fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523

Analysis

max time kernel
151s
max time network
147s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe
Size

2.0MB
MD5

0539d4fcc77c6376c899122568d4d267
SHA1

df5bce5cec0ca7e6e5279ff2339391abbf4dac24
SHA256

fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523
SHA512

70604463311b278618c707d9054e7b1e2511e2dce9ba8de3ebd293c52273c243588c4d293c47c87d10c1c0592da0f918891d5616b10fc52b3b38c3b73445054b
SSDEEP

24576:xKtveZAE3WsAv2lmi9az6DtLANew8spKC1c911pHH6wxsi3vYMZJSDzydsMBcwkc:xevMXC8Ip1pps1pnei3Xgssac6

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\kisknl.sys	kxescore.exe
File opened for modification	C:\Windows\SysWOW64\drivers\KAVBase.sys	KINSTALLERS_66_4430.exe
File created	C:\Windows\system32\drivers\bc.sys	KINSTALLERS_66_4430.exe
File created	C:\Windows\system32\drivers\kisknl64.sys	KINSTALLERS_66_4430.exe
File opened for modification	C:\Windows\SysWOW64\drivers\kisknl.sys	kxescore.exe
File created	C:\Windows\system32\drivers\kdhacker.sys	KINSTALLERS_66_4430.exe
File created	C:\Windows\system32\drivers\kdhacker64.sys	KINSTALLERS_66_4430.exe
File created	C:\Windows\system32\drivers\ksapi.sys	KINSTALLERS_66_4430.exe
File created	C:\Windows\system32\drivers\ksskrpr.sys	KINSTALLERS_66_4430.exe
File opened for modification	C:\Windows\system32\drivers\bc.sys	KINSTALLERS_66_4430.exe
File created	C:\Windows\system32\drivers\kavbootc.sys	KINSTALLERS_66_4430.exe
File created	C:\Windows\system32\drivers\kusbquery.sys	KINSTALLERS_66_4430.exe
File created	C:\Windows\system32\drivers\kusbquery64.sys	KINSTALLERS_66_4430.exe
File created	C:\Windows\system32\drivers\kavbootc64.sys	KINSTALLERS_66_4430.exe
File created	C:\Windows\system32\drivers\kisknl.sys	KINSTALLERS_66_4430.exe

Executes dropped EXE 10 IoCs

pid	Process
1888	KINSTALLERS_66_4430.exe
328	KINSTALLERS_66_4430.exe
1876	kavlog2.exe
1628	kxetray.exe
1796	kxescore.exe
1708	kislive.exe
1264	kxescore.exe
1612	kwsprotect64.exe
1212	Process not Found
1128	Process not Found

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32	KINSTALLERS_66_4430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu64.dll"	KINSTALLERS_66_4430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ThreadingModel = "Apartment"	KINSTALLERS_66_4430.exe

Sets file execution options in registry 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kdrvmgr.exe	KINSTALLERS_66_4430.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLIVE.EXE	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksetupwiz.exe	KINSTALLERS_66_4430.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSETUPWIZ.EXE	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scomregsvrv8.exe	KINSTALLERS_66_4430.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KDRVMGR.EXE	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kislive.exe	KINSTALLERS_66_4430.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISMAIN.EXE	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krecycle.exe	KINSTALLERS_66_4430.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSCAN.EXE	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kismain.exe	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kscan.exe	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninst.exe	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kisaddin.exe	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kiscall.exe	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxescore.exe	KINSTALLERS_66_4430.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KXETRAY.EXE	KINSTALLERS_66_4430.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVLOG2.EXE	KINSTALLERS_66_4430.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KXESCORE.EXE	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavlog2.exe	KINSTALLERS_66_4430.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISCALL.EXE	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksignsp.exe	KINSTALLERS_66_4430.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSIGNSP.EXE	KINSTALLERS_66_4430.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRECYCLE.EXE	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxetray.exe	KINSTALLERS_66_4430.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCOMREGSVRV8.EXE	KINSTALLERS_66_4430.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UNINST.EXE	KINSTALLERS_66_4430.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISADDIN.EXE	KINSTALLERS_66_4430.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\KDHacker\ImagePath = "\\??\\c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\security\\kxescan\\kdhacker64.sys"	kxescore.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000139db-59.dat	upx
behavioral1/files/0x00070000000139db-61.dat	upx
behavioral1/files/0x00070000000139db-65.dat	upx
behavioral1/files/0x00070000000139db-64.dat	upx
behavioral1/files/0x00070000000139db-63.dat	upx
behavioral1/memory/328-67-0x0000000000400000-0x000000000051C000-memory.dmp	upx
behavioral1/memory/328-171-0x0000000000400000-0x000000000051C000-memory.dmp	upx
behavioral1/memory/328-174-0x0000000000400000-0x000000000051C000-memory.dmp	upx

Loads dropped DLL 64 IoCs

pid	Process
1888	KINSTALLERS_66_4430.exe
328	KINSTALLERS_66_4430.exe
328	KINSTALLERS_66_4430.exe
328	KINSTALLERS_66_4430.exe
328	KINSTALLERS_66_4430.exe
328	KINSTALLERS_66_4430.exe
328	KINSTALLERS_66_4430.exe
328	KINSTALLERS_66_4430.exe
328	KINSTALLERS_66_4430.exe
328	KINSTALLERS_66_4430.exe
328	KINSTALLERS_66_4430.exe
328	KINSTALLERS_66_4430.exe
328	KINSTALLERS_66_4430.exe
328	KINSTALLERS_66_4430.exe
328	KINSTALLERS_66_4430.exe
1876	kavlog2.exe
1876	kavlog2.exe
328	KINSTALLERS_66_4430.exe
1876	kavlog2.exe
1876	kavlog2.exe
328	KINSTALLERS_66_4430.exe
328	KINSTALLERS_66_4430.exe
328	KINSTALLERS_66_4430.exe
1628	kxetray.exe
1628	kxetray.exe
1628	kxetray.exe
1628	kxetray.exe
1708	kislive.exe
1708	kislive.exe
1708	kislive.exe
1708	kislive.exe
1628	kxetray.exe
1708	kislive.exe
1708	kislive.exe
1796	kxescore.exe
1796	kxescore.exe
1796	kxescore.exe
1796	kxescore.exe
1264	kxescore.exe
1264	kxescore.exe
1708	kislive.exe
1264	kxescore.exe
1264	kxescore.exe
1264	kxescore.exe
1264	kxescore.exe
1264	kxescore.exe
1264	kxescore.exe
1264	kxescore.exe
1264	kxescore.exe
1264	kxescore.exe
1264	kxescore.exe
1264	kxescore.exe
1628	kxetray.exe
1628	kxetray.exe
1628	kxetray.exe
1612	kwsprotect64.exe
1264	kxescore.exe
532	IEXPLORE.EXE
1784	iexplore.exe
1784	iexplore.exe
532	IEXPLORE.EXE
532	IEXPLORE.EXE
1264	kxescore.exe
1264	kxescore.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	KINSTALLERS_66_4430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kxesc = "\"c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kxetray.exe\" -autorun"	KINSTALLERS_66_4430.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\desktop.ini	KINSTALLERS_66_4430.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\desktop.ini	KINSTALLERS_66_4430.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	kxetray.exe
File opened (read-only)	\??\U:	kxetray.exe
File opened (read-only)	\??\V:	kxetray.exe
File opened (read-only)	\??\Z:	kxetray.exe
File opened (read-only)	\??\M:	kxetray.exe
File opened (read-only)	\??\G:	kxetray.exe
File opened (read-only)	\??\H:	kxetray.exe
File opened (read-only)	\??\K:	kxetray.exe
File opened (read-only)	\??\N:	kxetray.exe
File opened (read-only)	\??\R:	kxetray.exe
File opened (read-only)	\??\S:	kxetray.exe
File opened (read-only)	\??\D:	kxetray.exe
File opened (read-only)	\??\E:	kxetray.exe
File opened (read-only)	\??\X:	kxetray.exe
File opened (read-only)	\??\Y:	kxetray.exe
File opened (read-only)	\??\Q:	kxetray.exe
File opened (read-only)	\??\I:	kxetray.exe
File opened (read-only)	\??\J:	kxetray.exe
File opened (read-only)	\??\L:	kxetray.exe
File opened (read-only)	\??\O:	kxetray.exe
File opened (read-only)	\??\T:	kxetray.exe
File opened (read-only)	\??\W:	kxetray.exe
File opened (read-only)	\??\F:	kxetray.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksde\kmctrl.dll	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kskinmgr.dll	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kwsui.dll	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisknl64.sys	KINSTALLERS_66_4430.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\krmcdm.krf	kxescore.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\shoujizhushou\data\apdev.dat	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\kplc.dat	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\jsonv6.dll	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ktoolupd.dll	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\webui\icon\bkgrdx.gif	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\shoujizhushou\shoujizhushou.exe	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kseutil.dll	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\shoujizhushou\drvinst64.exe	KINSTALLERS_66_4430.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\shoujizhushou\pubfiles.xml	KINSTALLERS_66_4430.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\shoujizhushou\sjk_daemon.exe	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\module.ini	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\data.fsg	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kupdata.exe	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\shoujizhushou\dpinst64.exe	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\shoujizhushou\keasyipc.dll	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\broplugver.ini	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\kpopcfg.config	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\khistory.ini	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\config\ksesysfiles.dat	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kusbhwl.dat	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\lpolicy.dat	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kcommonpid.kid	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kdrvmgr.exe	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\clear.xml	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kconfig.xml	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\ksskrpr.sys	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\shoujizhushou\sjk_daemon.exe	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\log\ksdectrl_trace.log	kxescore.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksde\ksdecs.dll	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\ksinst.dll	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kqsccfg.dat	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\shoujizhushou\kcomponent.dll	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\kws\icon\kws_safe.gif	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\quarantine.ini	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kfcdetect.dll	KINSTALLERS_66_4430.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\shoujizhushou\kcomponent.dll	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\kws\icon\knet.png	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kismain.exe	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\kismain.ini	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\bro.cfg	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kae\karchive.dat	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\shoujizhushou\kfmt.dat	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\shoujizhushou\adbwinusbapi.dll	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\kws\icon\commentbgsafelts.gif	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksde\deheurcfg.ini	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxebase.dll	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksapi.sys	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\shoujizhushou\kmobiletray.dll	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\ksscore.dll	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\shoujizhushou\kusbcore.dll	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\shoujizhushou\drvinst32.exe	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\khackfix.ini	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksetupwiz.exe	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kusbscan.dll	KINSTALLERS_66_4430.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kxesansp.dll	KINSTALLERS_66_4430.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\shoujizhushou\kinfoc.dll	KINSTALLERS_66_4430.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\shoujizhushou\dpinst64.exe	KINSTALLERS_66_4430.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\process.krf	kxescore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b4d72ab92f3880439d367e493124f922000000000200000000001066000000010000200000000693e1e46c851629ca10219b144b0e474bcbf63dcca03e99856fa8f904e8460f000000000e80000000020000200000003f80cee9b0831352b0520e996777f3cd32c5666bab5cb35528a46b5467b19f22900000001125b8a46eaf7f46982214f09719eee5f54759785f8e0c6827a46b343cf835b30099a9969c58c7414f56096b253aabd45e29c599bae9fef349214a5798ae9605c4a2463b465f7777d40206042955cf5205fbcece39cab9c6753fcc4071486cbf4cd8672c32df5daa8d0a47e98f5b9609105aa8d608b9d13f9eb5ad76fb2981852ac9d2dc52cdf54b95e44acdf18259db400000005d96e0c4bd4f0f6b502137a84b38ee87c1164ffb16c805b96e2f32b303febe32f7ddee15cdf46ef06100aca5744e8cccf90266229daf21974045de048fd1d79e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376623362"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{172DD1D1-7118-11ED-B68C-6A6CB2F85B9F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b4d72ab92f3880439d367e493124f9220000000002000000000010660000000100002000000028431a69980635a29b9c11f8adbc94af5f7e2085520e0722ad0cdbb3b7fb3840000000000e800000000200002000000091c1abed7c6f1ac7ff379d5a7f191db3ba82f0963e7982dc848a474ec5f566a6200000008e1ee2f03d8bfd801f1d742ddfb61aefacc2ffcdd60d7b4ce08fe3d94a11de6e4000000063a8f190cf04d1231048da50e3980b38db601115f332d9820df68a785353661fb03da4ca014ddf77fce1273cfc8cbc4d41957e0e2909fc2cf69a1de97738ea26	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b06a042505d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies registry class 34 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu64.dll"	KINSTALLERS_66_4430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ThreadingModel = "Apartment"	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\Shellex\ContextMenuHandlers\duba_64bit	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{372B851C-71B6-4fd3-9A23-30A4D1FFF178}	kxetray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32	KINSTALLERS_66_4430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\ = "CKavMenuShell Class"	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	KINSTALLERS_66_4430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1"	KINSTALLERS_66_4430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "d00d4ba1ebd71213d3caecffa531d3e8"	KINSTALLERS_66_4430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "e4lhhzao2dx5nihgxdjtbiu7vvvz"	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}	KINSTALLERS_66_4430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	KINSTALLERS_66_4430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "0"	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\Shellex\ContextMenuHandlers\duba_64bit	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}	KINSTALLERS_66_4430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu.dll"	KINSTALLERS_66_4430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_32bit	KINSTALLERS_66_4430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	KINSTALLERS_66_4430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Shellex\ContextMenuHandlers\duba_64bit	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_32bit	KINSTALLERS_66_4430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid	KINSTALLERS_66_4430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32	KINSTALLERS_66_4430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32\ThreadingModel = "Apartment"	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_32bit	KINSTALLERS_66_4430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	KINSTALLERS_66_4430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	kxescore.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe
1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe
1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe
1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe
1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe
1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe
1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe
1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe
328	KINSTALLERS_66_4430.exe
328	KINSTALLERS_66_4430.exe
1628	kxetray.exe
1628	kxetray.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
460	Process not Found
460	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	328	KINSTALLERS_66_4430.exe
Token: SeDebugPrivilege	1708	kislive.exe
Token: SeDebugPrivilege	1264	kxescore.exe
Token: SeDebugPrivilege	328	KINSTALLERS_66_4430.exe
Token: 33	1264	kxescore.exe
Token: SeIncBasePriorityPrivilege	1264	kxescore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1784	iexplore.exe
1628	kxetray.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1628	kxetray.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe
1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe
1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe
1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe
1784	iexplore.exe
1784	iexplore.exe
532	IEXPLORE.EXE
532	IEXPLORE.EXE
1612	kwsprotect64.exe
1612	kwsprotect64.exe
1628	kxetray.exe
532	IEXPLORE.EXE
532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1888	1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe	30
PID 1208 wrote to memory of 1888	1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe	30
PID 1208 wrote to memory of 1888	1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe	30
PID 1208 wrote to memory of 1888	1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe	30
PID 1208 wrote to memory of 1888	1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe	30
PID 1208 wrote to memory of 1888	1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe	30
PID 1208 wrote to memory of 1888	1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe	30
PID 1208 wrote to memory of 1784	1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe	31
PID 1208 wrote to memory of 1784	1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe	31
PID 1208 wrote to memory of 1784	1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe	31
PID 1208 wrote to memory of 1784	1208	fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe	31
PID 1784 wrote to memory of 532	1784	iexplore.exe	32
PID 1784 wrote to memory of 532	1784	iexplore.exe	32
PID 1784 wrote to memory of 532	1784	iexplore.exe	32
PID 1784 wrote to memory of 532	1784	iexplore.exe	32
PID 1888 wrote to memory of 328	1888	KINSTALLERS_66_4430.exe	33
PID 1888 wrote to memory of 328	1888	KINSTALLERS_66_4430.exe	33
PID 1888 wrote to memory of 328	1888	KINSTALLERS_66_4430.exe	33
PID 1888 wrote to memory of 328	1888	KINSTALLERS_66_4430.exe	33
PID 1888 wrote to memory of 328	1888	KINSTALLERS_66_4430.exe	33
PID 1888 wrote to memory of 328	1888	KINSTALLERS_66_4430.exe	33
PID 1888 wrote to memory of 328	1888	KINSTALLERS_66_4430.exe	33
PID 328 wrote to memory of 1876	328	KINSTALLERS_66_4430.exe	35
PID 328 wrote to memory of 1876	328	KINSTALLERS_66_4430.exe	35
PID 328 wrote to memory of 1876	328	KINSTALLERS_66_4430.exe	35
PID 328 wrote to memory of 1876	328	KINSTALLERS_66_4430.exe	35
PID 328 wrote to memory of 1876	328	KINSTALLERS_66_4430.exe	35
PID 328 wrote to memory of 1876	328	KINSTALLERS_66_4430.exe	35
PID 328 wrote to memory of 1876	328	KINSTALLERS_66_4430.exe	35
PID 328 wrote to memory of 1628	328	KINSTALLERS_66_4430.exe	36
PID 328 wrote to memory of 1628	328	KINSTALLERS_66_4430.exe	36
PID 328 wrote to memory of 1628	328	KINSTALLERS_66_4430.exe	36
PID 328 wrote to memory of 1628	328	KINSTALLERS_66_4430.exe	36
PID 328 wrote to memory of 1628	328	KINSTALLERS_66_4430.exe	36
PID 328 wrote to memory of 1628	328	KINSTALLERS_66_4430.exe	36
PID 328 wrote to memory of 1628	328	KINSTALLERS_66_4430.exe	36
PID 328 wrote to memory of 1796	328	KINSTALLERS_66_4430.exe	39
PID 328 wrote to memory of 1796	328	KINSTALLERS_66_4430.exe	39
PID 328 wrote to memory of 1796	328	KINSTALLERS_66_4430.exe	39
PID 328 wrote to memory of 1796	328	KINSTALLERS_66_4430.exe	39
PID 328 wrote to memory of 1796	328	KINSTALLERS_66_4430.exe	39
PID 328 wrote to memory of 1796	328	KINSTALLERS_66_4430.exe	39
PID 328 wrote to memory of 1796	328	KINSTALLERS_66_4430.exe	39
PID 328 wrote to memory of 1708	328	KINSTALLERS_66_4430.exe	38
PID 328 wrote to memory of 1708	328	KINSTALLERS_66_4430.exe	38
PID 328 wrote to memory of 1708	328	KINSTALLERS_66_4430.exe	38
PID 328 wrote to memory of 1708	328	KINSTALLERS_66_4430.exe	38
PID 328 wrote to memory of 1708	328	KINSTALLERS_66_4430.exe	38
PID 328 wrote to memory of 1708	328	KINSTALLERS_66_4430.exe	38
PID 328 wrote to memory of 1708	328	KINSTALLERS_66_4430.exe	38
PID 1628 wrote to memory of 1612	1628	kxetray.exe	41
PID 1628 wrote to memory of 1612	1628	kxetray.exe	41
PID 1628 wrote to memory of 1612	1628	kxetray.exe	41
PID 1628 wrote to memory of 1612	1628	kxetray.exe	41

C:\Users\Admin\AppData\Local\Temp\fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe
"C:\Users\Admin\AppData\Local\Temp\fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208
- C:\KINSTALLERS_66_4430.exe
  \KINSTALLERS_66_4430.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_66_4430.exe
    "C:\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_66_4430.exe" /s
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Registers COM server for autorun
    - Sets file execution options in registry
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:328
  - - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe
      "c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe" -install
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1876
  - - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe
      "c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe" /autorun
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1628
    - - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kwsprotect64.exe
        
        "c:\program files (x86)\kingsoft\kingsoft antivirus\kwsprotect64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1612
  - - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe
      "c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe" /autorun /std /skipcs3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:1708
  - - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe
      "c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe" /start kxescore
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1796
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" www.cfbingyue.com
  2⤵
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1784 CREDAT:275457 /prefetch:2
    3⤵
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:532

\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe
"c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe" /service kxescore
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Sets service image path in registry
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\KINSTALLERS_66_4430.exe

Filesize
58KB

MD5
1915689cf3a859e46042a10afdf1a0dd

SHA1
873ccfc9bf4130a87fb0804cd27dc7eb11fbe4e0

SHA256
84cc37ec6849e5634ed80fd1feebc54d7cbf183923a86369dde62a66afa7f259

SHA512
fa375057475a05c170eee26516e38f3ef35d22fb649caff25ff4bf000bebb48d6286a6689509a11488d1355d9d7a3d910b40ff182455152bd23726a7dfc899fe

Download Submit
C:\KINSTALLERS_66_4430.exe

Filesize
58KB

MD5
1915689cf3a859e46042a10afdf1a0dd

SHA1
873ccfc9bf4130a87fb0804cd27dc7eb11fbe4e0

SHA256
84cc37ec6849e5634ed80fd1feebc54d7cbf183923a86369dde62a66afa7f259

SHA512
fa375057475a05c170eee26516e38f3ef35d22fb649caff25ff4bf000bebb48d6286a6689509a11488d1355d9d7a3d910b40ff182455152bd23726a7dfc899fe

Download Submit
C:\Program Files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe

Filesize
490KB

MD5
9b773fe403c07b1126c48784e51fe223

SHA1
6f0bdd3b5bfd2cab7a859bf395f57728f808b776

SHA256
99fe3741defcff0910dc415e382c6a58c8fd84617c7b219c2160aa8f54ffa7d1

SHA512
13a898b86bb0990181655e9de35f48fe418b3238bdc00f917cca727fcdbfbc661d3cee95da06b32970d259a6e3e1b70e0df02cf75ed530397154a55627a6dbf1

Download Submit
C:\Program Files (x86)\kingsoft\kingsoft antivirus\kislive.exe

Filesize
678KB

MD5
49e148faf71deabfc2d974ca63f20f22

SHA1
f21c708a84e40e9f00d922ac683be89872d72a0d

SHA256
1c04ea4234ec7465c827cc26cecedfe5ec9d33d89ee67f49c3f6d86e0fd8233c

SHA512
389b7416e86be98d956019a14f62b34707945c15cc41a6daa6f58d106dd9f0bf4f67d563aff7af5928e72f4d0819680c13afa9b072f980101d11eb416949b7a2

Download Submit
C:\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

Filesize
164KB

MD5
5caa87154c5e49499b03341fe0a9203e

SHA1
276aa388cac4acf4abe2c309d6526c80883c8d94

SHA256
0d7d445b6c864c3c8e3a4e92a10ef5b8d5b40737aa58126fb836aacd993cfdf6

SHA512
211eab4d0a645fdf2a5f7eb8971d8f08ce00c9b6b127b79ef6afd40481ff0cc17205785d4befecc03a1d4258fc54bc924e5ad572f7b94ffa3a98d931a48b657e

Download Submit
C:\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

Filesize
164KB

MD5
5caa87154c5e49499b03341fe0a9203e

SHA1
276aa388cac4acf4abe2c309d6526c80883c8d94

SHA256
0d7d445b6c864c3c8e3a4e92a10ef5b8d5b40737aa58126fb836aacd993cfdf6

SHA512
211eab4d0a645fdf2a5f7eb8971d8f08ce00c9b6b127b79ef6afd40481ff0cc17205785d4befecc03a1d4258fc54bc924e5ad572f7b94ffa3a98d931a48b657e

Download Submit
C:\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

Filesize
1.2MB

MD5
593a7177f156c406753edfc59fd0fa17

SHA1
93d9c1e294779cdfe14be6d9659831b5d396c008

SHA256
bfbf5845aa4a3e62ca308fda905e7469bc0b9a21c03b02c5e5bdeaedfe3e508b

SHA512
444aedd05fa9034a7801a3df6f41d23d4dcab84e89289f7f2df1cc1dcec74e38703c22ac65e88559159adc70055a6f4e22e1e934d6266667e522952b4499d395

Download Submit
C:\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_66_4430.exe

Filesize
18.6MB

MD5
42ff95573244a90bd7f7df9ef4c9a8db

SHA1
4fe2fb20f71e1450bf4c61d7ac8616e58ac96cae

SHA256
082a1e4608214a86e5f463862775d0b53f1b96d4a8e4158ce9464d207b6e7697

SHA512
5112b03a3cb739246fd008ff7cf6a763e82d606b3d607c57c7edf544e74169c4505c4ea838c5853a95abfe6ab1d8acbafbe5fd608960596537389ab4170557d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_66_4430.exe

Filesize
18.6MB

MD5
42ff95573244a90bd7f7df9ef4c9a8db

SHA1
4fe2fb20f71e1450bf4c61d7ac8616e58ac96cae

SHA256
082a1e4608214a86e5f463862775d0b53f1b96d4a8e4158ce9464d207b6e7697

SHA512
5112b03a3cb739246fd008ff7cf6a763e82d606b3d607c57c7edf544e74169c4505c4ea838c5853a95abfe6ab1d8acbafbe5fd608960596537389ab4170557d7

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\MSVCP80.dll

Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\MSVCR80.dll

Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kavevent.dll

Filesize
90KB

MD5
80f899ca024ddcf5218a4fadeacaec54

SHA1
2756821bde2d8eb44b04da63afbf5496565ddf71

SHA256
2a0d8c0778ef91c5e9f7ffac47a0e49a4055d50556895822d84adcbce9375c17

SHA512
ae871718f3eb2bcdd4bc6d41a691e9684a98a022d0db9d9444470820847e648e369a5f0c7887dc31d6ffa51572634345fe2448c1defe8535eb79c30f8202f41f

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe

Filesize
678KB

MD5
49e148faf71deabfc2d974ca63f20f22

SHA1
f21c708a84e40e9f00d922ac683be89872d72a0d

SHA256
1c04ea4234ec7465c827cc26cecedfe5ec9d33d89ee67f49c3f6d86e0fd8233c

SHA512
389b7416e86be98d956019a14f62b34707945c15cc41a6daa6f58d106dd9f0bf4f67d563aff7af5928e72f4d0819680c13afa9b072f980101d11eb416949b7a2

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kpopclt.dll

Filesize
206KB

MD5
8acd62949443cf36b3db239bb20fd244

SHA1
802c4bb757579bd6a679510b0834a9ebd38ed21e

SHA256
2e38b4541e78f12061f0b11ff80a24112acb71768d9b3f0df74ee0d72141e81b

SHA512
689000576e7a5a98a11de00859a5275b10f3348ba2889be04ee68894d704c591df8a210cb1353f0a2af540dc16eee46fd8da7be31e1082ebc433d1c538e2a846

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kskinmgr.dll

Filesize
1.2MB

MD5
0e1d9a1ede63e5a17ff67560b0c9907d

SHA1
862a3096f2c3ab9a3ece20c094ddb53b646bf1db

SHA256
d50621aba143b3ddfac3d16a5c9e29280a9477c23b4d7988ed9a200996cf3aab

SHA512
ec088a489fd494a269eae5185ddae4712bc83810d59e8905e97134c4f8e009854c016d4daa8bf55eaed363914cc8f8f79fa2088ac0a2fabed9546a45e63950c8

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

Filesize
164KB

MD5
5caa87154c5e49499b03341fe0a9203e

SHA1
276aa388cac4acf4abe2c309d6526c80883c8d94

SHA256
0d7d445b6c864c3c8e3a4e92a10ef5b8d5b40737aa58126fb836aacd993cfdf6

SHA512
211eab4d0a645fdf2a5f7eb8971d8f08ce00c9b6b127b79ef6afd40481ff0cc17205785d4befecc03a1d4258fc54bc924e5ad572f7b94ffa3a98d931a48b657e

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore_sp.xcf

Filesize
87B

MD5
47f61d0f7bd830f5bfe72c3b65941fde

SHA1
d7f440877e23679fd2c480dff2b8f3219702d681

SHA256
eb09cf1094904f0d3038ce1e981fd4366eba4000c8b6f13a3dbbaefea4797e37

SHA512
d234f17af1440aba1a4f6c2b24d04fdeb3a685f25f391cdc1ac048dfed1b470689bed5b21d7b3db94f9186445932982f462bbee8af919c1a957ab89bd69e68f5

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

Filesize
1.2MB

MD5
593a7177f156c406753edfc59fd0fa17

SHA1
93d9c1e294779cdfe14be6d9659831b5d396c008

SHA256
bfbf5845aa4a3e62ca308fda905e7469bc0b9a21c03b02c5e5bdeaedfe3e508b

SHA512
444aedd05fa9034a7801a3df6f41d23d4dcab84e89289f7f2df1cc1dcec74e38703c22ac65e88559159adc70055a6f4e22e1e934d6266667e522952b4499d395

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\operation\cas\kctrl.dat

Filesize
1KB

MD5
f596ddc3f7cf74175a1ed766b412d147

SHA1
efe4b46eed0c910a5ff8407506750047cfdfb93a

SHA256
3dce4ca31f74798638655017dd2742f93d075910bd97363bb837a87758776898

SHA512
55b42bf8d4d5f6454b752e8843e0acc3b56e01b2dea85b7c34996efd24baab470d1171d00d004ec28638ef4277ac67334e0b0dfc6eedf8761adf0420b4ac6818

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\operation\cas\kfmt.datx

Filesize
44KB

MD5
993e4a86486505e01592663e29696b69

SHA1
1c40b31f43d9cba8d98c50a15a07e8acdd401cbe

SHA256
8dc71438b6b1ed7f342239e0b8c7f7802ace67eed99a02e0dbeba166f14fa12e

SHA512
05171694fe11affa34c41b8213fd2abfa526f1d7b92aeded67fc64e8750139906400cf62307b2c2ba43a153bf4780a020b40d03c4629495876dbbe8c65fb4535

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\operation\cas\kinfoc.dll

Filesize
298KB

MD5
009aefc592b99c2ab5bd6cfe09fbb927

SHA1
9676a6fec5d8f6f1a22ed704e0ba466a7b2e96b4

SHA256
9f605fd88ee390e983cf2ce290865a5645d031750d42b4609c23990cac1abddd

SHA512
72e4cb35ede62f1f1bb92503ae428847916a24d1694bdbdf0469b9b09ce9e88c26908262f0e30e2b4a2946b3010a816c27c136621dda3d2c3a3eb28911225e44

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\kismain.ini

Filesize
68B

MD5
454d5f48380c0c3bb3a11da001cab793

SHA1
1538cddae94ad0b131f6446a44d3d866280706ae

SHA256
7a07a29a6b91d143473fe7a2d9591b55ffd47f29d6a038d1f316efe057991cb6

SHA512
16b831762d7ce0ca15a15259f2bb3e748a6655f7f8fef8510369b419a456e3dd7236b284bffa5cce96bc3928ad10b8a6b3777a78838927d39944298f738c8742

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\uplive.svr

Filesize
3KB

MD5
e302e1b7d41f2d41cf926242d693dd87

SHA1
f0c75c85fa80a13822775d0093ba34b5961fb208

SHA256
c83343a6aa3645c1155ea1ee224f5c3fe8867e174ad46da92abaa139d12ea74e

SHA512
adec4c968f3510ee81c4a54bfffa39244e0e0fb12a24d06c7921d1902352d827ebb5508d5dac13cbc5469591976607885937951eab876a054710c81f52efe811

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavevent.dll

Filesize
90KB

MD5
80f899ca024ddcf5218a4fadeacaec54

SHA1
2756821bde2d8eb44b04da63afbf5496565ddf71

SHA256
2a0d8c0778ef91c5e9f7ffac47a0e49a4055d50556895822d84adcbce9375c17

SHA512
ae871718f3eb2bcdd4bc6d41a691e9684a98a022d0db9d9444470820847e648e369a5f0c7887dc31d6ffa51572634345fe2448c1defe8535eb79c30f8202f41f

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe

Filesize
490KB

MD5
9b773fe403c07b1126c48784e51fe223

SHA1
6f0bdd3b5bfd2cab7a859bf395f57728f808b776

SHA256
99fe3741defcff0910dc415e382c6a58c8fd84617c7b219c2160aa8f54ffa7d1

SHA512
13a898b86bb0990181655e9de35f48fe418b3238bdc00f917cca727fcdbfbc661d3cee95da06b32970d259a6e3e1b70e0df02cf75ed530397154a55627a6dbf1

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe

Filesize
490KB

MD5
9b773fe403c07b1126c48784e51fe223

SHA1
6f0bdd3b5bfd2cab7a859bf395f57728f808b776

SHA256
99fe3741defcff0910dc415e382c6a58c8fd84617c7b219c2160aa8f54ffa7d1

SHA512
13a898b86bb0990181655e9de35f48fe418b3238bdc00f917cca727fcdbfbc661d3cee95da06b32970d259a6e3e1b70e0df02cf75ed530397154a55627a6dbf1

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe

Filesize
490KB

MD5
9b773fe403c07b1126c48784e51fe223

SHA1
6f0bdd3b5bfd2cab7a859bf395f57728f808b776

SHA256
99fe3741defcff0910dc415e382c6a58c8fd84617c7b219c2160aa8f54ffa7d1

SHA512
13a898b86bb0990181655e9de35f48fe418b3238bdc00f917cca727fcdbfbc661d3cee95da06b32970d259a6e3e1b70e0df02cf75ed530397154a55627a6dbf1

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe

Filesize
490KB

MD5
9b773fe403c07b1126c48784e51fe223

SHA1
6f0bdd3b5bfd2cab7a859bf395f57728f808b776

SHA256
99fe3741defcff0910dc415e382c6a58c8fd84617c7b219c2160aa8f54ffa7d1

SHA512
13a898b86bb0990181655e9de35f48fe418b3238bdc00f917cca727fcdbfbc661d3cee95da06b32970d259a6e3e1b70e0df02cf75ed530397154a55627a6dbf1

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavmenu.dll

Filesize
43KB

MD5
d32bef39d9e1439a1331e806cdf18f9f

SHA1
cc853d2fc89e779b541835d035fd05fa7cc339f2

SHA256
25bba853799d7681bcbe8258a7777d8faf7e0a41645cbaa1fc702c4e222fd712

SHA512
b0f7182a5e14d946ee69ce6f24271db08acfc457a0e71eb9dd242d812fd3c3210f382d9b3117ed9594ba43d9994324eb2b840214bfbbacbb78a77d6b81a04a17

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kislive.exe

Filesize
678KB

MD5
49e148faf71deabfc2d974ca63f20f22

SHA1
f21c708a84e40e9f00d922ac683be89872d72a0d

SHA256
1c04ea4234ec7465c827cc26cecedfe5ec9d33d89ee67f49c3f6d86e0fd8233c

SHA512
389b7416e86be98d956019a14f62b34707945c15cc41a6daa6f58d106dd9f0bf4f67d563aff7af5928e72f4d0819680c13afa9b072f980101d11eb416949b7a2

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kislive.exe

Filesize
678KB

MD5
49e148faf71deabfc2d974ca63f20f22

SHA1
f21c708a84e40e9f00d922ac683be89872d72a0d

SHA256
1c04ea4234ec7465c827cc26cecedfe5ec9d33d89ee67f49c3f6d86e0fd8233c

SHA512
389b7416e86be98d956019a14f62b34707945c15cc41a6daa6f58d106dd9f0bf4f67d563aff7af5928e72f4d0819680c13afa9b072f980101d11eb416949b7a2

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kislive.exe

Filesize
678KB

MD5
49e148faf71deabfc2d974ca63f20f22

SHA1
f21c708a84e40e9f00d922ac683be89872d72a0d

SHA256
1c04ea4234ec7465c827cc26cecedfe5ec9d33d89ee67f49c3f6d86e0fd8233c

SHA512
389b7416e86be98d956019a14f62b34707945c15cc41a6daa6f58d106dd9f0bf4f67d563aff7af5928e72f4d0819680c13afa9b072f980101d11eb416949b7a2

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kismain.exe

Filesize
48KB

MD5
4c4f23290c3be3b0316c76879a6e2a7f

SHA1
1cd2667fe62b42b2476ea6da22b93c565369dc0f

SHA256
1ca3e7064d9dd86c42f62286b958db26065272fccd9fb37416b64981e2d28de0

SHA512
8e14538656a778411746917c545a964485683c403684bde4a2ee0d09c1760ca00f1d10cf2cb0e875edc624ba0bbe3636f68b24fdf50aeb26d482dda9c4b9ae3a

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kismain.exe

Filesize
48KB

MD5
4c4f23290c3be3b0316c76879a6e2a7f

SHA1
1cd2667fe62b42b2476ea6da22b93c565369dc0f

SHA256
1ca3e7064d9dd86c42f62286b958db26065272fccd9fb37416b64981e2d28de0

SHA512
8e14538656a778411746917c545a964485683c403684bde4a2ee0d09c1760ca00f1d10cf2cb0e875edc624ba0bbe3636f68b24fdf50aeb26d482dda9c4b9ae3a

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kpopclt.dll

Filesize
206KB

MD5
8acd62949443cf36b3db239bb20fd244

SHA1
802c4bb757579bd6a679510b0834a9ebd38ed21e

SHA256
2e38b4541e78f12061f0b11ff80a24112acb71768d9b3f0df74ee0d72141e81b

SHA512
689000576e7a5a98a11de00859a5275b10f3348ba2889be04ee68894d704c591df8a210cb1353f0a2af540dc16eee46fd8da7be31e1082ebc433d1c538e2a846

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\krecycle.exe

Filesize
466KB

MD5
5de709d7b66526520395c869a09e7398

SHA1
5a3413ec8b6b240bf3c6163458d104ac79618b0e

SHA256
c2a92dd073d393bd934bda4192dd76803dbc3b9d20b7ba02b1454ff4b31aac2f

SHA512
634f47b809aacb1f53fcbaacaf304c1f65dd133c761b9614b110574d1392205cbfec06272cdc28f6276dcbe1d4f82d7f2fe97a3f233bf419352e7365efaaf93e

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kskinmgr.dll

Filesize
1.2MB

MD5
0e1d9a1ede63e5a17ff67560b0c9907d

SHA1
862a3096f2c3ab9a3ece20c094ddb53b646bf1db

SHA256
d50621aba143b3ddfac3d16a5c9e29280a9477c23b4d7988ed9a200996cf3aab

SHA512
ec088a489fd494a269eae5185ddae4712bc83810d59e8905e97134c4f8e009854c016d4daa8bf55eaed363914cc8f8f79fa2088ac0a2fabed9546a45e63950c8

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

Filesize
164KB

MD5
5caa87154c5e49499b03341fe0a9203e

SHA1
276aa388cac4acf4abe2c309d6526c80883c8d94

SHA256
0d7d445b6c864c3c8e3a4e92a10ef5b8d5b40737aa58126fb836aacd993cfdf6

SHA512
211eab4d0a645fdf2a5f7eb8971d8f08ce00c9b6b127b79ef6afd40481ff0cc17205785d4befecc03a1d4258fc54bc924e5ad572f7b94ffa3a98d931a48b657e

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

Filesize
164KB

MD5
5caa87154c5e49499b03341fe0a9203e

SHA1
276aa388cac4acf4abe2c309d6526c80883c8d94

SHA256
0d7d445b6c864c3c8e3a4e92a10ef5b8d5b40737aa58126fb836aacd993cfdf6

SHA512
211eab4d0a645fdf2a5f7eb8971d8f08ce00c9b6b127b79ef6afd40481ff0cc17205785d4befecc03a1d4258fc54bc924e5ad572f7b94ffa3a98d931a48b657e

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

Filesize
164KB

MD5
5caa87154c5e49499b03341fe0a9203e

SHA1
276aa388cac4acf4abe2c309d6526c80883c8d94

SHA256
0d7d445b6c864c3c8e3a4e92a10ef5b8d5b40737aa58126fb836aacd993cfdf6

SHA512
211eab4d0a645fdf2a5f7eb8971d8f08ce00c9b6b127b79ef6afd40481ff0cc17205785d4befecc03a1d4258fc54bc924e5ad572f7b94ffa3a98d931a48b657e

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

Filesize
164KB

MD5
5caa87154c5e49499b03341fe0a9203e

SHA1
276aa388cac4acf4abe2c309d6526c80883c8d94

SHA256
0d7d445b6c864c3c8e3a4e92a10ef5b8d5b40737aa58126fb836aacd993cfdf6

SHA512
211eab4d0a645fdf2a5f7eb8971d8f08ce00c9b6b127b79ef6afd40481ff0cc17205785d4befecc03a1d4258fc54bc924e5ad572f7b94ffa3a98d931a48b657e

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

Filesize
1.2MB

MD5
593a7177f156c406753edfc59fd0fa17

SHA1
93d9c1e294779cdfe14be6d9659831b5d396c008

SHA256
bfbf5845aa4a3e62ca308fda905e7469bc0b9a21c03b02c5e5bdeaedfe3e508b

SHA512
444aedd05fa9034a7801a3df6f41d23d4dcab84e89289f7f2df1cc1dcec74e38703c22ac65e88559159adc70055a6f4e22e1e934d6266667e522952b4499d395

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

Filesize
1.2MB

MD5
593a7177f156c406753edfc59fd0fa17

SHA1
93d9c1e294779cdfe14be6d9659831b5d396c008

SHA256
bfbf5845aa4a3e62ca308fda905e7469bc0b9a21c03b02c5e5bdeaedfe3e508b

SHA512
444aedd05fa9034a7801a3df6f41d23d4dcab84e89289f7f2df1cc1dcec74e38703c22ac65e88559159adc70055a6f4e22e1e934d6266667e522952b4499d395

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

Filesize
1.2MB

MD5
593a7177f156c406753edfc59fd0fa17

SHA1
93d9c1e294779cdfe14be6d9659831b5d396c008

SHA256
bfbf5845aa4a3e62ca308fda905e7469bc0b9a21c03b02c5e5bdeaedfe3e508b

SHA512
444aedd05fa9034a7801a3df6f41d23d4dcab84e89289f7f2df1cc1dcec74e38703c22ac65e88559159adc70055a6f4e22e1e934d6266667e522952b4499d395

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

Filesize
1.2MB

MD5
593a7177f156c406753edfc59fd0fa17

SHA1
93d9c1e294779cdfe14be6d9659831b5d396c008

SHA256
bfbf5845aa4a3e62ca308fda905e7469bc0b9a21c03b02c5e5bdeaedfe3e508b

SHA512
444aedd05fa9034a7801a3df6f41d23d4dcab84e89289f7f2df1cc1dcec74e38703c22ac65e88559159adc70055a6f4e22e1e934d6266667e522952b4499d395

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcp80.dll

Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcp80.dll

Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcp80.dll

Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcp80.dll

Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcp80.dll

Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcr80.dll

Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcr80.dll

Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcr80.dll

Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcr80.dll

Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcr80.dll

Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\operation\cas\kinfoc.dll

Filesize
298KB

MD5
009aefc592b99c2ab5bd6cfe09fbb927

SHA1
9676a6fec5d8f6f1a22ed704e0ba466a7b2e96b4

SHA256
9f605fd88ee390e983cf2ce290865a5645d031750d42b4609c23990cac1abddd

SHA512
72e4cb35ede62f1f1bb92503ae428847916a24d1694bdbdf0469b9b09ce9e88c26908262f0e30e2b4a2946b3010a816c27c136621dda3d2c3a3eb28911225e44

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\security\kavbootc.sys

Filesize
26KB

MD5
a16b3c62473f0eb6b25d3fe01d94d20a

SHA1
574228836ef2bd07d128108ee2cbb372cbf7a4a8

SHA256
e115909cb4707f1895e69ef9e608ff8ee10fead21ac1c6c7b3148fc998e2355d

SHA512
a07bd7312bda0062b5e45d84b3494a3912a014ae4c50e69f57895f5625c14498bd38104087020b51f745be3ff2a86bb0c27313c6dbb8969765ffe28225ca3fb6

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\security\kavbootc.sys

Filesize
26KB

MD5
a16b3c62473f0eb6b25d3fe01d94d20a

SHA1
574228836ef2bd07d128108ee2cbb372cbf7a4a8

SHA256
e115909cb4707f1895e69ef9e608ff8ee10fead21ac1c6c7b3148fc998e2355d

SHA512
a07bd7312bda0062b5e45d84b3494a3912a014ae4c50e69f57895f5625c14498bd38104087020b51f745be3ff2a86bb0c27313c6dbb8969765ffe28225ca3fb6

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisknl.sys

Filesize
177KB

MD5
633eb9d80d2d9db7eaeb6860bc6bec6e

SHA1
442daec6ff786e64cc0cecd2a581bd50fedf905a

SHA256
0ca2860e25746409b786db01104e823d5d2386b726602f09fdae885e7bdb389c

SHA512
6b0f47ceba0ae4f61c4b5c3ec2435e6d36fb9bb74a220ce4da1e3d9233d5136d795c69949093f46c0249d806383c32e729db27eccd00bd9b5dc7f40a074126c7

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisknl.sys

Filesize
177KB

MD5
633eb9d80d2d9db7eaeb6860bc6bec6e

SHA1
442daec6ff786e64cc0cecd2a581bd50fedf905a

SHA256
0ca2860e25746409b786db01104e823d5d2386b726602f09fdae885e7bdb389c

SHA512
6b0f47ceba0ae4f61c4b5c3ec2435e6d36fb9bb74a220ce4da1e3d9233d5136d795c69949093f46c0249d806383c32e729db27eccd00bd9b5dc7f40a074126c7

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\uni0nst.exe

Filesize
1.0MB

MD5
6107de5d840803f1145620cb74c5407d

SHA1
050699ad40120f10cb936b276b4627868bcf3dab

SHA256
28a11841a177031a608140e21626fd44b029c54659c9d40dc63e30b38058c625

SHA512
e6346be1171094386ddde18ad4736bfff7d75c312d58e8fc942a262edc15435b2fa79a9c515984dc8a2086ccefae8d1c071e30ddc12c2a4905bd27497b199f2a

Download Submit
\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_66_4430.exe

Filesize
18.6MB

MD5
42ff95573244a90bd7f7df9ef4c9a8db

SHA1
4fe2fb20f71e1450bf4c61d7ac8616e58ac96cae

SHA256
082a1e4608214a86e5f463862775d0b53f1b96d4a8e4158ce9464d207b6e7697

SHA512
5112b03a3cb739246fd008ff7cf6a763e82d606b3d607c57c7edf544e74169c4505c4ea838c5853a95abfe6ab1d8acbafbe5fd608960596537389ab4170557d7

Download Submit
\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_66_4430.exe

Filesize
18.6MB

MD5
42ff95573244a90bd7f7df9ef4c9a8db

SHA1
4fe2fb20f71e1450bf4c61d7ac8616e58ac96cae

SHA256
082a1e4608214a86e5f463862775d0b53f1b96d4a8e4158ce9464d207b6e7697

SHA512
5112b03a3cb739246fd008ff7cf6a763e82d606b3d607c57c7edf544e74169c4505c4ea838c5853a95abfe6ab1d8acbafbe5fd608960596537389ab4170557d7

Download Submit
\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_66_4430.exe

Filesize
18.6MB

MD5
42ff95573244a90bd7f7df9ef4c9a8db

SHA1
4fe2fb20f71e1450bf4c61d7ac8616e58ac96cae

SHA256
082a1e4608214a86e5f463862775d0b53f1b96d4a8e4158ce9464d207b6e7697

SHA512
5112b03a3cb739246fd008ff7cf6a763e82d606b3d607c57c7edf544e74169c4505c4ea838c5853a95abfe6ab1d8acbafbe5fd608960596537389ab4170557d7

Download Submit
memory/328-174-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/328-67-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/328-73-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download
memory/328-75-0x0000000004070000-0x00000000040B8000-memory.dmp

Filesize
288KB

Download
memory/328-68-0x0000000000980000-0x0000000000A9C000-memory.dmp

Filesize
1.1MB

Download
memory/328-76-0x0000000004070000-0x00000000040B8000-memory.dmp

Filesize
288KB

Download
memory/328-170-0x0000000000980000-0x0000000000A9C000-memory.dmp

Filesize
1.1MB

Download
memory/328-171-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/328-74-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download
memory/328-66-0x0000000000980000-0x0000000000A9C000-memory.dmp

Filesize
1.1MB

Download
memory/1208-54-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/1264-177-0x0000000001C90000-0x0000000001CA9000-memory.dmp

Filesize
100KB

Download
memory/1264-161-0x0000000001190000-0x00000000011AA000-memory.dmp

Filesize
104KB

Download
memory/1264-175-0x0000000004B70000-0x0000000004BE2000-memory.dmp

Filesize
456KB

Download
memory/1264-172-0x0000000003310000-0x000000000335D000-memory.dmp

Filesize
308KB

Download
memory/1264-168-0x0000000003CC0000-0x0000000003D34000-memory.dmp

Filesize
464KB

Download
memory/1264-141-0x0000000000BA0000-0x0000000000BCA000-memory.dmp

Filesize
168KB

Download
memory/1264-143-0x0000000000160000-0x000000000016E000-memory.dmp

Filesize
56KB

Download
memory/1264-144-0x0000000001160000-0x000000000118B000-memory.dmp

Filesize
172KB

Download
memory/1264-146-0x0000000000D10000-0x0000000000D24000-memory.dmp

Filesize
80KB

Download
memory/1264-147-0x0000000001040000-0x0000000001052000-memory.dmp

Filesize
72KB

Download
memory/1264-166-0x0000000003200000-0x0000000003256000-memory.dmp

Filesize
344KB

Download
memory/1264-164-0x0000000002FC0000-0x000000000306D000-memory.dmp

Filesize
692KB

Download
memory/1264-162-0x0000000002CB0000-0x0000000002D49000-memory.dmp

Filesize
612KB

Download
memory/1264-155-0x0000000002E90000-0x0000000002FBB000-memory.dmp

Filesize
1.2MB

Download
memory/1264-159-0x0000000001920000-0x0000000001961000-memory.dmp

Filesize
260KB

Download
memory/1628-187-0x0000000003390000-0x00000000033C7000-memory.dmp

Filesize
220KB

Download
memory/1628-184-0x0000000003000000-0x00000000030EE000-memory.dmp

Filesize
952KB

Download
memory/1628-181-0x0000000002A90000-0x0000000002AE6000-memory.dmp

Filesize
344KB

Download
memory/1628-192-0x0000000004C90000-0x0000000004D73000-memory.dmp

Filesize
908KB

Download
memory/1628-120-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1628-191-0x00000000041B0000-0x00000000041BE000-memory.dmp

Filesize
56KB

Download
memory/1628-154-0x0000000002A10000-0x0000000002A8E000-memory.dmp

Filesize
504KB

Download
memory/1628-189-0x0000000004700000-0x00000000048C6000-memory.dmp

Filesize
1.8MB

Download
memory/1628-183-0x0000000002F60000-0x0000000002FF9000-memory.dmp

Filesize
612KB

Download
memory/1628-196-0x00000000041E0000-0x00000000041EE000-memory.dmp

Filesize
56KB

Download
memory/1628-179-0x0000000002B40000-0x0000000002E5F000-memory.dmp

Filesize
3.1MB

Download
memory/1628-197-0x0000000005220000-0x000000000524A000-memory.dmp

Filesize
168KB

Download
memory/1628-194-0x0000000004FC0000-0x0000000005218000-memory.dmp

Filesize
2.3MB

Download
memory/1628-186-0x0000000003890000-0x00000000039CE000-memory.dmp

Filesize
1.2MB

Download
memory/1628-153-0x0000000002A11000-0x0000000002A71000-memory.dmp

Filesize
384KB

Download
memory/1708-126-0x0000000002040000-0x000000000205A000-memory.dmp

Filesize
104KB

Download
memory/1708-140-0x0000000002A80000-0x0000000002BBE000-memory.dmp

Filesize
1.2MB

Download