307b3a1fbd441e54934284c21e0db78b5ec417e9f0e1c3bfa45dcca94196261e

Analysis

max time kernel
155s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25bd57a1034c3e7b57846255aa285077.exe
Size

899KB
MD5

25bd57a1034c3e7b57846255aa285077
SHA1

6918a5793d54906c3c120dc9d348c7d72b249423
SHA256

307b3a1fbd441e54934284c21e0db78b5ec417e9f0e1c3bfa45dcca94196261e
SHA512

7cc0695a626887ce7d752e1df44a84d329f0d90f11e7b3ee84dc2f1d3dd47a2f54bf24f356dccd378e2e9b37790294d860ed2822dfc409dd2bafaa44c232575f
SSDEEP

24576:2Ms1/QkXzu4zzB6fJ2dM3snVAFQf3w7yKS:rcokXzu4XBCoe3sV9Gyf

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	25bd57a1034c3e7b57846255aa285077.exe

Executes dropped EXE 6 IoCs

pid	Process
3008	KSWebShield.exe
2328	KSWebShield.exe
1156	KSWebShield.exe
3224	KSWebShield.exe
3272	KSWebShield.exe
2452	KSWebShield.exe

Loads dropped DLL 19 IoCs

pid	Process
1156	KSWebShield.exe
3224	KSWebShield.exe
3224	KSWebShield.exe
3224	KSWebShield.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4056	IEXPLORE.EXE
4056	IEXPLORE.EXE
4056	IEXPLORE.EXE
4056	IEXPLORE.EXE
4596	IEXPLORE.EXE
4596	IEXPLORE.EXE
4596	IEXPLORE.EXE
4596	IEXPLORE.EXE
752	IEXPLORE.EXE
752	IEXPLORE.EXE
752	IEXPLORE.EXE
752	IEXPLORE.EXE

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	25bd57a1034c3e7b57846255aa285077.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	KSWebShield.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	KSWebShield.exe
File created	C:\Windows\SysWOW64\safe.ico	25bd57a1034c3e7b57846255aa285077.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	KSWebShield.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	KSWebShield.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\progra~1\ico\Film.ico	25bd57a1034c3e7b57846255aa285077.exe
File created	C:\progra~1\ico\meiv.ico	25bd57a1034c3e7b57846255aa285077.exe
File created	C:\progra~1\ico\Video.ico	25bd57a1034c3e7b57846255aa285077.exe
File opened for modification	C:\PROGRA~1\kingsoft\KWSSVC.log	KSWebShield.exe
File opened for modification	C:\PROGRA~1\kingsoft\KWSSVC.log	KSWebShield.exe
File opened for modification	C:\progra~1\Maxthon\Config\config.ini	25bd57a1034c3e7b57846255aa285077.exe
File opened for modification	C:\progra~1\Maxthon2\SharedAccount\Config\Config.ini	25bd57a1034c3e7b57846255aa285077.exe
File created	C:\progra~1\ico\Beauty.ico	25bd57a1034c3e7b57846255aa285077.exe
File opened for modification	C:\Program Files\kingsoft\KWSSVC.log	KSWebShield.exe
File opened for modification	C:\Program Files\kingsoft\KWSSVC.log	KSWebShield.exe
File opened for modification	C:\progra~1\TheWorld 3\TheWorld.ini	25bd57a1034c3e7b57846255aa285077.exe
File created	C:\progra~1\ico\Taobao.ico	25bd57a1034c3e7b57846255aa285077.exe
File created	C:\progra~1\kingsoft\kwssp.dll	25bd57a1034c3e7b57846255aa285077.exe
File created	C:\progra~1\kingsoft\kwsui.dll	25bd57a1034c3e7b57846255aa285077.exe
File opened for modification	C:\PROGRA~1\kingsoft\KWSSVC.log	KSWebShield.exe
File opened for modification	C:\PROGRA~1\kingsoft\KWSSVC.log	KSWebShield.exe
File created	C:\progra~1\ico\Chat.ico	25bd57a1034c3e7b57846255aa285077.exe
File created	C:\progra~1\kingsoft\KSWebShield.exe	25bd57a1034c3e7b57846255aa285077.exe
File created	C:\progra~1\kingsoft\KSWebShield.dll	25bd57a1034c3e7b57846255aa285077.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31079708"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4e92002c4a416439bca1d31c27b84050000000002000000000010660000000100002000000092fd3f2c9e035b7a3b840aa82c58c48fa04c37d55b3195202baf532edc93edd3000000000e8000000002000020000000d9ab101afd325ee7c1765745508bdbdd1d2291de5066e131c14602da2b2b01292000000089f1fbe19b8278066ced1752541b4bdc31016fdfe49a83f758529211b62cd359400000007cb26ca5f0c1f1a11873ca7150b3792a4ba3256c6e76eec543e4d1d58657456e592808d371d7a22a48b610aa1ea84275f49a47410eba2ca9f5fb24db8b4c57a7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31079708"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.779dh.com\ = "126"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410924321"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902b3f071c3dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "340800310"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90c010231c3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\779dh.com\Total = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "520175253"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\779dh.com\Total = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "371581436"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\779dh.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\New Windows\Allow	25bd57a1034c3e7b57846255aa285077.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\DOMStorage\779dh.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31079708"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "371581436"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3E79DF23-A90F-11EE-BB4F-524326B4BB5C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4e92002c4a416439bca1d31c27b8405000000000200000000001066000000010000200000003a0460c0337efc55174143e32ccbdbb7de0b6d3ac9b77e383de220e2c9c252bd000000000e8000000002000020000000f3fdecdc5e0da512a4597c1b17122de9d099f402198920c5bafa277dea238c102000000053f6a7caf93c3a00ae437970badee2071d8801089ecc09d4733d2be8b6ddfb8b400000000ff9652e6a9e46a3d1ee602896db14b2663868167f3b4a73bc37f989ff3d7c975f607922389ba51dd2898ae8d39236f9294ad8914f4a670e66f59baaf6e66ca6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.v258.net = "0"	25bd57a1034c3e7b57846255aa285077.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.779dh.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31079708"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.779dh.com\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "417831524"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	KSWebShield.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	KSWebShield.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	KSWebShield.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	KSWebShield.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	KSWebShield.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	KSWebShield.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	KSWebShield.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	KSWebShield.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1084	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeDebugPrivilege	3008	KSWebShield.exe
Token: SeDebugPrivilege	2328	KSWebShield.exe
Token: SeDebugPrivilege	1156	KSWebShield.exe
Token: 33	1156	KSWebShield.exe
Token: SeIncBasePriorityPrivilege	1156	KSWebShield.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: SeIncBasePriorityPrivilege	4928	25bd57a1034c3e7b57846255aa285077.exe
Token: 33	4928	25bd57a1034c3e7b57846255aa285077.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1176	WScript.exe
2184	WScript.exe
2244	WScript.exe
4072	WScript.exe
3852	iexplore.exe
3852	iexplore.exe
3852	iexplore.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1176	WScript.exe
2184	WScript.exe
2244	WScript.exe
4072	WScript.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
4928	25bd57a1034c3e7b57846255aa285077.exe
4928	25bd57a1034c3e7b57846255aa285077.exe
3224	KSWebShield.exe
3224	KSWebShield.exe
3852	iexplore.exe
3852	iexplore.exe
4056	IEXPLORE.EXE
4056	IEXPLORE.EXE
4056	IEXPLORE.EXE
4056	IEXPLORE.EXE
3852	iexplore.exe
3852	iexplore.exe
4596	IEXPLORE.EXE
4596	IEXPLORE.EXE
4596	IEXPLORE.EXE
4596	IEXPLORE.EXE
3852	iexplore.exe
3852	iexplore.exe
752	IEXPLORE.EXE
752	IEXPLORE.EXE
752	IEXPLORE.EXE
752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 1176	4928	25bd57a1034c3e7b57846255aa285077.exe	91
PID 4928 wrote to memory of 1176	4928	25bd57a1034c3e7b57846255aa285077.exe	91
PID 4928 wrote to memory of 1176	4928	25bd57a1034c3e7b57846255aa285077.exe	91
PID 4928 wrote to memory of 2184	4928	25bd57a1034c3e7b57846255aa285077.exe	92
PID 4928 wrote to memory of 2184	4928	25bd57a1034c3e7b57846255aa285077.exe	92
PID 4928 wrote to memory of 2184	4928	25bd57a1034c3e7b57846255aa285077.exe	92
PID 4928 wrote to memory of 2244	4928	25bd57a1034c3e7b57846255aa285077.exe	93
PID 4928 wrote to memory of 2244	4928	25bd57a1034c3e7b57846255aa285077.exe	93
PID 4928 wrote to memory of 2244	4928	25bd57a1034c3e7b57846255aa285077.exe	93
PID 4928 wrote to memory of 4072	4928	25bd57a1034c3e7b57846255aa285077.exe	94
PID 4928 wrote to memory of 4072	4928	25bd57a1034c3e7b57846255aa285077.exe	94
PID 4928 wrote to memory of 4072	4928	25bd57a1034c3e7b57846255aa285077.exe	94
PID 4928 wrote to memory of 3008	4928	25bd57a1034c3e7b57846255aa285077.exe	98
PID 4928 wrote to memory of 3008	4928	25bd57a1034c3e7b57846255aa285077.exe	98
PID 4928 wrote to memory of 3008	4928	25bd57a1034c3e7b57846255aa285077.exe	98
PID 4928 wrote to memory of 2328	4928	25bd57a1034c3e7b57846255aa285077.exe	102
PID 4928 wrote to memory of 2328	4928	25bd57a1034c3e7b57846255aa285077.exe	102
PID 4928 wrote to memory of 2328	4928	25bd57a1034c3e7b57846255aa285077.exe	102
PID 1156 wrote to memory of 3224	1156	KSWebShield.exe	104
PID 1156 wrote to memory of 3224	1156	KSWebShield.exe	104
PID 1156 wrote to memory of 3224	1156	KSWebShield.exe	104
PID 4928 wrote to memory of 3852	4928	25bd57a1034c3e7b57846255aa285077.exe	114
PID 4928 wrote to memory of 3852	4928	25bd57a1034c3e7b57846255aa285077.exe	114
PID 3852 wrote to memory of 4056	3852	iexplore.exe	116
PID 3852 wrote to memory of 4056	3852	iexplore.exe	116
PID 3852 wrote to memory of 4056	3852	iexplore.exe	116
PID 4928 wrote to memory of 988	4928	25bd57a1034c3e7b57846255aa285077.exe	120
PID 4928 wrote to memory of 988	4928	25bd57a1034c3e7b57846255aa285077.exe	120
PID 4928 wrote to memory of 988	4928	25bd57a1034c3e7b57846255aa285077.exe	120
PID 988 wrote to memory of 1084	988	cmd.exe	122
PID 988 wrote to memory of 1084	988	cmd.exe	122
PID 988 wrote to memory of 1084	988	cmd.exe	122
PID 4928 wrote to memory of 2940	4928	25bd57a1034c3e7b57846255aa285077.exe	123
PID 4928 wrote to memory of 2940	4928	25bd57a1034c3e7b57846255aa285077.exe	123
PID 3852 wrote to memory of 4596	3852	iexplore.exe	124
PID 3852 wrote to memory of 4596	3852	iexplore.exe	124
PID 3852 wrote to memory of 4596	3852	iexplore.exe	124
PID 988 wrote to memory of 4076	988	cmd.exe	125
PID 988 wrote to memory of 4076	988	cmd.exe	125
PID 988 wrote to memory of 4076	988	cmd.exe	125
PID 988 wrote to memory of 4880	988	cmd.exe	126
PID 988 wrote to memory of 4880	988	cmd.exe	126
PID 988 wrote to memory of 4880	988	cmd.exe	126
PID 988 wrote to memory of 772	988	cmd.exe	128
PID 988 wrote to memory of 772	988	cmd.exe	128
PID 988 wrote to memory of 772	988	cmd.exe	128
PID 988 wrote to memory of 4900	988	cmd.exe	127
PID 988 wrote to memory of 4900	988	cmd.exe	127
PID 988 wrote to memory of 4900	988	cmd.exe	127
PID 988 wrote to memory of 3904	988	cmd.exe	129
PID 988 wrote to memory of 3904	988	cmd.exe	129
PID 988 wrote to memory of 3904	988	cmd.exe	129
PID 988 wrote to memory of 4520	988	cmd.exe	130
PID 988 wrote to memory of 4520	988	cmd.exe	130
PID 988 wrote to memory of 4520	988	cmd.exe	130
PID 988 wrote to memory of 2760	988	cmd.exe	131
PID 988 wrote to memory of 2760	988	cmd.exe	131
PID 988 wrote to memory of 2760	988	cmd.exe	131
PID 988 wrote to memory of 5068	988	cmd.exe	132
PID 988 wrote to memory of 5068	988	cmd.exe	132
PID 988 wrote to memory of 5068	988	cmd.exe	132
PID 988 wrote to memory of 2944	988	cmd.exe	133
PID 988 wrote to memory of 2944	988	cmd.exe	133
PID 988 wrote to memory of 2944	988	cmd.exe	133

Views/modifies file attributes 1 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4956	attrib.exe
4900	attrib.exe
3840	attrib.exe
4880	attrib.exe
764	attrib.exe
3596	attrib.exe
3840	attrib.exe

C:\Users\Admin\AppData\Local\Temp\25bd57a1034c3e7b57846255aa285077.exe
"C:\Users\Admin\AppData\Local\Temp\25bd57a1034c3e7b57846255aa285077.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\WScript.exe
  WScript.exe C:\Users\Admin\AppData\Local\Temp\y97Ai.vbs
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1176
- C:\Windows\SysWOW64\WScript.exe
  WScript.exe C:\Users\Admin\AppData\Local\Temp\Ub226.vbs
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2184
- C:\Windows\SysWOW64\WScript.exe
  WScript.exe C:\Users\Admin\AppData\Local\Temp\i34z3.vbs
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2244
- C:\Windows\SysWOW64\WScript.exe
  WScript.exe C:\Users\Admin\AppData\Local\Temp\cbJH8.vbs
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4072
- C:\progra~1\kingsoft\KSWebShield.exe
  C:\progra~1\kingsoft\KSWebShield.exe -install
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3008
- C:\progra~1\kingsoft\KSWebShield.exe
  C:\progra~1\kingsoft\KSWebShield.exe -start
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2328
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.6626.net/?ukt-31
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3852 CREDAT:17410 /prefetch:2
    3⤵
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4056
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3852 CREDAT:82952 /prefetch:2
    3⤵
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4596
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3852 CREDAT:17420 /prefetch:2
    3⤵
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\lnk.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1084
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4076
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Documents and Settings\All Users\Application Data\Kingsoft\kws\kws.ini" /p everyone:f
    3⤵
    PID:4880
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\Desktop\╘┌╧▀┬■╗¡.url" /p everyone:f
    3⤵
    PID:4900
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:3904
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\Desktop\├└┼«╩╙╞╡.url" /p everyone:f
    3⤵
    PID:4520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2760
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\Desktop\╘┌╧▀╡τ╙░.url" /p everyone:f
    3⤵
    PID:5068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2944
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\Desktop\╨╘╕╨├└┼«.url" /p everyone:f
    3⤵
    PID:1804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\Desktop\╠╘▒ª╣║╬∩.url" /p everyone:f
    3⤵
    PID:1100
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:3840
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\Desktop\╘┌╧▀╨í╦╡.url" /p everyone:f
    3⤵
    PID:4568
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Documents and Settings\All Users\Application Data\Kingsoft\kws\kws.ini" +R +S
    3⤵
    - Views/modifies file attributes
    PID:4956
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\Desktop\╘┌╧▀┬■╗¡.url" +R +S
    3⤵
    - Views/modifies file attributes
    PID:4900
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\Desktop\├└┼«╩╙╞╡.url" +R +S
    3⤵
    - Views/modifies file attributes
    PID:3840
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\Desktop\╘┌╧▀╡τ╙░.url" +R +S
    3⤵
    - Views/modifies file attributes
    PID:4880
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\Desktop\╨╘╕╨├└┼«.url" +R +S
    3⤵
    - Views/modifies file attributes
    PID:764
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\Desktop\╠╘▒ª╣║╬∩.url" +R +S
    3⤵
    - Views/modifies file attributes
    PID:3596
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\Desktop\╘┌╧▀╨í╦╡.url" +R +S
    3⤵
    - Views/modifies file attributes
    PID:3840
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4076
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Documents and Settings\All Users\Application Data\Kingsoft\kws\kws.ini" /p everyone:R
    3⤵
    PID:4744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2968
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\Desktop\╘┌╧▀┬■╗¡.url" /p everyone:R
    3⤵
    PID:3556
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\Desktop\├└┼«╩╙╞╡.url" /p everyone:R
    3⤵
    PID:2372
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4772
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\Desktop\╘┌╧▀╡τ╙░.url" /p everyone:R
    3⤵
    PID:2276
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:8
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\Desktop\╨╘╕╨├└┼«.url" /p everyone:R
    3⤵
    PID:1804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1100
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\Desktop\╠╘▒ª╣║╬∩.url" /p everyone:R
    3⤵
    PID:4088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2760
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\Desktop\╘┌╧▀╨í╦╡.url" /p everyone:R
    3⤵
    PID:2372
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.31166.net/?uk-31
  2⤵
  PID:2940
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.779dh.com/?kj-31
  2⤵
  - Modifies Internet Explorer settings
  PID:1040

C:\Windows\System32\expand.exe
"C:\Windows\System32\expand.exe" "C:\Users\Admin\AppData\Local\Temp\url.cab" -F:*.* "C:\Users\Admin\Desktop"
1⤵
- Drops file in Windows directory
PID:3020

C:\Windows\System32\expand.exe
"C:\Windows\System32\expand.exe" "C:\Users\Admin\AppData\Local\Temp\url.cab" -F:*.* "C:\Users\Admin\Favorites"
1⤵
- Drops file in Windows directory
PID:4704

C:\progra~1\kingsoft\KSWebShield.exe
C:\progra~1\kingsoft\KSWebShield.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156
- C:\progra~1\kingsoft\KSWebShield.exe
  C:\progra~1\kingsoft\KSWebShield.exe -run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:3224

C:\Program Files\kingsoft\KSWebShield.exe
"C:\Program Files\kingsoft\KSWebShield.exe" -install
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2452

C:\Program Files\kingsoft\KSWebShield.exe
"C:\Program Files\kingsoft\KSWebShield.exe" -start
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~1\kingsoft\KWSSVC.log

Filesize
202B

MD5
06dfc1415639555e793c59a1400c4e69

SHA1
541ba339ac213c686bb9519acbc6ab971dee9475

SHA256
587f70316f226d6f57e57c1bfc846bdd0f17d2bd8f46914dfe772f7a4f106b28

SHA512
a24f361b5db05f21227f59684ec263a462d5d05480e4c33f04edc509f494160444ab23f5c29d244564d815a078dff0652e24fa79e7b288e41a3d83d40e0b75a6

Download Submit
C:\PROGRA~1\kingsoft\KWSSVC.log

Filesize
448B

MD5
826fe304f3699394c4b277fe7faefc8a

SHA1
015f74f7971a89f62f26ca61ae49b440339d3128

SHA256
831db4cbb0f37a1c89c1cf8910010c190af1281022e59a5ef3b9835512a33af4

SHA512
af9a6a2439ced891aa771d35bedffe0b8fab7072fdf67d5ae741d01cbbf0426662052f3665afa30ead1b2444ab3f84a388ac9d713e0999abc2e0b05338cb3604

Download Submit
C:\PROGRA~1\kingsoft\KWSSVC.log

Filesize
546B

MD5
ec564b4f6e424ce9441e47ec03f1479c

SHA1
05c4a93a92f4913a6fb983a0350e10f814457985

SHA256
8125fd6b77c12447b7bb8a770c260fcdb7a0ac3c62ff45773a3c8b46db7aacfd

SHA512
b9bcce7ea4c1cac6ce5f8238a50cb918ca8ccff1f4a693969f93487702b114c612240dec5e77138e64269f1381cab0db3af2423ccce6980a34a42180e4e00738

Download Submit
C:\Program Files\kingsoft\KSWebShield.exe

Filesize
197KB

MD5
2bcfdc7e51a9c556e5fb04e4d02fed39

SHA1
33e6eca60078affa733c2300605c91adddf992b0

SHA256
ee47b58a5464ceb75d73a82935a217970270958030eabc4e03100c61e7222fb1

SHA512
86b7a88d0aa5bacac2fd2a1eb60b5ac80a0fe012a1fb9105b7d7071e594a73e8fa049bebcbde144acc2e8116f682f47286d56c1302dd7153902fa5c2d617881c

Download Submit
C:\Program Files\kingsoft\KWSSVC.log

Filesize
748B

MD5
9b215d45b109ed8692e79df7718f05a6

SHA1
43b6fcb8b09b742c489a357634911031c443241e

SHA256
46c3808d95db1e6a11b541e95a637aa629ffe1513e6c3a94796cd2afe4681e0e

SHA512
ca1467865e340fcb452adb383f3e52bc370bc2171c26b8d6595797b1709445981115676e7a69c17c955577dba3d3c0db5d7881f790deb17cfef86712cf3a54af

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\360safe.lnk

Filesize
1KB

MD5
d3ca23ea23f5efe516768e930b794448

SHA1
44245cd06768da3995cc4cc7d2f711062acdf324

SHA256
686de74d9610517112684c2ef7bb66495eba0e481c9a5ed22998504315ac3fe6

SHA512
0664f4b1b7b181eed16a9f5ae963025041f5d890a360f968db2131b1968bc66fe9027b2765a2ae3cae337d222635af815d1abce3476f620ca993466bad9d5db3

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\360sdo.lnk

Filesize
1KB

MD5
9e85aaf6d58f07060248f50011767806

SHA1
1e1ffde6711ee1b19d302f91e3c2428f4c47edbf

SHA256
27303d835a58a5de361d0c311709cb6105633f2465f2edec217136c24f2b61c6

SHA512
bc3e5950e4929177af8353c7559247a2ba7731997510d85df0c80b40cc90d36d191604da6080d4c6f07245c87ae94826843e55d71ad57abacf044a16192fe735

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\KSWebShield.lnk

Filesize
1KB

MD5
00ef006771b7b58e04bba39753aed3a3

SHA1
3af1a65edd86191d297284ede268e96e0d0b5da1

SHA256
3374ff9466c104837664d49c8f18259a341dca254a54b4c87dca42644db41642

SHA512
850745a78bdc543897bca96124c7dd86f9019d9b224403c25b300fa378e28b7ab3dafef8152e0598a53414080e3743b948f15976caa6ab60f932b80ca2f45631

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\½ðÉ½Íø¶Ü.lnk

Filesize
1KB

MD5
f8112ba3f057e4fcf4c695a7f10fb540

SHA1
598fb2e43dcf6394622975386d58154416558189

SHA256
31aa5f53d7c52508846f84b17aaa49dc565ba948218bf00e2283379b5a0df263

SHA512
b08c4054e73420f8badfa4f2812c82ccc9e2ed1b0d7dfef6d16c8d1711b76bfc885a26ed4ef4217c557484956ff7bacf9d59040f60b4f3993ceb242e8794fdb9

Download Submit
C:\ProgramData\kingsoft\kws\kws.ini

Filesize
77B

MD5
948dd44368b603fab25b41b997c5f99c

SHA1
d7da791135ee7ac1611dc9762b463e1bb8fdf9cb

SHA256
995f5ab89cb30039507ae21f7691385112b28659e7123b864a8be8640c3dc67c

SHA512
1946cded8cc87c447a367b4f41b653d4b93ea297d06f6527b59b45f2ffec5c71e6234ca134762c6d9f9246690c8b613418a89be08521f39e07372fc1aee3b338

Download Submit
C:\ProgramData\kingsoft\kws\kws.ini

Filesize
89B

MD5
23255051a9c9bddb52c9123f20ccd389

SHA1
c5c44c34dc08b155b5c41bc450abf7036bc8c0a7

SHA256
7ee1723584efd3ff7507761e5b36b01ed9ac8281a3f6724254fb897cd61011b5

SHA512
96738fb8d78e557c5c4283e402d9add39d4782694007ecaa5e8f2aa4afd416a01b1a26d115ccd39a130935062a8e653c2a81f03d481ff6732ebc961379456b6b

Download Submit
C:\ProgramData\kingsoft\kws\kws.ini

Filesize
57B

MD5
632ae68e7eef65eee5aace802815cd11

SHA1
8d447c0c2efc6408b711ef3ca0f9f6199c02e51f

SHA256
ae95f7dcf2193b28c7e9ee5e6dfe1f4eaa936dc2fb6747da0f3365ccec4a66fe

SHA512
9c744a4e2379f7e60ecc0dfa7666f14d1241e5f8d8312db66395a09f519f8aef77540085708f310891c7d5f7f7687e132052e985addbc3bb73a8503f856d238d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver749E.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\5w2ovpd\imagestore.dat

Filesize
1KB

MD5
0bdc6dcd64acb2c0ee36ec8559a9e2fa

SHA1
8bcee51ff471edb2e11adec3285b0c43f0232f2f

SHA256
ee49a7a50d9cb9db3d1395da3d0e40ba7cd8a78eae076d2d5dd2588f35304f35

SHA512
63748bb8377acb925d7ad75b90ab8f1cda13b2a162378fe57a785dc189b69f083659fb3d960a5cca7fa6c6ec28fb9b990fef98ffd38dfa2d30d5aa883c3e3269

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\58G7K3A9\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GUTCV3OF\favicon[1].ico

Filesize
1KB

MD5
7ef1f0a0093460fe46bb691578c07c95

SHA1
2da3ffbbf4737ce4dae9488359de34034d1ebfbd

SHA256
4c62eef22174220b8655590a77b27957f3518b4c3b7352d0b64263b80e728f2c

SHA512
68da2c2f6f7a88ae364a4cf776d2c42e50150501ccf9b740a2247885fb21d1becbe9ee0ba61e965dd21d8ee01be2b364a29a7f9032fc6b5cdfb28cc6b42f4793

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ub226.vbs

Filesize
478B

MD5
7362e8e15c001c6a436833c780bcf190

SHA1
60af3a516c601cbb288450915405cc550ef1e06e

SHA256
a089c00385ec72082e21a9bae6be5b3669ef33ef50ac208c3e44275deb806b56

SHA512
cdd48cab51b0bcf853cb7dde79198e44c0c1cdb18afbf8b0aa231e6ba03a80602e66c818dc778971345f23c0f1c120d03dbec5c1280c9a91ed8004201a8c2477

Download Submit
C:\Users\Admin\AppData\Local\Temp\cbJH8.vbs

Filesize
566B

MD5
680521afa77bd640e3b8e8a4bedd2c1d

SHA1
2e6e55aee4d1d9d22d8fbacc91e936e0d126b596

SHA256
8fa568e0a875b89117cf649d3ae491824764953e0ecf351f2e28998a759770c4

SHA512
1c02ed6c6bbd2865f923f036b69d2efc30b547ba98119c41d625fad59d3c3fe8971302cc23c8079772fbb7387472508fbff51f2eb10a7b68889efcfbd139933b

Download Submit
C:\Users\Admin\AppData\Local\Temp\i34z3.vbs

Filesize
565B

MD5
24fe08b93105abd2afbc67f7b5a6671f

SHA1
3a4e0e52645cb6f73075931f6af233599cdaeef5

SHA256
6dc1cb7b6a9ccdbef3f44a9ee3b38941b5facab5063e5f817e609eda4d02037d

SHA512
8093808e1aaf0722e69f81c99ac4d951957d90e1e784c326e1b18380173f10a42c4b1e1388bda9146504810fc90e140570085966fb994b965b57dcb717fe0687

Download Submit
C:\Users\Admin\AppData\Local\Temp\lnk.bat

Filesize
1KB

MD5
7224ccf9d4354e76d4b5e8b57d5dab17

SHA1
2a910ce03a6b7cfb09c220d85577258cb3ef3a7d

SHA256
76487df756feb13baa1af6c7b09041beb7c80115547796e126a4da2bf867a6df

SHA512
f601bc1148f38a8cbf72cd8e983326a673ffd8c4d69f413abeeba869f29ac7097eb3613cc2303a1c08c4d6fa2a694ac193d416fea41c48316e82c7f51b57e57e

Download Submit
C:\Users\Admin\AppData\Local\Temp\y97Ai.vbs

Filesize
476B

MD5
ec23238217f6b5645af06fc0bf5c237f

SHA1
9bb0f8fd2ab793067ad91ea73937e3e37227a29a

SHA256
5452ae11d8d0e47014ffa8390e29007de69157a21cf5ce772745276390cf4b85

SHA512
458d1f5dea40902c786a6a5da421e2e6f1d17ab661efdb96bfaf8e215ce36c26bbed097896e71c4c3a33dea08439f9180713a675ead2bea96e9cf0aa09439507

Download Submit
C:\Users\Admin\Favorites\ÃÀÅ®ÊÓÆµ.url

Filesize
134B

MD5
f74aa96b9b45c6b94531b192d4926ed8

SHA1
9352c33b863662540afebc3e7570804f1ac8f23d

SHA256
31530927f5f5b0a42111845beeee35fa7d85aea04e3f8b26283b4b5fff01b3f2

SHA512
0665afb5e78385fcbf3def63e09358ac136162ccec3dd7b304f4d428c401ee38a1841d0c0fb691bb7ad0afe72d6958bd63886f4699176f5dbfedb4aa128968c1

Download Submit
C:\Users\Admin\Favorites\ÌÔ±¦¹ºÎï.url

Filesize
135B

MD5
971c6a735a623358b013d44528942707

SHA1
03b058fa21afb28c10b9630bbae040095af8f335

SHA256
fdaf404d55a0d798f3f7a6a70bd023f02ebba07062b79dd50e543a18800be08f

SHA512
373c4cfefa02069d95d28320a9f7d7636b9c779a619a6c3aa77598e959dd0b09fa3f4238dc38c1f1843c09e82457c7d4a58cdfef2bf0cd300c75f501f7286b02

Download Submit
C:\Users\Admin\Favorites\ÐÔ¸ÐÃÀÅ®.url

Filesize
133B

MD5
5a52bb6c53b4839dfa8520a7fe5b53b5

SHA1
c124cd3787130609936d62d988e61067a22bb1d4

SHA256
cd201c825bcbe86a66c2cd500a0cfaca065fdabf753e220012a0cf8c90a4d0ee

SHA512
27812417c5379ba86787ee01130d6c2e85709f33b06dd2b35050b138dd75e76e10428d583274a17b8cf1bcae1fb031c904716318732eccf3b11f529982836710

Download Submit
C:\Users\Admin\Favorites\ÔÚÏßµçÓ°.url

Filesize
189B

MD5
410344edda7f66eed109b512a5c20d9c

SHA1
eb4a4646312a24d13d7bbc49c04c1f74879b199c

SHA256
2743d42f107c734d57ac9922e5d5949254ec3cb512374135d40a0607446afbc4

SHA512
1753e2104c563b377668be35aa1179ceba7ffc7854be9ed3d54e0e4b695cb0a0f3867aeb255e0a96651eb1580ac654db3c61fa7e6242d8b86c192f11b1bb71b1

Download Submit
C:\Users\Admin\Favorites\ÔÚÏßÂþ».url

Filesize
190B

MD5
6e028a15d5121ed2504d69fe97945899

SHA1
b664b2f0d5584382f42322c0daf49c515bd692e2

SHA256
5f4d7cb69f9919ca3bfb5e93f7bf5af8f6b31530d09fd34a9d64be3c70630bf4

SHA512
487daaf3e105012185c6f3f11787dcea31ec299cee6b1aa6f9e0c1e67929ea9d2134d642fc5b981a0918d7b25dff00f2fcb408cde7e1683458e0994fe481e718

Download Submit
C:\Users\Admin\Favorites\ÔÚÏßÐ¡Ëµ.url

Filesize
133B

MD5
9f3fd6ee0c3d7636694f46b3b0860afa

SHA1
ccf26f1b9b6351c9e190cf3466f51aab59579df4

SHA256
82a66de7a7fa48d263b8abaab4a18ea475af46866d7fd1be94420cedfe8fce3c

SHA512
43703e62e5ee2f625b2966dba02b51950bf31e1911ac2aa9cc6eab4c9a486546bb4867183ce13e6d10ace20d604dbb56ba506715f2d9271770f8a733a32fa4df

Download Submit
C:\Windows\LOGS\DPX\setupact.log

Filesize
168KB

MD5
d099cd0ff271757f64a61132f8f54bcc

SHA1
33ebb845a2fbe4bf784d4d968e7cb3c03b4599ee

SHA256
123a6528b2f56dd292c918bdf1a54600b333d7e4a059ecc199a7bd689c2ae621

SHA512
2a8d008821bec75ce24620da882834bcc97dc21db31d6f36549fcdd01509f6810bd9555aab3b45a24260824a9d898aeb123f1767231a9b1bc4a6fc68f645af7e

Download Submit
C:\progra~1\kingsoft\kswebshield.dll

Filesize
437KB

MD5
0b629e4318e64a6ab7e2c43ad6cc3e83

SHA1
27e835072fb85614f49e7cd586f64bd10bfcd497

SHA256
41ef17fdff69930c658773f394f2f33f2f9ddab4b638e2b962da76a63a975be5

SHA512
298d43fb819a9257bdef1392bf68209423c82ea47f22f32657943dec0a6407be6ce8631e633b38e9d31df1ff9391b01010f6ff293835a1e6953dee09d30de24f

Download Submit
C:\progra~1\kingsoft\kwssp.dll

Filesize
633KB

MD5
8c8dc085ab24bd23b77f146c78c8ff14

SHA1
3c01f9a5338fec055dd2fea36e468d160420a0b8

SHA256
ee50170b1c1829b98b647ea81d286f8a3630de1737be914ea02c409f1da1c217

SHA512
4754af26541d1737c8bae42a89c16570618b5bb5a44a4812f5e9819c852a2c6e235a9111bae98008037e94c614f4aabcf5166d041dce6e16be30683e80a1990c

Download Submit
C:\progra~1\kingsoft\kwsui.dll

Filesize
457KB

MD5
272764640b4b296e13c7c136cfbaaca2

SHA1
8c4f405469d370db5270c64f119d5b5ba0eece4e

SHA256
50723b6ad935609de87df9f838756bdbb6cbdf801d3c0ce8e08cebb35ef04b3b

SHA512
97c4520913f968cf591d996c7aa82004455507d81f50968f8e7cbb5122b57be715c34b8de4f9d391195f4c1864747781b69632a8850119df4977524d002a604a

Download Submit
\??\c:\users\admin\appdata\local\temp\url.cab

Filesize
6KB

MD5
40a36b16aae0dc11743ffbbccb38a564

SHA1
e174112532afe76c6a3d4577742a1727b3abe397

SHA256
b5b7d6add712d4185cb10d299065ca48d6ccb5bfe79b024a170d2bc6869138e8

SHA512
b038f3449af3abfe56560068b86c4f634e8feafcab2bf655718ce8f34cd87b20bf3caa843860e6572f74f601a704f8dcbde714aaca9153feca92b31353b9951f

Download Submit
memory/3224-88-0x00000000024D0000-0x0000000002540000-memory.dmp

Filesize
448KB

Download
memory/4928-100-0x0000000002CB0000-0x0000000002D20000-memory.dmp

Filesize
448KB

Download
memory/4928-133-0x0000000000400000-0x00000000006C8000-memory.dmp

Filesize
2.8MB

Download
memory/4928-107-0x0000000000400000-0x00000000006C8000-memory.dmp

Filesize
2.8MB

Download
memory/4928-148-0x0000000000400000-0x00000000006C8000-memory.dmp

Filesize
2.8MB

Download
memory/4928-149-0x0000000002CB0000-0x0000000002D20000-memory.dmp

Filesize
448KB

Download
memory/4928-161-0x0000000000400000-0x00000000006C8000-memory.dmp

Filesize
2.8MB

Download
memory/4928-0-0x0000000000400000-0x00000000006C8000-memory.dmp

Filesize
2.8MB

Download
memory/4928-193-0x0000000000400000-0x00000000006C8000-memory.dmp

Filesize
2.8MB

Download
memory/4928-194-0x0000000000400000-0x00000000006C8000-memory.dmp

Filesize
2.8MB

Download
memory/4928-96-0x0000000000400000-0x00000000006C8000-memory.dmp

Filesize
2.8MB

Download
memory/4928-95-0x0000000002CB0000-0x0000000002D20000-memory.dmp

Filesize
448KB

Download
memory/4928-206-0x0000000000400000-0x00000000006C8000-memory.dmp

Filesize
2.8MB

Download
memory/4928-6-0x0000000000400000-0x00000000006C8000-memory.dmp

Filesize
2.8MB

Download
memory/4928-217-0x0000000000400000-0x00000000006C8000-memory.dmp

Filesize
2.8MB

Download
memory/4928-220-0x0000000000400000-0x00000000006C8000-memory.dmp

Filesize
2.8MB

Download
memory/4928-223-0x0000000000400000-0x00000000006C8000-memory.dmp

Filesize
2.8MB

Download
memory/4928-224-0x0000000000400000-0x00000000006C8000-memory.dmp

Filesize
2.8MB

Download
memory/4928-225-0x0000000000400000-0x00000000006C8000-memory.dmp

Filesize
2.8MB

Download
memory/4928-226-0x0000000000400000-0x00000000006C8000-memory.dmp

Filesize
2.8MB

Download