Analysis Overview
SHA256
816cb8a8b8805cf2b7383a6e70b395aab22b2292b300776c914d224ee8c04650
Threat Level: Known bad
The file 087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
Modifies firewall policy service
Adds Run key to start application
Installs/modifies Browser Helper Object
Modifies Windows Firewall
Enumerates connected drives
Checks computer location settings
Checks installed software on the system
Registers COM server for autorun
Checks for VirtualBox DLLs, possible anti-VM trick
Drops file in Program Files directory
Drops file in Windows directory
Loads dropped DLL
Executes dropped EXE
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Modifies Internet Explorer settings
Modifies system certificate store
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-04-29 23:22
Signatures
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-29 23:22
Reported
2024-04-29 23:25
Platform
win10v2004-20240426-en
Max time kernel
150s
Max time network
150s
Command Line
Signatures
Modifies firewall policy service
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HCDNClient = "\"C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QyKernel.exe\" -shell_start" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\F: | C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe | N/A |
Installs/modifies Browser Helper Object
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C} | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
Checks for VirtualBox DLLs, possible anti-VM trick
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\VBoxMiniRdrDN | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
Checks installed software on the system
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinVIP\skinplan\PlayerRes\Top\75.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\MultiAccountsBtn_mov.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Middle\ADRes\AdInnerPrompt\AdInnerPrompt (88).png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\PersonalCenter\image\qiyi.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\QYProduct\blackback.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\only\loading_2.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\normal\loading_15.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\downloadRes\common\check.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\QYProduct\QYProudctHomePage.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\MobileAssistant\Fragment\fragment_mobile_connect.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\ConfigRes\about_scrollbar\scrollbarbk.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\list\locallistorderup.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Ctrl\PlayerHd.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Middle\tipbk.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinDefault\skinplan\list\listmodebg.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinDefault\skinplan\PlayerRes\Ctrl\stop.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Middle\ADRes\8.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinVIP\skinplan\PlayerRes\Top\widi_selected.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\LocalListRes\add_file_down.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Middle\ADRes\5.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skin_third_part.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\npclient.dll | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Ctrl\Comment\switch_on.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\homepageRes\focus_big_sty_collect_selected.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\listUI\listUI_pagectrl.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\xml\t6.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\DlgTemplateNewBlack.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\PersonalCenter\register\taos1.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinDefault\skinplan\PlayerRes\popup_player\minimize.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\BatchDownLoad\errorIcon.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\listUI\page_up.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinVIP\skinplan\list\process.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ShadowTitle.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\left_list_video_more_icon_3.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\InsetControls\ic_rollviewandlistview.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\pic_error.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\LobbyServerList1.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\Mobile\clientkey.pem | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinVIP\skinplan\list\locatefile.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\scrollbar_up.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\ConfigRes\CheckVersionComplete.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PLRes\PowerList_item.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\downloadRes\download_cancel_selected.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinVIP\skinplan\SearchRes\hotWords_13.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\rank_bk2.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\TipsComment.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\playerface.dll | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Middle\ADRes\AdWnd_Skip_Background.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Middle\logo\logo_refresh_hover.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\homepageRes\LoadingDefaultImage.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinDefault\skinplan\list\process.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinVIP\skinplan\mobileassistant2.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinVIP\skinplan\PlayerRes\pstyle\snapshot.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\xml\t34.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Middle\ADRes\AdInnerPrompt\AdInnerPrompt (2).png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\listUI\filmlib2_down.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\titleRes\moon.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\titleRes\play_record.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Ctrl\GoodsCorner\goods_corner_bk (42).png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Ctrl\volume.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Middle\ADRes\AdInnerPrompt\AdInnerPrompt (25).png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\msgbox.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\download\DownloadTip.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Middle\ADRes\AdWnd_SkipAdHot.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Fonts\iqiyi_logo.ttf | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Windows\Fonts\iqiyi_logo.ttf | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Windows\psnetwork.ini | C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\nsi35F5.tmp\vmpagedown.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyMaster.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\mkshortcut.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe | N/A |
Loads dropped DLL
Registers COM server for autorun
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\InprocServer32\ThreadingModel = "Apartment" | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\LocalLow\\Unity\\WebPlayer\\loader\\UnityWebPluginAX.ocx" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}\InprocServer32 | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}\InprocServer32\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QYPlugin64.dll" | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\InprocServer32 | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\InprocServer32\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QYPlugin64.dll" | C:\Windows\system32\regsvr32.exe | N/A |
Enumerates physical storage devices
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\pps\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\magnet2\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\Policy = "3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\QyFragment.exe = "9000" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.ppstream.com | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\qisu | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6BE0FB-8B18-4dfc-959F-233651CC4D7F}\AppName = "QyKernel.exe" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\qips | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC} | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\Policy = "3" | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\pps | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_AUTOCONFIG_BRANDING | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC} | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.pps.tv | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\qygameclient | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\magnet2 | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\Policy = "3" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\QyClient.exe = "1" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6BE0FB-8B18-4dfc-959F-233651CC4D7F}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\ppstream\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\AppName = "QYFollowVideo.exe" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\QyPlayer.exe = "9000" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\AppName = "QyClient.exe" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\AppName = "QyClient.exe" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\QyBrowser.exe = "1" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\AppName = "QYFollowVideo.exe" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\QyPlayer.exe = "1" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\QyBrowser.exe = "9000" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\Policy = "3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\New Windows\Allow | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAC94FEE-45B4-4FD4-9EEA-D8978EC96C6E}\AppName = "QyClient.exe" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAC94FEE-45B4-4FD4-9EEA-D8978EC96C6E}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAC94FEE-45B4-4FD4-9EEA-D8978EC96C6E} | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\ppsrun\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAC94FEE-45B4-4FD4-9EEA-D8978EC96C6E}\Policy = "3" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ppsrun | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AUTOCONFIG_BRANDING\iexplore.exe = "1" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6BE0FB-8B18-4dfc-959F-233651CC4D7F} | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ppstream | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\QyFragment.exe = "1" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\QyClient.exe = "9000" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6BE0FB-8B18-4dfc-959F-233651CC4D7F}\Policy = "3" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\qips\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\qisu\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\qygameclient\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5}\TypeLib\Version = "1.0" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E1D75F62-CBBD-45C7-9D1D-6B5ECEC2E006}\1.0\ = "IEHelper 1.0 Type Library" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB3A16EC-96E2-421B-8462-C6F992596E65}\TypeLib\Version = "1.0" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.FlashHelper | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.FlvFilter\CLSID | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E1D75F62-CBBD-45C7-9D1D-6B5ECEC2E006}\1.0\FLAGS\ = "0" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\MiscStatus\1 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\InProcServer32\ | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\QYPlugin.QYPluginCtrl.1\CLSID | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\ppsrun\DefaultIcon\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QyClient.exe,-0" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\AppID\{F008CD3D-7044-4CD4-BE14-BF3FCCF144F9}\ = "UnityWebPlayer" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\WOW6432Node\Interface\{6130BEAD-7375-4DB7-8B6D-7E41303CE675}\ProxyStubClsid32 | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.FlvFilter\CurVer\ = "IEHelper.FlvFilter.1" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6360BD3-5CD0-40D3-BD87-DAFF37889F50}\1.0\ = "QYPlugin ActiveX ¿Ø¼þÄ£¿é" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259} | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\Shell\Open | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.pmv | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\qisu\shell\open | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.FlashHelper\CLSID | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.FlvFilter.1\ = "FlvFilter Class" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.qsv\OpenWithList | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{790F2D3B-18EE-40E2-A45E-1FAC13B6AFB8}\TypeLib | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\QYPlugin.QYPluginCtrl.1\CLSID\ = "{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\TypeLib | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\VersionIndependentProgID | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\TypeLib\{75A564FE-95D1-41A9-B1D9-10D1E3CB502B} | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.FlvFilter\CLSID\ = "{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}\ProgID | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3636FE13-B7E3-4CDC-B7E3-A8014BD2CC02}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\MiscStatus | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\ProgID | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6360BD3-5CD0-40D3-BD87-DAFF37889F50}\1.0\0\win64 | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\qips\URL Protocol | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\qygameclient\shell\open | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{138F4260-66CA-4F7C-812F-C6EED99B7EC7}\TypeLib\Version = "1.0" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.pgf\DefaultIcon | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\ppsrun\shell\open\command\ = "\"C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QyClient.exe\" -ppstream \"%1\"" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\qisu\shell | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3636FE13-B7E3-4CDC-B7E3-A8014BD2CC02}\TypeLib\ = "{E1D75F62-CBBD-45C7-9D1D-6B5ECEC2E006}" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\Shell\Open\Command | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\qygameclient\shell\open\command | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\LocalLow\\Unity\\WebPlayer\\loader\\UnityWebPluginAX.ocx" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\Control | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\ToolboxBitmap32 | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}\TypeLib | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.pfv\OpenWithList\GeePlayer.exe | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{790F2D3B-18EE-40E2-A45E-1FAC13B6AFB8}\ = "_DQYPluginEvents" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\ = "爱奇艺浏览器插件" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\InfoTip = "使用爱奇艺PPS影音收看影视节目,清晰流畅更新快。" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\InProcServer32\ThreadingModel = "Apartment" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\AppID\UnityWebPluginAX.ocx | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\Version | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\.pfv | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}\VersionIndependentProgID | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}\InprocServer32 | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\qips\shell\open | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\qygameclient\shell | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Interface\{6130BEAD-7375-4DB7-8B6D-7E41303CE675}\TypeLib\Version = "1.0" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}\TypeLib\ = "{E1D75F62-CBBD-45C7-9D1D-6B5ECEC2E006}" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}\VersionIndependentProgID\ = "IEHelper.FlvFilter" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB\Blob = 0f000000010000001400000044cb4357ecb773b9ac3a3b0b1e45ab6bc45c2f1c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703085300000001000000230000003021301f06092b06010401829b510230123010060a2b0601040182373c0101030200c06200000001000000200000004b22d5a6aec99f3cdb79aa5ec06838479cd5ecba7164f7f22dc1d65f63d85708140000000100000014000000e166cf0ed1f1b34bb7062014fe8712d5f6fefb3e1d000000010000001000000051541f96c328dd7ac3ef2bdce753ac470b000000010000000e00000057006f005300690067006e0000007e000000010000000800000000c00c0f7f39d30168000000010000000800000000800c13c1b9d401030000000100000014000000b94294bf91ea8fb64be61097c7fb001359b676cb20000000010000007a050000308205763082035ea00302010202105e68d61171946350560068f33ec9c591300d06092a864886f70d01010505003055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e301e170d3039303830383031303030315a170d3339303830383031303030315a3055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e30820222300d06092a864886f70d01010105000382020f003082020a0282020100bdca8dacb8911556977b6b5c7ac2de6bd9a1b0c31023faa7a1b2cc31fa3ed9a6296f163de06bf8b8405fdb39a8007a8ba04d547dc22278fc8e09b8a885d7cc95974b74d89e7ef000e40e89ae4928441a1099320f258853a40db30f1208160b0371271c7fe1dbd2fd6768c4055d0a0e5d70d7d897a0bc53419a918df49e36667a7e56c1905fe6b1682036a48c242c2c470b59766630b5bedeed8ff89dd3bb0130e6f2f30ee02c9280f385f9288ab4542e9aedf776fc156816eb4a6ceb2e128fd4cffe0cc75c1d0b7e0532be5eb0092a42d5c94e90b3590dbb7a7ecdd5085ab47fd81c6911f9270f7b06af5483187be1dd547a51686e77fcc6bf524a6646a1b2671abba34f77a0be5dfffc560b43727790ca9ef9f239f50da9f4ead7e7b3102f30423721cc3070c986980fcc584d83bb7de51aa5378db6ac3297003a6371241e9e37c4ff74d437c0e2fe88466011dd083f5036abb87aa495626a6eb0ca6a215a69f3f3fb1d703995f3a76ea68189a188c53b71caa352ee83bbfda077f4e46fe742db6d4a998a3448bc17dce4800822b6f231c03f043eeb9f2079d6b80664640231d7a9cd52fb84456909002adc558bc406464bc04a1d095b3928fda9abce00f92e484b26e6304ca558cab444824fe7911e33c3b093ff11fc81d2ca1f7129dd764f9225af1d81b70f2f8cc306cc2f27a34ae40e99ba7c1e451f7faa194596fdfc3d0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414e166cf0ed1f1b34bb7062014fe8712d5f6fefb3e300d06092a864886f70d01010505000382020100a8cb7240b276c17e7bfcad64e3327bcc3cb65d46d3f52ce2705dc82ed8067d98d10b21a0895924019df9af097d0a238234d5fc7c7299b9a3d754f4ea52700ec5f5d63be13a0932e6213993bdb315ea4f6af4f58b3f2f7c8d582ec5e139a03ec73d4a739e407ac02b61a967c9f324b9b36d552c5a1d9e2572ce0badaac755620bbefb63b3614423a3cbe11a0ef79a064dded4234e21965b395b571d2f5d085e0979ff7c97b54d83ae0dd6e6a379e033d099960230a73effd2a3433f055a06ea4402da7cf848d033a9f907c795e1f53ef55d71baf295a974886159e3bfca5a13ba72b48c5d3687e9a6c53c13bfded04426eeb7ec2e70fad79db7ace5c5405ae6d76c7b2cc3569b47cd0bcefa1bb421d7b766b8f425308b5c0db9ea67b2f46daed5a19e4fd89fe92702b01d06d68fe3fb48129f7f11a1103e4c513a96b0d113f1c7d826ae3aca91c4699ddf012964516f68da14ec084197908dd0b280f2cfc23dbf9168c580671ec4601355d56199577cba950f61493aca75bcc90a933f670e12f228e2311bc05716df087c19c17e0f1f851e0a367c5b7e27bc7abfe0dbf4da52bdde0c547031914395c8bcf03edd097e306450ed7f01a433674d684fbe15efb0f60211a21b13253adcc259f1e35c46bb672c0246ea1e48a6e65bd9b5bc51a29296dbaac63722a6fecc2074a32da92e6bcbc0821121b59379ee4486bed71ee41efb | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB\Blob = 040000000100000010000000a1f2f9b5d2c87a74b8f305f1d7e1848d030000000100000014000000b94294bf91ea8fb64be61097c7fb001359b676cb68000000010000000800000000800c13c1b9d4017e000000010000000800000000c00c0f7f39d3010b000000010000000e00000057006f005300690067006e0000001d000000010000001000000051541f96c328dd7ac3ef2bdce753ac47140000000100000014000000e166cf0ed1f1b34bb7062014fe8712d5f6fefb3e6200000001000000200000004b22d5a6aec99f3cdb79aa5ec06838479cd5ecba7164f7f22dc1d65f63d857085300000001000000230000003021301f06092b06010401829b510230123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080f000000010000001400000044cb4357ecb773b9ac3a3b0b1e45ab6bc45c2f1c20000000010000007a050000308205763082035ea00302010202105e68d61171946350560068f33ec9c591300d06092a864886f70d01010505003055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e301e170d3039303830383031303030315a170d3339303830383031303030315a3055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e30820222300d06092a864886f70d01010105000382020f003082020a0282020100bdca8dacb8911556977b6b5c7ac2de6bd9a1b0c31023faa7a1b2cc31fa3ed9a6296f163de06bf8b8405fdb39a8007a8ba04d547dc22278fc8e09b8a885d7cc95974b74d89e7ef000e40e89ae4928441a1099320f258853a40db30f1208160b0371271c7fe1dbd2fd6768c4055d0a0e5d70d7d897a0bc53419a918df49e36667a7e56c1905fe6b1682036a48c242c2c470b59766630b5bedeed8ff89dd3bb0130e6f2f30ee02c9280f385f9288ab4542e9aedf776fc156816eb4a6ceb2e128fd4cffe0cc75c1d0b7e0532be5eb0092a42d5c94e90b3590dbb7a7ecdd5085ab47fd81c6911f9270f7b06af5483187be1dd547a51686e77fcc6bf524a6646a1b2671abba34f77a0be5dfffc560b43727790ca9ef9f239f50da9f4ead7e7b3102f30423721cc3070c986980fcc584d83bb7de51aa5378db6ac3297003a6371241e9e37c4ff74d437c0e2fe88466011dd083f5036abb87aa495626a6eb0ca6a215a69f3f3fb1d703995f3a76ea68189a188c53b71caa352ee83bbfda077f4e46fe742db6d4a998a3448bc17dce4800822b6f231c03f043eeb9f2079d6b80664640231d7a9cd52fb84456909002adc558bc406464bc04a1d095b3928fda9abce00f92e484b26e6304ca558cab444824fe7911e33c3b093ff11fc81d2ca1f7129dd764f9225af1d81b70f2f8cc306cc2f27a34ae40e99ba7c1e451f7faa194596fdfc3d0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414e166cf0ed1f1b34bb7062014fe8712d5f6fefb3e300d06092a864886f70d01010505000382020100a8cb7240b276c17e7bfcad64e3327bcc3cb65d46d3f52ce2705dc82ed8067d98d10b21a0895924019df9af097d0a238234d5fc7c7299b9a3d754f4ea52700ec5f5d63be13a0932e6213993bdb315ea4f6af4f58b3f2f7c8d582ec5e139a03ec73d4a739e407ac02b61a967c9f324b9b36d552c5a1d9e2572ce0badaac755620bbefb63b3614423a3cbe11a0ef79a064dded4234e21965b395b571d2f5d085e0979ff7c97b54d83ae0dd6e6a379e033d099960230a73effd2a3433f055a06ea4402da7cf848d033a9f907c795e1f53ef55d71baf295a974886159e3bfca5a13ba72b48c5d3687e9a6c53c13bfded04426eeb7ec2e70fad79db7ace5c5405ae6d76c7b2cc3569b47cd0bcefa1bb421d7b766b8f425308b5c0db9ea67b2f46daed5a19e4fd89fe92702b01d06d68fe3fb48129f7f11a1103e4c513a96b0d113f1c7d826ae3aca91c4699ddf012964516f68da14ec084197908dd0b280f2cfc23dbf9168c580671ec4601355d56199577cba950f61493aca75bcc90a933f670e12f228e2311bc05716df087c19c17e0f1f851e0a367c5b7e27bc7abfe0dbf4da52bdde0c547031914395c8bcf03edd097e306450ed7f01a433674d684fbe15efb0f60211a21b13253adcc259f1e35c46bb672c0246ea1e48a6e65bd9b5bc51a29296dbaac63722a6fecc2074a32da92e6bcbc0821121b59379ee4486bed71ee41efb | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB\Blob = 1900000001000000100000002ee0c890fdcb0441fa180c68348589950f000000010000001400000044cb4357ecb773b9ac3a3b0b1e45ab6bc45c2f1c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703085300000001000000230000003021301f06092b06010401829b510230123010060a2b0601040182373c0101030200c06200000001000000200000004b22d5a6aec99f3cdb79aa5ec06838479cd5ecba7164f7f22dc1d65f63d85708140000000100000014000000e166cf0ed1f1b34bb7062014fe8712d5f6fefb3e1d000000010000001000000051541f96c328dd7ac3ef2bdce753ac470b000000010000000e00000057006f005300690067006e0000007e000000010000000800000000c00c0f7f39d30168000000010000000800000000800c13c1b9d401030000000100000014000000b94294bf91ea8fb64be61097c7fb001359b676cb040000000100000010000000a1f2f9b5d2c87a74b8f305f1d7e1848d20000000010000007a050000308205763082035ea00302010202105e68d61171946350560068f33ec9c591300d06092a864886f70d01010505003055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e301e170d3039303830383031303030315a170d3339303830383031303030315a3055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e30820222300d06092a864886f70d01010105000382020f003082020a0282020100bdca8dacb8911556977b6b5c7ac2de6bd9a1b0c31023faa7a1b2cc31fa3ed9a6296f163de06bf8b8405fdb39a8007a8ba04d547dc22278fc8e09b8a885d7cc95974b74d89e7ef000e40e89ae4928441a1099320f258853a40db30f1208160b0371271c7fe1dbd2fd6768c4055d0a0e5d70d7d897a0bc53419a918df49e36667a7e56c1905fe6b1682036a48c242c2c470b59766630b5bedeed8ff89dd3bb0130e6f2f30ee02c9280f385f9288ab4542e9aedf776fc156816eb4a6ceb2e128fd4cffe0cc75c1d0b7e0532be5eb0092a42d5c94e90b3590dbb7a7ecdd5085ab47fd81c6911f9270f7b06af5483187be1dd547a51686e77fcc6bf524a6646a1b2671abba34f77a0be5dfffc560b43727790ca9ef9f239f50da9f4ead7e7b3102f30423721cc3070c986980fcc584d83bb7de51aa5378db6ac3297003a6371241e9e37c4ff74d437c0e2fe88466011dd083f5036abb87aa495626a6eb0ca6a215a69f3f3fb1d703995f3a76ea68189a188c53b71caa352ee83bbfda077f4e46fe742db6d4a998a3448bc17dce4800822b6f231c03f043eeb9f2079d6b80664640231d7a9cd52fb84456909002adc558bc406464bc04a1d095b3928fda9abce00f92e484b26e6304ca558cab444824fe7911e33c3b093ff11fc81d2ca1f7129dd764f9225af1d81b70f2f8cc306cc2f27a34ae40e99ba7c1e451f7faa194596fdfc3d0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414e166cf0ed1f1b34bb7062014fe8712d5f6fefb3e300d06092a864886f70d01010505000382020100a8cb7240b276c17e7bfcad64e3327bcc3cb65d46d3f52ce2705dc82ed8067d98d10b21a0895924019df9af097d0a238234d5fc7c7299b9a3d754f4ea52700ec5f5d63be13a0932e6213993bdb315ea4f6af4f58b3f2f7c8d582ec5e139a03ec73d4a739e407ac02b61a967c9f324b9b36d552c5a1d9e2572ce0badaac755620bbefb63b3614423a3cbe11a0ef79a064dded4234e21965b395b571d2f5d085e0979ff7c97b54d83ae0dd6e6a379e033d099960230a73effd2a3433f055a06ea4402da7cf848d033a9f907c795e1f53ef55d71baf295a974886159e3bfca5a13ba72b48c5d3687e9a6c53c13bfded04426eeb7ec2e70fad79db7ace5c5405ae6d76c7b2cc3569b47cd0bcefa1bb421d7b766b8f425308b5c0db9ea67b2f46daed5a19e4fd89fe92702b01d06d68fe3fb48129f7f11a1103e4c513a96b0d113f1c7d826ae3aca91c4699ddf012964516f68da14ec084197908dd0b280f2cfc23dbf9168c580671ec4601355d56199577cba950f61493aca75bcc90a933f670e12f228e2311bc05716df087c19c17e0f1f851e0a367c5b7e27bc7abfe0dbf4da52bdde0c547031914395c8bcf03edd097e306450ed7f01a433674d684fbe15efb0f60211a21b13253adcc259f1e35c46bb672c0246ea1e48a6e65bd9b5bc51a29296dbaac63722a6fecc2074a32da92e6bcbc0821121b59379ee4486bed71ee41efb | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB\Blob = 5c000000010000000400000000100000040000000100000010000000a1f2f9b5d2c87a74b8f305f1d7e1848d030000000100000014000000b94294bf91ea8fb64be61097c7fb001359b676cb68000000010000000800000000800c13c1b9d4017e000000010000000800000000c00c0f7f39d3010b000000010000000e00000057006f005300690067006e0000001d000000010000001000000051541f96c328dd7ac3ef2bdce753ac47140000000100000014000000e166cf0ed1f1b34bb7062014fe8712d5f6fefb3e6200000001000000200000004b22d5a6aec99f3cdb79aa5ec06838479cd5ecba7164f7f22dc1d65f63d857085300000001000000230000003021301f06092b06010401829b510230123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080f000000010000001400000044cb4357ecb773b9ac3a3b0b1e45ab6bc45c2f1c1900000001000000100000002ee0c890fdcb0441fa180c683485899520000000010000007a050000308205763082035ea00302010202105e68d61171946350560068f33ec9c591300d06092a864886f70d01010505003055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e301e170d3039303830383031303030315a170d3339303830383031303030315a3055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e30820222300d06092a864886f70d01010105000382020f003082020a0282020100bdca8dacb8911556977b6b5c7ac2de6bd9a1b0c31023faa7a1b2cc31fa3ed9a6296f163de06bf8b8405fdb39a8007a8ba04d547dc22278fc8e09b8a885d7cc95974b74d89e7ef000e40e89ae4928441a1099320f258853a40db30f1208160b0371271c7fe1dbd2fd6768c4055d0a0e5d70d7d897a0bc53419a918df49e36667a7e56c1905fe6b1682036a48c242c2c470b59766630b5bedeed8ff89dd3bb0130e6f2f30ee02c9280f385f9288ab4542e9aedf776fc156816eb4a6ceb2e128fd4cffe0cc75c1d0b7e0532be5eb0092a42d5c94e90b3590dbb7a7ecdd5085ab47fd81c6911f9270f7b06af5483187be1dd547a51686e77fcc6bf524a6646a1b2671abba34f77a0be5dfffc560b43727790ca9ef9f239f50da9f4ead7e7b3102f30423721cc3070c986980fcc584d83bb7de51aa5378db6ac3297003a6371241e9e37c4ff74d437c0e2fe88466011dd083f5036abb87aa495626a6eb0ca6a215a69f3f3fb1d703995f3a76ea68189a188c53b71caa352ee83bbfda077f4e46fe742db6d4a998a3448bc17dce4800822b6f231c03f043eeb9f2079d6b80664640231d7a9cd52fb84456909002adc558bc406464bc04a1d095b3928fda9abce00f92e484b26e6304ca558cab444824fe7911e33c3b093ff11fc81d2ca1f7129dd764f9225af1d81b70f2f8cc306cc2f27a34ae40e99ba7c1e451f7faa194596fdfc3d0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414e166cf0ed1f1b34bb7062014fe8712d5f6fefb3e300d06092a864886f70d01010505000382020100a8cb7240b276c17e7bfcad64e3327bcc3cb65d46d3f52ce2705dc82ed8067d98d10b21a0895924019df9af097d0a238234d5fc7c7299b9a3d754f4ea52700ec5f5d63be13a0932e6213993bdb315ea4f6af4f58b3f2f7c8d582ec5e139a03ec73d4a739e407ac02b61a967c9f324b9b36d552c5a1d9e2572ce0badaac755620bbefb63b3614423a3cbe11a0ef79a064dded4234e21965b395b571d2f5d085e0979ff7c97b54d83ae0dd6e6a379e033d099960230a73effd2a3433f055a06ea4402da7cf848d033a9f907c795e1f53ef55d71baf295a974886159e3bfca5a13ba72b48c5d3687e9a6c53c13bfded04426eeb7ec2e70fad79db7ace5c5405ae6d76c7b2cc3569b47cd0bcefa1bb421d7b766b8f425308b5c0db9ea67b2f46daed5a19e4fd89fe92702b01d06d68fe3fb48129f7f11a1103e4c513a96b0d113f1c7d826ae3aca91c4699ddf012964516f68da14ec084197908dd0b280f2cfc23dbf9168c580671ec4601355d56199577cba950f61493aca75bcc90a933f670e12f228e2311bc05716df087c19c17e0f1f851e0a367c5b7e27bc7abfe0dbf4da52bdde0c547031914395c8bcf03edd097e306450ed7f01a433674d684fbe15efb0f60211a21b13253adcc259f1e35c46bb672c0246ea1e48a6e65bd9b5bc51a29296dbaac63722a6fecc2074a32da92e6bcbc0821121b59379ee4486bed71ee41efb | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe"
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe
"C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe" /S
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe" QiyiUpdate "C:\Program Files (x86)\IQIYI Video" true
C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe" -install
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IQIYI Video\LStyle\QYPlugin.dll"
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IQIYI Video\LStyle\QYPlugin64.dll"
C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\IQIYI Video\LStyle\QYPlugin64.dll"
C:\Users\Admin\AppData\Local\Temp\nsi35F5.tmp\vmpagedown.exe
"C:\Users\Admin\AppData\Local\Temp\nsi35F5.tmp\vmpagedown.exe" "http://vodguide.ppstream.iqiyi.com/search.php?ver=1.0.6.55" "C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\vmPage\search_top.zip"
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyMaster.exe
"C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyMaster.exe" "C:\Users\Public\QiYi\QiyiHCDN\Config"
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe" QiyiUpdate "C:\Users\Admin\AppData\Roaming\IQIYI Video" true
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe" -i
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe"
C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe" -finstall
C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe"
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe" videolibrary=uninstall_setup
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺视频客户端" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyClient.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyClient.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺HCDN网络数据传输组件" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺视频播放器" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyMiniPlayer.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyMiniPlayer.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺PPS影音 播放器组件" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyPlayer.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyPlayer.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺升级模块" dir=in program="C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyUpdate.exe" action=allow description="C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyUpdate.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺视频辅助程序" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyFragment.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyFragment.exe"
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\mkshortcut.exe
"C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\mkshortcut.exe" -output "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\爱奇艺PPS.lnk" -target "C:\Program Files (x86)\IQIYI Video\LStyle\QyClient.exe" -parameters "quicklaunchrun" -workingdir "C:\Program Files (x86)\IQIYI Video\LStyle" -appid "IQIYI, Inc.PCClient" -icon "C:\Program Files (x86)\IQIYI Video\LStyle\skin\Logo\LogoBevel.ico" -description "使用爱奇艺PPS收看影视节目,清晰流畅更新快"
C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | dl.static.iqiyi.com | udp |
| SG | 118.26.120.3:80 | dl.static.iqiyi.com | tcp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.120.26.118.in-addr.arpa | udp |
| US | 8.8.8.8:53 | vodguide.ppstream.iqiyi.com | udp |
| HK | 118.26.34.91:80 | vodguide.ppstream.iqiyi.com | tcp |
| US | 8.8.8.8:53 | static.qiyi.com | udp |
| US | 8.8.8.8:53 | 91.34.26.118.in-addr.arpa | udp |
| SG | 118.26.120.1:80 | static.qiyi.com | tcp |
| US | 8.8.8.8:53 | msg.iqiyi.com | udp |
| CN | 111.48.118.157:80 | msg.iqiyi.com | tcp |
| N/A | 10.127.255.255:5353 | udp | |
| N/A | 224.0.0.251:5353 | udp | |
| SG | 118.26.120.1:80 | static.qiyi.com | tcp |
| US | 8.8.8.8:53 | 1.120.26.118.in-addr.arpa | udp |
| US | 8.8.8.8:53 | policy.video.iqiyi.com | udp |
| US | 8.8.8.8:53 | list3.ppstream.com.iqiyi.com | udp |
| US | 8.8.8.8:53 | gameguide.youxi.pps.tv | udp |
| US | 8.8.8.8:53 | pdata.video.iqiyi.com | udp |
| SG | 114.119.175.88:80 | pdata.video.iqiyi.com | tcp |
| US | 8.8.8.8:53 | msg.71.am | udp |
| SG | 161.117.186.135:80 | policy.video.iqiyi.com | tcp |
| SG | 161.117.186.135:80 | policy.video.iqiyi.com | tcp |
| HK | 118.26.34.93:80 | list3.ppstream.com.iqiyi.com | tcp |
| CN | 101.227.22.21:17788 | udp | |
| CN | 183.61.167.102:17788 | udp | |
| CN | 183.61.95.33:17788 | udp | |
| CN | 119.188.40.102:17788 | udp | |
| CN | 218.61.39.94:17788 | udp | |
| CN | 119.188.133.214:17788 | udp | |
| CN | 223.99.251.87:17788 | udp | |
| N/A | 127.0.0.1:80 | tcp | |
| SG | 118.26.120.3:80 | gameguide.youxi.pps.tv | tcp |
| US | 8.8.8.8:53 | flux.hcdn.qiyi.com | udp |
| HK | 118.26.34.93:80 | list3.ppstream.com.iqiyi.com | tcp |
| US | 8.8.8.8:53 | 21.22.227.101.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 102.167.61.183.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 33.95.61.183.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 102.40.188.119.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 94.39.61.218.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 214.133.188.119.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 87.251.99.223.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.175.119.114.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 135.186.117.161.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 93.34.26.118.in-addr.arpa | udp |
| CN | 111.48.118.157:80 | msg.iqiyi.com | tcp |
| US | 8.8.8.8:53 | uaa.iqiyi.com | udp |
| CN | 123.125.84.228:80 | uaa.iqiyi.com | tcp |
| US | 8.8.8.8:53 | list.youxi.pps.tv | udp |
| US | 8.8.8.8:53 | aia1.wosign.com | udp |
| CN | 180.163.251.149:80 | aia1.wosign.com | tcp |
| US | 8.8.8.8:53 | 74.19.199.152.in-addr.arpa | udp |
| SG | 118.26.120.1:80 | list.youxi.pps.tv | tcp |
| US | 8.8.8.8:53 | list.youxi.ppstream.com | udp |
| SG | 118.26.120.1:80 | list.youxi.ppstream.com | tcp |
| N/A | 10.127.255.255:60000 | udp | |
| US | 8.8.8.8:53 | cache.hall.game.pps.tv | udp |
| N/A | 10.127.255.255:60001 | udp | |
| N/A | 10.127.255.255:60002 | udp | |
| N/A | 10.127.255.255:60003 | udp | |
| N/A | 10.127.255.255:60004 | udp | |
| N/A | 10.127.255.255:60005 | udp | |
| N/A | 10.127.255.255:60006 | udp | |
| N/A | 10.127.255.255:60007 | udp | |
| N/A | 10.127.255.255:60008 | udp | |
| N/A | 10.127.255.255:60009 | udp | |
| SG | 114.119.175.88:80 | pdata.video.iqiyi.com | tcp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.71.91.104.in-addr.arpa | udp |
| CN | 111.48.118.157:80 | msg.iqiyi.com | tcp |
| US | 8.8.8.8:53 | count.game.pps.tv | udp |
| SG | 114.119.175.88:80 | pdata.video.iqiyi.com | tcp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cdata.video.qiyi.com | udp |
| US | 8.8.8.8:53 | msg.iqiyi.com | udp |
| CN | 111.48.118.157:80 | msg.iqiyi.com | tcp |
| US | 8.8.8.8:53 | ppcc.inter.qiyi.com | udp |
| SG | 47.241.163.52:8088 | ppcc.inter.qiyi.com | tcp |
| CN | 124.237.225.21:80 | msg.iqiyi.com | tcp |
| US | 8.8.8.8:53 | 10.173.189.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\nsi35F5.tmp\StdUtils.dll
| MD5 | 572b16bf94a6492976f777b7d0373971 |
| SHA1 | 3ae46f117f0d3ea32b28de9a73fca0d912260203 |
| SHA256 | fb87ec46457a836060bd3ee33bb37ec4d222d4974816654b32ba9d40efd90c75 |
| SHA512 | 872347db453458f3bfe6d6bb9dbb66305abcf5773acaaea4d06e8800b3329f536d70e6c96e6dd59a20e963bfce496a0fe014302d2469353bfbcba0fbd2ba6fd6 |
C:\Users\Admin\AppData\Local\Temp\nsi35F5.tmp\nsProcess.dll
| MD5 | dacc5f5531887a11804bda084e12cee1 |
| SHA1 | 85e9f509668d9d78120435e5df593d988b16029a |
| SHA256 | 18584f582d454c15de69b515dcd8952a446bf18514de532c309b351b30d77066 |
| SHA512 | f16dcc34d444490621df50ea70772a692592bb35f078f7e7a7360976da873e8e917663344864b56f5989a65ecdaa70d8eb0df4f8a2495f50aa5d25f6f248ae4a |
C:\Users\Admin\AppData\Local\Temp\nsi35F5.tmp\NSISdl.dll
| MD5 | 8ff1b274c581f2e928a418f3b90620eb |
| SHA1 | ad7ad3acd29b882204e74fe36369a6b89a8beed4 |
| SHA256 | df10d5b4ca10ea6ddce96d6ddecfc175f1dff4292a8c5c1f8e0adfb6e1e824c3 |
| SHA512 | a932f9b77fb801e624069661f9c0a7fab4a1e540d763d51bca91e2570767029261946c4ef522e1e9fecc189cd8090e99ba9b454439a3e3fec2ca318dcb428691 |
memory/3376-31-0x0000000005840000-0x0000000005849000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\nsi35F5.tmp\DialogEx.dll
| MD5 | e0f33283138ef1c169f71cb1708985a3 |
| SHA1 | f10f88a272fc7c14f3a37d0f650aa7480bc1efd0 |
| SHA256 | a9b34148448d893558dbb91b51bbbdddd535e2c8387a13e930a4b5096b0af03c |
| SHA512 | 8094b5096cb0c4ee6572217beab6419b8d9ecdb2b902c9c596ef3cc513e4916b05c2bb54fd6084f274b6919d4871ae31cce4eddadd272cb7516c30dfc7c7db0a |
C:\Users\Admin\AppData\Local\Temp\nsi35F5.tmp\nsis7z.dll
| MD5 | cb22c301a35e0d8551578940c018868d |
| SHA1 | 1aa3a19c0c5e8cd02feedca50fb1845a99964ee6 |
| SHA256 | d77183207b8a3b6bf4d7267aee06c7d0f76a6b42e0c007e596931ec59dfa597d |
| SHA512 | f1997bc05c360c1adad90317e7aeb97af9982b2e40e4aadd88522d640fda44648c733e19c572b01647cfb6b2093f2387b41db37f52cd87b8d02c479be0395f5c |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\Signin.png
| MD5 | 053bf204ab9961e6843a052348ca8d5a |
| SHA1 | cfd71af85b0cae52a4c54429e925add459287de6 |
| SHA256 | 1b02340f651f6af1019402f595737b2e71f1e341892e419ae64617aa571db6af |
| SHA512 | 3476e12f9ba18a7663b6519ecec7fba8379a974d5962b37fa0d0ae024f9cb554d9ec44a13c2fc739e472b851531259aa3460f89c7683fde9e8de0b5e8a1051b8 |
C:\Program Files (x86)\IQIYI Video\LStyle\appdata\webcache\2\movieLib_pstyle.css
| MD5 | 04934b72e752e77dd0bf67c9d06a2272 |
| SHA1 | 9e5d3a5a81089989981cd9a44784e42ac40c638d |
| SHA256 | a18e3ac76891027def955b9f310ac15a51c8b514e7b63aa27cbb96f8d38cf926 |
| SHA512 | 7df18a0a080715a781df5baa0a7fccef6eaa4818bed11d985c42ee81acb9ce2665a5aacf30b7517d4d30c1aac6557f6d6a8b6623c15a7ce8f10c5d7691ee380f |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\made\loading_17.png
| MD5 | 0893bfeefb776d58da6ef7bd6b8d64c8 |
| SHA1 | c9905b5a2edb4f4caf87c76425e7db4e63b699d6 |
| SHA256 | e0787ff81f12df511d1b97382c78d58bf28269fac897eae4e0faddffe7be6aeb |
| SHA512 | fe8735b4b0042d1124ccf1dc55edd298fdfadb101bdab735b0bff89068909e61d81cef5b4ba967bc11a683b064cfe7638ea91cc4026a9073e197fc489ec78435 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\normal\loading_17.png
| MD5 | 28853faad82cbc1110fddc0c3a54d85d |
| SHA1 | d11e7cb83ceba8bd8223b59150bbd747222715f4 |
| SHA256 | 59fe4bb150bb9bbb28bedff5d2aaa87307041420100c2be31c9084f9a92fc342 |
| SHA512 | 4cd0a50c61f650df55ede29da8e72f5b909cbd6bae3d375176b0952ca8d46ce0ef06e104ab540e500f23e9ae9af9e2fcfb3b6c52ab7ed8cd6e7a11696150eb1e |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\only\config.ini
| MD5 | 534a43f71c3ae9f4860a02b65d1de41d |
| SHA1 | c6929fb5bba5aa8b56a3c891e9fdc1f571ab42c7 |
| SHA256 | b7b478999cc6ff9694335c0877d9a0182415a0478eb04d660849c8c98556672f |
| SHA512 | 5a048eb691bf368d955c010d30dd122dd27980de7da38a7e0ee1e13b9d98b71e3a5edc5cc1af908d73014bd6a4a2f25aaec5750156598c871d516d6dbcd838c8 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\only\loading_16.png
| MD5 | 11007ca324dd134924fa2bca5244eb73 |
| SHA1 | 56fa6e06d7db2e9693d7eb26eb13d52ab9ce8fc3 |
| SHA256 | 05395237709655d0cb9de583e7c2a3192df91388333d70923798eaf61b1562bb |
| SHA512 | bfa1d34ac7312cc273fbb59748a6e6f0cea6c6db7a498c04dfc8ebc2491806cd9d55fe766f727e3c0a130699a7f20d1a8d2e01ea005ad15cf706b0916a115e63 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PLRes\btnPopUpClose.png
| MD5 | 7844d223803d5f35c4eb453908d3d3d2 |
| SHA1 | f6946969ca172c5735f19cc5215ee170bd963bb6 |
| SHA256 | 38e371539a017a690e546a161ce82dbb757ccfd46e7bfa46c79f8377a9d6a223 |
| SHA512 | 4db164312a9813a0288abef93a4ae7d12945a3f290010603e9343b4bafea8883a1bc626ebea2e548eb6fb915ab47786b2a0adf02b1b720f4968f8b15005fd49f |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\downloadRes\downLoad\config_dlg_close.png
| MD5 | 754a7d6d7740eead34bb5a9f6940f009 |
| SHA1 | 18acc6593a114f5616a539101f31504cb511459e |
| SHA256 | 154ca004725f7936e20efa1780f3cdef20869de4ac00d1b0079c86e31b0e59f3 |
| SHA512 | 785ac79cec2f7f3fd813761a53b506ac5b2fede0ba67ea8a5bf495da5dc028c69e88217d1c45ad4e4ad4c34b3d3a1d6df88363c4e8fc1c095af3078357e2abda |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\AL_Close1.png
| MD5 | 1867ed15b4256e9edc952c334a543201 |
| SHA1 | 386b14cf44c620a55f64c6069409eb0eb5c5e3a3 |
| SHA256 | 87b01d7e066af46794e584904a4bedb27707da1eb32080b60a286f01b9c27820 |
| SHA512 | 027e984adcc90553c9c699c6f1a797eea5e7b02f8cb4a807aa62263780485de235c6294b608b8a34c67e9b5024d98768cab6265cc7776884b9ab4e6585e0c0a3 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\AL_Close2.png
| MD5 | 33cced8d3d97f78972a5418ec7e96f29 |
| SHA1 | 09bb1332bbb1f06eda3bb09f37b3699257162369 |
| SHA256 | 42803e7485f1507abcfca5f455e76956a0dd92ddf2b9d6341a4f2375a941746f |
| SHA512 | 04683521c7dc5e7f4ff701da3fe4291eccbe6b96ba5631676844fe4616a0fcb5e7434a47f245f9b800a47922b25c3d5a2d1063eee61b82db656866c194aca1ce |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\common\common_scroll.png
| MD5 | 93343a6c34066ba4b50a6d455210f538 |
| SHA1 | 10bdaace70cee2656f3c6eedd2c5aa5182dd6de1 |
| SHA256 | d2d9f913aa2646725e0af0d332a10a78b1d7269bf0d774aeb3e6dfc4be40558e |
| SHA512 | 06066d93e57cf309c064779a415a34290d52d9312da45acad20b0655f098568cb438d694f46aafe5d0edeb5178a50c6a729e174c683666d97112a1e09741b1aa |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\listUI\filmlib2_normal.png
| MD5 | 7602910002b9307718bb5a4c221d6be5 |
| SHA1 | 61004f0ad2d3f55c7549b3c8eecf2108d0efb655 |
| SHA256 | 9298a0cc560f702a118dec0bf34bf2d609d5a56d1c49e9658b0eeac0bba59a38 |
| SHA512 | eac38bff7fbf476bcd003253b737723c46c31cdcc205bde5f6c4bad9f5da75d7f08f061976c1bb724888f2a4ec38a9c0667e56c3a993a4a69cf236c43adcd259 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\PersonalCenter\set\cancel.png
| MD5 | d1a6675f77f74cc5847b0a59c49c3f6b |
| SHA1 | f96c4084818cc5836e4086b665e97c3bd7d99f47 |
| SHA256 | 29207dd0cbb59bd1e6fe489ab6ada4cb04c74083099127b194402f1f3ea4bf8d |
| SHA512 | 3f4a2f4fc645fbbcfb5fda5fd37fe8dffb96329c4e66841ca5bdb8c8ae4836e4eaede44a6e4e5ca17cf6bf02524d304bf83922092fc9b88fa72e94a322617388 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\PersonalCenter\set\ok.png
| MD5 | 4d34af20771db466a6439fa56ff5f687 |
| SHA1 | 5223e4281ff91d0bdedc9af14c4825e56cad01e4 |
| SHA256 | b4513c801e7893e2364967da122e5340a69a0c8f28d0318234ee0ca41ac12f60 |
| SHA512 | bb770d0649982b3f4d35a5b6628cd0a4168f31ea89e56eaf92f74412cc2ddcf8773dd60f25ff5c0d04d77960570d652f8b7cf7cdd2cbaf07151024c8355871b3 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\QYProduct\blackback.png
| MD5 | 60ce4c0275c77aa5572892c81728620d |
| SHA1 | 82fc18f800c867547140a7764f38a65eec9a4b96 |
| SHA256 | 8ea1ba9ad6052fe784d79b9bd3ff879152c1d58738cc1faab0a1304b68ce69db |
| SHA512 | ee1d28e4c4b939a721f42f67505de0fe2084f36244b53838a4704a19f32246919a88ab7936b6cfa07e54f4b5c1a11d36305376a3ef42bb73bfa5fd679f83af91 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\MobileAssistant\Fragment\MobileAssistant\scrollbar.png
| MD5 | 8f6b9b86898ce75b5c94034ab1f14381 |
| SHA1 | 4005fdcd5071fe373db13e301301ed0e2dc74876 |
| SHA256 | 874664eaa38618437f551ed0492a89b718e44f2a6f64e2b5590b708c6ddb3b97 |
| SHA512 | f42d284538b5ca4f8382321dd96dc104b8d7f49a1339dc1e7fdcac4fb22099078d29ccf29a7b9d23c94260295f39126197d082b4983acf7be9a1569ad4e237e3 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\PersonalCenter\common\close_big1.png
| MD5 | 5fa2adb150f63cba9e5443befe17eaf4 |
| SHA1 | b5c2a1cee13211626c061c422961a1d0aa742703 |
| SHA256 | 02b0a8d8524e604ed201f912fba8ee58c5573f8310145d3e64a3c279726dac40 |
| SHA512 | 9cbde58a143beabec9cd89ab66bf0f29db6903ece436fdb0c14dfd66803ccc4f951b316216c073be9e8032d20f8e0f93a4c393672884063e3cf8f29f7b404607 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\PersonalCenter\common\close_big2.png
| MD5 | 51fd1384bab6df779007cee07422e4ac |
| SHA1 | 16e89c96196d21f3a85ed6a0f5d97d096c2fbc15 |
| SHA256 | 9c0ec21d601c6e193caa0a04db9c80318d15e1fec713d3e82e53f709a5620fd9 |
| SHA512 | 279c7e23a32b639d13d836b1c9744bbbeec4167a95bd3302bae6ff2738877fb2e99e8a2c95934b38c74d74dda4783ab14f81ac96c551084e9cdbe4f9ee24519c |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\soft_txt_icon_2.png
| MD5 | 1402aa18efd86eec43a345d936f8ab4d |
| SHA1 | c51a44b65489e041620c8ce9ebb5d04c517d27e5 |
| SHA256 | 2276b09083e0da61a550d97c12cd814622c853358f26dcaffd423285ed29640f |
| SHA512 | 7b4913b6a30410d87a3c1c87d4b6d15510c47f17b38c3c2db11da2fb344b88e5c3d86dba86781eff180eb803222af6a58b6a0a12905139b085d988061c5bfd12 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\spaceship.png
| MD5 | 575984f7a1cfe13a9ed1d3800bd7d14a |
| SHA1 | df04fdf4070d29d76aaff8f5b2f68bff6ee0cdc3 |
| SHA256 | 925b723d434d5528c4dd712102279974e76842b71544fa8153d6108d11ccd7de |
| SHA512 | 1d2eca187cfead14798cdc18b4ffed909b483869281bd05fc4b7412fb76a7ee6987efbffa17db218be32d4c2e1ee6e1cb383a4a96983f226baae1f42a330725b |
C:\Windows\Fonts\iqiyi_logo.ttf
| MD5 | e1097f713080d07e0c717e0737ef167e |
| SHA1 | f31f1c4570925450c1fd1ac847cf54461b6274d4 |
| SHA256 | f2aa97fb51572edf0694ae328bbdcb01a172189aa53549b7ea8caebc66325249 |
| SHA512 | 786dda62d0423a9733af16035390e99bd47c5cd8c49f2802eb443896230b2dba70eefbb95de3175b2143dbca1f9ab8ccb8cd8e7cd8b8821f0a93d1a5c69923ad |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe
| MD5 | 95bff19e30f8b194eebc8c81b671d6d7 |
| SHA1 | be2883ccd72263e162350cdfb7bf9d4bc5090f17 |
| SHA256 | 4fa1020f67d7beee37c67bb6bd86ed8925e348adbf5748f9555dc96797c651d3 |
| SHA512 | 762bf013e4d46ca61dceabde986753cf501442e1c72dcf394b628e2f6273ff05f686908bf9ec3be17d28b34602ea0bc18795e296da43dda7de47e81962a559db |
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe
| MD5 | b6e9d6c600b793177c69ffc751c7a8f2 |
| SHA1 | 2d83d7e4a84a5378333250a470ad6577ea858780 |
| SHA256 | 19aa1945952438cc82e633ff6c90c4f21835fb79d49de8649dd1e18ae4c9a80b |
| SHA512 | 069ed99225d5d69817e16f8dfc2c95fe7c667e9e7f7b03897b58ffabe14ced8b4498b5ed117155ef79761f5189f88b54729864623cff1c80d9536f7c08ef4a0b |
C:\Users\Admin\AppData\Local\Temp\nsx59AB.tmp\UserInfo.dll
| MD5 | 13a689123cebd31c1d1862e05981beca |
| SHA1 | 0430094a1a0f639ba9bf5831c24f1f4330762a6d |
| SHA256 | 386933bdaf4774e88670e21abbebdeddf64b1e87b1681f85ac5b3ec1cac8dcdf |
| SHA512 | 0663148e80f4703000bbfc8ede2bcc7cad19877585a5cc46aa13a7003377d7315d33f01c1d311d38bcf5e3782e4b361510214f09a9f6537b856c5ad9bc41fdae |
C:\Program Files (x86)\IQIYI Video\LStyle\GdiPlus.dll
| MD5 | 385e243fc4314f79c1e3042070586d03 |
| SHA1 | bff588a2ac255b4cd1e3a9528529aa0e26f4657b |
| SHA256 | 18055410347fe57288aa11917e77f9b5833f59e669e8c65fc589d314eb6b695c |
| SHA512 | 5854cd81f2f9d5d01a7c0e3ab1b6801490f455191089a21dbc199cf924f59aadbff85d9b963700961c326a4def2a13ff9ba6d3933ead17262b7b66d0279f2c55 |
C:\Users\Admin\AppData\Local\Temp\nsx59AB.tmp\UtilsPlugin.dll
| MD5 | 877ba4f17e960ddcf0c2fa2df62b6710 |
| SHA1 | c452ce34ed1b5043bb26ec938d170fffb14b53c9 |
| SHA256 | 7481df00348a7279b044cf12f7188b2c15e6a1862e5ed2ea8e7e2b0dc6c027ae |
| SHA512 | 0ae63c05641c234d53573e69eb143582916c4c976fc11d78efe0310b8fc04b0491838abd94b8c7b9ee5f77ddf41bfdeef61227c87a6da427c68b9feae6ada612 |
C:\Users\Admin\AppData\Local\Temp\nsx59AB.tmp\System.dll
| MD5 | d0d7d2799802f7cddf8db7a2d8ae1e23 |
| SHA1 | ae8d8cfd9f1a7104036a9e8658f50f9c35c7a1c6 |
| SHA256 | 828819614dc0dbfb73f22d4c3712e6369230eab92819c5d4efe75870ee109a5a |
| SHA512 | 2b5af0e34720eb2f5b0aa04b589b46fb4b4d344b5c5d23fdd382348b051ac9766ff80f6a2455ef66da78ba880e8ce41b23daf741033de7701ca3f17f1adde408 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\AoreAudioVolume.dll
| MD5 | a53ff1a83e51f4915a6a61ee92f408d3 |
| SHA1 | 15f9bbc83652f057f933ad2dfa02c9713884d328 |
| SHA256 | c81aedcb12656accfdbda1d1572311c9a0f9954c0036c0074235f42b6c0567de |
| SHA512 | be5d2b9c05d28c49ad3b8be847f322bbf23b06e9966418f57698e463c9bd112e9ad27081029fee422212013924beedf010074bcce5683308039ccbeee072f436 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\control\mainframe.png
| MD5 | b702f688b22f0d326be0496338307f0d |
| SHA1 | 3a69c7a925bef885ad3491fe552a613dde803aad |
| SHA256 | 97aec0db2dcaf6d20a1ed9e8cb2d8bdde456ea0bbee9bb9275bfb284dd059a52 |
| SHA512 | bd30e9c6518072b5954d69824d084a99011f24cbc386e4be15a3d55bf5f69cc11f1ff4693699b2291278ea7d19665348e847f6c0ba8737fe46ef837dfca3d102 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\DlgDownloadBG.png
| MD5 | aeeb6b445e55574128467d1699a62e16 |
| SHA1 | bd554f4c7472ef3aca5b1e831f44d6b7ed768fb2 |
| SHA256 | 19ec9c459ed3c438a6c1a8630e81265f4ee1414c5ca62c704832cdf01cbfc98d |
| SHA512 | 11e1484541aa5d56b42f4222d9ca442fcd2570daa2656fea78c96a51c7949aafb73012b74d853a3cbe70163056d9b1d50b505c7b9f6c15b18b1fe807e95d9156 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\DelBtnNor.png
| MD5 | 5ff65cbf00ca0eb38b04df50917ac76e |
| SHA1 | d5c498ddc143f575bc00955bdb38640901b85a85 |
| SHA256 | bd20a3bb861109627eef3acfc4cddd6120b6e96d7de94415ed375b43930c78ca |
| SHA512 | 01bdfba569dd465a84878cee5f31ba9694953c9804338654a135d8e081639a88dd419cb7b1f3edf843fa98bcfe0be8550f0e0709f3b51f5a051914fe2cbdfb9e |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\DelBtnHov.png
| MD5 | 159f343e6d3f9ba1d99da3d187398909 |
| SHA1 | 5855b18908526953cb8b8a9d281ee144107dfe76 |
| SHA256 | 1446a20293259c127b7631cb9934265c89810039e8c076cd98f946d55e00da1d |
| SHA512 | 70d6c98f6e57036a2e894c102888ea86575ad3e00e30ff386a1d97c6d4f407d29945f3f11c0e633e4f81179fe6f868755c0e82a0b9f1dbcc46e9410e6207ccc9 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\defaultgameicon.png
| MD5 | 116824ac4fabdc85d00e1d6e60fa6fff |
| SHA1 | 5bc1c4a8c152de3c1ea834a44e247ecb1e1ae865 |
| SHA256 | ae9291b1744a13ff45be576d455f268b93068651944e5fc5998b8c85eb1ef462 |
| SHA512 | a2397a5730dd9fcf8da86e58e247dac4b3806b5cae62b706cff2f8a87a0e7000c875b745413d6ec05c930fc4d5d89bc9b14389c6100bb437443970c889207a61 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CutLine_mov.png
| MD5 | 7069d28083d1361384f04c0d0f68904e |
| SHA1 | eb42e13f8ddd37a0a6493d1a8b4fa629c04ee229 |
| SHA256 | 328ee1b1c993d27c97aeb037e0e755e05a106aa4ee9e3203f350c9a09c4fa8d6 |
| SHA512 | 316e4539fb1cbb0204bbdf4beeeba9c3f268a006f280c74ae3d2d77caf1d34c571073c0dde726cacd94aa2237d5e03c345d38fe0feb6eeff01803cc634358403 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CreateShortLink_Nomal.png
| MD5 | 673f47624b85a4403fdc740fe2721397 |
| SHA1 | ab0843b01f6a80a70c2cbaabe67f273094f80b33 |
| SHA256 | 38bb2806bdc0022541bde8ebdfcc7c4b4724489e870cfa7ec5bc16919057f629 |
| SHA512 | eb43372ada55842ec5a7ca52be3a4cc0eebd1bf83323b06f3587632f9ac76ba57cc943cac46c3529bdc269105aef965a2662924815b253044f5b34a77b0d73ca |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CreateShortLinkTips.png
| MD5 | cb1e1030a8813d00749d308b0da73b9f |
| SHA1 | d97c9823d234fd8650dfcf540796d26f97442776 |
| SHA256 | 2d0fc3650a7f32216d8545dfd541bf4a1ab9f386521ae8f035ef8f6c069089fd |
| SHA512 | 24141197dabf6dd18adedf1920b52dbac7a72eefcf71cf66d02048e08d480c489e3ee72be174c593bd7a4e2882ef62bb0e941e5dc3c98d6abec15db88cbc5051 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CreateShortLinkClose_Hover.png
| MD5 | 2855abc8bc2f15113af379b3ced104a2 |
| SHA1 | 0aebf0295a17c7fd6c722ce10a65c9fc4fd09f03 |
| SHA256 | 671af83a229fe930a720e5805e079ce2c01334125136011d8adc0ee6c3dd50ab |
| SHA512 | 5b5063eacf5fdd0ee1e939090334d5f918c4fe3484a6a0a3ee4c87e8808153002ea8316733a5a8e84c5e019a2c6f4a64b8390ca339cfad7c2135fcdb9024b3c6 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ComBtn.png
| MD5 | 0a2318d4078889584caa4523315bdd70 |
| SHA1 | 281adb6f789746a5c2e446eea019c1e1047ab8d1 |
| SHA256 | 5956629dc86c8486d28137f91fcc493183a53a103c1ba5f4a4019f67a132e9ef |
| SHA512 | 5c05917259aefc4b675913cb896af105b1e7bf7cf07ac400083303e2952e307fb72eef4786e27381a7eee5d2b17dd4d55a9ed1dac7acded6890db927f4657b5b |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CollectingToDesktop_MOV.png
| MD5 | e4c70faae3c4fce495e12d24c2854c8b |
| SHA1 | 9faf01736350722f60820485bc6fa1eb364e2c5d |
| SHA256 | 03f78a2bb0eb5d120d85e7c08a16410921824154186b04ef1027905b07d137a5 |
| SHA512 | 54567bbe7b75acc0e09a4fde69ff50d295609fdab69478d8c995213d4491f09aeaeaa134b2a63a76d3c5f92a8a3b61c1e56b8593dddf17a12ca28b6c8af4e4c9 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CollectingToDesktop_HOV.png
| MD5 | 8f88aba447c6b48423a6ab9502060195 |
| SHA1 | 2d434c1dc6f8523b49dc669abd8f69f50656ffbb |
| SHA256 | 78a209e1df0745cffb42aeeba157769ccf016dd3e356719415c11374f0e592df |
| SHA512 | 927b79089112c18870b43568c6efa1f8959beb39aaba9356429d7209438f8ad330488f3c49d8b4bd9aff29808b751ee52c82f7322dc72eb8a2d1ac563ba79fbf |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ClearIECache_mov.png
| MD5 | 683aebc33c1a57d4e7193ac11edb718d |
| SHA1 | f880556c87ea97d913003b5d61bfcc46309203fc |
| SHA256 | 2a1b1688b001bf57d60a0c47b6b82910c443015711820f6a95a073e540621a40 |
| SHA512 | 6aa2665a83c7b683658601815d6b0957ee3376645158339657bda2ff765b7db91fb8abc49ef0e50c5a9474965ccc9e34ba8df82e28d8cfa2b05cd49225a3a454 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ClearIECache_hov.png
| MD5 | 5e9c33c45c3997c6bd2a227496d8bbf5 |
| SHA1 | 61438ac8294a4723abf785604b05f3cfb3f190a5 |
| SHA256 | 59a3e8272352042ab795032d5dd448b2f9bb3c9bb0e4a119792ef31094e69005 |
| SHA512 | de8df25f3294dfa0a01433df94672272c119ab58c58e7af5bab3cb155dca248113d31e5145b1039dcf24bd27725aa385c860e286ffb7c6a85b4b8f25373451e4 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CheckBoxUncheckHover.png
| MD5 | 0e40da2e0b0d35ca116a6ef8cc09ab27 |
| SHA1 | c43ff70922be4bfcf7823551be6b2167c341f979 |
| SHA256 | b443f84b1dae129f7f7d86f46a1b6afac0569f5537ef79919396a18f15a6c709 |
| SHA512 | 82042d24bb547bf1aba3b317e611516162a955714df3c44807c65ac5ef449b0e5e0eee8e673de24be9eb89c9cf45068afff74fb710e2eb89e9d4106ffdd645a7 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CheckBoxUncheck.png
| MD5 | 0992ec4811eb429baf46221fb1bfe4fa |
| SHA1 | c4d95902c17a2c339cfadd366a1735a08dcef39c |
| SHA256 | 179ad885c9bd5e378b834f0c192f36d24366dac0af3df1c3a7896150e94a56a0 |
| SHA512 | 91fedac3aad148511f028fbf25f544590abd7daac05fdcf9f62063911a1b5e39003e9a97d54425d2facfb4446311dc42499e625766b912656dd1fbebf8fc56b1 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CheckBoxCheck.png
| MD5 | d9cdf06422119816ca6f9c4c72cd09f6 |
| SHA1 | 64e3bd1921689df2f3ee450c8387f9325d1254e0 |
| SHA256 | 23f27fa2319a141f10a8be0cce63f11fce499f5943306d9d555c177c74d346cb |
| SHA512 | 2763f47b77742585d3562d61afe00033ef7ebb9f3fb1b7cd8b163d62ed5770680b00ac27bf200a47734cf715adaab862b9710268db9b6fc67f3c6625612cd88b |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\bt_normal.png
| MD5 | e189e1d1d43cba9e78c008fa248e02fe |
| SHA1 | b374269f970d337375552f2b771126f11da42f15 |
| SHA256 | 911eb65979874e946ac0b2da2440084f98c3088758e2f1bd9144d495061d6aaa |
| SHA512 | fd1b83cd8130000670756169910920145c9a1cc1ca35b4efca61311248db07488d32430d5d3d1c45b231b3d5803e011470326f4e3ec694ff5663a16b66e1df67 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\bt_hover.png
| MD5 | 15ae314b60106f6eda43676eb1d3de6b |
| SHA1 | 2897302883ec07add176c4e03f8dc9a4ae6afdde |
| SHA256 | 8927bf74e9d960dad95ba796e6f2bc731c5b4e1192cbd7b120cbd2f1898ec3c1 |
| SHA512 | 479afa994781f6a495d7439ae3d0afc131ad5ad7bb5ff1471f1ffebf61633a74624e41b06b481f17c8a9f723635de871273147659ddf070664c385215bc23a80 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_Normal.png
| MD5 | e720f8d7d9b1eebf115a3ac3b2e8fa0e |
| SHA1 | 39e7f401d756d0f67413f9ff9ac925780b6e5434 |
| SHA256 | 395035ebf113e3f7d46d5fff75fad4154a674747d86049eb88d0962865cc8328 |
| SHA512 | 436d15bbdfd0cb4a1bbea0db7be5249ebb5e59268c6768a58424c66d155f4485057de177d9b36959c022b6a3c305af072414a75e829d44eee5cc0a8b6b9f4dcf |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_MOV.png
| MD5 | 0373829c3ff82ae9637c770174be1f01 |
| SHA1 | b608bca312673a83e435c475c3b6e56cf0ed0f61 |
| SHA256 | c5db13edaa19ab6024f12952264a3ec005c4ff87f677e33d0444a9485c113179 |
| SHA512 | ed0aa92263b53f6b65820303a08d31c7d54c422425aeae90ea52e08c54e10392acf33fdbb12e9ceea954df9a3cab1b13d4cc39c5a46198c364c6de3017d9dc87 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_Hover.png
| MD5 | d94d4858a788fc9c9e4372a9847660f4 |
| SHA1 | 863d2d93f6909c19ee666e0b73e5a1914343c221 |
| SHA256 | 6dc00a8eef3d4d1394655073304c749b499e4ebe34ba292b3aa1e81f53a2efdf |
| SHA512 | f734a7c10005bd83e56e4f00139375404524c94c8a906d71bcd67dc590d91a9d9caeaef702a67540c7a627100a371c663a4d2c0cc6610b429e2618e1869f61d3 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_HOV.png
| MD5 | fa74861595b2d7f8029238da227c9ed1 |
| SHA1 | c2103a895f32dcb9e8f1b8a7f647d38821b2df1b |
| SHA256 | f22ecceffd5edb6c5818da84a7753190a2f1a050d7a137676c6baf155955ac02 |
| SHA512 | 7ec53735e6f498db76f25e742d512a58729dc3889ed6c5aa78844fa9178b8ced9de960d238258f161c3dfa5217bd2c575488b868910ec55bb5d887469ef7989b |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_click.png
| MD5 | d5c86709860616b2a77328be90005dd7 |
| SHA1 | 8e3051d9b74eeea2641ca29510e8dd75e8f6dbe4 |
| SHA256 | 4f3d3d8f8544b6f5d973443d28972712d9f869f745544822a7af63d66cb9806f |
| SHA512 | c2149278520b60989638870a3095b82f85eb7329f67741c99e832c483e2a2a7159e9f5294223d504eb98f0d1b185a57834d43da0681684a7b4152929cbdaa6de |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnMinNormal.png
| MD5 | 0f8c32a24cdd495cf044885babc2a284 |
| SHA1 | b554b4ed413de5050d7ba05f5f9135fd9a8bad66 |
| SHA256 | ce9610d0d6f603ed290e3eac9813fe6428f85575399f1d2f3b79ec2b80bc5700 |
| SHA512 | 88f4ca39e9acf4d4e17d003e1bb043a2cb4784d3c06fccb061f4e78033ab814ce301d23ae2a71ff454e8ab8f82557bb5385cb6ac927950aab955ce9ca459b0c3 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnMinHover.png
| MD5 | 3d5ce2154e2739d8372cd19ef6894d54 |
| SHA1 | a50b1d7dce90ace6de2f64420cc501d4ae044ff0 |
| SHA256 | bcc19a19510a08c675266e240a2262c92f1bb214f333cdd3c12e50a84f97f881 |
| SHA512 | 382f29d7c19f22c34a9fea304028535835fe2693fc6c86834d3b2ca915a3e14b88cc84cbb368543312f6080f53479039557418efe65e2909ff5b07e06c593684 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnCloseNormal.png
| MD5 | 5c58e41384824810c9233b4e20544bbb |
| SHA1 | 19a38a15c08df0c87fc96fb2ff1218cb11397bb7 |
| SHA256 | b6f7642aa16976177755b14a93dbdb3245eadc5f31cd28abbd97d31b4939a189 |
| SHA512 | 1ee8e676ea4702c7196f123c327aa0cbffc4553f389816dc7a8ade555b7f8c07e5b4b80bcc8ef6546e85e9b5255f20cd81cde91faf509f7d4fc0f35421af364c |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnCloseHover.png
| MD5 | 77c53a33af5d9060edc64d742581c78d |
| SHA1 | a6ca1ead89f69b55cfa2557a2607e056d7b98ad5 |
| SHA256 | b8ee599130d00563db4e4c0cf66b07d626d00e28edc35d9e96734d73c11e56f5 |
| SHA512 | 16bc887a618d565e5a5a93c98bce80510138a1c6687a027b16aa52233154bdead4224d4fbe76b2c48d13e210e426c6c86c250a27e7b4b7e695a9af59e8a8f506 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnCloseDisable.png
| MD5 | a7a050294a34df2b6598b06c0f1b46ee |
| SHA1 | ad0a456db2e13852af75b30f8a84495dd8414b1d |
| SHA256 | a37bc8a0d719e97f6bba561f05056c90beafef08dc5cf77ca0604caf833b82ae |
| SHA512 | 3d1bbf0957bc2df884b0716ecaeaf616f83f803a006cb0b03f66102520d99e98833d4448c407b75dc5a67505f0c7cc23a919a4b58881bd4c1691c5257299df36 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BindPhone_Mov.png
| MD5 | 62cfbca60f27d4b42253c96e1753bfbe |
| SHA1 | 496690bcb841f2c95b1b1d3ad2f8a70c7a3dee76 |
| SHA256 | 4e2ef52fdf819e5d5825857600bb1ebad672a16873f4f55cc02c4b78c04d01e9 |
| SHA512 | ea87b367f8dd7a0670ae3171dd7a6f957682a661528e9f1330921c8273dd6df952e529aed59c21be33f0f733483266468809dcf0a5c38137610849ca2489c4a2 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BindPhone_Hov.png
| MD5 | f061cd973c3245b935f8ca0e7fa2df41 |
| SHA1 | b843b3013d90a3b54f54796f36d0b3ae64e0684a |
| SHA256 | 4047e046f0f25b0f41d3cdc6578e252d35d5b2db9d44f91fbe5400b14073c8d9 |
| SHA512 | 05047a6b3c235dbf1c086ea97759f888efc88dbd25eef984de53aab304e0091f40f0014b6edea4368f813f4d4dc0cd04d35cd1fe0dbaee3a9ddd31b675cac186 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BindingAccountTips.png
| MD5 | 782b458a7a130a168e2348bb6b6d1ec8 |
| SHA1 | bf958b123c4c07ffda0d47939747464deba924a5 |
| SHA256 | 37bea36b1180d7b0a2a2734a46b3ced630c997a461024dbd395e12706ba29599 |
| SHA512 | 3b765d00dbf554f5b4037b27a6ee5a3cfcbc26d33a6b336f5a37fd085de24ac5bf26edf0e6855ece7184799a1e216bc072fe516356a419e9a9d26846c58ce32f |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BarPay_mov.png
| MD5 | 17ded5e0a173363a18f2e998cf05882f |
| SHA1 | 121c6c1c92e0538cc4a1964eea2a6de7784a6ff7 |
| SHA256 | 5a6d97e4f5fd2cd4ff81595bce200b8b9bb0af8c87e0a5a1ad33e2ba8592631b |
| SHA512 | 12d6cf34bb4f1c3482421cc986d2776d6724e3b97f257a2cfa17f373b688742c23d8a7ea682b8bc19c5b6162e2bf9627c415e3dc822a7beed2bdc2799bcb6b6c |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BarPay_hov.png
| MD5 | f3506a23a8eab8def532ec1124fc122b |
| SHA1 | 5dab7891775c289e860aa2b144483209e8673b13 |
| SHA256 | 4d2fe7c86523d8e72de46e925aa1ea473e43b46534088c2372ebd5cd2db6a02f |
| SHA512 | 1095e4cce712836bb0f1b45f83a919f44c7becc8c51f950fec2a1e4034f8d6004372e23f100e51e309a7a406c51b4fd0821cc92f8245b720e094ce6b9cbc0856 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ArrowLine.png
| MD5 | bc5022a5719a200d8cb4df3b5d95337d |
| SHA1 | 33b3389c08cb110d2882ce7c87c09f6ac768e91a |
| SHA256 | 79c208d9481d9ad70b6375aaa875c1933fa6a5aff1a20ca69ae9e2d28fd16253 |
| SHA512 | 71d564c909621d9260a257daaee9bdb019a8fe24f81db319ba7bf31b6e81e5db7fafde7b76c181a615bd872fd702ab60d463ee340b8b8124bb524ded20cc9245 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\QyWebGameClient.exe
| MD5 | 4c3d98b2b8e9e4064e5947d64c4ec613 |
| SHA1 | 6b8c3f2ee10d8f830f8678e5245cc2a35d18ac28 |
| SHA256 | 46f0604a4450ef9f828364e21a1441bdd4fa7a229964aa61bf16279150c9ba55 |
| SHA512 | 10025f9d34b952b09037f5f269583d74c3792cbd386eee2ba3e143f8b04636cf662e1c154f286a86343d0f27a1bece456442daa7eec84670e741c08048aada2a |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\QyGameClient.exe
| MD5 | 85d1912c6c543f4cf7b69ebb76372b5c |
| SHA1 | f43303d60f2baf0d17ae6d14b8d98b6b1152d696 |
| SHA256 | b9f7db9f09ad85025a61617ea56089ac92a2f1c9feccd9b3273f88abf8e769b3 |
| SHA512 | 91f568d0a95625da13da7c416e0813b922f30c280a80e04229365fc121ddec0da9afb4a1f64c63405521d463cebe6ace0c5a6dda4da5bf57a39d50729eac176a |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\LobbyServerList1.xml
| MD5 | 45811f4d5463405dae043f7e9b9ba846 |
| SHA1 | 886a410881900f0237ed619bfca6583da8ef919a |
| SHA256 | a0635bc8344e41759e0a53f0720435952f57fe68df229ac4831fb9300bdc4593 |
| SHA512 | cbaa251953dc1bd3d67c176702a23482472449078344d7d26051589e1b5350f5a85cf120453bc6fa66f6a8c6b8db80bd52c4b2bd67dd53d5a1df02c7dd8d1736 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\img\error.jpg
| MD5 | 2cd92fc75bc2be926e4c002598f325c0 |
| SHA1 | 484461932de9ae91409a67308236f4f35be0a232 |
| SHA256 | 657728435b2d152106f4acac777bfd82157727e0fdf6364c4f0eb4906a443399 |
| SHA512 | d1ab9a455742d502260bbd3279a9da0579f0408b5a7443ec5c28b4a19c8e31f6e622d33c6e886cde289a3f8e6c530c9b94e8c247299a0ed54dd01a41ca8c329d |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\img\bgline.jpg
| MD5 | e50052189fe327cffc4920d2cbfe7e5a |
| SHA1 | 917e438ed6c14579b4c923bed88b0938a5719312 |
| SHA256 | 49de719c563b90541a46fd3db53057cd6e1c854f69359b09453b7c6233707ecd |
| SHA512 | e98a96a9a3086768ce81e2152a7ad98c8f0c08308521ade743940ecc23170ff6309d722869543593f8fea742d2b0f95602a594ddff9894881043654d69008a58 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\img\arrow4.png
| MD5 | 55b2b0485d8cb14277abed24471c8ec6 |
| SHA1 | 121aca27f33646990d96a7b602671a0d01f6a4b5 |
| SHA256 | 41e8a39560fe7c5d41be57668b697ff6d163794c1fe0d178bd7ff603395e5666 |
| SHA512 | d0330c27c501f78cb3dc07df0b2b757851420a88002ee1ccaa5ec3fe29d42fb59bcd26b2fad40bf771e611e2ce7e98fbe7a72c7edd0e58cc5a78075d392cf751 |
C:\Users\Admin\AppData\LocalLow\Unity\WebPlayer\loader\UnityWebPluginAX.ocx
| MD5 | fd0cb28279bb47d33605f6a6f90759e3 |
| SHA1 | 374e2f6beab2520083bf749959dca7e07497a5dc |
| SHA256 | b913b88aa4aac4c0114cf5d0d5e6b3baabd17727e1ec1450452f89bbf91123fc |
| SHA512 | e4e13a61b3c47d2d5ee6bd2b0831f1b8fcf15e0a21dc857c761fd64ee60f06872018582d5b498427961a59a0e5188699658f8d1f60e7d182ae31a10be02527c6 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\img\arrow3.png
| MD5 | 4b7ff428e1010f5b4b924a381ecc6a9f |
| SHA1 | c64a6c92c9ce90dc5f51fcb61d1fa7aaf55765bb |
| SHA256 | 6da80486fc24fe096983626c22d7ade8e72667205ae9ab88eafb1b5e896f7d47 |
| SHA512 | aeb5d028c20c69cc04422c1cbcb0ec9ee72557553cc8230c9129b7baa70c6ad3263d91c9d5c62c69792f321182564d6f52e167e18bbbe4370564790596561d39 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\error_togame.html
| MD5 | 5926b1d339e58bf3ebc876939ea4c2c5 |
| SHA1 | 64394e162c82bc19812c62881ca1545288e56516 |
| SHA256 | 5bbaa9feff7fbe44b794df4b493c587303588d74d138cdb50504ed5b6e3c8669 |
| SHA512 | a8f7374e80214bc9ba4e493e8706e59f55f07ccc31601ed550f0d1787e1c5dc6695f4fbf75e7e2b66c031fb44e391af6d65ea619c3286aedf3d12c819b3751c8 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\ClientGadgetSDK.exe
| MD5 | 9b4a17d36d4730907fbd6d8969ad4533 |
| SHA1 | 547f1198f277c267627083ab3a6f083931a88f85 |
| SHA256 | 7a201389575d3c6f60a638dcd6f8c1c41687b51bc7be541ebc271330e1875be6 |
| SHA512 | 870012f8ee3b07e5b45abdce7c0bbaaca5d963412332669ba1ceb4c6b9c6077740b6336dcd8ea802c10254e73173de00a3e2f1c6e3e6202b397477cc38e96ce2 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ComBtnHov.png
| MD5 | 6cb194b84853c3d231eead716d49370c |
| SHA1 | f95a681a3dc9318580bb62ef8ce4a678d78f1ec5 |
| SHA256 | ee34c098163504705e055812f003d823efe727600ea4b56db73553e2ff9d0219 |
| SHA512 | 5ba1f927981c8679b49c5fd079ea2bcc662c8e9282ae736783c7d46ddcf7c486ad48856cea0831a223ac8b9600eea541a35fd3b4afd4fa2f132dc554503ba4ec |
C:\Users\Admin\AppData\Local\Temp\nsx59AB.tmp\UAC.dll
| MD5 | 113c5f02686d865bc9e8332350274fd1 |
| SHA1 | 4fa4414666f8091e327adb4d81a98a0d6e2e254a |
| SHA256 | 0d21041a1b5cd9f9968fc1d457c78a802c9c5a23f375327e833501b65bcd095d |
| SHA512 | e190d1ee50c0b2446b14f0d9994a0ce58f5dbd2aa5d579f11b3a342da1d4abf0f833a0415d3817636b237930f314be54e4c85b4db4a9b4a3e532980ea9c91284 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\browseradapter.ini
| MD5 | 849c0db12448b338a7454ce8fc8c6365 |
| SHA1 | 1477afec52ba1303cab09b085a7148bcf56b2497 |
| SHA256 | 9897278fec98e2ad20355747dbcb541f2c87d15616f6f15215fec3351590b3a2 |
| SHA512 | cfff784ac25afd5d6b6a4b15b90f41614f3a9299e77921e804b9464504ea472e6da69e2142784a0c6dbd6f2319ef124220da22230dfd260e440939f14b97124b |
C:\Users\Admin\AppData\Local\Temp\nsi35F5.tmp\registry.dll
| MD5 | f81598566d3bebe154d86906e7419653 |
| SHA1 | fb2a980abe37a0b724edf932884931f946332b68 |
| SHA256 | b13d15f8d3e5498d3014dd0c5acc2b42df4aa08f96e0b3e59dc7c9e8c1e7f4c7 |
| SHA512 | 95f6d51d11df472808b9e6a765be6f13231901d698b62f0782e2c17a5ddeee43a8484894f11568ae474ffc7a3b27d8cd01785caf8d87eecdc4a3f64a3ece9255 |
memory/3376-5415-0x0000000005E50000-0x0000000005EA9000-memory.dmp
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\vmPage\1.0.6.55\skin\btn1.png
| MD5 | d271a47cd14ebb209b06ea235a91d144 |
| SHA1 | df6d11259e8b54247d052a64b2fdeb86908ff751 |
| SHA256 | 09fda339a9d73d4bd0c728084eda60967139cf45c96e81fdd63ef562597c37ed |
| SHA512 | a074342fcdad77884e7b3c0360dcdf5798e3b1dca4484df23cd85b0283da0920fc867fddd41bd3d8eb4b1200e43c9b34114ba479ae9d4e874f46ba4808705ef0 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\vmPage\1.0.6.55\skin\no_up_and_down.png
| MD5 | de4109c2374280da714e9dcdb3d3ad9e |
| SHA1 | ce6657dd563c51c684277a4213fb2be052a13f38 |
| SHA256 | 03b3fa0f39cc032f3f0fa0748810bca79d925e64ec5c2df0d3898580b1d7b203 |
| SHA512 | 99160096e9ef20e984d09d6abd34a0522543e00b582254f337a3f61ead89ec933fa8f2618bc1deb32f7bd44c821ddc1ce9b60392fe65374cd1912262a632a205 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\LogoLIB.ico
| MD5 | 094fad0a9eb6e39e00f6452da2e0a596 |
| SHA1 | 053e9e4ae140cc3fec5a500c6941e0181e6ad143 |
| SHA256 | 8429febe04859faa258bb06bfba94eb969ff7e80da207bac6417a22cc83548de |
| SHA512 | b5d41ab5c040b0a001aaf399e9e7fd9646eb5d79268fa5f5258fb22a178b311f46e46c48c75495a003ea15949327700b7011602d726d92cf7e348f83e3ec5867 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyMaster.exe
| MD5 | 9e8e028857769d11281f83f1438d8a35 |
| SHA1 | a6a23b4e3fc495ba235a5b35c35c8fe05ef2f55d |
| SHA256 | 169e700568cb68e2511589aca9be8ad26bcd1ae52d0d109120576934c8af94c0 |
| SHA512 | 42c9874e7b8eaa50888f4f533bd93c11c8277c8435583f06c764a5858f47c34ff5d8fc982540b5c06cb2ee03fb406931eb4db8170c18d0c1bb3f5bdd52d8b9e4 |
C:\Users\Admin\AppData\Local\Temp\nsi35F5.tmp\nsExec.dll
| MD5 | 2d1656be5aab3f3e6873cb5d0c046717 |
| SHA1 | 32facbec7603c0d3a2198c390399711f68a96de7 |
| SHA256 | 63133db6770f8ae0a5b38ddeafafbdc61cd6bc2ab0b6f3c307c0904f29d8a218 |
| SHA512 | d55426322c315a211c4de778eabd676fe2353ebff15f8725eb4e5dce03bb6b92f8a180e5093c2bdb324329bff72b4b1ed37d9d8155ce4c98926e0cbaa1c62ea1 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\PPStream.ini
| MD5 | 8cd8530308b24c696d893a79b81feb9e |
| SHA1 | 78a80c721654f64d57dc2e346f6d27eee52b0626 |
| SHA256 | 51861957dbbc91e9eae102c12b9277ce4bca02a1c17e06fbbe8caf8768753c89 |
| SHA512 | 794578c536864fd594d68fecf0a75541067c14c3ce5d84eac6094925c3f4b4ae9e0a932b20ae8bc4034bc36ea5bf8be783636a0317b473610fc884f07a7340ff |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\PSNetwork.ini
| MD5 | 3221fa8864ba8b73d2b5fbd437a289a0 |
| SHA1 | 0b210cd735603be096e676cc0dc9d4c5c1de63f7 |
| SHA256 | 8ffc6af8e58191176ef82385aa12d25c0379d3b9ccc3a3ce1d041f3c52d61914 |
| SHA512 | 220a1f69d939f7a67c94a70e88acab7be105a7ed4fece40890c0b8650b4f356d3d7cdd348e380673a4cac25cc16e8c1324aa9fb64efb3b7337401876ad13ef4f |
C:\Users\Public\QiYi\QiyiHCDN\Config\PSNetwork.ini
| MD5 | 8388edf1f2a3d184170bfb85b1a6ab27 |
| SHA1 | 9c6c4e03fa5f6a6cd7d5352492d3914a5a1fa587 |
| SHA256 | 934f3cc7c0f41ab68416e9e82ea37d2830fecff40abdf6588f92bfd6906ab6a0 |
| SHA512 | 24aeed103f2a295e65760b4ffa4e3bf318ddd35b29a44912fa6a108b76f3954ccfe968ef6274766087c6b046c351c84e768549e7996ccc8268dff9cde09f772c |
C:\Users\Public\QiYi\QiyiHCDN\Config\PSNetwork.ini
| MD5 | 4153e2e34facd1b4d56938d4008d57de |
| SHA1 | 444ff1694a33770e4b1434b90dee592d840ad549 |
| SHA256 | 197ac563db40cf6399710cc1ec54ed74b7ef4bbf502c0f6b1572ee37b26568d2 |
| SHA512 | ca0aa2cc100550e8d4b26bf65f304fcd7b292ba5d6beeb3497a10ac763c4ae690421b6228bc8e3dba87cfba19b660e6062dbc430a6b67bcf7569cf739b978563 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\browseradapter.ini
| MD5 | 2ead05e1cee75f9ebdd5f9ac04cba9e9 |
| SHA1 | 5c37cff83b68982eac4e8b6ad8a4a00143890a04 |
| SHA256 | 0f318d57f8a2101da3b9c6b6c92e072afdf30150d4e628db68d4502a50b5bbfc |
| SHA512 | ef73d57044c0b860839ad2226a4b61da16191e94a11584cb015c85f9ba6bf7202bad73baf2302426b1a1e3981b292b3eb4774643c31af2d7a12312025270e203 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\browseradapter.ini
| MD5 | d35d65ebeb7daeed102ffae14943ade1 |
| SHA1 | c9fd9325fe68123af7212070ed52c700ed7cc2a0 |
| SHA256 | 381db8693849c168a6244dcc462d298e8c68345b18e4177f4add1fafce27f311 |
| SHA512 | 18eb00494e2e6e4d3ceecf6fb55d7a9050377021ef593e639b5281b9b8567d0744b8203119d414cff83a92730e180d4663997daa0ef0b585324cc082630d93ed |
C:\Users\Admin\AppData\Local\Temp\nsi35F5.tmp\config.ini
| MD5 | 89647dee1e147207f3446ea739c8ab0a |
| SHA1 | 2939c1be244aa0fc4101832ee410418c337a4a40 |
| SHA256 | 09622256300931a8465cb377e4f958239022f4245606e956728a9940321c17c3 |
| SHA512 | 5c18225bd6c7ba97909a1f2473bbc6fbbde49ba91b5aac01cd4846a39eca886e7f27b1ad54bb143a1831b23b66887b5a4de50f63ba5a70dc44f00db18027d257 |
C:\Users\Public\QiYi\QiyiHCDN\Config\PSNetwork.ini
| MD5 | 019c48ec63df304c9a927b1cb64e86cb |
| SHA1 | 67eeabb6ee69de138c0fffb85caba0b983ad674e |
| SHA256 | c71a6c8d3f78e38e1fb356f880e88804b6001e3667c56927d84a02d32caef3ea |
| SHA512 | 49ed0e58eb5d674ac83e93e48ff7f7b4244f609a8dbf491a99106739fcc7b6400adc4d033747d7653b805a81b0a37532dcce65ae38b8582ff15aeb638117a1c9 |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-29 23:22
Reported
2024-04-29 23:25
Platform
win7-20231129-en
Max time kernel
150s
Max time network
146s
Command Line
Signatures
Modifies firewall policy service
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\HCDNClient = "\"C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QyKernel.exe\" -shell_start" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\F: | C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe | N/A |
Installs/modifies Browser Helper Object
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C} | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
Checks for VirtualBox DLLs, possible anti-VM trick
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\VBoxMiniRdrDN | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
Checks installed software on the system
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinDefault\skinplan\PlayerRes\Top\widi.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\URLBar\URLBar_Next.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\userinfo\w\face_masking_s.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\userinfo\w\face_masking_s.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\img\arrow3.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\ConfigRes\faultCheck.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\downloadRes\common\process.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\PersonalCenter\Push\push_right_hover.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\uploadRes\upload_advanced_btn.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\feature\content\f_2.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\MainMenu_bk.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Ctrl\Comment\alpha_thumb.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\titleRes\download.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\videosquare\videosquare_item_comment_mid_normal.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\only\loading_3.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PLRes\trangle_up.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\homepageRes\common_qiyiproduced_logo.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\homepageRes\focus_big_sty_has_collect_normal.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BarPay_hov.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Middle\ADRes\AdInnerPrompt\AdInnerPrompt (1).png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\billboard\channelList.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\info\MsgBox.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\xml\t33.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\downloadRes\common\FilterWndBk3.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\InsetControls\ic_PlayListBKImage.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\tip_wnd\tip_triangle.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\btn_play.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\InstallProgress_Normal.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\ConfigRes\about_close.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Ctrl\GoodsCorner\goods_corner_bk (19).png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\homepageRes\tv.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\PersonalCenter\register\qqs2.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinVIP\skinplan\PlayerRes\RightMenu\icon_local_file.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\xml\t27.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\PSkin\player\player_menu.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\PlayerUI.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\downloadRes\downLoad\check.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\titleRes\title_back.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\vip\loading_9.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\PersonalCenter\image\more_line.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\left_list_tab_line.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\popup_player\close.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinVIP\skinplan\PlayerRes\pstyle\playermode.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\Mobile\AdbWinUsbApi.dll | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Middle\WebWnd.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PLRes\listdownarrow.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\PersonalCenter\set\checkbox2_selected.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\userinfo\b\sep.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PLRes\seriesoptionsmall.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\downloadRes\common\check.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\btn_play.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\PSkin\AdvertiseWnd\AdvertiseWnd_LimitSkipAD.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\PSkin\AdvertiseWnd\AdvertiseWnd_UpNormal.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\PSkin\AdvertiseWnd\AdvertiseWnd_VolumeMute.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Ctrl\Comment\alpha_thumb.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\downloadRes\download_cancel_normal.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\homepageRes\common_demand.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinDefault\skinplan\list\collapsesubgenIcon.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinVIP\skinplan\skin.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\InsetControls\ic_varietymixture_commonctrl.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\DownContinue_Disable.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\ConfigRes\list_header_sep.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\Guide\CallFloatPlayerGuide.xml | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\homepageRes\ylbg.png | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Fonts\iqiyi_logo.ttf | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Windows\psnetwork.ini | C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\nsoC61.tmp\vmpagedown.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyMaster.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\mkshortcut.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe | N/A |
Loads dropped DLL
Registers COM server for autorun
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\InprocServer32\ThreadingModel = "Apartment" | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\LocalLow\\Unity\\WebPlayer\\loader\\UnityWebPluginAX.ocx" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}\InprocServer32 | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}\InprocServer32\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QYPlugin64.dll" | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\InprocServer32 | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\InprocServer32\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QYPlugin64.dll" | C:\Windows\system32\regsvr32.exe | N/A |
Enumerates physical storage devices
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING\QyFragment.exe = "1" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\New Windows\Allow\*.pps.tv | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAC94FEE-45B4-4FD4-9EEA-D8978EC96C6E} | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAC94FEE-45B4-4FD4-9EEA-D8978EC96C6E}\AppName = "QyClient.exe" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\qisu\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\QyBrowser.exe = "9000" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6BE0FB-8B18-4dfc-959F-233651CC4D7F}\AppName = "QyKernel.exe" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ppsrun | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\qips\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\qygameclient | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\ProtocolExecute | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6BE0FB-8B18-4dfc-959F-233651CC4D7F}\Policy = "3" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\QyClient.exe = "9000" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING\QyClient.exe = "1" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ppstream | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_AUTOCONFIG_BRANDING | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING\QyBrowser.exe = "1" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6BE0FB-8B18-4dfc-959F-233651CC4D7F} | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\pps | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\pps\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\qips | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\Policy = "3" | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\magnet2 | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_AUTOCONFIG_BRANDING\iexplore.exe = "1" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING\QyPlayer.exe = "1" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\AppName = "QYFollowVideo.exe" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\Policy = "3" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\magnet2\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\QyPlayer.exe = "9000" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAC94FEE-45B4-4FD4-9EEA-D8978EC96C6E}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAC94FEE-45B4-4FD4-9EEA-D8978EC96C6E}\Policy = "3" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\qisu | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\AppName = "QyClient.exe" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\Policy = "3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC} | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\QyFragment.exe = "9000" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\New Windows\Allow | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\New Windows\Allow\*.ppstream.com | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6BE0FB-8B18-4dfc-959F-233651CC4D7F}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ppsrun\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC} | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\AppName = "QYFollowVideo.exe" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ppstream\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\qygameclient\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\Policy = "3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\AppName = "QyClient.exe" | C:\Windows\system32\regsvr32.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\InprocServer32\ThreadingModel = "Apartment" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\LocalLow\\Unity\\WebPlayer\\loader\\UnityWebPluginAX.ocx, 102" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\MiscStatus\1\ = "131473" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\TypeLib\{75A564FE-95D1-41A9-B1D9-10D1E3CB502B} | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}\TypeLib | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.FlvFilter\CLSID\ = "{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\Control | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\qygameclient\shell\open | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}\InprocServer32 | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\qygameclient | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\AppID\UnityWebPluginAX.ocx\AppID = "{F008CD3D-7044-4CD4-BE14-BF3FCCF144F9}" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\UnityWebPlayer.UnityWebPlayer | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5}\ProxyStubClsid32 | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\pps_qsv\shell\open\command | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.FlvFilter.1\CLSID\ = "{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\TypeLib | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{790F2D3B-18EE-40E2-A45E-1FAC13B6AFB8}\ProxyStubClsid32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.qsv | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.FlashHelper\CLSID | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.FlvFilter.1\CLSID | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{138F4260-66CA-4F7C-812F-C6EED99B7EC7}\TypeLib\ = "{B6360BD3-5CD0-40D3-BD87-DAFF37889F50}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\Version\ = "1.0" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\UnityWebPlayer.UnityWebPlayer\CLSID\ = "{444785F1-DE89-4295-863A-D46C3A781394}" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB} | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3636FE13-B7E3-4CDC-B7E3-A8014BD2CC02}\TypeLib | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB3A16EC-96E2-421B-8462-C6F992596E65}\ProxyStubClsid32 | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Interface\{6130BEAD-7375-4DB7-8B6D-7E41303CE675}\TypeLib | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}\TypeLib\ = "{E1D75F62-CBBD-45C7-9D1D-6B5ECEC2E006}" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\pps_qsv\DefaultIcon | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3636FE13-B7E3-4CDC-B7E3-A8014BD2CC02}\TypeLib | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\pps_pfv | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C} | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\PPS Inc. = "YES" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\InprocServer32\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QYPlugin.dll" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB3A16EC-96E2-421B-8462-C6F992596E65}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\ppstream\ = "PPStream播放协议" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB3A16EC-96E2-421B-8462-C6F992596E65} | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{790F2D3B-18EE-40E2-A45E-1FAC13B6AFB8}\ = "_DQYPluginEvents" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\ppsrun\ = "PPS运行协议" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3636FE13-B7E3-4CDC-B7E3-A8014BD2CC02}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\Control\ | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\pps_pfv\shell\open | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E1D75F62-CBBD-45C7-9D1D-6B5ECEC2E006}\1.0\0\win32\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\Accelerator\\IEHelper.dll" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\pps\URL Protocol | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\pps_pfv\ = "媒体文件(.pfv)" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\magnet2\ = "magnet2播放协议" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\MiscStatus\1 | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3636FE13-B7E3-4CDC-B7E3-A8014BD2CC02}\ = "IFlashHelper" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\QYPlugin.QYPluginCtrl.1 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.pfv\OpenWithList | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E1D75F62-CBBD-45C7-9D1D-6B5ECEC2E006}\1.0\ = "IEHelper 1.0 Type Library" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\ProgID | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5}\TypeLib\Version = "1.0" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}\Programmable | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6360BD3-5CD0-40D3-BD87-DAFF37889F50}\1.0\FLAGS\ = "2" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{138F4260-66CA-4F7C-812F-C6EED99B7EC7}\TypeLib\Version = "1.0" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.pgf | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\qips\DefaultIcon\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QyClient.exe,-0" | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}\InprocServer32\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\Accelerator\\IEHelper.dll" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e52000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a | C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\087a27b9c10371b55e73b9e04e21b57a_JaffaCakes118.exe"
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe
"C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe" /S
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe" QiyiUpdate "C:\Program Files (x86)\IQIYI Video" true
C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe" -install
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IQIYI Video\LStyle\QYPlugin.dll"
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IQIYI Video\LStyle\QYPlugin64.dll"
C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\IQIYI Video\LStyle\QYPlugin64.dll"
C:\Users\Admin\AppData\Local\Temp\nsoC61.tmp\vmpagedown.exe
"C:\Users\Admin\AppData\Local\Temp\nsoC61.tmp\vmpagedown.exe" "http://vodguide.ppstream.iqiyi.com/search.php?ver=1.0.6.55" "C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\vmPage\search_top.zip"
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyMaster.exe
"C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyMaster.exe" "C:\Users\Public\QiYi\QiyiHCDN\Config"
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe" QiyiUpdate "C:\Users\Admin\AppData\Roaming\IQIYI Video" true
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe" -i
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe"
C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe" -finstall
C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe"
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe" videolibrary=uninstall_setup
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺视频客户端" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyClient.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyClient.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺HCDN网络数据传输组件" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺视频播放器" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyMiniPlayer.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyMiniPlayer.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺PPS影音 播放器组件" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyPlayer.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyPlayer.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺升级模块" dir=in program="C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyUpdate.exe" action=allow description="C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyUpdate.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺视频辅助程序" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyFragment.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyFragment.exe"
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\mkshortcut.exe
"C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\mkshortcut.exe" -output "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\爱奇艺PPS.lnk" -target "C:\Program Files (x86)\IQIYI Video\LStyle\QyClient.exe" -parameters "quicklaunchrun" -workingdir "C:\Program Files (x86)\IQIYI Video\LStyle" -appid "IQIYI, Inc.PCClient" -icon "C:\Program Files (x86)\IQIYI Video\LStyle\skin\Logo\LogoBevel.ico" -description "使用爱奇艺PPS收看影视节目,清晰流畅更新快"
C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | dl.static.iqiyi.com | udp |
| SG | 118.26.120.3:80 | dl.static.iqiyi.com | tcp |
| US | 8.8.8.8:53 | vodguide.ppstream.iqiyi.com | udp |
| SG | 118.26.120.1:80 | vodguide.ppstream.iqiyi.com | tcp |
| US | 8.8.8.8:53 | static.qiyi.com | udp |
| HK | 118.26.34.91:80 | static.qiyi.com | tcp |
| US | 8.8.8.8:53 | msg.iqiyi.com | udp |
| CN | 111.48.118.157:80 | msg.iqiyi.com | tcp |
| N/A | 10.127.255.255:5353 | udp | |
| N/A | 224.0.0.251:5353 | udp | |
| HK | 118.26.34.91:80 | static.qiyi.com | tcp |
| US | 8.8.8.8:53 | policy.video.iqiyi.com | udp |
| US | 8.8.8.8:53 | list3.ppstream.com.iqiyi.com | udp |
| US | 8.8.8.8:53 | gameguide.youxi.pps.tv | udp |
| US | 8.8.8.8:53 | policy.video.iqiyi.com | udp |
| US | 8.8.8.8:53 | pdata.video.iqiyi.com | udp |
| CN | 101.227.22.13:17788 | udp | |
| CN | 183.61.167.94:17788 | udp | |
| CN | 183.61.95.10:17788 | udp | |
| CN | 119.188.40.94:17788 | udp | |
| CN | 218.61.39.86:17788 | udp | |
| CN | 119.188.133.206:17788 | udp | |
| CN | 223.99.251.79:17788 | udp | |
| US | 8.8.8.8:53 | msg.71.am | udp |
| SG | 161.117.186.135:80 | policy.video.iqiyi.com | tcp |
| HK | 118.26.34.93:80 | list3.ppstream.com.iqiyi.com | tcp |
| SG | 161.117.186.135:80 | policy.video.iqiyi.com | tcp |
| SG | 114.119.175.88:80 | pdata.video.iqiyi.com | tcp |
| N/A | 127.0.0.1:80 | tcp | |
| US | 8.8.8.8:53 | flux.hcdn.qiyi.com | udp |
| HK | 118.26.34.93:80 | list3.ppstream.com.iqiyi.com | tcp |
| SG | 118.26.120.3:80 | gameguide.youxi.pps.tv | tcp |
| CN | 111.48.118.157:80 | msg.iqiyi.com | tcp |
| US | 8.8.8.8:53 | uaa.iqiyi.com | udp |
| CN | 123.125.84.228:80 | uaa.iqiyi.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | list.youxi.pps.tv | udp |
| US | 8.8.8.8:53 | aia1.wosign.com | udp |
| CN | 180.163.251.149:80 | aia1.wosign.com | tcp |
| SG | 118.26.120.1:80 | list.youxi.pps.tv | tcp |
| US | 8.8.8.8:53 | list.youxi.ppstream.com | udp |
| SG | 118.26.120.1:80 | list.youxi.ppstream.com | tcp |
| N/A | 10.127.255.255:60000 | udp | |
| N/A | 10.127.255.255:60001 | udp | |
| N/A | 10.127.255.255:60002 | udp | |
| N/A | 10.127.255.255:60003 | udp | |
| N/A | 10.127.255.255:60004 | udp | |
| N/A | 10.127.255.255:60005 | udp | |
| N/A | 10.127.255.255:60006 | udp | |
| US | 8.8.8.8:53 | cache.hall.game.pps.tv | udp |
| N/A | 10.127.255.255:60007 | udp | |
| N/A | 10.127.255.255:60008 | udp | |
| N/A | 10.127.255.255:60009 | udp | |
| CN | 111.48.118.157:80 | msg.iqiyi.com | tcp |
| US | 8.8.8.8:53 | count.game.pps.tv | udp |
| SG | 114.119.175.88:80 | pdata.video.iqiyi.com | tcp |
| US | 8.8.8.8:53 | msg.iqiyi.com | udp |
| US | 8.8.8.8:53 | cdata.video.qiyi.com | udp |
| CN | 124.237.225.21:80 | msg.iqiyi.com | tcp |
| US | 8.8.8.8:53 | ppcc.inter.qiyi.com | udp |
| CN | 111.48.118.157:80 | msg.iqiyi.com | tcp |
| SG | 47.241.163.52:8088 | ppcc.inter.qiyi.com | tcp |
Files
\Users\Admin\AppData\Local\Temp\nsoC61.tmp\StdUtils.dll
| MD5 | 572b16bf94a6492976f777b7d0373971 |
| SHA1 | 3ae46f117f0d3ea32b28de9a73fca0d912260203 |
| SHA256 | fb87ec46457a836060bd3ee33bb37ec4d222d4974816654b32ba9d40efd90c75 |
| SHA512 | 872347db453458f3bfe6d6bb9dbb66305abcf5773acaaea4d06e8800b3329f536d70e6c96e6dd59a20e963bfce496a0fe014302d2469353bfbcba0fbd2ba6fd6 |
\Users\Admin\AppData\Local\Temp\nsoC61.tmp\nsProcess.dll
| MD5 | dacc5f5531887a11804bda084e12cee1 |
| SHA1 | 85e9f509668d9d78120435e5df593d988b16029a |
| SHA256 | 18584f582d454c15de69b515dcd8952a446bf18514de532c309b351b30d77066 |
| SHA512 | f16dcc34d444490621df50ea70772a692592bb35f078f7e7a7360976da873e8e917663344864b56f5989a65ecdaa70d8eb0df4f8a2495f50aa5d25f6f248ae4a |
\Users\Admin\AppData\Local\Temp\nsoC61.tmp\NSISdl.dll
| MD5 | 8ff1b274c581f2e928a418f3b90620eb |
| SHA1 | ad7ad3acd29b882204e74fe36369a6b89a8beed4 |
| SHA256 | df10d5b4ca10ea6ddce96d6ddecfc175f1dff4292a8c5c1f8e0adfb6e1e824c3 |
| SHA512 | a932f9b77fb801e624069661f9c0a7fab4a1e540d763d51bca91e2570767029261946c4ef522e1e9fecc189cd8090e99ba9b454439a3e3fec2ca318dcb428691 |
\Users\Admin\AppData\Local\Temp\nsoC61.tmp\DialogEx.dll
| MD5 | e0f33283138ef1c169f71cb1708985a3 |
| SHA1 | f10f88a272fc7c14f3a37d0f650aa7480bc1efd0 |
| SHA256 | a9b34148448d893558dbb91b51bbbdddd535e2c8387a13e930a4b5096b0af03c |
| SHA512 | 8094b5096cb0c4ee6572217beab6419b8d9ecdb2b902c9c596ef3cc513e4916b05c2bb54fd6084f274b6919d4871ae31cce4eddadd272cb7516c30dfc7c7db0a |
memory/1700-28-0x0000000003240000-0x0000000003249000-memory.dmp
\Users\Admin\AppData\Local\Temp\nsoC61.tmp\nsis7z.dll
| MD5 | cb22c301a35e0d8551578940c018868d |
| SHA1 | 1aa3a19c0c5e8cd02feedca50fb1845a99964ee6 |
| SHA256 | d77183207b8a3b6bf4d7267aee06c7d0f76a6b42e0c007e596931ec59dfa597d |
| SHA512 | f1997bc05c360c1adad90317e7aeb97af9982b2e40e4aadd88522d640fda44648c733e19c572b01647cfb6b2093f2387b41db37f52cd87b8d02c479be0395f5c |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\Signin.png
| MD5 | 053bf204ab9961e6843a052348ca8d5a |
| SHA1 | cfd71af85b0cae52a4c54429e925add459287de6 |
| SHA256 | 1b02340f651f6af1019402f595737b2e71f1e341892e419ae64617aa571db6af |
| SHA512 | 3476e12f9ba18a7663b6519ecec7fba8379a974d5962b37fa0d0ae024f9cb554d9ec44a13c2fc739e472b851531259aa3460f89c7683fde9e8de0b5e8a1051b8 |
C:\Program Files (x86)\IQIYI Video\LStyle\appdata\webcache\2\movieLib_pstyle.css
| MD5 | 04934b72e752e77dd0bf67c9d06a2272 |
| SHA1 | 9e5d3a5a81089989981cd9a44784e42ac40c638d |
| SHA256 | a18e3ac76891027def955b9f310ac15a51c8b514e7b63aa27cbb96f8d38cf926 |
| SHA512 | 7df18a0a080715a781df5baa0a7fccef6eaa4818bed11d985c42ee81acb9ce2665a5aacf30b7517d4d30c1aac6557f6d6a8b6623c15a7ce8f10c5d7691ee380f |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\made\loading_17.png
| MD5 | 0893bfeefb776d58da6ef7bd6b8d64c8 |
| SHA1 | c9905b5a2edb4f4caf87c76425e7db4e63b699d6 |
| SHA256 | e0787ff81f12df511d1b97382c78d58bf28269fac897eae4e0faddffe7be6aeb |
| SHA512 | fe8735b4b0042d1124ccf1dc55edd298fdfadb101bdab735b0bff89068909e61d81cef5b4ba967bc11a683b064cfe7638ea91cc4026a9073e197fc489ec78435 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\normal\loading_17.png
| MD5 | 28853faad82cbc1110fddc0c3a54d85d |
| SHA1 | d11e7cb83ceba8bd8223b59150bbd747222715f4 |
| SHA256 | 59fe4bb150bb9bbb28bedff5d2aaa87307041420100c2be31c9084f9a92fc342 |
| SHA512 | 4cd0a50c61f650df55ede29da8e72f5b909cbd6bae3d375176b0952ca8d46ce0ef06e104ab540e500f23e9ae9af9e2fcfb3b6c52ab7ed8cd6e7a11696150eb1e |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\only\config.ini
| MD5 | 534a43f71c3ae9f4860a02b65d1de41d |
| SHA1 | c6929fb5bba5aa8b56a3c891e9fdc1f571ab42c7 |
| SHA256 | b7b478999cc6ff9694335c0877d9a0182415a0478eb04d660849c8c98556672f |
| SHA512 | 5a048eb691bf368d955c010d30dd122dd27980de7da38a7e0ee1e13b9d98b71e3a5edc5cc1af908d73014bd6a4a2f25aaec5750156598c871d516d6dbcd838c8 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\only\loading_16.png
| MD5 | 11007ca324dd134924fa2bca5244eb73 |
| SHA1 | 56fa6e06d7db2e9693d7eb26eb13d52ab9ce8fc3 |
| SHA256 | 05395237709655d0cb9de583e7c2a3192df91388333d70923798eaf61b1562bb |
| SHA512 | bfa1d34ac7312cc273fbb59748a6e6f0cea6c6db7a498c04dfc8ebc2491806cd9d55fe766f727e3c0a130699a7f20d1a8d2e01ea005ad15cf706b0916a115e63 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PLRes\btnPopUpClose.png
| MD5 | 7844d223803d5f35c4eb453908d3d3d2 |
| SHA1 | f6946969ca172c5735f19cc5215ee170bd963bb6 |
| SHA256 | 38e371539a017a690e546a161ce82dbb757ccfd46e7bfa46c79f8377a9d6a223 |
| SHA512 | 4db164312a9813a0288abef93a4ae7d12945a3f290010603e9343b4bafea8883a1bc626ebea2e548eb6fb915ab47786b2a0adf02b1b720f4968f8b15005fd49f |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\downloadRes\downLoad\config_dlg_close.png
| MD5 | 754a7d6d7740eead34bb5a9f6940f009 |
| SHA1 | 18acc6593a114f5616a539101f31504cb511459e |
| SHA256 | 154ca004725f7936e20efa1780f3cdef20869de4ac00d1b0079c86e31b0e59f3 |
| SHA512 | 785ac79cec2f7f3fd813761a53b506ac5b2fede0ba67ea8a5bf495da5dc028c69e88217d1c45ad4e4ad4c34b3d3a1d6df88363c4e8fc1c095af3078357e2abda |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\AL_Close1.png
| MD5 | 1867ed15b4256e9edc952c334a543201 |
| SHA1 | 386b14cf44c620a55f64c6069409eb0eb5c5e3a3 |
| SHA256 | 87b01d7e066af46794e584904a4bedb27707da1eb32080b60a286f01b9c27820 |
| SHA512 | 027e984adcc90553c9c699c6f1a797eea5e7b02f8cb4a807aa62263780485de235c6294b608b8a34c67e9b5024d98768cab6265cc7776884b9ab4e6585e0c0a3 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\AL_Close2.png
| MD5 | 33cced8d3d97f78972a5418ec7e96f29 |
| SHA1 | 09bb1332bbb1f06eda3bb09f37b3699257162369 |
| SHA256 | 42803e7485f1507abcfca5f455e76956a0dd92ddf2b9d6341a4f2375a941746f |
| SHA512 | 04683521c7dc5e7f4ff701da3fe4291eccbe6b96ba5631676844fe4616a0fcb5e7434a47f245f9b800a47922b25c3d5a2d1063eee61b82db656866c194aca1ce |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\common\common_scroll.png
| MD5 | 93343a6c34066ba4b50a6d455210f538 |
| SHA1 | 10bdaace70cee2656f3c6eedd2c5aa5182dd6de1 |
| SHA256 | d2d9f913aa2646725e0af0d332a10a78b1d7269bf0d774aeb3e6dfc4be40558e |
| SHA512 | 06066d93e57cf309c064779a415a34290d52d9312da45acad20b0655f098568cb438d694f46aafe5d0edeb5178a50c6a729e174c683666d97112a1e09741b1aa |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\listUI\filmlib2_normal.png
| MD5 | 7602910002b9307718bb5a4c221d6be5 |
| SHA1 | 61004f0ad2d3f55c7549b3c8eecf2108d0efb655 |
| SHA256 | 9298a0cc560f702a118dec0bf34bf2d609d5a56d1c49e9658b0eeac0bba59a38 |
| SHA512 | eac38bff7fbf476bcd003253b737723c46c31cdcc205bde5f6c4bad9f5da75d7f08f061976c1bb724888f2a4ec38a9c0667e56c3a993a4a69cf236c43adcd259 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\PersonalCenter\set\cancel.png
| MD5 | d1a6675f77f74cc5847b0a59c49c3f6b |
| SHA1 | f96c4084818cc5836e4086b665e97c3bd7d99f47 |
| SHA256 | 29207dd0cbb59bd1e6fe489ab6ada4cb04c74083099127b194402f1f3ea4bf8d |
| SHA512 | 3f4a2f4fc645fbbcfb5fda5fd37fe8dffb96329c4e66841ca5bdb8c8ae4836e4eaede44a6e4e5ca17cf6bf02524d304bf83922092fc9b88fa72e94a322617388 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\PersonalCenter\set\ok.png
| MD5 | 4d34af20771db466a6439fa56ff5f687 |
| SHA1 | 5223e4281ff91d0bdedc9af14c4825e56cad01e4 |
| SHA256 | b4513c801e7893e2364967da122e5340a69a0c8f28d0318234ee0ca41ac12f60 |
| SHA512 | bb770d0649982b3f4d35a5b6628cd0a4168f31ea89e56eaf92f74412cc2ddcf8773dd60f25ff5c0d04d77960570d652f8b7cf7cdd2cbaf07151024c8355871b3 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\QYProduct\blackback.png
| MD5 | 60ce4c0275c77aa5572892c81728620d |
| SHA1 | 82fc18f800c867547140a7764f38a65eec9a4b96 |
| SHA256 | 8ea1ba9ad6052fe784d79b9bd3ff879152c1d58738cc1faab0a1304b68ce69db |
| SHA512 | ee1d28e4c4b939a721f42f67505de0fe2084f36244b53838a4704a19f32246919a88ab7936b6cfa07e54f4b5c1a11d36305376a3ef42bb73bfa5fd679f83af91 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\MobileAssistant\Fragment\MobileAssistant\scrollbar.png
| MD5 | 8f6b9b86898ce75b5c94034ab1f14381 |
| SHA1 | 4005fdcd5071fe373db13e301301ed0e2dc74876 |
| SHA256 | 874664eaa38618437f551ed0492a89b718e44f2a6f64e2b5590b708c6ddb3b97 |
| SHA512 | f42d284538b5ca4f8382321dd96dc104b8d7f49a1339dc1e7fdcac4fb22099078d29ccf29a7b9d23c94260295f39126197d082b4983acf7be9a1569ad4e237e3 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\PersonalCenter\common\close_big1.png
| MD5 | 5fa2adb150f63cba9e5443befe17eaf4 |
| SHA1 | b5c2a1cee13211626c061c422961a1d0aa742703 |
| SHA256 | 02b0a8d8524e604ed201f912fba8ee58c5573f8310145d3e64a3c279726dac40 |
| SHA512 | 9cbde58a143beabec9cd89ab66bf0f29db6903ece436fdb0c14dfd66803ccc4f951b316216c073be9e8032d20f8e0f93a4c393672884063e3cf8f29f7b404607 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\PersonalCenter\common\close_big2.png
| MD5 | 51fd1384bab6df779007cee07422e4ac |
| SHA1 | 16e89c96196d21f3a85ed6a0f5d97d096c2fbc15 |
| SHA256 | 9c0ec21d601c6e193caa0a04db9c80318d15e1fec713d3e82e53f709a5620fd9 |
| SHA512 | 279c7e23a32b639d13d836b1c9744bbbeec4167a95bd3302bae6ff2738877fb2e99e8a2c95934b38c74d74dda4783ab14f81ac96c551084e9cdbe4f9ee24519c |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\soft_txt_icon_2.png
| MD5 | 1402aa18efd86eec43a345d936f8ab4d |
| SHA1 | c51a44b65489e041620c8ce9ebb5d04c517d27e5 |
| SHA256 | 2276b09083e0da61a550d97c12cd814622c853358f26dcaffd423285ed29640f |
| SHA512 | 7b4913b6a30410d87a3c1c87d4b6d15510c47f17b38c3c2db11da2fb344b88e5c3d86dba86781eff180eb803222af6a58b6a0a12905139b085d988061c5bfd12 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\spaceship.png
| MD5 | 575984f7a1cfe13a9ed1d3800bd7d14a |
| SHA1 | df04fdf4070d29d76aaff8f5b2f68bff6ee0cdc3 |
| SHA256 | 925b723d434d5528c4dd712102279974e76842b71544fa8153d6108d11ccd7de |
| SHA512 | 1d2eca187cfead14798cdc18b4ffed909b483869281bd05fc4b7412fb76a7ee6987efbffa17db218be32d4c2e1ee6e1cb383a4a96983f226baae1f42a330725b |
\Program Files (x86)\IQIYI Video\LStyle\QyClient.exe
| MD5 | 3544d9748462cd7593833d993c29a37c |
| SHA1 | 1877aca3b883eaddc14bb00fb2055240f474647e |
| SHA256 | 16957ec4af0aa862c4d7da1ddc270560837485b602246a475f3d7124e942db96 |
| SHA512 | 805b0ee15917ef2c31f1d087ebbcf23cf40cadeb0cf25512bffe29678c4e4a91cbd1888871d047efb4a173fcb1b1be75e5a9b59707f6b9b0b25cb9fe25523775 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\logo.ttf
| MD5 | e1097f713080d07e0c717e0737ef167e |
| SHA1 | f31f1c4570925450c1fd1ac847cf54461b6274d4 |
| SHA256 | f2aa97fb51572edf0694ae328bbdcb01a172189aa53549b7ea8caebc66325249 |
| SHA512 | 786dda62d0423a9733af16035390e99bd47c5cd8c49f2802eb443896230b2dba70eefbb95de3175b2143dbca1f9ab8ccb8cd8e7cd8b8821f0a93d1a5c69923ad |
\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe
| MD5 | 95bff19e30f8b194eebc8c81b671d6d7 |
| SHA1 | be2883ccd72263e162350cdfb7bf9d4bc5090f17 |
| SHA256 | 4fa1020f67d7beee37c67bb6bd86ed8925e348adbf5748f9555dc96797c651d3 |
| SHA512 | 762bf013e4d46ca61dceabde986753cf501442e1c72dcf394b628e2f6273ff05f686908bf9ec3be17d28b34602ea0bc18795e296da43dda7de47e81962a559db |
C:\Program Files (x86)\IQIYI Video\LStyle\GdiPlus.dll
| MD5 | 385e243fc4314f79c1e3042070586d03 |
| SHA1 | bff588a2ac255b4cd1e3a9528529aa0e26f4657b |
| SHA256 | 18055410347fe57288aa11917e77f9b5833f59e669e8c65fc589d314eb6b695c |
| SHA512 | 5854cd81f2f9d5d01a7c0e3ab1b6801490f455191089a21dbc199cf924f59aadbff85d9b963700961c326a4def2a13ff9ba6d3933ead17262b7b66d0279f2c55 |
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe
| MD5 | b6e9d6c600b793177c69ffc751c7a8f2 |
| SHA1 | 2d83d7e4a84a5378333250a470ad6577ea858780 |
| SHA256 | 19aa1945952438cc82e633ff6c90c4f21835fb79d49de8649dd1e18ae4c9a80b |
| SHA512 | 069ed99225d5d69817e16f8dfc2c95fe7c667e9e7f7b03897b58ffabe14ced8b4498b5ed117155ef79761f5189f88b54729864623cff1c80d9536f7c08ef4a0b |
\Users\Admin\AppData\Local\Temp\nso3B00.tmp\UserInfo.dll
| MD5 | 13a689123cebd31c1d1862e05981beca |
| SHA1 | 0430094a1a0f639ba9bf5831c24f1f4330762a6d |
| SHA256 | 386933bdaf4774e88670e21abbebdeddf64b1e87b1681f85ac5b3ec1cac8dcdf |
| SHA512 | 0663148e80f4703000bbfc8ede2bcc7cad19877585a5cc46aa13a7003377d7315d33f01c1d311d38bcf5e3782e4b361510214f09a9f6537b856c5ad9bc41fdae |
\Users\Admin\AppData\Local\Temp\nso3B00.tmp\System.dll
| MD5 | d0d7d2799802f7cddf8db7a2d8ae1e23 |
| SHA1 | ae8d8cfd9f1a7104036a9e8658f50f9c35c7a1c6 |
| SHA256 | 828819614dc0dbfb73f22d4c3712e6369230eab92819c5d4efe75870ee109a5a |
| SHA512 | 2b5af0e34720eb2f5b0aa04b589b46fb4b4d344b5c5d23fdd382348b051ac9766ff80f6a2455ef66da78ba880e8ce41b23daf741033de7701ca3f17f1adde408 |
C:\Users\Admin\AppData\Local\Temp\nso3B00.tmp\UtilsPlugin.dll
| MD5 | 877ba4f17e960ddcf0c2fa2df62b6710 |
| SHA1 | c452ce34ed1b5043bb26ec938d170fffb14b53c9 |
| SHA256 | 7481df00348a7279b044cf12f7188b2c15e6a1862e5ed2ea8e7e2b0dc6c027ae |
| SHA512 | 0ae63c05641c234d53573e69eb143582916c4c976fc11d78efe0310b8fc04b0491838abd94b8c7b9ee5f77ddf41bfdeef61227c87a6da427c68b9feae6ada612 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\AoreAudioVolume.dll
| MD5 | a53ff1a83e51f4915a6a61ee92f408d3 |
| SHA1 | 15f9bbc83652f057f933ad2dfa02c9713884d328 |
| SHA256 | c81aedcb12656accfdbda1d1572311c9a0f9954c0036c0074235f42b6c0567de |
| SHA512 | be5d2b9c05d28c49ad3b8be847f322bbf23b06e9966418f57698e463c9bd112e9ad27081029fee422212013924beedf010074bcce5683308039ccbeee072f436 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\LobbyServerList1.xml
| MD5 | 45811f4d5463405dae043f7e9b9ba846 |
| SHA1 | 886a410881900f0237ed619bfca6583da8ef919a |
| SHA256 | a0635bc8344e41759e0a53f0720435952f57fe68df229ac4831fb9300bdc4593 |
| SHA512 | cbaa251953dc1bd3d67c176702a23482472449078344d7d26051589e1b5350f5a85cf120453bc6fa66f6a8c6b8db80bd52c4b2bd67dd53d5a1df02c7dd8d1736 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\QyGameClient.exe
| MD5 | 85d1912c6c543f4cf7b69ebb76372b5c |
| SHA1 | f43303d60f2baf0d17ae6d14b8d98b6b1152d696 |
| SHA256 | b9f7db9f09ad85025a61617ea56089ac92a2f1c9feccd9b3273f88abf8e769b3 |
| SHA512 | 91f568d0a95625da13da7c416e0813b922f30c280a80e04229365fc121ddec0da9afb4a1f64c63405521d463cebe6ace0c5a6dda4da5bf57a39d50729eac176a |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\img\error.jpg
| MD5 | 2cd92fc75bc2be926e4c002598f325c0 |
| SHA1 | 484461932de9ae91409a67308236f4f35be0a232 |
| SHA256 | 657728435b2d152106f4acac777bfd82157727e0fdf6364c4f0eb4906a443399 |
| SHA512 | d1ab9a455742d502260bbd3279a9da0579f0408b5a7443ec5c28b4a19c8e31f6e622d33c6e886cde289a3f8e6c530c9b94e8c247299a0ed54dd01a41ca8c329d |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\img\bgline.jpg
| MD5 | e50052189fe327cffc4920d2cbfe7e5a |
| SHA1 | 917e438ed6c14579b4c923bed88b0938a5719312 |
| SHA256 | 49de719c563b90541a46fd3db53057cd6e1c854f69359b09453b7c6233707ecd |
| SHA512 | e98a96a9a3086768ce81e2152a7ad98c8f0c08308521ade743940ecc23170ff6309d722869543593f8fea742d2b0f95602a594ddff9894881043654d69008a58 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_MOV.png
| MD5 | 0373829c3ff82ae9637c770174be1f01 |
| SHA1 | b608bca312673a83e435c475c3b6e56cf0ed0f61 |
| SHA256 | c5db13edaa19ab6024f12952264a3ec005c4ff87f677e33d0444a9485c113179 |
| SHA512 | ed0aa92263b53f6b65820303a08d31c7d54c422425aeae90ea52e08c54e10392acf33fdbb12e9ceea954df9a3cab1b13d4cc39c5a46198c364c6de3017d9dc87 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\DelBtnNor.png
| MD5 | 5ff65cbf00ca0eb38b04df50917ac76e |
| SHA1 | d5c498ddc143f575bc00955bdb38640901b85a85 |
| SHA256 | bd20a3bb861109627eef3acfc4cddd6120b6e96d7de94415ed375b43930c78ca |
| SHA512 | 01bdfba569dd465a84878cee5f31ba9694953c9804338654a135d8e081639a88dd419cb7b1f3edf843fa98bcfe0be8550f0e0709f3b51f5a051914fe2cbdfb9e |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\DelBtnHov.png
| MD5 | 159f343e6d3f9ba1d99da3d187398909 |
| SHA1 | 5855b18908526953cb8b8a9d281ee144107dfe76 |
| SHA256 | 1446a20293259c127b7631cb9934265c89810039e8c076cd98f946d55e00da1d |
| SHA512 | 70d6c98f6e57036a2e894c102888ea86575ad3e00e30ff386a1d97c6d4f407d29945f3f11c0e633e4f81179fe6f868755c0e82a0b9f1dbcc46e9410e6207ccc9 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\defaultgameicon.png
| MD5 | 116824ac4fabdc85d00e1d6e60fa6fff |
| SHA1 | 5bc1c4a8c152de3c1ea834a44e247ecb1e1ae865 |
| SHA256 | ae9291b1744a13ff45be576d455f268b93068651944e5fc5998b8c85eb1ef462 |
| SHA512 | a2397a5730dd9fcf8da86e58e247dac4b3806b5cae62b706cff2f8a87a0e7000c875b745413d6ec05c930fc4d5d89bc9b14389c6100bb437443970c889207a61 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CutLine_mov.png
| MD5 | 7069d28083d1361384f04c0d0f68904e |
| SHA1 | eb42e13f8ddd37a0a6493d1a8b4fa629c04ee229 |
| SHA256 | 328ee1b1c993d27c97aeb037e0e755e05a106aa4ee9e3203f350c9a09c4fa8d6 |
| SHA512 | 316e4539fb1cbb0204bbdf4beeeba9c3f268a006f280c74ae3d2d77caf1d34c571073c0dde726cacd94aa2237d5e03c345d38fe0feb6eeff01803cc634358403 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CreateShortLink_Nomal.png
| MD5 | 673f47624b85a4403fdc740fe2721397 |
| SHA1 | ab0843b01f6a80a70c2cbaabe67f273094f80b33 |
| SHA256 | 38bb2806bdc0022541bde8ebdfcc7c4b4724489e870cfa7ec5bc16919057f629 |
| SHA512 | eb43372ada55842ec5a7ca52be3a4cc0eebd1bf83323b06f3587632f9ac76ba57cc943cac46c3529bdc269105aef965a2662924815b253044f5b34a77b0d73ca |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CreateShortLinkTips.png
| MD5 | cb1e1030a8813d00749d308b0da73b9f |
| SHA1 | d97c9823d234fd8650dfcf540796d26f97442776 |
| SHA256 | 2d0fc3650a7f32216d8545dfd541bf4a1ab9f386521ae8f035ef8f6c069089fd |
| SHA512 | 24141197dabf6dd18adedf1920b52dbac7a72eefcf71cf66d02048e08d480c489e3ee72be174c593bd7a4e2882ef62bb0e941e5dc3c98d6abec15db88cbc5051 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CreateShortLinkClose_Hover.png
| MD5 | 2855abc8bc2f15113af379b3ced104a2 |
| SHA1 | 0aebf0295a17c7fd6c722ce10a65c9fc4fd09f03 |
| SHA256 | 671af83a229fe930a720e5805e079ce2c01334125136011d8adc0ee6c3dd50ab |
| SHA512 | 5b5063eacf5fdd0ee1e939090334d5f918c4fe3484a6a0a3ee4c87e8808153002ea8316733a5a8e84c5e019a2c6f4a64b8390ca339cfad7c2135fcdb9024b3c6 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CommonBtn_normal.png
| MD5 | e189e1d1d43cba9e78c008fa248e02fe |
| SHA1 | b374269f970d337375552f2b771126f11da42f15 |
| SHA256 | 911eb65979874e946ac0b2da2440084f98c3088758e2f1bd9144d495061d6aaa |
| SHA512 | fd1b83cd8130000670756169910920145c9a1cc1ca35b4efca61311248db07488d32430d5d3d1c45b231b3d5803e011470326f4e3ec694ff5663a16b66e1df67 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CommonBtn_Hover.png
| MD5 | 15ae314b60106f6eda43676eb1d3de6b |
| SHA1 | 2897302883ec07add176c4e03f8dc9a4ae6afdde |
| SHA256 | 8927bf74e9d960dad95ba796e6f2bc731c5b4e1192cbd7b120cbd2f1898ec3c1 |
| SHA512 | 479afa994781f6a495d7439ae3d0afc131ad5ad7bb5ff1471f1ffebf61633a74624e41b06b481f17c8a9f723635de871273147659ddf070664c385215bc23a80 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ComBtnHov.png
| MD5 | 6cb194b84853c3d231eead716d49370c |
| SHA1 | f95a681a3dc9318580bb62ef8ce4a678d78f1ec5 |
| SHA256 | ee34c098163504705e055812f003d823efe727600ea4b56db73553e2ff9d0219 |
| SHA512 | 5ba1f927981c8679b49c5fd079ea2bcc662c8e9282ae736783c7d46ddcf7c486ad48856cea0831a223ac8b9600eea541a35fd3b4afd4fa2f132dc554503ba4ec |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ComBtn.png
| MD5 | 0a2318d4078889584caa4523315bdd70 |
| SHA1 | 281adb6f789746a5c2e446eea019c1e1047ab8d1 |
| SHA256 | 5956629dc86c8486d28137f91fcc493183a53a103c1ba5f4a4019f67a132e9ef |
| SHA512 | 5c05917259aefc4b675913cb896af105b1e7bf7cf07ac400083303e2952e307fb72eef4786e27381a7eee5d2b17dd4d55a9ed1dac7acded6890db927f4657b5b |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CollectingToDesktop_MOV.png
| MD5 | e4c70faae3c4fce495e12d24c2854c8b |
| SHA1 | 9faf01736350722f60820485bc6fa1eb364e2c5d |
| SHA256 | 03f78a2bb0eb5d120d85e7c08a16410921824154186b04ef1027905b07d137a5 |
| SHA512 | 54567bbe7b75acc0e09a4fde69ff50d295609fdab69478d8c995213d4491f09aeaeaa134b2a63a76d3c5f92a8a3b61c1e56b8593dddf17a12ca28b6c8af4e4c9 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CollectingToDesktop_HOV.png
| MD5 | 8f88aba447c6b48423a6ab9502060195 |
| SHA1 | 2d434c1dc6f8523b49dc669abd8f69f50656ffbb |
| SHA256 | 78a209e1df0745cffb42aeeba157769ccf016dd3e356719415c11374f0e592df |
| SHA512 | 927b79089112c18870b43568c6efa1f8959beb39aaba9356429d7209438f8ad330488f3c49d8b4bd9aff29808b751ee52c82f7322dc72eb8a2d1ac563ba79fbf |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ClearIECache_mov.png
| MD5 | 683aebc33c1a57d4e7193ac11edb718d |
| SHA1 | f880556c87ea97d913003b5d61bfcc46309203fc |
| SHA256 | 2a1b1688b001bf57d60a0c47b6b82910c443015711820f6a95a073e540621a40 |
| SHA512 | 6aa2665a83c7b683658601815d6b0957ee3376645158339657bda2ff765b7db91fb8abc49ef0e50c5a9474965ccc9e34ba8df82e28d8cfa2b05cd49225a3a454 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ClearIECache_hov.png
| MD5 | 5e9c33c45c3997c6bd2a227496d8bbf5 |
| SHA1 | 61438ac8294a4723abf785604b05f3cfb3f190a5 |
| SHA256 | 59a3e8272352042ab795032d5dd448b2f9bb3c9bb0e4a119792ef31094e69005 |
| SHA512 | de8df25f3294dfa0a01433df94672272c119ab58c58e7af5bab3cb155dca248113d31e5145b1039dcf24bd27725aa385c860e286ffb7c6a85b4b8f25373451e4 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CheckBoxUncheckHover.png
| MD5 | 0e40da2e0b0d35ca116a6ef8cc09ab27 |
| SHA1 | c43ff70922be4bfcf7823551be6b2167c341f979 |
| SHA256 | b443f84b1dae129f7f7d86f46a1b6afac0569f5537ef79919396a18f15a6c709 |
| SHA512 | 82042d24bb547bf1aba3b317e611516162a955714df3c44807c65ac5ef449b0e5e0eee8e673de24be9eb89c9cf45068afff74fb710e2eb89e9d4106ffdd645a7 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CheckBoxUncheck.png
| MD5 | 0992ec4811eb429baf46221fb1bfe4fa |
| SHA1 | c4d95902c17a2c339cfadd366a1735a08dcef39c |
| SHA256 | 179ad885c9bd5e378b834f0c192f36d24366dac0af3df1c3a7896150e94a56a0 |
| SHA512 | 91fedac3aad148511f028fbf25f544590abd7daac05fdcf9f62063911a1b5e39003e9a97d54425d2facfb4446311dc42499e625766b912656dd1fbebf8fc56b1 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CheckBoxCheck.png
| MD5 | d9cdf06422119816ca6f9c4c72cd09f6 |
| SHA1 | 64e3bd1921689df2f3ee450c8387f9325d1254e0 |
| SHA256 | 23f27fa2319a141f10a8be0cce63f11fce499f5943306d9d555c177c74d346cb |
| SHA512 | 2763f47b77742585d3562d61afe00033ef7ebb9f3fb1b7cd8b163d62ed5770680b00ac27bf200a47734cf715adaab862b9710268db9b6fc67f3c6625612cd88b |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_Normal.png
| MD5 | e720f8d7d9b1eebf115a3ac3b2e8fa0e |
| SHA1 | 39e7f401d756d0f67413f9ff9ac925780b6e5434 |
| SHA256 | 395035ebf113e3f7d46d5fff75fad4154a674747d86049eb88d0962865cc8328 |
| SHA512 | 436d15bbdfd0cb4a1bbea0db7be5249ebb5e59268c6768a58424c66d155f4485057de177d9b36959c022b6a3c305af072414a75e829d44eee5cc0a8b6b9f4dcf |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_Hover.png
| MD5 | d94d4858a788fc9c9e4372a9847660f4 |
| SHA1 | 863d2d93f6909c19ee666e0b73e5a1914343c221 |
| SHA256 | 6dc00a8eef3d4d1394655073304c749b499e4ebe34ba292b3aa1e81f53a2efdf |
| SHA512 | f734a7c10005bd83e56e4f00139375404524c94c8a906d71bcd67dc590d91a9d9caeaef702a67540c7a627100a371c663a4d2c0cc6610b429e2618e1869f61d3 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_HOV.png
| MD5 | fa74861595b2d7f8029238da227c9ed1 |
| SHA1 | c2103a895f32dcb9e8f1b8a7f647d38821b2df1b |
| SHA256 | f22ecceffd5edb6c5818da84a7753190a2f1a050d7a137676c6baf155955ac02 |
| SHA512 | 7ec53735e6f498db76f25e742d512a58729dc3889ed6c5aa78844fa9178b8ced9de960d238258f161c3dfa5217bd2c575488b868910ec55bb5d887469ef7989b |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_click.png
| MD5 | d5c86709860616b2a77328be90005dd7 |
| SHA1 | 8e3051d9b74eeea2641ca29510e8dd75e8f6dbe4 |
| SHA256 | 4f3d3d8f8544b6f5d973443d28972712d9f869f745544822a7af63d66cb9806f |
| SHA512 | c2149278520b60989638870a3095b82f85eb7329f67741c99e832c483e2a2a7159e9f5294223d504eb98f0d1b185a57834d43da0681684a7b4152929cbdaa6de |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnMinNormal.png
| MD5 | 0f8c32a24cdd495cf044885babc2a284 |
| SHA1 | b554b4ed413de5050d7ba05f5f9135fd9a8bad66 |
| SHA256 | ce9610d0d6f603ed290e3eac9813fe6428f85575399f1d2f3b79ec2b80bc5700 |
| SHA512 | 88f4ca39e9acf4d4e17d003e1bb043a2cb4784d3c06fccb061f4e78033ab814ce301d23ae2a71ff454e8ab8f82557bb5385cb6ac927950aab955ce9ca459b0c3 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnMinHover.png
| MD5 | 3d5ce2154e2739d8372cd19ef6894d54 |
| SHA1 | a50b1d7dce90ace6de2f64420cc501d4ae044ff0 |
| SHA256 | bcc19a19510a08c675266e240a2262c92f1bb214f333cdd3c12e50a84f97f881 |
| SHA512 | 382f29d7c19f22c34a9fea304028535835fe2693fc6c86834d3b2ca915a3e14b88cc84cbb368543312f6080f53479039557418efe65e2909ff5b07e06c593684 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnCloseNormal.png
| MD5 | 5c58e41384824810c9233b4e20544bbb |
| SHA1 | 19a38a15c08df0c87fc96fb2ff1218cb11397bb7 |
| SHA256 | b6f7642aa16976177755b14a93dbdb3245eadc5f31cd28abbd97d31b4939a189 |
| SHA512 | 1ee8e676ea4702c7196f123c327aa0cbffc4553f389816dc7a8ade555b7f8c07e5b4b80bcc8ef6546e85e9b5255f20cd81cde91faf509f7d4fc0f35421af364c |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnCloseHover.png
| MD5 | 77c53a33af5d9060edc64d742581c78d |
| SHA1 | a6ca1ead89f69b55cfa2557a2607e056d7b98ad5 |
| SHA256 | b8ee599130d00563db4e4c0cf66b07d626d00e28edc35d9e96734d73c11e56f5 |
| SHA512 | 16bc887a618d565e5a5a93c98bce80510138a1c6687a027b16aa52233154bdead4224d4fbe76b2c48d13e210e426c6c86c250a27e7b4b7e695a9af59e8a8f506 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnCloseDisable.png
| MD5 | a7a050294a34df2b6598b06c0f1b46ee |
| SHA1 | ad0a456db2e13852af75b30f8a84495dd8414b1d |
| SHA256 | a37bc8a0d719e97f6bba561f05056c90beafef08dc5cf77ca0604caf833b82ae |
| SHA512 | 3d1bbf0957bc2df884b0716ecaeaf616f83f803a006cb0b03f66102520d99e98833d4448c407b75dc5a67505f0c7cc23a919a4b58881bd4c1691c5257299df36 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BindPhone_Mov.png
| MD5 | 62cfbca60f27d4b42253c96e1753bfbe |
| SHA1 | 496690bcb841f2c95b1b1d3ad2f8a70c7a3dee76 |
| SHA256 | 4e2ef52fdf819e5d5825857600bb1ebad672a16873f4f55cc02c4b78c04d01e9 |
| SHA512 | ea87b367f8dd7a0670ae3171dd7a6f957682a661528e9f1330921c8273dd6df952e529aed59c21be33f0f733483266468809dcf0a5c38137610849ca2489c4a2 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BindPhone_Hov.png
| MD5 | f061cd973c3245b935f8ca0e7fa2df41 |
| SHA1 | b843b3013d90a3b54f54796f36d0b3ae64e0684a |
| SHA256 | 4047e046f0f25b0f41d3cdc6578e252d35d5b2db9d44f91fbe5400b14073c8d9 |
| SHA512 | 05047a6b3c235dbf1c086ea97759f888efc88dbd25eef984de53aab304e0091f40f0014b6edea4368f813f4d4dc0cd04d35cd1fe0dbaee3a9ddd31b675cac186 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BindingAccountTips.png
| MD5 | 782b458a7a130a168e2348bb6b6d1ec8 |
| SHA1 | bf958b123c4c07ffda0d47939747464deba924a5 |
| SHA256 | 37bea36b1180d7b0a2a2734a46b3ced630c997a461024dbd395e12706ba29599 |
| SHA512 | 3b765d00dbf554f5b4037b27a6ee5a3cfcbc26d33a6b336f5a37fd085de24ac5bf26edf0e6855ece7184799a1e216bc072fe516356a419e9a9d26846c58ce32f |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BarPay_mov.png
| MD5 | 17ded5e0a173363a18f2e998cf05882f |
| SHA1 | 121c6c1c92e0538cc4a1964eea2a6de7784a6ff7 |
| SHA256 | 5a6d97e4f5fd2cd4ff81595bce200b8b9bb0af8c87e0a5a1ad33e2ba8592631b |
| SHA512 | 12d6cf34bb4f1c3482421cc986d2776d6724e3b97f257a2cfa17f373b688742c23d8a7ea682b8bc19c5b6162e2bf9627c415e3dc822a7beed2bdc2799bcb6b6c |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BarPay_hov.png
| MD5 | f3506a23a8eab8def532ec1124fc122b |
| SHA1 | 5dab7891775c289e860aa2b144483209e8673b13 |
| SHA256 | 4d2fe7c86523d8e72de46e925aa1ea473e43b46534088c2372ebd5cd2db6a02f |
| SHA512 | 1095e4cce712836bb0f1b45f83a919f44c7becc8c51f950fec2a1e4034f8d6004372e23f100e51e309a7a406c51b4fd0821cc92f8245b720e094ce6b9cbc0856 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ArrowLine.png
| MD5 | bc5022a5719a200d8cb4df3b5d95337d |
| SHA1 | 33b3389c08cb110d2882ce7c87c09f6ac768e91a |
| SHA256 | 79c208d9481d9ad70b6375aaa875c1933fa6a5aff1a20ca69ae9e2d28fd16253 |
| SHA512 | 71d564c909621d9260a257daaee9bdb019a8fe24f81db319ba7bf31b6e81e5db7fafde7b76c181a615bd872fd702ab60d463ee340b8b8124bb524ded20cc9245 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\control\mainframe.png
| MD5 | b702f688b22f0d326be0496338307f0d |
| SHA1 | 3a69c7a925bef885ad3491fe552a613dde803aad |
| SHA256 | 97aec0db2dcaf6d20a1ed9e8cb2d8bdde456ea0bbee9bb9275bfb284dd059a52 |
| SHA512 | bd30e9c6518072b5954d69824d084a99011f24cbc386e4be15a3d55bf5f69cc11f1ff4693699b2291278ea7d19665348e847f6c0ba8737fe46ef837dfca3d102 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\QyWebGameClient.exe
| MD5 | 4c3d98b2b8e9e4064e5947d64c4ec613 |
| SHA1 | 6b8c3f2ee10d8f830f8678e5245cc2a35d18ac28 |
| SHA256 | 46f0604a4450ef9f828364e21a1441bdd4fa7a229964aa61bf16279150c9ba55 |
| SHA512 | 10025f9d34b952b09037f5f269583d74c3792cbd386eee2ba3e143f8b04636cf662e1c154f286a86343d0f27a1bece456442daa7eec84670e741c08048aada2a |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\img\arrow4.png
| MD5 | 55b2b0485d8cb14277abed24471c8ec6 |
| SHA1 | 121aca27f33646990d96a7b602671a0d01f6a4b5 |
| SHA256 | 41e8a39560fe7c5d41be57668b697ff6d163794c1fe0d178bd7ff603395e5666 |
| SHA512 | d0330c27c501f78cb3dc07df0b2b757851420a88002ee1ccaa5ec3fe29d42fb59bcd26b2fad40bf771e611e2ce7e98fbe7a72c7edd0e58cc5a78075d392cf751 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\img\arrow3.png
| MD5 | 4b7ff428e1010f5b4b924a381ecc6a9f |
| SHA1 | c64a6c92c9ce90dc5f51fcb61d1fa7aaf55765bb |
| SHA256 | 6da80486fc24fe096983626c22d7ade8e72667205ae9ab88eafb1b5e896f7d47 |
| SHA512 | aeb5d028c20c69cc04422c1cbcb0ec9ee72557553cc8230c9129b7baa70c6ad3263d91c9d5c62c69792f321182564d6f52e167e18bbbe4370564790596561d39 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\error_togame.html
| MD5 | 5926b1d339e58bf3ebc876939ea4c2c5 |
| SHA1 | 64394e162c82bc19812c62881ca1545288e56516 |
| SHA256 | 5bbaa9feff7fbe44b794df4b493c587303588d74d138cdb50504ed5b6e3c8669 |
| SHA512 | a8f7374e80214bc9ba4e493e8706e59f55f07ccc31601ed550f0d1787e1c5dc6695f4fbf75e7e2b66c031fb44e391af6d65ea619c3286aedf3d12c819b3751c8 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\ClientGadgetSDK.exe
| MD5 | 9b4a17d36d4730907fbd6d8969ad4533 |
| SHA1 | 547f1198f277c267627083ab3a6f083931a88f85 |
| SHA256 | 7a201389575d3c6f60a638dcd6f8c1c41687b51bc7be541ebc271330e1875be6 |
| SHA512 | 870012f8ee3b07e5b45abdce7c0bbaaca5d963412332669ba1ceb4c6b9c6077740b6336dcd8ea802c10254e73173de00a3e2f1c6e3e6202b397477cc38e96ce2 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\browseradapter.ini
| MD5 | 849c0db12448b338a7454ce8fc8c6365 |
| SHA1 | 1477afec52ba1303cab09b085a7148bcf56b2497 |
| SHA256 | 9897278fec98e2ad20355747dbcb541f2c87d15616f6f15215fec3351590b3a2 |
| SHA512 | cfff784ac25afd5d6b6a4b15b90f41614f3a9299e77921e804b9464504ea472e6da69e2142784a0c6dbd6f2319ef124220da22230dfd260e440939f14b97124b |
C:\Users\Admin\AppData\Local\Unity\WebPlayer\Uninstall.exe
| MD5 | f5ec6cd3d798b1c9a2392dcbcf9bc502 |
| SHA1 | 56593b443ba4554410fb7bba45a137a436880008 |
| SHA256 | 97cf07b0e1a1b5a153a5760bc4270ff09d319aca9d45a2b9250edaa1bf5b848a |
| SHA512 | 838cdd97e05bc13863151504d930a14ccba9e3829e432f617b17d9ef29fbf21802ad66f6ad9c6ac385c8437f80e8127e00a11986ce3ae9ba06ced1caa327e3ce |
C:\Users\Admin\AppData\Local\Temp\nso3B00.tmp\UAC.dll
| MD5 | 113c5f02686d865bc9e8332350274fd1 |
| SHA1 | 4fa4414666f8091e327adb4d81a98a0d6e2e254a |
| SHA256 | 0d21041a1b5cd9f9968fc1d457c78a802c9c5a23f375327e833501b65bcd095d |
| SHA512 | e190d1ee50c0b2446b14f0d9994a0ce58f5dbd2aa5d579f11b3a342da1d4abf0f833a0415d3817636b237930f314be54e4c85b4db4a9b4a3e532980ea9c91284 |
memory/1700-5412-0x0000000005990000-0x00000000059E9000-memory.dmp
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\vmPage\1.0.6.55\skin\btn1.png
| MD5 | d271a47cd14ebb209b06ea235a91d144 |
| SHA1 | df6d11259e8b54247d052a64b2fdeb86908ff751 |
| SHA256 | 09fda339a9d73d4bd0c728084eda60967139cf45c96e81fdd63ef562597c37ed |
| SHA512 | a074342fcdad77884e7b3c0360dcdf5798e3b1dca4484df23cd85b0283da0920fc867fddd41bd3d8eb4b1200e43c9b34114ba479ae9d4e874f46ba4808705ef0 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\vmPage\1.0.6.55\skin\no_up_and_down.png
| MD5 | de4109c2374280da714e9dcdb3d3ad9e |
| SHA1 | ce6657dd563c51c684277a4213fb2be052a13f38 |
| SHA256 | 03b3fa0f39cc032f3f0fa0748810bca79d925e64ec5c2df0d3898580b1d7b203 |
| SHA512 | 99160096e9ef20e984d09d6abd34a0522543e00b582254f337a3f61ead89ec933fa8f2618bc1deb32f7bd44c821ddc1ce9b60392fe65374cd1912262a632a205 |
C:\Users\Admin\AppData\Local\Temp\nsoC61.tmp\vmpagedown.exe
| MD5 | f5c82723518ac5c1e33cb7b8520094d5 |
| SHA1 | 210cb26ffc62e7b9e6bd0398b28ecbe9e1b0e2c4 |
| SHA256 | e9abaff20fecb812d4df90395990054fb26d17640ad7a31cabd582cabe22948a |
| SHA512 | 85ccf75499dced8f1cb0e451b2135cf705da33ae23e290b4594dad1ed901cb7e3b4777b28dc52a7a9d5c40d4d10e9d90e3be3de8c686e276dd6837f15a498524 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyMaster.exe
| MD5 | 9e8e028857769d11281f83f1438d8a35 |
| SHA1 | a6a23b4e3fc495ba235a5b35c35c8fe05ef2f55d |
| SHA256 | 169e700568cb68e2511589aca9be8ad26bcd1ae52d0d109120576934c8af94c0 |
| SHA512 | 42c9874e7b8eaa50888f4f533bd93c11c8277c8435583f06c764a5858f47c34ff5d8fc982540b5c06cb2ee03fb406931eb4db8170c18d0c1bb3f5bdd52d8b9e4 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\PStyle\Logo\LogoNetworkVideo.ico
| MD5 | 094fad0a9eb6e39e00f6452da2e0a596 |
| SHA1 | 053e9e4ae140cc3fec5a500c6941e0181e6ad143 |
| SHA256 | 8429febe04859faa258bb06bfba94eb969ff7e80da207bac6417a22cc83548de |
| SHA512 | b5d41ab5c040b0a001aaf399e9e7fd9646eb5d79268fa5f5258fb22a178b311f46e46c48c75495a003ea15949327700b7011602d726d92cf7e348f83e3ec5867 |
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\爱奇艺PPS.lnk
| MD5 | bf1b16efb2da6863b693c157b8a2a5eb |
| SHA1 | 51fa3fc35daa0a2a19d7922959ae87093f261940 |
| SHA256 | c8024dff3c356699da1f5e204324d06b1329cd957138349de0dea44eaef3f3ef |
| SHA512 | ba0f5c63668eca11646db942cb374af16085c53a74bc48bb3d7cfaae583fbd0202890ba017eba301034209c44b09b6ce6fddf1240079547f0a46f5a7749357ba |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\PPStream.ini
| MD5 | 3d4e7a4fd6dfc6e495ad27b32485942b |
| SHA1 | e52be06207a61f4222ee9075ea52582ed1bc9b65 |
| SHA256 | ba7b1e79381a984b03ddd8c413f81b37ef1f9bb9eb9275c8ca83ff74e531ef60 |
| SHA512 | f02dc6c52469d357f08f520fe2f5cd064b9519df0fa516d47322f56a09dd187e6d947bdfbda86ca4f1c5118690da64f0a94e0889953fe5186093aba62e50618c |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\PPStream.ini
| MD5 | b6eb232db6642fb82e3e8f349683b813 |
| SHA1 | b5f428c2671cd8db90c11184382fcf715ccaef99 |
| SHA256 | aca1f6b168f502fff94499a2322243fe67d475e28947beef4b4909efaa8dc400 |
| SHA512 | 781cdbe618dafd1e967fa2fc54ead27be566d98ca41e29845386c8f33d0840e57ea7bfeafb0bf27d7177e6d213d09d2a8790ad4b9799a778ac4b1b5a2a58d7c4 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\PSNetwork.ini
| MD5 | 3221fa8864ba8b73d2b5fbd437a289a0 |
| SHA1 | 0b210cd735603be096e676cc0dc9d4c5c1de63f7 |
| SHA256 | 8ffc6af8e58191176ef82385aa12d25c0379d3b9ccc3a3ce1d041f3c52d61914 |
| SHA512 | 220a1f69d939f7a67c94a70e88acab7be105a7ed4fece40890c0b8650b4f356d3d7cdd348e380673a4cac25cc16e8c1324aa9fb64efb3b7337401876ad13ef4f |
memory/1700-5889-0x0000000005A00000-0x0000000005A02000-memory.dmp
C:\Users\Public\QiYi\QiyiHCDN\Config\PSNetwork.ini
| MD5 | 900ddaedbadc4847936c9598fa8886f7 |
| SHA1 | 5142edc7bb8b0ea18c02c2a997e754da0f2f25da |
| SHA256 | 6b3b96879cf66056b2fb9bd051282a0a40f18b6193a793b1af014394fcb68e5d |
| SHA512 | f76fd9a2533424ffa34b1617f52092f4cef139d04860c5042f0bce71ebc9d4444a01709bd40982b9707c497943bbf3daf5c9f4dfc25a930af84544f918eed86f |
C:\Users\Public\QiYi\QiyiHCDN\Config\PSNetwork.ini
| MD5 | d609ec3b80050d970282ec2238f2ef23 |
| SHA1 | fcc22135e48b4e53c9f6eebcda066019c7a021f6 |
| SHA256 | 2f995cdfb93a1d02cec8bbcdff96f71fdfc29bcedc0aef3a3b0102052257b520 |
| SHA512 | 3b798c51cc19ac868673ccf2c5857791cf282d6e5c2980088e970a5e7d6d7e10934c3086ff5108dcc961dd5304a25990b5464e8ddee42d66a76409a409780021 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\browseradapter.ini
| MD5 | 2ead05e1cee75f9ebdd5f9ac04cba9e9 |
| SHA1 | 5c37cff83b68982eac4e8b6ad8a4a00143890a04 |
| SHA256 | 0f318d57f8a2101da3b9c6b6c92e072afdf30150d4e628db68d4502a50b5bbfc |
| SHA512 | ef73d57044c0b860839ad2226a4b61da16191e94a11584cb015c85f9ba6bf7202bad73baf2302426b1a1e3981b292b3eb4774643c31af2d7a12312025270e203 |
C:\Users\Public\QiYi\QiyiHCDN\Config\PSNetwork.ini
| MD5 | a8ef2ccd1a1ffaf4d9ee3723966e4839 |
| SHA1 | a54b3c15edc10ae4e11396fa87a31f116b4ce880 |
| SHA256 | e99ada1171e90844309b46bf8ff88aee247753893834ecb47b65f9d548e93a23 |
| SHA512 | 77425a6737401ad3e678a02fbd8e2c3ae9049c4a4a4d74fc382fde2694d046c1adb4b95c7af3a687ebf98adce4cd1b4bfdf8ced00ba2cf5a4a776f44cddcede5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 29f65ba8e88c063813cc50a4ea544e93 |
| SHA1 | 05a7040d5c127e68c25d81cc51271ffb8bef3568 |
| SHA256 | 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184 |
| SHA512 | e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa |
C:\Users\Admin\AppData\Local\Temp\Tar5AD5.tmp
| MD5 | 435a9ac180383f9fa094131b173a2f7b |
| SHA1 | 76944ea657a9db94f9a4bef38f88c46ed4166983 |
| SHA256 | 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34 |
| SHA512 | 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\browseradapter.ini
| MD5 | 9c5e79339786f87a19c31eb892413b64 |
| SHA1 | 4ebd59f5ae1c3d57d0d96de98568673ebabd1e20 |
| SHA256 | 200cdfd7907959d30aa279df8d27fb90d426d5ae90d10d0c03d68beed55d8ffd |
| SHA512 | 8ca84c83ffd8d0d091bf64925c33cd6a66273502cf9a6abb25364c63603c1a9347befa90e3012bac3b67458795503fef5b1632f16101bfafe48c202c4c25e1d2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | 4986413ada97dd8acf6f891d556f3a74 |
| SHA1 | e80073a6d90594450d81becf96217ec4283d0119 |
| SHA256 | 730e6a63919aa1742295d678a1cea7db4d980eaa979be273e2d48480c1af2734 |
| SHA512 | 63e4eddc9df4c1c3891d971852782132a02c536bb4b3775a78a78f07d8a8e08daafcdc8ecf691d1f087cb6516d49614947e801988abeb5eb8eb6ad7a87e7f844 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\Local\Temp\nsoC61.tmp\config.ini
| MD5 | 89647dee1e147207f3446ea739c8ab0a |
| SHA1 | 2939c1be244aa0fc4101832ee410418c337a4a40 |
| SHA256 | 09622256300931a8465cb377e4f958239022f4245606e956728a9940321c17c3 |
| SHA512 | 5c18225bd6c7ba97909a1f2473bbc6fbbde49ba91b5aac01cd4846a39eca886e7f27b1ad54bb143a1831b23b66887b5a4de50f63ba5a70dc44f00db18027d257 |
C:\Users\Admin\AppData\Local\Temp\nsoC61.tmp\nsExec.dll
| MD5 | 2d1656be5aab3f3e6873cb5d0c046717 |
| SHA1 | 32facbec7603c0d3a2198c390399711f68a96de7 |
| SHA256 | 63133db6770f8ae0a5b38ddeafafbdc61cd6bc2ab0b6f3c307c0904f29d8a218 |
| SHA512 | d55426322c315a211c4de778eabd676fe2353ebff15f8725eb4e5dce03bb6b92f8a180e5093c2bdb324329bff72b4b1ed37d9d8155ce4c98926e0cbaa1c62ea1 |
C:\Users\Admin\AppData\Local\Temp\nsoC61.tmp\registry.dll
| MD5 | f81598566d3bebe154d86906e7419653 |
| SHA1 | fb2a980abe37a0b724edf932884931f946332b68 |
| SHA256 | b13d15f8d3e5498d3014dd0c5acc2b42df4aa08f96e0b3e59dc7c9e8c1e7f4c7 |
| SHA512 | 95f6d51d11df472808b9e6a765be6f13231901d698b62f0782e2c17a5ddeee43a8484894f11568ae474ffc7a3b27d8cd01785caf8d87eecdc4a3f64a3ece9255 |
C:\Users\Public\QiYi\QiyiHCDN\Config\PSNetwork.ini
| MD5 | 59c1a68cd15802065ec24c5f1eb6972e |
| SHA1 | fa5b82214841fa185a22e220bc891f4379b73220 |
| SHA256 | 5882424764360916569363c94778a9700b51f6a22c584ffbed16495324223e77 |
| SHA512 | f0cb386bf568718894fc7f6382ba31688383eb8f6e12125c0631567b22df12c792d9e74dc2c18602dc069bec37e11c6cd838da7ebb5fb4bd9607966565155bde |