Analysis Overview
SHA256
3d9662ac7e9d6756cfbbb53978e20ad1f073830b3c7b79215320535889456313
Threat Level: Known bad
The file 081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
Modifies firewall policy service
Adds Run key to start application
Enumerates connected drives
Modifies Windows Firewall
Downloads MZ/PE file
Installs/modifies Browser Helper Object
Checks computer location settings
Checks for VirtualBox DLLs, possible anti-VM trick
Checks installed software on the system
Registers COM server for autorun
Drops file in Windows directory
Drops file in Program Files directory
Loads dropped DLL
Executes dropped EXE
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Modifies registry class
Modifies Internet Explorer settings
Modifies system certificate store
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-04-29 16:28
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-29 16:27
Reported
2024-04-29 16:30
Platform
win7-20240221-en
Max time kernel
150s
Max time network
150s
Command Line
Signatures
Modifies firewall policy service
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\HCDNClient = "\"C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QyKernel.exe\" -shell_start" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
Downloads MZ/PE file
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\F: | C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe | N/A |
Installs/modifies Browser Helper Object
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C} | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
Checks for VirtualBox DLLs, possible anti-VM trick
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\VBoxMiniRdrDN | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
Checks installed software on the system
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\DownloadIcon_Normal.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\common\pageshowallinoficon.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\PersonalCenter\image\image_band1.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\SelfVideoListRes\SelfVideoListContainer.xml | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\wnd_upload.xml | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Ctrl\Comment\color_table.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Middle\ADRes\AdInnerPrompt\AdInnerPrompt (117).png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\only\loading_8.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\downloadRes\DwMsgBox2.xml | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\xml\t10.xml | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\homepageRes\homepgRes_PlayButtonNormal.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\PersonalCenter\common\close_big1.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\LocalListRes\LocalList.xml | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\Logo\videolibrary.ico | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\MobileDown\AppDown2D.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\hijack\phone.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PLRes\seriesoptionsmall.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\downloadRes\error.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\titleRes\titlebarUI.xml | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinVIP\skinplan\list\checkboxCheck.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\whitePlay.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Middle\ADRes\AdWnd_Timer.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PLRes\btnSort.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\downloadRes\common\transferdownload.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\listUI\filmlib2-normal.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinVIP\skinplan\PlayerRes\Top\size_1R1x.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\TabCfgPlusX\show.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\MultiAccountsBtn_hov.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\PSkin\player\Player_MiniTitleBar.xml | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\common_dlg.xml | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\internal_message\system_message_item.xml | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\hot.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\PSkin\AdvertiseWnd\AdvertiseWnd_SkipAdvertiseNormal.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\normal\loading_11.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\homepageRes\common_homepage_embeddedplayStartPic.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\DlgTemplateNewBlack.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\downloadlistcutline.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\LocalListRes\add_file_down.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\downloadRes\downLoad\config_dlg_close.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\btn_next2.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\RightMenu\menu_bk.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\homepageRes\filmtv.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\titleRes\skin_select.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinVIP\skinplan\list\historyOption.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\mobileassistant1.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Middle\ADRes\AdWnd_LimitSkipAD.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\hijack\close.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\vip\loading_13.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\RightMenu\icon_selected.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\titleRes\splitline.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skin_third_part.xml | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\sys_max.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\heart.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\J-5.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Middle\tipbk.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\TipsWindow\bk.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\common\common_CommonPlayCtrlImage.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\xml\t15.xml | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinVIP\skinplan\list\pause.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinVIP\skinplan\PlayerRes\Ctrl\album_state_110_70.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\NewDlgClose.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Ctrl\SettingWnd.xml | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\downloadRes\MobileAst_File_Transfer.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\listUI\download_1.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\psnetwork.ini | C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe | N/A |
| File created | C:\Windows\Fonts\iqiyi_logo.ttf | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
Executes dropped EXE
Loads dropped DLL
Registers COM server for autorun
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\InprocServer32\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QYPlugin64.dll" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\InprocServer32\ThreadingModel = "Apartment" | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\LocalLow\\Unity\\WebPlayer\\loader\\UnityWebPluginAX.ocx" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}\InprocServer32 | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}\InprocServer32\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QYPlugin64.dll" | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\InprocServer32 | C:\Windows\system32\regsvr32.exe | N/A |
Enumerates physical storage devices
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\AppName = "QyClient.exe" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\AppName = "QYFollowVideo.exe" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\QyClient.exe = "9000" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6BE0FB-8B18-4dfc-959F-233651CC4D7F} | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ppstream | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\qygameclient | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\AppName = "QyClient.exe" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\magnet2\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING\QyFragment.exe = "1" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\New Windows\Allow | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\New Windows\Allow\*.ppstream.com | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6BE0FB-8B18-4dfc-959F-233651CC4D7F}\Policy = "3" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6BE0FB-8B18-4dfc-959F-233651CC4D7F}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\magnet2 | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\ProtocolExecute | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC} | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6BE0FB-8B18-4dfc-959F-233651CC4D7F}\AppName = "QyKernel.exe" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ppsrun | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\qygameclient\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\QyBrowser.exe = "9000" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING\QyClient.exe = "1" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAC94FEE-45B4-4FD4-9EEA-D8978EC96C6E}\AppName = "QyClient.exe" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_AUTOCONFIG_BRANDING | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING\QyPlayer.exe = "1" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\qisu\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\" | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\QyFragment.exe = "9000" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\pps\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_AUTOCONFIG_BRANDING\iexplore.exe = "1" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\Policy = "3" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\Policy = "3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\pps | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ppsrun\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ppstream\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\Policy = "3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\qisu | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\Policy = "3" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\New Windows\Allow\*.pps.tv | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAC94FEE-45B4-4FD4-9EEA-D8978EC96C6E}\Policy = "3" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\AppName = "QYFollowVideo.exe" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAC94FEE-45B4-4FD4-9EEA-D8978EC96C6E}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\qips | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC} | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\QyPlayer.exe = "9000" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING\QyBrowser.exe = "1" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAC94FEE-45B4-4FD4-9EEA-D8978EC96C6E} | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\qips\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\qygameclient | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.pfv\OpenWithProgIds | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\pps_pfv\DefaultIcon | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\AppID\{F008CD3D-7044-4CD4-BE14-BF3FCCF144F9} | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.FlvFilter | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\QYPlugin.QYPluginCtrl.1\ = "爱奇艺浏览器插件" | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\UnityWebPlayer.UnityWebPlayer | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{790F2D3B-18EE-40E2-A45E-1FAC13B6AFB8}\TypeLib\Version = "1.0" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\.pmv\ = "爱奇艺PPS下载文件" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\pps_qsv\shell | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB3A16EC-96E2-421B-8462-C6F992596E65}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Wow6432Node\Interface\{6130BEAD-7375-4DB7-8B6D-7E41303CE675}\TypeLib | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Wow6432Node\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5}\ProxyStubClsid32 | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\Control | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\MiscStatus | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{138F4260-66CA-4F7C-812F-C6EED99B7EC7}\TypeLib | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\MiscStatus | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\pps_pfv\shell\open | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IEHelper.DLL | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\ToolboxBitmap32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\ppsrun\DefaultIcon | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\ppsrun\shell\open\command\ = "\"C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QyClient.exe\" -ppstream \"%1\"" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.FlashHelper | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\QYPlugin.QYPluginCtrl.1\CLSID\ = "{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\ToolboxBitmap32\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QYPlugin64.dll, 1" | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\qygameclient\shell | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Interface\{6130BEAD-7375-4DB7-8B6D-7E41303CE675}\ProxyStubClsid32 | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}\ProgID\ = "IEHelper.FlashHelper.1" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\qisu\shell\open\command | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB3A16EC-96E2-421B-8462-C6F992596E65}\ = "IFlvFilter" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259} | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{138F4260-66CA-4F7C-812F-C6EED99B7EC7}\TypeLib | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\ppsrun\ = "PPS运行协议" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.qsv | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Wow6432Node\Interface\{6130BEAD-7375-4DB7-8B6D-7E41303CE675}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB3A16EC-96E2-421B-8462-C6F992596E65}\TypeLib | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.pfv\OpenWithList\GeePlayer.exe | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\pps_qsv\shell\open | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3636FE13-B7E3-4CDC-B7E3-A8014BD2CC02} | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\InprocServer32 | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\ = "UnityWebPlayer Control" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Wow6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3636FE13-B7E3-4CDC-B7E3-A8014BD2CC02}\TypeLib | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\ProgID | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\pps\DefaultIcon\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QyClient.exe,-0" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\pps\shell\open | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5}\TypeLib\ = "{75A564FE-95D1-41A9-B1D9-10D1E3CB502B}" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6360BD3-5CD0-40D3-BD87-DAFF37889F50}\1.0\0\win32\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QYPlugin.dll" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}\InprocServer32 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\qygameclient\shell\open | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{138F4260-66CA-4F7C-812F-C6EED99B7EC7}\ = "_DQYPlugin" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E1D75F62-CBBD-45C7-9D1D-6B5ECEC2E006}\1.0\0\win32\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\Accelerator\\IEHelper.dll" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6360BD3-5CD0-40D3-BD87-DAFF37889F50}\1.0\FLAGS | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.pfv | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\TypeLib | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\ppsrun\shell\open\command | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6360BD3-5CD0-40D3-BD87-DAFF37889F50}\1.0\HELPDIR\ | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\Shell\Open\Command\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QyClient.exe web_startup_tray" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\ = "爱奇艺浏览器插件" | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\Control | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\ProgID | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\TypeLib\{75A564FE-95D1-41A9-B1D9-10D1E3CB502B}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\LocalLow\\Unity\\WebPlayer\\loader\\UnityWebPluginAX.ocx" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{138F4260-66CA-4F7C-812F-C6EED99B7EC7}\ProxyStubClsid32 | C:\Windows\system32\regsvr32.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e52000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe"
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe
"C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe" /S
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe" QiyiUpdate "C:\Program Files (x86)\IQIYI Video" true
C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe" -install
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IQIYI Video\LStyle\QYPlugin.dll"
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IQIYI Video\LStyle\QYPlugin64.dll"
C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\IQIYI Video\LStyle\QYPlugin64.dll"
C:\Users\Admin\AppData\Local\Temp\nsy2637.tmp\vmpagedown.exe
"C:\Users\Admin\AppData\Local\Temp\nsy2637.tmp\vmpagedown.exe" "http://vodguide.ppstream.iqiyi.com/search.php?ver=1.0.6.55" "C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\vmPage\search_top.zip"
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyMaster.exe
"C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyMaster.exe" "C:\Users\Public\QiYi\QiyiHCDN\Config"
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe" QiyiUpdate "C:\Users\Admin\AppData\Roaming\IQIYI Video" true
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe" -i
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe"
C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe" -finstall
C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe"
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe" videolibrary=uninstall_setup
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺视频客户端" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyClient.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyClient.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺HCDN网络数据传输组件" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺视频播放器" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyMiniPlayer.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyMiniPlayer.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺PPS影音 播放器组件" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyPlayer.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyPlayer.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺升级模块" dir=in program="C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyUpdate.exe" action=allow description="C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyUpdate.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺视频辅助程序" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyFragment.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyFragment.exe"
C:\Windows\TEMP\assistant.exe
"C:\Windows\TEMP\assistant.exe"
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\mkshortcut.exe
"C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\mkshortcut.exe" -output "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\爱奇艺PPS.lnk" -target "C:\Program Files (x86)\IQIYI Video\LStyle\QyClient.exe" -parameters "quicklaunchrun" -workingdir "C:\Program Files (x86)\IQIYI Video\LStyle" -appid "IQIYI, Inc.PCClient" -icon "C:\Program Files (x86)\IQIYI Video\LStyle\skin\Logo\LogoBevel.ico" -description "使用爱奇艺PPS收看影视节目,清晰流畅更新快"
C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | dl.static.iqiyi.com | udp |
| SG | 118.26.120.1:80 | dl.static.iqiyi.com | tcp |
| US | 8.8.8.8:53 | vodguide.ppstream.iqiyi.com | udp |
| HK | 118.26.34.91:80 | vodguide.ppstream.iqiyi.com | tcp |
| US | 8.8.8.8:53 | static.qiyi.com | udp |
| SG | 118.26.120.1:80 | static.qiyi.com | tcp |
| US | 8.8.8.8:53 | msg.iqiyi.com | udp |
| CN | 111.48.118.157:80 | msg.iqiyi.com | tcp |
| N/A | 10.127.255.255:5353 | udp | |
| N/A | 224.0.0.251:5353 | udp | |
| SG | 118.26.120.1:80 | static.qiyi.com | tcp |
| US | 8.8.8.8:53 | static.iqiyi.com | udp |
| BE | 104.68.86.49:80 | static.iqiyi.com | tcp |
| US | 8.8.8.8:53 | policy.video.iqiyi.com | udp |
| US | 8.8.8.8:53 | list3.ppstream.com.iqiyi.com | udp |
| US | 8.8.8.8:53 | gameguide.youxi.pps.tv | udp |
| US | 8.8.8.8:53 | policy.video.iqiyi.com | udp |
| US | 8.8.8.8:53 | pdata.video.iqiyi.com | udp |
| US | 8.8.8.8:53 | msg.71.am | udp |
| SG | 161.117.186.135:80 | policy.video.iqiyi.com | tcp |
| SG | 118.26.120.3:80 | gameguide.youxi.pps.tv | tcp |
| CN | 58.215.125.60:17788 | udp | |
| CN | 183.61.167.86:17788 | udp | |
| CN | 58.56.65.64:17788 | udp | |
| CN | 119.188.133.196:17788 | udp | |
| CN | 1.28.145.95:17788 | udp | |
| CN | 223.99.251.71:17788 | udp | |
| CN | 119.188.133.198:17788 | udp | |
| SG | 161.117.186.135:80 | policy.video.iqiyi.com | tcp |
| SG | 114.119.175.88:80 | pdata.video.iqiyi.com | tcp |
| US | 8.8.8.8:53 | flux.hcdn.qiyi.com | udp |
| SG | 118.26.120.3:80 | gameguide.youxi.pps.tv | tcp |
| CN | 111.48.118.157:80 | msg.iqiyi.com | tcp |
| US | 8.8.8.8:53 | uaa.iqiyi.com | udp |
| SG | 118.26.120.3:80 | gameguide.youxi.pps.tv | tcp |
| CN | 123.125.84.228:80 | uaa.iqiyi.com | tcp |
| N/A | 127.0.0.1:80 | tcp | |
| US | 8.8.8.8:53 | list.youxi.pps.tv | udp |
| US | 8.8.8.8:53 | aia1.wosign.com | udp |
| CN | 180.163.251.149:80 | aia1.wosign.com | tcp |
| SG | 118.26.120.1:80 | list.youxi.pps.tv | tcp |
| US | 8.8.8.8:53 | list.youxi.ppstream.com | udp |
| SG | 118.26.120.1:80 | list.youxi.ppstream.com | tcp |
| N/A | 10.127.255.255:60000 | udp | |
| N/A | 10.127.255.255:60001 | udp | |
| N/A | 10.127.255.255:60002 | udp | |
| N/A | 10.127.255.255:60003 | udp | |
| N/A | 10.127.255.255:60004 | udp | |
| N/A | 10.127.255.255:60005 | udp | |
| N/A | 10.127.255.255:60006 | udp | |
| N/A | 10.127.255.255:60007 | udp | |
| N/A | 10.127.255.255:60008 | udp | |
| N/A | 10.127.255.255:60009 | udp | |
| US | 8.8.8.8:53 | cache.hall.game.pps.tv | udp |
| SG | 114.119.175.88:80 | pdata.video.iqiyi.com | tcp |
| SG | 114.119.175.88:80 | pdata.video.iqiyi.com | tcp |
| SG | 114.119.175.88:80 | pdata.video.iqiyi.com | tcp |
| CN | 111.48.118.157:80 | msg.iqiyi.com | tcp |
| US | 8.8.8.8:53 | count.game.pps.tv | udp |
| SG | 114.119.175.88:80 | pdata.video.iqiyi.com | tcp |
| US | 8.8.8.8:53 | msg.iqiyi.com | udp |
| CN | 111.48.118.157:80 | msg.iqiyi.com | tcp |
| US | 8.8.8.8:53 | cdata.video.qiyi.com | udp |
| CN | 124.237.225.21:80 | msg.iqiyi.com | tcp |
Files
\Users\Admin\AppData\Local\Temp\nsy2637.tmp\StdUtils.dll
| MD5 | 572b16bf94a6492976f777b7d0373971 |
| SHA1 | 3ae46f117f0d3ea32b28de9a73fca0d912260203 |
| SHA256 | fb87ec46457a836060bd3ee33bb37ec4d222d4974816654b32ba9d40efd90c75 |
| SHA512 | 872347db453458f3bfe6d6bb9dbb66305abcf5773acaaea4d06e8800b3329f536d70e6c96e6dd59a20e963bfce496a0fe014302d2469353bfbcba0fbd2ba6fd6 |
\Users\Admin\AppData\Local\Temp\nsy2637.tmp\nsProcess.dll
| MD5 | dacc5f5531887a11804bda084e12cee1 |
| SHA1 | 85e9f509668d9d78120435e5df593d988b16029a |
| SHA256 | 18584f582d454c15de69b515dcd8952a446bf18514de532c309b351b30d77066 |
| SHA512 | f16dcc34d444490621df50ea70772a692592bb35f078f7e7a7360976da873e8e917663344864b56f5989a65ecdaa70d8eb0df4f8a2495f50aa5d25f6f248ae4a |
\Users\Admin\AppData\Local\Temp\nsy2637.tmp\NSISdl.dll
| MD5 | 8ff1b274c581f2e928a418f3b90620eb |
| SHA1 | ad7ad3acd29b882204e74fe36369a6b89a8beed4 |
| SHA256 | df10d5b4ca10ea6ddce96d6ddecfc175f1dff4292a8c5c1f8e0adfb6e1e824c3 |
| SHA512 | a932f9b77fb801e624069661f9c0a7fab4a1e540d763d51bca91e2570767029261946c4ef522e1e9fecc189cd8090e99ba9b454439a3e3fec2ca318dcb428691 |
\Users\Admin\AppData\Local\Temp\nsy2637.tmp\DialogEx.dll
| MD5 | e0f33283138ef1c169f71cb1708985a3 |
| SHA1 | f10f88a272fc7c14f3a37d0f650aa7480bc1efd0 |
| SHA256 | a9b34148448d893558dbb91b51bbbdddd535e2c8387a13e930a4b5096b0af03c |
| SHA512 | 8094b5096cb0c4ee6572217beab6419b8d9ecdb2b902c9c596ef3cc513e4916b05c2bb54fd6084f274b6919d4871ae31cce4eddadd272cb7516c30dfc7c7db0a |
memory/2344-28-0x00000000003E0000-0x00000000003E9000-memory.dmp
\Users\Admin\AppData\Local\Temp\nsy2637.tmp\nsis7z.dll
| MD5 | cb22c301a35e0d8551578940c018868d |
| SHA1 | 1aa3a19c0c5e8cd02feedca50fb1845a99964ee6 |
| SHA256 | d77183207b8a3b6bf4d7267aee06c7d0f76a6b42e0c007e596931ec59dfa597d |
| SHA512 | f1997bc05c360c1adad90317e7aeb97af9982b2e40e4aadd88522d640fda44648c733e19c572b01647cfb6b2093f2387b41db37f52cd87b8d02c479be0395f5c |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\Signin.png
| MD5 | 053bf204ab9961e6843a052348ca8d5a |
| SHA1 | cfd71af85b0cae52a4c54429e925add459287de6 |
| SHA256 | 1b02340f651f6af1019402f595737b2e71f1e341892e419ae64617aa571db6af |
| SHA512 | 3476e12f9ba18a7663b6519ecec7fba8379a974d5962b37fa0d0ae024f9cb554d9ec44a13c2fc739e472b851531259aa3460f89c7683fde9e8de0b5e8a1051b8 |
C:\Program Files (x86)\IQIYI Video\LStyle\appdata\webcache\2\movieLib_pstyle.css
| MD5 | 04934b72e752e77dd0bf67c9d06a2272 |
| SHA1 | 9e5d3a5a81089989981cd9a44784e42ac40c638d |
| SHA256 | a18e3ac76891027def955b9f310ac15a51c8b514e7b63aa27cbb96f8d38cf926 |
| SHA512 | 7df18a0a080715a781df5baa0a7fccef6eaa4818bed11d985c42ee81acb9ce2665a5aacf30b7517d4d30c1aac6557f6d6a8b6623c15a7ce8f10c5d7691ee380f |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\made\loading_17.png
| MD5 | 0893bfeefb776d58da6ef7bd6b8d64c8 |
| SHA1 | c9905b5a2edb4f4caf87c76425e7db4e63b699d6 |
| SHA256 | e0787ff81f12df511d1b97382c78d58bf28269fac897eae4e0faddffe7be6aeb |
| SHA512 | fe8735b4b0042d1124ccf1dc55edd298fdfadb101bdab735b0bff89068909e61d81cef5b4ba967bc11a683b064cfe7638ea91cc4026a9073e197fc489ec78435 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\normal\loading_17.png
| MD5 | 28853faad82cbc1110fddc0c3a54d85d |
| SHA1 | d11e7cb83ceba8bd8223b59150bbd747222715f4 |
| SHA256 | 59fe4bb150bb9bbb28bedff5d2aaa87307041420100c2be31c9084f9a92fc342 |
| SHA512 | 4cd0a50c61f650df55ede29da8e72f5b909cbd6bae3d375176b0952ca8d46ce0ef06e104ab540e500f23e9ae9af9e2fcfb3b6c52ab7ed8cd6e7a11696150eb1e |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\only\config.ini
| MD5 | 534a43f71c3ae9f4860a02b65d1de41d |
| SHA1 | c6929fb5bba5aa8b56a3c891e9fdc1f571ab42c7 |
| SHA256 | b7b478999cc6ff9694335c0877d9a0182415a0478eb04d660849c8c98556672f |
| SHA512 | 5a048eb691bf368d955c010d30dd122dd27980de7da38a7e0ee1e13b9d98b71e3a5edc5cc1af908d73014bd6a4a2f25aaec5750156598c871d516d6dbcd838c8 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\only\loading_16.png
| MD5 | 11007ca324dd134924fa2bca5244eb73 |
| SHA1 | 56fa6e06d7db2e9693d7eb26eb13d52ab9ce8fc3 |
| SHA256 | 05395237709655d0cb9de583e7c2a3192df91388333d70923798eaf61b1562bb |
| SHA512 | bfa1d34ac7312cc273fbb59748a6e6f0cea6c6db7a498c04dfc8ebc2491806cd9d55fe766f727e3c0a130699a7f20d1a8d2e01ea005ad15cf706b0916a115e63 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PLRes\btnPopUpClose.png
| MD5 | 7844d223803d5f35c4eb453908d3d3d2 |
| SHA1 | f6946969ca172c5735f19cc5215ee170bd963bb6 |
| SHA256 | 38e371539a017a690e546a161ce82dbb757ccfd46e7bfa46c79f8377a9d6a223 |
| SHA512 | 4db164312a9813a0288abef93a4ae7d12945a3f290010603e9343b4bafea8883a1bc626ebea2e548eb6fb915ab47786b2a0adf02b1b720f4968f8b15005fd49f |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\downloadRes\downLoad\config_dlg_close.png
| MD5 | 754a7d6d7740eead34bb5a9f6940f009 |
| SHA1 | 18acc6593a114f5616a539101f31504cb511459e |
| SHA256 | 154ca004725f7936e20efa1780f3cdef20869de4ac00d1b0079c86e31b0e59f3 |
| SHA512 | 785ac79cec2f7f3fd813761a53b506ac5b2fede0ba67ea8a5bf495da5dc028c69e88217d1c45ad4e4ad4c34b3d3a1d6df88363c4e8fc1c095af3078357e2abda |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\AL_Close1.png
| MD5 | 1867ed15b4256e9edc952c334a543201 |
| SHA1 | 386b14cf44c620a55f64c6069409eb0eb5c5e3a3 |
| SHA256 | 87b01d7e066af46794e584904a4bedb27707da1eb32080b60a286f01b9c27820 |
| SHA512 | 027e984adcc90553c9c699c6f1a797eea5e7b02f8cb4a807aa62263780485de235c6294b608b8a34c67e9b5024d98768cab6265cc7776884b9ab4e6585e0c0a3 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\AL_Close2.png
| MD5 | 33cced8d3d97f78972a5418ec7e96f29 |
| SHA1 | 09bb1332bbb1f06eda3bb09f37b3699257162369 |
| SHA256 | 42803e7485f1507abcfca5f455e76956a0dd92ddf2b9d6341a4f2375a941746f |
| SHA512 | 04683521c7dc5e7f4ff701da3fe4291eccbe6b96ba5631676844fe4616a0fcb5e7434a47f245f9b800a47922b25c3d5a2d1063eee61b82db656866c194aca1ce |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\common\common_scroll.png
| MD5 | 93343a6c34066ba4b50a6d455210f538 |
| SHA1 | 10bdaace70cee2656f3c6eedd2c5aa5182dd6de1 |
| SHA256 | d2d9f913aa2646725e0af0d332a10a78b1d7269bf0d774aeb3e6dfc4be40558e |
| SHA512 | 06066d93e57cf309c064779a415a34290d52d9312da45acad20b0655f098568cb438d694f46aafe5d0edeb5178a50c6a729e174c683666d97112a1e09741b1aa |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\listUI\filmlib2_normal.png
| MD5 | 7602910002b9307718bb5a4c221d6be5 |
| SHA1 | 61004f0ad2d3f55c7549b3c8eecf2108d0efb655 |
| SHA256 | 9298a0cc560f702a118dec0bf34bf2d609d5a56d1c49e9658b0eeac0bba59a38 |
| SHA512 | eac38bff7fbf476bcd003253b737723c46c31cdcc205bde5f6c4bad9f5da75d7f08f061976c1bb724888f2a4ec38a9c0667e56c3a993a4a69cf236c43adcd259 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\PersonalCenter\set\cancel.png
| MD5 | d1a6675f77f74cc5847b0a59c49c3f6b |
| SHA1 | f96c4084818cc5836e4086b665e97c3bd7d99f47 |
| SHA256 | 29207dd0cbb59bd1e6fe489ab6ada4cb04c74083099127b194402f1f3ea4bf8d |
| SHA512 | 3f4a2f4fc645fbbcfb5fda5fd37fe8dffb96329c4e66841ca5bdb8c8ae4836e4eaede44a6e4e5ca17cf6bf02524d304bf83922092fc9b88fa72e94a322617388 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\PersonalCenter\set\ok.png
| MD5 | 4d34af20771db466a6439fa56ff5f687 |
| SHA1 | 5223e4281ff91d0bdedc9af14c4825e56cad01e4 |
| SHA256 | b4513c801e7893e2364967da122e5340a69a0c8f28d0318234ee0ca41ac12f60 |
| SHA512 | bb770d0649982b3f4d35a5b6628cd0a4168f31ea89e56eaf92f74412cc2ddcf8773dd60f25ff5c0d04d77960570d652f8b7cf7cdd2cbaf07151024c8355871b3 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\QYProduct\blackback.png
| MD5 | 60ce4c0275c77aa5572892c81728620d |
| SHA1 | 82fc18f800c867547140a7764f38a65eec9a4b96 |
| SHA256 | 8ea1ba9ad6052fe784d79b9bd3ff879152c1d58738cc1faab0a1304b68ce69db |
| SHA512 | ee1d28e4c4b939a721f42f67505de0fe2084f36244b53838a4704a19f32246919a88ab7936b6cfa07e54f4b5c1a11d36305376a3ef42bb73bfa5fd679f83af91 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\MobileAssistant\Fragment\MobileAssistant\scrollbar.png
| MD5 | 8f6b9b86898ce75b5c94034ab1f14381 |
| SHA1 | 4005fdcd5071fe373db13e301301ed0e2dc74876 |
| SHA256 | 874664eaa38618437f551ed0492a89b718e44f2a6f64e2b5590b708c6ddb3b97 |
| SHA512 | f42d284538b5ca4f8382321dd96dc104b8d7f49a1339dc1e7fdcac4fb22099078d29ccf29a7b9d23c94260295f39126197d082b4983acf7be9a1569ad4e237e3 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\PersonalCenter\common\close_big1.png
| MD5 | 5fa2adb150f63cba9e5443befe17eaf4 |
| SHA1 | b5c2a1cee13211626c061c422961a1d0aa742703 |
| SHA256 | 02b0a8d8524e604ed201f912fba8ee58c5573f8310145d3e64a3c279726dac40 |
| SHA512 | 9cbde58a143beabec9cd89ab66bf0f29db6903ece436fdb0c14dfd66803ccc4f951b316216c073be9e8032d20f8e0f93a4c393672884063e3cf8f29f7b404607 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\PersonalCenter\common\close_big2.png
| MD5 | 51fd1384bab6df779007cee07422e4ac |
| SHA1 | 16e89c96196d21f3a85ed6a0f5d97d096c2fbc15 |
| SHA256 | 9c0ec21d601c6e193caa0a04db9c80318d15e1fec713d3e82e53f709a5620fd9 |
| SHA512 | 279c7e23a32b639d13d836b1c9744bbbeec4167a95bd3302bae6ff2738877fb2e99e8a2c95934b38c74d74dda4783ab14f81ac96c551084e9cdbe4f9ee24519c |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\soft_txt_icon_2.png
| MD5 | 1402aa18efd86eec43a345d936f8ab4d |
| SHA1 | c51a44b65489e041620c8ce9ebb5d04c517d27e5 |
| SHA256 | 2276b09083e0da61a550d97c12cd814622c853358f26dcaffd423285ed29640f |
| SHA512 | 7b4913b6a30410d87a3c1c87d4b6d15510c47f17b38c3c2db11da2fb344b88e5c3d86dba86781eff180eb803222af6a58b6a0a12905139b085d988061c5bfd12 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\spaceship.png
| MD5 | 575984f7a1cfe13a9ed1d3800bd7d14a |
| SHA1 | df04fdf4070d29d76aaff8f5b2f68bff6ee0cdc3 |
| SHA256 | 925b723d434d5528c4dd712102279974e76842b71544fa8153d6108d11ccd7de |
| SHA512 | 1d2eca187cfead14798cdc18b4ffed909b483869281bd05fc4b7412fb76a7ee6987efbffa17db218be32d4c2e1ee6e1cb383a4a96983f226baae1f42a330725b |
\Program Files (x86)\IQIYI Video\LStyle\QyClient.exe
| MD5 | 3544d9748462cd7593833d993c29a37c |
| SHA1 | 1877aca3b883eaddc14bb00fb2055240f474647e |
| SHA256 | 16957ec4af0aa862c4d7da1ddc270560837485b602246a475f3d7124e942db96 |
| SHA512 | 805b0ee15917ef2c31f1d087ebbcf23cf40cadeb0cf25512bffe29678c4e4a91cbd1888871d047efb4a173fcb1b1be75e5a9b59707f6b9b0b25cb9fe25523775 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\logo.ttf
| MD5 | e1097f713080d07e0c717e0737ef167e |
| SHA1 | f31f1c4570925450c1fd1ac847cf54461b6274d4 |
| SHA256 | f2aa97fb51572edf0694ae328bbdcb01a172189aa53549b7ea8caebc66325249 |
| SHA512 | 786dda62d0423a9733af16035390e99bd47c5cd8c49f2802eb443896230b2dba70eefbb95de3175b2143dbca1f9ab8ccb8cd8e7cd8b8821f0a93d1a5c69923ad |
\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe
| MD5 | 95bff19e30f8b194eebc8c81b671d6d7 |
| SHA1 | be2883ccd72263e162350cdfb7bf9d4bc5090f17 |
| SHA256 | 4fa1020f67d7beee37c67bb6bd86ed8925e348adbf5748f9555dc96797c651d3 |
| SHA512 | 762bf013e4d46ca61dceabde986753cf501442e1c72dcf394b628e2f6273ff05f686908bf9ec3be17d28b34602ea0bc18795e296da43dda7de47e81962a559db |
C:\Program Files (x86)\IQIYI Video\LStyle\GdiPlus.dll
| MD5 | 385e243fc4314f79c1e3042070586d03 |
| SHA1 | bff588a2ac255b4cd1e3a9528529aa0e26f4657b |
| SHA256 | 18055410347fe57288aa11917e77f9b5833f59e669e8c65fc589d314eb6b695c |
| SHA512 | 5854cd81f2f9d5d01a7c0e3ab1b6801490f455191089a21dbc199cf924f59aadbff85d9b963700961c326a4def2a13ff9ba6d3933ead17262b7b66d0279f2c55 |
\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe
| MD5 | b6e9d6c600b793177c69ffc751c7a8f2 |
| SHA1 | 2d83d7e4a84a5378333250a470ad6577ea858780 |
| SHA256 | 19aa1945952438cc82e633ff6c90c4f21835fb79d49de8649dd1e18ae4c9a80b |
| SHA512 | 069ed99225d5d69817e16f8dfc2c95fe7c667e9e7f7b03897b58ffabe14ced8b4498b5ed117155ef79761f5189f88b54729864623cff1c80d9536f7c08ef4a0b |
\Users\Admin\AppData\Local\Temp\nso5AB0.tmp\UserInfo.dll
| MD5 | 13a689123cebd31c1d1862e05981beca |
| SHA1 | 0430094a1a0f639ba9bf5831c24f1f4330762a6d |
| SHA256 | 386933bdaf4774e88670e21abbebdeddf64b1e87b1681f85ac5b3ec1cac8dcdf |
| SHA512 | 0663148e80f4703000bbfc8ede2bcc7cad19877585a5cc46aa13a7003377d7315d33f01c1d311d38bcf5e3782e4b361510214f09a9f6537b856c5ad9bc41fdae |
C:\Users\Admin\AppData\Local\Temp\nso5AB0.tmp\UtilsPlugin.dll
| MD5 | 877ba4f17e960ddcf0c2fa2df62b6710 |
| SHA1 | c452ce34ed1b5043bb26ec938d170fffb14b53c9 |
| SHA256 | 7481df00348a7279b044cf12f7188b2c15e6a1862e5ed2ea8e7e2b0dc6c027ae |
| SHA512 | 0ae63c05641c234d53573e69eb143582916c4c976fc11d78efe0310b8fc04b0491838abd94b8c7b9ee5f77ddf41bfdeef61227c87a6da427c68b9feae6ada612 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\ClientGadgetSDK.exe
| MD5 | 9b4a17d36d4730907fbd6d8969ad4533 |
| SHA1 | 547f1198f277c267627083ab3a6f083931a88f85 |
| SHA256 | 7a201389575d3c6f60a638dcd6f8c1c41687b51bc7be541ebc271330e1875be6 |
| SHA512 | 870012f8ee3b07e5b45abdce7c0bbaaca5d963412332669ba1ceb4c6b9c6077740b6336dcd8ea802c10254e73173de00a3e2f1c6e3e6202b397477cc38e96ce2 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\error_togame.html
| MD5 | 5926b1d339e58bf3ebc876939ea4c2c5 |
| SHA1 | 64394e162c82bc19812c62881ca1545288e56516 |
| SHA256 | 5bbaa9feff7fbe44b794df4b493c587303588d74d138cdb50504ed5b6e3c8669 |
| SHA512 | a8f7374e80214bc9ba4e493e8706e59f55f07ccc31601ed550f0d1787e1c5dc6695f4fbf75e7e2b66c031fb44e391af6d65ea619c3286aedf3d12c819b3751c8 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\AoreAudioVolume.dll
| MD5 | a53ff1a83e51f4915a6a61ee92f408d3 |
| SHA1 | 15f9bbc83652f057f933ad2dfa02c9713884d328 |
| SHA256 | c81aedcb12656accfdbda1d1572311c9a0f9954c0036c0074235f42b6c0567de |
| SHA512 | be5d2b9c05d28c49ad3b8be847f322bbf23b06e9966418f57698e463c9bd112e9ad27081029fee422212013924beedf010074bcce5683308039ccbeee072f436 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CreateShortLinkClose_Hover.png
| MD5 | 2855abc8bc2f15113af379b3ced104a2 |
| SHA1 | 0aebf0295a17c7fd6c722ce10a65c9fc4fd09f03 |
| SHA256 | 671af83a229fe930a720e5805e079ce2c01334125136011d8adc0ee6c3dd50ab |
| SHA512 | 5b5063eacf5fdd0ee1e939090334d5f918c4fe3484a6a0a3ee4c87e8808153002ea8316733a5a8e84c5e019a2c6f4a64b8390ca339cfad7c2135fcdb9024b3c6 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CommonBtn_normal.png
| MD5 | e189e1d1d43cba9e78c008fa248e02fe |
| SHA1 | b374269f970d337375552f2b771126f11da42f15 |
| SHA256 | 911eb65979874e946ac0b2da2440084f98c3088758e2f1bd9144d495061d6aaa |
| SHA512 | fd1b83cd8130000670756169910920145c9a1cc1ca35b4efca61311248db07488d32430d5d3d1c45b231b3d5803e011470326f4e3ec694ff5663a16b66e1df67 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CommonBtn_Hover.png
| MD5 | 15ae314b60106f6eda43676eb1d3de6b |
| SHA1 | 2897302883ec07add176c4e03f8dc9a4ae6afdde |
| SHA256 | 8927bf74e9d960dad95ba796e6f2bc731c5b4e1192cbd7b120cbd2f1898ec3c1 |
| SHA512 | 479afa994781f6a495d7439ae3d0afc131ad5ad7bb5ff1471f1ffebf61633a74624e41b06b481f17c8a9f723635de871273147659ddf070664c385215bc23a80 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\DelBtnNor.png
| MD5 | 5ff65cbf00ca0eb38b04df50917ac76e |
| SHA1 | d5c498ddc143f575bc00955bdb38640901b85a85 |
| SHA256 | bd20a3bb861109627eef3acfc4cddd6120b6e96d7de94415ed375b43930c78ca |
| SHA512 | 01bdfba569dd465a84878cee5f31ba9694953c9804338654a135d8e081639a88dd419cb7b1f3edf843fa98bcfe0be8550f0e0709f3b51f5a051914fe2cbdfb9e |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\DelBtnHov.png
| MD5 | 159f343e6d3f9ba1d99da3d187398909 |
| SHA1 | 5855b18908526953cb8b8a9d281ee144107dfe76 |
| SHA256 | 1446a20293259c127b7631cb9934265c89810039e8c076cd98f946d55e00da1d |
| SHA512 | 70d6c98f6e57036a2e894c102888ea86575ad3e00e30ff386a1d97c6d4f407d29945f3f11c0e633e4f81179fe6f868755c0e82a0b9f1dbcc46e9410e6207ccc9 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\defaultgameicon.png
| MD5 | 116824ac4fabdc85d00e1d6e60fa6fff |
| SHA1 | 5bc1c4a8c152de3c1ea834a44e247ecb1e1ae865 |
| SHA256 | ae9291b1744a13ff45be576d455f268b93068651944e5fc5998b8c85eb1ef462 |
| SHA512 | a2397a5730dd9fcf8da86e58e247dac4b3806b5cae62b706cff2f8a87a0e7000c875b745413d6ec05c930fc4d5d89bc9b14389c6100bb437443970c889207a61 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CutLine_mov.png
| MD5 | 7069d28083d1361384f04c0d0f68904e |
| SHA1 | eb42e13f8ddd37a0a6493d1a8b4fa629c04ee229 |
| SHA256 | 328ee1b1c993d27c97aeb037e0e755e05a106aa4ee9e3203f350c9a09c4fa8d6 |
| SHA512 | 316e4539fb1cbb0204bbdf4beeeba9c3f268a006f280c74ae3d2d77caf1d34c571073c0dde726cacd94aa2237d5e03c345d38fe0feb6eeff01803cc634358403 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CreateShortLink_Nomal.png
| MD5 | 673f47624b85a4403fdc740fe2721397 |
| SHA1 | ab0843b01f6a80a70c2cbaabe67f273094f80b33 |
| SHA256 | 38bb2806bdc0022541bde8ebdfcc7c4b4724489e870cfa7ec5bc16919057f629 |
| SHA512 | eb43372ada55842ec5a7ca52be3a4cc0eebd1bf83323b06f3587632f9ac76ba57cc943cac46c3529bdc269105aef965a2662924815b253044f5b34a77b0d73ca |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CreateShortLinkTips.png
| MD5 | cb1e1030a8813d00749d308b0da73b9f |
| SHA1 | d97c9823d234fd8650dfcf540796d26f97442776 |
| SHA256 | 2d0fc3650a7f32216d8545dfd541bf4a1ab9f386521ae8f035ef8f6c069089fd |
| SHA512 | 24141197dabf6dd18adedf1920b52dbac7a72eefcf71cf66d02048e08d480c489e3ee72be174c593bd7a4e2882ef62bb0e941e5dc3c98d6abec15db88cbc5051 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ComBtnHov.png
| MD5 | 6cb194b84853c3d231eead716d49370c |
| SHA1 | f95a681a3dc9318580bb62ef8ce4a678d78f1ec5 |
| SHA256 | ee34c098163504705e055812f003d823efe727600ea4b56db73553e2ff9d0219 |
| SHA512 | 5ba1f927981c8679b49c5fd079ea2bcc662c8e9282ae736783c7d46ddcf7c486ad48856cea0831a223ac8b9600eea541a35fd3b4afd4fa2f132dc554503ba4ec |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ComBtn.png
| MD5 | 0a2318d4078889584caa4523315bdd70 |
| SHA1 | 281adb6f789746a5c2e446eea019c1e1047ab8d1 |
| SHA256 | 5956629dc86c8486d28137f91fcc493183a53a103c1ba5f4a4019f67a132e9ef |
| SHA512 | 5c05917259aefc4b675913cb896af105b1e7bf7cf07ac400083303e2952e307fb72eef4786e27381a7eee5d2b17dd4d55a9ed1dac7acded6890db927f4657b5b |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CollectingToDesktop_MOV.png
| MD5 | e4c70faae3c4fce495e12d24c2854c8b |
| SHA1 | 9faf01736350722f60820485bc6fa1eb364e2c5d |
| SHA256 | 03f78a2bb0eb5d120d85e7c08a16410921824154186b04ef1027905b07d137a5 |
| SHA512 | 54567bbe7b75acc0e09a4fde69ff50d295609fdab69478d8c995213d4491f09aeaeaa134b2a63a76d3c5f92a8a3b61c1e56b8593dddf17a12ca28b6c8af4e4c9 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CollectingToDesktop_HOV.png
| MD5 | 8f88aba447c6b48423a6ab9502060195 |
| SHA1 | 2d434c1dc6f8523b49dc669abd8f69f50656ffbb |
| SHA256 | 78a209e1df0745cffb42aeeba157769ccf016dd3e356719415c11374f0e592df |
| SHA512 | 927b79089112c18870b43568c6efa1f8959beb39aaba9356429d7209438f8ad330488f3c49d8b4bd9aff29808b751ee52c82f7322dc72eb8a2d1ac563ba79fbf |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\browseradapter.ini
| MD5 | 849c0db12448b338a7454ce8fc8c6365 |
| SHA1 | 1477afec52ba1303cab09b085a7148bcf56b2497 |
| SHA256 | 9897278fec98e2ad20355747dbcb541f2c87d15616f6f15215fec3351590b3a2 |
| SHA512 | cfff784ac25afd5d6b6a4b15b90f41614f3a9299e77921e804b9464504ea472e6da69e2142784a0c6dbd6f2319ef124220da22230dfd260e440939f14b97124b |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ClearIECache_mov.png
| MD5 | 683aebc33c1a57d4e7193ac11edb718d |
| SHA1 | f880556c87ea97d913003b5d61bfcc46309203fc |
| SHA256 | 2a1b1688b001bf57d60a0c47b6b82910c443015711820f6a95a073e540621a40 |
| SHA512 | 6aa2665a83c7b683658601815d6b0957ee3376645158339657bda2ff765b7db91fb8abc49ef0e50c5a9474965ccc9e34ba8df82e28d8cfa2b05cd49225a3a454 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ClearIECache_hov.png
| MD5 | 5e9c33c45c3997c6bd2a227496d8bbf5 |
| SHA1 | 61438ac8294a4723abf785604b05f3cfb3f190a5 |
| SHA256 | 59a3e8272352042ab795032d5dd448b2f9bb3c9bb0e4a119792ef31094e69005 |
| SHA512 | de8df25f3294dfa0a01433df94672272c119ab58c58e7af5bab3cb155dca248113d31e5145b1039dcf24bd27725aa385c860e286ffb7c6a85b4b8f25373451e4 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CheckBoxUncheckHover.png
| MD5 | 0e40da2e0b0d35ca116a6ef8cc09ab27 |
| SHA1 | c43ff70922be4bfcf7823551be6b2167c341f979 |
| SHA256 | b443f84b1dae129f7f7d86f46a1b6afac0569f5537ef79919396a18f15a6c709 |
| SHA512 | 82042d24bb547bf1aba3b317e611516162a955714df3c44807c65ac5ef449b0e5e0eee8e673de24be9eb89c9cf45068afff74fb710e2eb89e9d4106ffdd645a7 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CheckBoxUncheck.png
| MD5 | 0992ec4811eb429baf46221fb1bfe4fa |
| SHA1 | c4d95902c17a2c339cfadd366a1735a08dcef39c |
| SHA256 | 179ad885c9bd5e378b834f0c192f36d24366dac0af3df1c3a7896150e94a56a0 |
| SHA512 | 91fedac3aad148511f028fbf25f544590abd7daac05fdcf9f62063911a1b5e39003e9a97d54425d2facfb4446311dc42499e625766b912656dd1fbebf8fc56b1 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CheckBoxCheck.png
| MD5 | d9cdf06422119816ca6f9c4c72cd09f6 |
| SHA1 | 64e3bd1921689df2f3ee450c8387f9325d1254e0 |
| SHA256 | 23f27fa2319a141f10a8be0cce63f11fce499f5943306d9d555c177c74d346cb |
| SHA512 | 2763f47b77742585d3562d61afe00033ef7ebb9f3fb1b7cd8b163d62ed5770680b00ac27bf200a47734cf715adaab862b9710268db9b6fc67f3c6625612cd88b |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_Normal.png
| MD5 | e720f8d7d9b1eebf115a3ac3b2e8fa0e |
| SHA1 | 39e7f401d756d0f67413f9ff9ac925780b6e5434 |
| SHA256 | 395035ebf113e3f7d46d5fff75fad4154a674747d86049eb88d0962865cc8328 |
| SHA512 | 436d15bbdfd0cb4a1bbea0db7be5249ebb5e59268c6768a58424c66d155f4485057de177d9b36959c022b6a3c305af072414a75e829d44eee5cc0a8b6b9f4dcf |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_MOV.png
| MD5 | 0373829c3ff82ae9637c770174be1f01 |
| SHA1 | b608bca312673a83e435c475c3b6e56cf0ed0f61 |
| SHA256 | c5db13edaa19ab6024f12952264a3ec005c4ff87f677e33d0444a9485c113179 |
| SHA512 | ed0aa92263b53f6b65820303a08d31c7d54c422425aeae90ea52e08c54e10392acf33fdbb12e9ceea954df9a3cab1b13d4cc39c5a46198c364c6de3017d9dc87 |
memory/2344-5395-0x0000000005120000-0x0000000005179000-memory.dmp
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_Hover.png
| MD5 | d94d4858a788fc9c9e4372a9847660f4 |
| SHA1 | 863d2d93f6909c19ee666e0b73e5a1914343c221 |
| SHA256 | 6dc00a8eef3d4d1394655073304c749b499e4ebe34ba292b3aa1e81f53a2efdf |
| SHA512 | f734a7c10005bd83e56e4f00139375404524c94c8a906d71bcd67dc590d91a9d9caeaef702a67540c7a627100a371c663a4d2c0cc6610b429e2618e1869f61d3 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_HOV.png
| MD5 | fa74861595b2d7f8029238da227c9ed1 |
| SHA1 | c2103a895f32dcb9e8f1b8a7f647d38821b2df1b |
| SHA256 | f22ecceffd5edb6c5818da84a7753190a2f1a050d7a137676c6baf155955ac02 |
| SHA512 | 7ec53735e6f498db76f25e742d512a58729dc3889ed6c5aa78844fa9178b8ced9de960d238258f161c3dfa5217bd2c575488b868910ec55bb5d887469ef7989b |
C:\Users\Admin\AppData\Local\Unity\WebPlayer\Uninstall.exe
| MD5 | f5ec6cd3d798b1c9a2392dcbcf9bc502 |
| SHA1 | 56593b443ba4554410fb7bba45a137a436880008 |
| SHA256 | 97cf07b0e1a1b5a153a5760bc4270ff09d319aca9d45a2b9250edaa1bf5b848a |
| SHA512 | 838cdd97e05bc13863151504d930a14ccba9e3829e432f617b17d9ef29fbf21802ad66f6ad9c6ac385c8437f80e8127e00a11986ce3ae9ba06ced1caa327e3ce |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_click.png
| MD5 | d5c86709860616b2a77328be90005dd7 |
| SHA1 | 8e3051d9b74eeea2641ca29510e8dd75e8f6dbe4 |
| SHA256 | 4f3d3d8f8544b6f5d973443d28972712d9f869f745544822a7af63d66cb9806f |
| SHA512 | c2149278520b60989638870a3095b82f85eb7329f67741c99e832c483e2a2a7159e9f5294223d504eb98f0d1b185a57834d43da0681684a7b4152929cbdaa6de |
C:\Users\Admin\AppData\Local\Temp\nso5AB0.tmp\UAC.dll
| MD5 | 113c5f02686d865bc9e8332350274fd1 |
| SHA1 | 4fa4414666f8091e327adb4d81a98a0d6e2e254a |
| SHA256 | 0d21041a1b5cd9f9968fc1d457c78a802c9c5a23f375327e833501b65bcd095d |
| SHA512 | e190d1ee50c0b2446b14f0d9994a0ce58f5dbd2aa5d579f11b3a342da1d4abf0f833a0415d3817636b237930f314be54e4c85b4db4a9b4a3e532980ea9c91284 |
C:\Users\Admin\AppData\Local\Temp\nso5AB0.tmp\System.dll
| MD5 | d0d7d2799802f7cddf8db7a2d8ae1e23 |
| SHA1 | ae8d8cfd9f1a7104036a9e8658f50f9c35c7a1c6 |
| SHA256 | 828819614dc0dbfb73f22d4c3712e6369230eab92819c5d4efe75870ee109a5a |
| SHA512 | 2b5af0e34720eb2f5b0aa04b589b46fb4b4d344b5c5d23fdd382348b051ac9766ff80f6a2455ef66da78ba880e8ce41b23daf741033de7701ca3f17f1adde408 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnMinNormal.png
| MD5 | 0f8c32a24cdd495cf044885babc2a284 |
| SHA1 | b554b4ed413de5050d7ba05f5f9135fd9a8bad66 |
| SHA256 | ce9610d0d6f603ed290e3eac9813fe6428f85575399f1d2f3b79ec2b80bc5700 |
| SHA512 | 88f4ca39e9acf4d4e17d003e1bb043a2cb4784d3c06fccb061f4e78033ab814ce301d23ae2a71ff454e8ab8f82557bb5385cb6ac927950aab955ce9ca459b0c3 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\vmPage.ini
| MD5 | 3e8a5d1adafbf32b88bccd9e04866c1f |
| SHA1 | 1e8f652bdbadfdb76ae3783f2b13e782eed2a755 |
| SHA256 | 5639ce40cff3ee7cc012f13a8d3d259c29c3f7711111336e4ac1b2cea6932d38 |
| SHA512 | 91a07ca3130e33c5e142727bbaf0973b99d75b36c4ae074f6374a6b81b2bc0d8b88d0e253b40b916322f47e15e49a2784dc55ac6d93cd6b2915bd6a6aa2406d9 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnMinHover.png
| MD5 | 3d5ce2154e2739d8372cd19ef6894d54 |
| SHA1 | a50b1d7dce90ace6de2f64420cc501d4ae044ff0 |
| SHA256 | bcc19a19510a08c675266e240a2262c92f1bb214f333cdd3c12e50a84f97f881 |
| SHA512 | 382f29d7c19f22c34a9fea304028535835fe2693fc6c86834d3b2ca915a3e14b88cc84cbb368543312f6080f53479039557418efe65e2909ff5b07e06c593684 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\vmPage.dll
| MD5 | 93d53ff1b299ffec787c73c0c87ec223 |
| SHA1 | 91e674bc48d7f9a18668e13d3889ea4cfdbcf7c4 |
| SHA256 | b50fd866fe75a6654ca15ac2ebbde98dc7c5e6b23df6ea658d1fb4f55825a388 |
| SHA512 | 92e2c5c1eb85f3bf18e17ebb04563b1f6e85efa27d9ccdfd2b6959a1fc43ceb9c70fe129994ae22e8b9320fce7f5b06973f45a3da23aac00da75de9a1edb6b0d |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnCloseNormal.png
| MD5 | 5c58e41384824810c9233b4e20544bbb |
| SHA1 | 19a38a15c08df0c87fc96fb2ff1218cb11397bb7 |
| SHA256 | b6f7642aa16976177755b14a93dbdb3245eadc5f31cd28abbd97d31b4939a189 |
| SHA512 | 1ee8e676ea4702c7196f123c327aa0cbffc4553f389816dc7a8ade555b7f8c07e5b4b80bcc8ef6546e85e9b5255f20cd81cde91faf509f7d4fc0f35421af364c |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnCloseHover.png
| MD5 | 77c53a33af5d9060edc64d742581c78d |
| SHA1 | a6ca1ead89f69b55cfa2557a2607e056d7b98ad5 |
| SHA256 | b8ee599130d00563db4e4c0cf66b07d626d00e28edc35d9e96734d73c11e56f5 |
| SHA512 | 16bc887a618d565e5a5a93c98bce80510138a1c6687a027b16aa52233154bdead4224d4fbe76b2c48d13e210e426c6c86c250a27e7b4b7e695a9af59e8a8f506 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnCloseDisable.png
| MD5 | a7a050294a34df2b6598b06c0f1b46ee |
| SHA1 | ad0a456db2e13852af75b30f8a84495dd8414b1d |
| SHA256 | a37bc8a0d719e97f6bba561f05056c90beafef08dc5cf77ca0604caf833b82ae |
| SHA512 | 3d1bbf0957bc2df884b0716ecaeaf616f83f803a006cb0b03f66102520d99e98833d4448c407b75dc5a67505f0c7cc23a919a4b58881bd4c1691c5257299df36 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BindPhone_Mov.png
| MD5 | 62cfbca60f27d4b42253c96e1753bfbe |
| SHA1 | 496690bcb841f2c95b1b1d3ad2f8a70c7a3dee76 |
| SHA256 | 4e2ef52fdf819e5d5825857600bb1ebad672a16873f4f55cc02c4b78c04d01e9 |
| SHA512 | ea87b367f8dd7a0670ae3171dd7a6f957682a661528e9f1330921c8273dd6df952e529aed59c21be33f0f733483266468809dcf0a5c38137610849ca2489c4a2 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BindPhone_Hov.png
| MD5 | f061cd973c3245b935f8ca0e7fa2df41 |
| SHA1 | b843b3013d90a3b54f54796f36d0b3ae64e0684a |
| SHA256 | 4047e046f0f25b0f41d3cdc6578e252d35d5b2db9d44f91fbe5400b14073c8d9 |
| SHA512 | 05047a6b3c235dbf1c086ea97759f888efc88dbd25eef984de53aab304e0091f40f0014b6edea4368f813f4d4dc0cd04d35cd1fe0dbaee3a9ddd31b675cac186 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BindingAccountTips.png
| MD5 | 782b458a7a130a168e2348bb6b6d1ec8 |
| SHA1 | bf958b123c4c07ffda0d47939747464deba924a5 |
| SHA256 | 37bea36b1180d7b0a2a2734a46b3ced630c997a461024dbd395e12706ba29599 |
| SHA512 | 3b765d00dbf554f5b4037b27a6ee5a3cfcbc26d33a6b336f5a37fd085de24ac5bf26edf0e6855ece7184799a1e216bc072fe516356a419e9a9d26846c58ce32f |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BarPay_mov.png
| MD5 | 17ded5e0a173363a18f2e998cf05882f |
| SHA1 | 121c6c1c92e0538cc4a1964eea2a6de7784a6ff7 |
| SHA256 | 5a6d97e4f5fd2cd4ff81595bce200b8b9bb0af8c87e0a5a1ad33e2ba8592631b |
| SHA512 | 12d6cf34bb4f1c3482421cc986d2776d6724e3b97f257a2cfa17f373b688742c23d8a7ea682b8bc19c5b6162e2bf9627c415e3dc822a7beed2bdc2799bcb6b6c |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BarPay_hov.png
| MD5 | f3506a23a8eab8def532ec1124fc122b |
| SHA1 | 5dab7891775c289e860aa2b144483209e8673b13 |
| SHA256 | 4d2fe7c86523d8e72de46e925aa1ea473e43b46534088c2372ebd5cd2db6a02f |
| SHA512 | 1095e4cce712836bb0f1b45f83a919f44c7becc8c51f950fec2a1e4034f8d6004372e23f100e51e309a7a406c51b4fd0821cc92f8245b720e094ce6b9cbc0856 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ArrowLine.png
| MD5 | bc5022a5719a200d8cb4df3b5d95337d |
| SHA1 | 33b3389c08cb110d2882ce7c87c09f6ac768e91a |
| SHA256 | 79c208d9481d9ad70b6375aaa875c1933fa6a5aff1a20ca69ae9e2d28fd16253 |
| SHA512 | 71d564c909621d9260a257daaee9bdb019a8fe24f81db319ba7bf31b6e81e5db7fafde7b76c181a615bd872fd702ab60d463ee340b8b8124bb524ded20cc9245 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\control\mainframe.png
| MD5 | b702f688b22f0d326be0496338307f0d |
| SHA1 | 3a69c7a925bef885ad3491fe552a613dde803aad |
| SHA256 | 97aec0db2dcaf6d20a1ed9e8cb2d8bdde456ea0bbee9bb9275bfb284dd059a52 |
| SHA512 | bd30e9c6518072b5954d69824d084a99011f24cbc386e4be15a3d55bf5f69cc11f1ff4693699b2291278ea7d19665348e847f6c0ba8737fe46ef837dfca3d102 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\QyWebGameClient.exe
| MD5 | 4c3d98b2b8e9e4064e5947d64c4ec613 |
| SHA1 | 6b8c3f2ee10d8f830f8678e5245cc2a35d18ac28 |
| SHA256 | 46f0604a4450ef9f828364e21a1441bdd4fa7a229964aa61bf16279150c9ba55 |
| SHA512 | 10025f9d34b952b09037f5f269583d74c3792cbd386eee2ba3e143f8b04636cf662e1c154f286a86343d0f27a1bece456442daa7eec84670e741c08048aada2a |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\QyGameClient.exe
| MD5 | 85d1912c6c543f4cf7b69ebb76372b5c |
| SHA1 | f43303d60f2baf0d17ae6d14b8d98b6b1152d696 |
| SHA256 | b9f7db9f09ad85025a61617ea56089ac92a2f1c9feccd9b3273f88abf8e769b3 |
| SHA512 | 91f568d0a95625da13da7c416e0813b922f30c280a80e04229365fc121ddec0da9afb4a1f64c63405521d463cebe6ace0c5a6dda4da5bf57a39d50729eac176a |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\LobbyServerList1.xml
| MD5 | 45811f4d5463405dae043f7e9b9ba846 |
| SHA1 | 886a410881900f0237ed619bfca6583da8ef919a |
| SHA256 | a0635bc8344e41759e0a53f0720435952f57fe68df229ac4831fb9300bdc4593 |
| SHA512 | cbaa251953dc1bd3d67c176702a23482472449078344d7d26051589e1b5350f5a85cf120453bc6fa66f6a8c6b8db80bd52c4b2bd67dd53d5a1df02c7dd8d1736 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\img\error.jpg
| MD5 | 2cd92fc75bc2be926e4c002598f325c0 |
| SHA1 | 484461932de9ae91409a67308236f4f35be0a232 |
| SHA256 | 657728435b2d152106f4acac777bfd82157727e0fdf6364c4f0eb4906a443399 |
| SHA512 | d1ab9a455742d502260bbd3279a9da0579f0408b5a7443ec5c28b4a19c8e31f6e622d33c6e886cde289a3f8e6c530c9b94e8c247299a0ed54dd01a41ca8c329d |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\img\bgline.jpg
| MD5 | e50052189fe327cffc4920d2cbfe7e5a |
| SHA1 | 917e438ed6c14579b4c923bed88b0938a5719312 |
| SHA256 | 49de719c563b90541a46fd3db53057cd6e1c854f69359b09453b7c6233707ecd |
| SHA512 | e98a96a9a3086768ce81e2152a7ad98c8f0c08308521ade743940ecc23170ff6309d722869543593f8fea742d2b0f95602a594ddff9894881043654d69008a58 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\img\arrow4.png
| MD5 | 55b2b0485d8cb14277abed24471c8ec6 |
| SHA1 | 121aca27f33646990d96a7b602671a0d01f6a4b5 |
| SHA256 | 41e8a39560fe7c5d41be57668b697ff6d163794c1fe0d178bd7ff603395e5666 |
| SHA512 | d0330c27c501f78cb3dc07df0b2b757851420a88002ee1ccaa5ec3fe29d42fb59bcd26b2fad40bf771e611e2ce7e98fbe7a72c7edd0e58cc5a78075d392cf751 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\img\arrow3.png
| MD5 | 4b7ff428e1010f5b4b924a381ecc6a9f |
| SHA1 | c64a6c92c9ce90dc5f51fcb61d1fa7aaf55765bb |
| SHA256 | 6da80486fc24fe096983626c22d7ade8e72667205ae9ab88eafb1b5e896f7d47 |
| SHA512 | aeb5d028c20c69cc04422c1cbcb0ec9ee72557553cc8230c9129b7baa70c6ad3263d91c9d5c62c69792f321182564d6f52e167e18bbbe4370564790596561d39 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\xUILib.dll
| MD5 | dd1da7c9c63bef5810d6bf420b250711 |
| SHA1 | aac132d466e9d5c6d0c0e7361de660d19b233832 |
| SHA256 | 520e93652c86c834ac667c129f6fa248be683dcb08a2001af8bb8293043d059b |
| SHA512 | e98cf642aeba71c5bd4f14d700f094c5310d63914c070a7218a892e7842e0d7d2701797742727e11eca929a4839d3d6d6c243725b80b056b8388e476243f2355 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\Btnbg.jpg
| MD5 | 677a088118e4a38fdd16899bb674d00c |
| SHA1 | 72f3f2f6a023e69f71cb296dec20b7263588a5aa |
| SHA256 | 5177ec784971bb764d1c52ac6eb576c0807c3ba52a50550ab49c840da111bd04 |
| SHA512 | f224e2727ab60f3a81f709454214cc4148ef7b5478565e6e22aafecec6ce8606f19ea71da58b0fa2ff8a3085aba5e99fa43c568d4bdf6ca3cd7fa067df760f46 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\btn1.png
| MD5 | d271a47cd14ebb209b06ea235a91d144 |
| SHA1 | df6d11259e8b54247d052a64b2fdeb86908ff751 |
| SHA256 | 09fda339a9d73d4bd0c728084eda60967139cf45c96e81fdd63ef562597c37ed |
| SHA512 | a074342fcdad77884e7b3c0360dcdf5798e3b1dca4484df23cd85b0283da0920fc867fddd41bd3d8eb4b1200e43c9b34114ba479ae9d4e874f46ba4808705ef0 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\btn.png
| MD5 | 7ce6f870a814cc914ddc015625f09b56 |
| SHA1 | a22877c1c76ff797b13a99ddea8920ba31e37292 |
| SHA256 | 101e790789b35eae7b1129e6a5ac8ad61a8391fd963a1527f9da81bd130611b3 |
| SHA512 | ca7661795e92b6cc282a23b63a0ba11e7bbb413a46c9ada5ed232b479c6850302d4189d09e60c46a7831d43cb7d73c485530b3b24709db9254910cc242dabf0b |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\btnbk.png
| MD5 | 32550273cea0a17561146ca14e7a5c90 |
| SHA1 | 036266b87d881860d50722703774159ddccabd6b |
| SHA256 | 370eb5b574a1d8fde787a22d45653f174170bfd54d416798a445c19319f2f5b4 |
| SHA512 | bc27fce0e8e9e99f620f66ca9a966312847b3908b9af69568129399aa1eb7e0884f2df68870fc626c6af43e9a3aa55389a340da5c3046e005cb1dc7d6a80a32a |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\btn_ret0.png
| MD5 | d1b7f29671caee4fd94f2da0a3f6de8f |
| SHA1 | 3db70210a894e341f86200e97c6796a6cb957e19 |
| SHA256 | 5a1a5e6e22070178cb4e197ce5908a385624ecfc4397eb8f2c386303f23419c0 |
| SHA512 | 94f323918c207233cd31eb5047f9b285546d50f3ee3db933aa35f66e393b7fbd1ea9cca70de8dcd8e1e60be2a85ee8a914a944717e9a117ee76b966620abd490 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\btn_ret1.png
| MD5 | 2a8f0f7669103f39c10a5f3d76572f19 |
| SHA1 | 40f7f8df67ce3ca7c06347e10e784835647d8fe4 |
| SHA256 | e39f3108af9ebb13ea48d540c10e743ad505eadd914e5a6181f7e02c3f4f445f |
| SHA512 | ea64409c2ff9c36c715eaadbfa42ef1301b6ad371a0f5b004c8613c2cad6f36bb537f7dacdc3f496b3b675e80e6339e108c3a4d63d6cc142a5be1ae9f6fd2b55 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\btn_play.png
| MD5 | efe072b9f40e37707fea80e7c44b4239 |
| SHA1 | 6d4813b46390e88b2fda0cf4c86677999d1d08c2 |
| SHA256 | f3a5382d884ec50790f997c832698637d3ab7d713da87d34c1a2abec34154248 |
| SHA512 | 36da4270612a0178ba085436812ddd755c1a3361361062a8a83476087fc8936de332d840d5c939ffe1e909084a91ad9c7b2bfce75461fecd03e671156f0c3fdc |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\change.png
| MD5 | 775c8c473d114371aee960166e797a1c |
| SHA1 | 9d6781c18cf88a45fab4eccbc0080167fa71b7d3 |
| SHA256 | 29faea036beb35f0742556fa75cb9c9e8f34895bbe24899d7a461c9a5b7ad6d5 |
| SHA512 | 1318cdf41d31360049b67f4d1877bcc3b3e4f0e27ff91321e6c7739e6007037116baf4a46c5fefc33f30e859fd4cae77fcd2cb4dcebd74be2c95fa40c31ac181 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\cancel.png
| MD5 | c4501efb71ab8a88611c877bc8d3f2e9 |
| SHA1 | 61836546363409c117919f7f744eb3b62619399a |
| SHA256 | a1b31668e240e38e7b85888d783cd5045b90747a2e8f3ae8a72ec3583274f82a |
| SHA512 | 26ec7eb4c95c85ca9f6e5fd823fcdb75ea8353751999ae524f642442fbcfe7ba8a48c644e6384fdcab78a6df1114aa529f0871b0731b752946df9961250758b6 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\buttom_gray.jpg
| MD5 | 01aa1d97e77f242a34b5da6d2f2b1de2 |
| SHA1 | dfa6ae051c6f22d30387a6760807fcefe1746343 |
| SHA256 | 55e5a5bd697dd9d01189ca52d10492cfb614c023e884d781d2489eef94940ec5 |
| SHA512 | 26af1af1f34f0f0c5a32506fdefa7cf8abebb6afd16089c3ec89ec754efe894fcd7fbe55d222d6b6bde690ee26977bae2fee570a1fd3530397b38c575d19305c |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\clock.png
| MD5 | b544e79b41f4bc35aa817082ecd8b813 |
| SHA1 | 5bbbb6b5c015f62b8ff3eb0a6520acafd59a5204 |
| SHA256 | a61bfde4ad5caddf5b751af7fff2c65fa9fe885f780b0d6a4c49b8717d97ab42 |
| SHA512 | 7c5b112c9ce3a4cbbb92aed4e74d18c23b8bbc2f31c9b281ac4024994e62fb995442002aaf8a539a3e07fe030c7a9e09b13d76b72bd75e24a5ced228f25d3076 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\bubble.png
| MD5 | 5809d6111ba9d0f0dca94aab242026c7 |
| SHA1 | 7c22450d09a0d56d18dfc742455253361f012196 |
| SHA256 | ac1cf25396f995245fc4955a3dc4fb1cc49c39307db7bfd71a7d7551ea6c7be0 |
| SHA512 | da6c207f8eadfd661650adf72191bdf31b7cfeca8b3fbb4cb75e0fe6686f7defaca3b1e9251bef5903bde1e3849ce5d91005fd509f80abe609d603f533c7d8ad |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\dislike.png
| MD5 | 12aea16243dcb7e1dda1687b2aecd6c1 |
| SHA1 | 289cd20a1a409a52da2c95e4b47bd99cf45c9a4a |
| SHA256 | 3d7026fac432528053b0bd89a715bb2c2e54179832fe03794185517f841e7403 |
| SHA512 | d8244c7b57bd230b1010093a3eb5f2e116a4ee31776d571327e96f11cdd8d99939dba3659fea1b52e10cc34321caf5f6ecfafaced7df5c7e63cd165e42f7cbe3 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\default.png
| MD5 | ab98f23ce1c7e3187b0e73d42efd1d53 |
| SHA1 | b80d38ad33dc89b42b81c053fade7a1a049b68bd |
| SHA256 | 3c88faa2dc8924082654c78c84980f8f44cff10c2326c9c4594dc2d475775a5b |
| SHA512 | 5fc9ffe92dc94e1d217dd035d378466ebdae9360405ba6bdfeed7fff57344eaafd19169ef757b0162fa49c7558547c929755a4fb75d6e33019741d47fe62616b |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\vmPage\1.0.6.55\skin\dotline_col.png
| MD5 | c0ca066c359686727c94faa7785ad6bd |
| SHA1 | ce6fa096b57c66f9fcd3051756a60afa7f44e41d |
| SHA256 | 41b01e59c1383425ba03e4d05999c6fd627965e6269495c00b213aa4325d3240 |
| SHA512 | d6786c8bfc9206ce3abdb7db6bb021c7a06d7a0ec49be8b355dfe540a1c06e5e5e6a5332f859c4380e92e81add0ed5674aa7557f066e768a8653e117f66c5d23 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\combk.jpg
| MD5 | bda61d3d16b5e080958a26403856dd76 |
| SHA1 | 6e0f505387a78a81be4e9a5cd1b9e7e169d437c6 |
| SHA256 | e67a18b2fc2992aff28ca1313f098b84e43028faadb6b1313200fcbe8d91dab3 |
| SHA512 | 8a11210b3ca823639655adfbd357f6424f9fdf9acc0969bb7f506dedcac562c11921391861da76bac974515656a010fe8f735c93a1cdfcd53f2aa67497c5356f |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\CloseBtnImage.png
| MD5 | 669e1458615cdc45ecb657f19f4c47ff |
| SHA1 | 5a581bb204332d05efb30c58fb12c6e954a588a6 |
| SHA256 | 631bee4f6b34820aad4c74092ab8bd241d84c8a72183dc8e054cb82f01270297 |
| SHA512 | 437ab69c46668ae16f9e0ce1823255799884e309a4fb2345f8830a5c6b7d73655cdafec8ed813c7ace036a62f09c9db1f905c69365d9645d1ec83439337b8b3a |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\vmPage\1.0.6.55\skin\no_up_and_down.png
| MD5 | de4109c2374280da714e9dcdb3d3ad9e |
| SHA1 | ce6657dd563c51c684277a4213fb2be052a13f38 |
| SHA256 | 03b3fa0f39cc032f3f0fa0748810bca79d925e64ec5c2df0d3898580b1d7b203 |
| SHA512 | 99160096e9ef20e984d09d6abd34a0522543e00b582254f337a3f61ead89ec933fa8f2618bc1deb32f7bd44c821ddc1ce9b60392fe65374cd1912262a632a205 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\clock3.png
| MD5 | e4a948196291cd9e4593dd8176a30e8f |
| SHA1 | a16f8d4aff82f0a70872bbf1bb49d0100a7c5d87 |
| SHA256 | 97f6442227b58735e933e67bc5504890e2580590060648c71ae9fe98b4526fb9 |
| SHA512 | af1f8bfb182e1319456ed0e79b2905a1446cb973a25f6fb38d6f88813ac7eef44103655e590eddf94c6c7ba045721b5d2b16255b539c5384dfcef9e312c3ff78 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\clock2.png
| MD5 | e28c2b70c7adc739dab9f8d1c35fd4dd |
| SHA1 | b410b7a04a1e759317317e640ead04c7d3aa68b1 |
| SHA256 | 767b41c52a61ce2052f1125098a67c137cb66cea10de1520f9eba19143b0233e |
| SHA512 | c6ca780fb6072312694890d935c77e245a8bc724ef68e892385419d8e4c9eadf7f8a32ba496bc8ffa551d2febe30f25d9ddb2f574e3ffd3f581308d9ac45b6dd |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\btn_page.png
| MD5 | a501626cf7705ff8174c95811d8df7ed |
| SHA1 | 73a11ce3c98edc4b3440877fe955bf67b1cbe2f6 |
| SHA256 | 79f8d73e8261c148b892928921dcf4a4fd0d94efc5e550de568b0930e49c2de9 |
| SHA512 | 2eb7c3b389ea103b5d65a32c0a1bb1130217ee728a02223515fd0efc9cb949e5ff95226e2c930ac61d0001e063f89d166d3c21ff0ac70d6083ae4b3c7f03651c |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\btn_next2.png
| MD5 | e6c6e3ab8badf71c9b74ba5580a142c5 |
| SHA1 | 8f9785ef428d3a4d7b24af6eea4d9b4f138000a6 |
| SHA256 | 1480f4518ce6abc1975c577e24195db18ffdb7819fd379245c0ea6eea811c387 |
| SHA512 | 9f70184a0d21a8bbcb13eba85f56a57f0e9b499004855a6967c6922101bbcd4a668913e1c4a569c01102950b97b2f2bd84a7e28bea91660cae55c62f0ac75713 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\btn_next.png
| MD5 | d2f76b0e7cbd0875f256034b701fc745 |
| SHA1 | 1bd822c14c75db9d8958c9c2d5eadb068b1d1459 |
| SHA256 | f007f96dd7b6e68b1e5464d50f849aa4af3f7d518f549f04f6f499a03d2967de |
| SHA512 | 5e9ff44861771697f075625f4e201e6aefbc71407d9da7972d273d439809904e2070dd832128c019f2efe6d7a69a73eda8779c0ba4fb3c94fc485faf18ad43c3 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\btn_leftright.png
| MD5 | 1e99938728bb59279da6c6137d4dac1d |
| SHA1 | 486d642cedd0622312e71d084c41156d67aabb22 |
| SHA256 | 0195bf63fe3f748b8fdec44e48c53807eb5b7f6c9a12dd41b12b3a8f8ac643cb |
| SHA512 | 6950623383605e7a33d29a5a2fc4ff6f819fd043e38f5cad65f40d98f5cfffc86f2fcc6596fc1fc8f7218b24b07116952ca9efad10f6ce113d56eee93b5182d8 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\BtnLook.png
| MD5 | a10dd22d96d01a586d1ec1bdb3e2a452 |
| SHA1 | dbf16d2feb475ffe776b3f4ff93fad0e1df8a324 |
| SHA256 | 692e2688c727b8d4b5cd5c9d57e1baacccf4c9b42050a6a1e61dc0f97fd7356c |
| SHA512 | d30d1cc6635911924fdbcee591a6236c219b46f232e2a4475ec0f94d92ddbef2fecff61b11535f25ee51d9670fd937073a5da9b02e50651a6109f47325f22350 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\BtnHoverbg.jpg
| MD5 | 8b4727ebab78a0493cd80baadd8479c9 |
| SHA1 | d89971e9c4ee5d778b61efff0db875c5f531eeb5 |
| SHA256 | 41903ae7a88916451ec9d7f6fb8c531065cb8edf6dedd553e140e6a1c2ab8742 |
| SHA512 | 8181d7e87254d0a7e7350f10e612872ea7c71dd3c9241eaa8dd65713b7b666a0fb274fcc6901613ebb3e9d13388c861197d26bde4049db8df5e68d1960cd23c2 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\LogoLIB.ico
| MD5 | 094fad0a9eb6e39e00f6452da2e0a596 |
| SHA1 | 053e9e4ae140cc3fec5a500c6941e0181e6ad143 |
| SHA256 | 8429febe04859faa258bb06bfba94eb969ff7e80da207bac6417a22cc83548de |
| SHA512 | b5d41ab5c040b0a001aaf399e9e7fd9646eb5d79268fa5f5258fb22a178b311f46e46c48c75495a003ea15949327700b7011602d726d92cf7e348f83e3ec5867 |
C:\Users\Admin\AppData\Local\Temp\nsy2637.tmp\vmpagedown.exe
| MD5 | f5c82723518ac5c1e33cb7b8520094d5 |
| SHA1 | 210cb26ffc62e7b9e6bd0398b28ecbe9e1b0e2c4 |
| SHA256 | e9abaff20fecb812d4df90395990054fb26d17640ad7a31cabd582cabe22948a |
| SHA512 | 85ccf75499dced8f1cb0e451b2135cf705da33ae23e290b4594dad1ed901cb7e3b4777b28dc52a7a9d5c40d4d10e9d90e3be3de8c686e276dd6837f15a498524 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyMaster.exe
| MD5 | 9e8e028857769d11281f83f1438d8a35 |
| SHA1 | a6a23b4e3fc495ba235a5b35c35c8fe05ef2f55d |
| SHA256 | 169e700568cb68e2511589aca9be8ad26bcd1ae52d0d109120576934c8af94c0 |
| SHA512 | 42c9874e7b8eaa50888f4f533bd93c11c8277c8435583f06c764a5858f47c34ff5d8fc982540b5c06cb2ee03fb406931eb4db8170c18d0c1bb3f5bdd52d8b9e4 |
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\爱奇艺PPS.lnk
| MD5 | df61e9f76b7c707d6ed95c7f762ac0a5 |
| SHA1 | ae2820fdcd797c9ebc1457a9f9a17ce6cf5706c8 |
| SHA256 | 7521097c6e531f33e0eee5d8a71e69935fd51d9ba255a274ba4d46ff300780a3 |
| SHA512 | 49987976446b938fbd86c4ca03e402dcb107cceb8496461efb2319d19f9e39f3bc9a246ce9f8fa4ee4e9a5fb630c4d0b68201759947cbe1e27f726f156fcfeaa |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\PPStream.ini
| MD5 | 50b9cc08394733bad1f873eefd2b25c8 |
| SHA1 | 01151177303c144ac751acf5d4ea1211bb4f8635 |
| SHA256 | 0010ac24d61fbc2d85cb5b82ff7e0489b6f085fba82d212748efc17ca31bb202 |
| SHA512 | f41a2c5a61d19378f8545a77ba47724070ea1c23c641a776a94f210cbaabc34cd1401728b9e989d3c3ee272b20602b7cf7194b581effc98920fc4f60b5bbbc8c |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\PSNetwork.ini
| MD5 | 3221fa8864ba8b73d2b5fbd437a289a0 |
| SHA1 | 0b210cd735603be096e676cc0dc9d4c5c1de63f7 |
| SHA256 | 8ffc6af8e58191176ef82385aa12d25c0379d3b9ccc3a3ce1d041f3c52d61914 |
| SHA512 | 220a1f69d939f7a67c94a70e88acab7be105a7ed4fece40890c0b8650b4f356d3d7cdd348e380673a4cac25cc16e8c1324aa9fb64efb3b7337401876ad13ef4f |
memory/2344-5976-0x0000000005230000-0x0000000005232000-memory.dmp
C:\Users\Public\QiYi\QiyiHCDN\Config\PSNetwork.ini
| MD5 | 40767b37f76cdc61b6aa8c2582241e79 |
| SHA1 | 32f9513c84b64c3a4f2c331c9e8e927d91edef26 |
| SHA256 | 9140a9403517a9a52add399256cbe86577e3eda1280db38b6f1560a9486040a0 |
| SHA512 | 90ad23204ded0a031442b8492dec0f0a970e01043eeae933ef086182e1776d036d2a7556e8b69b97ef5c602d0586674a7e0c44ed8f9a0c747a080bfdbb69271f |
C:\Users\Public\QiYi\QiyiHCDN\Config\PSNetwork.ini
| MD5 | a04f3638aa745498381076aa21b6174a |
| SHA1 | b91bc51aef9e7f3bab35c25851b756940ab0150f |
| SHA256 | 15d73a200746a7ca8bc6bb7d05a63ef27ebb23c7edf98195a39034b231acad3e |
| SHA512 | f1269cb99a8e3b33a7592b7fb26a3b256c75cd173ccbe008e0b0e9ec9f0b78383745b4daf047cc9e5cddec4853f3b94cdd6d923946e5d17afc1199d9dc7c4762 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\browseradapter.ini
| MD5 | 2ead05e1cee75f9ebdd5f9ac04cba9e9 |
| SHA1 | 5c37cff83b68982eac4e8b6ad8a4a00143890a04 |
| SHA256 | 0f318d57f8a2101da3b9c6b6c92e072afdf30150d4e628db68d4502a50b5bbfc |
| SHA512 | ef73d57044c0b860839ad2226a4b61da16191e94a11584cb015c85f9ba6bf7202bad73baf2302426b1a1e3981b292b3eb4774643c31af2d7a12312025270e203 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 29f65ba8e88c063813cc50a4ea544e93 |
| SHA1 | 05a7040d5c127e68c25d81cc51271ffb8bef3568 |
| SHA256 | 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184 |
| SHA512 | e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa |
C:\Users\Admin\AppData\Local\Temp\Tar7B61.tmp
| MD5 | 435a9ac180383f9fa094131b173a2f7b |
| SHA1 | 76944ea657a9db94f9a4bef38f88c46ed4166983 |
| SHA256 | 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34 |
| SHA512 | 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\browseradapter.ini
| MD5 | a454b36183fd551e879d6ac7d0298cf9 |
| SHA1 | fe1ad6aafc7e2ec88aff1e65d2324e171a594a5e |
| SHA256 | baa691cc89366726a11203a4892af426873f1d30fcc13d94f502f6ec906c669b |
| SHA512 | 845b98293cf38303ddb011930f916d356c1185e2d6a63c33d810b797dcbec47f3d72d231f30ef617fb2ce7abce74c5d28ee50fb47b91cbeaeb0ca69e42b42c8a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d6064ac3dbe2ba1b2195538b9260ee06 |
| SHA1 | 84f585a4a1357cb6007959cb4339481be3fc3b0d |
| SHA256 | c45ef2c68961109e02175c8ae6096161a4949c524eb975256fbf95ca7f58d9c8 |
| SHA512 | d46f21dbd5d13a46a5db40d774ecd05ca9fa6d9dfc70ee65ae6719f9631c92eef9491a4bcc0a22703d7a17b6b5ceb92bf4af18a088b4c2b7be225bbd025802e9 |
C:\Users\Admin\AppData\Local\Temp\nsy2637.tmp\registry.dll
| MD5 | f81598566d3bebe154d86906e7419653 |
| SHA1 | fb2a980abe37a0b724edf932884931f946332b68 |
| SHA256 | b13d15f8d3e5498d3014dd0c5acc2b42df4aa08f96e0b3e59dc7c9e8c1e7f4c7 |
| SHA512 | 95f6d51d11df472808b9e6a765be6f13231901d698b62f0782e2c17a5ddeee43a8484894f11568ae474ffc7a3b27d8cd01785caf8d87eecdc4a3f64a3ece9255 |
C:\Users\Admin\AppData\Local\Temp\nsy2637.tmp\nsExec.dll
| MD5 | 2d1656be5aab3f3e6873cb5d0c046717 |
| SHA1 | 32facbec7603c0d3a2198c390399711f68a96de7 |
| SHA256 | 63133db6770f8ae0a5b38ddeafafbdc61cd6bc2ab0b6f3c307c0904f29d8a218 |
| SHA512 | d55426322c315a211c4de778eabd676fe2353ebff15f8725eb4e5dce03bb6b92f8a180e5093c2bdb324329bff72b4b1ed37d9d8155ce4c98926e0cbaa1c62ea1 |
C:\Users\Admin\AppData\Local\Temp\nsy2637.tmp\config.ini
| MD5 | 6407ab4354903e636dee95503d8cc59d |
| SHA1 | 88fb51b1fbc4aaac280153a75deba47df39b8ea5 |
| SHA256 | e7f4dbe32eea2f5c18808909cd86a07501d903a486d1f6658228d3f62aee48d3 |
| SHA512 | 768be9d4d3901c7a5346259f8912229e8a8fb24688fbffae71502097925505b035b9e5e06626733dd1774ea25b8322111246ce47d7467f375c7fe7f9ec586b50 |
C:\Users\Public\QiYi\QiyiHCDN\Config\PSNetwork.ini
| MD5 | 32df06dd100652fb622134c0eb2a8fde |
| SHA1 | 77f8def595a767d9cef527d42930b91fd3d5b9bd |
| SHA256 | 2d9b4e1f20d99c8ca80f44b00b62f329fb852708dd478ee37bff21912433d8db |
| SHA512 | 6384ac4910a8182db0b25cfa0dd5ce4bc5ae5c7f12796cb87bd9f8b3fb51da14bd792f493a478c693dac8ce37fb714c1056e170cb28007da432a8b452f667f60 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-29 16:27
Reported
2024-04-29 16:30
Platform
win10v2004-20240419-en
Max time kernel
150s
Max time network
149s
Command Line
Signatures
Modifies firewall policy service
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HCDNClient = "\"C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QyKernel.exe\" -shell_start" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\F: | C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe | N/A |
Installs/modifies Browser Helper Object
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C} | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
Checks for VirtualBox DLLs, possible anti-VM trick
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\VBoxMiniRdrDN | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
Checks installed software on the system
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\Guide\Tip01.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinDefault\skinplan\PlayerRes\pstyle\topmosting.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\vip_icon.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\ConfigRes\Combo_over.bmp | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\ConfigRes\ppsbooster_progressbar.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\LoginRes\btn_login_ad.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\dm.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\only\loading_17.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\titleRes\title_edit_delete.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinDefault\skinplan\right_menu_icon_09_on.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinVIP\skinplan\list\favoriteSelect.gif | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\PSkin\player\player_LogoRight.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\history\tv.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Middle\ADRes\AdInnerPrompt\AdInnerPrompt (24).png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Middle\ADRes\AdWnd_UpHot.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinDefault\skinplan\PlayerRes\Top\share.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\SplitterLeft.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\upload_advanced_btn.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\list\locallistorderup.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\billboard\right_normal.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\DelBtnHov.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ServersListItem.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\PSkin\player\Player_Progressbar.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\Guide\CallFloatPlayerGuide.xml | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\soft_windows_butten_1.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\QyAppExtension.dll | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\base.js | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\gameexitguide\checkno.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\common\MaskWindow.xml | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\health.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinDefault\skinplan\list\downloading.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinDefault\skinplan\list\downloadmenuicon.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinDefault\skinplan\PlayerRes\pstyle\close.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinDefault\skinplan\right_menu_icon_10_on.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\edit.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\BatchDownLoad\viplinkpanelicon.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Ctrl\Comment\alpha_thumb.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\PersonalCenter\Push\push_left_hover.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinVIP\skinplan\sys_menu.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinVIP\skinplan\right_menu_icon_15_on.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\puma.dll | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\BatchDownLoad\tagbk.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\history\third_party_mini.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Ctrl\GoodsCorner\goods_corner_bk (43).png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\homepageRes\HomePageMagicPosterCtrl.xml | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\SetsTab.xml | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\xml\t4.xml | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\QyWebGameClient.exe | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\Menubar\show_more.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\PersonalCenter\register\bds1.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\SearchRes\left_list_del.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\switcher1_bg.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Ctrl\GoodsCorner\goods_corner_bk (35).png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Middle\ADRes\AdInnerPrompt\AdInnerPrompt (80).png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\downloadRes\RouterUI\registerlogin.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\edu.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\hot.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Ctrl\Comment\emoticons_bk.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\Menubar\girl_back_groundicon.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\skinVIP\skinplan\PlayerRes\pstyle\topmost.png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\global.dll | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\PersonalCenter\menuwnd.xml | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\skin\xml\t15.xml | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File created | C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Ctrl\GoodsCorner\goods_corner_bk (28).png | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Fonts\iqiyi_logo.ttf | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Windows\Fonts\iqiyi_logo.ttf | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Windows\psnetwork.ini | C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyMaster.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\mkshortcut.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe | N/A |
Loads dropped DLL
Registers COM server for autorun
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}\InprocServer32 | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}\InprocServer32\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QYPlugin64.dll" | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\InprocServer32 | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\InprocServer32\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QYPlugin64.dll" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\InprocServer32\ThreadingModel = "Apartment" | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\LocalLow\\Unity\\WebPlayer\\loader\\UnityWebPluginAX.ocx" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
Enumerates physical storage devices
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\QyClient.exe = "1" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.pps.tv | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\QyClient.exe = "9000" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\pps | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\ppsrun\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\magnet2 | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6BE0FB-8B18-4dfc-959F-233651CC4D7F}\AppName = "QyKernel.exe" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AUTOCONFIG_BRANDING\iexplore.exe = "1" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\AppName = "QyClient.exe" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6BE0FB-8B18-4dfc-959F-233651CC4D7F}\Policy = "3" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\qisu\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\AppName = "QYFollowVideo.exe" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\QyPlayer.exe = "9000" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\ppstream\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\qygameclient\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_AUTOCONFIG_BRANDING | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\QyBrowser.exe = "9000" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ppsrun | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAC94FEE-45B4-4FD4-9EEA-D8978EC96C6E}\AppName = "QyClient.exe" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\qips\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\AppName = "QyClient.exe" | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\QyFragment.exe = "9000" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\Policy = "3" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\Policy = "3" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}\Policy = "3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\qips | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\qygameclient | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\QyPlayer.exe = "1" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAC94FEE-45B4-4FD4-9EEA-D8978EC96C6E} | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAC94FEE-45B4-4FD4-9EEA-D8978EC96C6E}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAC94FEE-45B4-4FD4-9EEA-D8978EC96C6E}\Policy = "3" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\pps\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\magnet2\WarnOnOpen = "0" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\AppName = "QYFollowVideo.exe" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\QyFragment.exe = "1" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\New Windows\Allow | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.ppstream.com | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6BE0FB-8B18-4dfc-959F-233651CC4D7F}\AppPath = "C:\\Program Files (x86)\\IQIYI Video\\LStyle" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}\Policy = "3" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC} | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC} | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\QyBrowser.exe = "1" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6BE0FB-8B18-4dfc-959F-233651CC4D7F} | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ppstream | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\qisu | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}\Programmable | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\ = "爱奇艺浏览器插件" | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\qygameclient | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\qygameclient\URL Protocol | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6360BD3-5CD0-40D3-BD87-DAFF37889F50}\1.0\0 | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\QYPlugin.QYPluginCtrl.1\CLSID | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\UnityWebPlayer.UnityWebPlayer.1\CLSID\ = "{444785F1-DE89-4295-863A-D46C3A781394}" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\TypeLib | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3636FE13-B7E3-4CDC-B7E3-A8014BD2CC02}\ProxyStubClsid32 | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\ = "爱奇艺PPS影音" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\UnityWebPlayer.UnityWebPlayer\CLSID | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\WOW6432Node\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5}\ = "_DUnityWebPlayerAXEvents" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{790F2D3B-18EE-40E2-A45E-1FAC13B6AFB8} | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\ppsrun\DefaultIcon\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QyClient.exe,-0" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\qisu\ = "qisu播放协议" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E1D75F62-CBBD-45C7-9D1D-6B5ECEC2E006}\1.0\ = "IEHelper 1.0 Type Library" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E1D75F62-CBBD-45C7-9D1D-6B5ECEC2E006}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\Accelerator" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Interface\{D10F4BFD-C3ED-44B7-BD0D-83F05E4D52D5} | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.qsv | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\Control | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\qygameclient\DefaultIcon\ = "C:\\Program Files (x86)\\IQIYI Video\\Common\\QyGameClient\\QyGameClient.exe,-0" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.FlashHelper.1 | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB3A16EC-96E2-421B-8462-C6F992596E65}\ProxyStubClsid32 | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\TypeLib | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\qygameclient\shell | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3636FE13-B7E3-4CDC-B7E3-A8014BD2CC02}\TypeLib\ = "{E1D75F62-CBBD-45C7-9D1D-6B5ECEC2E006}" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\.pgf\ = "爱奇艺PPS缓存文件" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\ppstream | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6360BD3-5CD0-40D3-BD87-DAFF37889F50}\1.0\ = "QYPlugin ActiveX ¿Ø¼þÄ£¿é" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE} | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\qygameclient\shell\open\command\ = "\"C:\\Program Files (x86)\\IQIYI Video\\Common\\QyGameClient\\QyGameClient.exe\" -qygameclient \"%1\"" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\VersionIndependentProgID\ = "UnityWebPlayer.UnityWebPlayer" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\QYPlugin.QYPluginCtrl.1\CLSID\ = "{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}" | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\Control\ | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\qips\shell\open\command\ = "\"C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QyClient.exe\" -ppstream \"%1\"" | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB3A16EC-96E2-421B-8462-C6F992596E65}\TypeLib | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}\InprocServer32\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QYPlugin.dll" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\PPS Inc. = "YES" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\{305ca226-d286-468e-b848-2b2e8e697b76} 2 = "0" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\InProcServer32\ThreadingModel = "Apartment" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}\Shell\Open\Command\ = "C:\\Program Files (x86)\\IQIYI Video\\LStyle\\QyClient.exe web_startup_tray" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\Version\ = "1.0" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\Implemented Categories | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.FlashHelper\CurVer | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\UnityWebPlayer.UnityWebPlayer\CurVer\ = "UnityWebPlayer.UnityWebPlayer.1" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.FlvFilter\CurVer\ = "IEHelper.FlvFilter.1" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}\ = "FlvFilter Class" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}\ = "QYPlugin Property Page" | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\MiscStatus\1 | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\.pfv | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\UnityWebPlayer.UnityWebPlayer.1\ = "UnityWebPlayer Control" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.FlashHelper\ = "°®ÆæÒÕÖúÊÖ" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.FlashHelper\CLSID\ = "{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\WOW6432Node\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}\VersionIndependentProgID | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\.qsv | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3636FE13-B7E3-4CDC-B7E3-A8014BD2CC02}\TypeLib\Version = "1.0" | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F2A21BBC-4512-4A05-9224-1F6DBDEA4153} | C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\AppID\UnityWebPluginAX.ocx | C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}\ProgID\ = "QYPlugin.QYPluginCtrl.1" | C:\Windows\system32\regsvr32.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB\Blob = 1900000001000000100000002ee0c890fdcb0441fa180c68348589950f000000010000001400000044cb4357ecb773b9ac3a3b0b1e45ab6bc45c2f1c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703085300000001000000230000003021301f06092b06010401829b510230123010060a2b0601040182373c0101030200c06200000001000000200000004b22d5a6aec99f3cdb79aa5ec06838479cd5ecba7164f7f22dc1d65f63d85708140000000100000014000000e166cf0ed1f1b34bb7062014fe8712d5f6fefb3e1d000000010000001000000051541f96c328dd7ac3ef2bdce753ac470b000000010000000e00000057006f005300690067006e0000007e000000010000000800000000c00c0f7f39d30168000000010000000800000000800c13c1b9d401030000000100000014000000b94294bf91ea8fb64be61097c7fb001359b676cb040000000100000010000000a1f2f9b5d2c87a74b8f305f1d7e1848d20000000010000007a050000308205763082035ea00302010202105e68d61171946350560068f33ec9c591300d06092a864886f70d01010505003055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e301e170d3039303830383031303030315a170d3339303830383031303030315a3055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e30820222300d06092a864886f70d01010105000382020f003082020a0282020100bdca8dacb8911556977b6b5c7ac2de6bd9a1b0c31023faa7a1b2cc31fa3ed9a6296f163de06bf8b8405fdb39a8007a8ba04d547dc22278fc8e09b8a885d7cc95974b74d89e7ef000e40e89ae4928441a1099320f258853a40db30f1208160b0371271c7fe1dbd2fd6768c4055d0a0e5d70d7d897a0bc53419a918df49e36667a7e56c1905fe6b1682036a48c242c2c470b59766630b5bedeed8ff89dd3bb0130e6f2f30ee02c9280f385f9288ab4542e9aedf776fc156816eb4a6ceb2e128fd4cffe0cc75c1d0b7e0532be5eb0092a42d5c94e90b3590dbb7a7ecdd5085ab47fd81c6911f9270f7b06af5483187be1dd547a51686e77fcc6bf524a6646a1b2671abba34f77a0be5dfffc560b43727790ca9ef9f239f50da9f4ead7e7b3102f30423721cc3070c986980fcc584d83bb7de51aa5378db6ac3297003a6371241e9e37c4ff74d437c0e2fe88466011dd083f5036abb87aa495626a6eb0ca6a215a69f3f3fb1d703995f3a76ea68189a188c53b71caa352ee83bbfda077f4e46fe742db6d4a998a3448bc17dce4800822b6f231c03f043eeb9f2079d6b80664640231d7a9cd52fb84456909002adc558bc406464bc04a1d095b3928fda9abce00f92e484b26e6304ca558cab444824fe7911e33c3b093ff11fc81d2ca1f7129dd764f9225af1d81b70f2f8cc306cc2f27a34ae40e99ba7c1e451f7faa194596fdfc3d0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414e166cf0ed1f1b34bb7062014fe8712d5f6fefb3e300d06092a864886f70d01010505000382020100a8cb7240b276c17e7bfcad64e3327bcc3cb65d46d3f52ce2705dc82ed8067d98d10b21a0895924019df9af097d0a238234d5fc7c7299b9a3d754f4ea52700ec5f5d63be13a0932e6213993bdb315ea4f6af4f58b3f2f7c8d582ec5e139a03ec73d4a739e407ac02b61a967c9f324b9b36d552c5a1d9e2572ce0badaac755620bbefb63b3614423a3cbe11a0ef79a064dded4234e21965b395b571d2f5d085e0979ff7c97b54d83ae0dd6e6a379e033d099960230a73effd2a3433f055a06ea4402da7cf848d033a9f907c795e1f53ef55d71baf295a974886159e3bfca5a13ba72b48c5d3687e9a6c53c13bfded04426eeb7ec2e70fad79db7ace5c5405ae6d76c7b2cc3569b47cd0bcefa1bb421d7b766b8f425308b5c0db9ea67b2f46daed5a19e4fd89fe92702b01d06d68fe3fb48129f7f11a1103e4c513a96b0d113f1c7d826ae3aca91c4699ddf012964516f68da14ec084197908dd0b280f2cfc23dbf9168c580671ec4601355d56199577cba950f61493aca75bcc90a933f670e12f228e2311bc05716df087c19c17e0f1f851e0a367c5b7e27bc7abfe0dbf4da52bdde0c547031914395c8bcf03edd097e306450ed7f01a433674d684fbe15efb0f60211a21b13253adcc259f1e35c46bb672c0246ea1e48a6e65bd9b5bc51a29296dbaac63722a6fecc2074a32da92e6bcbc0821121b59379ee4486bed71ee41efb | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB\Blob = 5c000000010000000400000000100000040000000100000010000000a1f2f9b5d2c87a74b8f305f1d7e1848d030000000100000014000000b94294bf91ea8fb64be61097c7fb001359b676cb68000000010000000800000000800c13c1b9d4017e000000010000000800000000c00c0f7f39d3010b000000010000000e00000057006f005300690067006e0000001d000000010000001000000051541f96c328dd7ac3ef2bdce753ac47140000000100000014000000e166cf0ed1f1b34bb7062014fe8712d5f6fefb3e6200000001000000200000004b22d5a6aec99f3cdb79aa5ec06838479cd5ecba7164f7f22dc1d65f63d857085300000001000000230000003021301f06092b06010401829b510230123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080f000000010000001400000044cb4357ecb773b9ac3a3b0b1e45ab6bc45c2f1c1900000001000000100000002ee0c890fdcb0441fa180c683485899520000000010000007a050000308205763082035ea00302010202105e68d61171946350560068f33ec9c591300d06092a864886f70d01010505003055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e301e170d3039303830383031303030315a170d3339303830383031303030315a3055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e30820222300d06092a864886f70d01010105000382020f003082020a0282020100bdca8dacb8911556977b6b5c7ac2de6bd9a1b0c31023faa7a1b2cc31fa3ed9a6296f163de06bf8b8405fdb39a8007a8ba04d547dc22278fc8e09b8a885d7cc95974b74d89e7ef000e40e89ae4928441a1099320f258853a40db30f1208160b0371271c7fe1dbd2fd6768c4055d0a0e5d70d7d897a0bc53419a918df49e36667a7e56c1905fe6b1682036a48c242c2c470b59766630b5bedeed8ff89dd3bb0130e6f2f30ee02c9280f385f9288ab4542e9aedf776fc156816eb4a6ceb2e128fd4cffe0cc75c1d0b7e0532be5eb0092a42d5c94e90b3590dbb7a7ecdd5085ab47fd81c6911f9270f7b06af5483187be1dd547a51686e77fcc6bf524a6646a1b2671abba34f77a0be5dfffc560b43727790ca9ef9f239f50da9f4ead7e7b3102f30423721cc3070c986980fcc584d83bb7de51aa5378db6ac3297003a6371241e9e37c4ff74d437c0e2fe88466011dd083f5036abb87aa495626a6eb0ca6a215a69f3f3fb1d703995f3a76ea68189a188c53b71caa352ee83bbfda077f4e46fe742db6d4a998a3448bc17dce4800822b6f231c03f043eeb9f2079d6b80664640231d7a9cd52fb84456909002adc558bc406464bc04a1d095b3928fda9abce00f92e484b26e6304ca558cab444824fe7911e33c3b093ff11fc81d2ca1f7129dd764f9225af1d81b70f2f8cc306cc2f27a34ae40e99ba7c1e451f7faa194596fdfc3d0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414e166cf0ed1f1b34bb7062014fe8712d5f6fefb3e300d06092a864886f70d01010505000382020100a8cb7240b276c17e7bfcad64e3327bcc3cb65d46d3f52ce2705dc82ed8067d98d10b21a0895924019df9af097d0a238234d5fc7c7299b9a3d754f4ea52700ec5f5d63be13a0932e6213993bdb315ea4f6af4f58b3f2f7c8d582ec5e139a03ec73d4a739e407ac02b61a967c9f324b9b36d552c5a1d9e2572ce0badaac755620bbefb63b3614423a3cbe11a0ef79a064dded4234e21965b395b571d2f5d085e0979ff7c97b54d83ae0dd6e6a379e033d099960230a73effd2a3433f055a06ea4402da7cf848d033a9f907c795e1f53ef55d71baf295a974886159e3bfca5a13ba72b48c5d3687e9a6c53c13bfded04426eeb7ec2e70fad79db7ace5c5405ae6d76c7b2cc3569b47cd0bcefa1bb421d7b766b8f425308b5c0db9ea67b2f46daed5a19e4fd89fe92702b01d06d68fe3fb48129f7f11a1103e4c513a96b0d113f1c7d826ae3aca91c4699ddf012964516f68da14ec084197908dd0b280f2cfc23dbf9168c580671ec4601355d56199577cba950f61493aca75bcc90a933f670e12f228e2311bc05716df087c19c17e0f1f851e0a367c5b7e27bc7abfe0dbf4da52bdde0c547031914395c8bcf03edd097e306450ed7f01a433674d684fbe15efb0f60211a21b13253adcc259f1e35c46bb672c0246ea1e48a6e65bd9b5bc51a29296dbaac63722a6fecc2074a32da92e6bcbc0821121b59379ee4486bed71ee41efb | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB\Blob = 0f000000010000001400000044cb4357ecb773b9ac3a3b0b1e45ab6bc45c2f1c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703085300000001000000230000003021301f06092b06010401829b510230123010060a2b0601040182373c0101030200c06200000001000000200000004b22d5a6aec99f3cdb79aa5ec06838479cd5ecba7164f7f22dc1d65f63d85708140000000100000014000000e166cf0ed1f1b34bb7062014fe8712d5f6fefb3e1d000000010000001000000051541f96c328dd7ac3ef2bdce753ac470b000000010000000e00000057006f005300690067006e0000007e000000010000000800000000c00c0f7f39d30168000000010000000800000000800c13c1b9d401030000000100000014000000b94294bf91ea8fb64be61097c7fb001359b676cb20000000010000007a050000308205763082035ea00302010202105e68d61171946350560068f33ec9c591300d06092a864886f70d01010505003055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e301e170d3039303830383031303030315a170d3339303830383031303030315a3055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e30820222300d06092a864886f70d01010105000382020f003082020a0282020100bdca8dacb8911556977b6b5c7ac2de6bd9a1b0c31023faa7a1b2cc31fa3ed9a6296f163de06bf8b8405fdb39a8007a8ba04d547dc22278fc8e09b8a885d7cc95974b74d89e7ef000e40e89ae4928441a1099320f258853a40db30f1208160b0371271c7fe1dbd2fd6768c4055d0a0e5d70d7d897a0bc53419a918df49e36667a7e56c1905fe6b1682036a48c242c2c470b59766630b5bedeed8ff89dd3bb0130e6f2f30ee02c9280f385f9288ab4542e9aedf776fc156816eb4a6ceb2e128fd4cffe0cc75c1d0b7e0532be5eb0092a42d5c94e90b3590dbb7a7ecdd5085ab47fd81c6911f9270f7b06af5483187be1dd547a51686e77fcc6bf524a6646a1b2671abba34f77a0be5dfffc560b43727790ca9ef9f239f50da9f4ead7e7b3102f30423721cc3070c986980fcc584d83bb7de51aa5378db6ac3297003a6371241e9e37c4ff74d437c0e2fe88466011dd083f5036abb87aa495626a6eb0ca6a215a69f3f3fb1d703995f3a76ea68189a188c53b71caa352ee83bbfda077f4e46fe742db6d4a998a3448bc17dce4800822b6f231c03f043eeb9f2079d6b80664640231d7a9cd52fb84456909002adc558bc406464bc04a1d095b3928fda9abce00f92e484b26e6304ca558cab444824fe7911e33c3b093ff11fc81d2ca1f7129dd764f9225af1d81b70f2f8cc306cc2f27a34ae40e99ba7c1e451f7faa194596fdfc3d0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414e166cf0ed1f1b34bb7062014fe8712d5f6fefb3e300d06092a864886f70d01010505000382020100a8cb7240b276c17e7bfcad64e3327bcc3cb65d46d3f52ce2705dc82ed8067d98d10b21a0895924019df9af097d0a238234d5fc7c7299b9a3d754f4ea52700ec5f5d63be13a0932e6213993bdb315ea4f6af4f58b3f2f7c8d582ec5e139a03ec73d4a739e407ac02b61a967c9f324b9b36d552c5a1d9e2572ce0badaac755620bbefb63b3614423a3cbe11a0ef79a064dded4234e21965b395b571d2f5d085e0979ff7c97b54d83ae0dd6e6a379e033d099960230a73effd2a3433f055a06ea4402da7cf848d033a9f907c795e1f53ef55d71baf295a974886159e3bfca5a13ba72b48c5d3687e9a6c53c13bfded04426eeb7ec2e70fad79db7ace5c5405ae6d76c7b2cc3569b47cd0bcefa1bb421d7b766b8f425308b5c0db9ea67b2f46daed5a19e4fd89fe92702b01d06d68fe3fb48129f7f11a1103e4c513a96b0d113f1c7d826ae3aca91c4699ddf012964516f68da14ec084197908dd0b280f2cfc23dbf9168c580671ec4601355d56199577cba950f61493aca75bcc90a933f670e12f228e2311bc05716df087c19c17e0f1f851e0a367c5b7e27bc7abfe0dbf4da52bdde0c547031914395c8bcf03edd097e306450ed7f01a433674d684fbe15efb0f60211a21b13253adcc259f1e35c46bb672c0246ea1e48a6e65bd9b5bc51a29296dbaac63722a6fecc2074a32da92e6bcbc0821121b59379ee4486bed71ee41efb | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB\Blob = 040000000100000010000000a1f2f9b5d2c87a74b8f305f1d7e1848d030000000100000014000000b94294bf91ea8fb64be61097c7fb001359b676cb68000000010000000800000000800c13c1b9d4017e000000010000000800000000c00c0f7f39d3010b000000010000000e00000057006f005300690067006e0000001d000000010000001000000051541f96c328dd7ac3ef2bdce753ac47140000000100000014000000e166cf0ed1f1b34bb7062014fe8712d5f6fefb3e6200000001000000200000004b22d5a6aec99f3cdb79aa5ec06838479cd5ecba7164f7f22dc1d65f63d857085300000001000000230000003021301f06092b06010401829b510230123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080f000000010000001400000044cb4357ecb773b9ac3a3b0b1e45ab6bc45c2f1c20000000010000007a050000308205763082035ea00302010202105e68d61171946350560068f33ec9c591300d06092a864886f70d01010505003055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e301e170d3039303830383031303030315a170d3339303830383031303030315a3055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e30820222300d06092a864886f70d01010105000382020f003082020a0282020100bdca8dacb8911556977b6b5c7ac2de6bd9a1b0c31023faa7a1b2cc31fa3ed9a6296f163de06bf8b8405fdb39a8007a8ba04d547dc22278fc8e09b8a885d7cc95974b74d89e7ef000e40e89ae4928441a1099320f258853a40db30f1208160b0371271c7fe1dbd2fd6768c4055d0a0e5d70d7d897a0bc53419a918df49e36667a7e56c1905fe6b1682036a48c242c2c470b59766630b5bedeed8ff89dd3bb0130e6f2f30ee02c9280f385f9288ab4542e9aedf776fc156816eb4a6ceb2e128fd4cffe0cc75c1d0b7e0532be5eb0092a42d5c94e90b3590dbb7a7ecdd5085ab47fd81c6911f9270f7b06af5483187be1dd547a51686e77fcc6bf524a6646a1b2671abba34f77a0be5dfffc560b43727790ca9ef9f239f50da9f4ead7e7b3102f30423721cc3070c986980fcc584d83bb7de51aa5378db6ac3297003a6371241e9e37c4ff74d437c0e2fe88466011dd083f5036abb87aa495626a6eb0ca6a215a69f3f3fb1d703995f3a76ea68189a188c53b71caa352ee83bbfda077f4e46fe742db6d4a998a3448bc17dce4800822b6f231c03f043eeb9f2079d6b80664640231d7a9cd52fb84456909002adc558bc406464bc04a1d095b3928fda9abce00f92e484b26e6304ca558cab444824fe7911e33c3b093ff11fc81d2ca1f7129dd764f9225af1d81b70f2f8cc306cc2f27a34ae40e99ba7c1e451f7faa194596fdfc3d0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414e166cf0ed1f1b34bb7062014fe8712d5f6fefb3e300d06092a864886f70d01010505000382020100a8cb7240b276c17e7bfcad64e3327bcc3cb65d46d3f52ce2705dc82ed8067d98d10b21a0895924019df9af097d0a238234d5fc7c7299b9a3d754f4ea52700ec5f5d63be13a0932e6213993bdb315ea4f6af4f58b3f2f7c8d582ec5e139a03ec73d4a739e407ac02b61a967c9f324b9b36d552c5a1d9e2572ce0badaac755620bbefb63b3614423a3cbe11a0ef79a064dded4234e21965b395b571d2f5d085e0979ff7c97b54d83ae0dd6e6a379e033d099960230a73effd2a3433f055a06ea4402da7cf848d033a9f907c795e1f53ef55d71baf295a974886159e3bfca5a13ba72b48c5d3687e9a6c53c13bfded04426eeb7ec2e70fad79db7ace5c5405ae6d76c7b2cc3569b47cd0bcefa1bb421d7b766b8f425308b5c0db9ea67b2f46daed5a19e4fd89fe92702b01d06d68fe3fb48129f7f11a1103e4c513a96b0d113f1c7d826ae3aca91c4699ddf012964516f68da14ec084197908dd0b280f2cfc23dbf9168c580671ec4601355d56199577cba950f61493aca75bcc90a933f670e12f228e2311bc05716df087c19c17e0f1f851e0a367c5b7e27bc7abfe0dbf4da52bdde0c547031914395c8bcf03edd097e306450ed7f01a433674d684fbe15efb0f60211a21b13253adcc259f1e35c46bb672c0246ea1e48a6e65bd9b5bc51a29296dbaac63722a6fecc2074a32da92e6bcbc0821121b59379ee4486bed71ee41efb | C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\081a6223a80b3d8f15f06b9783aa9850_JaffaCakes118.exe"
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe
"C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe" /S
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe" QiyiUpdate "C:\Program Files (x86)\IQIYI Video" true
C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\Qy_plugin.exe" -install
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IQIYI Video\LStyle\QYPlugin.dll"
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IQIYI Video\LStyle\QYPlugin64.dll"
C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\IQIYI Video\LStyle\QYPlugin64.dll"
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyMaster.exe
"C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyMaster.exe" "C:\Users\Public\QiYi\QiyiHCDN\Config"
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe" QiyiUpdate "C:\Users\Admin\AppData\Roaming\IQIYI Video" true
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe" -i
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe"
C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe" -finstall
C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe"
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe" videolibrary=uninstall_setup
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺视频客户端" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyClient.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyClient.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺HCDN网络数据传输组件" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺视频播放器" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyMiniPlayer.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyMiniPlayer.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺PPS影音 播放器组件" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyPlayer.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyPlayer.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺升级模块" dir=in program="C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyUpdate.exe" action=allow description="C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyUpdate.exe"
C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="爱奇艺视频辅助程序" dir=in program="C:\Program Files (x86)\IQIYI Video\LStyle\QyFragment.exe" action=allow description="C:\Program Files (x86)\IQIYI Video\LStyle\QyFragment.exe"
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\mkshortcut.exe
"C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\mkshortcut.exe" -output "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\爱奇艺PPS.lnk" -target "C:\Program Files (x86)\IQIYI Video\LStyle\QyClient.exe" -parameters "quicklaunchrun" -workingdir "C:\Program Files (x86)\IQIYI Video\LStyle" -appid "IQIYI, Inc.PCClient" -icon "C:\Program Files (x86)\IQIYI Video\LStyle\skin\Logo\LogoBevel.ico" -description "使用爱奇艺PPS收看影视节目,清晰流畅更新快"
C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe
"C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 8.8.8.8:53 | dl.static.iqiyi.com | udp |
| US | 8.8.8.8:53 | spider.pps.tv | udp |
| US | 8.8.8.8:53 | msg.iqiyi.com | udp |
| N/A | 10.127.255.255:5353 | udp | |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | policy.video.iqiyi.com | udp |
| CN | 58.215.125.56:17788 | udp | |
| CN | 183.61.167.82:17788 | udp | |
| CN | 58.56.65.60:17788 | udp | |
| CN | 119.188.133.192:17788 | udp | |
| CN | 1.28.145.91:17788 | udp | |
| CN | 223.99.251.67:17788 | udp | |
| CN | 163.177.41.153:17788 | udp | |
| US | 8.8.8.8:53 | 56.125.215.58.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 82.167.61.183.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 60.65.56.58.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 192.133.188.119.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 91.145.28.1.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.251.99.223.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 153.41.177.163.in-addr.arpa | udp |
| N/A | 10.127.255.255:60000 | udp | |
| N/A | 10.127.255.255:60001 | udp | |
| N/A | 10.127.255.255:60002 | udp | |
| N/A | 10.127.255.255:60003 | udp | |
| N/A | 10.127.255.255:60004 | udp | |
| N/A | 10.127.255.255:60005 | udp | |
| N/A | 10.127.255.255:60006 | udp | |
| N/A | 10.127.255.255:60007 | udp | |
| N/A | 10.127.255.255:60008 | udp | |
| N/A | 10.127.255.255:60009 | udp | |
| US | 8.8.8.8:53 | list3.ppstream.com.iqiyi.com | udp |
| US | 8.8.8.8:53 | pdata.video.iqiyi.com | udp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | list3.ppstream.com.iqiyi.com | udp |
| US | 8.8.8.8:53 | pdata.video.iqiyi.com | udp |
| US | 8.8.8.8:53 | list3.ppstream.com.iqiyi.com | udp |
| US | 8.8.8.8:53 | pdata.video.iqiyi.com | udp |
| US | 8.8.8.8:53 | list3.ppstream.com.iqiyi.com | udp |
| US | 8.8.8.8:53 | pdata.video.iqiyi.com | udp |
| US | 8.8.8.8:53 | list3.ppstream.com.iqiyi.com | udp |
| US | 8.8.8.8:53 | pdata.video.iqiyi.com | udp |
| US | 8.8.8.8:53 | list3.ppstream.com.iqiyi.com | udp |
| US | 8.8.8.8:53 | list3.ppstream.com.iqiyi.com | udp |
Files
C:\Users\Admin\AppData\Local\Temp\nso44E9.tmp\StdUtils.dll
| MD5 | 572b16bf94a6492976f777b7d0373971 |
| SHA1 | 3ae46f117f0d3ea32b28de9a73fca0d912260203 |
| SHA256 | fb87ec46457a836060bd3ee33bb37ec4d222d4974816654b32ba9d40efd90c75 |
| SHA512 | 872347db453458f3bfe6d6bb9dbb66305abcf5773acaaea4d06e8800b3329f536d70e6c96e6dd59a20e963bfce496a0fe014302d2469353bfbcba0fbd2ba6fd6 |
C:\Users\Admin\AppData\Local\Temp\nso44E9.tmp\nsProcess.dll
| MD5 | dacc5f5531887a11804bda084e12cee1 |
| SHA1 | 85e9f509668d9d78120435e5df593d988b16029a |
| SHA256 | 18584f582d454c15de69b515dcd8952a446bf18514de532c309b351b30d77066 |
| SHA512 | f16dcc34d444490621df50ea70772a692592bb35f078f7e7a7360976da873e8e917663344864b56f5989a65ecdaa70d8eb0df4f8a2495f50aa5d25f6f248ae4a |
C:\Users\Admin\AppData\Local\Temp\nso44E9.tmp\NSISdl.dll
| MD5 | 8ff1b274c581f2e928a418f3b90620eb |
| SHA1 | ad7ad3acd29b882204e74fe36369a6b89a8beed4 |
| SHA256 | df10d5b4ca10ea6ddce96d6ddecfc175f1dff4292a8c5c1f8e0adfb6e1e824c3 |
| SHA512 | a932f9b77fb801e624069661f9c0a7fab4a1e540d763d51bca91e2570767029261946c4ef522e1e9fecc189cd8090e99ba9b454439a3e3fec2ca318dcb428691 |
C:\Users\Admin\AppData\Local\Temp\nso44E9.tmp\DialogEx.dll
| MD5 | e0f33283138ef1c169f71cb1708985a3 |
| SHA1 | f10f88a272fc7c14f3a37d0f650aa7480bc1efd0 |
| SHA256 | a9b34148448d893558dbb91b51bbbdddd535e2c8387a13e930a4b5096b0af03c |
| SHA512 | 8094b5096cb0c4ee6572217beab6419b8d9ecdb2b902c9c596ef3cc513e4916b05c2bb54fd6084f274b6919d4871ae31cce4eddadd272cb7516c30dfc7c7db0a |
memory/776-36-0x0000000004F60000-0x0000000004F69000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\nso44E9.tmp\nsis7z.dll
| MD5 | cb22c301a35e0d8551578940c018868d |
| SHA1 | 1aa3a19c0c5e8cd02feedca50fb1845a99964ee6 |
| SHA256 | d77183207b8a3b6bf4d7267aee06c7d0f76a6b42e0c007e596931ec59dfa597d |
| SHA512 | f1997bc05c360c1adad90317e7aeb97af9982b2e40e4aadd88522d640fda44648c733e19c572b01647cfb6b2093f2387b41db37f52cd87b8d02c479be0395f5c |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\Signin.png
| MD5 | 053bf204ab9961e6843a052348ca8d5a |
| SHA1 | cfd71af85b0cae52a4c54429e925add459287de6 |
| SHA256 | 1b02340f651f6af1019402f595737b2e71f1e341892e419ae64617aa571db6af |
| SHA512 | 3476e12f9ba18a7663b6519ecec7fba8379a974d5962b37fa0d0ae024f9cb554d9ec44a13c2fc739e472b851531259aa3460f89c7683fde9e8de0b5e8a1051b8 |
C:\Program Files (x86)\IQIYI Video\LStyle\appdata\webcache\2\movieLib_pstyle.css
| MD5 | 04934b72e752e77dd0bf67c9d06a2272 |
| SHA1 | 9e5d3a5a81089989981cd9a44784e42ac40c638d |
| SHA256 | a18e3ac76891027def955b9f310ac15a51c8b514e7b63aa27cbb96f8d38cf926 |
| SHA512 | 7df18a0a080715a781df5baa0a7fccef6eaa4818bed11d985c42ee81acb9ce2665a5aacf30b7517d4d30c1aac6557f6d6a8b6623c15a7ce8f10c5d7691ee380f |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\made\loading_17.png
| MD5 | 0893bfeefb776d58da6ef7bd6b8d64c8 |
| SHA1 | c9905b5a2edb4f4caf87c76425e7db4e63b699d6 |
| SHA256 | e0787ff81f12df511d1b97382c78d58bf28269fac897eae4e0faddffe7be6aeb |
| SHA512 | fe8735b4b0042d1124ccf1dc55edd298fdfadb101bdab735b0bff89068909e61d81cef5b4ba967bc11a683b064cfe7638ea91cc4026a9073e197fc489ec78435 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\normal\loading_17.png
| MD5 | 28853faad82cbc1110fddc0c3a54d85d |
| SHA1 | d11e7cb83ceba8bd8223b59150bbd747222715f4 |
| SHA256 | 59fe4bb150bb9bbb28bedff5d2aaa87307041420100c2be31c9084f9a92fc342 |
| SHA512 | 4cd0a50c61f650df55ede29da8e72f5b909cbd6bae3d375176b0952ca8d46ce0ef06e104ab540e500f23e9ae9af9e2fcfb3b6c52ab7ed8cd6e7a11696150eb1e |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\only\config.ini
| MD5 | 534a43f71c3ae9f4860a02b65d1de41d |
| SHA1 | c6929fb5bba5aa8b56a3c891e9fdc1f571ab42c7 |
| SHA256 | b7b478999cc6ff9694335c0877d9a0182415a0478eb04d660849c8c98556672f |
| SHA512 | 5a048eb691bf368d955c010d30dd122dd27980de7da38a7e0ee1e13b9d98b71e3a5edc5cc1af908d73014bd6a4a2f25aaec5750156598c871d516d6dbcd838c8 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PlayerRes\Other\loading\only\loading_16.png
| MD5 | 11007ca324dd134924fa2bca5244eb73 |
| SHA1 | 56fa6e06d7db2e9693d7eb26eb13d52ab9ce8fc3 |
| SHA256 | 05395237709655d0cb9de583e7c2a3192df91388333d70923798eaf61b1562bb |
| SHA512 | bfa1d34ac7312cc273fbb59748a6e6f0cea6c6db7a498c04dfc8ebc2491806cd9d55fe766f727e3c0a130699a7f20d1a8d2e01ea005ad15cf706b0916a115e63 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\PLRes\btnPopUpClose.png
| MD5 | 7844d223803d5f35c4eb453908d3d3d2 |
| SHA1 | f6946969ca172c5735f19cc5215ee170bd963bb6 |
| SHA256 | 38e371539a017a690e546a161ce82dbb757ccfd46e7bfa46c79f8377a9d6a223 |
| SHA512 | 4db164312a9813a0288abef93a4ae7d12945a3f290010603e9343b4bafea8883a1bc626ebea2e548eb6fb915ab47786b2a0adf02b1b720f4968f8b15005fd49f |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\downloadRes\downLoad\config_dlg_close.png
| MD5 | 754a7d6d7740eead34bb5a9f6940f009 |
| SHA1 | 18acc6593a114f5616a539101f31504cb511459e |
| SHA256 | 154ca004725f7936e20efa1780f3cdef20869de4ac00d1b0079c86e31b0e59f3 |
| SHA512 | 785ac79cec2f7f3fd813761a53b506ac5b2fede0ba67ea8a5bf495da5dc028c69e88217d1c45ad4e4ad4c34b3d3a1d6df88363c4e8fc1c095af3078357e2abda |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\AL_Close1.png
| MD5 | 1867ed15b4256e9edc952c334a543201 |
| SHA1 | 386b14cf44c620a55f64c6069409eb0eb5c5e3a3 |
| SHA256 | 87b01d7e066af46794e584904a4bedb27707da1eb32080b60a286f01b9c27820 |
| SHA512 | 027e984adcc90553c9c699c6f1a797eea5e7b02f8cb4a807aa62263780485de235c6294b608b8a34c67e9b5024d98768cab6265cc7776884b9ab4e6585e0c0a3 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\AL_Close2.png
| MD5 | 33cced8d3d97f78972a5418ec7e96f29 |
| SHA1 | 09bb1332bbb1f06eda3bb09f37b3699257162369 |
| SHA256 | 42803e7485f1507abcfca5f455e76956a0dd92ddf2b9d6341a4f2375a941746f |
| SHA512 | 04683521c7dc5e7f4ff701da3fe4291eccbe6b96ba5631676844fe4616a0fcb5e7434a47f245f9b800a47922b25c3d5a2d1063eee61b82db656866c194aca1ce |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\common\common_scroll.png
| MD5 | 93343a6c34066ba4b50a6d455210f538 |
| SHA1 | 10bdaace70cee2656f3c6eedd2c5aa5182dd6de1 |
| SHA256 | d2d9f913aa2646725e0af0d332a10a78b1d7269bf0d774aeb3e6dfc4be40558e |
| SHA512 | 06066d93e57cf309c064779a415a34290d52d9312da45acad20b0655f098568cb438d694f46aafe5d0edeb5178a50c6a729e174c683666d97112a1e09741b1aa |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\listUI\filmlib2_normal.png
| MD5 | 7602910002b9307718bb5a4c221d6be5 |
| SHA1 | 61004f0ad2d3f55c7549b3c8eecf2108d0efb655 |
| SHA256 | 9298a0cc560f702a118dec0bf34bf2d609d5a56d1c49e9658b0eeac0bba59a38 |
| SHA512 | eac38bff7fbf476bcd003253b737723c46c31cdcc205bde5f6c4bad9f5da75d7f08f061976c1bb724888f2a4ec38a9c0667e56c3a993a4a69cf236c43adcd259 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\PersonalCenter\set\cancel.png
| MD5 | d1a6675f77f74cc5847b0a59c49c3f6b |
| SHA1 | f96c4084818cc5836e4086b665e97c3bd7d99f47 |
| SHA256 | 29207dd0cbb59bd1e6fe489ab6ada4cb04c74083099127b194402f1f3ea4bf8d |
| SHA512 | 3f4a2f4fc645fbbcfb5fda5fd37fe8dffb96329c4e66841ca5bdb8c8ae4836e4eaede44a6e4e5ca17cf6bf02524d304bf83922092fc9b88fa72e94a322617388 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\PersonalCenter\set\ok.png
| MD5 | 4d34af20771db466a6439fa56ff5f687 |
| SHA1 | 5223e4281ff91d0bdedc9af14c4825e56cad01e4 |
| SHA256 | b4513c801e7893e2364967da122e5340a69a0c8f28d0318234ee0ca41ac12f60 |
| SHA512 | bb770d0649982b3f4d35a5b6628cd0a4168f31ea89e56eaf92f74412cc2ddcf8773dd60f25ff5c0d04d77960570d652f8b7cf7cdd2cbaf07151024c8355871b3 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\mainpluginRes\QYProduct\blackback.png
| MD5 | 60ce4c0275c77aa5572892c81728620d |
| SHA1 | 82fc18f800c867547140a7764f38a65eec9a4b96 |
| SHA256 | 8ea1ba9ad6052fe784d79b9bd3ff879152c1d58738cc1faab0a1304b68ce69db |
| SHA512 | ee1d28e4c4b939a721f42f67505de0fe2084f36244b53838a4704a19f32246919a88ab7936b6cfa07e54f4b5c1a11d36305376a3ef42bb73bfa5fd679f83af91 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\MobileAssistant\Fragment\MobileAssistant\scrollbar.png
| MD5 | 8f6b9b86898ce75b5c94034ab1f14381 |
| SHA1 | 4005fdcd5071fe373db13e301301ed0e2dc74876 |
| SHA256 | 874664eaa38618437f551ed0492a89b718e44f2a6f64e2b5590b708c6ddb3b97 |
| SHA512 | f42d284538b5ca4f8382321dd96dc104b8d7f49a1339dc1e7fdcac4fb22099078d29ccf29a7b9d23c94260295f39126197d082b4983acf7be9a1569ad4e237e3 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\PersonalCenter\common\close_big2.png
| MD5 | 51fd1384bab6df779007cee07422e4ac |
| SHA1 | 16e89c96196d21f3a85ed6a0f5d97d096c2fbc15 |
| SHA256 | 9c0ec21d601c6e193caa0a04db9c80318d15e1fec713d3e82e53f709a5620fd9 |
| SHA512 | 279c7e23a32b639d13d836b1c9744bbbeec4167a95bd3302bae6ff2738877fb2e99e8a2c95934b38c74d74dda4783ab14f81ac96c551084e9cdbe4f9ee24519c |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\pstyle\PersonalCenter\common\close_big1.png
| MD5 | 5fa2adb150f63cba9e5443befe17eaf4 |
| SHA1 | b5c2a1cee13211626c061c422961a1d0aa742703 |
| SHA256 | 02b0a8d8524e604ed201f912fba8ee58c5573f8310145d3e64a3c279726dac40 |
| SHA512 | 9cbde58a143beabec9cd89ab66bf0f29db6903ece436fdb0c14dfd66803ccc4f951b316216c073be9e8032d20f8e0f93a4c393672884063e3cf8f29f7b404607 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\soft_txt_icon_2.png
| MD5 | 1402aa18efd86eec43a345d936f8ab4d |
| SHA1 | c51a44b65489e041620c8ce9ebb5d04c517d27e5 |
| SHA256 | 2276b09083e0da61a550d97c12cd814622c853358f26dcaffd423285ed29640f |
| SHA512 | 7b4913b6a30410d87a3c1c87d4b6d15510c47f17b38c3c2db11da2fb344b88e5c3d86dba86781eff180eb803222af6a58b6a0a12905139b085d988061c5bfd12 |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\spaceship.png
| MD5 | 575984f7a1cfe13a9ed1d3800bd7d14a |
| SHA1 | df04fdf4070d29d76aaff8f5b2f68bff6ee0cdc3 |
| SHA256 | 925b723d434d5528c4dd712102279974e76842b71544fa8153d6108d11ccd7de |
| SHA512 | 1d2eca187cfead14798cdc18b4ffed909b483869281bd05fc4b7412fb76a7ee6987efbffa17db218be32d4c2e1ee6e1cb383a4a96983f226baae1f42a330725b |
C:\Program Files (x86)\IQIYI Video\LStyle\skin\logo.ttf
| MD5 | e1097f713080d07e0c717e0737ef167e |
| SHA1 | f31f1c4570925450c1fd1ac847cf54461b6274d4 |
| SHA256 | f2aa97fb51572edf0694ae328bbdcb01a172189aa53549b7ea8caebc66325249 |
| SHA512 | 786dda62d0423a9733af16035390e99bd47c5cd8c49f2802eb443896230b2dba70eefbb95de3175b2143dbca1f9ab8ccb8cd8e7cd8b8821f0a93d1a5c69923ad |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\UnityWebPlayer.exe
| MD5 | 95bff19e30f8b194eebc8c81b671d6d7 |
| SHA1 | be2883ccd72263e162350cdfb7bf9d4bc5090f17 |
| SHA256 | 4fa1020f67d7beee37c67bb6bd86ed8925e348adbf5748f9555dc96797c651d3 |
| SHA512 | 762bf013e4d46ca61dceabde986753cf501442e1c72dcf394b628e2f6273ff05f686908bf9ec3be17d28b34602ea0bc18795e296da43dda7de47e81962a559db |
C:\Program Files (x86)\IQIYI Video\LStyle\GdiPlus.dll
| MD5 | 385e243fc4314f79c1e3042070586d03 |
| SHA1 | bff588a2ac255b4cd1e3a9528529aa0e26f4657b |
| SHA256 | 18055410347fe57288aa11917e77f9b5833f59e669e8c65fc589d314eb6b695c |
| SHA512 | 5854cd81f2f9d5d01a7c0e3ab1b6801490f455191089a21dbc199cf924f59aadbff85d9b963700961c326a4def2a13ff9ba6d3933ead17262b7b66d0279f2c55 |
C:\Program Files (x86)\IQIYI Video\LStyle\QiyiDACL.exe
| MD5 | b6e9d6c600b793177c69ffc751c7a8f2 |
| SHA1 | 2d83d7e4a84a5378333250a470ad6577ea858780 |
| SHA256 | 19aa1945952438cc82e633ff6c90c4f21835fb79d49de8649dd1e18ae4c9a80b |
| SHA512 | 069ed99225d5d69817e16f8dfc2c95fe7c667e9e7f7b03897b58ffabe14ced8b4498b5ed117155ef79761f5189f88b54729864623cff1c80d9536f7c08ef4a0b |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\AoreAudioVolume.dll
| MD5 | a53ff1a83e51f4915a6a61ee92f408d3 |
| SHA1 | 15f9bbc83652f057f933ad2dfa02c9713884d328 |
| SHA256 | c81aedcb12656accfdbda1d1572311c9a0f9954c0036c0074235f42b6c0567de |
| SHA512 | be5d2b9c05d28c49ad3b8be847f322bbf23b06e9966418f57698e463c9bd112e9ad27081029fee422212013924beedf010074bcce5683308039ccbeee072f436 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\ClientGadgetSDK.exe
| MD5 | 9b4a17d36d4730907fbd6d8969ad4533 |
| SHA1 | 547f1198f277c267627083ab3a6f083931a88f85 |
| SHA256 | 7a201389575d3c6f60a638dcd6f8c1c41687b51bc7be541ebc271330e1875be6 |
| SHA512 | 870012f8ee3b07e5b45abdce7c0bbaaca5d963412332669ba1ceb4c6b9c6077740b6336dcd8ea802c10254e73173de00a3e2f1c6e3e6202b397477cc38e96ce2 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnMinNormal.png
| MD5 | 0f8c32a24cdd495cf044885babc2a284 |
| SHA1 | b554b4ed413de5050d7ba05f5f9135fd9a8bad66 |
| SHA256 | ce9610d0d6f603ed290e3eac9813fe6428f85575399f1d2f3b79ec2b80bc5700 |
| SHA512 | 88f4ca39e9acf4d4e17d003e1bb043a2cb4784d3c06fccb061f4e78033ab814ce301d23ae2a71ff454e8ab8f82557bb5385cb6ac927950aab955ce9ca459b0c3 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnMinHover.png
| MD5 | 3d5ce2154e2739d8372cd19ef6894d54 |
| SHA1 | a50b1d7dce90ace6de2f64420cc501d4ae044ff0 |
| SHA256 | bcc19a19510a08c675266e240a2262c92f1bb214f333cdd3c12e50a84f97f881 |
| SHA512 | 382f29d7c19f22c34a9fea304028535835fe2693fc6c86834d3b2ca915a3e14b88cc84cbb368543312f6080f53479039557418efe65e2909ff5b07e06c593684 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\bt_normal.png
| MD5 | e189e1d1d43cba9e78c008fa248e02fe |
| SHA1 | b374269f970d337375552f2b771126f11da42f15 |
| SHA256 | 911eb65979874e946ac0b2da2440084f98c3088758e2f1bd9144d495061d6aaa |
| SHA512 | fd1b83cd8130000670756169910920145c9a1cc1ca35b4efca61311248db07488d32430d5d3d1c45b231b3d5803e011470326f4e3ec694ff5663a16b66e1df67 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\bt_hover.png
| MD5 | 15ae314b60106f6eda43676eb1d3de6b |
| SHA1 | 2897302883ec07add176c4e03f8dc9a4ae6afdde |
| SHA256 | 8927bf74e9d960dad95ba796e6f2bc731c5b4e1192cbd7b120cbd2f1898ec3c1 |
| SHA512 | 479afa994781f6a495d7439ae3d0afc131ad5ad7bb5ff1471f1ffebf61633a74624e41b06b481f17c8a9f723635de871273147659ddf070664c385215bc23a80 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_Normal.png
| MD5 | e720f8d7d9b1eebf115a3ac3b2e8fa0e |
| SHA1 | 39e7f401d756d0f67413f9ff9ac925780b6e5434 |
| SHA256 | 395035ebf113e3f7d46d5fff75fad4154a674747d86049eb88d0962865cc8328 |
| SHA512 | 436d15bbdfd0cb4a1bbea0db7be5249ebb5e59268c6768a58424c66d155f4485057de177d9b36959c022b6a3c305af072414a75e829d44eee5cc0a8b6b9f4dcf |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_MOV.png
| MD5 | 0373829c3ff82ae9637c770174be1f01 |
| SHA1 | b608bca312673a83e435c475c3b6e56cf0ed0f61 |
| SHA256 | c5db13edaa19ab6024f12952264a3ec005c4ff87f677e33d0444a9485c113179 |
| SHA512 | ed0aa92263b53f6b65820303a08d31c7d54c422425aeae90ea52e08c54e10392acf33fdbb12e9ceea954df9a3cab1b13d4cc39c5a46198c364c6de3017d9dc87 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\browseradapter.ini
| MD5 | 849c0db12448b338a7454ce8fc8c6365 |
| SHA1 | 1477afec52ba1303cab09b085a7148bcf56b2497 |
| SHA256 | 9897278fec98e2ad20355747dbcb541f2c87d15616f6f15215fec3351590b3a2 |
| SHA512 | cfff784ac25afd5d6b6a4b15b90f41614f3a9299e77921e804b9464504ea472e6da69e2142784a0c6dbd6f2319ef124220da22230dfd260e440939f14b97124b |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CreateShortLink_Nomal.png
| MD5 | 673f47624b85a4403fdc740fe2721397 |
| SHA1 | ab0843b01f6a80a70c2cbaabe67f273094f80b33 |
| SHA256 | 38bb2806bdc0022541bde8ebdfcc7c4b4724489e870cfa7ec5bc16919057f629 |
| SHA512 | eb43372ada55842ec5a7ca52be3a4cc0eebd1bf83323b06f3587632f9ac76ba57cc943cac46c3529bdc269105aef965a2662924815b253044f5b34a77b0d73ca |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\defaultgameicon.png
| MD5 | 116824ac4fabdc85d00e1d6e60fa6fff |
| SHA1 | 5bc1c4a8c152de3c1ea834a44e247ecb1e1ae865 |
| SHA256 | ae9291b1744a13ff45be576d455f268b93068651944e5fc5998b8c85eb1ef462 |
| SHA512 | a2397a5730dd9fcf8da86e58e247dac4b3806b5cae62b706cff2f8a87a0e7000c875b745413d6ec05c930fc4d5d89bc9b14389c6100bb437443970c889207a61 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CutLine_mov.png
| MD5 | 7069d28083d1361384f04c0d0f68904e |
| SHA1 | eb42e13f8ddd37a0a6493d1a8b4fa629c04ee229 |
| SHA256 | 328ee1b1c993d27c97aeb037e0e755e05a106aa4ee9e3203f350c9a09c4fa8d6 |
| SHA512 | 316e4539fb1cbb0204bbdf4beeeba9c3f268a006f280c74ae3d2d77caf1d34c571073c0dde726cacd94aa2237d5e03c345d38fe0feb6eeff01803cc634358403 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CreateShortLinkTips.png
| MD5 | cb1e1030a8813d00749d308b0da73b9f |
| SHA1 | d97c9823d234fd8650dfcf540796d26f97442776 |
| SHA256 | 2d0fc3650a7f32216d8545dfd541bf4a1ab9f386521ae8f035ef8f6c069089fd |
| SHA512 | 24141197dabf6dd18adedf1920b52dbac7a72eefcf71cf66d02048e08d480c489e3ee72be174c593bd7a4e2882ef62bb0e941e5dc3c98d6abec15db88cbc5051 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CreateShortLinkClose_Hover.png
| MD5 | 2855abc8bc2f15113af379b3ced104a2 |
| SHA1 | 0aebf0295a17c7fd6c722ce10a65c9fc4fd09f03 |
| SHA256 | 671af83a229fe930a720e5805e079ce2c01334125136011d8adc0ee6c3dd50ab |
| SHA512 | 5b5063eacf5fdd0ee1e939090334d5f918c4fe3484a6a0a3ee4c87e8808153002ea8316733a5a8e84c5e019a2c6f4a64b8390ca339cfad7c2135fcdb9024b3c6 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ComBtnHov.png
| MD5 | 6cb194b84853c3d231eead716d49370c |
| SHA1 | f95a681a3dc9318580bb62ef8ce4a678d78f1ec5 |
| SHA256 | ee34c098163504705e055812f003d823efe727600ea4b56db73553e2ff9d0219 |
| SHA512 | 5ba1f927981c8679b49c5fd079ea2bcc662c8e9282ae736783c7d46ddcf7c486ad48856cea0831a223ac8b9600eea541a35fd3b4afd4fa2f132dc554503ba4ec |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ComBtn.png
| MD5 | 0a2318d4078889584caa4523315bdd70 |
| SHA1 | 281adb6f789746a5c2e446eea019c1e1047ab8d1 |
| SHA256 | 5956629dc86c8486d28137f91fcc493183a53a103c1ba5f4a4019f67a132e9ef |
| SHA512 | 5c05917259aefc4b675913cb896af105b1e7bf7cf07ac400083303e2952e307fb72eef4786e27381a7eee5d2b17dd4d55a9ed1dac7acded6890db927f4657b5b |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CollectingToDesktop_MOV.png
| MD5 | e4c70faae3c4fce495e12d24c2854c8b |
| SHA1 | 9faf01736350722f60820485bc6fa1eb364e2c5d |
| SHA256 | 03f78a2bb0eb5d120d85e7c08a16410921824154186b04ef1027905b07d137a5 |
| SHA512 | 54567bbe7b75acc0e09a4fde69ff50d295609fdab69478d8c995213d4491f09aeaeaa134b2a63a76d3c5f92a8a3b61c1e56b8593dddf17a12ca28b6c8af4e4c9 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CollectingToDesktop_HOV.png
| MD5 | 8f88aba447c6b48423a6ab9502060195 |
| SHA1 | 2d434c1dc6f8523b49dc669abd8f69f50656ffbb |
| SHA256 | 78a209e1df0745cffb42aeeba157769ccf016dd3e356719415c11374f0e592df |
| SHA512 | 927b79089112c18870b43568c6efa1f8959beb39aaba9356429d7209438f8ad330488f3c49d8b4bd9aff29808b751ee52c82f7322dc72eb8a2d1ac563ba79fbf |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ClearIECache_mov.png
| MD5 | 683aebc33c1a57d4e7193ac11edb718d |
| SHA1 | f880556c87ea97d913003b5d61bfcc46309203fc |
| SHA256 | 2a1b1688b001bf57d60a0c47b6b82910c443015711820f6a95a073e540621a40 |
| SHA512 | 6aa2665a83c7b683658601815d6b0957ee3376645158339657bda2ff765b7db91fb8abc49ef0e50c5a9474965ccc9e34ba8df82e28d8cfa2b05cd49225a3a454 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ClearIECache_hov.png
| MD5 | 5e9c33c45c3997c6bd2a227496d8bbf5 |
| SHA1 | 61438ac8294a4723abf785604b05f3cfb3f190a5 |
| SHA256 | 59a3e8272352042ab795032d5dd448b2f9bb3c9bb0e4a119792ef31094e69005 |
| SHA512 | de8df25f3294dfa0a01433df94672272c119ab58c58e7af5bab3cb155dca248113d31e5145b1039dcf24bd27725aa385c860e286ffb7c6a85b4b8f25373451e4 |
C:\Users\Admin\AppData\LocalLow\Unity\WebPlayer\loader\UnityWebPluginAX.ocx
| MD5 | fd0cb28279bb47d33605f6a6f90759e3 |
| SHA1 | 374e2f6beab2520083bf749959dca7e07497a5dc |
| SHA256 | b913b88aa4aac4c0114cf5d0d5e6b3baabd17727e1ec1450452f89bbf91123fc |
| SHA512 | e4e13a61b3c47d2d5ee6bd2b0831f1b8fcf15e0a21dc857c761fd64ee60f06872018582d5b498427961a59a0e5188699658f8d1f60e7d182ae31a10be02527c6 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CheckBoxUncheckHover.png
| MD5 | 0e40da2e0b0d35ca116a6ef8cc09ab27 |
| SHA1 | c43ff70922be4bfcf7823551be6b2167c341f979 |
| SHA256 | b443f84b1dae129f7f7d86f46a1b6afac0569f5537ef79919396a18f15a6c709 |
| SHA512 | 82042d24bb547bf1aba3b317e611516162a955714df3c44807c65ac5ef449b0e5e0eee8e673de24be9eb89c9cf45068afff74fb710e2eb89e9d4106ffdd645a7 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CheckBoxUncheck.png
| MD5 | 0992ec4811eb429baf46221fb1bfe4fa |
| SHA1 | c4d95902c17a2c339cfadd366a1735a08dcef39c |
| SHA256 | 179ad885c9bd5e378b834f0c192f36d24366dac0af3df1c3a7896150e94a56a0 |
| SHA512 | 91fedac3aad148511f028fbf25f544590abd7daac05fdcf9f62063911a1b5e39003e9a97d54425d2facfb4446311dc42499e625766b912656dd1fbebf8fc56b1 |
C:\Users\Admin\AppData\Local\Temp\nso44E9.tmp\registry.dll
| MD5 | f81598566d3bebe154d86906e7419653 |
| SHA1 | fb2a980abe37a0b724edf932884931f946332b68 |
| SHA256 | b13d15f8d3e5498d3014dd0c5acc2b42df4aa08f96e0b3e59dc7c9e8c1e7f4c7 |
| SHA512 | 95f6d51d11df472808b9e6a765be6f13231901d698b62f0782e2c17a5ddeee43a8484894f11568ae474ffc7a3b27d8cd01785caf8d87eecdc4a3f64a3ece9255 |
memory/776-5415-0x0000000005D40000-0x0000000005D99000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\nszC333.tmp\UserInfo.dll
| MD5 | 13a689123cebd31c1d1862e05981beca |
| SHA1 | 0430094a1a0f639ba9bf5831c24f1f4330762a6d |
| SHA256 | 386933bdaf4774e88670e21abbebdeddf64b1e87b1681f85ac5b3ec1cac8dcdf |
| SHA512 | 0663148e80f4703000bbfc8ede2bcc7cad19877585a5cc46aa13a7003377d7315d33f01c1d311d38bcf5e3782e4b361510214f09a9f6537b856c5ad9bc41fdae |
C:\Users\Admin\AppData\Local\Temp\nszC333.tmp\System.dll
| MD5 | d0d7d2799802f7cddf8db7a2d8ae1e23 |
| SHA1 | ae8d8cfd9f1a7104036a9e8658f50f9c35c7a1c6 |
| SHA256 | 828819614dc0dbfb73f22d4c3712e6369230eab92819c5d4efe75870ee109a5a |
| SHA512 | 2b5af0e34720eb2f5b0aa04b589b46fb4b4d344b5c5d23fdd382348b051ac9766ff80f6a2455ef66da78ba880e8ce41b23daf741033de7701ca3f17f1adde408 |
C:\Users\Admin\AppData\Local\Temp\nszC333.tmp\UAC.dll
| MD5 | 113c5f02686d865bc9e8332350274fd1 |
| SHA1 | 4fa4414666f8091e327adb4d81a98a0d6e2e254a |
| SHA256 | 0d21041a1b5cd9f9968fc1d457c78a802c9c5a23f375327e833501b65bcd095d |
| SHA512 | e190d1ee50c0b2446b14f0d9994a0ce58f5dbd2aa5d579f11b3a342da1d4abf0f833a0415d3817636b237930f314be54e4c85b4db4a9b4a3e532980ea9c91284 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\CheckBoxCheck.png
| MD5 | d9cdf06422119816ca6f9c4c72cd09f6 |
| SHA1 | 64e3bd1921689df2f3ee450c8387f9325d1254e0 |
| SHA256 | 23f27fa2319a141f10a8be0cce63f11fce499f5943306d9d555c177c74d346cb |
| SHA512 | 2763f47b77742585d3562d61afe00033ef7ebb9f3fb1b7cd8b163d62ed5770680b00ac27bf200a47734cf715adaab862b9710268db9b6fc67f3c6625612cd88b |
C:\Users\Admin\AppData\Local\Temp\nszC333.tmp\UtilsPlugin.dll
| MD5 | 877ba4f17e960ddcf0c2fa2df62b6710 |
| SHA1 | c452ce34ed1b5043bb26ec938d170fffb14b53c9 |
| SHA256 | 7481df00348a7279b044cf12f7188b2c15e6a1862e5ed2ea8e7e2b0dc6c027ae |
| SHA512 | 0ae63c05641c234d53573e69eb143582916c4c976fc11d78efe0310b8fc04b0491838abd94b8c7b9ee5f77ddf41bfdeef61227c87a6da427c68b9feae6ada612 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_Hover.png
| MD5 | d94d4858a788fc9c9e4372a9847660f4 |
| SHA1 | 863d2d93f6909c19ee666e0b73e5a1914343c221 |
| SHA256 | 6dc00a8eef3d4d1394655073304c749b499e4ebe34ba292b3aa1e81f53a2efdf |
| SHA512 | f734a7c10005bd83e56e4f00139375404524c94c8a906d71bcd67dc590d91a9d9caeaef702a67540c7a627100a371c663a4d2c0cc6610b429e2618e1869f61d3 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_HOV.png
| MD5 | fa74861595b2d7f8029238da227c9ed1 |
| SHA1 | c2103a895f32dcb9e8f1b8a7f647d38821b2df1b |
| SHA256 | f22ecceffd5edb6c5818da84a7753190a2f1a050d7a137676c6baf155955ac02 |
| SHA512 | 7ec53735e6f498db76f25e742d512a58729dc3889ed6c5aa78844fa9178b8ced9de960d238258f161c3dfa5217bd2c575488b868910ec55bb5d887469ef7989b |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnSearch_click.png
| MD5 | d5c86709860616b2a77328be90005dd7 |
| SHA1 | 8e3051d9b74eeea2641ca29510e8dd75e8f6dbe4 |
| SHA256 | 4f3d3d8f8544b6f5d973443d28972712d9f869f745544822a7af63d66cb9806f |
| SHA512 | c2149278520b60989638870a3095b82f85eb7329f67741c99e832c483e2a2a7159e9f5294223d504eb98f0d1b185a57834d43da0681684a7b4152929cbdaa6de |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnCloseNormal.png
| MD5 | 5c58e41384824810c9233b4e20544bbb |
| SHA1 | 19a38a15c08df0c87fc96fb2ff1218cb11397bb7 |
| SHA256 | b6f7642aa16976177755b14a93dbdb3245eadc5f31cd28abbd97d31b4939a189 |
| SHA512 | 1ee8e676ea4702c7196f123c327aa0cbffc4553f389816dc7a8ade555b7f8c07e5b4b80bcc8ef6546e85e9b5255f20cd81cde91faf509f7d4fc0f35421af364c |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnCloseHover.png
| MD5 | 77c53a33af5d9060edc64d742581c78d |
| SHA1 | a6ca1ead89f69b55cfa2557a2607e056d7b98ad5 |
| SHA256 | b8ee599130d00563db4e4c0cf66b07d626d00e28edc35d9e96734d73c11e56f5 |
| SHA512 | 16bc887a618d565e5a5a93c98bce80510138a1c6687a027b16aa52233154bdead4224d4fbe76b2c48d13e210e426c6c86c250a27e7b4b7e695a9af59e8a8f506 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BtnCloseDisable.png
| MD5 | a7a050294a34df2b6598b06c0f1b46ee |
| SHA1 | ad0a456db2e13852af75b30f8a84495dd8414b1d |
| SHA256 | a37bc8a0d719e97f6bba561f05056c90beafef08dc5cf77ca0604caf833b82ae |
| SHA512 | 3d1bbf0957bc2df884b0716ecaeaf616f83f803a006cb0b03f66102520d99e98833d4448c407b75dc5a67505f0c7cc23a919a4b58881bd4c1691c5257299df36 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BindPhone_Mov.png
| MD5 | 62cfbca60f27d4b42253c96e1753bfbe |
| SHA1 | 496690bcb841f2c95b1b1d3ad2f8a70c7a3dee76 |
| SHA256 | 4e2ef52fdf819e5d5825857600bb1ebad672a16873f4f55cc02c4b78c04d01e9 |
| SHA512 | ea87b367f8dd7a0670ae3171dd7a6f957682a661528e9f1330921c8273dd6df952e529aed59c21be33f0f733483266468809dcf0a5c38137610849ca2489c4a2 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BindPhone_Hov.png
| MD5 | f061cd973c3245b935f8ca0e7fa2df41 |
| SHA1 | b843b3013d90a3b54f54796f36d0b3ae64e0684a |
| SHA256 | 4047e046f0f25b0f41d3cdc6578e252d35d5b2db9d44f91fbe5400b14073c8d9 |
| SHA512 | 05047a6b3c235dbf1c086ea97759f888efc88dbd25eef984de53aab304e0091f40f0014b6edea4368f813f4d4dc0cd04d35cd1fe0dbaee3a9ddd31b675cac186 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BindingAccountTips.png
| MD5 | 782b458a7a130a168e2348bb6b6d1ec8 |
| SHA1 | bf958b123c4c07ffda0d47939747464deba924a5 |
| SHA256 | 37bea36b1180d7b0a2a2734a46b3ced630c997a461024dbd395e12706ba29599 |
| SHA512 | 3b765d00dbf554f5b4037b27a6ee5a3cfcbc26d33a6b336f5a37fd085de24ac5bf26edf0e6855ece7184799a1e216bc072fe516356a419e9a9d26846c58ce32f |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BarPay_mov.png
| MD5 | 17ded5e0a173363a18f2e998cf05882f |
| SHA1 | 121c6c1c92e0538cc4a1964eea2a6de7784a6ff7 |
| SHA256 | 5a6d97e4f5fd2cd4ff81595bce200b8b9bb0af8c87e0a5a1ad33e2ba8592631b |
| SHA512 | 12d6cf34bb4f1c3482421cc986d2776d6724e3b97f257a2cfa17f373b688742c23d8a7ea682b8bc19c5b6162e2bf9627c415e3dc822a7beed2bdc2799bcb6b6c |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\BarPay_hov.png
| MD5 | f3506a23a8eab8def532ec1124fc122b |
| SHA1 | 5dab7891775c289e860aa2b144483209e8673b13 |
| SHA256 | 4d2fe7c86523d8e72de46e925aa1ea473e43b46534088c2372ebd5cd2db6a02f |
| SHA512 | 1095e4cce712836bb0f1b45f83a919f44c7becc8c51f950fec2a1e4034f8d6004372e23f100e51e309a7a406c51b4fd0821cc92f8245b720e094ce6b9cbc0856 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\png_res\ArrowLine.png
| MD5 | bc5022a5719a200d8cb4df3b5d95337d |
| SHA1 | 33b3389c08cb110d2882ce7c87c09f6ac768e91a |
| SHA256 | 79c208d9481d9ad70b6375aaa875c1933fa6a5aff1a20ca69ae9e2d28fd16253 |
| SHA512 | 71d564c909621d9260a257daaee9bdb019a8fe24f81db319ba7bf31b6e81e5db7fafde7b76c181a615bd872fd702ab60d463ee340b8b8124bb524ded20cc9245 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\skins\default\control\mainframe.png
| MD5 | b702f688b22f0d326be0496338307f0d |
| SHA1 | 3a69c7a925bef885ad3491fe552a613dde803aad |
| SHA256 | 97aec0db2dcaf6d20a1ed9e8cb2d8bdde456ea0bbee9bb9275bfb284dd059a52 |
| SHA512 | bd30e9c6518072b5954d69824d084a99011f24cbc386e4be15a3d55bf5f69cc11f1ff4693699b2291278ea7d19665348e847f6c0ba8737fe46ef837dfca3d102 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\QyWebGameClient.exe
| MD5 | 4c3d98b2b8e9e4064e5947d64c4ec613 |
| SHA1 | 6b8c3f2ee10d8f830f8678e5245cc2a35d18ac28 |
| SHA256 | 46f0604a4450ef9f828364e21a1441bdd4fa7a229964aa61bf16279150c9ba55 |
| SHA512 | 10025f9d34b952b09037f5f269583d74c3792cbd386eee2ba3e143f8b04636cf662e1c154f286a86343d0f27a1bece456442daa7eec84670e741c08048aada2a |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\QyGameClient.exe
| MD5 | 85d1912c6c543f4cf7b69ebb76372b5c |
| SHA1 | f43303d60f2baf0d17ae6d14b8d98b6b1152d696 |
| SHA256 | b9f7db9f09ad85025a61617ea56089ac92a2f1c9feccd9b3273f88abf8e769b3 |
| SHA512 | 91f568d0a95625da13da7c416e0813b922f30c280a80e04229365fc121ddec0da9afb4a1f64c63405521d463cebe6ace0c5a6dda4da5bf57a39d50729eac176a |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\LobbyServerList1.xml
| MD5 | 45811f4d5463405dae043f7e9b9ba846 |
| SHA1 | 886a410881900f0237ed619bfca6583da8ef919a |
| SHA256 | a0635bc8344e41759e0a53f0720435952f57fe68df229ac4831fb9300bdc4593 |
| SHA512 | cbaa251953dc1bd3d67c176702a23482472449078344d7d26051589e1b5350f5a85cf120453bc6fa66f6a8c6b8db80bd52c4b2bd67dd53d5a1df02c7dd8d1736 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\img\error.jpg
| MD5 | 2cd92fc75bc2be926e4c002598f325c0 |
| SHA1 | 484461932de9ae91409a67308236f4f35be0a232 |
| SHA256 | 657728435b2d152106f4acac777bfd82157727e0fdf6364c4f0eb4906a443399 |
| SHA512 | d1ab9a455742d502260bbd3279a9da0579f0408b5a7443ec5c28b4a19c8e31f6e622d33c6e886cde289a3f8e6c530c9b94e8c247299a0ed54dd01a41ca8c329d |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\img\bgline.jpg
| MD5 | e50052189fe327cffc4920d2cbfe7e5a |
| SHA1 | 917e438ed6c14579b4c923bed88b0938a5719312 |
| SHA256 | 49de719c563b90541a46fd3db53057cd6e1c854f69359b09453b7c6233707ecd |
| SHA512 | e98a96a9a3086768ce81e2152a7ad98c8f0c08308521ade743940ecc23170ff6309d722869543593f8fea742d2b0f95602a594ddff9894881043654d69008a58 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\img\arrow4.png
| MD5 | 55b2b0485d8cb14277abed24471c8ec6 |
| SHA1 | 121aca27f33646990d96a7b602671a0d01f6a4b5 |
| SHA256 | 41e8a39560fe7c5d41be57668b697ff6d163794c1fe0d178bd7ff603395e5666 |
| SHA512 | d0330c27c501f78cb3dc07df0b2b757851420a88002ee1ccaa5ec3fe29d42fb59bcd26b2fad40bf771e611e2ce7e98fbe7a72c7edd0e58cc5a78075d392cf751 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\img\arrow3.png
| MD5 | 4b7ff428e1010f5b4b924a381ecc6a9f |
| SHA1 | c64a6c92c9ce90dc5f51fcb61d1fa7aaf55765bb |
| SHA256 | 6da80486fc24fe096983626c22d7ade8e72667205ae9ab88eafb1b5e896f7d47 |
| SHA512 | aeb5d028c20c69cc04422c1cbcb0ec9ee72557553cc8230c9129b7baa70c6ad3263d91c9d5c62c69792f321182564d6f52e167e18bbbe4370564790596561d39 |
C:\Program Files (x86)\IQIYI Video\Common\QyGameClient\error_togame.html
| MD5 | 5926b1d339e58bf3ebc876939ea4c2c5 |
| SHA1 | 64394e162c82bc19812c62881ca1545288e56516 |
| SHA256 | 5bbaa9feff7fbe44b794df4b493c587303588d74d138cdb50504ed5b6e3c8669 |
| SHA512 | a8f7374e80214bc9ba4e493e8706e59f55f07ccc31601ed550f0d1787e1c5dc6695f4fbf75e7e2b66c031fb44e391af6d65ea619c3286aedf3d12c819b3751c8 |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\vmPage.dll
| MD5 | 93d53ff1b299ffec787c73c0c87ec223 |
| SHA1 | 91e674bc48d7f9a18668e13d3889ea4cfdbcf7c4 |
| SHA256 | b50fd866fe75a6654ca15ac2ebbde98dc7c5e6b23df6ea658d1fb4f55825a388 |
| SHA512 | 92e2c5c1eb85f3bf18e17ebb04563b1f6e85efa27d9ccdfd2b6959a1fc43ceb9c70fe129994ae22e8b9320fce7f5b06973f45a3da23aac00da75de9a1edb6b0d |
C:\Program Files (x86)\IQIYI Video\LStyle\vmPage\vmPage.ini
| MD5 | 3e8a5d1adafbf32b88bccd9e04866c1f |
| SHA1 | 1e8f652bdbadfdb76ae3783f2b13e782eed2a755 |
| SHA256 | 5639ce40cff3ee7cc012f13a8d3d259c29c3f7711111336e4ac1b2cea6932d38 |
| SHA512 | 91a07ca3130e33c5e142727bbaf0973b99d75b36c4ae074f6374a6b81b2bc0d8b88d0e253b40b916322f47e15e49a2784dc55ac6d93cd6b2915bd6a6aa2406d9 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\vmPage\1.0.6.55\skin\btn1.png
| MD5 | d271a47cd14ebb209b06ea235a91d144 |
| SHA1 | df6d11259e8b54247d052a64b2fdeb86908ff751 |
| SHA256 | 09fda339a9d73d4bd0c728084eda60967139cf45c96e81fdd63ef562597c37ed |
| SHA512 | a074342fcdad77884e7b3c0360dcdf5798e3b1dca4484df23cd85b0283da0920fc867fddd41bd3d8eb4b1200e43c9b34114ba479ae9d4e874f46ba4808705ef0 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\vmPage\1.0.6.55\skin\no_up_and_down.png
| MD5 | de4109c2374280da714e9dcdb3d3ad9e |
| SHA1 | ce6657dd563c51c684277a4213fb2be052a13f38 |
| SHA256 | 03b3fa0f39cc032f3f0fa0748810bca79d925e64ec5c2df0d3898580b1d7b203 |
| SHA512 | 99160096e9ef20e984d09d6abd34a0522543e00b582254f337a3f61ead89ec933fa8f2618bc1deb32f7bd44c821ddc1ce9b60392fe65374cd1912262a632a205 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\LogoLIB.ico
| MD5 | 094fad0a9eb6e39e00f6452da2e0a596 |
| SHA1 | 053e9e4ae140cc3fec5a500c6941e0181e6ad143 |
| SHA256 | 8429febe04859faa258bb06bfba94eb969ff7e80da207bac6417a22cc83548de |
| SHA512 | b5d41ab5c040b0a001aaf399e9e7fd9646eb5d79268fa5f5258fb22a178b311f46e46c48c75495a003ea15949327700b7011602d726d92cf7e348f83e3ec5867 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\QyMaster.exe
| MD5 | 9e8e028857769d11281f83f1438d8a35 |
| SHA1 | a6a23b4e3fc495ba235a5b35c35c8fe05ef2f55d |
| SHA256 | 169e700568cb68e2511589aca9be8ad26bcd1ae52d0d109120576934c8af94c0 |
| SHA512 | 42c9874e7b8eaa50888f4f533bd93c11c8277c8435583f06c764a5858f47c34ff5d8fc982540b5c06cb2ee03fb406931eb4db8170c18d0c1bb3f5bdd52d8b9e4 |
C:\Users\Admin\AppData\Local\Temp\nso44E9.tmp\nsExec.dll
| MD5 | 2d1656be5aab3f3e6873cb5d0c046717 |
| SHA1 | 32facbec7603c0d3a2198c390399711f68a96de7 |
| SHA256 | 63133db6770f8ae0a5b38ddeafafbdc61cd6bc2ab0b6f3c307c0904f29d8a218 |
| SHA512 | d55426322c315a211c4de778eabd676fe2353ebff15f8725eb4e5dce03bb6b92f8a180e5093c2bdb324329bff72b4b1ed37d9d8155ce4c98926e0cbaa1c62ea1 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\PSNetwork.ini
| MD5 | 3221fa8864ba8b73d2b5fbd437a289a0 |
| SHA1 | 0b210cd735603be096e676cc0dc9d4c5c1de63f7 |
| SHA256 | 8ffc6af8e58191176ef82385aa12d25c0379d3b9ccc3a3ce1d041f3c52d61914 |
| SHA512 | 220a1f69d939f7a67c94a70e88acab7be105a7ed4fece40890c0b8650b4f356d3d7cdd348e380673a4cac25cc16e8c1324aa9fb64efb3b7337401876ad13ef4f |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\PPStream.ini
| MD5 | ba675ee634bd31114ffd559d4af2287c |
| SHA1 | 24b5a5470c331bc8817ad255db84da425b9f677b |
| SHA256 | e6085dd122a9c7dba0684b2e32ffab80ffb2ecf806626ac45d00bddcacf0d016 |
| SHA512 | ae6cdcb20768217bd9278d1cb379d7342d892c26fbfec6da7254eb4d2aae83983d6563d37b458ff47b1ef1e94da40a9529e6893b76ad6ce4f973084583479c9a |
C:\Users\Public\QiYi\QiyiHCDN\Config\PSNetwork.ini
| MD5 | 4cf8025c95b17b03d123811cf2fda952 |
| SHA1 | 2db700fcec6a1b915ee414a03b5b1d6dcbce062e |
| SHA256 | 9c599066e67a75df1b97908c5f90dde62c83534d6a20968090162c40983c3ed9 |
| SHA512 | 4bd6d614b7affd9a952b8785f8884e0ca9c0acffeed50fc520f873feb306cd242387971a16e757bf878c1f9f09d3fa21e3ea732240d442cbf4b3573561b26348 |
C:\Users\Public\QiYi\QiyiHCDN\Config\PSNetwork.ini
| MD5 | 4cc4b1f702c942e9c7276e94cd6a13e4 |
| SHA1 | 578d2c49a5cd802360bbcb76d575fa4fec1cc81a |
| SHA256 | 5117d37fcc07b8b31ed1487f5b508f14d382d4afda6b186884df190746976c95 |
| SHA512 | 9bc071b87b574a0085165311d3762b20aefd45db258f293c29fa31c46da3534329542a5f0420e75923318b207a685bde764b56e4eab5410a28d02d06a924206e |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\browseradapter.ini
| MD5 | 2ead05e1cee75f9ebdd5f9ac04cba9e9 |
| SHA1 | 5c37cff83b68982eac4e8b6ad8a4a00143890a04 |
| SHA256 | 0f318d57f8a2101da3b9c6b6c92e072afdf30150d4e628db68d4502a50b5bbfc |
| SHA512 | ef73d57044c0b860839ad2226a4b61da16191e94a11584cb015c85f9ba6bf7202bad73baf2302426b1a1e3981b292b3eb4774643c31af2d7a12312025270e203 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\browseradapter.ini
| MD5 | a175012f3ffafbc37b0d6d5ee72f9fb4 |
| SHA1 | 0623b2775066e3f06f4d86c38932c6ad960c3085 |
| SHA256 | a0a094d6fcdf59af42ac2d2257df93a24272bd885d237a9d66426abf2706f484 |
| SHA512 | 388bb4eb8fa6a1beeaa0d3678368f1f679ec3dfc6cb4718f34a1c32ab2668a158c2cd7c5a64b7f77707d2186928d311305ee47b5a923b1ee35826a8fb0a987a8 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\browseradapter.ini
| MD5 | 56b64f7538c04fc037a6171c732fd278 |
| SHA1 | a4d54250c8260c09da6ee5878dde308654aa0a06 |
| SHA256 | 686f5782774973412d994c9ba9812de95604b87df6209e635628861607f07946 |
| SHA512 | 96a1d0410c4a4823f3d4fe58f0655f975429d6d8c6a481e5c6daac4bb86f844f9ac306b652638a667b1a0d26a1f5a5d12e920e89fd84a9ceae0e3552ffb8372f |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\browseradapter.ini
| MD5 | cb15cb81d4cd8827c2205edb9c2e1005 |
| SHA1 | 24ffa311486cc900526f9f22d27a6361642980b2 |
| SHA256 | 3b48a46f7053c68c4a5bd2c7a5eee51c8347bbb582545d4615ef491638191922 |
| SHA512 | a0f916465a8d71a3ffaf6688bfc916313fd5f7de1e0d71aed7b3d8a149cbf47c141e6d5d892b0219748df1ace3c5fd026a337f00b9f3be89e720333015e8ba7f |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\browseradapter.ini
| MD5 | 840d8c3f8ef65047c1c5c75b926d9d25 |
| SHA1 | ae04523029fee1b609a47f2ee8590abed09353fd |
| SHA256 | 2a5d7ab1d683d967d16606cb7ed717c06e6ccc2a81e431db971ae1858bba75c8 |
| SHA512 | c223c00b814d8434f382980e8ddd42c7ed173197ed96b36d5ac97c92138250ba98fbc6dedb0ac97607f56b42e64c91d8cc60386010e4d136ea5268d13597bbb7 |
C:\Users\Admin\AppData\Roaming\IQIYI Video\LStyle\browseradapter.ini
| MD5 | 0260a186a501b61ccbc2dd1e27c41859 |
| SHA1 | 0e75449b47057af9b5e69ff39154e2c679b43f84 |
| SHA256 | 7fbd145d54291c8ad95538ae614995d849d577f0527b1b439ee1989795e29b64 |
| SHA512 | b4812f6a0ebee261ef282c30d9d58a41a09aa92f5f134ab49be6624f84341ef33a954d63930a2beac1b9fb0626e356a17b2650e09ad7031a78e6902e3228643c |