c7e2cda5dd59e4603442f175a6206961bb6c56669279bdf8306a222ebb072a91

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 07:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
Size 34.3MB
Sample240617-jkl69svdkl
SHA256 c7e2cda5dd59e4603442f175a6206961bb6c56669279bdf8306a222ebb072a91
MD5 b773f47dd39416c57b4663d49a9e2169
SHA1 6dce4b85f0a9f63a491006118e14c8b6e743e9e9
SHA512 92fab0481c3a0835faa842fd2c4a7270d789c0bbef7a38cfb3a5b5962f5c5bd921ccee31fdd8e0a74f378476af6d7807bd47bee45bbb78323728b81e2460b74e
SSDEEP 786432:Mfd/2KRtZRmftegE+An25MkWQiVcMuH2B84vnclcv1PNiWayCaFPbm:MfbrZGhJA2rI8/4vco1PApM1bm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Executes dropped EXE 34 IoCs

pid	Process
1500	dictbuilder.exe
4504	imeutil.exe
4520	imeutil.exe
4488	imeconfig.exe
4048	imetool.exe
3244	imetoolx64.exe
2424	BDDownloadExe.exe
1780	imetoolx64.exe
4184	imetoolx64.exe
3548	imetoolx64.exe
2700	imetoolx64.exe
704	imetoolx64.exe
5084	imetoolx64.exe
1920	IMEBroker.exe
4696	imeutil.exe
4460	imeconfig.exe
1708	bdupdate.exe
1272	baidupinyin.exe
988	cellinst.exe
1576	skininst.exe
3924	imeconfig.exe
3644	imeconfig.exe
3468	imeconfig.exe
4604	baidupinyin.exe
844	imetoolx64.exe
3436	imetoolx64.exe
3220	imeconfig.exe
376	imetoolx64.exe
4844	imetoolx64.exe
2380	imetoolx64.exe
4336	imetoolx64.exe
5092	imetoolx64.exe
4276	imetoolx64.exe
4848	IMEBroker.exe

Loads dropped DLL 64 IoCs

pid	Process
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
4504	imeutil.exe
4504	imeutil.exe
4520	imeutil.exe
4520	imeutil.exe
4488	imeconfig.exe
4488	imeconfig.exe
4488	imeconfig.exe
4488	imeconfig.exe
4488	imeconfig.exe
4488	imeconfig.exe
4488	imeconfig.exe
4488	imeconfig.exe
4488	imeconfig.exe
4488	imeconfig.exe
1780	imetoolx64.exe
848	regsvr32.exe
2136	regsvr32.exe
2136	regsvr32.exe
2136	regsvr32.exe
4696	imeutil.exe
4696	imeutil.exe
4460	imeconfig.exe
4460	imeconfig.exe
4460	imeconfig.exe
4460	imeconfig.exe
4460	imeconfig.exe
4460	imeconfig.exe
4460	imeconfig.exe
4460	imeconfig.exe
4460	imeconfig.exe
4460	imeconfig.exe
1708	bdupdate.exe
1272	baidupinyin.exe
1272	baidupinyin.exe
1272	baidupinyin.exe
1272	baidupinyin.exe
1272	baidupinyin.exe
1272	baidupinyin.exe
1272	baidupinyin.exe
1272	baidupinyin.exe
1272	baidupinyin.exe
1272	baidupinyin.exe
1272	baidupinyin.exe
1272	baidupinyin.exe
988	cellinst.exe
988	cellinst.exe
1576	skininst.exe
1576	skininst.exe
1576	skininst.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
3924	imeconfig.exe
4604	baidupinyin.exe
3924	imeconfig.exe
4604	baidupinyin.exe
3924	imeconfig.exe

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\InProcServer32	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\InProcServer32\ = "C:\\Windows\\system32\\baiducnTSF.dll"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\InProcServer32\ThreadingModel = "Apartment"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\InProcServer32	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\InProcServer32\ = "C:\\Windows\\system32\\baiducnTSF.dll"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\InProcServer32\ThreadingModel = "Apartment"	imetoolx64.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BaiduPinyin = "\"C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028\\baidupinyin.exe\" --autorun"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BaiduPinyin = "\"C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028\\baidupinyin.exe\" --autorun"	imetoolx64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	baidupinyin.exe
File opened for modification	\??\PhysicalDrive0	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File opened for modification	\??\PhysicalDrive0	BDDownloadExe.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\baiducn.ime	imetoolx64.exe
File created	C:\Windows\SysWOW64\baiducn.ime	imetoolx64.exe
File created	C:\Windows\system32\baiducnTSF.dll	imetoolx64.exe
File created	C:\Windows\system32\baiducn.ime	imetoolx64.exe
File opened for modification	C:\Windows\system32\baiducn.ime	imetoolx64.exe
File created	C:\Windows\SysWOW64\baiducn.ime	imetoolx64.exe
File created	C:\Windows\system32\baiducnTSF.dll	imetoolx64.exe
File created	C:\Windows\SysWOW64\baiducnTSF.dll	imetoolx64.exe
File created	C:\Windows\system32\baiducn.ime	imetoolx64.exe
File created	C:\Windows\SysWOW64\baiducnTSF.dll	imetoolx64.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imezlibx64.dll	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\msvcp120.dll	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\btn_wireframe_90_30.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\PersonalCenter\images\0_tips.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\Preview\quicksetting\3\normal.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\Preview\quicksetting\4\normal.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\btn_logo_panel_right.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\btn_logo_panel_settingcenter.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\plugin\js\ime-plugin.js	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\5e642625b8aa3f77d9d215212618dcb3.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\c2a4d6c9bf5832a424a3c9295ac5e85e.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\Notify\HtmlFuncNotify\css\bubbleRemind.css	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\Notify\HtmlFuncNotify\images\logo.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\skin_engine.dll	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\c48642a30b57232dc85e5219db831691.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\9cb299f92465ec2ca54d06ea1a8a98a4.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\urldict.dat.tmp	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\btn_login_reload.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\Preview\quicksetting\1\skinpreview.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\app.ini	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\9c7e49bf90cacdb77d4d4ef88145f493.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\67805a15ac3079dbd5cab56003df3f7c.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\说明.txt	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\btn_white_90_30.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\ic_quick_9.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\Notify\HtmlFuncNotify\images\closeBg.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imepng.dll	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\libeay32.dll	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\OpList.ini	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\5a996d2a0af3056fe9482b25b463d6a0.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\quicksetting\font_desc.f	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\4a0529890b4d0b881ded94ecbe6b18ca.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\b45c5e068beb3f97244f1617c6d5ee60.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\1d91d2c07feb861bb02176ba80f7029e.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\aa9901ff1020deeafec27e4eb6bd64af.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\f9fd447cd59ab6f4fc63b562b7870d79.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\thumbnail.dat.tmp	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\btn_blue_90_30_2.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\ic_quick_13.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\ic_quick_2.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\PluginInvoker.exe	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\5513da1d3026b0da4abaa7ff67200e11.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\ic_quick_11.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\ime_skin_thumb_1.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\emotion\js\skin.config.js	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\PersonalCenter\images\btn_logo-panel_left.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\bugreport_baiducnTSF.ini	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\ic_quick_10.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\bdupdate.exe	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\8b7070ea1fab6dd3aa93c50fbfd02b8c.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetool.exe.new	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\376decc8363804c5f6487571851f229c.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\5b34535f96ed0fa4cac7942144f9bbfa.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\btn_login_delect.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\toolwindow\tb_pifu.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\favorite.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\emotion\images\load.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\6f1252010438615fe023b8157578e25e.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\86fe541faabafe7c0464846557eb2f7f.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\a022737ecc95e14fb243554fe11272f0.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\bc205f9db63a4ae474968f66c7939705.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\bddd88a7cffeffe14007bc167680b049.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\d2cd96fb322212d317fd70a00e7aba49.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\update_bg.png	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA91}	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B1A491FF-0A2A-405b-B462-BC8B6B82D921}	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA91}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA95}\AppName = "quickhelp.exe"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA93}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA91}\AppName = "imeconfig.exe"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA95}\AppName = "quickhelp.exe"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA93}\AppName = "pluginmgr.exe"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA94}\AppName = "skinbox.exe"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA96}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA95}\Policy = "3"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA96}\AppName = "baidupinyin.exe"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B1A491FF-0A2A-405b-B462-BC8B6B82D921}	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B1A491FF-0A2A-405b-B462-BC8B6B82D921}\Policy = "3"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B1A491FF-0A2A-405b-B462-BC8B6B82D921}\AppName = "imetoolx64.exe"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{409A2B36-B1D9-442a-A4DD-9C5EBCBA5134}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B1A491FF-0A2A-405b-B462-BC8B6B82D921}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA91}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA91}\Policy = "3"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA94}\Policy = "3"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{04CCE131-9A31-493e-AAFC-1AB51FDE2883}\Policy = "3"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA95}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA96}\Policy = "3"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA94}	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA93}\Policy = "3"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA96}	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA96}	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA96}\Policy = "3"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA95}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B1A491FF-0A2A-405b-B462-BC8B6B82D921}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA94}\Policy = "3"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B1A491FF-0A2A-405b-B462-BC8B6B82D921}\AppName = "imetoolx64.exe"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA95}\Policy = "3"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B1A491FF-0A2A-405b-B462-BC8B6B82D921}\Policy = "3"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{409A2B36-B1D9-442a-A4DD-9C5EBCBA5134}\Policy = "3"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA91}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{409A2B36-B1D9-442a-A4DD-9C5EBCBA5134}\Policy = "3"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{04CCE131-9A31-493e-AAFC-1AB51FDE2883}\AppName = "IMESkinInput.exe"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA93}\AppName = "pluginmgr.exe"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA94}\AppName = "skinbox.exe"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA93}	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{04CCE131-9A31-493e-AAFC-1AB51FDE2883}\Policy = "3"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA96}\AppName = "baidupinyin.exe"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA94}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{04CCE131-9A31-493e-AAFC-1AB51FDE2883}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA93}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA94}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{04CCE131-9A31-493e-AAFC-1AB51FDE2883}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA91}\AppName = "imeconfig.exe"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA94}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA95}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{04CCE131-9A31-493e-AAFC-1AB51FDE2883}\AppName = "IMESkinInput.exe"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{04CCE131-9A31-493e-AAFC-1AB51FDE2883}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{409A2B36-B1D9-442a-A4DD-9C5EBCBA5134}\AppName = "imetool.exe"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{409A2B36-B1D9-442a-A4DD-9C5EBCBA5134}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{409A2B36-B1D9-442a-A4DD-9C5EBCBA5134}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{409A2B36-B1D9-442a-A4DD-9C5EBCBA5134}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA96}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA93}\Policy = "3"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{409A2B36-B1D9-442a-A4DD-9C5EBCBA5134}\AppName = "imetool.exe"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA95}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA93}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{04CCE131-9A31-493e-AAFC-1AB51FDE2883}	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA91}\Policy = "3"	imetoolx64.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{29F9A596-1256-43F4-BE7F-16C89D66550A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\InprocServer32\ = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028\\BaiducnAx.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduImeSkinFile\Shell\Open\Command\ = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028\\skininst.exe \"%1\""	skininst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\InProcServer32	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduImeSkinFile\DefaultIcon	skininst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\BaiducnAx.DLL	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE4A566E-CD2F-412A-B259-1F1965B935C4}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bdict	cellinst.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCC34BB9-44B9-4660-8B75-AC11729A3A91}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bdict\ = "BaiduImeDictFile"	cellinst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\ = "中文(简体) - 百度输入法"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bcd	cellinst.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\ProgID\ = "BaiducnAx.ScreenShotAx.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduImeDictFile\Shell\ = "Open"	cellinst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiducnAx.ScreenShotAx.1\CLSID\ = "{D64016F6-4D8E-4B35-AB22-9B2060800112}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE4A566E-CD2F-412A-B259-1F1965B935C4}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduImeSkinFile\Shell\Open	skininst.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{29F9A596-1256-43F4-BE7F-16C89D66550A}\ = "BaiducnAx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiducnAx.ScreenShotAx.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiducnAx.ScreenShotAx\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiducnAx.ScreenShotAx\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCC34BB9-44B9-4660-8B75-AC11729A3A91}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\AppID = "{29F9A596-1256-43F4-BE7F-16C89D66550A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\InProcServer32\ThreadingModel = "Apartment"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiducnAx.ScreenShotAx.1\CLSID\ = "{D64016F6-4D8E-4B35-AB22-9B2060800112}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduImeSkinFile\Shell\Open\ = "安装到百度输入法(&I)"	skininst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\InProcServer32\ = "C:\\Windows\\SysWow64\\baiducnTSF.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BdImeFile	cellinst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE4A566E-CD2F-412A-B259-1F1965B935C4}\1.0\ = "BaiducnAx 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCC34BB9-44B9-4660-8B75-AC11729A3A91}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.bps	skininst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\BaiducnAx.DLL\AppID = "{29F9A596-1256-43F4-BE7F-16C89D66550A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCC34BB9-44B9-4660-8B75-AC11729A3A91}\TypeLib\ = "{BE4A566E-CD2F-412A-B259-1F1965B935C4}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduImeSkinFile	skininst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/BaiduImeDict\Extension = ".bdict"	cellinst.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\TypeLib\ = "{BE4A566E-CD2F-412A-B259-1F1965B935C4}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE4A566E-CD2F-412A-B259-1F1965B935C4}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/BaiduImeSkin	skininst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\InProcServer32	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiducnAx.ScreenShotAx.1\ = "°Ù¶ÈÊäÈë·¨Ò»¼ü·¢Í¼"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
Token: SeDebugPrivilege	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
Token: SeRestorePrivilege	1780	imetoolx64.exe
Token: SeBackupPrivilege	1780	imetoolx64.exe
Token: SeRestorePrivilege	1780	imetoolx64.exe
Token: SeBackupPrivilege	1780	imetoolx64.exe
Token: SeRestorePrivilege	848	regsvr32.exe
Token: SeBackupPrivilege	848	regsvr32.exe
Token: SeRestorePrivilege	376	imetoolx64.exe
Token: SeBackupPrivilege	376	imetoolx64.exe
Token: SeRestorePrivilege	376	imetoolx64.exe
Token: SeBackupPrivilege	376	imetoolx64.exe
Token: SeRestorePrivilege	2348	regsvr32.exe
Token: SeBackupPrivilege	2348	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1500	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	87
PID 1724 wrote to memory of 1500	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	87
PID 1724 wrote to memory of 1500	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	87
PID 1724 wrote to memory of 4504	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	88
PID 1724 wrote to memory of 4504	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	88
PID 1724 wrote to memory of 4504	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	88
PID 1724 wrote to memory of 4520	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	89
PID 1724 wrote to memory of 4520	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	89
PID 1724 wrote to memory of 4520	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	89
PID 4520 wrote to memory of 4488	4520	imeutil.exe	90
PID 4520 wrote to memory of 4488	4520	imeutil.exe	90
PID 4520 wrote to memory of 4488	4520	imeutil.exe	90
PID 1724 wrote to memory of 4048	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	91
PID 1724 wrote to memory of 4048	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	91
PID 1724 wrote to memory of 4048	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	91
PID 4048 wrote to memory of 3244	4048	imetool.exe	92
PID 4048 wrote to memory of 3244	4048	imetool.exe	92
PID 1724 wrote to memory of 2424	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	93
PID 1724 wrote to memory of 2424	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	93
PID 1724 wrote to memory of 2424	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	93
PID 1724 wrote to memory of 1780	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	94
PID 1724 wrote to memory of 1780	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	94
PID 1780 wrote to memory of 1284	1780	imetoolx64.exe	95
PID 1780 wrote to memory of 1284	1780	imetoolx64.exe	95
PID 1284 wrote to memory of 848	1284	RegSvr32.exe	96
PID 1284 wrote to memory of 848	1284	RegSvr32.exe	96
PID 1284 wrote to memory of 848	1284	RegSvr32.exe	96
PID 1780 wrote to memory of 4184	1780	imetoolx64.exe	97
PID 1780 wrote to memory of 4184	1780	imetoolx64.exe	97
PID 1780 wrote to memory of 3548	1780	imetoolx64.exe	98
PID 1780 wrote to memory of 3548	1780	imetoolx64.exe	98
PID 1780 wrote to memory of 2700	1780	imetoolx64.exe	99
PID 1780 wrote to memory of 2700	1780	imetoolx64.exe	99
PID 1780 wrote to memory of 704	1780	imetoolx64.exe	100
PID 1780 wrote to memory of 704	1780	imetoolx64.exe	100
PID 1780 wrote to memory of 4200	1780	imetoolx64.exe	101
PID 1780 wrote to memory of 4200	1780	imetoolx64.exe	101
PID 1780 wrote to memory of 5084	1780	imetoolx64.exe	102
PID 1780 wrote to memory of 5084	1780	imetoolx64.exe	102
PID 4200 wrote to memory of 2136	4200	RegSvr32.exe	103
PID 4200 wrote to memory of 2136	4200	RegSvr32.exe	103
PID 4200 wrote to memory of 2136	4200	RegSvr32.exe	103
PID 5084 wrote to memory of 1920	5084	imetoolx64.exe	104
PID 5084 wrote to memory of 1920	5084	imetoolx64.exe	104
PID 5084 wrote to memory of 1920	5084	imetoolx64.exe	104
PID 1724 wrote to memory of 4696	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	105
PID 1724 wrote to memory of 4696	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	105
PID 1724 wrote to memory of 4696	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	105
PID 4696 wrote to memory of 4460	4696	imeutil.exe	106
PID 4696 wrote to memory of 4460	4696	imeutil.exe	106
PID 4696 wrote to memory of 4460	4696	imeutil.exe	106
PID 1724 wrote to memory of 1708	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	107
PID 1724 wrote to memory of 1708	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	107
PID 1724 wrote to memory of 1708	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	107
PID 1724 wrote to memory of 1272	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	108
PID 1724 wrote to memory of 1272	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	108
PID 1724 wrote to memory of 1272	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	108
PID 1724 wrote to memory of 988	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	109
PID 1724 wrote to memory of 988	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	109
PID 1724 wrote to memory of 988	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	109
PID 1724 wrote to memory of 1576	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	110
PID 1724 wrote to memory of 1576	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	110
PID 1724 wrote to memory of 1576	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	110
PID 1724 wrote to memory of 4604	1724	b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b773f47dd39416c57b4663d49a9e2169_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dictbuilder.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dictbuilder.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1500
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe" --clean_old
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4504
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe" --quit
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe" --usercenter=close
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4488
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetool.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetool.exe" --moveuserdata
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --moveuserdata
    3⤵
    - Executes dropped EXE
    PID:3244
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BDDownloadExe.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BDDownloadExe.exe" 1 /product=201
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  PID:2424
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Registers COM server for autorun
  - Adds Run key to start application
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\SYSTEM32\RegSvr32.exe
    RegSvr32.exe /s "C:\Windows\SysWOW64\baiducnTSF.dll"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1284
  - - C:\Windows\SysWOW64\regsvr32.exe
      /s "C:\Windows\SysWOW64\baiducnTSF.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:848
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --startmenuopt
    3⤵
    - Executes dropped EXE
    PID:4184
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --vistataskscheduler
    3⤵
    - Executes dropped EXE
    PID:3548
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --filesec
    3⤵
    - Executes dropped EXE
    PID:2700
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --whitelist
    3⤵
    - Executes dropped EXE
    - Modifies Internet Explorer settings
    PID:704
- - C:\Windows\SYSTEM32\RegSvr32.exe
    RegSvr32.exe /s "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BaiducnAx.dll"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4200
  - - C:\Windows\SysWOW64\regsvr32.exe
      /s "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BaiducnAx.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:2136
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --install-shell
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Program Files (x86)\Baidu\BaiduPinyin\IMEBroker.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\IMEBroker.exe" --quit
      4⤵
      Executes dropped EXE
      PID:1920
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe" --quit
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe" --usercenter=close
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4460
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\bdupdate.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\bdupdate.exe" --installgau
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1708
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baidupinyin.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baidupinyin.exe" /u
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1272
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\cellinst.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\cellinst.exe" -reg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  PID:988
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\skininst.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\skininst.exe" -reg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  PID:1576
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baidupinyin.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baidupinyin.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  PID:4604
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe" --location
    3⤵
    - Executes dropped EXE
    PID:3220
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --install
    3⤵
    - Executes dropped EXE
    - Registers COM server for autorun
    - Adds Run key to start application
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:376
  - - C:\Windows\SYSTEM32\RegSvr32.exe
      RegSvr32.exe /s "C:\Windows\SysWOW64\baiducnTSF.dll"
      4⤵
      PID:5000
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        /s "C:\Windows\SysWOW64\baiducnTSF.dll"
        5⤵
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2348
  - - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --startmenuopt
      4⤵
      Executes dropped EXE
      PID:4844
  - - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --vistataskscheduler
      4⤵
      Executes dropped EXE
      PID:2380
  - - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --filesec
      4⤵
      Executes dropped EXE
      PID:4336
  - - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --whitelist
      4⤵
      Executes dropped EXE
      Modifies Internet Explorer settings
      PID:5092
  - - C:\Windows\SYSTEM32\RegSvr32.exe
      RegSvr32.exe /s "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BaiducnAx.dll"
      4⤵
      PID:3948
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        /s "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BaiducnAx.dll"
        5⤵
        Modifies registry class
        
        PID:4520
  - - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --install-shell
      4⤵
      Executes dropped EXE
      PID:4276
    - - C:\Program Files (x86)\Baidu\BaiduPinyin\IMEBroker.exe
        
        "C:\Program Files (x86)\Baidu\BaiduPinyin\IMEBroker.exe" --quit
        5⤵
        Executes dropped EXE
        
        PID:4848
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe" --setopt /Command/ImportSogouDict bool:true
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3924
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe" --setopt /Command/ImportQQDict bool:true
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe" --setopt /Command/CheckImeSetup str:AD
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --set-first-ime
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --fix
  2⤵
  - Executes dropped EXE
  PID:3436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BDDownloadExe.exe

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BDDownloadExe.exe
Size 367KB
SHA256 7f0205f152c43f56f03ba19799ceec4390dc0a3ae7021f602e5aeafce6c86030
MD5 95a8e6aed4214cff2cf194f64e90f533
SHA1 4cb80a89d8f164291b3b0b6d73ad4558c7e24aab
SHA512 e2d7287326ccb507548d4f202a585dbe4b197ea3175a2dc238f72fc9bdd02018005515298ea9211af6157f4133d80b975f3567965b5b5883ebe0823a2529a357
SSDEEP 6144:AJwx+zTO02TvEUSzi1G6/InjNx9LtEmCR1/gxKrpU1QUTivt:AJwx+zTBtzi18xzBEmCRixBivt
MD5 SHA1 SHA512 SSDEEP

Submit Download

BaiduPinyin.exe

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BaiduPinyin.exe
Size 2.8MB
SHA256 020f509f0c15d6c123b02e790d4d3d674a781ceeb8d6b304bcfb7d57479c5b36
MD5 080a1318a5e18553f622ee9498e1a99d
SHA1 8242034ceb4f3333c410478499f02885044373c2
SHA512 c90571a169099ad0973c090de7a1434f52bdef635730fac44029635ca91870269237595f81b6602dbb8f5cd077acafa2d36380776a3707d94fb1e8668070d1c3
SSDEEP 49152:7K/DSYCn9Kweq0WbJ9TvKiIVpbOPBVyW4/clbLZzj1Tl7Aa74ETnQgIMbMxx++s9:7KLSYCn9Kwe2bzKiipCPBjtL1j1x7n4Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

BaiducnAx.dll

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BaiducnAx.dll
Size 143KB
SHA256 a1ef06a36509ac868cb1a731183330644efe37fb35a635385a5ac4c50688bae0
MD5 e41852e853a50d8a0cab5e684b781959
SHA1 d13866acbc0f173c3b398ca3a7dc90c4a5cc4963
SHA512 cf06047e2a859f8f78725bc3ffaf16f790a706e3a1461da81287d3558be9ee225110efe70245c6625a54854af16b95116c6a8e67ddbcda6a6b7d2375c27f36a8
SSDEEP 3072:y6jEV++Jcz4yUuu16Sr+m+6cq1QnvDOM+ozqHrGM67DuuuyeqCnRlFq72B3dk:bjEg4cz4yUuoAzqHrkeqCnRlFr+
MD5 SHA1 SHA512 SSDEEP

Submit Download

IMEFREETYPE.dll

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\IMEFREETYPE.dll
Size 762KB
SHA256 c6a521c1f3c2611e063d4929fb4a2c466395d4a54a17b6c1036f9e92a0d3ede2
MD5 8d82ce7a07be1b62440c0cec4e170a15
SHA1 3c6d41dc25978907acff8369778b4e352d56ccc1
SHA512 033f08cc83b6bc911c5cb136e152b920cb7193b1ce6e4529a84260ed0225d814059a4a47c603070db6191a86ddef4104e3eec712bccb8f0d2d0b85050612651f
SSDEEP 12288:Sutzw9mpKAc/v4yCM5oJC/iUc2oEzy2HUGxKslELVQLdhZv5zrCDSJfEWmQg5izm:xz+/CMfxoEzX0Gosa2d/v5zreZPYq
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.ini

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\app.ini
Size 2KB
SHA256 d9e8604274f890c75250ff38ddd069f4c8c412c8b3cf8a98e67b2706bfced59c
MD5 2acb717904708b6b98f41dc5f2dd17d0
SHA1 4a2460b5904e20339109bd4ef04b0f43ad3bc30b
SHA512 e736e4c7e0fa239964546e2d4fa0241e80f82fbef7acc31b9373e6c9c02c99b09ae20fd402fc922bec9288537588e4b91ebe1970651ed87877cb2bdc93b2494c
MD5 SHA1 SHA512

Submit Download

autoupdate.ini

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\autoupdate.ini
Size 1KB
SHA256 ca25c996b6d5ebe5348c6baddd2073309539171bcf706e6c6c1d06e7ce421ffc
MD5 3c45a3efd6faca8afd99af299c37b0a2
SHA1 3f9658399ed8de6292e7cf7c16060248c7114f90
SHA512 21f708eabc7152beb7479a3fa7c19c7b95028f3f78fd34c15fb180a16b03c0b02de290dff611692acf2c80cd5c9885e7818cf312adcf859cd975ca1c79b913d2
MD5 SHA1 SHA512

Submit Download

baiducn.ime

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baiducn.ime
Size 399KB
SHA256 1ef970a39e17a0f1188f7ea88a871a833613b0fbc5fbc028f2a29bcddba72159
MD5 56385cb44bcf0b46d7b27ae70dc304f8
SHA1 f488aff961286a852fba6f887ba9369d7dbb8bbe
SHA512 37725ad5e9599ce7db125453a4f63ead7d6648dca65ab93bb5ed6888404a04d86dfcea1d0a28ec4a005449d1246a452e03bb4a8bcf5c4bed42071cb1c2afb681
SSDEEP 6144:CJzTRnEhsCcX6Y4TS1hTDyddl3xXx3l6z3leCDwC723jCYZn:CJRnEVtTS1NyddBlBlQeLAkCYZn
MD5 SHA1 SHA512 SSDEEP

Submit Download

baiducnx64.ime

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baiducnx64.ime
Size 469KB
SHA256 a00392e1f6c235507cf6077f16052216de8c50ea3c601b32ea8f1e75f447d650
MD5 385de7eb355e2b67bc8efaf1d28db78b
SHA1 f8dcd255c7160347af343bd6824640d1960a3afe
SHA512 95461dbb67355cd44ebe0f8ae124bd878a7588e09ef9fc682ac256a1c5c243f5d1ffcf1189f714670f4298ce8e67e6463f98bb83540652edfaddd55e3d173267
SSDEEP 6144:PvYRf/PwlB6eem7wXJhGxw76qlYgkHd6TOsZEkMXMRIljgTVW807VcsHCP:PvWfQH7wXJhGs60vkD66jgYna
MD5 SHA1 SHA512 SSDEEP

Submit Download

bdaucommon.dll

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\bdaucommon.dll
Size 139KB
SHA256 6a2b893de7fbc1c0c507a35c14882236c326f553baf07409cd358308eefcb5af
MD5 93bfa462ede419250bc876b2884ece05
SHA1 233a8a946f119492b8fa2b4b8993e5d3db00acfe
SHA512 2cae7a79f3adbc23fbd7a84689321b438596bd9cec5b2bca274f0d67ae0bad7b9b984ba352256fe6079338435958e28923915d029bc4b2e52fd04dff61312245
SSDEEP 3072:bcsjwl4M88+67C+5+/QLmFQyA1Fq7Aasxh:bcsjwfK6XDJLquxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

bdnetdll.dll

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\bdnetdll.dll
Size 195KB
SHA256 0be32940021bce94782662b3377e2658600e0ada82ad3ce561b00a3abfdc528d
MD5 d55a908913b1f2bc2e9e0195472882f7
SHA1 627509ef0575d389e39a2dbae82e94da50346f2e
SHA512 1a500d47e0785a0467e29a4986f0dc658a9c105855d70d4c17d4a8df7d5354d808fec25f79bb507719eeb93c1a5db49a006e291b1ea4dd18049c1d94696d5eea
SSDEEP 6144:1PFI/ProaxjLckVqiqONcmxAI+BNXcNtLF+sK:XB0vckVqBONcmxj+ANe
MD5 SHA1 SHA512 SSDEEP

Submit Download

thumbnail.dat

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\thumbnail.dat
Size 376KB
SHA256 0b07258015b5e139776c9be53965f4442bfc9d7265db93665f2a10a166fb04ce
MD5 3c11f16a387925e9c088b0d819795bb4
SHA1 bf99c57feafd149b93c73fac2211b8be00b3e536
SHA512 2a5cf1c37d3cc67709a427a5831a46218e15550054896b333c5ec9a7f6b370fb271d06696b842c2dc55947ed9dabaea5fb9bb1c859ca4132106cc02c590ab1be
SSDEEP 6144:ssamHXkRHi5ekOzEXNuXPu5gRKeWo2aimSYlW5FExzhvBQyVPs:ssamURC4kO4uXPDR7Dr+7UzhvaY0
MD5 SHA1 SHA512 SSDEEP

Submit Download

dummygram.dat

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\dummygram.dat
Size 16.0MB
SHA256 8f34cb39e843f2569e530d13f9583d385d80273c7f0a7bd3227fba11336527fa
MD5 df695d1bb876e0aff16e80d37c13a045
SHA1 bfa3f935d0259f103213c86b19643c9d0e839d31
SHA512 8ad735da6d0cb7050474d53787bbbcf371cdc70ba6bb54e8b649331570f29f99f609ad897178f0c430548da245a31ffdf0db8f4cc1931f7bb1837d273d4d02e7
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

engraw.dat

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\engraw.dat
Size 385KB
SHA256 835828871ef9af95f85b8f249f2cacdbbae6c73ef802448f7c59584eb63265f6
MD5 5fba35a5c0c99d59803bf9d2590c3f82
SHA1 8e8e082647997cb688effe79ec12529bd03e9987
SHA512 4217349c66ee47d096d2a4c19fa408dd6f08a09a9c47cb9493b5a2faff6f3f4f0d855cf02905f24f0a8d1ce6bb1d4d561c4f69a1378b09ff473f997855ddedf2
SSDEEP 12288:vHbHS3hChqyZSxzmKaEfiwpzpIStjI2ob97i7/3r0f:zEpiUIkkSq
MD5 SHA1 SHA512 SSDEEP

Submit Download

rawdict.dat

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\rawdict.dat
Size 6.3MB
SHA256 1d753a7609cfe79ec3abc6b2c0c6d552f29caf1251ffae2cb8fb81a71d80ee84
MD5 d28c28b7d005a754a60839b4091aa556
SHA1 90e2b7ef24d2521b66ffa793d19dd7bbe8fe3bbb
SHA512 96a754995b7751cb4a0df624bd8f4975b9fa40ef97329a798abf47197537c62f51f1b47900d82be14f2d2d2785e963897ab6f7cb713e6a76fef0107c4517c089
SSDEEP 98304:bcocUaYiGVOAl4PZygFRoZ26PhmRUVutVutJ04cZSAEgnX:bxL6XRo2GAVIJMSAEgX
MD5 SHA1 SHA512 SSDEEP

Submit Download

rawgram.dat

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\rawgram.dat
Size 15.1MB
SHA256 5f6bd5aa51cf2590579116816e87a26617f1424fdb00f4703dd4ee9429d425e8
MD5 2e1b6f915bc3efb9bd950099e9a25fa2
SHA1 ada21f4380f5c2bbf9a023fb3a97c6abc67d8552
SHA512 771557c762acab825f5f96bc83cac0612b5551f2c2d85406fe2288aad9aef9a17b16769ba29a7b5ef5087f17b5f2d0538480b3c16f809c5b52fb1afc4420f51c
SSDEEP 196608:gSEVbTjceuOZ+iofqZVwaWyBVmCRqK+dIIj/Ug/EkzEfB:gSEV/weuO+IVwaWyBVDAPjFREfB
MD5 SHA1 SHA512 SSDEEP

Submit Download

dictbuilder.exe

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dictbuilder.exe
Size 264KB
SHA256 9415b6d6014edb194cb9e428e77900c37b1b9a950e2c97bd013d4af8f5e8455a
MD5 78b547129a5af3251cd3a2cab4107d4e
SHA1 da5d2da96f238fa327cdea23225b08f813d5504d
SHA512 ef9a1edb6272e2eeab04eeb142c5f0a7806f4e96335a1aab6d391746de795f00ea62c06ecdf0df7bc5e6933e1961afa94df11639ff5f16d0bae871a584b3bc48
SSDEEP 6144:UlhXseJl5Yr0wcHrg5p4RLjqEr0nhQFoQ7u7:UlhXsedwcHdRLjqEr0iFR7u7
MD5 SHA1 SHA512 SSDEEP

Submit Download

imeconfig.exe

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
Size 3.2MB
SHA256 5893e51697c153e3ef8b257cba716577b7cc3e82fd0a8fbab51189706dedfc40
MD5 0ccf4e1bd3bdd1119d96bd92b89e6a76
SHA1 9b00ad3520a26a9f6e0644c2796c85d8ae54c47d
SHA512 e259835f453a9d7a3ece6e9b79d087ec7d596810ed072964e38b21eca613c2321b3964ec79806269eb6abcda40aafcd9d5e82f360018cbfa1e86266baff8507e
SSDEEP 49152:ydt/RvPpU+VzIoPlVmZxQkTXp6Iq/P9Cp2ZpMYDvj80DKQP04p9VJPl/+M:u/O03mZJrQ/Pop2gc1P0oVJPJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

imepng.dll

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imepng.dll
Size 298KB
SHA256 bb0258c4b7ea8543f2f5aced98081d7a973f337c57be08f294ab189d13e7c417
MD5 40e91fcd84dafcc606ccc876f991a7e6
SHA1 21e2dab15eddb84c631838e1575a72598e9355c2
SHA512 dda11e19996c688090776fd3ba1428af05fb234a51947e4692b83cd11eff3ad39d7a46e481c536f0aea780c827c8169616ff74b2b9b5aadb4abab11b1e852693
SSDEEP 6144:Z1saTiosK2Gbf1TwUoOAkKdm8axymAOBAO7P5:jsaWosTUM3axymzRP5
MD5 SHA1 SHA512 SSDEEP

Submit Download

imetool.exe

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetool.exe
Size 432KB
SHA256 b764d5cee51a13554e07e38ddaab5cfdf25227d327df02b812601a02aa2642e2
MD5 2bf4df93da74877391e02f8e69aa452c
SHA1 943dac0ffcc567acfca7903ce673ed67052786ca
SHA512 4286351471213fcbee9546e748c806fa7831d828a3f5a21c83cf0f564bba34b28c9af7ddd8e106ea82f82f625a5244754491334cf85e084b25d886f3aae0bc14
SSDEEP 6144:57Rz3i8qenDjedtWGLzv2kd2EUqRISBEL4F4MzYW10xFvgTpVUSRCfXA2:57Ro+3jGOxQEcaMzYQ0xFQlMXA2
MD5 SHA1 SHA512 SSDEEP

Submit Download

imetoolx64.exe

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
Size 495KB
SHA256 ce79fe1a0be452b78b8bd2a550938c77f890106522de4a1e40f9b2c11c9921df
MD5 9af35461fc6335a68a453200ac3aedd3
SHA1 316ce402638d3ba5f14bd4d73daadf11e714b956
SHA512 30d66a6517d6d240f78fb9aca1c281c3ac9f93cc9eca181cc0b5c1907d3e0912092311b289d7a8283130de90953613850005f8837dc3ff0d1347f1356d1935d7
SSDEEP 12288:qr/0bQ+4MsJesRkK1TmHfhAJl9gCqrCbkH:xQF9fRkKkqna/rCbkH
MD5 SHA1 SHA512 SSDEEP

Submit Download

imeutil.exe

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe
Size 105KB
SHA256 756d55a8085e1b07695eb90db9266e98a0f0afc67ae188867eed96badc3d59ea
MD5 2ff02072877da8f34f9af9928aa5f5b3
SHA1 d9e5bee9e783fecd13e95e2cdea37fcaa9a1cbd7
SHA512 9f340860dfce4f20b674d8db7ceb15af5dd618cfb6e75a154c043a16a2fd3e57a97b763cbe84a945d06ef324b11f2b6da4ec798fa536033ccf76de2a62787c1a
SSDEEP 1536:3ZKMAWwhKPdKx7Pwh/kd/DW9RaF7CkjMJPwEuC5vICDdMO+:3ZZBPdKx7PM4CSF7CkIJPZuigCyO+
MD5 SHA1 SHA512 SSDEEP

Submit Download

imezlib.dll

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imezlib.dll
Size 186KB
SHA256 183db759881d0213aa708410c122a7373ba08dbe122343b6acf9292741108d97
MD5 de63b59c6697079ecc7646589deaafef
SHA1 709c2d6058556dd0f9d46ef840153249cd60d94b
SHA512 0e8493cc0f1ee0666305c06928d4811563aa07187bdb3146bf21b3446e946e6f582c7e1375f32281b259163de72a0d54b0ade097843bbfdd5ff599d444f54573
SSDEEP 3072:UBC2p4OmXb7mn0011Lmmca9WrBsSTBIPpoy6tAonOahhMAEfDx15czTBfhr1+yMd:Ulp48P2trn+bDnITBpr1+r4M
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl.dll

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\libcurl.dll
Size 295KB
SHA256 4352c68ffc4308c2e24acc19608318a52dd0a9f362f1cd2c8ff07b55ae37dde9
MD5 60054f32651599c68fab41b220f476e0
SHA1 281a63035340db32bb7d55e009f8097546f4aa9a
SHA512 daa3431d8d70b0278a13b04dc1d74b44d235296c86686fc233dcd23af963bcd5977dd97ea5546cf548e222fb43f7bba5db350f1de1c2fbefe1379c717d8e2a39
SSDEEP 6144:8NFZnCbaeSdHibiVe1hrru0styuYZF/oNf/+rWF9GZ1X:UMbaLdHibiVeXqEZFQNgQU1X
MD5 SHA1 SHA512 SSDEEP

Submit Download

libeay32.dll

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\libeay32.dll
Size 1.1MB
SHA256 1f649a43e098fef9be0cbdf6f57b1afd3aa14d06c5c1aa82f5c26b769f04f141
MD5 b8a2583697545aea9baa1383f9796368
SHA1 a8d5fa264d96e70e36461d99a44a9a39cb186730
SHA512 cbb43e7b2cee7d76ac026ec3deb9626c43d6acbc595cebd41293cc1045808a7f09da19ab64c7b0a44432281e43e4904432906f5c3dec6bb1f3c146c907fc6864
SSDEEP 24576:+BUrPO3MnizSE0avVN1+z+az675sPEaHlZ0/tP0V1Sg6r:vMMne34D27QV/0/tP0Vsg6r
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp120.dll

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\msvcp120.dll
Size 444KB
SHA256 87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
MD5 fd5cabbe52272bd76007b68186ebaf00
SHA1 efd1e306c1092c17f6944cc6bf9a1bfad4d14613
SHA512 1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5
SSDEEP 12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr120.dll

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\msvcr120.dll
Size 948KB
SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
MD5 034ccadc1c073e4216e9466b720f9849
SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssleay32.dll

Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\ssleay32.dll
Size 267KB
SHA256 6f34c5eec35a9f5af26cd163792c53fbd30ff0d04110f6bddeeff413f8dea10a
MD5 0f6f9f42e4dd9dcd5715955e3838ec4a
SHA1 f93a11370df53d30a84268b003fab1b8eb2a3960
SHA512 ecc9ba94660d2d3ea7a80e2a67e3db129e983d33697fa5da6c000a7b53c3e3a1460bedb12fc82af422f03c9e9c097335e9704dd21ae9d7b4baa78f19826c4920
SSDEEP 6144:mrPAiq6odbKWMZ9/wXDwguE4dz7l0u4WPMswLdV76zUETWV9cEoUQXbYGWAaHe+g:a4z6odbKWMZ9/wTwguE4dz7l03UMswLu
MD5 SHA1 SHA512 SSDEEP

Submit Download

IMEBroker.exe

Path C:\Program Files (x86)\Baidu\BaiduPinyin\IMEBroker.exe
Size 161KB
SHA256 044bea17ccaff8d1bd437dd13a0d37798ac1629f7fc6fb1cf6d5c4d0e065e5f4
MD5 59294fde17337c3b141160be336fa7b0
SHA1 59331a76ec7bdb6ef4cf3566391587229b942378
SHA512 f9be627ce0587e89132e013000d88db0b943f6b11e630e78aefd2f347a12f7ddf30b0a71ed5049017f2148083166924bc2c6ae35ed9d635c492dd84312d0e414
SSDEEP 3072:KeibNPaI/4ZbNzl+MP+jve2cM0ZyHbwCzDx/ByPC:KXbNPGdXAGwey7wChBKC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Global.db

Path C:\ProgramData\Baidu\Common\Global.db
Size 52B
SHA256 4e30e884a31111183e8e977097d705ca6bc8ccadf78fc1b9d808b6d18dff4bd0
MD5 99ac85892f568349d7942cb78af5d545
SHA1 6f53513297e3073cb7f893065629b9ab2fde0d7d
SHA512 04b0752e4928bf4ae72bf6fe05ee6b4ba89ed17a71c4d16f59a51f198ba19b7e88f89a6c380bbd31f0e7edadb822beb492e2222f49ad5e95991050387a17ab47
MD5 SHA1 SHA512

Submit Download

Status.ini

Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Account\.common\Status.ini
Size 2KB
SHA256 399a12221fd6d51ac890bbdec405f273e9bbf4019a518e1052d047f9920d985d
MD5 d70248770be7777240dbe5753664332f
SHA1 484e5b2fc2f5754f6e8f5cf17674f2e60f9052e7
SHA512 877dc78d9cbc28d4ecbdd8ce015a11b2560c29d21d87db7f77526ee5cd4e48c6ec4cfe82b62fcc34bd62c60179c9d3d487ee6cb72899fd80f4ffc2859c8e462b
MD5 SHA1 SHA512

Submit Download

Status.ini

Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Account\.common\Status.ini
Size 2KB
SHA256 490eb980fcddc45c95e6c8755c780230a26d3c208fcb66b5b4a8cf6c086217b0
MD5 007bfefa784576362f40bbc274bda342
SHA1 ab4845a7cfea0b64e8e6e0b71c84e34bd1f106e6
SHA512 0cb43c0c4388df2d13560055ec17062c2218c531cb803857f1d32e3b795d82a18f048020aefc2d02c79ece6657e57591472d3d08bedbc4c2c1da8377502df8d4
MD5 SHA1 SHA512

Submit Download

Status.ini

Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Account\.common\Status.ini
Size 289B
SHA256 b4d810cac49676bbe7afde55f2460d4ee558ccb051b873b084b1ce310660a2c3
MD5 594a495ab13f9e25f437986639e3574a
SHA1 c15ffe9884ac5e1b1765c83241be0c01dc315fbc
SHA512 08917462657248b543cc2b3dc4737bea8f3dca3984df6c3bd8c505eae38c025c9f404d1e77dbb0b4bbc9b1259d2f1c9d7c8387fdc696f06e5cf585c824521719
MD5 SHA1 SHA512

Submit Download

Status.ini

Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Account\.common\Status.ini
Size 298B
SHA256 82b44f7d3c42a49e3605edd1602c2fb0d51339c9a3811e300d32d263c3833df3
MD5 15b856857e9fad9d5436acb593cf688d
SHA1 010aefc1127b863ac928128414c342898f81e460
SHA512 372135a9b7473bc064674a1695beeb08c56694255989248404ed6dae70f48e6523e1319df15b9e7ca52549554376ef3f64433549c9d47148b53caf7d48fbf109
MD5 SHA1 SHA512

Submit Download

Status.ini

Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Account\.common\Status.ini
Size 1KB
SHA256 6c9c776d1df3fedeed4902d4aa44c49a5208be023f3d87233154d043f6f59b21
MD5 30ffec8b2af9a7c8a2d5644e6251d6b0
SHA1 7048cfb42593b4034bb9e2add9280379d08e7187
SHA512 d43904d76f69b6ab8870a0a383474d2784cad3adf8b95e106ecebcf57539796b9c9bfd427bbfaedae4f3e1f0bb04a29be934b116c44e34a6788f169124f02977
MD5 SHA1 SHA512

Submit Download

Status.ini

Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Status.ini
Size 5KB
SHA256 5dcfe8f475d189e359d94fe2f6711aa9abcdd9df89aaaf95bfa674f16246c499
MD5 79c420603af7121212eedbd9ee9dee84
SHA1 3de545f2c48ed6a4c41e54967e73a76ef1f26eff
SHA512 515d0aff0fc684c59b37e70fd04e3a4589c77ccca8ba7187b535957f2c0333074fc7ae07d7c853224c6b2949b2aeaa448347b903ad1b5bf1613cda67f80dc036
SSDEEP 96:zQ6+4nHrCOTSrbjE9V9s9Q9YDu+cHgtuRA4gqN6KskORRORyWOR0ORvy:pHrCOGQ9V9s9Q9DbHnRA4gqN6Ksv5y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Status.ini

Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Status.ini
Size 5KB
SHA256 dc87b659b0e419e027cd26075f98b9894e2abfed8f221853cac977fc82a15f79
MD5 5095d6f6058923fba98bbd76a8d81e93
SHA1 b2076e8747c9c6e80f7b757507adeea3d1a382bf
SHA512 64b8f91bf88ec17cdd03485656fac0212fff2bd807ff82a0dfc794e0d7fbf39195dc78fe581f42420c34c7bc1ef0c943d2fc1eaafb3772e096650fd7a467323e
SSDEEP 96:zQ4w+4nHrCOTSrbjE9V9s9Q9YDu+cHgtuRA4gqN6KskORRORyWOR0ORvy:0HrCOGQ9V9s9Q9DbHnRA4gqN6Ksv5y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Status.ini

Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Status.ini
Size 287B
SHA256 ae7b8647c037e8209722004771449f342a7b93ae182a0cc348cdac48bd3ee47b
MD5 2c1b855de8e0f5b2903e124284b2a1a9
SHA1 70e8018494ee11124cfe454409d3512c5452dce0
SHA512 e7497892a1b444166c77294a241581bec2c61a1215adc15742c0374007f1e8531f2ac74c37288ad5d8ef80b3716d2b3549f3426eb616478e20f514e823826270
MD5 SHA1 SHA512

Submit Download

common.ini

Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\common.ini
Size 568B
SHA256 2c6c16ec784410c022bfe6dd4618fb2f4cff421c0cbc151707afbf9db0ad3a3c
MD5 0fcd28ed0e69ca531809e8e2058eb246
SHA1 5d7a1862ee5c8a708c91a9866b503d87cbfacc84
SHA512 276995e090a70844cbc912d9660d39c33dc5f8eed0985dd5d9c8b56a360c933f2ca63cbf32eb548031b4557260f0b720487242b2fcbc63e7e4e6937c2ac887c4
MD5 SHA1 SHA512

Submit Download

config.ini

Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\config.ini
Size 180B
SHA256 eabd7d3be7320da61a8b08a0453b0b321f620eccd213b9aa0bd7c90fa68f6d05
MD5 59a10c16c431344055a320b52861ade8
SHA1 ed325976a2a4dccb09a6cd21505ded5349774051
SHA512 63fed95535e8cc7c72e81b2ce6493b038f0e31eb5cee9af6332d8530eb202a580efe4a41069962e90129fa548d088ad1c2c9bcc159bf06c4a20a5c81c620e905
MD5 SHA1 SHA512

Submit Download

Protocol.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg6EBA.tmp\Src\Protocol.dll
Size 668KB
SHA256 7c301b9c44cae3a53a4f939a391ae36e79e29f9216fc903665b4551426cecd90
MD5 a438e303cf31126c5d6b882aeded21a8
SHA1 eebe92a2e07ec209e6c366899938d2f7677e9977
SHA512 ddc47c35d7b662e939d471e07f5f45e979abd4df14b334c5c12f229f7d185bb9925693d9dd71e36c97eef02c92f961775f5d7cd605b36af9e6a5c9d83af3964b
SSDEEP 12288:dmaGqDdZHrLgjYSrXJ2YSIAkL2dFHZluIqNqSayOUpJyOwC+ATO3se:Y9qDdV3YWKNoSrHpJTNhTcse
MD5 SHA1 SHA512 SSDEEP

Submit Download

Report.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg6EBA.tmp\Src\Report.dll
Size 316KB
SHA256 3347ab083d69d9d4bf6c8e6816c56a1eb694b581721965ebd44d240fe956e164
MD5 98a2b4d094fa825e601b1f68752d4ac5
SHA1 0197c18e2443b53add35870df81a0123acbaa0cd
SHA512 47ef8d5ee9273a41169ec522245869f6d9d90b840d56d88e68bd693b4d1b4243b005cede1a5f9420ff1a5240f7de8ba7a5b915b846af9e1c57a0d4eaa584d53d
SSDEEP 6144:1Hmqik5oLytEct4Cz7UWi9F5ZqDvdVfb/f:pmqik5dtEc6Ccz5EDvPfbX
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg6EBA.tmp\System.dll
Size 19KB
SHA256 714bd22a836a7f164b848541b8bf8ac80a20ff38e10e412bf9ef518620a80b8c
MD5 35d7b29c3ed690a8b0cd323917677b42
SHA1 ad74d2babe09f94838e408c8f9f77b6b56c644f5
SHA512 abc6f37b7306de737adf998607e81304ecc1589ac8e3164651b237def11b424a190e84608f4f6ce44a63ce225d93be7c617a736c82fb6b9077c5222c2e17b67d
SSDEEP 384:4JoiO8V2upW7vQjS//nYPLQa6jvjeMN+:4JzO8V2uovQjoym
MD5 SHA1 SHA512 SSDEEP

Submit Download

chkm.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg6EBA.tmp\chkm.dll
Size 74KB
SHA256 2061a94b4d34a77f935f95a3741f917c91b27d0e1585c2ee2f8e00806b671db7
MD5 3b8308f1dba641b49a642fa6d92f3451
SHA1 a11164e08bd9c594b6d608c51a2428a4c6b555a2
SHA512 dc089fc2bb43ccfcca8748013636e8d249cd91e1b08b30358d00df0decaec5782d2af85274e7b70784d4e58c934dfe5112fdcb4006de2a5dbe9c76dae9ed1f81
SSDEEP 768:9elCeN9djBHTUURm58yTOM30Hz6pW+QLqr69p4R1t8iKkEL:9elD9djBYqyTOS0T6UBLNWt8iC
MD5 SHA1 SHA512 SSDEEP

Submit Download

insthelper.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg6EBA.tmp\insthelper.dll
Size 774KB
SHA256 d62d59db60544bd44db6d710f3b6d48608bee022d908dc46d16885e79dd1ca0d
MD5 8bcd300c69b67e78b09cf07aecfa14fb
SHA1 d92bdb71d8b8477a3f0838360191aecc459a3c09
SHA512 393667c3423ed6defeca5c7c51c3244106ebb737398b34822a38edf9fa68cead72016a77c29d4f47d0c5c784c6339e8080d3b35eb17d325658a951c464951cf4
SSDEEP 24576:Hur3XYYvDFTBs8N2x0y7J07fGYQ0gD8H9V2SM+5byEziR1BRWptMYabpeB:jp8JQPIFz41BR3bbpeB
MD5 SHA1 SHA512 SSDEEP

Submit Download

reportsetup.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg6EBA.tmp\reportsetup.dll
Size 309KB
SHA256 210876c0ff70ffaa88a05f9ef794a96136549f4168e940e256fb4ac85b0fff71
MD5 52c3b9ac0484ece3b524a9526272f88e
SHA1 c07268de6a13290acbf58ec5ef75e2468533d791
SHA512 da7710404e5630509eeaf9e318e2a4a2d9c4f269aee6cdce5d2a8f128094e7c92940312fda9913f5c44dce5159b59159f40137ddb2e7975e450f30c6a7b24f47
SSDEEP 6144:9TTPaNT41SBzliGz6WXKzoOCEIMzjKTBR2Z4kgg6D/Uuc:NrmT4uxiGz6WazojEfnKT/2Z4nD/Uuc
MD5 SHA1 SHA512 SSDEEP

Submit Download

baiducnTSF.dll

Path C:\Windows\SysWOW64\baiducnTSF.dll
Size 518KB
SHA256 aca42b70ee70806ff6a298acbfda17051f3514073ba1bffeb64006d56d75a9ea
MD5 047883fa5f336320c303345fd0c2a37c
SHA1 d5a647ce1dde1faa4128c1db5c82851ca73716a7
SHA512 b8e8032fd8c4a94fa7841bfa4a9b89c894766cfebb2702da2570acddee1c161c7a12551f51d3dce81fb10d55e56075c226843d811a20ef6cafafa3e58418dd48
SSDEEP 12288:L8C2fjK52mqnLcnZaH92VQmrxOi49fnlLc1:LQLKclnLcnZaH926imnlQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

baiducnTSF.dll

Path C:\Windows\System32\baiducnTSF.dll
Size 606KB
SHA256 6717422b8a66c295cdc52624794354c642c0f5b3c9fc945e17c700765815a2ff
MD5 523d13d373e36022819a8bfd4106afa7
SHA1 928fd5209a568333193b4327897fbcd25829a876
SHA512 d5be101c0a4c7bdf5eddf351311e8a7db74d2fef8f97171e3ea0820fc7384c8505915ecfc774f70c519ed87807173397f6771d515bbc816d113a24460b72fafd
SSDEEP 6144:xcJm0Rw9xBAjnUnqUeuUIrRW8EDva30ASTC32n1g+tdtdWqcQm2f9lGo1Zo+0wI2:qmRb9R7RhUa352nmEm4yo16+0wMNty
MD5 SHA1 SHA512 SSDEEP

Submit Download