ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 07:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
Size

34.3MB
MD5

eae3424e1df0a620c27913077106d1f0
SHA1

9de4b609d8295c632b672caedb88c9fc6ee0ec08
SHA256

ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7
SHA512

18ddd9107516bac217cc7a429ced0b01fe370173a9a6adca895c25275aa8dcae6b60c616e785db2159affdd1a5e00a33aac6223cdd5080588ab7b1c8bcce3533
SSDEEP

786432:1KuznJ/p8sjDi6mWcQTmbq2SsOP5uAgCcMyszWMA4q10WIE10:1vzJlq2czu2nKLVtnq10WQ

Score

7^/10

bootkit discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 34 IoCs

pid	Process
968	dictbuilder.exe
4716	imeutil.exe
372	imeutil.exe
4800	imeconfig.exe
4572	imetool.exe
4468	imetoolx64.exe
632	BDDownloadExe.exe
396	imetoolx64.exe
1932	imetoolx64.exe
1916	imetoolx64.exe
2300	imetoolx64.exe
1620	imetoolx64.exe
4984	imetoolx64.exe
2640	imeutil.exe
2520	IMEBroker.exe
3908	imeconfig.exe
4916	bdupdate.exe
3404	baidupinyin.exe
2436	cellinst.exe
3788	skininst.exe
1828	baidupinyin.exe
916	imeconfig.exe
1372	imeconfig.exe
5068	imeconfig.exe
3080	imetoolx64.exe
1700	imetoolx64.exe
4088	imeconfig.exe
2044	imetoolx64.exe
4400	imetoolx64.exe
1976	imetoolx64.exe
4996	imetoolx64.exe
2320	imetoolx64.exe
2008	imetoolx64.exe
4112	IMEBroker.exe

Loads dropped DLL 64 IoCs

pid	Process
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
4716	imeutil.exe
4716	imeutil.exe
372	imeutil.exe
372	imeutil.exe
4800	imeconfig.exe
4800	imeconfig.exe
4800	imeconfig.exe
4800	imeconfig.exe
4800	imeconfig.exe
4800	imeconfig.exe
4800	imeconfig.exe
4800	imeconfig.exe
4800	imeconfig.exe
4800	imeconfig.exe
396	imetoolx64.exe
2664	regsvr32.exe
2640	imeutil.exe
2640	imeutil.exe
3908	imeconfig.exe
3908	imeconfig.exe
3908	imeconfig.exe
3908	imeconfig.exe
3908	imeconfig.exe
3908	imeconfig.exe
3908	imeconfig.exe
3908	imeconfig.exe
3908	imeconfig.exe
3908	imeconfig.exe
3396	regsvr32.exe
3396	regsvr32.exe
3396	regsvr32.exe
4916	bdupdate.exe
3404	baidupinyin.exe
3404	baidupinyin.exe
3404	baidupinyin.exe
3404	baidupinyin.exe
3404	baidupinyin.exe
3404	baidupinyin.exe
3404	baidupinyin.exe
3404	baidupinyin.exe
3404	baidupinyin.exe
3404	baidupinyin.exe
3404	baidupinyin.exe
3404	baidupinyin.exe
2436	cellinst.exe
2436	cellinst.exe
3788	skininst.exe
3788	skininst.exe
3788	skininst.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1828	baidupinyin.exe
1828	baidupinyin.exe
916	imeconfig.exe
1828	baidupinyin.exe
1828	baidupinyin.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BaiduPinyin = "\"C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028\\baidupinyin.exe\" --autorun"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BaiduPinyin = "\"C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028\\baidupinyin.exe\" --autorun"	imetoolx64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File opened for modification	\??\PhysicalDrive0	BDDownloadExe.exe
File opened for modification	\??\PhysicalDrive0	baidupinyin.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\system32\baiducn.ime	imetoolx64.exe
File created	C:\Windows\SysWOW64\baiducn.ime	imetoolx64.exe
File created	C:\Windows\SysWOW64\baiducn.ime	imetoolx64.exe
File created	C:\Windows\SysWOW64\baiducnTSF.dll	imetoolx64.exe
File opened for modification	C:\Windows\system32\baiducn.ime	imetoolx64.exe
File created	C:\Windows\system32\baiducnTSF.dll	imetoolx64.exe
File created	C:\Windows\SysWOW64\baiducnTSF.dll	imetoolx64.exe
File created	C:\Windows\system32\baiducn.ime	imetoolx64.exe
File opened for modification	C:\Windows\system32\baiducn.ime	imetoolx64.exe
File created	C:\Windows\system32\baiducnTSF.dll	imetoolx64.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\ic_quick_10.png	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\skinbox\images\ic_collect.png	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\emotion\images\scroll-bg.png	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\PersonalCenter\js\achievement.js	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\dummygram.dat.tmp	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\UIPFullx64.dll	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\bg_facebox_edit_lab_recommend.png	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\configure.dll	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\30264a2f29e718b05e1374efe65f846a.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\PersonalCenter\images\medals.png	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\btn_facebox_packgae_add.png	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\bdupdate.exe	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\47e0176d8894cae0b7680fb97d6ef41c.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\daa0a8cf65501226f723b0ea9660f8fb.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\fb39f44df8d2440b3913a0e80be0026c.png	dictbuilder.exe
File opened for modification	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\nsr23C2.tmp	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\ad6f04fc9591e0b2b4151ac6238cceb1.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\c5390ddb87ab6447cf48fa31990b8fd5.png	dictbuilder.exe
File opened for modification	C:\Program Files (x86)\Baidu\BaiduPinyin\IMEBroker.exe	imetoolx64.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\5b34535f96ed0fa4cac7942144f9bbfa.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\Notify\HtmlFuncNotify\images\kuaisu.jpg	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\Notify\HtmlFuncNotify\images\xiaoxijilu.jpg	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\691845e79e30d6be514af931d85e47fd.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\说明.txt	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imezlib.dll	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\PluginInvoker.exe	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BasicNetUtils.dll	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\PluginMgr.exe	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\939495d82b45ae98b2fe9680e7a261d4.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\btn_blue_90_30_2.png	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\skinbox\images\ic_setting.png	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\skinbox\style\box.css	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\microkernel.dll	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imenotify.exe	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\menu_select_bkg.png	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\Notify\HtmlFuncNotify\images\btnBg.jpg	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\86fe541faabafe7c0464846557eb2f7f.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\e2bb3a8386e340b3960934df10f303c9.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\plugin\Ime-plugin.html	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\skinbox\images\check_btn.png	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File opened for modification	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\engdict.dat	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\a170f3f6859387acd96c3d31684f0fd5.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\loading_100_facebox.png	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\minimize.png	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\ImeConfig\maintab_item.png	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\PersonalCenter\images\bg_medal_right.png	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\NetService.ini	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\skinbox\images\ic_search_close.png	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\61fbc188683a19a9aace96112ac111be.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MiniSkin\ic_quick_0.png	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\07dbc3eb403bba762203f62b045b3daa.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\82de6191e81d8400287b29b5ed560064.png	dictbuilder.exe
File opened for modification	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\dummygram.dat	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\Baiducn.ime	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\bugreport_baiducn.ini	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\635945b224196f9427ddbd8c6fbd8783.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\96d2e98dfd8679b35c8dbf2080765547.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\9d44d6e672620771e58cd01b1c0d1b25.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\PersonalCenter\images\bg_medal_left.png	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\skinbox\images\ic_back.png	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\resource\PersonalCenter\images\btn_logo-panel_coin.png	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\55efa667245a7d1d420d7b8d3ba89833.png	dictbuilder.exe
File created	C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\77298781da3df08556281286e0bf3892.png	dictbuilder.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imeutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imetool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bdupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	baidupinyin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imeconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imeconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dictbuilder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	baidupinyin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imeconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IMEBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imeconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BDDownloadExe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imeutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IMEBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imeconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cellinst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imeconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imeutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skininst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA93}\Policy = "3"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{409A2B36-B1D9-442a-A4DD-9C5EBCBA5134}\Policy = "3"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{409A2B36-B1D9-442a-A4DD-9C5EBCBA5134}\AppName = "imetool.exe"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA91}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA94}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{409A2B36-B1D9-442a-A4DD-9C5EBCBA5134}\AppName = "imetool.exe"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA91}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA93}\Policy = "3"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{04CCE131-9A31-493e-AAFC-1AB51FDE2883}\AppName = "IMESkinInput.exe"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA91}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{04CCE131-9A31-493e-AAFC-1AB51FDE2883}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA95}	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA95}\Policy = "3"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA93}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA95}\AppName = "quickhelp.exe"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{409A2B36-B1D9-442a-A4DD-9C5EBCBA5134}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA91}\AppName = "imeconfig.exe"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{409A2B36-B1D9-442a-A4DD-9C5EBCBA5134}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B1A491FF-0A2A-405b-B462-BC8B6B82D921}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA94}\Policy = "3"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B1A491FF-0A2A-405b-B462-BC8B6B82D921}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B1A491FF-0A2A-405b-B462-BC8B6B82D921}\AppName = "imetoolx64.exe"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA95}\AppName = "quickhelp.exe"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA91}\Policy = "3"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA93}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B1A491FF-0A2A-405b-B462-BC8B6B82D921}\Policy = "3"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA96}\Policy = "3"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{409A2B36-B1D9-442a-A4DD-9C5EBCBA5134}\Policy = "3"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA93}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{409A2B36-B1D9-442a-A4DD-9C5EBCBA5134}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA95}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA93}\AppName = "pluginmgr.exe"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B1A491FF-0A2A-405b-B462-BC8B6B82D921}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA91}\Policy = "3"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA94}\Policy = "3"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B1A491FF-0A2A-405b-B462-BC8B6B82D921}\AppName = "imetoolx64.exe"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{04CCE131-9A31-493e-AAFC-1AB51FDE2883}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA96}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA96}\Policy = "3"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA91}\AppName = "imeconfig.exe"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA95}	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{04CCE131-9A31-493e-AAFC-1AB51FDE2883}\Policy = "3"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA94}\AppName = "skinbox.exe"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA96}	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA94}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{409A2B36-B1D9-442a-A4DD-9C5EBCBA5134}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA93}\AppName = "pluginmgr.exe"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA96}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA96}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA95}\Policy = "3"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{04CCE131-9A31-493e-AAFC-1AB51FDE2883}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA95}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{04CCE131-9A31-493e-AAFC-1AB51FDE2883}\Policy = "3"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA96}\AppName = "baidupinyin.exe"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA91}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA94}\AppName = "skinbox.exe"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B1A491FF-0A2A-405b-B462-BC8B6B82D921}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA96}\AppName = "baidupinyin.exe"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{04CCE131-9A31-493e-AAFC-1AB51FDE2883}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{04CCE131-9A31-493e-AAFC-1AB51FDE2883}\AppName = "IMESkinInput.exe"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA93}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA94}	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E06E40F9-3614-42f7-BB35-C01E7412FA94}\AppPath = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	imetoolx64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B1A491FF-0A2A-405b-B462-BC8B6B82D921}\Policy = "3"	imetoolx64.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\BaiducnAx.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduImeSkinFile\ = "百度输入法皮肤文件"	skininst.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCC34BB9-44B9-4660-8B75-AC11729A3A91}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/BaiduImeSkin\Extension = ".bps"	skininst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduImeSkinFile	skininst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{29F9A596-1256-43F4-BE7F-16C89D66550A}\ = "BaiducnAx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiducnAx.ScreenShotAx.1\ = "°Ù¶ÈÊäÈë·¨Ò»¼ü·¢Í¼"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\InProcServer32\ = "C:\\Windows\\SysWow64\\baiducnTSF.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE4A566E-CD2F-412A-B259-1F1965B935C4}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE4A566E-CD2F-412A-B259-1F1965B935C4}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduImeDictFile	cellinst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\InProcServer32\ = "C:\\Windows\\system32\\baiducnTSF.dll"	imetoolx64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCC34BB9-44B9-4660-8B75-AC11729A3A91}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\BdImeSkinFile	skininst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduImeDictFile\Shell\Open\ = "安装到百度输入法(&I)"	cellinst.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bps	skininst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduImeDictFile\DefaultIcon\ = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028\\cellinst.exe,0"	cellinst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCC34BB9-44B9-4660-8B75-AC11729A3A91}\TypeLib\ = "{BE4A566E-CD2F-412A-B259-1F1965B935C4}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.bcd	cellinst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduImeSkinFile\Shell	skininst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\ = "中文(简体) - 百度输入法"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE4A566E-CD2F-412A-B259-1F1965B935C4}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCC34BB9-44B9-4660-8B75-AC11729A3A91}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\InProcServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\InprocServer32\ = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028\\BaiducnAx.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE4A566E-CD2F-412A-B259-1F1965B935C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduImeSkinFile\Shell\Open\Command	skininst.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\Control	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiducnAx.ScreenShotAx.1\CLSID\ = "{D64016F6-4D8E-4B35-AB22-9B2060800112}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCC34BB9-44B9-4660-8B75-AC11729A3A91}\ = "IScreenShotAx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\InProcServer32	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\InProcServer32\ = "C:\\Windows\\system32\\baiducnTSF.dll"	imetoolx64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\VersionIndependentProgID\ = "BaiducnAx.ScreenShotAx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiducnAx.ScreenShotAx\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bcd	cellinst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\ToolboxBitmap32\ = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028\\BaiducnAx.dll, 102"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{170462E1-875A-4DC4-A37D-EB3CEFDE9FEF}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\ = "°Ù¶ÈÊäÈë·¨Ò»¼ü·¢Í¼"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduImeDictFile\Shell\Open	cellinst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\BaiducnAx.DLL\AppID = "{29F9A596-1256-43F4-BE7F-16C89D66550A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiducnAx.ScreenShotAx\CLSID\ = "{D64016F6-4D8E-4B35-AB22-9B2060800112}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiducnAx.ScreenShotAx\CurVer\ = "BaiducnAx.ScreenShotAx.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\AppID = "{29F9A596-1256-43F4-BE7F-16C89D66550A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE4A566E-CD2F-412A-B259-1F1965B935C4}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduImeSkinFile\Shell\Open	skininst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduImeSkinFile\Shell\Open\Command\ = "C:\\Program Files (x86)\\Baidu\\BaiduPinyin\\3.3.2.1028\\skininst.exe \"%1\""	skininst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCC34BB9-44B9-4660-8B75-AC11729A3A91}\ = "IScreenShotAx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bdict	cellinst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D64016F6-4D8E-4B35-AB22-9B2060800112}\TypeLib\ = "{BE4A566E-CD2F-412A-B259-1F1965B935C4}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE4A566E-CD2F-412A-B259-1F1965B935C4}\1.0\FLAGS	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
Token: SeDebugPrivilege	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
Token: SeRestorePrivilege	396	imetoolx64.exe
Token: SeBackupPrivilege	396	imetoolx64.exe
Token: SeRestorePrivilege	396	imetoolx64.exe
Token: SeBackupPrivilege	396	imetoolx64.exe
Token: SeRestorePrivilege	2664	regsvr32.exe
Token: SeBackupPrivilege	2664	regsvr32.exe
Token: SeRestorePrivilege	2044	imetoolx64.exe
Token: SeBackupPrivilege	2044	imetoolx64.exe
Token: SeRestorePrivilege	2044	imetoolx64.exe
Token: SeBackupPrivilege	2044	imetoolx64.exe
Token: SeRestorePrivilege	4748	regsvr32.exe
Token: SeBackupPrivilege	4748	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 968	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	92
PID 1088 wrote to memory of 968	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	92
PID 1088 wrote to memory of 968	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	92
PID 1088 wrote to memory of 4716	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	94
PID 1088 wrote to memory of 4716	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	94
PID 1088 wrote to memory of 4716	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	94
PID 1088 wrote to memory of 372	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	95
PID 1088 wrote to memory of 372	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	95
PID 1088 wrote to memory of 372	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	95
PID 372 wrote to memory of 4800	372	imeutil.exe	96
PID 372 wrote to memory of 4800	372	imeutil.exe	96
PID 372 wrote to memory of 4800	372	imeutil.exe	96
PID 1088 wrote to memory of 4572	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	97
PID 1088 wrote to memory of 4572	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	97
PID 1088 wrote to memory of 4572	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	97
PID 4572 wrote to memory of 4468	4572	imetool.exe	98
PID 4572 wrote to memory of 4468	4572	imetool.exe	98
PID 1088 wrote to memory of 632	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	99
PID 1088 wrote to memory of 632	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	99
PID 1088 wrote to memory of 632	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	99
PID 1088 wrote to memory of 396	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	100
PID 1088 wrote to memory of 396	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	100
PID 396 wrote to memory of 3860	396	imetoolx64.exe	101
PID 396 wrote to memory of 3860	396	imetoolx64.exe	101
PID 3860 wrote to memory of 2664	3860	RegSvr32.exe	102
PID 3860 wrote to memory of 2664	3860	RegSvr32.exe	102
PID 3860 wrote to memory of 2664	3860	RegSvr32.exe	102
PID 396 wrote to memory of 1932	396	imetoolx64.exe	103
PID 396 wrote to memory of 1932	396	imetoolx64.exe	103
PID 396 wrote to memory of 1916	396	imetoolx64.exe	104
PID 396 wrote to memory of 1916	396	imetoolx64.exe	104
PID 396 wrote to memory of 2300	396	imetoolx64.exe	105
PID 396 wrote to memory of 2300	396	imetoolx64.exe	105
PID 396 wrote to memory of 1620	396	imetoolx64.exe	106
PID 396 wrote to memory of 1620	396	imetoolx64.exe	106
PID 396 wrote to memory of 1976	396	imetoolx64.exe	107
PID 396 wrote to memory of 1976	396	imetoolx64.exe	107
PID 396 wrote to memory of 4984	396	imetoolx64.exe	108
PID 396 wrote to memory of 4984	396	imetoolx64.exe	108
PID 1088 wrote to memory of 2640	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	109
PID 1088 wrote to memory of 2640	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	109
PID 1088 wrote to memory of 2640	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	109
PID 1976 wrote to memory of 3396	1976	RegSvr32.exe	111
PID 1976 wrote to memory of 3396	1976	RegSvr32.exe	111
PID 1976 wrote to memory of 3396	1976	RegSvr32.exe	111
PID 4984 wrote to memory of 2520	4984	imetoolx64.exe	110
PID 4984 wrote to memory of 2520	4984	imetoolx64.exe	110
PID 4984 wrote to memory of 2520	4984	imetoolx64.exe	110
PID 2640 wrote to memory of 3908	2640	imeutil.exe	112
PID 2640 wrote to memory of 3908	2640	imeutil.exe	112
PID 2640 wrote to memory of 3908	2640	imeutil.exe	112
PID 1088 wrote to memory of 4916	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	113
PID 1088 wrote to memory of 4916	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	113
PID 1088 wrote to memory of 4916	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	113
PID 1088 wrote to memory of 3404	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	114
PID 1088 wrote to memory of 3404	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	114
PID 1088 wrote to memory of 3404	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	114
PID 1088 wrote to memory of 2436	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	115
PID 1088 wrote to memory of 2436	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	115
PID 1088 wrote to memory of 2436	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	115
PID 1088 wrote to memory of 3788	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	116
PID 1088 wrote to memory of 3788	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	116
PID 1088 wrote to memory of 3788	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	116
PID 1088 wrote to memory of 1828	1088	ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe
"C:\Users\Admin\AppData\Local\Temp\ad515ec278d0e97347b6a527d1c3baf3d1d96ace5a7a724dd93de2fc3b9e6ee7.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dictbuilder.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dictbuilder.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:968
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe" --clean_old
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4716
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe" --quit
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe" --usercenter=close
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4800
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetool.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetool.exe" --moveuserdata
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --moveuserdata
    3⤵
    - Executes dropped EXE
    PID:4468
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BDDownloadExe.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BDDownloadExe.exe" 1 /product=201
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  PID:632
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:396
- - C:\Windows\SYSTEM32\RegSvr32.exe
    RegSvr32.exe /s "C:\Windows\SysWOW64\baiducnTSF.dll"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3860
  - - C:\Windows\SysWOW64\regsvr32.exe
      /s "C:\Windows\SysWOW64\baiducnTSF.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:2664
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --startmenuopt
    3⤵
    - Executes dropped EXE
    PID:1932
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --vistataskscheduler
    3⤵
    - Executes dropped EXE
    PID:1916
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --filesec
    3⤵
    - Executes dropped EXE
    PID:2300
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --whitelist
    3⤵
    - Executes dropped EXE
    - Modifies Internet Explorer settings
    PID:1620
- - C:\Windows\SYSTEM32\RegSvr32.exe
    RegSvr32.exe /s "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BaiducnAx.dll"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Windows\SysWOW64\regsvr32.exe
      /s "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BaiducnAx.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:3396
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --install-shell
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Program Files (x86)\Baidu\BaiduPinyin\IMEBroker.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\IMEBroker.exe" --quit
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2520
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe" --quit
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe" --usercenter=close
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3908
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\bdupdate.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\bdupdate.exe" --installgau
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4916
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baidupinyin.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baidupinyin.exe" /u
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3404
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\cellinst.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\cellinst.exe" -reg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2436
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\skininst.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\skininst.exe" -reg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3788
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baidupinyin.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baidupinyin.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  PID:1828
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe" --location
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4088
- - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
    "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --install
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
  - - C:\Windows\SYSTEM32\RegSvr32.exe
      RegSvr32.exe /s "C:\Windows\SysWOW64\baiducnTSF.dll"
      4⤵
      PID:2560
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        /s "C:\Windows\SysWOW64\baiducnTSF.dll"
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4748
  - - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --startmenuopt
      4⤵
      Executes dropped EXE
      PID:2320
  - - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --vistataskscheduler
      4⤵
      Executes dropped EXE
      PID:4400
  - - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --filesec
      4⤵
      Executes dropped EXE
      PID:1976
  - - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --whitelist
      4⤵
      Executes dropped EXE
      Modifies Internet Explorer settings
      PID:2008
  - - C:\Windows\SYSTEM32\RegSvr32.exe
      RegSvr32.exe /s "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BaiducnAx.dll"
      4⤵
      PID:3884
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        /s "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BaiducnAx.dll"
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2640
  - - C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --install-shell
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:4996
    - - C:\Program Files (x86)\Baidu\BaiduPinyin\IMEBroker.exe
        
        "C:\Program Files (x86)\Baidu\BaiduPinyin\IMEBroker.exe" --quit
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4112
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe" --setopt /Command/ImportSogouDict bool:true
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:916
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe" --setopt /Command/ImportQQDict bool:true
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1372
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe" --setopt /Command/CheckImeSetup str:AD
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5068
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --set-first-ime
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
  "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --fix
  2⤵
  - Executes dropped EXE
  PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BDDownloadExe.exe

Filesize
367KB

MD5
b5e16bd1f7edaa0d56c9e2ce65f35516

SHA1
ca4b7fc4c77680b8ce4b1bdbb2b231beb06c98e2

SHA256
91702ae34d17e643983accc23f937c0956d5d5e07b26871e025de4a6da85b696

SHA512
ec0fdc8d2a8b1f93a2282c0af139dddc637533758e65d6e2b052a8e20c8a031d3d4133e04c1c082981035a35afa552b219ac0503f43181c4d399f95581e91b29

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BaiduPinyin.exe

Filesize
2.8MB

MD5
080a1318a5e18553f622ee9498e1a99d

SHA1
8242034ceb4f3333c410478499f02885044373c2

SHA256
020f509f0c15d6c123b02e790d4d3d674a781ceeb8d6b304bcfb7d57479c5b36

SHA512
c90571a169099ad0973c090de7a1434f52bdef635730fac44029635ca91870269237595f81b6602dbb8f5cd077acafa2d36380776a3707d94fb1e8668070d1c3

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BaiducnAx.dll

Filesize
143KB

MD5
e41852e853a50d8a0cab5e684b781959

SHA1
d13866acbc0f173c3b398ca3a7dc90c4a5cc4963

SHA256
a1ef06a36509ac868cb1a731183330644efe37fb35a635385a5ac4c50688bae0

SHA512
cf06047e2a859f8f78725bc3ffaf16f790a706e3a1461da81287d3558be9ee225110efe70245c6625a54854af16b95116c6a8e67ddbcda6a6b7d2375c27f36a8

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\IMEBroker.exe

Filesize
161KB

MD5
59294fde17337c3b141160be336fa7b0

SHA1
59331a76ec7bdb6ef4cf3566391587229b942378

SHA256
044bea17ccaff8d1bd437dd13a0d37798ac1629f7fc6fb1cf6d5c4d0e065e5f4

SHA512
f9be627ce0587e89132e013000d88db0b943f6b11e630e78aefd2f347a12f7ddf30b0a71ed5049017f2148083166924bc2c6ae35ed9d635c492dd84312d0e414

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\MSVCP120.dll

Filesize
444KB

MD5
fd5cabbe52272bd76007b68186ebaf00

SHA1
efd1e306c1092c17f6944cc6bf9a1bfad4d14613

SHA256
87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608

SHA512
1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baiducn.ime

Filesize
399KB

MD5
56385cb44bcf0b46d7b27ae70dc304f8

SHA1
f488aff961286a852fba6f887ba9369d7dbb8bbe

SHA256
1ef970a39e17a0f1188f7ea88a871a833613b0fbc5fbc028f2a29bcddba72159

SHA512
37725ad5e9599ce7db125453a4f63ead7d6648dca65ab93bb5ed6888404a04d86dfcea1d0a28ec4a005449d1246a452e03bb4a8bcf5c4bed42071cb1c2afb681

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baiducnTSF.dll

Filesize
518KB

MD5
047883fa5f336320c303345fd0c2a37c

SHA1
d5a647ce1dde1faa4128c1db5c82851ca73716a7

SHA256
aca42b70ee70806ff6a298acbfda17051f3514073ba1bffeb64006d56d75a9ea

SHA512
b8e8032fd8c4a94fa7841bfa4a9b89c894766cfebb2702da2570acddee1c161c7a12551f51d3dce81fb10d55e56075c226843d811a20ef6cafafa3e58418dd48

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baiducnTSFx64.dll

Filesize
606KB

MD5
523d13d373e36022819a8bfd4106afa7

SHA1
928fd5209a568333193b4327897fbcd25829a876

SHA256
6717422b8a66c295cdc52624794354c642c0f5b3c9fc945e17c700765815a2ff

SHA512
d5be101c0a4c7bdf5eddf351311e8a7db74d2fef8f97171e3ea0820fc7384c8505915ecfc774f70c519ed87807173397f6771d515bbc816d113a24460b72fafd

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baiducnx64.ime

Filesize
469KB

MD5
385de7eb355e2b67bc8efaf1d28db78b

SHA1
f8dcd255c7160347af343bd6824640d1960a3afe

SHA256
a00392e1f6c235507cf6077f16052216de8c50ea3c601b32ea8f1e75f447d650

SHA512
95461dbb67355cd44ebe0f8ae124bd878a7588e09ef9fc682ac256a1c5c243f5d1ffcf1189f714670f4298ce8e67e6463f98bb83540652edfaddd55e3d173267

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\bdaucommon.dll

Filesize
139KB

MD5
93bfa462ede419250bc876b2884ece05

SHA1
233a8a946f119492b8fa2b4b8993e5d3db00acfe

SHA256
6a2b893de7fbc1c0c507a35c14882236c326f553baf07409cd358308eefcb5af

SHA512
2cae7a79f3adbc23fbd7a84689321b438596bd9cec5b2bca274f0d67ae0bad7b9b984ba352256fe6079338435958e28923915d029bc4b2e52fd04dff61312245

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\bdnetdll.dll

Filesize
195KB

MD5
d55a908913b1f2bc2e9e0195472882f7

SHA1
627509ef0575d389e39a2dbae82e94da50346f2e

SHA256
0be32940021bce94782662b3377e2658600e0ada82ad3ce561b00a3abfdc528d

SHA512
1a500d47e0785a0467e29a4986f0dc658a9c105855d70d4c17d4a8df7d5354d808fec25f79bb507719eeb93c1a5db49a006e291b1ea4dd18049c1d94696d5eea

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\thumbnail.dat

Filesize
376KB

MD5
3c11f16a387925e9c088b0d819795bb4

SHA1
bf99c57feafd149b93c73fac2211b8be00b3e536

SHA256
0b07258015b5e139776c9be53965f4442bfc9d7265db93665f2a10a166fb04ce

SHA512
2a5cf1c37d3cc67709a427a5831a46218e15550054896b333c5ec9a7f6b370fb271d06696b842c2dc55947ed9dabaea5fb9bb1c859ca4132106cc02c590ab1be

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\dummygram.dat

Filesize
16.0MB

MD5
df695d1bb876e0aff16e80d37c13a045

SHA1
bfa3f935d0259f103213c86b19643c9d0e839d31

SHA256
8f34cb39e843f2569e530d13f9583d385d80273c7f0a7bd3227fba11336527fa

SHA512
8ad735da6d0cb7050474d53787bbbcf371cdc70ba6bb54e8b649331570f29f99f609ad897178f0c430548da245a31ffdf0db8f4cc1931f7bb1837d273d4d02e7

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\engraw.dat

Filesize
385KB

MD5
5fba35a5c0c99d59803bf9d2590c3f82

SHA1
8e8e082647997cb688effe79ec12529bd03e9987

SHA256
835828871ef9af95f85b8f249f2cacdbbae6c73ef802448f7c59584eb63265f6

SHA512
4217349c66ee47d096d2a4c19fa408dd6f08a09a9c47cb9493b5a2faff6f3f4f0d855cf02905f24f0a8d1ce6bb1d4d561c4f69a1378b09ff473f997855ddedf2

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\rawdict.dat

Filesize
6.3MB

MD5
d28c28b7d005a754a60839b4091aa556

SHA1
90e2b7ef24d2521b66ffa793d19dd7bbe8fe3bbb

SHA256
1d753a7609cfe79ec3abc6b2c0c6d552f29caf1251ffae2cb8fb81a71d80ee84

SHA512
96a754995b7751cb4a0df624bd8f4975b9fa40ef97329a798abf47197537c62f51f1b47900d82be14f2d2d2785e963897ab6f7cb713e6a76fef0107c4517c089

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\rawgram.dat

Filesize
15.1MB

MD5
2e1b6f915bc3efb9bd950099e9a25fa2

SHA1
ada21f4380f5c2bbf9a023fb3a97c6abc67d8552

SHA256
5f6bd5aa51cf2590579116816e87a26617f1424fdb00f4703dd4ee9429d425e8

SHA512
771557c762acab825f5f96bc83cac0612b5551f2c2d85406fe2288aad9aef9a17b16769ba29a7b5ef5087f17b5f2d0538480b3c16f809c5b52fb1afc4420f51c

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dictbuilder.exe

Filesize
264KB

MD5
78b547129a5af3251cd3a2cab4107d4e

SHA1
da5d2da96f238fa327cdea23225b08f813d5504d

SHA256
9415b6d6014edb194cb9e428e77900c37b1b9a950e2c97bd013d4af8f5e8455a

SHA512
ef9a1edb6272e2eeab04eeb142c5f0a7806f4e96335a1aab6d391746de795f00ea62c06ecdf0df7bc5e6933e1961afa94df11639ff5f16d0bae871a584b3bc48

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe

Filesize
3.2MB

MD5
0ccf4e1bd3bdd1119d96bd92b89e6a76

SHA1
9b00ad3520a26a9f6e0644c2796c85d8ae54c47d

SHA256
5893e51697c153e3ef8b257cba716577b7cc3e82fd0a8fbab51189706dedfc40

SHA512
e259835f453a9d7a3ece6e9b79d087ec7d596810ed072964e38b21eca613c2321b3964ec79806269eb6abcda40aafcd9d5e82f360018cbfa1e86266baff8507e

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imefreetype.dll

Filesize
762KB

MD5
8d82ce7a07be1b62440c0cec4e170a15

SHA1
3c6d41dc25978907acff8369778b4e352d56ccc1

SHA256
c6a521c1f3c2611e063d4929fb4a2c466395d4a54a17b6c1036f9e92a0d3ede2

SHA512
033f08cc83b6bc911c5cb136e152b920cb7193b1ce6e4529a84260ed0225d814059a4a47c603070db6191a86ddef4104e3eec712bccb8f0d2d0b85050612651f

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imepng.dll

Filesize
298KB

MD5
40e91fcd84dafcc606ccc876f991a7e6

SHA1
21e2dab15eddb84c631838e1575a72598e9355c2

SHA256
bb0258c4b7ea8543f2f5aced98081d7a973f337c57be08f294ab189d13e7c417

SHA512
dda11e19996c688090776fd3ba1428af05fb234a51947e4692b83cd11eff3ad39d7a46e481c536f0aea780c827c8169616ff74b2b9b5aadb4abab11b1e852693

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetool.exe

Filesize
432KB

MD5
f51b87edfcba2b76efffe705dd4e6951

SHA1
ed3d4d21a33d47960634f15b297309369d550030

SHA256
14145a84c8d19e1ec17f4f79778e8fcf998a5fd60c2c5852391caf88d0dcd7aa

SHA512
fbe76bfe49fd9382541b0aaecef568ec1d0db21fe7aff0df47e8fb05060a3e60a053198dcf225da44f6bda682f32c26fcdfd4ee8bac6bd4831ee41ff9ff5695e

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe

Filesize
495KB

MD5
56c71233b091ae9c9bdffde78d01178c

SHA1
49008558d094e5245df0ee187854f08eba719cfe

SHA256
37ec71fc85302dce47e3610aa97fc516d577d4297e37acd4413a2d50d09efb8b

SHA512
fc5abba1a9401fc20805363674c00c2ee94ad037297fe82f58f6e60dbe6eff39b2579babaa95cc766708ad1f7c9a965d87311c15cff4a3f1cadfe38ccf0d4245

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe

Filesize
105KB

MD5
2ff02072877da8f34f9af9928aa5f5b3

SHA1
d9e5bee9e783fecd13e95e2cdea37fcaa9a1cbd7

SHA256
756d55a8085e1b07695eb90db9266e98a0f0afc67ae188867eed96badc3d59ea

SHA512
9f340860dfce4f20b674d8db7ceb15af5dd618cfb6e75a154c043a16a2fd3e57a97b763cbe84a945d06ef324b11f2b6da4ec798fa536033ccf76de2a62787c1a

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imezlib.dll

Filesize
186KB

MD5
de63b59c6697079ecc7646589deaafef

SHA1
709c2d6058556dd0f9d46ef840153249cd60d94b

SHA256
183db759881d0213aa708410c122a7373ba08dbe122343b6acf9292741108d97

SHA512
0e8493cc0f1ee0666305c06928d4811563aa07187bdb3146bf21b3446e946e6f582c7e1375f32281b259163de72a0d54b0ade097843bbfdd5ff599d444f54573

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\libcurl.dll

Filesize
295KB

MD5
60054f32651599c68fab41b220f476e0

SHA1
281a63035340db32bb7d55e009f8097546f4aa9a

SHA256
4352c68ffc4308c2e24acc19608318a52dd0a9f362f1cd2c8ff07b55ae37dde9

SHA512
daa3431d8d70b0278a13b04dc1d74b44d235296c86686fc233dcd23af963bcd5977dd97ea5546cf548e222fb43f7bba5db350f1de1c2fbefe1379c717d8e2a39

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\libeay32.dll

Filesize
1.1MB

MD5
b8a2583697545aea9baa1383f9796368

SHA1
a8d5fa264d96e70e36461d99a44a9a39cb186730

SHA256
1f649a43e098fef9be0cbdf6f57b1afd3aa14d06c5c1aa82f5c26b769f04f141

SHA512
cbb43e7b2cee7d76ac026ec3deb9626c43d6acbc595cebd41293cc1045808a7f09da19ab64c7b0a44432281e43e4904432906f5c3dec6bb1f3c146c907fc6864

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\msvcr120.dll

Filesize
948KB

MD5
034ccadc1c073e4216e9466b720f9849

SHA1
f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

SHA256
86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

SHA512
5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

Download Submit
C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\ssleay32.dll

Filesize
267KB

MD5
0f6f9f42e4dd9dcd5715955e3838ec4a

SHA1
f93a11370df53d30a84268b003fab1b8eb2a3960

SHA256
6f34c5eec35a9f5af26cd163792c53fbd30ff0d04110f6bddeeff413f8dea10a

SHA512
ecc9ba94660d2d3ea7a80e2a67e3db129e983d33697fa5da6c000a7b53c3e3a1460bedb12fc82af422f03c9e9c097335e9704dd21ae9d7b4baa78f19826c4920

Download Submit
C:\ProgramData\Baidu\Common\Global.db

Filesize
52B

MD5
8d96557ae87d667d1d8139e0ba138191

SHA1
7f17b46e9226d2a87886f4e5651f6bacc896d08d

SHA256
b5786df52bc8418db7f0adf5ff6ed23b4aa3f4185fe1804b38e62acd5f74ac51

SHA512
72406c8c5ec75555c090dc2940f9b4ecd763185257c75db029e4ceb7b1022002134c9ac1f66b876c7f57831f6f8348934f830177a6e05f4451ad893f8baf0541

Download Submit
C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Account\.common\Status.ini

Filesize
1KB

MD5
3e068ec3729426e8092544db0ab17252

SHA1
44ba42ac89ac3813e50328ae40c705864626f27b

SHA256
66026e10478f4265e3f367c3a597854ed4284f5300848e50ec67623c17bffcd9

SHA512
d02e6a5054f539aab15323fa1a4c1aa9456dd1ddbeeb7eabd0c5cdc5cac30ead31f91f595bc059623dd3e114d60690fa28864328fc406145e1d9b50716c8aeed

Download Submit
C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Account\.common\Status.ini

Filesize
2KB

MD5
d20b5444745460ebf9090826183c9c8d

SHA1
b7936ee0663557ab06fae75511bc2b54bf5dbba4

SHA256
d936bc1e70252d7ed786b624b4d7f9fadf6cd1415644fb42fa626bd528a11499

SHA512
5b714610e9eeb36929e253e4313ac5536b140f9407b931fd9e2557f5dc7f161b05e73fa9ede60f6111d294e1795a43540eb96179ad347033dfcbc3aabe0f9ff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Account\.common\Status.ini

Filesize
298B

MD5
3c90db75866345684d6326d95f8c9182

SHA1
63515162530769e5cdc5132e67cdd404b3617726

SHA256
7c90e1f7bebea3aae1b91dbeea717ac5bbc7948301e4c40ef539db7b1390e559

SHA512
ad2179f72bdaf4d63feb8872e75f264336e7dcaac5532125156dde5fc803d6d685620b7175755499c31e2ad53df0bf50240f27ea0a115e35b4f40cd590db55f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Account\.common\Status.ini

Filesize
1KB

MD5
505138ac42a0ace107187f692d554e31

SHA1
7e603ffc77ed5aec01ea60a68bcec96bd222d4d2

SHA256
dbcff6ca3840702e1d9af2cf8dcbd7c2e4e41f164a5fe96d2436a0f5e8c474a5

SHA512
24b7456d19673b134403769f96e0483fa3f67ca0d0d06f76c514d3a417435f53d3e9c4b90a59516d336d5e38a8a9860be12a2b1b1b808b47dc964dbdcaae492f

Download Submit
C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Status.ini

Filesize
541B

MD5
a3b23a3c40c92e1facc68ce3b77b9d8d

SHA1
70b1ac342abc372d8bd9d878d0b344c00c2c7778

SHA256
3b6b58eacd37f851918deb4328677d6bf2995d7c26f57fa2db3325cf72e07418

SHA512
6e7206064ca04b7992fd7c82586488d65e6651cc409ed23589989bc849ecce7efe154614745be4732ec91ba6f93688f421bc83b6e63cdc2ef984401d33637dd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Status.ini

Filesize
5KB

MD5
c6c3888e01f70e46b64e3263b907e129

SHA1
c13c8379d0f4c6cf253e7af87da20c41215c3078

SHA256
33fa323b5785b7d9d773de3cc55954ee4a33319f89f59089c932e48a5eb536e1

SHA512
995d025532e4c02cd340a6625f5427c2c951afa1f81c9f6eef21abf6672964766e36229404a41f963a2ae76eac2137b9bbe502ccebf6b44227932b027309902e

Download Submit
C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Status.ini

Filesize
5KB

MD5
4ec871b320eb46690c0c3d35f772d5ae

SHA1
a601dee5401e6918cdda7ba506b5c00c61313910

SHA256
5aa2bfef744b6be0cad268c185b0d3c01e2e59932c23d329b8c34ba0b95d026a

SHA512
d5f50f257c9ba23b3763e4d0e1964be48079f79695b340ca5ae7aaec1ff3bc36e73bf218e632af5631e1eafd74dd513d2b88987ba6e167887684d011be70d5a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Status.ini

Filesize
4KB

MD5
e414c66bf2e61b60c3d80bd18e60d5bd

SHA1
d8d8637ddca0f689f474a5252615fd4ed2115da3

SHA256
15963d5145eb555c87f444dc63c8dde3dbe679d216388a2e1bfbfd9c5ba65d1b

SHA512
0bf4face902e04d1cdd2ff90e53ad48ecf1a9adc22de4d5c1805c33e2fe37456ebe33d5afc0706e866fac73e77ebe4a33188c79c5982ed0fb232104d2ce1944b

Download Submit
C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\common.ini

Filesize
568B

MD5
0fcd28ed0e69ca531809e8e2058eb246

SHA1
5d7a1862ee5c8a708c91a9866b503d87cbfacc84

SHA256
2c6c16ec784410c022bfe6dd4618fb2f4cff421c0cbc151707afbf9db0ad3a3c

SHA512
276995e090a70844cbc912d9660d39c33dc5f8eed0985dd5d9c8b56a360c933f2ca63cbf32eb548031b4557260f0b720487242b2fcbc63e7e4e6937c2ac887c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\config.ini

Filesize
150B

MD5
a734743db374e9ec2ccbe79a03087b05

SHA1
03bb0ebcb007d423f210c27f8af3352013232092

SHA256
8763d5a26721fdcd83f4ffa22155ae059a94d9ba370d1080173558e2849afdd2

SHA512
0b369b5e7e9ce2564a1d9bb0a7c9f1a07b8b8a548fe9ffaaac6334d033b04e4a920077d10b1728825993d56a7a8f844bbaa14f03d48e5beeda0fbddda2a2e773

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxCAF.tmp\Src\Protocol.dll

Filesize
668KB

MD5
a438e303cf31126c5d6b882aeded21a8

SHA1
eebe92a2e07ec209e6c366899938d2f7677e9977

SHA256
7c301b9c44cae3a53a4f939a391ae36e79e29f9216fc903665b4551426cecd90

SHA512
ddc47c35d7b662e939d471e07f5f45e979abd4df14b334c5c12f229f7d185bb9925693d9dd71e36c97eef02c92f961775f5d7cd605b36af9e6a5c9d83af3964b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxCAF.tmp\Src\Report.dll

Filesize
316KB

MD5
98a2b4d094fa825e601b1f68752d4ac5

SHA1
0197c18e2443b53add35870df81a0123acbaa0cd

SHA256
3347ab083d69d9d4bf6c8e6816c56a1eb694b581721965ebd44d240fe956e164

SHA512
47ef8d5ee9273a41169ec522245869f6d9d90b840d56d88e68bd693b4d1b4243b005cede1a5f9420ff1a5240f7de8ba7a5b915b846af9e1c57a0d4eaa584d53d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxCAF.tmp\System.dll

Filesize
19KB

MD5
35d7b29c3ed690a8b0cd323917677b42

SHA1
ad74d2babe09f94838e408c8f9f77b6b56c644f5

SHA256
714bd22a836a7f164b848541b8bf8ac80a20ff38e10e412bf9ef518620a80b8c

SHA512
abc6f37b7306de737adf998607e81304ecc1589ac8e3164651b237def11b424a190e84608f4f6ce44a63ce225d93be7c617a736c82fb6b9077c5222c2e17b67d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxCAF.tmp\chkm.dll

Filesize
74KB

MD5
3b8308f1dba641b49a642fa6d92f3451

SHA1
a11164e08bd9c594b6d608c51a2428a4c6b555a2

SHA256
2061a94b4d34a77f935f95a3741f917c91b27d0e1585c2ee2f8e00806b671db7

SHA512
dc089fc2bb43ccfcca8748013636e8d249cd91e1b08b30358d00df0decaec5782d2af85274e7b70784d4e58c934dfe5112fdcb4006de2a5dbe9c76dae9ed1f81

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxCAF.tmp\insthelper.dll

Filesize
774KB

MD5
8bcd300c69b67e78b09cf07aecfa14fb

SHA1
d92bdb71d8b8477a3f0838360191aecc459a3c09

SHA256
d62d59db60544bd44db6d710f3b6d48608bee022d908dc46d16885e79dd1ca0d

SHA512
393667c3423ed6defeca5c7c51c3244106ebb737398b34822a38edf9fa68cead72016a77c29d4f47d0c5c784c6339e8080d3b35eb17d325658a951c464951cf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxCAF.tmp\reportsetup.dll

Filesize
309KB

MD5
52c3b9ac0484ece3b524a9526272f88e

SHA1
c07268de6a13290acbf58ec5ef75e2468533d791

SHA256
210876c0ff70ffaa88a05f9ef794a96136549f4168e940e256fb4ac85b0fff71

SHA512
da7710404e5630509eeaf9e318e2a4a2d9c4f269aee6cdce5d2a8f128094e7c92940312fda9913f5c44dce5159b59159f40137ddb2e7975e450f30c6a7b24f47

Download Submit