9654ffacac7704e9fd2688fcb52b087b512b29c68f330efea53963a8f7ba7de6

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__8e1dbc15325925b0ad51ca1b5b7d3474.exe
Size 275KB
Sample260919-mx4tmazves
SHA256 9654ffacac7704e9fd2688fcb52b087b512b29c68f330efea53963a8f7ba7de6
MD5 8e1dbc15325925b0ad51ca1b5b7d3474
SHA1 5e2837898df0f7ac00fad7a79de48032850e3bab
SHA512 098c6e3b5645e307c41b3ffedd1ee22c88fae3f0f17fee75177eab10e73ea7454a552e3f32ad639aa350f6ef97a9512d7df3830a371313d2c83cbb2d8a8a1d5e
SSDEEP 6144:CBKHYmz6mq2pmHmFV2YjnWuwqzeRhvaBAUBZ6IpuA:d4m5bpnL2KnEqCRhvaFBZ6Y
TLSH
T1E454223B6EDB5C66D7990A3E11710C2C833D9E5CB004D32722317DAB5B34B9A99096FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery installer persistence upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	4904	jaffacakes118__8e1dbc15325925b0ad51ca1b5b7d3474.exe

Executes dropped EXE 6 IoCs

pid	Process
3720	setup_ieangels.exe
820	KSafeSvc.exe
4204	KSafeSvc.exe
5852	KSafeTray.exe
2160	KSafeSvc.exe
2060	KSafeTray.exe

Loads dropped DLL 64 IoCs

pid	Process
3720	setup_ieangels.exe
3720	setup_ieangels.exe
3720	setup_ieangels.exe
3720	setup_ieangels.exe
3720	setup_ieangels.exe
3720	setup_ieangels.exe
3720	setup_ieangels.exe
820	KSafeSvc.exe
820	KSafeSvc.exe
820	KSafeSvc.exe
820	KSafeSvc.exe
820	KSafeSvc.exe
820	KSafeSvc.exe
820	KSafeSvc.exe
820	KSafeSvc.exe
820	KSafeSvc.exe
4204	KSafeSvc.exe
4204	KSafeSvc.exe
4204	KSafeSvc.exe
4204	KSafeSvc.exe
4204	KSafeSvc.exe
4204	KSafeSvc.exe
4204	KSafeSvc.exe
4204	KSafeSvc.exe
4204	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
5852	KSafeTray.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe
2160	KSafeSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KSafeTray = "\"C:\\Program Files (x86)\\KSafe\\KSafeTray.exe\" -autorun"	setup_ieangels.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ieframe.dll	KSafeSvc.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2160-1502-0x0000000004400000-0x0000000004540000-memory.dmp	upx
behavioral2/memory/2160-1504-0x0000000004400000-0x0000000004540000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\KSafe\webui\splock\images\progresspop_bg.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\splock\images\xzbh_top_left.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\data\icon\IEpassword.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\data\icon\baidutoolbar.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\data\icon\kmplayer.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\data\icon\winlivemsg.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\splock\images\erji_bottom_right.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\splock\images\xzbh_left.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\KEng\kae\kaearchb.dat	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\KEng\kae\kaeunpack.dat	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\ksafevul.dll	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\ksafever.dll	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\kswbc.dll	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\data\icon\cache.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\kwsplugin\images\radio_blue_down.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\splock\images\progresspop_header.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\splock\images\right.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\KEng\ksg\zipa7001.ksg	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\data\icon\360password.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\data\icon\fixit.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\data\scanie.dat	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\images\bt_tips_sub_hove.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\splock\images\button_17_down.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\splock\images\xzbh_bottom_middle.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\KEng\ksg\zipac00c.ksg	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\ksafedb.dll	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\kse\config\kspfeng.filemonfilter.xml	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\data\html\bg.gif	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\images\hint_logo.bmp	setup_ieangels.exe
File opened for modification	C:\Program Files (x86)\KSafe\AppData\rfl2.dat-journal	KSafeSvc.exe
File created	C:\Program Files (x86)\KSafe\kcache.dll	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\icon\kwsdownicon1.gif	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\KEng\ksg\zipa7000.ksg	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\data\icon\wmp.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\splock\floatwnd\floatwndtip.png	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\splock\images\button_17_hover.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\KEng\ksg\ts281012.fsg	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\kxebase.dll	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\data\trashconf.dat	setup_ieangels.exe
File opened for modification	C:\Program Files (x86)\KSafe\data\icon\excel.bmp	setup_ieangels.exe
File opened for modification	C:\Program Files (x86)\KSafe\data\icon\huishouzhan.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\icon\commentbgadulttrs.gif	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\splock\images\red_right.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\splock\images\v4_close_down.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\splock\images\verifyhint.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\KSoft\icon\50000001.png	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\data\system.dat	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\images\ad_background.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\images\main_icon.bmp	setup_ieangels.exe
File opened for modification	C:\Program Files (x86)\KSafe\AppData\KSafeSvc.exe.spf0.log	KSafeSvc.exe
File opened for modification	C:\Program Files (x86)\KSafe\kse\kse_wfsdata\KSafeSvc_tmpa0.dat	KSafeSvc.exe
File opened for modification	C:\Program Files (x86)\KSafe\kse\ksbwdet2.dll.log	KSafeSvc.exe
File created	C:\Program Files (x86)\KSafe\ksfmon.dll	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\data\icon\msn.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\data\icon\opera.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\splock\images\xzbh_bottom_right.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\KEng\ksg\zipa800d.ksg	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\KEng\ksg\ztva8004.vsg	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\kwsctrl.dll	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\data\icon\winzip.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\kcldrep.dll	setup_ieangels.exe
File opened for modification	C:\Program Files (x86)\KSafe\data\icon\IEform.bmp	setup_ieangels.exe
File created	C:\Program Files (x86)\KSafe\webui\splock\images\left.bmp	setup_ieangels.exe
File opened for modification	C:\Program Files (x86)\KSafe\Cfg\bksoftmgr.ini	KSafeTray.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__8e1dbc15325925b0ad51ca1b5b7d3474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_ieangels.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KSafeSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KSafeSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KSafeTray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KSafeSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KSafeTray.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000c00000001c5a2-5.dat	nsis_installer_1
behavioral2/files/0x000c00000001c5a2-5.dat	nsis_installer_2

Modifies registry class 61 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bksafesvc.bkcomm\CurVer	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{E44A3E87-876D-46BB-8831-836A4C74918B}\ = "bksafesvc"	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9265A09B-A9C1-44ba-B65B-FEEC1FCA4C05}	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C313E554-97AB-49F9-988F-04DF64CD0451}\ = "bkcomm Class"	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C313E554-97AB-49F9-988F-04DF64CD0451}\ProgID	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C313E554-97AB-49F9-988F-04DF64CD0451}\LocalServer32\ = "\"C:\\Program Files (x86)\\KSafe\\KSafeSvc.exe\""	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C09A3ECC-2185-4F08-A17D-3EE687E05774}\1.0	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{25407239-B26F-40DF-97FF-1652E76BF999}	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bksafesvc.bkcomm.1\CLSID\ = "{C313E554-97AB-49F9-988F-04DF64CD0451}"	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C09A3ECC-2185-4F08-A17D-3EE687E05774}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\KSafe"	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{25407239-B26F-40DF-97FF-1652E76BF999}\ = "Ibkcomm"	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{25407239-B26F-40DF-97FF-1652E76BF999}\TypeLib\ = "{C09A3ECC-2185-4F08-A17D-3EE687E05774}"	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{25407239-B26F-40DF-97FF-1652E76BF999}\ = "Ibkcomm"	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{E44A3E87-876D-46BB-8831-836A4C74918B}	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C09A3ECC-2185-4F08-A17D-3EE687E05774}\1.0\FLAGS\ = "0"	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{25407239-B26F-40DF-97FF-1652E76BF999}\TypeLib\ = "{C09A3ECC-2185-4F08-A17D-3EE687E05774}"	KSafeSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9265A09B-A9C1-44ba-B65B-FEEC1FCA4C05}\ = 721a714da6750000	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2CF4F515-B28C-4038-B635-9F9B0048D505}\Implemented Categories\{CD8AEB3D-ADAC-4ee6-802D-1DCF4EAE9508}	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\bksafesvc.EXE	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{25407239-B26F-40DF-97FF-1652E76BF999}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bksafesvc.bkcomm\CLSID	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bksafesvc.bkcomm\CLSID\ = "{C313E554-97AB-49F9-988F-04DF64CD0451}"	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C313E554-97AB-49F9-988F-04DF64CD0451}\AppID = "{E44A3E87-876D-46BB-8831-836A4C74918B}"	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2CF4F515-B28C-4038-B635-9F9B0048D505}\Implemented Categories	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bksafesvc.bkcomm.1\CLSID	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C313E554-97AB-49F9-988F-04DF64CD0451}\LocalServer32	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C09A3ECC-2185-4F08-A17D-3EE687E05774}	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bksafesvc.bkcomm.1\ = "bkcomm Class"	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bksafesvc.bkcomm	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C09A3ECC-2185-4F08-A17D-3EE687E05774}\1.0\HELPDIR	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{25407239-B26F-40DF-97FF-1652E76BF999}\ProxyStubClsid32	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C313E554-97AB-49F9-988F-04DF64CD0451}\ProgID\ = "bksafesvc.bkcomm.1"	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C313E554-97AB-49F9-988F-04DF64CD0451}\TypeLib	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C09A3ECC-2185-4F08-A17D-3EE687E05774}\1.0\0\win32	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{25407239-B26F-40DF-97FF-1652E76BF999}\TypeLib\Version = "1.0"	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C313E554-97AB-49F9-988F-04DF64CD0451}\TypeLib\ = "{C09A3ECC-2185-4F08-A17D-3EE687E05774}"	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{25407239-B26F-40DF-97FF-1652E76BF999}\ProxyStubClsid32	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{25407239-B26F-40DF-97FF-1652E76BF999}\TypeLib\Version = "1.0"	KSafeSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BC40FFCF-BD8B-423d-882A-DEE82FE3315B}\ = a6e1f6b493a74849bf08683ce9f5d53e24c1c4d0e0b5424cb5ca9ff23371a3ed	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C313E554-97AB-49F9-988F-04DF64CD0451}\Programmable	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\bksafesvc.EXE\AppID = "{E44A3E87-876D-46BB-8831-836A4C74918B}"	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{E44A3E87-876D-46BB-8831-836A4C74918B}\LocalService = "KSafeSvc"	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C313E554-97AB-49F9-988F-04DF64CD0451}	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C313E554-97AB-49F9-988F-04DF64CD0451}\VersionIndependentProgID	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C09A3ECC-2185-4F08-A17D-3EE687E05774}\1.0\0\win32\ = "C:\\Program Files (x86)\\KSafe\\KSafeSvc.exe"	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bksafesvc.bkcomm\CurVer\ = "bksafesvc.bkcomm.1"	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C313E554-97AB-49F9-988F-04DF64CD0451}\VersionIndependentProgID\ = "bksafesvc.bkcomm"	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{25407239-B26F-40DF-97FF-1652E76BF999}\TypeLib	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{25407239-B26F-40DF-97FF-1652E76BF999}	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{25407239-B26F-40DF-97FF-1652E76BF999}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{25407239-B26F-40DF-97FF-1652E76BF999}\TypeLib	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bksafesvc.bkcomm\ = "bkcomm Class"	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bksafesvc.bkcomm.1	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C09A3ECC-2185-4F08-A17D-3EE687E05774}\1.0\FLAGS	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C09A3ECC-2185-4F08-A17D-3EE687E05774}\1.0\0	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2CF4F515-B28C-4038-B635-9F9B0048D505}	KSafeSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C09A3ECC-2185-4F08-A17D-3EE687E05774}\1.0\ = "bksafesvc 1.0 Type Library"	KSafeSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BC40FFCF-BD8B-423d-882A-DEE82FE3315B}	KSafeSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2CF4F515-B28C-4038-B635-9F9B0048D505}\Implemented Categories\{CD8AEB3D-ADAC-4ee6-802D-1DCF4EAE9508}\clsid = 393042423530454138363531333934344133303439384239303430303843313092f6813b	KSafeSvc.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3720	setup_ieangels.exe
3720	setup_ieangels.exe
3720	setup_ieangels.exe
3720	setup_ieangels.exe
3720	setup_ieangels.exe
3720	setup_ieangels.exe
3720	setup_ieangels.exe
3720	setup_ieangels.exe
3720	setup_ieangels.exe
3720	setup_ieangels.exe
3720	setup_ieangels.exe
3720	setup_ieangels.exe
3720	setup_ieangels.exe
3720	setup_ieangels.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3720	setup_ieangels.exe
Token: SeDebugPrivilege	3720	setup_ieangels.exe
Token: SeDebugPrivilege	3720	setup_ieangels.exe
Token: SeDebugPrivilege	3720	setup_ieangels.exe
Token: SeDebugPrivilege	3720	setup_ieangels.exe
Token: SeDebugPrivilege	3720	setup_ieangels.exe
Token: SeDebugPrivilege	3720	setup_ieangels.exe
Token: SeTakeOwnershipPrivilege	820	KSafeSvc.exe
Token: SeTakeOwnershipPrivilege	820	KSafeSvc.exe
Token: SeTakeOwnershipPrivilege	820	KSafeSvc.exe
Token: SeTakeOwnershipPrivilege	820	KSafeSvc.exe
Token: SeTakeOwnershipPrivilege	4204	KSafeSvc.exe
Token: SeTakeOwnershipPrivilege	4204	KSafeSvc.exe
Token: SeTakeOwnershipPrivilege	4204	KSafeSvc.exe
Token: SeTakeOwnershipPrivilege	4204	KSafeSvc.exe
Token: SeTakeOwnershipPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeChangeNotifyPrivilege	2160	KSafeSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5852	KSafeTray.exe
Token: SeIncreaseQuotaPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe
Token: SeDebugPrivilege	5852	KSafeTray.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe
5852	KSafeTray.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5852	KSafeTray.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 820	3720	setup_ieangels.exe	91
PID 3720 wrote to memory of 4204	3720	setup_ieangels.exe	93
PID 3720 wrote to memory of 2060	3720	setup_ieangels.exe	96

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e1dbc15325925b0ad51ca1b5b7d3474.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e1dbc15325925b0ad51ca1b5b7d3474.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
PID:4904

C:\Users\Admin\AppData\Local\Temp\setup_ieangels.exe
C:\Users\Admin\AppData\Local\Temp\setup_ieangels.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Program Files (x86)\KSafe\KSafeSvc.exe
  "C:\Program Files (x86)\KSafe\KSafeSvc.exe" /uninstall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:820
- C:\Program Files (x86)\KSafe\KSafeSvc.exe
  "C:\Program Files (x86)\KSafe\KSafeSvc.exe" /install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4204
- C:\Program Files (x86)\KSafe\KSafeTray.exe
  "C:\Program Files (x86)\KSafe\KSafeTray.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2060

C:\Program Files (x86)\KSafe\KSafeTray.exe
"C:\Program Files (x86)\KSafe\KSafeTray.exe" -autorun
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5852

C:\Program Files (x86)\KSafe\KSafeSvc.exe
"C:\Program Files (x86)\KSafe\KSafeSvc.exe" -svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

startup.log

Path C:\Program Files (x86)\KSafe\AppData\startup.log
Size 277B
SHA256 5ca101032d4cd5095ee54068b6422d92f12e7541fdc89487fc53ad8f866feabd
MD5 796a63d12d92c58e9b79bdf8d75fde93
SHA1 e76c714e5e51bf0822ad03c2fd91f8471e9bc9a1
SHA512 21c50da85f52a1397c962540137b55f4268f2a54d18382220d4b01ae55e1916138b834fcd9e7088fa5ce82ee7acdc63e1bd5f582a9de4e9db2deec3c7eda34cf
TLSH
T11AD09E624B32C2E1C23B0C80C40B71785B33F41A5211787566E031A5EBF4E4A8EADDF8
MD5 SHA1 SHA512 TLSH

Submit Download

startup.log

Path C:\Program Files (x86)\KSafe\AppData\startup.log
Size 332B
SHA256 0a58bb12b1016db696ae2e29cf5ec1f48e7d9f82ca7824cb66b984bf671cf280
MD5 88e56bbfeaa1e6b9be1defb4af4fa1b4
SHA1 499fb3268affd143f88d9f1776c0fd9100d24e5f
SHA512 7acc53eccf15390cfa2775a715d1a5585c6aebf6157424da8ac1b28b2ad20285125f0e5246d3b701accb385f41cfa6f3d93d0c7046f6d679b6b5a98e571a0aff
TLSH
T197E06D534B72C2E1C1370C80C40771785B73F41A5111787555E03165D7F4E498E9DDF8
MD5 SHA1 SHA512 TLSH

Submit Download

ksfmon.ini

Path C:\Program Files (x86)\KSafe\Cfg\ksfmon.ini
Size 147B
SHA256 5ac8c4dbec497daf72a54b1cc3cf241c0900f98d3b29c514f13f3e4478d4a473
MD5 f9f88f1d5509f21e046322b958ae31fc
SHA1 1ce48b05497e55339dfd6a350b5a7582c715de86
SHA512 c9bcfa7ff659a7994394318fd2d1e4c59ebaad7e58ee07eba9f0eea649bc4dc1794867880a20930d209fa40a3afa4a51fee36d547d582976eacd7a9be286c94b
TLSH
T12AC04810C76D001FCA8232A040A09232B87962683CE867040043F4BA6F0B4270A8D12C
MD5 SHA1 SHA512 TLSH

Submit Download

kaecore.dat

Path C:\Program Files (x86)\KSafe\KEng\kae\kaecore.dat
Size 237KB
SHA256 d296980583014b312f415796a8e00eb908b4629ab2c10a83c5a8b28884f38ab2
MD5 90b6701bc437269be30fb973a8fec770
SHA1 edb3085bdde20a275c31f143d927aaabf28a0214
SHA512 c7f5640c24b56168ca37274765f6322e0b8f3b0818093e7545b486db4c800698019356f40095d6358b83b6506319bdb738e492cdc26bd36eaa5958c9ddda5a69
SSDEEP 6144:vbZq/hkAVs2nE1xzGthVBoZ9DJgy6QHeTB/xXRJOg/WprtGKFN:vbZq/hkAVsnxqrVBoZ9DJwTlxXCthb
TLSH
T1A6349D23FD43517AC5CB2931487FBB9E1538C281039463C3BFD85D99EE505D2AA3928B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksafeave.dll

Path C:\Program Files (x86)\KSafe\KEng\ksafeave.dll
Size 209KB
SHA256 22926cc715a61aa84bad8e93666f95e4069d79315a4eb018bbeec52c99e52509
MD5 6e5bba4b953dce0b352afcdcfd300008
SHA1 1791a9e32caece33428dd22a580f6359869dc3ba
SHA512 39aa8bc0b30ba742f3b65ead192e46206eea07ab373017f75fe9f067819f778860dd37d7b3cca96003d22f159340a37737e4579b9bb49db2eb858659065415cd
SSDEEP 3072:wxAqeNQN7DNH1sa1I/ZfU+7heHqNHaNQusynwf+:Hf2N7DNQC+AKNARc+
TLSH
T1E9248D123B96C1BBD78F023284B7AB09737EA5536BA8D1C7EBA81D4A5D301C13D36356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KSafe.exe

Path C:\Program Files (x86)\KSafe\KSafe.exe
Size 4.1MB
SHA256 2cd8074de7c532c04a645400d05147c6871dad2c3846e093a4d5752b874fdee3
MD5 651f96378b7c766fb4c08138eebc1249
SHA1 16a7a665407a14c1718d35f6cf5218a127af9788
SHA512 e6300bb07d5ab3bbe3fd41c7d117e4ca50dd1cd115f763287458a6ee320bc4e3bf788f706503be51431ed876148fb9b24e06234d455434cf5b2bc3f6055943ee
SSDEEP 49152:IEVnx91VioWIVTED+iXPq/iR5MRfM4if/SpgQKSnhrSVS6Szosn:IYn1YoWIVYPqKRszzos
TLSH
T1F6169D01FFD989A0CA470472CCE1A7CFABA6AE411B14A5C7B96C3B4B9F715D17C3A241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KSafeSvc.exe

Path C:\Program Files (x86)\KSafe\KSafeSvc.exe
Size 897KB
SHA256 e1c014577c1d963fe439d7fda2d37507352289c129188fab558cf383bb0ed44b
MD5 748560ec84692f3b49cb2aeb0bfb7150
SHA1 75a47ffa3705081fb60f877d8a9aa3c7aee68c5f
SHA512 e325faf679771c3eaa44d9ebac951a5039a46350781a1cc02a415c7ced438224096912884744d1b606b8965c521ef4538f9c227270f4af856512ee8f0a432e00
SSDEEP 12288:GdBsBtgNRRJsad5b1AsrAyhukiX1xLyfkj8rcXiZp++NR4J:6BsfgvRJTd5HAyhudPLyYdXr+NR4J
TLSH
T10F157D61FFCAC2B1DF4705B34876831E127BB6571B1459C7A2D8390E99311C2EE3A26B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KSafeTray.exe

Path C:\Program Files (x86)\KSafe\KSafeTray.exe
Size 1.9MB
SHA256 d6a2213c72d7e8870e892dc0bb82e0a39496bdc7d6f9fefc02881ef89246726f
MD5 b1e1c239105ecdae3025786a50295357
SHA1 45a34f4ba2eb680a2cb5a6459479aa9937e44009
SHA512 04ad89e14c65f92699f75b0ce3fe3021856f9947eea1f7ddef6e94f8109cffdda21cb8c9a6d433c17402a5c25b39cce13916df66f3ec2a7ee584ccac2a63e165
SSDEEP 49152:BvNy2faXn+48RhWPkRvBpUpujBfZayOKLkoK9:BNyUkN6oPkrLZa9wRs
TLSH
T171957C50B79AC276DF5701B10426EB9E9167EA8517146DCFF3483E0F4E722C2783A26E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

soft_3.ico

Path C:\Program Files (x86)\KSafe\KSoft\icon\soft_3.ico
Size 13KB
SHA256 9c2595bb6d5e954a7177494f1b98197fbfeb58bda56464b3f5cdc90aecabb046
MD5 5185872e9383305d9ec6525c2df6aa98
SHA1 bf22506a516ddce7259002f45ad90880afe15901
SHA512 b024bde82ed044031cfbbf76060c47b7f4c5a76243d564c61eaf356ad1edbd36d3e8b372b30816ecc1d08274757a2e25421be2cb29b8b8cd2d5c86d5bdefca0e
SSDEEP 384:uNL/FYRs4QLztSubFcZb1pjjjjjzjjjjB:oNYm4Q3tHFcZZpjjjjjzjjjjB
TLSH
T1E652B387E4C1A982EC3106701C6F9D9E91AAFEFDA4548C8D2D64FC6616728834077E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bksafe.ini

Path C:\Program Files (x86)\KSafe\cfg\bksafe.ini
Size 84B
SHA256 ada58e88363dbb940b6b6fcd357e98330778dbc28fc2dcde6b2d829c979808af
MD5 6e0e676dd99e46dc0ca9dca9f01fb568
SHA1 9c8ab516bb9499347053e7474d5f02d8047c7078
SHA512 d98b13e5eac5f773a8f3a89b19ed770725f2659be00bcc0647f71e038988cf467e106f56e20136217ed0db49a6ee4e21c1b0b947607481d24e6dfea95931f12c
TLSH
T160A0222B000288EA002ACA380A3EC200C3F0AC28CC00B30FC0E02023CFC2A02380C0F2
MD5 SHA1 SHA512 TLSH

Submit Download

ksfmon.ini

Path C:\Program Files (x86)\KSafe\cfg\ksfmon.ini
Size 166B
SHA256 0ad58d9abe05984cafc4a9cf7344873b8fc22b0db69e699d98803c8fc4a0f92e
MD5 646cb8ae8d37f5f77cfca1ab1907edf6
SHA1 130cb45ee76fd52e0ce806e0928ea6dab105982f
SHA512 4055e91a74d4f9f803832c64d358f3dd4d1b4025bed75eb8dede0a6596af9ab80c500a2ec111915ceaad0b60396a747816cebd42556808837f9264c2584aef6c
TLSH
T1C1C04C10C77D011FCA82329044B09B32BC7952683DD567045143F4BBAF0B4274B4D13C
MD5 SHA1 SHA512 TLSH

Submit Download

ksfmon.ini

Path C:\Program Files (x86)\KSafe\cfg\ksfmon.ini
Size 192B
SHA256 17e1f6e9d76b0211caacc6942f669c55e020719b8e608c91ab38324a34b28443
MD5 8c639558beb22f43dfc32891f3051bac
SHA1 3592bf7027595b112d14a9dde9fae3f000a4f41d
SHA512 b247704e2da0aaecfe43f227dffd041206637325c562946f1d8426bc241a6b4b9408bb4b88da6929ecc8025721f03a0977a0318ecab3e8ade1233568bab0655c
TLSH
T1E0C01220C63C000FCAC232A100B09BA2B8B912283DE863041143F6BEAE0B8670B4D03C
MD5 SHA1 SHA512 TLSH

Submit Download

ksrundis.log

Path C:\Program Files (x86)\KSafe\cfg\ksrundis.log
Size 1KB
SHA256 fc2ff24f11b65c02d44765fa3f9d5200988d9bfae9ff74922e17f80d32b6c48e
MD5 5bf7184295732b1b8cdc409177c9bb99
SHA1 7bab975e4cd3d308fa8396f2e41996aaeaa1842a
SHA512 576b9ee20f8d96361f0464194e350e10a22380525f2324eda9b2f9bac7caef55858ffd1997ca031fed7fd3aa295033d6280266db151cd11cf3db1bec4cdbcbbe
TLSH
T10231F7AEA5D0CAAA4EA09CB0D0FDBC414F8AD1C3834DDD42513CD1BA65C6C946C1DB7E
MD5 SHA1 SHA512 TLSH

Submit Download

scansetting.ini

Path C:\Program Files (x86)\KSafe\cfg\scansetting.ini
Size 130B
SHA256 c53748ecccc8b1696ed992efd7558eeba4a8debd03236512e4e62c2cbf0bad5d
MD5 2d1b60a8eca39d70e0d2f29e305b032d
SHA1 e54d9a03e525ad7bff32632793549d320e201cdd
SHA512 35be1aea784d3997307cb39bdd923e221de4e4b84a7461b5b7a9c7e4e5033166729bbeb1a1710b8c8c1a189c52583cca902616e3bb3ad4803d85f7f6a4cc89ea
TLSH
T1E8C09205B291804D0ABE41E51BB1BACC02F189E50D6396A4BCA43C5F3FC51E72AFA597
MD5 SHA1 SHA512 TLSH

Submit Download

Firefoxpassword.bmp

Path C:\Program Files (x86)\KSafe\data\icon\Firefoxpassword.bmp
Size 822B
SHA256 32350795bcbf229512e65b7028ba0293429e844e41720b1ae8b96beda157e610
MD5 39a54eb4f03c49ba4959d0f04495b50b
SHA1 67a3d741fef19311879c662bb646fee05bb7c356
SHA512 fb83df9a492bbe83f9f981b0d8e614ef3349194d473fb1958da52928ef346356e51edeb87f575e9d98b581e48be167d28cae51d3cdd6b3214c42f6a6744357f5
TLSH
T1060165EFE688EC90E824D63940C655680210DFA828D0E2231D92F05A1F309C341D197B
MD5 SHA1 SHA512 TLSH

Submit Download

Intenethistory.bmp

Path C:\Program Files (x86)\KSafe\data\icon\Intenethistory.bmp
Size 1KB
SHA256 6b266103368172929cf65839cf5a28d8025bb0caa7a3358eb6b437e6f380e82a
MD5 6c6832b1fd87b8a793b422e8d29f83e7
SHA1 7f9ea74a3bf10af539af5c02e6542190d435b286
SHA512 3abf7d319967fe96b8a119d460ada7a20ae15e9fb4e99980b3dfb3b336d73b4e89d4bea5c2fe2bbbcc3bd5171a15e3230a45af55a88cdf22463b5c8193d12393
TLSH
T1B9118422A152C1BAE468DF37EB0D53FE300B5E54C258DA8B07DA7D503E321236B036A0
MD5 SHA1 SHA512 TLSH

Submit Download

browser-regedit.bmp

Path C:\Program Files (x86)\KSafe\data\icon\browser-regedit.bmp
Size 1KB
SHA256 9e3c5ca2e06f5f425eb5672aba0febe422d7c6626b106a5a76154cefd358e5da
MD5 f16fe5099d357ad279794740c8916dbe
SHA1 d02b9bf3ae364b244c5696246632286afc89c005
SHA512 0c1f5ab63b15a3507ac42383c090f156eae143b8ebfe58144889acf04a598d15a6eced8855b6b7a284b9626799f9838a8bf49f6259ae0f84b0102ed4da4a745e
TLSH
T1B311650011E0C0DBC7254E72C9E5A5F2BBD6ACF6C08401D309603C8E7C3A4644729957
MD5 SHA1 SHA512 TLSH

Submit Download

googlepassword.bmp

Path C:\Program Files (x86)\KSafe\data\icon\googlepassword.bmp
Size 1KB
SHA256 0ee46daf406f859342b75e10db1a5088be1f1c3da2006a04e920635384050474
MD5 d4e8926324ceddb6092847eae37f0db4
SHA1 bedc17c28b60fd371491076b7d19eeef43118225
SHA512 20294f8272c5c1d1de2c742466cf2e9c65e396d8bbe537257bbdf2dde4110419459dfaae9035adbfbba486fe52cd6b83f55c6dd898022770407ea313385e7c65
TLSH
T15D114F601140E023C7E9A7B1C7C6D2F977562E19E2240A2358B57E2CFFFD883A484900
MD5 SHA1 SHA512 TLSH

Submit Download

opera.bmp

Path C:\Program Files (x86)\KSafe\data\icon\opera.bmp
Size 822B
SHA256 0041adbd93cedbaf068c5dbaddddd8090daf295f4d7e8541f85745381e20b798
MD5 e0c523dbc3460155d8e6cd9314958884
SHA1 a13449320a7a6ec53f574099fe040b92f6efea39
SHA512 0b5b2e8d01bafacadedb976ed0b5ba84ed6e518038fae1f906635fa2c500aa905438c1017368154d6305d5ba41b3f7722bc4d4899a48dcefd37ff8a3775d1a49
TLSH
T12B014EB0820412F4CF9C0EFD21B8B00C207F0D8A769EAE9D080B38900FF21D9213CD40
MD5 SHA1 SHA512 TLSH

Submit Download

windowofworldpassword.bmp

Path C:\Program Files (x86)\KSafe\data\icon\windowofworldpassword.bmp
Size 1KB
SHA256 5880c4fdf1f5123d75c0e2f01e3dbab0696cd171cd87f961ad13c1f63985eac1
MD5 a006f77be4d925cd8a73ffbc12a2374f
SHA1 80157b4ae3e82214de5a2b0b017e3b188a817145
SHA512 f86cc90636350e4eef467510c89e87fad4ccdc4c494dd680909e9d5133b89aefa8c462911265632a5f33f1293eda7b0e6518bc8ac5826deffde281d6969cad8d
TLSH
T13611F90131CED176EBC7827BCA75A6F5E8165C16C192375B20503E09377798BB51E390
MD5 SHA1 SHA512 TLSH

Submit Download

winlivemsg.bmp

Path C:\Program Files (x86)\KSafe\data\icon\winlivemsg.bmp
Size 822B
SHA256 c451b062b45d269e422db7da18c2cff9ec0769bce5c89e51c289448ca404f6f2
MD5 b4d074d27f8ab0b13a9bb0a47e3141a2
SHA1 4f71baac43dc0b858400175585560095c474fdc9
SHA512 b97980504ee79fb75e68f0072dd140c38c26b5f944ba8b63ca4b317574d404ee2437f5cb6c805afbb3ac6083174f3e9adbc93e6dff440e9ea4970ca3b4fddbaa
TLSH
T151016869B1E18611DE785776631DB31F04311E316533E07C3615B4604B325DD8C199D0
MD5 SHA1 SHA512 TLSH

Submit Download

katrun.dll

Path C:\Program Files (x86)\KSafe\katrun.dll
Size 213KB
SHA256 db1b315a78bffe5136e73e401d600a5eb8ba4141aff46f1bf9f9da63ba8070ec
MD5 673acf5f8d935ef614f48de4f86b29b8
SHA1 e4e056aa74e2a191d6dd4dcd913317f3d51b1fdc
SHA512 4dad09b297de4d24ff5bfff5e336c43078e422b344a4fe4deae4e4fa5df274ebf473ffbc294cc488961527d99247233247d1a964d8fddb5ec308ad1abb335ce3
SSDEEP 3072:bjUPlHRsR6oS1F06y+BRYLixJV5+OQRtynqro:cU6oS1sTfo
TLSH
T1FA245B113BD5C2BADB5F173280B69B15737AB9632B90D0CBAB289D8E98316C17D74312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcache.dll

Path C:\Program Files (x86)\KSafe\kcache.dll
Size 189KB
SHA256 7d2cd4419e3cc1f1040ec3e76d15ab897838b844811be08a9f8dca81ef217955
MD5 3ebab621e30d34050bc8caf60339fd95
SHA1 3bc2fd9fa62654c2921af139d75ddebb1f65aeab
SHA512 b8bbea732d45dbe1e5c34a77735f8d00c9d8c311778de5c169335dd5036998817a62d5aa6dda7c2251a7f94957824d06353923237000477222022d987dc4e191
SSDEEP 3072:Mv1dV8ESr5EbtUJ6pxHnhTK7QkmH7YV62:MOqtUm4zZc2
TLSH
T15D147C027AE6C177E64F023944B28785637B79576BB185CFA7684E0F7EA22C03C35752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdump.dll

Path C:\Program Files (x86)\KSafe\kdump.dll
Size 205KB
SHA256 28af683a9b2452eabde3b96316e2d0a87d360fc56741c5af036947cfad09dadc
MD5 d6ad932cd7d5c1a4d893a26558f6dcbb
SHA1 23fb0877592017803a63f3ef95bab614f63ff06a
SHA512 30fc403f654f9f4d936f8e72ac665325fb20a59bb8a7b435a13fe425a0c69865e27c8512f36680df3627ecf41584c5031e02db8857d0f472f4d9dcf1e603ec13
SSDEEP 3072:GoJGjpoJ5pt+0BuuPsbym/iTcIIBkRAkB2LTmn7I/td3jWMSW:Napo7pBuuPqkgIItC6PSW
TLSH
T17B249E1231C1C47AE3AF03B5855BEF3926BE78714B75D2476BC44EC95E613A29E2A303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdumpcfg.dat

Path C:\Program Files (x86)\KSafe\kdumpcfg.dat
Size 19B
SHA256 98b751a01adf2a00ac0022d530f3af61ed16376bd1da57a7acac70be361cd20f
MD5 6be2205cc039dececc4f123dc11319f1
SHA1 eefebfdfb352f664154c390aa44a48115cfe6d14
SHA512 6088863fe454cdf9960ec4c5fd25d558e97200a7fc960f572e215561337977467563d536a072f4cebd764cccbd7867a0d3bc2e441f2820b1e974bf6375f09279
MD5 SHA1 SHA512

Submit Download

knescan.dll

Path C:\Program Files (x86)\KSafe\knescan.dll
Size 218KB
SHA256 0de1b63e92234ce737b61998aa6f360fb43988f4679d6fd7e157e55e6d5384d3
MD5 49fa3da5350bb8d0b57adc15b7003ec9
SHA1 18435b106480b8456ec025d0f828aefd66fb3b33
SHA512 662781aa92ae7dfb41e987fb2d6ab2807425d2fd96ca27fc22317f21d20afe29aae010a1a246f9f702f1b4a231bb4c739249a9925e5bc61452c6a719ab9becaa
SSDEEP 3072:s8qDz9PkW+7B7bn+kOtJKEQqc+eaI0oK:s8mB8W+7tQtvyA
TLSH
T146245B92FE928473D806073991E2C264FABFE5836F9766C7DB015278BD503C02E752AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksafebak.dll

Path C:\Program Files (x86)\KSafe\ksafebak.dll
Size 225KB
SHA256 7cd8c589d0188640fb83b6ef1173aba386c85fd3908637ee16e5a71e824c060d
MD5 88ee0fb3d4d407a3395ebac00d692898
SHA1 16099aa0923a11f7c47fc58e71fc28416323561b
SHA512 642e174586dab4f7c55e986ce6b97551f4f6a7ce6b3fdbea803d88a3b064f4ca482094940f980a18d7ba4b24f11f47842696b9cafc0ac389b87255a12fd510be
SSDEEP 3072:H+eemnolfjbqM8WLaBeTPScP5N1psudLfFtLSnS0gyN+32MLf3D3V8MQi/+koU+b:FCVvLHScb3sefFtLSzgE0NxbGb1r
TLSH
T14634AE417B97C27BD68F0A3690A7571E633EA2923B20F5CBF7580D495E302C13A79399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksafedb.dll

Path C:\Program Files (x86)\KSafe\ksafedb.dll
Size 517KB
SHA256 cf8e12d75518acf49380afc2b42db34cfb239d99a712760cda0cd596f9d76207
MD5 ba7a52322ca8f077d31e17a70ca71b13
SHA1 4ffdc4898c740c7c91811758e0e8411a3b527e24
SHA512 d758e31c65e61042ecc22bc1da2345f22616d161efccc0cb1e0d227bd40818b73d551cef5c8166090de3ac7fc69e20d7535fb8be1c9eed0137a3269b48c581fc
SSDEEP 12288:mcL+BU+8Jil8SofLKXLvsxDwjYt3jg9h3dwGu:mcL+BbUM8So2XLU9w2Mlu
TLSH
T156B4AE92AAD3C1F1E9CB61F912B65B7B1F3896079312A4D3AFD41DC24E102F2677E241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksafeeng.dll

Path C:\Program Files (x86)\KSafe\ksafeeng.dll
Size 597KB
SHA256 9d4d60dc828f9709815a6e6d1db2d78aa4b556f5518712cf5f0faedbec649029
MD5 2562cdd5c1697a4212169a8aa8ecb322
SHA1 808c5c0a702981d4d5ac207cbf10e4c20127abf4
SHA512 fe703558d63cb41c730900bc78e023577c91d7dd888eded1ea7a29eac86eb8d25f45a2faa0057843a03cc16adc6e7436fa74de88508125159d8880c17ea307aa
SSDEEP 12288:VRDppi/El2N9HTKygVKTzM9vnCMgH/4xexxdsdJ5HJFEP:VRDXkPbtPM9vnr8/4xEsdJXFEP
TLSH
T188D49E017BDA81B2D6DE053940F1B71E573A7A969730B6C3F7A029BA9C701D2BD38346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksfmon.dll

Path C:\Program Files (x86)\KSafe\ksfmon.dll
Size 1.1MB
SHA256 51bb0f08eb941fc7b69b2f2b90f912c3728262c3c26dd55b07925161b6f46895
MD5 d4f16e7cb886f5be143b8f43ac466122
SHA1 a8cb4c98d40528a2004f9cf41ba3dbeda645b632
SHA512 f60e0258931dd12a94066588c6fdc1d558d4edb9ecad100cf84677b613e16e9d70639652271cabdf3aab88e10d3920bc0c7fcd6a124faf48282a060bc05edc9d
SSDEEP 24576:dR1jojlUfMx+okjV829Qp/oooO4PO3+FjU2lggn:Xnjh9QpMO4PO3+FjU2lggn
TLSH
T1BA456C11FB9AC276DF5F16B40479A70E517EA6850F304AD3E7983E8F5C311C27A3A18A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kxecomm.dat

Path C:\Program Files (x86)\KSafe\kxecomm.dat
Size 149B
SHA256 d6504c7ce8f3db8d6e893e43170c0a87928676b516e3ad27ce8d1f4d253132c9
MD5 a1c5d0e73524d00ae9a50094eb19f355
SHA1 b27d88fe7582ea85291ab2af84d543b2c01d55ab
SHA512 1a6d099386b1e2873f6f5a772c8343536ee28fc2d86f49c227bb277ff6a3bc1bdf8ad6e567735771548aeb7a1f6c31763782e7d1eafd6f0dfe8225ed23034cff
TLSH
T165C04CA15A309195041997A90E8582C4BF28D8473ADF8491A055F74567E11C735451C9
MD5 SHA1 SHA512 TLSH

Submit Download

ksbw_wi.fsg

Path C:\ProgramData\kingsoft\ksbw\ksbw_wi.fsg
Size 256KB
SHA256 722586f2ead7f8e14bbc95e5f84a069255a3c21449daa03109ff81c6bae96365
MD5 47d8dd713a9e27bda9ede09a5b9f2fd8
SHA1 14b667c96eec8ef8d9ef2404b6ce6ef22b70f843
SHA512 0d37217f4a384d2e9ba876029f50ead9a01dc6d629de5482d2527e14881e836aef8ad53f677147c5a946964697bcf1826784bcb967bed29618cf1e3ee847f089
SSDEEP 6:eIvCMBMolLNWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWH:eiM4LB
TLSH
T137441250B7012413D8300334824B03100432D242378B4043097008343C213460B438C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KillProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsdA183.tmp\KillProcDLL.dll
Size 56KB
SHA256 1ec207c5368f7c1d6467958c8b94bab89f0b662aad02e20d7f59c2a13993dea5
MD5 69c39dad080ad1dbb3b71ec6d362b72e
SHA1 7d0136d950ea9dcbce67876c1f54882a850db37a
SHA512 d15d4b091c4c2e7b9f8fb8135a5d3b8acd6a822325024a9d55481dbc7551cc47d7b1da14ebd8197dd964481ed1290c7adc86e9889d93d9b7915abf71bd5c9179
SSDEEP 768:EvMN+dsb7Lhq8jj1gX3w80RfiFUW3ZmeprfQ5:aMN+dsb5bunLtJJ9RQ
TLSH
T11643181878438473E145093986D586C25FFF2C0337E764BFEF9605DE06E1298A5BAAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup_ieangels.exe

Path C:\Users\Admin\AppData\Local\Temp\setup_ieangels.exe
Size 14.8MB
SHA256 3e35e0e5e3cfd5217a536b4e2e0ba2d0604a7bac1a24be5cef4c5a7fd17056ff
MD5 45246b7576dcd61e1c3f8af10d45bdd5
SHA1 7fe323471a03e7d4d38dc0002c9c805515ae2cfc
SHA512 8ec4deed48cb32d7ce1993bb28a124cfb7974ed376274078af5723282833af390e060607ecbff3f36edc730bb366df806a3c6c3d7888f03ff82ce248e2fb6fed
SSDEEP 393216:OmiI9MYUEKHjcmoOxfWau37kvZceLayzt4d2:OmioKAmYt37oceJzV
TLSH
T18FF633FD4191F481F8435D74698525F2E344C7F48F90C497AA23E898B5A687C0B7BF89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/820-920-0x0000000002300000-0x0000000002339000-memory.dmp

Download

memory/820-930-0x0000000002370000-0x00000000023A0000-memory.dmp

Download

memory/820-915-0x00000000021A0000-0x00000000021D6000-memory.dmp

Download

memory/820-925-0x0000000002790000-0x0000000002812000-memory.dmp

Download

memory/2060-1107-0x00000000023C0000-0x00000000023F4000-memory.dmp

Download

memory/2160-1052-0x0000000006B90000-0x0000000006BE6000-memory.dmp

Download

memory/2160-1503-0x0000000001700000-0x000000000170D000-memory.dmp

Download

memory/2160-982-0x0000000001260000-0x0000000001295000-memory.dmp

Download

memory/2160-1007-0x0000000001ED0000-0x0000000001EEE000-memory.dmp

Download

memory/2160-1018-0x0000000004560000-0x0000000004578000-memory.dmp

Download

memory/2160-1020-0x0000000004750000-0x0000000004811000-memory.dmp

Download

memory/2160-1026-0x0000000005660000-0x00000000056B1000-memory.dmp

Download

memory/2160-969-0x00000000010D0000-0x0000000001100000-memory.dmp

Download

memory/2160-1023-0x00000000045C0000-0x00000000045D1000-memory.dmp

Download

memory/2160-1014-0x00000000043B0000-0x00000000043F1000-memory.dmp

Download

memory/2160-1068-0x0000000007D70000-0x0000000007DF7000-memory.dmp

Download

memory/2160-957-0x0000000000FA0000-0x0000000000FD6000-memory.dmp

Download

memory/2160-1505-0x0000000001710000-0x000000000172E000-memory.dmp

Download

memory/2160-1504-0x0000000004400000-0x0000000004540000-memory.dmp

Download

memory/2160-1502-0x0000000004400000-0x0000000004540000-memory.dmp

Download

memory/2160-1167-0x0000000008920000-0x00000000089DF000-memory.dmp

Download

memory/2160-1501-0x00000000016C0000-0x00000000016D5000-memory.dmp

Download

memory/2160-1040-0x00000000056D0000-0x00000000057E7000-memory.dmp

Download

memory/2160-1042-0x00000000056D0000-0x0000000005757000-memory.dmp

Download

memory/2160-1044-0x00000000056D0000-0x0000000005788000-memory.dmp

Download

memory/2160-1048-0x0000000006C50000-0x0000000006D67000-memory.dmp

Download

memory/2160-1050-0x0000000006A50000-0x0000000006A6C000-memory.dmp

Download

memory/2160-1006-0x0000000001240000-0x0000000001250000-memory.dmp

Download

memory/2160-961-0x0000000000FE0000-0x0000000001019000-memory.dmp

Download

memory/2160-965-0x0000000001040000-0x00000000010C2000-memory.dmp

Download

memory/2160-992-0x00000000012E0000-0x000000000131A000-memory.dmp

Download

memory/2160-996-0x00000000011B0000-0x00000000011BE000-memory.dmp

Download

memory/2160-994-0x0000000001CB0000-0x0000000001CE4000-memory.dmp

Download

memory/2160-974-0x0000000001100000-0x0000000001137000-memory.dmp

Download

memory/2160-1142-0x0000000006A70000-0x0000000006A7B000-memory.dmp

Download

memory/2160-1145-0x0000000008900000-0x0000000008919000-memory.dmp

Download

memory/2160-1248-0x0000000008800000-0x000000000883E000-memory.dmp

Download

memory/4204-944-0x00000000022F0000-0x0000000002372000-memory.dmp

Download

memory/4204-936-0x0000000002150000-0x0000000002186000-memory.dmp

Download

memory/4204-948-0x0000000002200000-0x0000000002230000-memory.dmp

Download

memory/4204-940-0x00000000021A0000-0x00000000021D9000-memory.dmp

Download

memory/4904-1-0x0000000002290000-0x0000000002291000-memory.dmp

Download

memory/4904-0-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

memory/4904-7-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

memory/5852-1489-0x0000000004450000-0x00000000044AC000-memory.dmp

Download

memory/5852-1491-0x00000000032B0000-0x00000000032D2000-memory.dmp

Download

memory/5852-999-0x00000000034F0000-0x0000000003572000-memory.dmp

Download

memory/5852-987-0x00000000023E0000-0x0000000002414000-memory.dmp

Download

memory/5852-1162-0x0000000005980000-0x00000000059D6000-memory.dmp

Download

memory/5852-1109-0x00000000050C0000-0x000000000511B000-memory.dmp

Download

memory/5852-997-0x00000000032F0000-0x000000000334A000-memory.dmp

Download

memory/5852-1334-0x0000000000A40000-0x0000000000AC9000-memory.dmp

Download

memory/5852-1160-0x0000000005910000-0x000000000594E000-memory.dmp

Download