_s2g100464_1488156589.exe is part of ?????? according to the _s2g100464_1488156589.exe version information.
_s2g100464_1488156589.exe's description is "?????"
_s2g100464_1488156589.exe is digitally signed by ????????????.
_s2g100464_1488156589.exe is usually located in the 'c:\downloads\' folder.
Some of the anti-virus scanners at VirusTotal detected _s2g100464_1488156589.exe.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
The following is the available information on _s2g100464_1488156589.exe:
Property | Value |
---|---|
Product name | ?????? |
File description | ????? |
Internal name | ?????? |
Original filename | setup.exe |
Legal copyright | Copyright (C) 2015 |
Product version | 2.4.0.367 |
File version | 2.4.0.367 |
Here's a screenshot of the file properties when displayed by Windows Explorer:
Product name | ?????? |
File description | ????? |
Internal name | ?????? |
Original filename | setup.exe |
Legal copyright | Copyright (C) 2015 |
Product version | 2.4.0.367 |
File version | 2.4.0.367 |
_s2g100464_1488156589.exe has a valid digital signature.
Property | Value |
---|---|
Signer name | ???????????? |
Certificate issuer name | WoSign Class 3 Code Signing CA G2 |
Certificate serial number | 6749c2580cc80e5ab2186d803071ebc2 |
43 of the 67 anti-virus programs at VirusTotal detected the _s2g100464_1488156589.exe file. That's a 64% detection rate.
Scanner | Detection Name |
---|---|
Ad-Aware | Trojan.GenericKD.41128292 |
AhnLab-V3 | PUP/Win32.Helper.R195919 |
Alibaba | AdWare:Win32/Kuaiba.93e964c8 |
ALYac | Trojan.GenericKD.41128292 |
Antiy-AVL | GrayWare[AdWare]/Win32.Kuaiba |
Arcabit | Trojan.Generic.D2739164 |
Avast | Win32:Adware-gen [Adw] |
AVG | Win32:Adware-gen [Adw] |
BitDefender | Trojan.GenericKD.41128292 |
CAT-QuickHeal | Adware.Generic.S380885 |
Comodo | ApplicUnwnt@#s6l4j1bjj0vn |
Cybereason | malicious.5d1e41 |
Cyren | W32/Kuaiba.A.gen!Eldorado |
DrWeb | Trojan.DownLoader23.37623 |
Emsisoft | Trojan.GenericKD.41128292 (B) |
Endgame | malicious (high confidence) |
ESET-NOD32 | a variant of Win32/Adware.Kuaiba.G |
FireEye | Generic.mg.22686e45d1e414f9 |
GData | Trojan.GenericKD.41128292 |
Ikarus | PUA.Kuaiba |
Invincea | heuristic |
Jiangmin | AdWare.Kuaiba.ae |
K7AntiVirus | Adware ( 004dbadd1 ) |
K7GW | Adware ( 004dbadd1 ) |
Kaspersky | not-a-virus:AdWare.Win32.Kuaiba.ajw |
Malwarebytes | Adware.Kuaiba |
MAX | malware (ai score=99) |
McAfee | PUP-XBQ-TK |
McAfee-GW-Edition | PUP-XBQ-TK |
Microsoft | PUA:Win32/Kuaiba |
MicroWorld-eScan | Trojan.GenericKD.41128292 |
NANO-Antivirus | Riskware.Win32.Kuaiba.ekatkt |
Paloalto | generic.ml |
Panda | Trj/Genetic.gen |
Rising | Malware.Generic.5!tfe (CLOUD) |
SentinelOne | DFI - Suspicious PE |
Sophos | Generic PUA HB (PUA) |
SUPERAntiSpyware | Adware.Kuaiba/Variant |
VBA32 | AdWare.Kuaiba |
VIPRE | Trojan.Win32.Generic!BT |
Yandex | PUA.Kuaiba! |
Zillya | Adware.Kuaiba.Win32.347 |
ZoneAlarm | not-a-virus:AdWare.Win32.Kuaiba.ajw |
The following information was gathered by executing the file inside Cuckoo Sandbox.
Successfully executed process in sandbox.
{ "file_recreated": [ "\\??\\Scsi0:", "\\??\\Scsi1:" ], "dll_loaded": [ "ADVAPI32.dll", "SETUPAPI.dll", "netapi32.dll", "Iphlpapi.dll", "PROPSYS.dll", "C:\\Windows\\syswow64\\MSCTF.dll", "API-MS-Win-Core-LocalRegistry-L1-1-0.dll", "Riched20.dll", "kernel32.dll", "OLEAUT32.dll", "C:\\Windows\\system32\\ole32.dll", "dwmapi.dll", "rpcrt4.dll", "ole32.dll", "comctl32.dll", "OLEAUT32.DLL", "C:\\Windows\\system32\\uxtheme.dll" ], "file_opened": [ "\\\\?\\PIPE\\wkssvc", "\\??\\PhysicalDrive0", "C:\\Windows\\win.ini", "C:\\", "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls" ], "regkey_opened": [ "HKEY_LOCAL_MACHINE\\SOFTWARE\\Hintsoft", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\lychee", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\ec59d64102cfd05c2eca786af1d3db253c3ed55b486fd0f6b6510a633177f123.bin", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Network\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\{AEFD33F3-CC73-4821-AD44-6915063E7FB1}\\Connection", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\ec59d64102cfd05c2eca786af1d3db253c3ed55b486fd0f6b6510a633177f123.bin", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u5feb\u5427\u7ef4\u62a4\u5e73\u53f0\u65e0\u76d8(\u5ba2\u6237\u7aef)_is1", "HKEY_CURRENT_USER\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\DriveIcons\\C\\DefaultLabel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Network\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\{EF381EA0-4D07-418D-A490-68AF67CE948B}\\Connection", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u00bd\u00f0\u00c9\u00bd\u00ce\u00c0\u00ca\u00bf", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u5feb\u5427\u6709\u76d8\u7ef4\u62a4\u5e73\u53f0\u5ba2\u6237\u7aef_is1", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\360SD", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\DriveIcons\\C\\DefaultLabel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\360\u00b0\u00b2\u00c8\u00ab\u00ce\u00c0\u00ca\u00bf", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\QQPCMgr", "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\8", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Goyoo", "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\LayoutIcon\\0409\\0000041d", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Pubwin2015\u5ba2\u6237\u7aef_is1", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_CURRENT_USER\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}", "HKEY_CLASSES_ROOT\\Applications\\Explorer.exe\\Drives\\C\\DefaultLabel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u00b0\u00d9\u00b6\u00c8\u00ce\u00c0\u00ca\u00bf", "HKEY_LOCAL_MACHINE\\SOFTWARE\\\u676d\u5dde\u987a\u7f51\u4fe1\u606f\u6280\u672f\u6709\u9650\u516c\u53f8", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Kingsoft Internet Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Yileyoo", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u00b0\u00d9\u00b6\u00c8\u00c9\u00b1\u00b6\u00be", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\{EF381EA0-4D07-418D-A490-68AF67CE948B}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{98D73BDD-CA25-4BCA-A68C-AD6171206063}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Sicent", "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Hintsoft\\PubwinClient", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\12", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup", "HKEY_LOCAL_MACHINE\\SOFTWARE\\YileyooClient", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\", "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\{AEFD33F3-CC73-4821-AD44-6915063E7FB1}" ], "file_written": [ "\\\\?\\PIPE\\wkssvc" ], "file_failed": [ "\\??\\Scsi13:", "\\??\\Scsi7:", "\\??\\Scsi11:", "\\??\\Scsi9:", "\\??\\Scsi12:", "\\??\\Scsi3:", "\\??\\Scsi5:", "\\??\\PhysicalDrive7", "\\??\\PhysicalDrive6", "\\??\\PhysicalDrive5", "\\??\\PhysicalDrive4", "\\??\\PhysicalDrive3", "\\??\\PhysicalDrive2", "\\??\\PhysicalDrive1", "\\??\\Scsi14:", "\\??\\PhysicalDrive9", "\\??\\PhysicalDrive8", "\\??\\Scsi6:", "\\??\\Scsi10:", "\\??\\Scsi8:", "\\??\\PhysicalDrive15", "\\??\\PhysicalDrive14", "\\??\\PhysicalDrive13", "\\??\\PhysicalDrive12", "\\??\\PhysicalDrive11", "\\??\\PhysicalDrive10", "\\??\\Scsi2:", "\\??\\Scsi4:", "\\??\\Scsi15:" ], "wmi_query": [ "SELECT * FROM Win32_ComputerSystem" ], "guid": [ "{4590f811-1d3a-11d0-891f-00aa004b2e24}", "{44aca674-e8fc-11d0-a07c-00c04fb68820}", "{674b6698-ee92-11d0-ad71-00c04fd8fdff}", "{8bc3f05e-d86b-11d0-a075-00c04fb68820}", "{7c857801-7381-11cf-884d-00aa004b2e24}", "{d5f569d0-593b-101a-b569-08002b2dbf7a}", "{f309ad18-d86a-11d0-a075-00c04fb68820}", "{dc12a687-737f-11cf-884d-00aa004b2e24}" ], "file_read": [ "\\\\?\\PIPE\\wkssvc", "C:\\Windows\\win.ini" ], "regkey_read": [ "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForOverlay", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\DevicePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes", "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\MapNetDriveVerbs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisplayName_RemovableDisk", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForInfoTip", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Data", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideFolderVerbs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Generation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\8\\ServiceName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisplayName_OpticalDisk", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsParseDisplayName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Network\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\{AEFD33F3-CC73-4821-AD44-6915063E7FB1}\\Connection\\Name", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInset", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInterval", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollDelay", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Hostname", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShowDriveLettersFirst", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsAliasedNotifications", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\NoFileFolderJunction", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Data", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HasNavigationEnum", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORDISPLAY", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\UseDropHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideInWebView", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Generation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\PinToNameSpaceTree", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\12\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideOnDesktopPerUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallDate", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Domain", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\12\\ServiceName", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragMinDist", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\ShowDriveLettersFirst", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsUniversalDelegate", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\_LabelFromReg", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Network\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\{EF381EA0-4D07-418D-A490-68AF67CE948B}\\Connection\\Name", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORPARSING", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\8\\Description", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragDelay", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisplayName_RemoteDrive", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisplayName_FixedDisk", "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisplayName_Floppy" ] }
[ { "process_path": "C:\\Windows\\System32\\lsass.exe", "process_name": "lsass.exe", "pid": 476, "summary": {}, "first_seen": 1583643185.34375, "ppid": 376 }, { "process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\ec59d64102cfd05c2eca786af1d3db253c3ed55b486fd0f6b6510a633177f123.bin", "process_name": "ec59d64102cfd05c2eca786af1d3db253c3ed55b486fd0f6b6510a633177f123.bin", "pid": 2436, "summary": { "file_recreated": [ "\\??\\Scsi0:", "\\??\\Scsi1:" ], "dll_loaded": [ "ADVAPI32.dll", "SETUPAPI.dll", "netapi32.dll", "Iphlpapi.dll", "PROPSYS.dll", "C:\\Windows\\syswow64\\MSCTF.dll", "API-MS-Win-Core-LocalRegistry-L1-1-0.dll", "Riched20.dll", "kernel32.dll", "OLEAUT32.dll", "C:\\Windows\\system32\\ole32.dll", "dwmapi.dll", "rpcrt4.dll", "ole32.dll", "comctl32.dll", "OLEAUT32.DLL", "C:\\Windows\\system32\\uxtheme.dll" ], "file_opened": [ "\\\\?\\PIPE\\wkssvc", "\\??\\PhysicalDrive0", "C:\\Windows\\win.ini", "C:\\", "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls" ], "regkey_opened": [ "HKEY_LOCAL_MACHINE\\SOFTWARE\\Hintsoft", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\lychee", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\ec59d64102cfd05c2eca786af1d3db253c3ed55b486fd0f6b6510a633177f123.bin", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Network\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\{AEFD33F3-CC73-4821-AD44-6915063E7FB1}\\Connection", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\ec59d64102cfd05c2eca786af1d3db253c3ed55b486fd0f6b6510a633177f123.bin", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u5feb\u5427\u7ef4\u62a4\u5e73\u53f0\u65e0\u76d8(\u5ba2\u6237\u7aef)_is1", "HKEY_CURRENT_USER\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\DriveIcons\\C\\DefaultLabel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Network\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\{EF381EA0-4D07-418D-A490-68AF67CE948B}\\Connection", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u00bd\u00f0\u00c9\u00bd\u00ce\u00c0\u00ca\u00bf", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u5feb\u5427\u6709\u76d8\u7ef4\u62a4\u5e73\u53f0\u5ba2\u6237\u7aef_is1", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\360SD", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\DriveIcons\\C\\DefaultLabel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\360\u00b0\u00b2\u00c8\u00ab\u00ce\u00c0\u00ca\u00bf", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\QQPCMgr", "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\8", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Goyoo", "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\LayoutIcon\\0409\\0000041d", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Pubwin2015\u5ba2\u6237\u7aef_is1", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_CURRENT_USER\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}", "HKEY_CLASSES_ROOT\\Applications\\Explorer.exe\\Drives\\C\\DefaultLabel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u00b0\u00d9\u00b6\u00c8\u00ce\u00c0\u00ca\u00bf", "HKEY_LOCAL_MACHINE\\SOFTWARE\\\u676d\u5dde\u987a\u7f51\u4fe1\u606f\u6280\u672f\u6709\u9650\u516c\u53f8", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Kingsoft Internet Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Yileyoo", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u00b0\u00d9\u00b6\u00c8\u00c9\u00b1\u00b6\u00be", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\{EF381EA0-4D07-418D-A490-68AF67CE948B}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{98D73BDD-CA25-4BCA-A68C-AD6171206063}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Sicent", "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Hintsoft\\PubwinClient", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\12", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup", "HKEY_LOCAL_MACHINE\\SOFTWARE\\YileyooClient", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\", "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\{AEFD33F3-CC73-4821-AD44-6915063E7FB1}" ], "file_written": [ "\\\\?\\PIPE\\wkssvc" ], "file_failed": [ "\\??\\Scsi13:", "\\??\\Scsi7:", "\\??\\Scsi11:", "\\??\\Scsi9:", "\\??\\Scsi12:", "\\??\\Scsi3:", "\\??\\Scsi5:", "\\??\\PhysicalDrive7", "\\??\\PhysicalDrive6", "\\??\\PhysicalDrive5", "\\??\\PhysicalDrive4", "\\??\\PhysicalDrive3", "\\??\\PhysicalDrive2", "\\??\\PhysicalDrive1", "\\??\\Scsi14:", "\\??\\PhysicalDrive9", "\\??\\PhysicalDrive8", "\\??\\Scsi6:", "\\??\\Scsi10:", "\\??\\Scsi8:", "\\??\\PhysicalDrive15", "\\??\\PhysicalDrive14", "\\??\\PhysicalDrive13", "\\??\\PhysicalDrive12", "\\??\\PhysicalDrive11", "\\??\\PhysicalDrive10", "\\??\\Scsi2:", "\\??\\Scsi4:", "\\??\\Scsi15:" ], "wmi_query": [ "SELECT * FROM Win32_ComputerSystem" ], "guid": [ "{4590f811-1d3a-11d0-891f-00aa004b2e24}", "{44aca674-e8fc-11d0-a07c-00c04fb68820}", "{674b6698-ee92-11d0-ad71-00c04fd8fdff}", "{8bc3f05e-d86b-11d0-a075-00c04fb68820}", "{7c857801-7381-11cf-884d-00aa004b2e24}", "{d5f569d0-593b-101a-b569-08002b2dbf7a}", "{f309ad18-d86a-11d0-a075-00c04fb68820}", "{dc12a687-737f-11cf-884d-00aa004b2e24}" ], "file_read": [ "\\\\?\\PIPE\\wkssvc", "C:\\Windows\\win.ini" ], "regkey_read": [ "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForOverlay", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\DevicePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes", "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\MapNetDriveVerbs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisplayName_RemovableDisk", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForInfoTip", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Data", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideFolderVerbs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Generation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\8\\ServiceName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisplayName_OpticalDisk", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsParseDisplayName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Network\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\{AEFD33F3-CC73-4821-AD44-6915063E7FB1}\\Connection\\Name", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInset", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInterval", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollDelay", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Hostname", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShowDriveLettersFirst", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsAliasedNotifications", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\NoFileFolderJunction", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Data", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HasNavigationEnum", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORDISPLAY", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\UseDropHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideInWebView", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Generation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\PinToNameSpaceTree", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\12\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideOnDesktopPerUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallDate", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Domain", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\12\\ServiceName", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragMinDist", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\ShowDriveLettersFirst", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsUniversalDelegate", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\_LabelFromReg", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Network\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\{EF381EA0-4D07-418D-A490-68AF67CE948B}\\Connection\\Name", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORPARSING", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\8\\Description", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragDelay", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisplayName_RemoteDrive", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisplayName_FixedDisk", "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisplayName_Floppy" ] }, "first_seen": 1583643185.609375, "ppid": 1564 } ]
[ { "markcount": 1, "families": [], "description": "Queries for the computername", "severity": 1, "marks": [ { "call": { "category": "misc", "status": 1, "stacktrace": [], "api": "GetComputerNameW", "return_value": 1, "arguments": { "computer_name": "CUCKPC" }, "time": 1583643185.875375, "tid": 2124, "flags": {} }, "pid": 2436, "type": "call", "cid": 759 } ], "references": [], "name": "antivm_queries_computername" }, { "markcount": 1, "families": [], "description": "Checks if process is being debugged by a debugger", "severity": 1, "marks": [ { "call": { "category": "system", "status": 0, "stacktrace": [], "last_error": 0, "nt_status": -1073741515, "api": "IsDebuggerPresent", "return_value": 0, "arguments": {}, "time": 1583643185.703375, "tid": 2124, "flags": {} }, "pid": 2436, "type": "call", "cid": 74 } ], "references": [], "name": "checks_debugger" }, { "markcount": 1, "families": [], "description": "Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate)", "severity": 1, "marks": [ { "category": "registry", "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallDate", "type": "ioc", "description": null } ], "references": [], "name": "recon_fingerprint" }, { "markcount": 1, "families": [], "description": "This executable has a PDB path", "severity": 1, "marks": [ { "category": "pdb_path", "ioc": "d:\\svn\\APPS\\GMSetupPacker\\Build\\bin\\release_static\\kuai8_downloader_1.pdb", "type": "ioc", "description": null } ], "references": [], "name": "has_pdb" }, { "markcount": 1, "families": [], "description": "Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available", "severity": 1, "marks": [ { "call": { "category": "system", "status": 1, "stacktrace": [], "api": "GlobalMemoryStatusEx", "return_value": 1, "arguments": {}, "time": 1583643185.828375, "tid": 856, "flags": {} }, "pid": 2436, "type": "call", "cid": 637 } ], "references": [], "name": "antivm_memory_available" }, { "markcount": 3, "families": [], "description": "The file contains an unknown PE resource name possibly indicative of a packer", "severity": 1, "marks": [ { "category": "resource name", "ioc": "GIF", "type": "ioc", "description": null }, { "category": "resource name", "ioc": "PNG", "type": "ioc", "description": null }, { "category": "resource name", "ioc": "XML", "type": "ioc", "description": null } ], "references": [], "name": "pe_unknown_resource_name" }, { "markcount": 1, "families": [], "description": "Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation", "severity": 2, "marks": [ { "call": { "category": "misc", "status": 1, "stacktrace": [], "api": "GetDiskFreeSpaceW", "return_value": 1, "arguments": { "root_path": "C:\\", "sectors_per_cluster": 8, "number_of_free_clusters": 5740542, "total_number_of_clusters": 8362495, "bytes_per_sector": 512 }, "time": 1583643185.812375, "tid": 2124, "flags": {} }, "pid": 2436, "type": "call", "cid": 510 } ], "references": [], "name": "antivm_disk_size" }, { "markcount": 1, "families": [ "china" ], "description": "Checks for known Chinese AV sofware registry keys", "severity": 2, "marks": [ { "category": "regkey", "ioc": ".*Kingsoft", "type": "ioc", "description": null } ], "references": [], "name": "av_detect_china_key" }, { "markcount": 48, "families": [], "description": "Foreign language identified in PE resource", "severity": 2, "marks": [ { "name": "GIF", "language": "LANG_CHINESE", "offset": "0x00166a18", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x00001555" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "PNG", "language": "LANG_CHINESE", "offset": "0x00195c0c", "filetype": "ASCII text, with very long lines, with no line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000187f" }, { "name": "XML", "language": "LANG_CHINESE", "offset": "0x0019748c", "filetype": "ISO-8859 text, with very long lines, with CRLF line terminators", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x00003ed9" }, { "name": "RT_ICON", "language": "LANG_CHINESE", "offset": "0x0019f340", "filetype": "GLS_BINARY_LSB_FIRST", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x00000468" }, { "name": "RT_ICON", "language": "LANG_CHINESE", "offset": "0x0019f340", "filetype": "GLS_BINARY_LSB_FIRST", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x00000468" }, { "name": "RT_ICON", "language": "LANG_CHINESE", "offset": "0x0019f340", "filetype": "GLS_BINARY_LSB_FIRST", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x00000468" }, { "name": "RT_ICON", "language": "LANG_CHINESE", "offset": "0x0019f340", "filetype": "GLS_BINARY_LSB_FIRST", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x00000468" }, { "name": "RT_STRING", "language": "LANG_CHINESE", "offset": "0x0019fa30", "filetype": "data", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000006e" }, { "name": "RT_STRING", "language": "LANG_CHINESE", "offset": "0x0019fa30", "filetype": "data", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000006e" }, { "name": "RT_STRING", "language": "LANG_CHINESE", "offset": "0x0019fa30", "filetype": "data", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000006e" }, { "name": "RT_STRING", "language": "LANG_CHINESE", "offset": "0x0019fa30", "filetype": "data", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000006e" }, { "name": "RT_STRING", "language": "LANG_CHINESE", "offset": "0x0019fa30", "filetype": "data", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000006e" }, { "name": "RT_STRING", "language": "LANG_CHINESE", "offset": "0x0019fa30", "filetype": "data", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000006e" }, { "name": "RT_STRING", "language": "LANG_CHINESE", "offset": "0x0019fa30", "filetype": "data", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000006e" }, { "name": "RT_GROUP_ICON", "language": "LANG_CHINESE", "offset": "0x0019faa0", "filetype": "MS Windows icon resource - 4 icons, 48x48", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x0000003e" }, { "name": "RT_VERSION", "language": "LANG_CHINESE", "offset": "0x0019fae0", "filetype": "data", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "type": "generic", "size": "0x00000264" } ], "references": [], "name": "origin_langid" }, { "markcount": 1, "families": [], "description": "Executes one or more WMI queries", "severity": 2, "marks": [ { "category": "wmi", "ioc": "SELECT * FROM Win32_ComputerSystem", "type": "ioc", "description": null } ], "references": [], "name": "has_wmi" }, { "markcount": 1, "families": [], "description": "The binary likely contains encrypted or compressed data indicative of a packer", "severity": 2, "marks": [ { "entropy": 7.750446882566537, "section": { "size_of_data": "0x0003b000", "virtual_address": "0x00166000", "entropy": 7.750446882566537, "name": ".rsrc", "virtual_size": "0x0003a2dc" }, "type": "generic", "description": "A section with a high entropy has been found" } ], "references": [ "http:\/\/www.forensickb.com\/2013\/03\/file-entropy-explained.html", "http:\/\/virii.es\/U\/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf" ], "name": "packer_entropy" }, { "markcount": 11, "families": [], "description": "Queries for potentially installed applications", "severity": 2, "marks": [ { "call": { "category": "registry", "status": 0, "stacktrace": [], "last_error": 6, "nt_status": -1073741772, "api": "RegOpenKeyExW", "return_value": 2, "arguments": { "access": "0x00020019", "base_handle": "0x80000002", "key_handle": "0x00000000", "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\360\u00b0\u00b2\u00c8\u00ab\u00ce\u00c0\u00ca\u00bf", "regkey_r": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\360\u00b0\u00b2\u00c8\u00ab\u00ce\u00c0\u00ca\u00bf", "options": 0 }, "time": 1583643185.812375, "tid": 2124, "flags": {} }, "pid": 2436, "type": "call", "cid": 514 }, { "call": { "category": "registry", "status": 0, "stacktrace": [], "last_error": 6, "nt_status": -1073741772, "api": "RegOpenKeyExW", "return_value": 2, "arguments": { "access": "0x00020019", "base_handle": "0x80000002", "key_handle": "0x00000000", "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\360SD", "regkey_r": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\360SD", "options": 0 }, "time": 1583643185.812375, "tid": 2124, "flags": {} }, "pid": 2436, "type": "call", "cid": 515 }, { "call": { "category": "registry", "status": 0, "stacktrace": [], "last_error": 6, "nt_status": -1073741772, "api": "RegOpenKeyExW", "return_value": 2, "arguments": { "access": "0x00020019", "base_handle": "0x80000002", "key_handle": "0x00000000", "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\QQPCMgr", "regkey_r": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\QQPCMgr", "options": 0 }, "time": 1583643185.812375, "tid": 2124, "flags": {} }, "pid": 2436, "type": "call", "cid": 516 }, { "call": { "category": "registry", "status": 0, "stacktrace": [], "last_error": 6, "nt_status": -1073741772, "api": "RegOpenKeyExW", "return_value": 2, "arguments": { "access": "0x00020019", "base_handle": "0x80000002", "key_handle": "0x00000000", "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u00b0\u00d9\u00b6\u00c8\u00c9\u00b1\u00b6\u00be", "regkey_r": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u00b0\u00d9\u00b6\u00c8\u00c9\u00b1\u00b6\u00be", "options": 0 }, "time": 1583643185.812375, "tid": 2124, "flags": {} }, "pid": 2436, "type": "call", "cid": 517 }, { "call": { "category": "registry", "status": 0, "stacktrace": [], "last_error": 6, "nt_status": -1073741772, "api": "RegOpenKeyExW", "return_value": 2, "arguments": { "access": "0x00020019", "base_handle": "0x80000002", "key_handle": "0x00000000", "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u00b0\u00d9\u00b6\u00c8\u00ce\u00c0\u00ca\u00bf", "regkey_r": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u00b0\u00d9\u00b6\u00c8\u00ce\u00c0\u00ca\u00bf", "options": 0 }, "time": 1583643185.812375, "tid": 2124, "flags": {} }, "pid": 2436, "type": "call", "cid": 518 }, { "call": { "category": "registry", "status": 0, "stacktrace": [], "last_error": 6, "nt_status": -1073741772, "api": "RegOpenKeyExW", "return_value": 2, "arguments": { "access": "0x00020019", "base_handle": "0x80000002", "key_handle": "0x00000000", "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Kingsoft Internet Security", "regkey_r": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Kingsoft Internet Security", "options": 0 }, "time": 1583643185.812375, "tid": 2124, "flags": {} }, "pid": 2436, "type": "call", "cid": 519 }, { "call": { "category": "registry", "status": 0, "stacktrace": [], "last_error": 6, "nt_status": -1073741772, "api": "RegOpenKeyExW", "return_value": 2, "arguments": { "access": "0x00020019", "base_handle": "0x80000002", "key_handle": "0x00000000", "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u00bd\u00f0\u00c9\u00bd\u00ce\u00c0\u00ca\u00bf", "regkey_r": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u00bd\u00f0\u00c9\u00bd\u00ce\u00c0\u00ca\u00bf", "options": 0 }, "time": 1583643185.812375, "tid": 2124, "flags": {} }, "pid": 2436, "type": "call", "cid": 520 }, { "call": { "category": "registry", "status": 0, "stacktrace": [], "last_error": 997, "nt_status": -1073741772, "api": "RegOpenKeyExW", "return_value": 2, "arguments": { "access": "0x00020019", "base_handle": "0x80000002", "key_handle": "0x00000000", "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{98D73BDD-CA25-4BCA-A68C-AD6171206063}", "regkey_r": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{98D73BDD-CA25-4BCA-A68C-AD6171206063}", "options": 0 }, "time": 1583643185.828375, "tid": 2124, "flags": {} }, "pid": 2436, "type": "call", "cid": 731 }, { "call": { "category": "registry", "status": 0, "stacktrace": [], "last_error": 997, "nt_status": -1073741772, "api": "RegOpenKeyExW", "return_value": 2, "arguments": { "access": "0x00020019", "base_handle": "0x80000002", "key_handle": "0x00000000", "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u5feb\u5427\u7ef4\u62a4\u5e73\u53f0\u65e0\u76d8(\u5ba2\u6237\u7aef)_is1", "regkey_r": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u5feb\u5427\u7ef4\u62a4\u5e73\u53f0\u65e0\u76d8(\u5ba2\u6237\u7aef)_is1", "options": 0 }, "time": 1583643185.828375, "tid": 2124, "flags": {} }, "pid": 2436, "type": "call", "cid": 732 }, { "call": { "category": "registry", "status": 0, "stacktrace": [], "last_error": 997, "nt_status": -1073741772, "api": "RegOpenKeyExW", "return_value": 2, "arguments": { "access": "0x00020019", "base_handle": "0x80000002", "key_handle": "0x00000000", "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u5feb\u5427\u6709\u76d8\u7ef4\u62a4\u5e73\u53f0\u5ba2\u6237\u7aef_is1", "regkey_r": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\u5feb\u5427\u6709\u76d8\u7ef4\u62a4\u5e73\u53f0\u5ba2\u6237\u7aef_is1", "options": 0 }, "time": 1583643185.828375, "tid": 2124, "flags": {} }, "pid": 2436, "type": "call", "cid": 733 }, { "call": { "category": "registry", "status": 0, "stacktrace": [], "last_error": 997, "nt_status": -1073741772, "api": "RegOpenKeyExW", "return_value": 2, "arguments": { "access": "0x00020019", "base_handle": "0x80000002", "key_handle": "0x00000000", "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Pubwin2015\u5ba2\u6237\u7aef_is1", "regkey_r": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Pubwin2015\u5ba2\u6237\u7aef_is1", "options": 0 }, "time": 1583643185.828375, "tid": 2124, "flags": {} }, "pid": 2436, "type": "call", "cid": 734 } ], "references": [], "name": "queries_programs" }, { "markcount": 1, "families": [], "description": "Executes one or more WMI queries which can be used to identify virtual machines", "severity": 2, "marks": [ { "category": "wmi", "ioc": "SELECT * FROM Win32_ComputerSystem", "type": "ioc", "description": null } ], "references": [], "name": "wmi_antivm" }, { "markcount": 3, "families": [], "description": "Queries information on disks, possibly for anti-virtualization", "severity": 3, "marks": [ { "call": { "category": "file", "status": 1, "stacktrace": [], "api": "NtCreateFile", "return_value": 0, "arguments": { "create_disposition": 1, "file_handle": "0x00000124", "filepath": "\\??\\PhysicalDrive0", "desired_access": "0xc0100080", "file_attributes": 0, "filepath_r": "\\??\\PhysicalDrive0", "create_options": 96, "status_info": 1, "share_access": 3 }, "time": 1583643185.812375, "tid": 2124, "flags": { "create_disposition": "FILE_OPEN", "desired_access": "FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE", "create_options": "FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT", "file_attributes": "", "status_info": "FILE_OPENED", "share_access": "FILE_SHARE_READ|FILE_SHARE_WRITE" } }, "pid": 2436, "type": "call", "cid": 527 }, { "call": { "category": "file", "status": 1, "stacktrace": [], "api": "NtCreateFile", "return_value": 0, "arguments": { "create_disposition": 1, "file_handle": "0x00000124", "filepath": "\\??\\Scsi0:", "desired_access": "0xc0100080", "file_attributes": 0, "filepath_r": "\\??\\Scsi0:", "create_options": 96, "status_info": 0, "share_access": 3 }, "time": 1583643185.812375, "tid": 2124, "flags": { "create_disposition": "FILE_OPEN", "desired_access": "FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE", "create_options": "FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT", "file_attributes": "", "status_info": "FILE_SUPERSEDED", "share_access": "FILE_SHARE_READ|FILE_SHARE_WRITE" } }, "pid": 2436, "type": "call", "cid": 546 }, { "call": { "category": "file", "status": 0, "stacktrace": [], "last_error": 1, "nt_status": -1073741808, "api": "DeviceIoControl", "return_value": 0, "arguments": { "input_buffer": "\u001c\u0000\u0000\u0000SCSIDISK\u0010'\u0000\u0000\u0001\u0005\u001b\u0000\u0000\u0000\u0000\u0000\u0011\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00ec\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "device_handle": "0x00000124", "control_code": 315400, "output_buffer": "" }, "time": 1583643185.812375, "tid": 2124, "flags": { "control_code": "" } }, "pid": 2436, "type": "call", "cid": 547 } ], "references": [], "name": "antivm_generic_disk" } ]
The Yara rules did not detect anything in the file.
{ "tls": [], "udp": [ { "src": "192.168.56.101", "dst": "192.168.56.255", "offset": 662, "time": 6.189416885375977, "dport": 137, "sport": 137 }, { "src": "192.168.56.101", "dst": "192.168.56.255", "offset": 5342, "time": 12.189029932022095, "dport": 138, "sport": 138 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 7186, "time": 6.1482319831848145, "dport": 5355, "sport": 51001 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 7514, "time": 4.143887996673584, "dport": 5355, "sport": 53595 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 7842, "time": 6.159782886505127, "dport": 5355, "sport": 53848 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 8170, "time": 4.7252209186553955, "dport": 5355, "sport": 54255 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 8498, "time": 3.021251916885376, "dport": 5355, "sport": 55314 }, { "src": "192.168.56.101", "dst": "239.255.255.250", "offset": 8826, "time": 4.689790964126587, "dport": 1900, "sport": 1900 }, { "src": "192.168.56.101", "dst": "239.255.255.250", "offset": 28236, "time": 4.177609920501709, "dport": 3702, "sport": 49152 }, { "src": "192.168.56.101", "dst": "239.255.255.250", "offset": 36620, "time": 6.250847101211548, "dport": 1900, "sport": 53598 } ], "dns_servers": [], "http": [], "icmp": [], "smtp": [], "tcp": [], "smtp_ex": [], "mitm": [], "hosts": [], "pcap_sha256": "3c41a8190a71cf7475dd73614c8f737eb57f4aa0980a001ad09bb94c6853032e", "dns": [], "http_ex": [], "domains": [], "dead_hosts": [], "sorted_pcap_sha256": "c717b3fb9ca12cf1410b772947fa9c00a0d7af1e7d9f3818199fca94042285cf", "irc": [], "https_ex": [] }
The instructions below shows how to remove _s2g100464_1488156589.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the _s2g100464_1488156589.exe file for removal, restart your computer and scan it again to verify that _s2g100464_1488156589.exe has been successfully removed. Here are the removal instructions in more detail:
_s2g100464_1488156589.exe may also use other filenames. The most common variants are listed below:
Property | Value |
---|---|
MD5 | 22686e45d1e414f9d0b229c2335e8af9 |
SHA256 | ec59d64102cfd05c2eca786af1d3db253c3ed55b486fd0f6b6510a633177f123 |
These are some of the error messages that can appear related to _s2g100464_1488156589.exe:
_s2g100464_1488156589.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
_s2g100464_1488156589.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
????? has stopped working.
End Program - _s2g100464_1488156589.exe. This program is not responding.
_s2g100464_1488156589.exe is not a valid Win32 application.
_s2g100464_1488156589.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
To help other users, please let us know what you will do with the file:
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
No comments posted yet.