URL:

http://cd002.www.duba.net/duba/install/2011/ever/duba20191113_100_50.exe

Full analysis: https://app.any.run/tasks/16bd816c-f22e-44e5-8135-57836dddbecb
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: November 21, 2019, 11:05:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
loader
Indicators:
MD5:

C1A2E1D2018C11763B6ED297B44DBF70

SHA1:

1FB04822D486BD361AB955E6AA061401FB3ECF32

SHA256:

B0F2F5C5AC58E308AFFF380C2BAC2594D33F21FB32AF7B98D77966845FBC366C

SSDEEP:

3:N1KdBV8hLxIVHEbWqEXVYA2EUUFvLN:CJ8UVHEbVEXVYA29UFTN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to CnC server

      • duba20191113_100_50.exe (PID: 3148)

    • Application was dropped or rewritten from another process

      • duba20191113_100_50.exe (PID: 3148)
      • duba20191113_100_50.exe (PID: 3572)
      • kavlog2.exe (PID: 3564)
      • khealtheye.exe (PID: 3788)
      • keyemain.exe (PID: 3132)
      • keyemain.exe (PID: 4048)
      • ksoftmgr.exe (PID: 2708)
      • kscan.exe (PID: 3668)
      • kxescore.exe (PID: 3744)
      • kxescore.exe (PID: 3980)
      • rcmdhelper.exe (PID: 2436)
      • kxetray.exe (PID: 1892)
      • rcmdhelper.exe (PID: 3020)
      • rcmdhelper.exe (PID: 784)
      • rcmdhelper.exe (PID: 3332)
      • rcmdhelper.exe (PID: 3228)
      • rcmdhelper.exe (PID: 2108)
      • rcmdhelper.exe (PID: 4008)
      • kxetray.exe (PID: 2360)
      • rcmdhelper.exe (PID: 3380)
      • rcmdhelper.exe (PID: 2256)
      • unlockbro.exe (PID: 2236)
      • kslaunch.exe (PID: 2992)

    • Changes the autorun value in the registry

      • duba20191113_100_50.exe (PID: 3148)

    • Loads dropped or rewritten executable

      • duba20191113_100_50.exe (PID: 3148)
      • kxescore.exe (PID: 3744)
      • kxescore.exe (PID: 3980)
      • kxetray.exe (PID: 1892)
      • keyemain.exe (PID: 4048)
      • keyemain.exe (PID: 3132)
      • rcmdhelper.exe (PID: 2256)
      • kscan.exe (PID: 3668)
      • rcmdhelper.exe (PID: 2436)
      • rcmdhelper.exe (PID: 3020)
      • kavlog2.exe (PID: 3564)
      • rcmdhelper.exe (PID: 3380)
      • rcmdhelper.exe (PID: 3228)
      • rcmdhelper.exe (PID: 4008)
      • rcmdhelper.exe (PID: 3332)
      • rcmdhelper.exe (PID: 784)
      • kxetray.exe (PID: 2360)
      • rcmdhelper.exe (PID: 2108)
      • ksoftmgr.exe (PID: 2708)
      • explorer.exe (PID: 352)

    • Downloads executable files from the Internet

      • firefox.exe (PID: 4036)

    • Loads the Task Scheduler DLL interface

      • kxetray.exe (PID: 1892)

    • Loads the Task Scheduler COM API

      • kxescore.exe (PID: 3980)
      • kscan.exe (PID: 3668)

    • Changes settings of System certificates

      • kscan.exe (PID: 3668)

    • Actions looks like stealing of personal data

      • kxetray.exe (PID: 1892)

  • SUSPICIOUS

    • Creates files in the program directory

      • firefox.exe (PID: 4036)
      • duba20191113_100_50.exe (PID: 3148)
      • khealtheye.exe (PID: 3788)
      • kxescore.exe (PID: 3744)
      • kxetray.exe (PID: 1892)
      • kxescore.exe (PID: 3980)
      • rcmdhelper.exe (PID: 784)
      • kscan.exe (PID: 3668)
      • kxetray.exe (PID: 2360)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 4036)
      • duba20191113_100_50.exe (PID: 3148)
      • khealtheye.exe (PID: 3788)
      • kxetray.exe (PID: 1892)
      • kxescore.exe (PID: 3980)

    • Creates a software uninstall entry

      • duba20191113_100_50.exe (PID: 3148)

    • Creates files in the Windows directory

      • duba20191113_100_50.exe (PID: 3148)
      • kavlog2.exe (PID: 3564)
      • kxescore.exe (PID: 3980)
      • kscan.exe (PID: 3668)

    • Removes files from Windows directory

      • duba20191113_100_50.exe (PID: 3148)
      • kxescore.exe (PID: 3980)
      • kscan.exe (PID: 3668)

    • Creates files in the driver directory

      • duba20191113_100_50.exe (PID: 3148)
      • kxescore.exe (PID: 3980)
      • kscan.exe (PID: 3668)

    • Creates COM task schedule object

      • duba20191113_100_50.exe (PID: 3148)
      • kxescore.exe (PID: 3980)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • duba20191113_100_50.exe (PID: 3148)
      • kxescore.exe (PID: 3980)

    • Executed as Windows Service

      • kxescore.exe (PID: 3980)

    • Reads internet explorer settings

      • ksoftmgr.exe (PID: 2708)

    • Creates files in the user directory

      • kxetray.exe (PID: 1892)

    • Reads Internet Cache Settings

      • ksoftmgr.exe (PID: 2708)
      • explorer.exe (PID: 352)

    • Creates or modifies windows services

      • kxescore.exe (PID: 3980)
      • kxetray.exe (PID: 1892)

    • Searches for installed software

      • kxetray.exe (PID: 1892)

    • Low-level read access rights to disk partition

      • duba20191113_100_50.exe (PID: 3148)

    • Adds / modifies Windows certificates

      • kscan.exe (PID: 3668)

    • Connects to server without host name

      • kxetray.exe (PID: 1892)
      • kscan.exe (PID: 3668)
      • kxescore.exe (PID: 3980)

  • INFO

    • Application launched itself

      • firefox.exe (PID: 1732)
      • firefox.exe (PID: 4036)

    • Reads settings of System Certificates

      • firefox.exe (PID: 4036)
      • kxetray.exe (PID: 1892)
      • kscan.exe (PID: 3668)

    • Reads CPU info

      • firefox.exe (PID: 4036)

    • Dropped object may contain Bitcoin addresses

      • duba20191113_100_50.exe (PID: 3148)
      • khealtheye.exe (PID: 3788)

    • Creates files in the user directory

      • firefox.exe (PID: 4036)

    • Reads the hosts file

      • kscan.exe (PID: 3668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
73
Monitored processes
31
Malicious processes
13
Suspicious processes
12

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe duba20191113_100_50.exe no specs duba20191113_100_50.exe pingsender.exe kxetray.exe kavlog2.exe ksoftmgr.exe kxescore.exe no specs kxescore.exe khealtheye.exe keyemain.exe no specs keyemain.exe no specs rcmdhelper.exe no specs rcmdhelper.exe no specs rcmdhelper.exe no specs rcmdhelper.exe no specs rcmdhelper.exe no specs rcmdhelper.exe no specs kscan.exe rcmdhelper.exe no specs rcmdhelper.exe no specs rcmdhelper.exe no specs kxetray.exe no specs unlockbro.exe no specs explorer.exe kslaunch.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
352C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
784"C:\program files\kingsoft\kingsoft antivirus\rcmdhelper.exe" -kdeskcanrcmdC:\program files\kingsoft\kingsoft antivirus\rcmdhelper.exe—kxetray.exe
User:
admin
Company:
Kingsoft Corporation
Integrity Level:
HIGH
Description:
Kingsoft Rcmd Helper
Exit code:
1
Version:
2019,07,23,22409
Modules
Images
c:\program files\kingsoft\kingsoft antivirus\rcmdhelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1152"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4036.13.1389795052\815133544" -childID 2 -isForBrowser -prefsHandle 2844 -prefMapHandle 2848 -prefsLen 5996 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 4036 "\\.\pipe\gecko-crash-server-pipe.4036" 2860 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1732"C:\Program Files\Mozilla Firefox\firefox.exe" "http://cd002.www.duba.net/duba/install/2011/ever/duba20191113_100_50.exe"C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1892"c:\program files\kingsoft\kingsoft antivirus\kxetray.exe" /autorun /kislive /devmgr /installc:\program files\kingsoft\kingsoft antivirus\kxetray.exe
duba20191113_100_50.exe
User:
admin
Company:
Kingsoft Corporation
Integrity Level:
HIGH
Description:
Kingsoft Security - 金山毒霸
Exit code:
0
Version:
2019,11,05,23144
Modules
Images
c:\program files\kingsoft\kingsoft antivirus\kxetray.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2108"C:\program files\kingsoft\kingsoft antivirus\rcmdhelper.exe" -updateliebaowifiC:\program files\kingsoft\kingsoft antivirus\rcmdhelper.exe—kxetray.exe
User:
admin
Company:
Kingsoft Corporation
Integrity Level:
HIGH
Description:
Kingsoft Rcmd Helper
Exit code:
0
Version:
2019,07,23,22409
Modules
Images
c:\program files\kingsoft\kingsoft antivirus\rcmdhelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2112"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4036.3.1313555930\489307633" -childID 1 -isForBrowser -prefsHandle 1308 -prefMapHandle 1296 -prefsLen 1 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 4036 "\\.\pipe\gecko-crash-server-pipe.4036" 1696 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2236"c:\program files\kingsoft\kingsoft antivirus\unlockbro.exe" /lnb:9c:\program files\kingsoft\kingsoft antivirus\unlockbro.exe—kxescore.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\program files\kingsoft\kingsoft antivirus\unlockbro.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2256"C:\program files\kingsoft\kingsoft antivirus\rcmdhelper.exe" -updatetaguserC:\program files\kingsoft\kingsoft antivirus\rcmdhelper.exe—kxetray.exe
User:
admin
Company:
Kingsoft Corporation
Integrity Level:
HIGH
Description:
Kingsoft Rcmd Helper
Exit code:
0
Version:
2019,07,23,22409
Modules
Images
c:\program files\kingsoft\kingsoft antivirus\rcmdhelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2360"c:\program files\kingsoft\kingsoft antivirus\kxetray.exe" /injectexplorerc:\program files\kingsoft\kingsoft antivirus\kxetray.exe—kxescore.exe
User:
admin
Company:
Kingsoft Corporation
Integrity Level:
MEDIUM
Description:
Kingsoft Security - 金山毒霸
Exit code:
1
Version:
2019,11,05,23144
Modules
Images
c:\program files\kingsoft\kingsoft antivirus\kxetray.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
3 916
Read events
3 235
Write events
601
Delete events
80

Modification events

(PID) Process:(4036) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
BBBA361803000000
(PID) Process:(1732) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
21FE331803000000
(PID) Process:(4036) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
1
(PID) Process:(4036) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(4036) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(352) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:308046O0NS4N39PO
Value:
00000000090000000D000000CC190500000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF605D425CD146D50100000000
(PID) Process:(352) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
0000000032000000370000009EDC1200090000000D000000CC19050033003000380030003400360042003000410046003400410033003900430042000000000000000000000000009CE8E700180000002DAC977714E3E70000000000D8E4E700EDE064777D401800FEFFFFFF8B8D6877108B687701000000010000000000000004E5E700CCE4E700E8E4E7006C878875010000000000000004E5E7007F878875CDBDE5E3000000006CEAE70002000000410037004400320037007D00000000000000D172ACE4E7007800650050E9E70065E18975ADDE8A96FEFFFFFF7F878875F36B8875E186887545B0E5E36CEAE70010000000630007003C003E006CEAE70080E9E700000000000000000000000000000008023CE7E7000000080234E5E700000000000000D172DC0D0000200200000000000060E5E700000000000700000078E5E700140000000000000000002800E82A00070000000090F8F70688F7F7067CE5E7003DA96C7600000000FBFFFF7FA0E5E700987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF000000000000000000000000B37FF906CD7FF906B37FF906000000000000000000000000080000002E006C00E72F687711000000B8452B00B0452B0000002800E72F687731AE977754E600007291E1E304E6E70082916C7654E6E70008E6E70027956C76000000008C00FD0330E6E700CD946C768C00FD03DCE6E70000FCFC03E1946C760000000000FCFC03DCE6E70038E6E700090000000D000000CC19050033003000380030003400360042003000410046003400410033003900430042000000000000000000000000009CE8E700180000002DAC977714E3E70000000000D8E4E700EDE064777D401800FEFFFFFF8B8D6877108B687701000000010000000000000004E5E700CCE4E700E8E4E7006C878875010000000000000004E5E7007F878875CDBDE5E3000000006CEAE70002000000410037004400320037007D00000000000000D172ACE4E7007800650050E9E70065E18975ADDE8A96FEFFFFFF7F878875F36B8875E186887545B0E5E36CEAE70010000000630007003C003E006CEAE70080E9E700000000000000000000000000000008023CE7E7000000080234E5E700000000000000D172DC0D0000200200000000000060E5E700000000000700000078E5E700140000000000000000002800E82A00070000000090F8F70688F7F7067CE5E7003DA96C7600000000FBFFFF7FA0E5E700987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF000000000000000000000000B37FF906CD7FF906B37FF906000000000000000000000000080000002E006C00E72F687711000000B8452B00B0452B0000002800E72F687731AE977754E600007291E1E304E6E70082916C7654E6E70008E6E70027956C76000000008C00FD0330E6E700CD946C768C00FD03DCE6E70000FCFC03E1946C760000000000FCFC03DCE6E70038E6E700090000000D000000CC19050033003000380030003400360042003000410046003400410033003900430042000000000000000000000000009CE8E700180000002DAC977714E3E70000000000D8E4E700EDE064777D401800FEFFFFFF8B8D6877108B687701000000010000000000000004E5E700CCE4E700E8E4E7006C878875010000000000000004E5E7007F878875CDBDE5E3000000006CEAE70002000000410037004400320037007D00000000000000D172ACE4E7007800650050E9E70065E18975ADDE8A96FEFFFFFF7F878875F36B8875E186887545B0E5E36CEAE70010000000630007003C003E006CEAE70080E9E700000000000000000000000000000008023CE7E7000000080234E5E700000000000000D172DC0D0000200200000000000060E5E700000000000700000078E5E700140000000000000000002800E82A00070000000090F8F70688F7F7067CE5E7003DA96C7600000000FBFFFF7FA0E5E700987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF000000000000000000000000B37FF906CD7FF906B37FF906000000000000000000000000080000002E006C00E72F687711000000B8452B00B0452B0000002800E72F687731AE977754E600007291E1E304E6E70082916C7654E6E70008E6E70027956C76000000008C00FD0330E6E700CD946C768C00FD03DCE6E70000FCFC03E1946C760000000000FCFC03DCE6E70038E6E700
(PID) Process:(352) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
0000000032000000370000009EDC1200090000000D000000CC19050033003000380030003400360042003000410046003400410033003900430042000000000000000000000000009CE8E700180000002DAC977714E3E70000000000D8E4E700EDE064777D401800FEFFFFFF8B8D6877108B687701000000010000000000000004E5E700CCE4E700E8E4E7006C878875010000000000000004E5E7007F878875CDBDE5E3000000006CEAE70002000000410037004400320037007D00000000000000D172ACE4E7007800650050E9E70065E18975ADDE8A96FEFFFFFF7F878875F36B8875E186887545B0E5E36CEAE70010000000ED0003003C003E006CEAE70080E9E700000000000000000000000000000008023CE7E7000000080234E5E700000000000000D172DC0D0000200200000000000060E5E700000000000700000078E5E700140000000000000000002800E82A00070000000090F8F70688F7F7067CE5E7003DA96C7600000000FBFFFF7FA0E5E700987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF000000000000000000000000B37FF906CD7FF906B37FF906000000000000000000000000080000002E006C00E72F687711000000B8452B00B0452B0000002800E72F687731AE977754E600007291E1E304E6E70082916C7654E6E70008E6E70027956C76000000008C00FD0330E6E700CD946C768C00FD03DCE6E70000FCFC03E1946C760000000000FCFC03DCE6E70038E6E700090000000D000000CC19050033003000380030003400360042003000410046003400410033003900430042000000000000000000000000009CE8E700180000002DAC977714E3E70000000000D8E4E700EDE064777D401800FEFFFFFF8B8D6877108B687701000000010000000000000004E5E700CCE4E700E8E4E7006C878875010000000000000004E5E7007F878875CDBDE5E3000000006CEAE70002000000410037004400320037007D00000000000000D172ACE4E7007800650050E9E70065E18975ADDE8A96FEFFFFFF7F878875F36B8875E186887545B0E5E36CEAE70010000000ED0003003C003E006CEAE70080E9E700000000000000000000000000000008023CE7E7000000080234E5E700000000000000D172DC0D0000200200000000000060E5E700000000000700000078E5E700140000000000000000002800E82A00070000000090F8F70688F7F7067CE5E7003DA96C7600000000FBFFFF7FA0E5E700987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF000000000000000000000000B37FF906CD7FF906B37FF906000000000000000000000000080000002E006C00E72F687711000000B8452B00B0452B0000002800E72F687731AE977754E600007291E1E304E6E70082916C7654E6E70008E6E70027956C76000000008C00FD0330E6E700CD946C768C00FD03DCE6E70000FCFC03E1946C760000000000FCFC03DCE6E70038E6E700090000000D000000CC19050033003000380030003400360042003000410046003400410033003900430042000000000000000000000000009CE8E700180000002DAC977714E3E70000000000D8E4E700EDE064777D401800FEFFFFFF8B8D6877108B687701000000010000000000000004E5E700CCE4E700E8E4E7006C878875010000000000000004E5E7007F878875CDBDE5E3000000006CEAE70002000000410037004400320037007D00000000000000D172ACE4E7007800650050E9E70065E18975ADDE8A96FEFFFFFF7F878875F36B8875E186887545B0E5E36CEAE70010000000ED0003003C003E006CEAE70080E9E700000000000000000000000000000008023CE7E7000000080234E5E700000000000000D172DC0D0000200200000000000060E5E700000000000700000078E5E700140000000000000000002800E82A00070000000090F8F70688F7F7067CE5E7003DA96C7600000000FBFFFF7FA0E5E700987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF000000000000000000000000B37FF906CD7FF906B37FF906000000000000000000000000080000002E006C00E72F687711000000B8452B00B0452B0000002800E72F687731AE977754E600007291E1E304E6E70082916C7654E6E70008E6E70027956C76000000008C00FD0330E6E700CD946C768C00FD03DCE6E70000FCFC03E1946C760000000000FCFC03DCE6E70038E6E700
(PID) Process:(4036) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(4036) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@%SystemRoot%\system32\p2pcollab.dll,-8042
Value:
Peer to Peer Trust
Executable files
226
Suspicious files
284
Text files
458
Unknown types
72

Dropped files

PID
Process
Filename
Type
4036firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
4036firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
4036firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp —
MD5:—
SHA256:—
4036firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm —
MD5:—
SHA256:—
4036firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm —
MD5:—
SHA256:—
4036firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm —
MD5:—
SHA256:—
4036firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.tmp —
MD5:—
SHA256:—
4036firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.binbinary
MD5:—
SHA256:—
4036firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:—
SHA256:—
4036firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\base-track-digest256.sbstorebinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
170
TCP/UDP connections
203
DNS requests
124
Threats
116

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3148
duba20191113_100_50.exe
POST
200
139.199.218.80:80
http://did.ijinshan.com/db/?v=2&p=db&u=BFEDB3EF3A040E44F6506DA0F9C95F2D&m=5254004a04af0000&ip=-781932352&s=26a4c0954b95d81dc41d6ce376483e09
CN
text
45 b
malicious
3148
duba20191113_100_50.exe
POST
200
119.29.47.96:80
http://infoc0.duba.net/c/
CN
text
36 b
whitelisted
3148
duba20191113_100_50.exe
POST
200
119.29.47.96:80
http://infoc0.duba.net/c/
CN
text
36 b
whitelisted
3148
duba20191113_100_50.exe
POST
200
119.29.47.96:80
http://infoc0.duba.net/c/
CN
text
36 b
whitelisted
3148
duba20191113_100_50.exe
GET
200
218.24.18.57:80
http://2398.35go.net/defend/o1/installrename.dat
CN
text
2.60 Kb
whitelisted
4036
firefox.exe
GET
200
116.207.145.81:80
http://cd002.www.duba.net/duba/install/2011/ever/duba20191113_100_50.exe
CN
executable
52.3 Mb
malicious
4036
firefox.exe
POST
200
172.217.22.67:80
http://ocsp.pki.goog/gts1o1
US
der
471 b
whitelisted
3148
duba20191113_100_50.exe
POST
200
119.29.47.96:80
http://infoc0.duba.net/c/
CN
text
36 b
whitelisted
4036
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
4036
firefox.exe
POST
200
172.217.22.67:80
http://ocsp.pki.goog/gts1o1
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4036
firefox.exe
2.16.186.112:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
4036
firefox.exe
52.35.182.58:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
4036
firefox.exe
116.207.145.81:80
cd002.www.duba.net
No.31,Jin-rong Street
CN
suspicious
4036
firefox.exe
143.204.214.118:443
snippets.cdn.mozilla.net
—
US
suspicious
4036
firefox.exe
35.161.81.202:443
push.services.mozilla.com
Amazon.com, Inc.
US
malicious
4036
firefox.exe
52.39.224.180:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
4036
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
4036
firefox.exe
52.222.158.157:443
tracking-protection.cdn.mozilla.net
Amazon.com, Inc.
US
whitelisted
4036
firefox.exe
52.25.50.137:443
shavar.services.mozilla.com
Amazon.com, Inc.
US
unknown
4036
firefox.exe
143.204.214.93:443
aus5.mozilla.org
—
US
whitelisted

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 2.16.186.112
  • 2.16.186.50
whitelisted
cd002.www.duba.net
  • 116.207.145.81
malicious
a1089.dscd.akamai.net
  • 2.16.186.50
  • 2.16.186.112
whitelisted
search.services.mozilla.com
  • 52.35.182.58
  • 35.164.109.147
  • 52.89.218.39
whitelisted
search.r53-2.services.mozilla.com
  • 52.89.218.39
  • 35.164.109.147
  • 52.35.182.58
whitelisted
sal.topgslb.com
  • 116.207.145.81
malicious
push.services.mozilla.com
  • 35.161.81.202
whitelisted
autopush.prod.mozaws.net
  • 35.161.81.202
whitelisted
snippets.cdn.mozilla.net
  • 143.204.214.118
  • 143.204.214.11
  • 143.204.214.5
  • 143.204.214.95
whitelisted
tiles.services.mozilla.com
  • 52.39.224.180
  • 54.213.235.202
  • 52.33.13.207
  • 52.24.113.72
  • 52.39.125.254
  • 52.33.184.165
  • 54.186.225.209
  • 52.89.51.22
whitelisted

Threats

PID
Process
Class
Message
4036
firefox.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1080
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
1080
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
3148
duba20191113_100_50.exe
Misc activity
ADWARE [PTsecurity] PUP.Win32/KingSoft.E (antivirus)
3148
duba20191113_100_50.exe
Misc activity
ADWARE [PTsecurity] PUP.Win32/KingSoft.E
3148
duba20191113_100_50.exe
Misc activity
ADWARE [PTsecurity] PUP.Win32/KingSoft.E
3148
duba20191113_100_50.exe
Misc activity
ADWARE [PTsecurity] PUP.Win32/KingSoft.E
3148
duba20191113_100_50.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3148
duba20191113_100_50.exe
Misc activity
ADWARE [PTsecurity] W32/Kingsoft Checkin
3148
duba20191113_100_50.exe
Misc activity
ADWARE [PTsecurity] PUP.Win32/KingSoft.E
51 ETPRO signatures available at the full report
Process
Message
duba20191113_100_50.exe
11:09:26|~03284| [KAVMENU] reg_duba_32bit
kavlog2.exe
_tWinMain End.
kxescore.exe
c:\program files\kingsoft\kingsoft antivirus\ksapi.dll
kxescore.exe
c:\program files\kingsoft\kingsoft antivirus\ksapi.dll
kxetray.exe
c:\program files\kingsoft\kingsoft antivirus\ksapi.dll
kxetray.exe
c:\program files\kingsoft\kingsoft antivirus\ksapi.dll
kscan.exe
c:\program files\kingsoft\kingsoft antivirus\ksapi.dll
kscan.exe
c:\program files\kingsoft\kingsoft antivirus\ksapi.dll
kxescore.exe
<ERROR>Inst
kxescore.exe
<FATAL>load Install Interface c:\program files\kingsoft\kingsoft antivirus\security\ksde\knetctrl.dll Fatal = 1
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://cd002.www.duba.net/duba/install/2011/ever/duba20191113_100_50.exe