Trojan.DownLoader34.63237

Technical Information

Malicious functions

Executes the following

'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\KSoftMgr\xlmodule\download\minithunderplatform.exe" "minithunderplatform" enable

Modifies file system

Creates the following files

%TEMP%\nsxbb06.tmp
%TEMP%\ksoftmgr\data\kuefreq\61000072.dat
%TEMP%\ksoftmgr\data\kuefreq\61000073.dat
%TEMP%\ksoftmgr\data\kuefreq\61000074.dat
%TEMP%\ksoftmgr\data\kuefreq\61000075.dat
%TEMP%\ksoftmgr\data\kuefreq\61000078.dat
%TEMP%\ksoftmgr\data\kuefreq\61000081.dat
%TEMP%\ksoftmgr\data\kuefreq\61000095.dat
%TEMP%\ksoftmgr\data\kuefreq\61000096.dat
%TEMP%\ksoftmgr\data\kuefreq\61000099.dat
%TEMP%\ksoftmgr\data\kuefreq\70000175.dat
%TEMP%\ksoftmgr\data\kuefreq\61000070.dat
%TEMP%\ksoftmgr\data\kuefreq\61000071.dat
%TEMP%\ksoftmgr\data\kuefreq\70000534.dat
%TEMP%\ksoftmgr\data\kuefreq\70001065.dat
%TEMP%\ksoftmgr\data\kuefreq\70001103.dat
%TEMP%\ksoftmgr\data\kuefreq\70001234.dat
%TEMP%\ksoftmgr\data\kuefreq\70001788.dat
%TEMP%\ksoftmgr\data\kuefreq\70001793.dat
%TEMP%\ksoftmgr\data\kuefreq\70001802.dat
%TEMP%\ksoftmgr\data\kuefreq\70001804.dat
%TEMP%\ksoftmgr\data\kuefreq\70001837.dat
%TEMP%\ksoftmgr\data\kuefreq\70001840.dat
%TEMP%\ksoftmgr\data\kuefreq\70001845.dat
%TEMP%\ksoftmgr\data\kuefreq\70000981.dat
%TEMP%\ksoftmgr\data\kuefreq\70001063.dat
%TEMP%\ksoftmgr\data\kuefreq\61000059.dat
%TEMP%\ksoftmgr\data\kuefreq\61000056.dat
%TEMP%\ksoftmgr\data\kuefreq\61000036.dat
%TEMP%\ksoftmgr\data\kuefreq\60047258.dat
%TEMP%\ksoftmgr\data\kuefreq\60047447.dat
%TEMP%\ksoftmgr\data\kuefreq\60047501.dat
%TEMP%\ksoftmgr\data\kuefreq\60047597.dat
%TEMP%\ksoftmgr\data\kuefreq\60047638.dat
%TEMP%\ksoftmgr\security\kxescan\kfcdetect.dll.log
%TEMP%\ksoftmgr\data\kuefreq\60047692.dat
%TEMP%\ksoftmgr\data\kuefreq\60047696.dat
%TEMP%\ksoftmgr\data\kuefreq\60047708.dat
%TEMP%\ksoftmgr\data\kuefreq\60047717.dat
%TEMP%\ksoftmgr\data\kuefreq\60047766.dat
%TEMP%\ksoftmgr\data\kuefreq\60047253.dat
%TEMP%\ksoftmgr\data\kuefreq\60047772.dat
%TEMP%\ksoftmgr\data\kuefreq\60047775.dat
%TEMP%\ksoftmgr\data\kuefreq\60047838.dat
%TEMP%\ksoftmgr\data\kuefreq\60047839.dat
%TEMP%\ksoftmgr\data\kuefreq\60047841.dat
%TEMP%\ksoftmgr\data\kuefreq\60047992.dat
%TEMP%\ksoftmgr\data\kuefreq\60048007.dat
%TEMP%\ksoftmgr\data\kuefreq\60048019.dat
%TEMP%\ksoftmgr\data\kuefreq\60048026.dat
%TEMP%\ksoftmgr\data\kuefreq\60048050.dat
%TEMP%\ksoftmgr\data\kuefreq\61000010.dat
%TEMP%\ksoftmgr\data\kuefreq\61000011.dat
%TEMP%\ksoftmgr\data\kuefreq\60047773.dat
%TEMP%\ksoftmgr\data\kuefreq\70001855.dat
%TEMP%\ksoftmgr\data\kuefreq\70001865.dat
%TEMP%\ksoftmgr\data\kuefreq\70001867.dat
%TEMP%\ksoftmgr\data\kuefreq\70001869.dat
%TEMP%\ksoftmgr\data\ksofticondownloader.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_100_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_2_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_6_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_3_30.dat
%ALLUSERSPROFILE%\thunder network\downloadlib\pub_store.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_1_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_5_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_4_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_14_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_7_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_9_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_8_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_18_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_21_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_22_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_19_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_13_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_20_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_15_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_16_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_12_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_10_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_17_30.dat
%TEMP%\ksoftmgr\softmgrcache\all_1_1_11_30.dat
%TEMP%\ksoftmgr\softmgrcache\ksmcat.dat
%TEMP%\ksoftmgr\data\localsofts.dat
%TEMP%\ksoftmgr\data\localsoftcache.dat
%TEMP%\ksoftmgr\data\softuninstcfg.ini
%TEMP%\ksoftmgr\data\kuefreq\70001874.dat
%TEMP%\ksoftmgr\data\kuefreq\70001875.dat
%TEMP%\ksoftmgr\data\kuefreq\70001878.dat
%TEMP%\ksoftmgr\data\kuefreq\70001884.dat
%TEMP%\ksoftmgr\data\kuefreq\70001897.dat
%TEMP%\ksoftmgr\data\kuefreq\70001898.dat
%TEMP%\ksoftmgr\data\kuefreq\70001903.dat
%TEMP%\ksoftmgr\data\kuefreq\70001905.dat
%TEMP%\ksoftmgr\data\kuefreq\70001906.dat
%TEMP%\ksoftmgr\data\kuefreq\70001911.dat
%TEMP%\ksoftmgr\data\kuefreq\70001914.dat
%TEMP%\ksoftmgr\data\kuefreq\70001920.dat
%TEMP%\ksoftmgr\data\kuefreq\70001921.dat
%TEMP%\ksoftmgr\data\kuefreq\70001923.dat
%TEMP%\ksoftmgr\data\kuefreq\70001924.dat
%TEMP%\ksoftmgr\data\kuefreq\70001925.dat
%TEMP%\ksoftmgr\data\kuefreq\70001933.dat
%TEMP%\ksoftmgr\data\kuefreq\70001935.dat
%TEMP%\ksoftmgr\data\kuefreq\70001936.dat
%TEMP%\ksoftmgr\data\softuninst.ini
%TEMP%\ksoftmgr\xlmodule\download\zlib1.dll
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020100920201010\index.dat
%TEMP%\ksoftmgr\data\ksoftmgr.ini
%TEMP%\ksoftmgr\softmgrcache\uninstallinfo.dat
%TEMP%\ksoftmgr\data\ksoftmgrlces.ini
%TEMP%\ksoftmgr\softmgrcache\all_1_1_23_30.dat
%TEMP%\ksoftmgr\data\kuefreq\60046865.dat
%TEMP%\ksoftmgr\data\kuefreq\60046533.dat
%TEMP%\ksoftmgr\data\kuefreq\60046095.dat
%TEMP%\ksoftmgr\data\kuefreq\60000024.dat
%TEMP%\ksoftmgr\data\kuefreq\60000030.dat
%TEMP%\ksoftmgr\data\kuefreq\60000041.dat
%TEMP%\ksoftmgr\data\kuefreq\60000043.dat
%TEMP%\ksoftmgr\data\kuefreq\60000044.dat
%TEMP%\ksoftmgr\data\kuefreq\60000047.dat
%TEMP%\ksoftmgr\data\kuefreq\60000048.dat
%TEMP%\ksoftmgr\data\kuefreq\60000057.dat
%TEMP%\ksoftmgr\data\kuefreq\60000072.dat
%TEMP%\ksoftmgr\data\kuefreq\60000098.dat
%TEMP%\ksoftmgr\data\kuefreq\60000011.dat
%TEMP%\ksoftmgr\data\kuefreq\60000022.dat
%TEMP%\ksoftmgr\data\kuefreq\60000101.dat
%TEMP%\ksoftmgr\data\kuefreq\60000179.dat
%TEMP%\ksoftmgr\data\kuefreq\60000209.dat
%TEMP%\ksoftmgr\data\kuefreq\60000234.dat
%TEMP%\ksoftmgr\data\kuefreq\60000321.dat
%TEMP%\ksoftmgr\data\kuefreq\60000365.dat
%TEMP%\ksoftmgr\data\kuefreq\60000400.dat
%TEMP%\ksoftmgr\data\kuefreq\60000401.dat
%TEMP%\ksoftmgr\data\kuefreq\60000404.dat
%TEMP%\ksoftmgr\data\kuefreq\60000407.dat
%TEMP%\ksoftmgr\data\kuefreq\60000421.dat
%TEMP%\ksoftmgr\data\kuefreq\60000105.dat
%TEMP%\ksoftmgr\data\kuefreq\60000158.dat
%TEMP%\ksoftmgr\data\kuefreq\60000002.dat
%ALLUSERSPROFILE%\kingsoft\kis\hg.dat
%TEMP%\ksoftmgr\data\whitelist.dat
%TEMP%\ksoftmgr\ksoftmgr.exe
%TEMP%\ksoftmgr\ksoftmgrengine.dll
%TEMP%\ksoftmgr\ksoftmgrproxy.exe
%TEMP%\ksoftmgr\ktoolupd.dll
%TEMP%\ksoftmgr\microsoft.vc80.crt.manifest
%TEMP%\ksoftmgr\microsoft.vc80.mfc.manifest
%TEMP%\ksoftmgr\msvcp80.dll
%TEMP%\ksoftmgr\msvcr80.dll
%TEMP%\ksoftmgr\zlib1.dll
%TEMP%\ksoftmgr\data\ksoft_category.dat
%TEMP%\ksoftmgr\data\ksoftmgrun.dat
%TEMP%\ksoftmgr\kskinmgr.dll
%TEMP%\ksoftmgr\data\kuefreq\kuefreq.dat
%TEMP%\ksoftmgr\security\kxescan\kfcdetect.dll
%TEMP%\ksoftmgr\xlmodule\xldl.dll
%TEMP%\ksoftmgr\xlmodule\download\atl71.dll
%TEMP%\ksoftmgr\xlmodule\download\dl_peer_id.dll
%TEMP%\ksoftmgr\xlmodule\download\download_engine.dll
%TEMP%\ksoftmgr\xlmodule\download\id.dat
%TEMP%\ksoftmgr\xlmodule\download\minithunderplatform.exe
%TEMP%\ksoftmgr\xlmodule\download\minizip.dll
%TEMP%\ksoftmgr\xlmodule\download\msvcp71.dll
%TEMP%\ksoftmgr\xlmodule\download\msvcr71.dll
%TEMP%\ksoftmgr\xlmodule\download\xlzlib1.dll
%TEMP%\ksoftmgr\data\kuefreq\kuehead.dat
%TEMP%\ksoftmgr\data\kuefreq\60000612.dat
%TEMP%\ksoftmgr\data\kuefreq\60000619.dat
%TEMP%\ksoftmgr\data\kuefreq\60000769.dat
%TEMP%\ksoftmgr\data\kuefreq\60000794.dat
%TEMP%\ksoftmgr\data\kuefreq\60025942.dat
%TEMP%\ksoftmgr\data\kuefreq\60035762.dat
%TEMP%\ksoftmgr\data\kuefreq\60036974.dat
%TEMP%\ksoftmgr\data\kuefreq\60037692.dat
%TEMP%\ksoftmgr\data\kuefreq\60037746.dat
%TEMP%\ksoftmgr\data\kuefreq\60038097.dat
%TEMP%\ksoftmgr\data\kuefreq\60038242.dat
%TEMP%\ksoftmgr\data\kuefreq\60039362.dat
%TEMP%\ksoftmgr\data\kuefreq\60039381.dat
%TEMP%\ksoftmgr\data\kuefreq\60039584.dat
%TEMP%\ksoftmgr\data\kuefreq\60039769.dat
%TEMP%\ksoftmgr\data\kuefreq\60040407.dat
%TEMP%\ksoftmgr\data\kuefreq\60040408.dat
%TEMP%\ksoftmgr\data\kuefreq\60040422.dat
%TEMP%\ksoftmgr\data\kuefreq\60040548.dat
%TEMP%\ksoftmgr\data\kuefreq\60043068.dat
%TEMP%\ksoftmgr\data\kuefreq\60043150.dat
%TEMP%\ksoftmgr\data\kuefreq\60043465.dat
%TEMP%\ksoftmgr\data\kuefreq\60043559.dat
%TEMP%\ksoftmgr\data\kuefreq\60044053.dat
%TEMP%\ksoftmgr\data\kuefreq\60044246.dat
%TEMP%\ksoftmgr\data\kuefreq\60044347.dat
%TEMP%\ksoftmgr\data\kuefreq\60044350.dat
%TEMP%\ksoftmgr\data\kuefreq\60045166.dat
%TEMP%\ksoftmgr\data\kuefreq\60045292.dat
%TEMP%\ksoftmgr\data\kuefreq\60015668.dat
%TEMP%\ksoftmgr\data\kuefreq\60005485.dat
%TEMP%\ksoftmgr\data\kuefreq\60005631.dat
%TEMP%\ksoftmgr\data\kuefreq\60005482.dat
%TEMP%\ksoftmgr\data\kuefreq\60000844.dat
%TEMP%\ksoftmgr\data\kuefreq\60000963.dat
%TEMP%\ksoftmgr\data\kuefreq\60001027.dat
%TEMP%\ksoftmgr\data\kuefreq\60001094.dat
%TEMP%\ksoftmgr\data\kuefreq\60001103.dat
%TEMP%\ksoftmgr\data\kuefreq\60001169.dat
%TEMP%\ksoftmgr\data\kuefreq\60001205.dat
%TEMP%\ksoftmgr\data\kuefreq\60001281.dat
%TEMP%\ksoftmgr\data\kuefreq\60001314.dat
%TEMP%\ksoftmgr\data\kuefreq\60001373.dat
%TEMP%\ksoftmgr\data\kuefreq\60001374.dat
%TEMP%\ksoftmgr\data\kuefreq\60001429.dat
%TEMP%\ksoftmgr\data\kuefreq\60001448.dat
%TEMP%\ksoftmgr\data\kuefreq\60001471.dat
%TEMP%\ksoftmgr\data\kuefreq\60001479.dat
%TEMP%\ksoftmgr\data\kuefreq\60001519.dat
%TEMP%\ksoftmgr\data\kuefreq\60001578.dat
%TEMP%\ksoftmgr\data\kuefreq\60001630.dat
%TEMP%\ksoftmgr\data\kuefreq\60001738.dat
%TEMP%\ksoftmgr\data\kuefreq\60001814.dat
%TEMP%\ksoftmgr\data\kuefreq\60001823.dat
%TEMP%\ksoftmgr\data\kuefreq\60002870.dat
%TEMP%\ksoftmgr\data\kuefreq\60002916.dat
%TEMP%\ksoftmgr\data\kuefreq\60002917.dat
%TEMP%\ksoftmgr\data\kuefreq\60005314.dat
%TEMP%\ksoftmgr\data\kuefreq\60046094.dat
%TEMP%\ksoftmgr\softmgrcache\kuesize.dat

Network activity

TCP

HTTP GET requests

http://so####r.duba.net/small/hotwords.htm
http://so####r.duba.net/softmgr_v2/allsoft/11/1/30/1/win7/64.html
http://so####r.duba.net/softmgr_v2/allsoft/17/1/30/1/win7/64.html
http://so####r.duba.net/softmgr_v2/allsoft/10/1/30/1/win7/64.html
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/82002170.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007092.png
http://so####r.duba.net/softmgr_v2/allsoft/12/1/30/1/win7/64.html
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60044347.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007476.png
http://so####r.duba.net/softmgr_v2/allsoft/16/1/30/1/win7/64.html
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70001049.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/61000096.png
http://so####r.duba.net/softmgr_v2/allsoft/15/1/30/1/win7/64.html
http://so####r.duba.net/softmgr_v2/allsoft/20/1/30/1/win7/64.html
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60038097.png
http://so####r.duba.net/softmgr_v2/allsoft/9/1/30/1/win7/64.html
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60000006.png
http://so####r.duba.net/softmgr_v2/allsoft/19/1/30/1/win7/64.html
http://so####r.duba.net/softmgr_v2/allsoft/22/1/30/1/win7/64.html
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007763.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007459.png
http://so####r.duba.net/softmgr_v2/allsoft/21/1/30/1/win7/64.html
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60000118.png
http://so####r.duba.net/small/css/images/install_btn2.png
http://so####r.duba.net/softmgr_v2/allsoft/18/1/30/1/win7/64.html
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60039457.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60015650.png
http://so####r.duba.net/softmgr_v2/getSoftwareSearchHotWords.json?ve###
http://so####r.duba.net/softmgr_v2/allsoft/8/1/30/1/win7/64.html
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70005977.png
http://so####r.duba.net/small/css/images/hot.png
http://so####r.duba.net/softmgr_v2/allsoft/13/1/30/1/win7/64.html
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60041256.png
http://so####r.duba.net/softmgr_v2/allsoft/23/1/30/1/win7/64.html
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70003220.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60047597.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60048030.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60046865.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007316.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007326.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007327.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007329.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60001814.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007330.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007325.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007398.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60003603.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007419.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/61000073.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007315.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007267.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007410.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60040407.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/61000069.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70005778.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/61000075.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60046533.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60048097.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/63003986.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70005378.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/84100002.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007093.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007324.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007323.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007317.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60000105.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60000034.png
http://so####r.duba.net/softmgr_v2/allsoft/7/1/30/1/win7/64.html
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/61000098.png
http://so####r.duba.net/softcenter/images/pic/hottopic/jsktbanner.png
http://so####r.duba.net/small/images/pic/hottopic/once.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007334.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70002847.png
http://so####r.duba.net/softcenter/images/pic/hottopic/20200307.jpg
http://so####r.duba.net/small/css/images/oral.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007340.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70005042.png
http://so####r.duba.net/small/css/images/btn_index3.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70006839.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60000002.png
http://so####r.duba.net/small/css/images/btn_index.png
http://so####r.duba.net/softcenter/images/pic/hottopic/20200529.jpg
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007385.png
http://so####r.duba.net/softcenter/images/pic/hottopic/20200519.jpg
http://so####r.duba.net/softmgr_v2/hot_subject/Win7/64/50.json
http://so####r.duba.net/softmgr_v2/hot_subject/Win7/64/48.json
http://so####r.duba.net/softmgr_v2/allsoft/general/win7/64.html
http://dl.##.ksmobile.com/static/res/dd/96/yuanqi_banner.gif
http://hm.##idu.com/hm.js?c7##############################
http://so####r.duba.net/softmgr_v2/popular/1.html
http://so####r.duba.net/softmgr_v2/popular/4.html
http://so####r.duba.net/small/css/images/loading.png
http://so####r.duba.net/small/js/index.min.js?ve################
http://so####r.duba.net/small/js/softmgr.min.js?ve################
http://so####r.duba.net/small/js/tscrollbar.min.js
http://so####r.duba.net/small/js/jquery-1.11.2.min.js
http://so####r.duba.net/small/css/common.css?ve################
http://so####r.duba.net/small/index.htm?ve#########################
http://so####r.duba.net/softcenter/images/pic/hottopic/20200212.png
http://so####r.duba.net/softcenter/images/pic/hottopic/52haoyalittle0215.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/61000074.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70005960.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007522.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70006384.png
http://so####r.duba.net/softmgr_v2/allsoft/14/1/30/1/win7/64.html
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007520.png
http://so####r.duba.net/softmgr_v2/allsoft/4/1/30/1/win7/64.html
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60048026.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60001738.png
http://so####r.duba.net/softmgr_v2/allsoft/5/1/30/1/win7/64.html
http://so####r.duba.net/softmgr_v2/allsoft/1/1/30/1/win7/64.html
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60000072.png
http://so####r.duba.net/small/css/images/btn_index2.png?v=#
http://so####r.duba.net/small/css/images/default.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60000399.png
http://so####r.duba.net/small/css/images/upgrade.png
http://so####r.duba.net/small/js/hotwords.min.js?ve################
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60040408.png
http://so####r.duba.net/small/css/hotwords.css?ve################
http://so####r.duba.net/small/css/images/btn_index1.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60048173.png
http://so####r.duba.net/softmgr_v2/allsoft/3/1/30/1/win7/64.html
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70005550.png
http://so####r.duba.net/softmgr_v2/allsoft/6/1/30/1/win7/64.html
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70006853.png
http://so####r.duba.net/softmgr_v2/allsoft/2/1/30/1/win7/64.html
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007328.png
http://so####r.duba.net/softmgr_v2/allsoft/100/1/30/1/win7/64.html
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60002917.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60047692.png
http://so####r.duba.net/small/css/common_old.css?ve################
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/60045286.png
http://so####r.duba.net/small/css/images/default_32.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/61000071.png
http://cu###.www.duba.net/duba/tools/dubatools/softmgricon/70007322.png
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

HTTP POST requests

http://12#.###.105.156:8080/kurl_query?11##### via 12#.#07.105.156

'hm.##idu.com':443

UDP

DNS ASK so####r.duba.net
DNS ASK hm.##idu.com
DNS ASK dl.##.ksmobile.com
DNS ASK cu###.www.duba.net
DNS ASK rq.#####ize.cloud.duba.net
DNS ASK microsoft.com

Miscellaneous

Searches for the following windows

ClassName: 'KSoftMgr_hiddenDpiAwarenessWindow' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%TEMP%\ksoftmgr\ksoftmgr.exe'
'%TEMP%\ksoftmgr\xlmodule\download\minithunderplatform.exe' -StartTP
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\KSoftMgr\xlmodule\download\minithunderplatform.exe" "minithunderplatform" enable' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней