Trojan.DownLoader13.17798

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Clients\StartMenuInternet\liebao.exe\shell\open\command] '' = '%LOCALAPPDATA%\liebao\liebao.exe'
[<HKLM>\Software\Wow6432Node\Clients\StartMenuInternet\liebao.exe\shell\open\command] '' = '%LOCALAPPDATA%\liebao\liebao.exe'
[<HKCU>\Software\Classes\file\shell\open\command] '' = '"%LOCALAPPDATA%\liebao\liebao.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\file\shell\open\command] '' = '"%LOCALAPPDATA%\liebao\liebao.exe" "%1"'
[<HKCU>\Software\Classes\https\shell\open\command] '' = '"%LOCALAPPDATA%\liebao\liebao.exe" "%1"'
[<HKLM>\Software\Classes\https\shell\open\command] '' = '"%LOCALAPPDATA%\liebao\liebao.exe" "%1"'
[<HKCU>\Software\Classes\http\shell\open\command] '' = '"%LOCALAPPDATA%\liebao\liebao.exe" "%1"'
[<HKLM>\Software\Classes\http\shell\open\command] '' = '"%LOCALAPPDATA%\liebao\liebao.exe" "%1"'
[<HKCU>\Software\Classes\ftp\shell\open\command] '' = '"%LOCALAPPDATA%\liebao\liebao.exe" "%1"'
[<HKLM>\Software\Classes\ftp\shell\open\command] '' = '"%LOCALAPPDATA%\liebao\liebao.exe" "%1"'
[<HKCU>\Software\Classes\Liebao.URL\shell\open\command] '' = '"%LOCALAPPDATA%\liebao\liebao.exe" "%1"'
[<HKLM>\Software\Classes\Liebao.URL\shell\open\command] '' = '"%LOCALAPPDATA%\liebao\liebao.exe" "%1"'
[<HKCU>\Software\Classes\Liebao.HTML\shell\open\command] '' = '"%LOCALAPPDATA%\liebao\liebao.exe" "%1"'
[<HKLM>\Software\Classes\Liebao.HTML\shell\open\command] '' = '"%LOCALAPPDATA%\liebao\liebao.exe" "%1"'

Creates the following services

[<HKLM>\SYSTEM\CurrentControlSet\services\knbcenter] 'ImagePath' = '%LOCALAPPDATA%\liebao\4.5.34.6725\knbcenter.exe'
[<HKLM>\System\CurrentControlSet\Services\knbcenter] 'Start' = '00000002'
[<HKLM>\SYSTEM\CurrentControlSet\Services\KNBDrv] 'ImagePath' = '<DRIVERS>\KNBDrv.sys'

Malicious functions

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="腾讯产品下载组件" dir=in program="%CommonProgramFiles(x86)%\tencent\qqdownload\122\tencentdl.exe" description="%CommonProgramFiles(x86)%\tencent\qqdownload\122\tence...

Modifies file system

Creates the following files

%ProgramFiles%\ksbinstaller_s_66_51114.exe
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\desktoptips.exe
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\fixbrowser.exe
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\kdumprep.exe
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\knbcenter.exe
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\liebao.exe
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\manualupgrade.exe
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\skinupdater.exe
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\sqlite3.exe
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\qqdl\tencentdl.exe
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\uninst.exe
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\third_party\baidu_hd_query.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\chrome.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\d3dcompiler_43.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\kmsgsvc.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\d3dcompiler_46.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\qqdl\dlcore.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\qqdl\downloadproxy.dll
%ProgramFiles%\kavsetups_66_66567.exe
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\qqdl\downloadproxyps.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\qqdl\extract.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\ffmpegsumo.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\kadfilter.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\kaxhlp.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\kbrowserupgrade2.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\kbupdatehelper.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\kfcdetect.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\cyui.exe
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\cysvc.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\ztvc0019.vsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\falset.psg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\zepbb002.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\zepc0002.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\zipb0002.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\zipb0003.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\zipb7004.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\zipb8009.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\zipba004.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\zipbb004.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\zipc0003.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\befc2009.psg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\btfc2009.psg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\false.psg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\zema0007.psg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\ztvbb00d.vsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\ztma002d.psg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\ztmb0014.psg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\ztmc0000.psg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\btvb7001.vsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\btvb7002.vsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\btvb7999.vsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\ztvb0002.vsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\ztvb0005.vsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\ztvb7001.vsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\ztvb8008.vsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\ztvb9008.vsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\ztvba012.vsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\ztvc0011.vsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\knbctrl.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\knbpolicy.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\ksapi.dll
%CommonProgramFiles(x86)%\tencent\qqdownload\122\extract.dll
%CommonProgramFiles(x86)%\tencent\qqdownload\122\downloadproxyps.dll
%CommonProgramFiles(x86)%\tencent\qqdownload\122\installinfo.xml
%HOMEPATH%\desktop\猎豹安全浏览器.lnk
%LOCALAPPDATA%\liebao\猎豹安全浏览器.lnk
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\猎豹安全浏览器.lnk
%ProgramFiles%\kuping_s_30767.exe
%APPDATA%\microsoft\windows\start menu\programs\猎豹安全浏览器\猎豹安全浏览器.lnk
%APPDATA%\microsoft\windows\start menu\programs\猎豹安全浏览器\修复浏览器.lnk
%APPDATA%\microsoft\windows\start menu\programs\猎豹安全浏览器\卸载猎豹安全浏览器.lnk
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\startmenu\猎豹安全浏览器.lnk
%CommonProgramFiles(x86)%\tencent\qqdownload\122\dlcore.dll
%CommonProgramFiles(x86)%\tencent\qqdownload\122\tnproxy.dll
%LOCALAPPDATA%\liebao\user data\legoicon\lego.dat
%LOCALAPPDATA%\liebao\4.5.34.6725\debug.log
%LOCALAPPDATA%\liebao\user data\default\uproperty.db-journal
%LOCALAPPDATA%\liebao\user data\default\uproperty.db
%WINDIR%\temp\uddb785.tmp
%LOCALAPPDATA%\liebao\user data\website\manifest-000001
%LOCALAPPDATA%\liebao\user data\website\000001.dbtmp
%LOCALAPPDATA%\liebao\user data\ba16.tmp
%LOCALAPPDATA%\liebao\user data\website\manifest-000002
%LOCALAPPDATA%\liebao\user data\website\000002.dbtmp
%LOCALAPPDATA%\liebao\user data\website\log
%LOCALAPPDATA%\liebao\user data\upgrade\cleanup.log
%LOCALAPPDATA%\liebao\4.5.34.6725\log\kmctrl.log
%LOCALAPPDATA%\liebao\4.5.34.6725\data\expand_safepay.dat
%CommonProgramFiles(x86)%\tencent\qqdownload\122\tencentdl.exe
%LOCALAPPDATA%\liebao\user data\install_info.json
%LOCALAPPDATA%\liebao\user data\local state
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\kseescan.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\ksesscan.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\kseutil.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\ktoolupd.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\kvipinter.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\libegl.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\libglesv2.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\liebao.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\mousegesture.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\plugins\np-mswmp.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\plugins\npaliedit.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\pepperflash\pepflashplayer.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\ksbwdet2.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\scom.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\qqdl\tnproxy.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\upgrade.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\uplive.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\xinput1_3.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\zlib1.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\knbdrv.sys
<DRIVERS>\knbdrv.sys
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\knbdrv64.sys
<DRIVERS>\knbdrv64.sys
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\ksapi.sys
<DRIVERS>\ksapi.sys
%LOCALAPPDATA%\liebao\liebao.exe
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\sqlite.dll
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\zepba000.ksg
%LOCALAPPDATA%\liebao\user data\upgrade\manager.log
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\zepb9002.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\zepb7001.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\img\psbc.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\img\safesearch_safe.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\img\safesearch_unsafe.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\img\sdb.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\secondarytile.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\presetextensions\nffflelpnjalbndohecponhmlcihbgeo\1.0\skin_thumbnail.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\img\spdb.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\img\tenpay.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\img\unionpay.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\liebao.ico
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\qqdl\install.bat
%LOCALAPPDATA%\liebao\202025015123165_1\browserpacket.xml
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\allsigns.ini
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\config\kseeat.cfg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\allvinfo.ini
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\kae\kaecore.ini
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\ksbwdt.ini
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\ksecfg.ini
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\ksedset.ini
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\signs.ini
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\vinfo.ini
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\gare.db
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\localauto.db
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\localurl.db
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\logos.db
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\switchcore.db
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\img\icbc.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\mousegesturelib.xml
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\img\hxb.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\locales\en-us.pak
%LOCALAPPDATA%\liebao\test_access
%LOCALAPPDATA%\liebao\user data\install2_log.log
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\bookmarks
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\kpreferences
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\master_preferences
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\presetextensions\preferences
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\presetextensions\preferences_resintall
%TEMP%\send_424.gz
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\presetextensions\nffflelpnjalbndohecponhmlcihbgeo\1.0\cached theme.pak
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\presetextensions\ljdfelebfnfpjclmmkljlnagcdkpfpdl\1.0\cached theme.pak
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\chrome_100_percent.pak
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\chrome_touch_100_percent.pak
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\kui.pak
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\img\czb.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\locales\kui_en-us.pak
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\locales\kui_zh-cn.pak
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\resources.pak
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\locales\zh-cn.pak
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\newtab_img2.zip
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\img\99bill.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\img\alipay.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\img\baifubao.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\img\bc.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\img\boc.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\img\ceb.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\img\cmb.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\img\gdb.png
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\adb_easylist.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\adfilter.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\anti_injection2.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\tn.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\trackers.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\wd.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\webresource.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\btfb7001.fsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\falset.fsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\oj011204.fsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\oj021204.fsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\oj051204.fsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\oj101204.fsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\oj141203.fsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\safepay_site.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\srvpref.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\ztfb0002.fsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\ztfc000f.fsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\pepperflash\manifest.json
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\bepac001.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\bepac002.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\bepb3001.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\bepb3002.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\bepb6001.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\bepb6002.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\false.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\unknown.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\zepb0001.ksg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\ztfb0005.fsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\ztfc000b.fsg
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\safepay.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\resource.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\pkw2.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\autofilljs2.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\cdeploy.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\checkvideo.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\feature2.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\gdeploy.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\incognito.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\kae\kaearcha.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\kae\kaearchb.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\kae\kaecore.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\kae\kaecorea.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\kae\kaecoref.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\kae\kaecorem.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\atxhlp.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\kae\kaevname.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\kae\kaextend.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\kae\karchive.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\ksais.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\kseexf.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\ksepnf.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\kseset.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\kwnp.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\lego.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\libvideo.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\nologin.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\p1tl.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\data\pkw.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\security\kxescan\kae\kaext2.dat
%LOCALAPPDATA%\liebao\202025015123165_1\lbbrowser\module\security\ksg\zepb8003.ksg
%TEMP%\send_bcc.gz

Deletes the following files

%LOCALAPPDATA%\liebao\test_access
%TEMP%\send_424.gz
%LOCALAPPDATA%\liebao\猎豹安全浏览器.lnk
%LOCALAPPDATA%\liebao\user data\default\uproperty.db-journal
%WINDIR%\temp\uddb785.tmp
%LOCALAPPDATA%\liebao\user data\website\current~rf11ba35.tmp
%LOCALAPPDATA%\liebao\user data\website\manifest-000001
%LOCALAPPDATA%\liebao\user data\website\current
%LOCALAPPDATA%\liebao\user data\website\log
%LOCALAPPDATA%\liebao\user data\website\manifest-000002
%LOCALAPPDATA%\liebao\user data\local state~rf11bb2f.tmp
%TEMP%\send_bcc.gz

Moves the following files

from %LOCALAPPDATA%\liebao\202025015123165_1\browserpacket.xml to %LOCALAPPDATA%\liebao\browserpacket.xml
from %LOCALAPPDATA%\liebao\user data\website\000001.dbtmp to %LOCALAPPDATA%\liebao\user data\website\current
from %LOCALAPPDATA%\liebao\user data\ba16.tmp to %LOCALAPPDATA%\liebao\user data\local state
from %LOCALAPPDATA%\liebao\user data\website\000002.dbtmp to %LOCALAPPDATA%\liebao\user data\website\current
from %LOCALAPPDATA%\liebao\user data\website\current to %LOCALAPPDATA%\liebao\user data\website\current~rf11ba35.tmp
from %LOCALAPPDATA%\liebao\user data\local state to %LOCALAPPDATA%\liebao\user data\local state~rf11bb2f.tmp

Substitutes the following files

%LOCALAPPDATA%\liebao\test_access
%LOCALAPPDATA%\liebao\猎豹安全浏览器.lnk
%LOCALAPPDATA%\liebao\user data\website\current
%LOCALAPPDATA%\liebao\user data\local state
%TEMP%\send_bcc.gz

Network activity

TCP

HTTP GET requests

http://dl.####n.ijinshan.com/liebao/link/ksbinstaller_s_66_51114.exe
http://dl.####n.ijinshan.com/duba/link/KAVSETUPS_66_66567.exe
http://dl.####n.ijinshan.com/kuping/jm/kuping_s_30767.exe
http://lb.###.ijinshan.com/lb/?v=############################################################################################################
http://lb####.tj.ijinshan.com/start/?s=######################################################################################################

HTTP POST requests

http://lb##.##.ijinshan.com/active/

UDP

DNS ASK dl.####n.ijinshan.com
DNS ASK lb##.##.ijinshan.com
DNS ASK dt##.#####ntdlinstallinfo.qq.com
DNS ASK lb.###.ijinshan.com
DNS ASK lb####.tj.ijinshan.com

Miscellaneous

Creates and executes the following

'%ProgramFiles%\ksbinstaller_s_66_51114.exe'
'%LOCALAPPDATA%\liebao\liebao.exe' --install-complete
'%CommonProgramFiles(x86)%\tencent\qqdownload\122\tencentdl.exe' -RegServer
'%LOCALAPPDATA%\liebao\liebao.exe' --make-default-browser
'%LOCALAPPDATA%\liebao\4.5.34.6725\module\qqdl\tencentdl.exe' /install' (with hidden window)
'%LOCALAPPDATA%\liebao\4.5.34.6725\skinupdater.exe' ' (with hidden window)
'%LOCALAPPDATA%\liebao\liebao.exe' --install-complete' (with hidden window)
'%CommonProgramFiles(x86)%\tencent\qqdownload\122\tencentdl.exe' -RegServer' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="腾讯产品下载组件" dir=in program="%CommonProgramFiles(x86)%\tencent\qqdownload\122\tencentdl.exe" description="%CommonProgramFiles(x86)%\tencent\qqdownload\122\tence...' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\tencent\qqdownload\122\DownloadProxyPS.dll"' (with hidden window)
'%LOCALAPPDATA%\liebao\4.5.34.6725\knbcenter.exe' /install' (with hidden window)
'%LOCALAPPDATA%\liebao\4.5.34.6725\knbcenter.exe' /start' (with hidden window)
'%LOCALAPPDATA%\liebao\liebao.exe' --make-default-browser' (with hidden window)

Executes the following

'%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\tencent\qqdownload\122\DownloadProxyPS.dll"

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial