Analysis
-
max time kernel
129s -
max time network
94s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13-05-2021 13:39
Static task
static1
Behavioral task
behavioral1
Sample
51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe
Resource
win7v20210410
General
-
Target
51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe
-
Size
511KB
-
MD5
568f9531fe2064351f3447cd400e5624
-
SHA1
92388449c52d5fa0fee4aabbde3347620a2845ac
-
SHA256
51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a
-
SHA512
1ffd7d3f4f3b54b895b7b762549c824974c93f7db161ea54d87906845228a1c0393f9631d9eb70fa94ee4b29fb9a6429e9da8fdd4cbbf6ac18a3eb1cdd6b3f00
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
Processes:
51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exeDesktopLayer.exe51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exeDesktopLayer.exepid process 3956 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe 3932 DesktopLayer.exe 188 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe 2304 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe 652 DesktopLayer.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe upx C:\Users\Admin\AppData\Local\Temp\51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx behavioral2/memory/3956-123-0x0000000000400000-0x000000000042E000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Tencent\QTalk\AUTemp\51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe upx C:\Users\Admin\AppData\Roaming\Tencent\QTalk\AUTemp\51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx -
Drops file in System32 directory 1 IoCs
Processes:
51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exedescription ioc process File created C:\Windows\SysWOW64\QQVistaHelper.dll 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe -
Drops file in Program Files directory 5 IoCs
Processes:
51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\px692F.tmp 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\px6F2B.tmp 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327148234" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "327148291" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09FB9115-B49B-11EB-B2DB-EA801B2465EB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "327148403" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{092C244E-B49B-11EB-B2DB-EA801B2465EB} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
DesktopLayer.exeDesktopLayer.exepid process 3932 DesktopLayer.exe 3932 DesktopLayer.exe 3932 DesktopLayer.exe 3932 DesktopLayer.exe 3932 DesktopLayer.exe 3932 DesktopLayer.exe 3932 DesktopLayer.exe 3932 DesktopLayer.exe 652 DesktopLayer.exe 652 DesktopLayer.exe 652 DesktopLayer.exe 652 DesktopLayer.exe 652 DesktopLayer.exe 652 DesktopLayer.exe 652 DesktopLayer.exe 652 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 3744 iexplore.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 3176 iexplore.exe 3744 iexplore.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
iexplore.exe51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 3176 iexplore.exe 3176 iexplore.exe 188 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe 3744 iexplore.exe 3744 iexplore.exe 3504 IEXPLORE.EXE 3504 IEXPLORE.EXE 3684 IEXPLORE.EXE 3684 IEXPLORE.EXE 3504 IEXPLORE.EXE 3504 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exeDesktopLayer.exeiexplore.exe51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exeDesktopLayer.exeiexplore.exedescription pid process target process PID 740 wrote to memory of 3956 740 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe PID 740 wrote to memory of 3956 740 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe PID 740 wrote to memory of 3956 740 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe PID 3956 wrote to memory of 3932 3956 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe DesktopLayer.exe PID 3956 wrote to memory of 3932 3956 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe DesktopLayer.exe PID 3956 wrote to memory of 3932 3956 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe DesktopLayer.exe PID 3932 wrote to memory of 3176 3932 DesktopLayer.exe iexplore.exe PID 3932 wrote to memory of 3176 3932 DesktopLayer.exe iexplore.exe PID 3176 wrote to memory of 3684 3176 iexplore.exe IEXPLORE.EXE PID 3176 wrote to memory of 3684 3176 iexplore.exe IEXPLORE.EXE PID 3176 wrote to memory of 3684 3176 iexplore.exe IEXPLORE.EXE PID 740 wrote to memory of 188 740 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe PID 740 wrote to memory of 188 740 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe PID 740 wrote to memory of 188 740 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe PID 188 wrote to memory of 2304 188 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe PID 188 wrote to memory of 2304 188 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe PID 188 wrote to memory of 2304 188 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe PID 2304 wrote to memory of 652 2304 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe DesktopLayer.exe PID 2304 wrote to memory of 652 2304 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe DesktopLayer.exe PID 2304 wrote to memory of 652 2304 51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe DesktopLayer.exe PID 652 wrote to memory of 3744 652 DesktopLayer.exe iexplore.exe PID 652 wrote to memory of 3744 652 DesktopLayer.exe iexplore.exe PID 3744 wrote to memory of 3504 3744 iexplore.exe IEXPLORE.EXE PID 3744 wrote to memory of 3504 3744 iexplore.exe IEXPLORE.EXE PID 3744 wrote to memory of 3504 3744 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe"C:\Users\Admin\AppData\Local\Temp\51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exeC:\Users\Admin\AppData\Local\Temp\51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3176 CREDAT:82945 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3684 -
C:\Users\Admin\AppData\Roaming\Tencent\QTalk\AUTemp\51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe"C:\Users\Admin\AppData\Roaming\Tencent\QTalk\AUTemp\51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe" C:\Users\Admin\AppData\Local\Temp\51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:188 -
C:\Users\Admin\AppData\Roaming\Tencent\QTalk\AUTemp\51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exeC:\Users\Admin\AppData\Roaming\Tencent\QTalk\AUTemp\51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3744 CREDAT:82945 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3504
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{092C244E-B49B-11EB-B2DB-EA801B2465EB}.datMD5
971def53a999feee259d11cbb4149fe7
SHA1dd98cb9fef0425a0eda6312efaed7542b9c63f15
SHA256d1a47b28c2a27269dba41cc8574c1b46ec6adf0820c911335d96e0cc1248601e
SHA5125ad9646eb13e84d75d8aa9a8d3f4883459d56193587eed2d43356f00e267ad1593f22be41bc03e2d2aec54c27f83ff03d6401e6031ede7c673327320b4722815
-
C:\Users\Admin\AppData\Local\Temp\51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exeMD5
ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Local\Temp\51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exeMD5
ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Roaming\Tencent\Logs\QTUninstall.txtMD5
e71bdbfe4d54bae0e956c90c0c636b78
SHA10ba286d2c1b79075e8530cfe62f16b82f61eae95
SHA25655650b220f99a96628eab5dc1fa491e2b3f0c28caa1bd4598e97ae2765dfe7fc
SHA5128fba6895fa24bf5f8dbf22d452538039abc178fa5f9778a2bf483f3b785d5ce882d6da0be4175830a55f99eaee369c11c70e3ec524fb4900550b9cd889050bc2
-
C:\Users\Admin\AppData\Roaming\Tencent\QTalk\AUTemp\51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exeMD5
568f9531fe2064351f3447cd400e5624
SHA192388449c52d5fa0fee4aabbde3347620a2845ac
SHA25651c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a
SHA5121ffd7d3f4f3b54b895b7b762549c824974c93f7db161ea54d87906845228a1c0393f9631d9eb70fa94ee4b29fb9a6429e9da8fdd4cbbf6ac18a3eb1cdd6b3f00
-
C:\Users\Admin\AppData\Roaming\Tencent\QTalk\AUTemp\51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a.exeMD5
568f9531fe2064351f3447cd400e5624
SHA192388449c52d5fa0fee4aabbde3347620a2845ac
SHA25651c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5a
SHA5121ffd7d3f4f3b54b895b7b762549c824974c93f7db161ea54d87906845228a1c0393f9631d9eb70fa94ee4b29fb9a6429e9da8fdd4cbbf6ac18a3eb1cdd6b3f00
-
C:\Users\Admin\AppData\Roaming\Tencent\QTalk\AUTemp\51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exeMD5
ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Roaming\Tencent\QTalk\AUTemp\51c9a8bf68a322bbdeb955121828a115ce7ec9994145eb2cddbb26fe17f2ce5aSrv.exeMD5
ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
memory/188-128-0x0000000000000000-mapping.dmp
-
memory/652-135-0x0000000000000000-mapping.dmp
-
memory/2304-131-0x0000000000000000-mapping.dmp
-
memory/3176-121-0x0000000000000000-mapping.dmp
-
memory/3176-126-0x00007FFD157E0000-0x00007FFD1584B000-memory.dmpFilesize
428KB
-
memory/3504-145-0x0000000000000000-mapping.dmp
-
memory/3684-127-0x0000000000000000-mapping.dmp
-
memory/3744-139-0x0000000000000000-mapping.dmp
-
memory/3744-140-0x00007FFD157E0000-0x00007FFD1584B000-memory.dmpFilesize
428KB
-
memory/3932-120-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/3932-117-0x0000000000000000-mapping.dmp
-
memory/3956-123-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3956-122-0x00000000001E0000-0x00000000001EF000-memory.dmpFilesize
60KB
-
memory/3956-114-0x0000000000000000-mapping.dmp