Overview

overview

10

Static

static

QQPCDownload1726.exe

windows7_x64

10

QQPCDownload1726.exe

windows10_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    189s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    06-09-2021 06:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    QQPCDownload1726.exe

  • Size

    1.2MB

  • MD5

    010ce02a531123766140c241b62dba0a

  • SHA1

    3d7cfa3422b5dc2776f54c088de6bc513f71c757

  • SHA256

    e4e0f491d1a623421f29cf888401e02de72c8c7eeebc2519140bb91cdd7ab447

  • SHA512

    51cb6807506c79500d2fbd96c073a5926a3442af6fed21bdb5981d4996a2a072046ed883d7dac7a5795461e800e6ff0ec2de97583a33527b63bf50eeb1c59066

Score
10/10
adwarebootkitdiscoveryevasionpersistencestealertrojan

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 7 IoCs
    persistence
  • Registers COM server for autorun 1 TTPs
    persistence
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Downloads MZ/PE file
  • Drops file in Drivers directory 7 IoCs
  • Executes dropped EXE 32 IoCs
  • Sets service image path in registry 2 TTPs
    persistence
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Installs/modifies Browser Helper Object 2 TTPs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Writes to the Master Boot Record (MBR) 1 TTPs 7 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1256
      • C:\Users\Admin\AppData\Local\Temp\QQPCDownload1726.exe
        "C:\Users\Admin\AppData\Local\Temp\QQPCDownload1726.exe"
        2⤵
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1936
        • C:\Users\Admin\AppData\Roaming\tencent\QQPCMgr\Download\QQPCMgr_Setup.exe
          "C:\Users\Admin\AppData\Roaming\tencent\QQPCMgr\Download\QQPCMgr_Setup.exe" /S ##silence=1&handle=327986&update=1&supply=1726&forceinstall=1&qqpcmgr=0&DownloadSetupInOne=1
          3⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Writes to the Master Boot Record (MBR)
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Modifies Internet Explorer settings
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1508
          • C:\Windows\SysWOW64\cacls.exe
            "cacls" "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243" /t /e /c /g SYSTEM:f
            4⤵
              PID:936
            • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMBluerayInsHlp.exe
              "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMBluerayInsHlp.exe" /install
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:1688
              • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMBluerayInsHlpx64.exe
                "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMBluerayInsHlpx64.exe" /install
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1080
            • C:\Windows\SysWOW64\regsvr32.exe
              regsvr32.exe /s /i "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\\QMGCShellExt64.dll"
              4⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:1900
              • C:\Windows\system32\regsvr32.exe
                /s /i "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\\QMGCShellExt64.dll"
                5⤵
                • Loads dropped DLL
                • Modifies registry class
                PID:1776
            • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCSoftCmd.exe
              "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCSoftCmd.exe" /command=SetSimpleVersionConfig /SimpleVersion=2 /From=Installer
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1580
            • C:\Windows\SysWOW64\Netsh.exe
              "C:\Windows\system32\Netsh.exe" exec "C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~f757ed1\firewallLog.txt"
              4⤵
                PID:1644
              • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCRTP.exe
                "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCRTP.exe" -i
                4⤵
                • Executes dropped EXE
                PID:1828
              • C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~f757ed1\RemNPX.exe
                "C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~f757ed1\RemNPX.exe"
                4⤵
                • Executes dropped EXE
                PID:880
              • C:\Windows\SysWOW64\regsvr32.exe
                "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\npQMExtensionsIE.dll"
                4⤵
                • Modifies registry class
                PID:1676
                • C:\Windows\SysWOW64\reg.exe
                  reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{29B6CFD5-0064-411A-8C42-9890C83F9921}\iexplore\AllowedDomains\qq.com" /f
                  5⤵
                    PID:1596
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{29B6CFD5-0064-411A-8C42-9890C83F9921}\iexplore" /v Flags /t reg_dword /d 4 /f
                    5⤵
                      PID:1328
                    • C:\Windows\SysWOW64\reg.exe
                      reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{29B6CFD5-0064-411A-8C42-9890C83F9921}\iexplore\AllowedDomains\baidu.com" /f
                      5⤵
                        PID:1100
                      • C:\Windows\SysWOW64\reg.exe
                        reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{29B6CFD5-0064-411A-8C42-9890C83F9921}\iexplore\AllowedDomains\xunlei.com" /f
                        5⤵
                          PID:1852
                        • C:\Windows\SysWOW64\reg.exe
                          reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{29B6CFD5-0064-411A-8C42-9890C83F9921}\iexplore\AllowedDomains\sogou.com" /f
                          5⤵
                            PID:584
                          • C:\Windows\SysWOW64\reg.exe
                            reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{29B6CFD5-0064-411A-8C42-9890C83F9921}\iexplore\AllowedDomains\kugou.com" /f
                            5⤵
                              PID:2000
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{29B6CFD5-0064-411A-8C42-9890C83F9921}\iexplore\AllowedDomains\*" /f
                              5⤵
                                PID:1736
                              • C:\Windows\SysWOW64\reg.exe
                                reg delete "hkcr\CLSID\{29B6CFD5-0064-411A-8C42-9890C83F9922}" /f
                                5⤵
                                  PID:1828
                              • C:\Windows\SysWOW64\regsvr32.exe
                                "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\TSWebMon64.dat"
                                4⤵
                                  PID:908
                                  • C:\Windows\system32\regsvr32.exe
                                    /s "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\TSWebMon64.dat"
                                    5⤵
                                    • Modifies registry class
                                    PID:1708
                                • C:\Windows\SysWOW64\regsvr32.exe
                                  "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMContextScan64.dll"
                                  4⤵
                                    PID:1084
                                    • C:\Windows\system32\regsvr32.exe
                                      /s "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMContextScan64.dll"
                                      5⤵
                                      • Modifies system executable filetype association
                                      • Modifies registry class
                                      PID:1688
                                  • C:\Windows\SysWOW64\regsvr32.exe
                                    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMContextUninstall64.dll"
                                    4⤵
                                      PID:964
                                      • C:\Windows\system32\regsvr32.exe
                                        /s "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMContextUninstall64.dll"
                                        5⤵
                                          PID:1600
                                      • C:\Windows\SysWOW64\regsvr32.exe
                                        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMContextScan.dll"
                                        4⤵
                                          PID:1096
                                        • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMProxyHelper64.exe
                                          "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMProxyHelper64.exe" /Uninstall
                                          4⤵
                                          • Executes dropped EXE
                                          PID:1900
                                        • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMSuperScan.exe
                                          "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\\QMSuperScan.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • Writes to the Master Boot Record (MBR)
                                          • Modifies data under HKEY_USERS
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1592
                                          • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMCheckNetwork.exe
                                            "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMCheckNetwork.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1636
                                        • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMMiYu.exe
                                          "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMMiYu.exe" /closemiyu
                                          4⤵
                                          • Modifies system executable filetype association
                                          • Executes dropped EXE
                                          • Modifies data under HKEY_USERS
                                          • Modifies registry class
                                          PID:1600
                                        • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\GameAssist_Setup.exe
                                          "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\GameAssist_Setup.exe" /S ##silence=1&supplyid=3500
                                          4⤵
                                          • Executes dropped EXE
                                          • Writes to the Master Boot Record (MBR)
                                          • Drops file in System32 directory
                                          • Drops file in Program Files directory
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1852
                                          • C:\Windows\SysWOW64\cacls.exe
                                            "cacls" "C:\Program Files (x86)\Tencent\QQPCMgr\Plugins\GameAssist\3.0.6398.138" /t /e /c /g SYSTEM:f
                                            5⤵
                                              PID:964
                                            • C:\Program Files (x86)\Tencent\QQPCMgr\Plugins\GameAssist\3.0.6398.138\QMProxyHelper64.exe
                                              "C:\Program Files (x86)\Tencent\QQPCMgr\Plugins\GameAssist\3.0.6398.138\QMProxyHelper64.exe" /Uninstall
                                              5⤵
                                              • Executes dropped EXE
                                              PID:2448
                                          • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCTray.exe
                                            "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCTray.exe" /loadexit /superfetch:1
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1328
                                          • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCRTP.exe
                                            "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCRTP.exe" -e
                                            4⤵
                                            • Executes dropped EXE
                                            PID:1348
                                          • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCRTP.exe
                                            "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCRTP.exe" -s
                                            4⤵
                                            • Executes dropped EXE
                                            PID:1828
                                          • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCTray.exe
                                            "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCTray.exe" /regrun
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:880
                                          • C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~f757ed1\UpdateTrayIcon.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~f757ed1\UpdateTrayIcon.exe" -t QQPCTray.exe -c 1 -p 1 -d "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\"
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of FindShellTrayWindow
                                            PID:1704
                                          • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\InstallUninstallCube.exe
                                            "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\\InstallUninstallCube.exe" "/verb=EndInstall" /sync=00000130 /pid=1508 "/temp=C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~f757ed1\" "/version=13.6.20672.243" /silence=1 /result=1
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2064
                                        • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQRepair.EXE
                                          "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQRepair.EXE" /ext=5 /sid=-2147221502
                                          3⤵
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          • Checks whether UAC is enabled
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3024
                                          • C:\Windows\SysWOW64\sc.exe
                                            "C:\Windows\system32\sc.exe" start TSSysKit
                                            4⤵
                                              PID:2688
                                            • C:\Windows\SysWOW64\sc.exe
                                              "C:\Windows\system32\sc.exe" start TsDefenseBt
                                              4⤵
                                                PID:3320
                                              • C:\Windows\SysWOW64\sc.exe
                                                "C:\Windows\system32\sc.exe" start QQPCRtp
                                                4⤵
                                                  PID:3348
                                                • C:\Windows\SysWOW64\sc.exe
                                                  "C:\Windows\system32\sc.exe" start TSSysKit
                                                  4⤵
                                                    PID:3380
                                                  • C:\Windows\SysWOW64\sc.exe
                                                    "C:\Windows\system32\sc.exe" start TsDefenseBt
                                                    4⤵
                                                      PID:3416
                                                    • C:\Windows\SysWOW64\sc.exe
                                                      "C:\Windows\system32\sc.exe" start QQPCRtp
                                                      4⤵
                                                        PID:3448
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        "C:\Windows\system32\sc.exe" start TSSysKit
                                                        4⤵
                                                          PID:3516
                                                        • C:\Windows\SysWOW64\sc.exe
                                                          "C:\Windows\system32\sc.exe" start TsDefenseBt
                                                          4⤵
                                                            PID:3548
                                                          • C:\Windows\SysWOW64\sc.exe
                                                            "C:\Windows\system32\sc.exe" start QQPCRtp
                                                            4⤵
                                                              PID:3576
                                                            • C:\Windows\SysWOW64\sc.exe
                                                              "C:\Windows\system32\sc.exe" start TSSysKit
                                                              4⤵
                                                                PID:3604
                                                              • C:\Windows\SysWOW64\sc.exe
                                                                "C:\Windows\system32\sc.exe" start TsDefenseBt
                                                                4⤵
                                                                  PID:3632
                                                                • C:\Windows\SysWOW64\sc.exe
                                                                  "C:\Windows\system32\sc.exe" start QQPCRtp
                                                                  4⤵
                                                                    PID:3660
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    "C:\Windows\system32\sc.exe" start TSSysKit
                                                                    4⤵
                                                                      PID:3688
                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                      "C:\Windows\system32\sc.exe" start TsDefenseBt
                                                                      4⤵
                                                                        PID:3720
                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                        "C:\Windows\system32\sc.exe" start QQPCRtp
                                                                        4⤵
                                                                          PID:3748
                                                                        • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCPatch.exe
                                                                          "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCPatch.exe"
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          • Drops file in Program Files directory
                                                                          PID:3808
                                                                    • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCTray.exe
                                                                      "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCTray.exe" /showui
                                                                      2⤵
                                                                      • Drops file in Drivers directory
                                                                      • Executes dropped EXE
                                                                      • Writes to the Master Boot Record (MBR)
                                                                      • Drops file in Program Files directory
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4068
                                                                      • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQRepair.exe
                                                                        "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQRepair.exe" /master
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Adds Run key to start application
                                                                        • Checks whether UAC is enabled
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3420
                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                          "C:\Windows\system32\sc.exe" start TSSysKit
                                                                          4⤵
                                                                            PID:3540
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            "C:\Windows\system32\sc.exe" start TsDefenseBt
                                                                            4⤵
                                                                              PID:3588
                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                              "C:\Windows\system32\sc.exe" start QQPCRtp
                                                                              4⤵
                                                                                PID:3624
                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                "C:\Windows\system32\sc.exe" start TSSysKit
                                                                                4⤵
                                                                                  PID:3648
                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                  "C:\Windows\system32\sc.exe" start TsDefenseBt
                                                                                  4⤵
                                                                                    PID:3636
                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                    "C:\Windows\system32\sc.exe" start QQPCRtp
                                                                                    4⤵
                                                                                      PID:3664
                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                      "C:\Windows\system32\sc.exe" start TSSysKit
                                                                                      4⤵
                                                                                        PID:3700
                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                        "C:\Windows\system32\sc.exe" start TsDefenseBt
                                                                                        4⤵
                                                                                          PID:3480
                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                          "C:\Windows\system32\sc.exe" start QQPCRtp
                                                                                          4⤵
                                                                                            PID:3744
                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                            "C:\Windows\system32\sc.exe" start TSSysKit
                                                                                            4⤵
                                                                                              PID:3764
                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                              "C:\Windows\system32\sc.exe" start TsDefenseBt
                                                                                              4⤵
                                                                                                PID:4016
                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                "C:\Windows\system32\sc.exe" start QQPCRtp
                                                                                                4⤵
                                                                                                  PID:3516
                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                  "C:\Windows\system32\sc.exe" start TSSysKit
                                                                                                  4⤵
                                                                                                    PID:3580
                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                    "C:\Windows\system32\sc.exe" start TsDefenseBt
                                                                                                    4⤵
                                                                                                      PID:3656
                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                      "C:\Windows\system32\sc.exe" start QQPCRtp
                                                                                                      4⤵
                                                                                                        PID:3680
                                                                                                      • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCPatch.exe
                                                                                                        "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCPatch.exe"
                                                                                                        4⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:3704
                                                                                                    • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCLeakScan.exe
                                                                                                      "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCLeakScan.exe" /start=desktop /hwnd=787024 /runtype=homepagestub /hwndContainer=787024
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:3012
                                                                                                • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMCheckNetwork.exe
                                                                                                  "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMCheckNetwork.exe" /AllChain
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:1836
                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                  \??\C:\Windows\system32\conhost.exe "-12210853051305108179-237369030-4294088231050619239-1212687173-8871700501146008866"
                                                                                                  1⤵
                                                                                                  • Modifies system executable filetype association
                                                                                                  • Modifies registry class
                                                                                                  PID:1096
                                                                                                • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCRtp.exe
                                                                                                  "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCRtp.exe" -r
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Adds Run key to start application
                                                                                                  • Writes to the Master Boot Record (MBR)
                                                                                                  • Drops file in System32 directory
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious behavior: LoadsDriver
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1512
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCTray.exe
                                                                                                    "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCTray.exe" /elevated /regrun
                                                                                                    2⤵
                                                                                                    • Drops file in Drivers directory
                                                                                                    • Executes dropped EXE
                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                    • Drops file in Program Files directory
                                                                                                    • Checks processor information in registry
                                                                                                    • Modifies Internet Explorer settings
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    • Modifies system certificate store
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious behavior: LoadsDriver
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                    • System policy modification
                                                                                                    PID:1352
                                                                                                    • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCRealTimeSpeedup.exe
                                                                                                      "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCRealTimeSpeedup.exe"
                                                                                                      3⤵
                                                                                                      • Drops file in Drivers directory
                                                                                                      • Executes dropped EXE
                                                                                                      • Checks whether UAC is enabled
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:2652
                                                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                      regsvr32.exe "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\TSWebMon64.dat" /s
                                                                                                      3⤵
                                                                                                        PID:2716
                                                                                                        • C:\Windows\system32\regsvr32.exe
                                                                                                          "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\TSWebMon64.dat" /s
                                                                                                          4⤵
                                                                                                          • Modifies registry class
                                                                                                          PID:2780
                                                                                                      • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\qmdl.exe
                                                                                                        "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\qmdl.exe"
                                                                                                        3⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:3092
                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                          "C:\Windows\System32\icacls.exe" C:\Users\Admin\AppData\Roaming\Tencent\Config\ /t /setintegritylevel low
                                                                                                          4⤵
                                                                                                          • Modifies file permissions
                                                                                                          PID:3228
                                                                                                      • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\Plugin\QMBlueScreenFixSetup_13.6.20672.243__1594805313978.exe
                                                                                                        "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\Plugin\QMBlueScreenFixSetup_13.6.20672.243__1594805313978.exe" /S
                                                                                                        3⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:3780
                                                                                                      • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\Plugin\QMRealTimeSpeedupSetup_13.6.20672.243__1594805313978.exe
                                                                                                        "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\Plugin\QMRealTimeSpeedupSetup_13.6.20672.243__1594805313978.exe" /S
                                                                                                        3⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:3852
                                                                                                    • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\VolSnapshotX64.exe
                                                                                                      "C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\VolSnapshotX64.exe" 00000003000000010501010000000000000205010000000000000003050150000000
                                                                                                      2⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:2976
                                                                                                  • C:\Windows\system32\vssvc.exe
                                                                                                    C:\Windows\system32\vssvc.exe
                                                                                                    1⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2152

                                                                                                  Network

                                                                                                  MITRE ATT&CK Matrix ATT&CK v6

                                                                                                  Initial Access

                                                                                                  Execution

                                                                                                  Persistence

                                                                                                  Change Default File Association

                                                                                                  1
                                                                                                  T1042

                                                                                                  Registry Run Keys / Startup Folder

                                                                                                  3
                                                                                                  T1060

                                                                                                  Browser Extensions

                                                                                                  1
                                                                                                  T1176

                                                                                                  Bootkit

                                                                                                  1
                                                                                                  T1067

                                                                                                  Privilege Escalation

                                                                                                  Defense Evasion

                                                                                                  Modify Registry

                                                                                                  7
                                                                                                  T1112

                                                                                                  Virtualization/Sandbox Evasion

                                                                                                  1
                                                                                                  T1497

                                                                                                  File Permissions Modification

                                                                                                  1
                                                                                                  T1222

                                                                                                  Install Root Certificate

                                                                                                  1
                                                                                                  T1130

                                                                                                  Credential Access

                                                                                                  Discovery

                                                                                                  Software Discovery

                                                                                                  1
                                                                                                  T1518

                                                                                                  Query Registry

                                                                                                  3
                                                                                                  T1012

                                                                                                  Virtualization/Sandbox Evasion

                                                                                                  1
                                                                                                  T1497

                                                                                                  System Information Discovery

                                                                                                  3
                                                                                                  T1082

                                                                                                  Lateral Movement

                                                                                                  Collection

                                                                                                  Exfiltration

                                                                                                  Command and Control

                                                                                                  Impact

                                                                                                  Replay Monitor

                                                                                                  Loading Replay Monitor...

                                                                                                  Downloads

                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\ClinicData\pic\Both_Disconnected.png
                                                                                                    MD5

                                                                                                    00ef699da2be626beb8957d69783cf45

                                                                                                    SHA1

                                                                                                    a381db99b4c39b6af39e39820adab2d38cb5ac18

                                                                                                    SHA256

                                                                                                    1efc1cdd056be89f2f37253f3845c99708fb6e60ab243179390996915c4be02b

                                                                                                    SHA512

                                                                                                    8ce2d3be5e9a00b5372c2640ebe3fc8dba492437964a5961b904cb978cea1284a9684d0ac2868e2052d677051023093332a09c9a675b0916b3468ee78929048d

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\ClinicData\pic\Check_Router.png
                                                                                                    MD5

                                                                                                    aa19bfbfedc591a531e1e6bd775f296b

                                                                                                    SHA1

                                                                                                    a93012d5ed23695c0c2701a4e7ceb430b55f741b

                                                                                                    SHA256

                                                                                                    fecd26a1fd8bca2f88a758c0df90bf8cb6d9476b61a89806ffb06399037eb502

                                                                                                    SHA512

                                                                                                    2223a33209c040fd96b13f7bce314116b410864dfa9f9a119271f01de4460c4f18935c6e6ae0cba78bf4399b7b926b8636796b52630122513244c73420bc0497

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\ClinicData\pic\Check_Wireless.png
                                                                                                    MD5

                                                                                                    752f6ed337ee1f8e8c944400757fa52f

                                                                                                    SHA1

                                                                                                    9237b59a2d0c9dc2ed06bb61e444ff5dae1027ba

                                                                                                    SHA256

                                                                                                    433c2f423344f967de20e933cc9134ad7b2fa3e669d144b620500946960b3ec1

                                                                                                    SHA512

                                                                                                    2945980632b15e3dbcc49b5c7342f81397f97e9862a841e21fb027d297c448ae70b7c36475fecc8de9ff6f698071d006cdcad98d5f6cd9de01d84f236641af02

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\174CFEBD82149B585C07A945C7A94AB6.png
                                                                                                    MD5

                                                                                                    174cfebd82149b585c07a945c7a94ab6

                                                                                                    SHA1

                                                                                                    991499483f23b1f4225475144f9aa8c9fede4cc9

                                                                                                    SHA256

                                                                                                    542b03ae170144603bc5ab52d47e9649aeb87df9d025743b21b6602bd3cf7250

                                                                                                    SHA512

                                                                                                    b961ce8878149c95d390230dbff6d6a45436e164094b8a4f57e95623c1d46b4663e57e5606c945547175514a66a5f3ea81f677878a04223d3f0da4ea8da228fc

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\30FF47F04BAD25FB17B32A76EADB240B.png
                                                                                                    MD5

                                                                                                    30ff47f04bad25fb17b32a76eadb240b

                                                                                                    SHA1

                                                                                                    e40ae4a17b71d27a0bad91b094f110db533a3f5e

                                                                                                    SHA256

                                                                                                    c54d8eda61ee3ef782cdcf77ad3a56f01df73200bd880b78a7034ae2dc42d178

                                                                                                    SHA512

                                                                                                    9076236acd816281fcd59c007c6f2c7b5f8de30cc560c8ffba77f287fe2299dc543aba8e26f503544ca1d76121c8ad12960762f6d890cd27d5e5a7f7f5988402

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\33EEE547ACCEC775CBD9D3FE34EADA49.png
                                                                                                    MD5

                                                                                                    33eee547accec775cbd9d3fe34eada49

                                                                                                    SHA1

                                                                                                    79bbcef6851ade8cd1c8bfc306cebc31891f7308

                                                                                                    SHA256

                                                                                                    d0e611a3cc8d039ba58db6bd8b7e3730fcf8a84570ffe271597390e9082cd4f9

                                                                                                    SHA512

                                                                                                    bf082db2cb3fcffccfa820760cdf6c7fcc995b33543b0a107b4d7198d694503e575673d6dbb8e7740cf8869bf173e9dcf2b09dbcccdcaa3c7fcd65bb74f2f1bb

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\518D8DC197284461A560F05A4D67F39E.png
                                                                                                    MD5

                                                                                                    518d8dc197284461a560f05a4d67f39e

                                                                                                    SHA1

                                                                                                    c47499885631f46840818f159c6ee5ecf44debc0

                                                                                                    SHA256

                                                                                                    2ee41da793d054eb2eb1459265d4ec61cef71523e416e10922bfd9391dc6fc79

                                                                                                    SHA512

                                                                                                    20b715e5465be878045a61ca343ed268c36545230540f319259d54c3c1ff44633a6f7c6f4a4cc10ce29ec197b9d5f9eb1d4458ac61653b4cf62c4cf3fcad9277

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\55A6E0FBB236D9876050466F65150A82.png
                                                                                                    MD5

                                                                                                    55a6e0fbb236d9876050466f65150a82

                                                                                                    SHA1

                                                                                                    ead1e125e09111b5b70456de224a98da65e02407

                                                                                                    SHA256

                                                                                                    69996ee525fc2993bede7e0246308fa434ad6a147fecfaea6ec2aef2502bdadc

                                                                                                    SHA512

                                                                                                    a78133876c3ac6ba0fcc52b53aa753bf6775f3c95144c08531ecab4b9abe746233f550b1a89c6d6eafe16f2263745486b536fdc27375246031463a4c8a61f48d

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\574A7650A7C42D9564DDC2F09318F994.png
                                                                                                    MD5

                                                                                                    574a7650a7c42d9564ddc2f09318f994

                                                                                                    SHA1

                                                                                                    b9a2f0b8c0ffeb40330b150cc9fd984134b2d313

                                                                                                    SHA256

                                                                                                    3be907261254d9bc5db4abe8c1daccf84c24270bc796c5cf6f35549de73b4b9f

                                                                                                    SHA512

                                                                                                    0b211e43fe7f382b1187750c45a3179ed6916b15e301acf45380353614ca9e3b8408d7526c7255cf4307fcc05aa34e29ff5e8c20026e2aa020632b843aa0c9a2

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\5963F88CAC90027875B790F084AB2F50.png
                                                                                                    MD5

                                                                                                    5963f88cac90027875b790f084ab2f50

                                                                                                    SHA1

                                                                                                    139aa8c85aff31dacceb01127a838f343d9fdacb

                                                                                                    SHA256

                                                                                                    d34ad7b5cd5cf5506d4ef40a1691948e6782a659fed89224676cee30f65a1e68

                                                                                                    SHA512

                                                                                                    fca239f4d5d3165461d6160e6ab1a8c4400a4e01319db9781f09156dd7eca84d987f6227a94dff8342b62dd341abdb85527597409ea5bb779c8bf16b10fe994f

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\67A80AD380340715C89E6A7839079A56.png
                                                                                                    MD5

                                                                                                    67a80ad380340715c89e6a7839079a56

                                                                                                    SHA1

                                                                                                    8faec70622bbbc684e33e8bc7b47d9b28ff39fa6

                                                                                                    SHA256

                                                                                                    9515c45e831d0f41478b526248c072977b726ccca753db27d11800bcf9e43104

                                                                                                    SHA512

                                                                                                    495045ab4b0489946219f48350cd28e531e7fe205f2c93c24aab4b469c5e86cc1f31c679f4657b2a0c834897fcbf3595153dd396c3791dd70fb08176160f80b4

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\6C89F1E0D917E59F1F6508EC4B8F4020.png
                                                                                                    MD5

                                                                                                    6c89f1e0d917e59f1f6508ec4b8f4020

                                                                                                    SHA1

                                                                                                    6781f40633d001a9ce0a1de5aad0d41124f486b0

                                                                                                    SHA256

                                                                                                    c082d7bf27352014ca026a94829497690af8d693facddd8a48f057715b6bfef8

                                                                                                    SHA512

                                                                                                    ef2da06fa8b283354aceebdf8395f1831696b591783634498e8ec1fcce70921d3aac52f8040ba972e09747dfa8f7c5fdaeaaf7913215cf1cba352377d136d97c

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\6F41F4914A42AE92A487D6C8266A00D2.png
                                                                                                    MD5

                                                                                                    6f41f4914a42ae92a487d6c8266a00d2

                                                                                                    SHA1

                                                                                                    0689d4af84eaf48db145cd84324ba139da60e5b0

                                                                                                    SHA256

                                                                                                    5494de5204ccd8679aa6bbf47336895b77ee7ee41678f6eb94446f0442e37d60

                                                                                                    SHA512

                                                                                                    dbb140fa6082b3d0e372d506961f4f77275d1524dc8e6875ad9e125525ef994f7075ef24b45cd6800c239f8c294431f5e7e66da379a3437dfdc74cdbe603b504

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\75470F0D685F3B8240A5CBF5E20434BC.png
                                                                                                    MD5

                                                                                                    75470f0d685f3b8240a5cbf5e20434bc

                                                                                                    SHA1

                                                                                                    1fa9845e0c9f06294f00114c74db7949459af778

                                                                                                    SHA256

                                                                                                    ed938e0a94f550ca0e69dd37bb9f1f0c7223cdaafb6a5ba52bdb27d34f6e4ddc

                                                                                                    SHA512

                                                                                                    1c85fec104a1a5ae5584b500ff191c33451529786eb4b04014d7449a66cde0d4eba638e3c2a3a022adfc23be099c4fa89c44d2b57692ae38990c14c36d61cb81

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\858FBD4B558F0E5AD8FF38489EDB4434.png
                                                                                                    MD5

                                                                                                    858fbd4b558f0e5ad8ff38489edb4434

                                                                                                    SHA1

                                                                                                    c387cadca2fe2800008fc5688beb65954df9171f

                                                                                                    SHA256

                                                                                                    5afe9c09459804b3d478302140bb078c48011c2e1380949df5b42bfb434745d3

                                                                                                    SHA512

                                                                                                    b5b4eb18960568cf69c5ed522bee1dba9dae7307b99b018d2ddcca3b8fd1171f1aa9318c12e42900bce964813912645a65eb5eabc5369629fe7850463038e64b

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\98756B2953BB5BD65CF206154E47CF96.png
                                                                                                    MD5

                                                                                                    98756b2953bb5bd65cf206154e47cf96

                                                                                                    SHA1

                                                                                                    89785cfa73221ae120ddaf4aff78d65cf15cc7df

                                                                                                    SHA256

                                                                                                    b64286991d5a6ffcf5dc28d6935858e39cf63ebfb5586aaa703df87be60791b3

                                                                                                    SHA512

                                                                                                    5ed65569a7d33227eae4f82ecfb9f3db89e7a4b371ba52e3fb739ca2d27440644cc90fdeda29daf4fc2f61175f1e0d48937e6e86a5414d2bc01dec3bbfdc7b19

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\98B357546E6446308A46CC818071F1A2.png
                                                                                                    MD5

                                                                                                    98b357546e6446308a46cc818071f1a2

                                                                                                    SHA1

                                                                                                    02414d2b40733d351a61a88ca593de3c27da36c3

                                                                                                    SHA256

                                                                                                    15521c05470a9bb5688f375f866cfb92722c9e099e8160031ca7bba33f9ec19d

                                                                                                    SHA512

                                                                                                    2476c18cc08e9c46abbaf6eee480bc2287495ae6a7401ba0fca7368e734256562f65cc438c9ac6e7246925ac9eac3b95a5cb423fc132da2a5f3847066a208d4f

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\98FBBCD596E587F39275FD127B3BC772.png
                                                                                                    MD5

                                                                                                    98fbbcd596e587f39275fd127b3bc772

                                                                                                    SHA1

                                                                                                    18dd3f4759a042b85178b0f11fc9876bac495f8f

                                                                                                    SHA256

                                                                                                    d8261dd59bb488fd88c326b8229f58cb97d54f8fb289c069e697aedd716d29ba

                                                                                                    SHA512

                                                                                                    2622b10af8e6a4a47acbc2dfa1a326e8efaa465395d6c8705f2b2b881dafdbf903ecbb8aa957373636f1c6e3a48744a3b870b2b1f6de356c356f4afac6dc0e2e

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\992D6B931FC570214F4A06152FF7B6F9.png
                                                                                                    MD5

                                                                                                    992d6b931fc570214f4a06152ff7b6f9

                                                                                                    SHA1

                                                                                                    ec3c4b94cffaf19cacf92a6399989919115e0a7d

                                                                                                    SHA256

                                                                                                    b311a858bf773354c019ed7322af14e0322673c656955ff7fce727130a047bda

                                                                                                    SHA512

                                                                                                    b599bc19831644bd1c96f819b3a8011ece78f926629f5fa87c136879dc3d9d10efd94ea47cdde0a061f0db9f83913a113b3a072643c075f0b551cb95ae7cbdd8

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\9D6C00A64695C74D3963715E2189124E.png
                                                                                                    MD5

                                                                                                    9d6c00a64695c74d3963715e2189124e

                                                                                                    SHA1

                                                                                                    f5c95ae62abed2b8487011eeab67aa107b5704fb

                                                                                                    SHA256

                                                                                                    04219886a42560177a86391c108aef621044aa34233c3421a87a8f0aa0217f92

                                                                                                    SHA512

                                                                                                    1edc3d624ae9b2b5eb32130abe8bb4053e1e5131dc1c7c12a9d9244d335f23dddb861c59b62cdb6a73cb9d67d69b094487e4f1aeb3a895274cc9a6959a3c6a83

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\A9F6A4D231496119A95ED90CFDE77021.png
                                                                                                    MD5

                                                                                                    a9f6a4d231496119a95ed90cfde77021

                                                                                                    SHA1

                                                                                                    45814350e647e71f417ff6eaccc586327f2f61f9

                                                                                                    SHA256

                                                                                                    0b6bfe7c30f504f6afd9ae28ac0f2e4fcc58f89ebb7fb299c917666f7af82e9d

                                                                                                    SHA512

                                                                                                    c8f7de4d40cd1e1c54f90dfde9d30d199d74061a759e1c7262a5a68e89db300ce1675d6610099103ccb309da432223fd3343ab4838c88488c25d67c15ee2d20a

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\ABB57EDD592C6DC7158188880CC24F80.png
                                                                                                    MD5

                                                                                                    abb57edd592c6dc7158188880cc24f80

                                                                                                    SHA1

                                                                                                    be703a0cc146eaf52504c70ebe7e5b11289b998f

                                                                                                    SHA256

                                                                                                    ac98b4fafc3cec42c52b803aa600e20b87a7b62d69720e50992bfcb1f68c9fb0

                                                                                                    SHA512

                                                                                                    8e0deb5122eab44d3f24a8448449e3142f7702495bc9c6627a1d480e78f9913ada19edadd86b7da68f27c6b7a53e545c2feede7a081f16b5ed2b150984afb1ab

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\DefaultSkin\DB377F81C4E4BF04554D8828CD33135F.png
                                                                                                    MD5

                                                                                                    db377f81c4e4bf04554d8828cd33135f

                                                                                                    SHA1

                                                                                                    19f2af6d65f537e06d18518fe60d1576a38f14c4

                                                                                                    SHA256

                                                                                                    f7ab59c19680c56107e5f61b809e56802b9f4385343087ddb83ffd748681d8be

                                                                                                    SHA512

                                                                                                    0574de86297632e5500fc13336e4db4f507b18e9450aff7f56830a6fda8c593d0f6d73bcb8a390b282ff780a918ec5f42a86d09b3f18a4ca7413e905293cb7a5

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\GF.dll
                                                                                                    MD5

                                                                                                    a288386bce7648101bcde13120496d8d

                                                                                                    SHA1

                                                                                                    323d85a2c66d38ae40aefd31a757290bbd555945

                                                                                                    SHA256

                                                                                                    bf10ac5e50aead363bed3e9e6c91ca90cddf2ae4e5014c16c1d81afa9c494c83

                                                                                                    SHA512

                                                                                                    7a55b05eae19b4d23a8b73848c1bbaccebcf28cdc1286a080b7175295c5f3e0c499b921762bc8f9973442bfe5c0a0a1692c1ce481a8d986d53e26d242ce854f0

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMBluerayInsHlp.exe
                                                                                                    MD5

                                                                                                    a8dc7bfce96b82fde777a21a76ccc9ba

                                                                                                    SHA1

                                                                                                    0f512385c2407d5a9054cdf97c0ca318727e2017

                                                                                                    SHA256

                                                                                                    6578d20118f089c46a77a4ea9074ac42a59562cfc3729064bcebbe4031ce8d27

                                                                                                    SHA512

                                                                                                    49d6f2d0aafd5579fed33eb7b7dbe20f94949cd1153d2cb5775acea491eb944aaee865eabea4c013dc1bdd40ad002a3858296f4b634f3d5845af910b65cf5e37

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMBluerayInsHlpx64.exe
                                                                                                    MD5

                                                                                                    ff80258f3d91837e1f78945cfacc4741

                                                                                                    SHA1

                                                                                                    5d2ceadaa81c9831b6463521619ee216d2b6ceca

                                                                                                    SHA256

                                                                                                    d125a26c7b1399e826bbcb9d2a620579ebaa36aa52b8816448648f7b0b4357ba

                                                                                                    SHA512

                                                                                                    59dbcdbc4a527ca92822e7d62530a9968d506e31385db6d97dce3f8733c03063947a502160adec29a11503613f9a44f6c0775624e559e75d8af07fb2b7a43333

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMGCShellExt64.dll
                                                                                                    MD5

                                                                                                    95fb8f5601905939ffbb92fd072b0c5d

                                                                                                    SHA1

                                                                                                    1c5f274ae91bb8d0d9fa5a822303c3c5865974d3

                                                                                                    SHA256

                                                                                                    e7f98599aee8e9367a170cc095f0daecba89592e2e0345a708f24a8b25be4e19

                                                                                                    SHA512

                                                                                                    15d2f4048014a7d78ac6da70ee1994d4e2efd6de5a507792630a75e840fe9ca6e497047e1509450e7a2451cd3cbf3835cce107b3dfd928dc329d547566b32f2e

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMLogEx.dll
                                                                                                    MD5

                                                                                                    b6ded7a3f8c665bf7b412ed5ac4afa8f

                                                                                                    SHA1

                                                                                                    22f1a80e9016dad80f6a5fd15cf6f7edff388bba

                                                                                                    SHA256

                                                                                                    9103a37e398c21bc55e46426322b00e7fec3753fc309006183d014f617c0053e

                                                                                                    SHA512

                                                                                                    0a09dd5a975692bd258da07053fb423b31d6f2a5d4b81a080dab8643bf5f3eebdf93b160c7effc9d25ceab35df0964f60a34e51cea1728b6dc314921aab84639

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMRealTimeSpeedupSkinCenter.zip
                                                                                                    MD5

                                                                                                    10e324f3650b35d8df841b5ec13018b0

                                                                                                    SHA1

                                                                                                    a1603383a45a8b0aaae803cc1f3161712124e186

                                                                                                    SHA256

                                                                                                    9dacf24bd588681415187d8bd173023cf5e2b8ec55ead1cb9ce74877bfeabb2e

                                                                                                    SHA512

                                                                                                    6a2169859fa6116b3aea67fdbcce4bfe9b226165d738f18bb2ff37f421566a0505271c66cb0dec64bf089e41e7823b2e00d5593d403dfef2d34e7cfd1feee495

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCSoftCmd.exe
                                                                                                    MD5

                                                                                                    d210e07048b53ca5cc665ba2104bba02

                                                                                                    SHA1

                                                                                                    b967b394a4c3be24613012076fadfcd60219d11b

                                                                                                    SHA256

                                                                                                    8e53a548b6ad1dc37ecfe2be1895fe10af487025d75cccd7393848039b531bc8

                                                                                                    SHA512

                                                                                                    13e662915a22b7592c59b848bf61bd9d73fbe68570c3c68e651ad25a001bbf3abc790757b22fc76bdd425e68f572e0706c71ddce14c57e3d0d804aea6534c17c

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\apps\BusinessInfo\res\business1_bkg.png
                                                                                                    MD5

                                                                                                    0b17268f47145b80380d887b00d60708

                                                                                                    SHA1

                                                                                                    d2e605dd314dd0c6076378b2a22a1fa53bca6f33

                                                                                                    SHA256

                                                                                                    a239f9bbafd79d24a65d5c38eb3d286ce6a3ab958f3210b36cd3ed0034360d9b

                                                                                                    SHA512

                                                                                                    8741f100d0b4b9fb4e41f323d4aa8247e7f8387b59f7b080e0d465019bf2c8be25a4d98d186d105296600562039f0f87c8c4f10be9a4304072abf3b1fe3938fe

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\apps\BusinessInfo\res\business2_bkg.png
                                                                                                    MD5

                                                                                                    bf69d3ed4a10c1459c87e321a7b1954a

                                                                                                    SHA1

                                                                                                    7ec754a6585d4cfdddaa158b06577875001dd643

                                                                                                    SHA256

                                                                                                    f1ffee9b85a18eb32e672d6978c6b207b6fc2e4069a30c9260aa08d50f74af67

                                                                                                    SHA512

                                                                                                    e5b356cc5abcefb40a9cf1fea72ed556849ebcf42418b09ddba7eaa7b29f87b7284294d969e638fd1b73b2b3578c7261900cb0a6e1d70f7c99f2f3c47d98103d

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\apps\BusinessInfo\res\business3_bkg.png
                                                                                                    MD5

                                                                                                    e985346b6202b2e47aebab7984704df5

                                                                                                    SHA1

                                                                                                    19a08f12412de93929701c630017159ecbbf0186

                                                                                                    SHA256

                                                                                                    e7d9811d5532c3cfeb631bf9c7fdecfb41ad1adcd92e91ad3177cfd581a102c0

                                                                                                    SHA512

                                                                                                    66f6a7810f857afc035a5341ef0243850975b2812720ebdacc9469ddcf810f02d60002b0fd0c8346bceab9230de00accbdb98a0735bc2f71071c73faab8d86a8

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\apps\Logo\Anyun3killer.png
                                                                                                    MD5

                                                                                                    01c6fccd8173e4298bed38b168c74e79

                                                                                                    SHA1

                                                                                                    ef1ce6a0564c5f292cd1daf59df258ccd10a4a9b

                                                                                                    SHA256

                                                                                                    9a723d7b8d569764947c849643babd7051368697d881894d54437f46da088ecc

                                                                                                    SHA512

                                                                                                    5a15c3eff14052d745c0aadc5fcb104f033a852651bc020654dc3e3d90e933851666ab7f32c937995f1c7c705e3ad30d2f5a43f704028f1cfee3b0c9550ef67f

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\apps\Logo\AppMarketPlugin.png
                                                                                                    MD5

                                                                                                    8d6e585aed5e0b9557901f2106fa6b55

                                                                                                    SHA1

                                                                                                    ed148aef3f5e8808dd33436f50a8fc131352217e

                                                                                                    SHA256

                                                                                                    35aee7196e14e414938fff76615882f3d8d2ddcaf3dc8a5ce7af83bd5b7b8137

                                                                                                    SHA512

                                                                                                    08b5a56766181f8802f54a45635dffa15762ce2719a8a53000bef1c4c126cc1c910e8f00d2e51369e6431e2b7a8ebf90f82fcb20e857d2a43e2685931bb4ee66

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\gjddFlowAS
                                                                                                    MD5

                                                                                                    77c524427249e3428aa92b04df1dff36

                                                                                                    SHA1

                                                                                                    6a3e8c096d7fdb515a5ef13aa54d624526c181f7

                                                                                                    SHA256

                                                                                                    8c14d4eee6b31aef7d69f4b6f7d25ce5e806e4dff43fa625aa97031895cd92d2

                                                                                                    SHA512

                                                                                                    e59d11abc625c77ac2852a94b9ce38d445245910898e78ead627d024275990461a476d2fc7da7a82ad911845c7eb30d3f1cb15a0084c2efc7329c49a51a4b4ab

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\qbclient\locales\en-US.pak
                                                                                                    MD5

                                                                                                    a1cb9e27ee2669a1db86cd8fe77b3ad4

                                                                                                    SHA1

                                                                                                    c8767540dbfe334cb9cdde1e94014396ea8edf7e

                                                                                                    SHA256

                                                                                                    08b5b82e2dace1588724c3b94764ed28ffe55de058a1d47d46813f4d18b76274

                                                                                                    SHA512

                                                                                                    0778ce300631d6b35e9a036f9f3197a3816c8bc0cbd34dbf4d532f130a0e8efc76da318fddcbd6a9995c7a6813169d23aff762b9f516996a8d411dd4badb6871

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\qbclient\locales\zh-CN.pak
                                                                                                    MD5

                                                                                                    209d0123654178004247d355409824af

                                                                                                    SHA1

                                                                                                    cc896bf5f4d88d80fea89c2f623c8436932bffe3

                                                                                                    SHA256

                                                                                                    c893f1eab716005a5aece4ab73c4311d4063688aefb64d2c3ff42a306b59e453

                                                                                                    SHA512

                                                                                                    0704349d34c5760d0f6211594dd3b76368c40e7e878d27930c77cd9edf9ab02962eab17e5efbae7791dad5d62c344d47b176cb090adc9edf15ecd411addd5e1f

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\qbclient\qb.pak
                                                                                                    MD5

                                                                                                    e4ec2b884bee4f0551b6feeb517b1e30

                                                                                                    SHA1

                                                                                                    9a090ab1932e6d6545a4d481a3db21d477fcbe56

                                                                                                    SHA256

                                                                                                    49559ccddf12544a97844fe36778603f368e3c575b7fc20983d8c945938c6e49

                                                                                                    SHA512

                                                                                                    6a9e85b961d0476dc6dfb82e5a9b22a2d2d5e12b8eca8937de5ec0420f593f90aced060c47f1ebc650599f5ec8290963273e998b24bbe6f6a13c3025d9fdab50

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\qbclient\qb_100_percent.pak
                                                                                                    MD5

                                                                                                    3434db08d3a1765a89ec8961902e3671

                                                                                                    SHA1

                                                                                                    32820e5e9cca80bb8168bb4df4847c8e093c9b9f

                                                                                                    SHA256

                                                                                                    4d35a90ad81b36a8dc8b782db67ade2e452ca0934cef9277f8524d4e1016c62b

                                                                                                    SHA512

                                                                                                    796f01dbbb6c88ba1fd5518869b1d3eea48d37d81985d5dcc4a91e1af0c8132cec786326f64edee0a37aff0d2a0ad8864841cd8a8aeede499bc70f7b18c2aa6e

                                                                                                    Download Submit
                                                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\qbclient\qb_200_percent.pak
                                                                                                    MD5

                                                                                                    f4c0754bfa9725051b9c77a75f8bf3af

                                                                                                    SHA1

                                                                                                    0e552bc73673ec33d75a334689a3e71179361532

                                                                                                    SHA256

                                                                                                    f1f5643b7b91d04c0826327f8e94104d1b8200d7fede14b0ec2d58bf91e0e331

                                                                                                    SHA512

                                                                                                    b5f0b19bd51cb411df2d75c326c16ce554e5edb26fb6aebb76724863a4c260006d0b29acff64b46a08d0387d19714eaa1a9688d0155a1fa94ccf3630cc9049e9

                                                                                                    Download Submit
                                                                                                  • C:\Users\Admin\AppData\Roaming\Tencent\DeskUpdate\GlobalMgr.db
                                                                                                    MD5

                                                                                                    cf7e71ed80cc5c32dbeb92ae0a852088

                                                                                                    SHA1

                                                                                                    c1c712dcf7f8692d1ba5cd3de13624a746d5f065

                                                                                                    SHA256

                                                                                                    37be15583d51f3bac41546c88292207386832c971a7ce63d6e65ca5a69fbb513

                                                                                                    SHA512

                                                                                                    2f09aa296633a7074d05bdfe1f09ab20189d7ddf45bc97ca84eab22e864cc6c8dc4dd051536cebe92d27642335b598305949ad785a66cc86609b4a96d79c5c11

                                                                                                    Download Submit
                                                                                                  • C:\Users\Admin\AppData\Roaming\Tencent\QQPCMgr\Download\QQPCMgr_Setup.exe
                                                                                                    MD5

                                                                                                    3efe337c046834114a5b907387541e79

                                                                                                    SHA1

                                                                                                    8d3e67228db1ab0cf77de409546cf056a6dfb97b

                                                                                                    SHA256

                                                                                                    cd6a75706684e2365fad82397bcb711f87e1f4b6899539fa4b6ee28e1dca150c

                                                                                                    SHA512

                                                                                                    c2ab461ffba1b4855b00ba56f82abd88970c6484df257e5f2eb3270afea19dc89b3ae7e233e84044e6cc04b24fe5ae7bf83749653819199264b5b124bdf7a4a4

                                                                                                    Download Submit
                                                                                                  • C:\Users\Admin\AppData\Roaming\tencent\QQPCMgr\Download\QQPCMgr_Setup.exe
                                                                                                    MD5

                                                                                                    3efe337c046834114a5b907387541e79

                                                                                                    SHA1

                                                                                                    8d3e67228db1ab0cf77de409546cf056a6dfb97b

                                                                                                    SHA256

                                                                                                    cd6a75706684e2365fad82397bcb711f87e1f4b6899539fa4b6ee28e1dca150c

                                                                                                    SHA512

                                                                                                    c2ab461ffba1b4855b00ba56f82abd88970c6484df257e5f2eb3270afea19dc89b3ae7e233e84044e6cc04b24fe5ae7bf83749653819199264b5b124bdf7a4a4

                                                                                                    Download Submit
                                                                                                  • C:\Windows\SysWOW64\MSVCP140.dll
                                                                                                    MD5

                                                                                                    cfbdf284c12056347e6773cb3949fbba

                                                                                                    SHA1

                                                                                                    ad3fa5fbbc4296d4a901ea94460762faf3d6a2b8

                                                                                                    SHA256

                                                                                                    bbecdfda2551b01aa16005c88305982c360a9fb9ba3d9be2fb15f2e9c6eb809f

                                                                                                    SHA512

                                                                                                    2f24eac94d51f8f28c8e6b6234ca2e481e0f8f1a73df62766ff4f5640480377fb2c4a469babedb87d303503994b469e570aaf725e16da6f9b2d6a77f15b4623f

                                                                                                    Download Submit
                                                                                                  • C:\Windows\SysWOW64\VCRUNTIME140.dll
                                                                                                    MD5

                                                                                                    8e65e033799eb9fd46bc5c184e7d1b85

                                                                                                    SHA1

                                                                                                    e1cc5313be1f7df4c43697f8f701305585fe4e71

                                                                                                    SHA256

                                                                                                    be38a38e22128af9a529af33d1f02dd24b2a344d29175939e229cf3a280673e4

                                                                                                    SHA512

                                                                                                    e0207fe2c327e7a66c42f23b3cbabc771d3819275dc970a9fa82d7af5f26606685644b8ea511f87ec511eb3a086a9506adec96c01c1b80b788c253bd0d459fbd

                                                                                                    Download Submit
                                                                                                  • C:\Windows\system32\MSVCP140.dll
                                                                                                    MD5

                                                                                                    b9abe16b723ddd90fc612d0ddb0f7ab4

                                                                                                    SHA1

                                                                                                    b323de242f21f39cf1cca4198ba1abb52e6aa0fb

                                                                                                    SHA256

                                                                                                    75fc76655631a4ae72d015b8e85f899537c603661ca35a3f29099b8e4c84716c

                                                                                                    SHA512

                                                                                                    2a66bddb9b6768419c6baacbf8bb19cda5662f5b1a1a3ca760b1d9d7ea7d65d19c29f48b7621362107eef819d692f1d2a55a6d7d0217ecea91eb6e150f6ab646

                                                                                                    Download Submit
                                                                                                  • C:\Windows\system32\VCRUNTIME140.dll
                                                                                                    MD5

                                                                                                    238dae6c4bb494893d01b99f6effdb93

                                                                                                    SHA1

                                                                                                    b3c96c7187191a70c0088641542dec48bf4b5baf

                                                                                                    SHA256

                                                                                                    da9d322ab2d891a83312f194e70060b1e2d1e6ecd87a4cff5a8f727453c1c4b8

                                                                                                    SHA512

                                                                                                    01b3f320feae9bcf3f540ac369515ea73249ba39630c117127ff9d0de6307f5d062246b799e48627c9735a80b9a4e0a2f7f293df187ba607d91a6ae64796cd64

                                                                                                    Download Submit
                                                                                                  • \Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\GF.dll
                                                                                                    MD5

                                                                                                    a288386bce7648101bcde13120496d8d

                                                                                                    SHA1

                                                                                                    323d85a2c66d38ae40aefd31a757290bbd555945

                                                                                                    SHA256

                                                                                                    bf10ac5e50aead363bed3e9e6c91ca90cddf2ae4e5014c16c1d81afa9c494c83

                                                                                                    SHA512

                                                                                                    7a55b05eae19b4d23a8b73848c1bbaccebcf28cdc1286a080b7175295c5f3e0c499b921762bc8f9973442bfe5c0a0a1692c1ce481a8d986d53e26d242ce854f0

                                                                                                    Download Submit
                                                                                                  • \Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMBluerayInsHlp.exe
                                                                                                    MD5

                                                                                                    a8dc7bfce96b82fde777a21a76ccc9ba

                                                                                                    SHA1

                                                                                                    0f512385c2407d5a9054cdf97c0ca318727e2017

                                                                                                    SHA256

                                                                                                    6578d20118f089c46a77a4ea9074ac42a59562cfc3729064bcebbe4031ce8d27

                                                                                                    SHA512

                                                                                                    49d6f2d0aafd5579fed33eb7b7dbe20f94949cd1153d2cb5775acea491eb944aaee865eabea4c013dc1bdd40ad002a3858296f4b634f3d5845af910b65cf5e37

                                                                                                    Download Submit
                                                                                                  • \Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMBluerayInsHlpx64.exe
                                                                                                    MD5

                                                                                                    ff80258f3d91837e1f78945cfacc4741

                                                                                                    SHA1

                                                                                                    5d2ceadaa81c9831b6463521619ee216d2b6ceca

                                                                                                    SHA256

                                                                                                    d125a26c7b1399e826bbcb9d2a620579ebaa36aa52b8816448648f7b0b4357ba

                                                                                                    SHA512

                                                                                                    59dbcdbc4a527ca92822e7d62530a9968d506e31385db6d97dce3f8733c03063947a502160adec29a11503613f9a44f6c0775624e559e75d8af07fb2b7a43333

                                                                                                    Download Submit
                                                                                                  • \Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMGCShellExt64.dll
                                                                                                    MD5

                                                                                                    95fb8f5601905939ffbb92fd072b0c5d

                                                                                                    SHA1

                                                                                                    1c5f274ae91bb8d0d9fa5a822303c3c5865974d3

                                                                                                    SHA256

                                                                                                    e7f98599aee8e9367a170cc095f0daecba89592e2e0345a708f24a8b25be4e19

                                                                                                    SHA512

                                                                                                    15d2f4048014a7d78ac6da70ee1994d4e2efd6de5a507792630a75e840fe9ca6e497047e1509450e7a2451cd3cbf3835cce107b3dfd928dc329d547566b32f2e

                                                                                                    Download Submit
                                                                                                  • \Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMGCShellExt64.dll
                                                                                                    MD5

                                                                                                    95fb8f5601905939ffbb92fd072b0c5d

                                                                                                    SHA1

                                                                                                    1c5f274ae91bb8d0d9fa5a822303c3c5865974d3

                                                                                                    SHA256

                                                                                                    e7f98599aee8e9367a170cc095f0daecba89592e2e0345a708f24a8b25be4e19

                                                                                                    SHA512

                                                                                                    15d2f4048014a7d78ac6da70ee1994d4e2efd6de5a507792630a75e840fe9ca6e497047e1509450e7a2451cd3cbf3835cce107b3dfd928dc329d547566b32f2e

                                                                                                    Download Submit
                                                                                                  • \Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMLogEx.dll
                                                                                                    MD5

                                                                                                    b6ded7a3f8c665bf7b412ed5ac4afa8f

                                                                                                    SHA1

                                                                                                    22f1a80e9016dad80f6a5fd15cf6f7edff388bba

                                                                                                    SHA256

                                                                                                    9103a37e398c21bc55e46426322b00e7fec3753fc309006183d014f617c0053e

                                                                                                    SHA512

                                                                                                    0a09dd5a975692bd258da07053fb423b31d6f2a5d4b81a080dab8643bf5f3eebdf93b160c7effc9d25ceab35df0964f60a34e51cea1728b6dc314921aab84639

                                                                                                    Download Submit
                                                                                                  • \Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QMLogEx64.dll
                                                                                                    MD5

                                                                                                    79d9ac3881a501f8db844f8a2465b406

                                                                                                    SHA1

                                                                                                    6031e13c9e475bde0e04cf8dd0b89afea1c28099

                                                                                                    SHA256

                                                                                                    d88dd8197a8df6d328254f4611dc87f32ec4e8d813af32d9f41c4d841856650a

                                                                                                    SHA512

                                                                                                    7697a1a085eb7f69dc9a00c1916fa425eb893bc965027a2e0dc59ad2b3f32f88dbaf4f6a04717112d40250343ed31f732ec1a72fbc581da057249ee3e9df77f1

                                                                                                    Download Submit
                                                                                                  • \Program Files (x86)\Tencent\QQPCMgr\13.6.20672.243\QQPCSoftCmd.exe
                                                                                                    MD5

                                                                                                    d210e07048b53ca5cc665ba2104bba02

                                                                                                    SHA1

                                                                                                    b967b394a4c3be24613012076fadfcd60219d11b

                                                                                                    SHA256

                                                                                                    8e53a548b6ad1dc37ecfe2be1895fe10af487025d75cccd7393848039b531bc8

                                                                                                    SHA512

                                                                                                    13e662915a22b7592c59b848bf61bd9d73fbe68570c3c68e651ad25a001bbf3abc790757b22fc76bdd425e68f572e0706c71ddce14c57e3d0d804aea6534c17c

                                                                                                    Download Submit
                                                                                                  • \Users\Admin\AppData\Local\Temp\TencentDownload\~f74f9ca\QQPCDownload.dll
                                                                                                    MD5

                                                                                                    aa142942435b567595a71eb4eb402579

                                                                                                    SHA1

                                                                                                    790ed6f6e5016b8873ce1817bcc96024a0e768de

                                                                                                    SHA256

                                                                                                    73a934147b27437f91517ed9ed7eb20fb54e222a1bf2047f201ac668455c0f1e

                                                                                                    SHA512

                                                                                                    e8a9d760bfac910500a56aea8e3849bc3e73c3a0065557dc1da2495d785ba58c428a168a97faebfaa638aa3e285e7141f3937156dc1d26caad1792929dba8708

                                                                                                    Download Submit
                                                                                                  • \Users\Admin\AppData\Roaming\Tencent\QQPCMgr\Download\QQPCMgr_Setup.exe
                                                                                                    MD5

                                                                                                    3efe337c046834114a5b907387541e79

                                                                                                    SHA1

                                                                                                    8d3e67228db1ab0cf77de409546cf056a6dfb97b

                                                                                                    SHA256

                                                                                                    cd6a75706684e2365fad82397bcb711f87e1f4b6899539fa4b6ee28e1dca150c

                                                                                                    SHA512

                                                                                                    c2ab461ffba1b4855b00ba56f82abd88970c6484df257e5f2eb3270afea19dc89b3ae7e233e84044e6cc04b24fe5ae7bf83749653819199264b5b124bdf7a4a4

                                                                                                    Download Submit
                                                                                                  • \Windows\SysWOW64\msvcp140.dll
                                                                                                    MD5

                                                                                                    cfbdf284c12056347e6773cb3949fbba

                                                                                                    SHA1

                                                                                                    ad3fa5fbbc4296d4a901ea94460762faf3d6a2b8

                                                                                                    SHA256

                                                                                                    bbecdfda2551b01aa16005c88305982c360a9fb9ba3d9be2fb15f2e9c6eb809f

                                                                                                    SHA512

                                                                                                    2f24eac94d51f8f28c8e6b6234ca2e481e0f8f1a73df62766ff4f5640480377fb2c4a469babedb87d303503994b469e570aaf725e16da6f9b2d6a77f15b4623f

                                                                                                    Download Submit
                                                                                                  • \Windows\SysWOW64\vcruntime140.dll
                                                                                                    MD5

                                                                                                    8e65e033799eb9fd46bc5c184e7d1b85

                                                                                                    SHA1

                                                                                                    e1cc5313be1f7df4c43697f8f701305585fe4e71

                                                                                                    SHA256

                                                                                                    be38a38e22128af9a529af33d1f02dd24b2a344d29175939e229cf3a280673e4

                                                                                                    SHA512

                                                                                                    e0207fe2c327e7a66c42f23b3cbabc771d3819275dc970a9fa82d7af5f26606685644b8ea511f87ec511eb3a086a9506adec96c01c1b80b788c253bd0d459fbd

                                                                                                    Download Submit
                                                                                                  • \Windows\System32\msvcp140.dll
                                                                                                    MD5

                                                                                                    b9abe16b723ddd90fc612d0ddb0f7ab4

                                                                                                    SHA1

                                                                                                    b323de242f21f39cf1cca4198ba1abb52e6aa0fb

                                                                                                    SHA256

                                                                                                    75fc76655631a4ae72d015b8e85f899537c603661ca35a3f29099b8e4c84716c

                                                                                                    SHA512

                                                                                                    2a66bddb9b6768419c6baacbf8bb19cda5662f5b1a1a3ca760b1d9d7ea7d65d19c29f48b7621362107eef819d692f1d2a55a6d7d0217ecea91eb6e150f6ab646

                                                                                                    Download Submit
                                                                                                  • \Windows\System32\msvcp140.dll
                                                                                                    MD5

                                                                                                    b9abe16b723ddd90fc612d0ddb0f7ab4

                                                                                                    SHA1

                                                                                                    b323de242f21f39cf1cca4198ba1abb52e6aa0fb

                                                                                                    SHA256

                                                                                                    75fc76655631a4ae72d015b8e85f899537c603661ca35a3f29099b8e4c84716c

                                                                                                    SHA512

                                                                                                    2a66bddb9b6768419c6baacbf8bb19cda5662f5b1a1a3ca760b1d9d7ea7d65d19c29f48b7621362107eef819d692f1d2a55a6d7d0217ecea91eb6e150f6ab646

                                                                                                    Download Submit
                                                                                                  • \Windows\System32\vcruntime140.dll
                                                                                                    MD5

                                                                                                    238dae6c4bb494893d01b99f6effdb93

                                                                                                    SHA1

                                                                                                    b3c96c7187191a70c0088641542dec48bf4b5baf

                                                                                                    SHA256

                                                                                                    da9d322ab2d891a83312f194e70060b1e2d1e6ecd87a4cff5a8f727453c1c4b8

                                                                                                    SHA512

                                                                                                    01b3f320feae9bcf3f540ac369515ea73249ba39630c117127ff9d0de6307f5d062246b799e48627c9735a80b9a4e0a2f7f293df187ba607d91a6ae64796cd64

                                                                                                    Download Submit
                                                                                                  • \Windows\System32\vcruntime140.dll
                                                                                                    MD5

                                                                                                    238dae6c4bb494893d01b99f6effdb93

                                                                                                    SHA1

                                                                                                    b3c96c7187191a70c0088641542dec48bf4b5baf

                                                                                                    SHA256

                                                                                                    da9d322ab2d891a83312f194e70060b1e2d1e6ecd87a4cff5a8f727453c1c4b8

                                                                                                    SHA512

                                                                                                    01b3f320feae9bcf3f540ac369515ea73249ba39630c117127ff9d0de6307f5d062246b799e48627c9735a80b9a4e0a2f7f293df187ba607d91a6ae64796cd64

                                                                                                    Download Submit
                                                                                                  • memory/584-170-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/880-205-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/880-214-0x000000006FFE0000-0x000000006FFF0000-memory.dmp
                                                                                                    Filesize

                                                                                                    64KB

                                                                                                    Download
                                                                                                  • memory/880-141-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/908-147-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/936-69-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/964-153-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/964-195-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1080-116-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1084-149-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1096-150-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1100-168-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1328-166-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1328-185-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1348-189-0x000000006FFF0000-0x0000000070000000-memory.dmp
                                                                                                    Filesize

                                                                                                    64KB

                                                                                                    Download
                                                                                                  • memory/1348-190-0x000000006FFE0000-0x000000006FFF0000-memory.dmp
                                                                                                    Filesize

                                                                                                    64KB

                                                                                                    Download
                                                                                                  • memory/1348-187-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1352-203-0x000000006FFE0000-0x000000006FFF0000-memory.dmp
                                                                                                    Filesize

                                                                                                    64KB

                                                                                                    Download
                                                                                                  • memory/1352-202-0x000000006FFF0000-0x0000000070000000-memory.dmp
                                                                                                    Filesize

                                                                                                    64KB

                                                                                                    Download
                                                                                                  • memory/1352-217-0x000000000E920000-0x000000000EB78000-memory.dmp
                                                                                                    Filesize

                                                                                                    2.3MB

                                                                                                    Download
                                                                                                  • memory/1352-204-0x000000006FFD0000-0x000000006FFE0000-memory.dmp
                                                                                                    Filesize

                                                                                                    64KB

                                                                                                    Download
                                                                                                  • memory/1352-213-0x0000000002280000-0x0000000002281000-memory.dmp
                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download
                                                                                                  • memory/1352-200-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1508-64-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1580-138-0x000000006FFF0000-0x0000000070000000-memory.dmp
                                                                                                    Filesize

                                                                                                    64KB

                                                                                                    Download
                                                                                                  • memory/1580-133-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1592-165-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1596-164-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1600-161-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1600-179-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1600-181-0x000000006FFF0000-0x0000000070000000-memory.dmp
                                                                                                    Filesize

                                                                                                    64KB

                                                                                                    Download
                                                                                                  • memory/1600-182-0x000000006FFF0000-0x0000000070000000-memory.dmp
                                                                                                    Filesize

                                                                                                    64KB

                                                                                                    Download
                                                                                                  • memory/1636-177-0x000000006FFF0000-0x0000000070000000-memory.dmp
                                                                                                    Filesize

                                                                                                    64KB

                                                                                                    Download
                                                                                                  • memory/1636-172-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1636-216-0x000000006FFF0000-0x0000000070000000-memory.dmp
                                                                                                    Filesize

                                                                                                    64KB

                                                                                                    Download
                                                                                                  • memory/1644-139-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1676-146-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1688-157-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1688-106-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1704-207-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1708-158-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1736-173-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1776-126-0x000007FEFBC41000-0x000007FEFBC43000-memory.dmp
                                                                                                    Filesize

                                                                                                    8KB

                                                                                                    Download
                                                                                                  • memory/1776-125-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1828-194-0x000000006FFF0000-0x0000000070000000-memory.dmp
                                                                                                    Filesize

                                                                                                    64KB

                                                                                                    Download
                                                                                                  • memory/1828-192-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1828-144-0x000000006FFF0000-0x0000000070000000-memory.dmp
                                                                                                    Filesize

                                                                                                    64KB

                                                                                                    Download
                                                                                                  • memory/1828-145-0x000000006FFE0000-0x000000006FFF0000-memory.dmp
                                                                                                    Filesize

                                                                                                    64KB

                                                                                                    Download
                                                                                                  • memory/1828-176-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1828-140-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1836-174-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1852-183-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1852-169-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1900-121-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1900-163-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1936-62-0x0000000000570000-0x0000000000571000-memory.dmp
                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download
                                                                                                  • memory/1936-61-0x0000000075201000-0x0000000075203000-memory.dmp
                                                                                                    Filesize

                                                                                                    8KB

                                                                                                    Download
                                                                                                  • memory/2000-171-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/2064-210-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/2448-215-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/2652-218-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/2652-231-0x0000000000690000-0x0000000000691000-memory.dmp
                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download
                                                                                                  • memory/2688-232-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/2716-220-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/2780-222-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/2976-226-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3012-275-0x0000000000360000-0x0000000000361000-memory.dmp
                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download
                                                                                                  • memory/3024-227-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3024-230-0x000000006FFE0000-0x000000006FFF0000-memory.dmp
                                                                                                    Filesize

                                                                                                    64KB

                                                                                                    Download
                                                                                                  • memory/3092-237-0x000000006FFD0000-0x000000006FFE0000-memory.dmp
                                                                                                    Filesize

                                                                                                    64KB

                                                                                                    Download
                                                                                                  • memory/3092-238-0x0000000002D80000-0x0000000002E0C000-memory.dmp
                                                                                                    Filesize

                                                                                                    560KB

                                                                                                    Download
                                                                                                  • memory/3092-233-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3228-240-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3320-241-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3348-242-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3380-243-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3416-244-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3448-245-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3516-246-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3548-247-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3576-248-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3604-249-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3632-250-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3660-251-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3688-252-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3720-253-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3748-254-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3780-255-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/4068-267-0x0000000001F00000-0x0000000001F01000-memory.dmp
                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download