Overview

overview

10

Static

static

8

03bf25deb9...f2.zip

windows10_x64

1

??????V17.0.exe

windows10_x64

3

0a4b3a05f7...e0.exe

windows10_x64

9

1286783ba7...da.exe

windows10_x64

9

2129e70155...a9.exe

windows10_x64

3

29cc23f499...31.exe

windows10_x64

1

3536ff0652...5a.exe

windows10_x64

1

3e6c4e569c...f0.exe

windows10_x64

1

54c7b99377...94.exe

windows10_x64

1

595aa62880...0a.exe

windows10_x64

3

61eb576454...c7.exe

windows10_x64

5

721fd78188...27.exe

windows10_x64

1

7a6bc0ae41...5f.exe

windows10_x64

3

7c0fdee367...b8.exe

windows10_x64

1

7e489f1f72...21.exe

windows10_x64

1

8a3a5aa3a0...20.exe

windows10_x64

8

8bec567244...2e.exe

windows10_x64

7

91e956fd59...21.exe

windows10_x64

1

94fe30df66...ff.exe

windows10_x64

10

a0262556d4...a3.zip

windows10_x64

1

heukms/HEU....1.exe

windows10_x64

8

a355a148d6...0b.exe

windows10_x64

1

b00ffa55cc...85.exe

windows10_x64

3

dca66d16ee...1e.rar

windows10_x64

3

mini-KMS_A...NG.exe

windows10_x64

9

eb54cd2d61...fc.exe

windows10_x64

1

eb83ccd27c...3b.exe

windows10_x64

10

eb87a4c70b...03.exe

windows10_x64

3

f05119aa88...eb.exe

windows10_x64

1

fb01b16f03...ca.exe

windows10_x64

3

fd6c69c345...20.exe

windows10_x64

10

fe9e92957e...ca.exe

windows10_x64

8

Resubmissions

28-03-2022 02:35

220328-c3bd6acaaj 10

Analysis

  • max time kernel
    305s
  • max time network
    313s
  • platform
    windows10_x64
  • resource
    win10-20220223-en
  • submitted
    28-03-2022 02:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    94fe30df66ffa19efb5d4d95f11212273c008788410c6e59e251589ce1cea5ff.exe

  • Size

    4.2MB

  • MD5

    be67e31b7773601efa2095b71471aa7a

  • SHA1

    9d4dcc899df653e48e6becb3b4001bf6d91f44be

  • SHA256

    94fe30df66ffa19efb5d4d95f11212273c008788410c6e59e251589ce1cea5ff

  • SHA512

    2e125ba0b54b2745e4288b1fb2e4040b2228ad022d9d661400781ca837bd864f5a1eee4c360f2e3fd2dcd35f91d0009ca5d8da7275b9e60aa054ad86432fdb33

Score
10/10
adwarebootkitdiscoveryevasionpersistencestealertrojan

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 7 IoCs
    persistence
  • Registers COM server for autorun 1 TTPs
    persistence
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Downloads MZ/PE file
  • Drops file in Drivers directory 6 IoCs
  • Executes dropped EXE 50 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Sets service image path in registry 2 TTPs
    persistence
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    evasiontrojan
  • Installs/modifies Browser Helper Object 2 TTPs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Writes to the Master Boot Record (MBR) 1 TTPs 9 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 11 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 61 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2328
      • C:\Users\Admin\AppData\Local\Temp\94fe30df66ffa19efb5d4d95f11212273c008788410c6e59e251589ce1cea5ff.exe
        "C:\Users\Admin\AppData\Local\Temp\94fe30df66ffa19efb5d4d95f11212273c008788410c6e59e251589ce1cea5ff.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3952
        • C:\Users\Admin\AppData\Local\Temp\小马激活Oem7F7.exe
          "C:\Users\Admin\AppData\Local\Temp\小马激活Oem7F7.exe"
          3⤵
          • Executes dropped EXE
          • Checks BIOS information in registry
          PID:2704
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c C:\Users\Admin\AppData\Local\Temp\7z.exe x C:\Users\Admin\AppData\Local\Temp\XMDownload -y -oC:\Users\Admin\AppData\Local\Temp\
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3668
          • C:\Users\Admin\AppData\Local\Temp\7z.exe
            C:\Users\Admin\AppData\Local\Temp\7z.exe x C:\Users\Admin\AppData\Local\Temp\XMDownload -y -oC:\Users\Admin\AppData\Local\Temp\
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3104
        • C:\Users\Admin\AppData\Local\Temp\Download\download\MiniTPFw.exe
          C:\Users\Admin\AppData\Local\Temp\Download\download\MiniTPFw.exe
          3⤵
          • Executes dropped EXE
          PID:3836
        • C:\Users\Admin\AppData\Local\Temp\Download\download\MiniThunderPlatform.exe
          "C:\Users\Admin\AppData\Local\Temp\Download\download\MiniThunderPlatform.exe" -StartTP
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Writes to the Master Boot Record (MBR)
          • Suspicious use of AdjustPrivilegeToken
          PID:3780
        • C:\Users\Admin\AppData\Local\Temp\kuwo_jm951.exe
          "C:\Users\Admin\AppData\Local\Temp\kuwo_jm951.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:540
          • C:\Users\Admin\AppData\Local\Temp\curl.exe
            "C:\Users\Admin\AppData\Local\Temp\curl.exe" -d MiUwOTxTUkM6TVVTSUNfOS4xLjEuNl9QMlQxfEFDVDpJTlNUQUxMX0lORk98VFlQRTpTdGFydFNldHVwfFRDb3VudDozMDI0MTgxMnx7a3V3b19qbTk1MS5leGV9fFU6fE1BQzo1MkM1RTU4RENDMTQ+ http://log.kuwo.cn/music.yl -o C:\Users\Admin\AppData\Local\Temp\kuwomsglog.txt
            4⤵
            • Executes dropped EXE
            PID:372
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\System32\netsh.exe" firewall add allowedprogram "C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\KwMusic.exe" 酷我音乐 ENABLE
            4⤵
              PID:1848
            • C:\Windows\SysWOW64\netsh.exe
              "C:\Windows\System32\netsh.exe" firewall add allowedprogram "C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\KwService.exe" 酷我核心服务 ENABLE
              4⤵
                PID:1820
              • C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\KwMusic.exe
                "C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\KwMusic.exe" /autorun /nologauto
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks whether UAC is enabled
                • Writes to the Master Boot Record (MBR)
                • Drops file in Program Files directory
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:4036
                • C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\KwService.exe
                  "C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\KwService.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3196
                • C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\KwWebKit.exe
                  "C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\KwWebKit.exe" --type=renderer --disable-gpu-compositing --no-sandbox --enable-begin-frame-scheduling --disable-direct-write --lang=en-US --lang=en-US --log-file="C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\debug.log" --log-severity=disable --enable-system-flash --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-gpu-compositing --channel="4036.0.426665358\687056398" /prefetch:1
                  5⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3032
                • C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\WriteMbox.exe
                  "C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\WriteMbox.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:3644
                • C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\KWUpdate.exe
                  "C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\KWUpdate.exe" /kwsid=63440682 /kwver=MUSIC_9.1.1.6_P2T1
                  5⤵
                  • Executes dropped EXE
                  PID:4172
                • C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\KwConfig.exe
                  "C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\KwConfig.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:3552
                • C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\KwUACSet.exe
                  --unzipnetsong
                  5⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  PID:3484
              • C:\Users\Admin\AppData\Local\Temp\curl.exe
                "C:\Users\Admin\AppData\Local\Temp\curl.exe" -d MiUwOTxTUkM6TVVTSUNfOS4xLjEuNl9QMlQxfEFDVDpJTlNUQUxMX0lORk98U3VjOjF8RGlzcGxheUNvbXBsZXRlUGFnZTowfEhhc1Nob3dDaGVjazowfEhhc1VuQ2hlY2s6MHxIYXNTdGFydE11c2ljQm94OjB8RXhjcHRpb25BYm9ydDowLjJ8U0tJUFRZUEU6MHxBdXRvUnVuOjF8U3RhZ2U6OTN8SW5zdGFsbFRpY2s6MzAyNjU0MjF8RXhpdFR5cGU6MXxVVUlEOnxUQ291bnQ6MzAyNjg1Nzh8e2t1d29fam05NTEuZXhlfXxVOnxNQUM6NTJDNUU1OERDQzE0Pg== http://log.kuwo.cn/music.yl -o C:\Users\Admin\AppData\Local\Temp\kuwomsglog.txt
                4⤵
                • Executes dropped EXE
                PID:3980
            • C:\Users\Admin\AppData\Local\Temp\QQPCMgr_1100122422.exe
              "C:\Users\Admin\AppData\Local\Temp\QQPCMgr_1100122422.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Writes to the Master Boot Record (MBR)
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1904
              • C:\Users\Admin\AppData\Local\Temp\TencentDownload\~1cd9f3b\PCMgr_Setup.exe
                "C:\Users\Admin\AppData\Local\Temp\TencentDownload\~1cd9f3b\PCMgr_Setup.exe" /S ##silence=1&handle=262722&update=1&supply=1100122422&forceinstall=1&qqpcmgr=0&DefaultIE=http://www.chn112.com&DownloadSetupInOne=2
                4⤵
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Adds Run key to start application
                • Writes to the Master Boot Record (MBR)
                • Drops file in System32 directory
                • Drops file in Program Files directory
                • Modifies Internet Explorer settings
                • Modifies data under HKEY_USERS
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3664
                • C:\Windows\SysWOW64\cacls.exe
                  "cacls" "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215" /t /e /c /g SYSTEM:f
                  5⤵
                    PID:524
                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMBluerayInsHlp.exe
                    "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMBluerayInsHlp.exe" /install
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1576
                    • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMBluerayInsHlpx64.exe
                      "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMBluerayInsHlpx64.exe" /install
                      6⤵
                      • Executes dropped EXE
                      PID:672
                  • C:\Windows\SysWOW64\regsvr32.exe
                    regsvr32.exe /s /i "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\\QMGCShellExt64.dll"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:540
                    • C:\Windows\system32\regsvr32.exe
                      /s /i "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\\QMGCShellExt64.dll"
                      6⤵
                      • Modifies registry class
                      PID:1428
                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCSoftCmd.exe
                    "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCSoftCmd.exe" /command=SetSimpleVersionConfig /SimpleVersion=2 /From=Installer
                    5⤵
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    PID:3932
                  • C:\Windows\SysWOW64\Netsh.exe
                    "C:\Windows\system32\Netsh.exe" exec "C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~1cdb9e7\firewallLog.txt"
                    5⤵
                      PID:3496
                    • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCRTP.exe
                      "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCRTP.exe" -i
                      5⤵
                      • Executes dropped EXE
                      PID:984
                    • C:\Windows\SysWOW64\regsvr32.exe
                      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\npQMExtensionsIE.dll"
                      5⤵
                      • Modifies registry class
                      PID:3888
                      • C:\Windows\SysWOW64\reg.exe
                        reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{29B6CFD5-0064-411A-8C42-9890C83F9921}\iexplore\AllowedDomains\qq.com" /f
                        6⤵
                          PID:1392
                        • C:\Windows\SysWOW64\reg.exe
                          reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{29B6CFD5-0064-411A-8C42-9890C83F9921}\iexplore\AllowedDomains\baidu.com" /f
                          6⤵
                            PID:2900
                          • C:\Windows\SysWOW64\reg.exe
                            reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{29B6CFD5-0064-411A-8C42-9890C83F9921}\iexplore\AllowedDomains\xunlei.com" /f
                            6⤵
                              PID:3696
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{29B6CFD5-0064-411A-8C42-9890C83F9921}\iexplore\AllowedDomains\sogou.com" /f
                              6⤵
                                PID:1860
                              • C:\Windows\SysWOW64\reg.exe
                                reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{29B6CFD5-0064-411A-8C42-9890C83F9921}\iexplore" /v Flags /t reg_dword /d 4 /f
                                6⤵
                                  PID:876
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{29B6CFD5-0064-411A-8C42-9890C83F9921}\iexplore\AllowedDomains\*" /f
                                  6⤵
                                    PID:988
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg delete "hkcr\CLSID\{29B6CFD5-0064-411A-8C42-9890C83F9922}" /f
                                    6⤵
                                      PID:1008
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{29B6CFD5-0064-411A-8C42-9890C83F9921}\iexplore\AllowedDomains\kugou.com" /f
                                      6⤵
                                        PID:3620
                                    • C:\Windows\SysWOW64\regsvr32.exe
                                      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\TSWebMon64.dat"
                                      5⤵
                                        PID:2204
                                        • C:\Windows\system32\regsvr32.exe
                                          /s "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\TSWebMon64.dat"
                                          6⤵
                                          • Modifies registry class
                                          PID:1624
                                      • C:\Windows\SysWOW64\regsvr32.exe
                                        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMContextScan64.dll"
                                        5⤵
                                          PID:2316
                                          • C:\Windows\system32\regsvr32.exe
                                            /s "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMContextScan64.dll"
                                            6⤵
                                            • Modifies system executable filetype association
                                            • Modifies registry class
                                            PID:1640
                                        • C:\Windows\SysWOW64\regsvr32.exe
                                          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMContextScan.dll"
                                          5⤵
                                          • Modifies system executable filetype association
                                          • Modifies registry class
                                          PID:3848
                                        • C:\Windows\SysWOW64\regsvr32.exe
                                          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMContextUninstall64.dll"
                                          5⤵
                                            PID:1496
                                            • C:\Windows\system32\regsvr32.exe
                                              /s "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMContextUninstall64.dll"
                                              6⤵
                                              • Modifies system executable filetype association
                                              • Modifies registry class
                                              PID:224
                                          • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMProxyHelper64.exe
                                            "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMProxyHelper64.exe" /Uninstall
                                            5⤵
                                            • Executes dropped EXE
                                            PID:1160
                                          • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMSuperScan.exe
                                            "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\\QMSuperScan.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            • Writes to the Master Boot Record (MBR)
                                            • Modifies data under HKEY_USERS
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3656
                                          • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\GameAssist_Setup.exe
                                            "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\GameAssist_Setup.exe" /S ##silence=1&supplyid=3500
                                            5⤵
                                            • Executes dropped EXE
                                            • Writes to the Master Boot Record (MBR)
                                            • Drops file in System32 directory
                                            • Drops file in Program Files directory
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1636
                                            • C:\Windows\SysWOW64\cacls.exe
                                              "cacls" "C:\Program Files (x86)\Tencent\QQPCMgr\Plugins\GameAssist\3.0.8265.138" /t /e /c /g SYSTEM:f
                                              6⤵
                                                PID:4372
                                              • C:\Program Files (x86)\Tencent\QQPCMgr\Plugins\GameAssist\3.0.8265.138\QMProxyHelper64.exe
                                                "C:\Program Files (x86)\Tencent\QQPCMgr\Plugins\GameAssist\3.0.8265.138\QMProxyHelper64.exe" /Uninstall
                                                6⤵
                                                • Executes dropped EXE
                                                PID:4732
                                            • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCRTP.exe
                                              "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCRTP.exe" -e
                                              5⤵
                                              • Executes dropped EXE
                                              PID:4212
                                            • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCTray.exe
                                              "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCTray.exe" /loadexit /superfetch:1
                                              5⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4168
                                            • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCRTP.exe
                                              "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCRTP.exe" -s
                                              5⤵
                                              • Executes dropped EXE
                                              PID:4348
                                            • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCTray.exe
                                              "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCTray.exe" /regrun
                                              5⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4580
                                            • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\InstallUninstallCube.exe
                                              "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\\InstallUninstallCube.exe" "/verb=EndInstall" /sync=0000028c /pid=3664 "/temp=C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~1cdb9e7\" "/version=13.10.21935.215" /silence=1 /result=1
                                              5⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4664
                                            • C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~1cdb9e7\UpdateTrayIcon.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~1cdb9e7\UpdateTrayIcon.exe" -t QQPCTray.exe -c 1 -p 1 -d "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\"
                                              5⤵
                                              • Executes dropped EXE
                                              • Checks computer location settings
                                              • Suspicious use of FindShellTrayWindow
                                              PID:4644
                                          • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQRepair.EXE
                                            "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQRepair.EXE" /ext=5 /sid=-2147221500
                                            4⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Checks whether UAC is enabled
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4832
                                            • C:\Windows\SysWOW64\sc.exe
                                              "C:\Windows\system32\sc.exe" start QQPCRtp
                                              5⤵
                                                PID:4252
                                              • C:\Windows\SysWOW64\sc.exe
                                                "C:\Windows\system32\sc.exe" start QQPCRtp
                                                5⤵
                                                  PID:4248
                                                • C:\Windows\SysWOW64\sc.exe
                                                  "C:\Windows\system32\sc.exe" start QQPCRtp
                                                  5⤵
                                                    PID:4068
                                                  • C:\Windows\SysWOW64\sc.exe
                                                    "C:\Windows\system32\sc.exe" start QQPCRtp
                                                    5⤵
                                                      PID:672
                                                    • C:\Windows\SysWOW64\sc.exe
                                                      "C:\Windows\system32\sc.exe" start QQPCRtp
                                                      5⤵
                                                        PID:4920
                                                      • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCPatch.exe
                                                        "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCPatch.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:4784
                                                    • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQRepair.EXE
                                                      "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQRepair.EXE" /ext=5 /sid=-2147221502
                                                      4⤵
                                                      • Executes dropped EXE
                                                      PID:4692
                                              • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMCheckNetwork.exe
                                                "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMCheckNetwork.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:3392
                                                • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMCheckNetwork.exe
                                                  "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMCheckNetwork.exe" /AllChain
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Writes to the Master Boot Record (MBR)
                                                  PID:928
                                              • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCRtp.exe
                                                "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCRtp.exe" -r
                                                1⤵
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                • Writes to the Master Boot Record (MBR)
                                                • Drops file in System32 directory
                                                • Drops file in Program Files directory
                                                • Modifies data under HKEY_USERS
                                                • Modifies system certificate store
                                                • Suspicious behavior: LoadsDriver
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4404
                                                • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCTray.exe
                                                  "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCTray.exe" /elevated /regrun
                                                  2⤵
                                                  • Drops file in Drivers directory
                                                  • Executes dropped EXE
                                                  • Checks whether UAC is enabled
                                                  • Writes to the Master Boot Record (MBR)
                                                  • Checks processor information in registry
                                                  • Modifies Internet Explorer settings
                                                  • Modifies Internet Explorer start page
                                                  • Modifies data under HKEY_USERS
                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                  • Suspicious behavior: LoadsDriver
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  • System policy modification
                                                  PID:4544
                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQRepair.exe
                                                    "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQRepair.exe" /master
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • Checks whether UAC is enabled
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4112
                                                    • C:\Windows\SysWOW64\sc.exe
                                                      "C:\Windows\system32\sc.exe" start QQPCRtp
                                                      4⤵
                                                        PID:4728
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        "C:\Windows\system32\sc.exe" start QQPCRtp
                                                        4⤵
                                                          PID:1640
                                                        • C:\Windows\SysWOW64\sc.exe
                                                          "C:\Windows\system32\sc.exe" start QQPCRtp
                                                          4⤵
                                                            PID:3672
                                                          • C:\Windows\SysWOW64\sc.exe
                                                            "C:\Windows\system32\sc.exe" start QQPCRtp
                                                            4⤵
                                                              PID:4684
                                                            • C:\Windows\SysWOW64\sc.exe
                                                              "C:\Windows\system32\sc.exe" start QQPCRtp
                                                              4⤵
                                                                PID:4868
                                                              • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCPatch.exe
                                                                "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCPatch.exe"
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Program Files directory
                                                                PID:4916
                                                            • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\qmdl.exe
                                                              "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\qmdl.exe"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1844
                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                "C:\Windows\System32\icacls.exe" C:\Users\Admin\AppData\Roaming\Tencent\Config\ /t /setintegritylevel low
                                                                4⤵
                                                                • Modifies file permissions
                                                                PID:4728
                                                            • C:\Windows\SysWOW64\regsvr32.exe
                                                              regsvr32.exe "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\TSWebMon64.dat" /s
                                                              3⤵
                                                                PID:1336
                                                                • C:\Windows\system32\regsvr32.exe
                                                                  "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\TSWebMon64.dat" /s
                                                                  4⤵
                                                                  • Modifies registry class
                                                                  PID:3884
                                                              • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCRealTimeSpeedup.exe
                                                                "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCRealTimeSpeedup.exe"
                                                                3⤵
                                                                • Drops file in Drivers directory
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:220
                                                              • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\Plugin\QMBlueScreenFixSetup_13.10.21935.215__1619169878035.exe
                                                                "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\Plugin\QMBlueScreenFixSetup_13.10.21935.215__1619169878035.exe" /S
                                                                3⤵
                                                                • Executes dropped EXE
                                                                PID:5276
                                                              • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\Plugin\QMRealTimeSpeedupSetup_13.10.21935.215__1619169878035.exe
                                                                "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\Plugin\QMRealTimeSpeedupSetup_13.10.21935.215__1619169878035.exe" /S
                                                                3⤵
                                                                • Executes dropped EXE
                                                                PID:5316
                                                              • C:\Windows\SysWOW64\regsvr32.exe
                                                                regsvr32.exe /s "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMGCShellExt64.dll"
                                                                3⤵
                                                                  PID:5524
                                                                  • C:\Windows\system32\regsvr32.exe
                                                                    /s "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMGCShellExt64.dll"
                                                                    4⤵
                                                                    • Modifies registry class
                                                                    PID:5540
                                                                • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMCheckNetwork.exe
                                                                  "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMCheckNetwork.exe"
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  PID:5968
                                                                  • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMCheckNetwork.exe
                                                                    "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QMCheckNetwork.exe" /AllChain
                                                                    4⤵
                                                                    • Executes dropped EXE
                                                                    PID:5980
                                                                • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\TSVulFixInc64.exe
                                                                  "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\TSVulFixInc64.exe" /start=3
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  PID:6060
                                                                • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCSoftTrayTips.exe
                                                                  "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\QQPCSoftTrayTips.exe" /scan_soft_analyze
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  PID:3520
                                                              • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\VolSnapshotX64.exe
                                                                "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\VolSnapshotX64.exe" 00000003000000010501010000000000000205010000000000000003050150000000
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Drops file in System32 directory
                                                                PID:4136
                                                              • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\VolSnapshotX64.exe
                                                                "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\VolSnapshotX64.exe" 00000003000000010501010000000000000205010000000000000003050150000000
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Drops file in System32 directory
                                                                PID:5828
                                                              • C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\VolSnapshotX64.exe
                                                                "C:\Program Files (x86)\Tencent\QQPCMgr\13.10.21935.215\VolSnapshotX64.exe" 00000003000000010501010000000000000205010000000000000003050150000000
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Drops file in System32 directory
                                                                PID:5872
                                                            • C:\Windows\system32\vssvc.exe
                                                              C:\Windows\system32\vssvc.exe
                                                              1⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4532

                                                            Network

                                                            MITRE ATT&CK Enterprise v6

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\DuiLib.dll
                                                              Filesize

                                                              1018KB

                                                              MD5

                                                              f4aa39bd6c7845b6e1c3a5922e2f06a9

                                                              SHA1

                                                              48c16bf2c1b07d7626038cbf3d54ae949e971b7f

                                                              SHA256

                                                              11f01e321831fa5417568711bcc77609b6d809efe25afad116f43a5adc6f8a55

                                                              SHA512

                                                              055100f158c8d98c6c3b8c700e933baeaf59b4afea0c1874b09dc48bdb03792c7f95d11a45b50943dde5041d930bb5f39c84edacd0a6df6f0bc19895d0d94b6d

                                                              Download Submit
                                                            • C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\KwMusic.exe
                                                              Filesize

                                                              633KB

                                                              MD5

                                                              9d8f56976f4bee9c113114c762f4e92d

                                                              SHA1

                                                              b7cf53fd88f60acdf46b17b36ef73b2adcb5af83

                                                              SHA256

                                                              6b1bd3bdb325c2b1b3f4b3e8e14c8db3967a9d4ce76cfe78b5d490f4233b7af1

                                                              SHA512

                                                              4213abd658a2954a62eb12a7db7b13d677733fe5b143ec9c787246089bfe50cd5aaa013c8ec65545a7d7be7c0d097a943b4ee94d093827ff98b001ef6a4cab41

                                                              Download Submit
                                                            • C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\KwService.exe
                                                              Filesize

                                                              56KB

                                                              MD5

                                                              2f8711ee7c7c6c2aaca5a1cc68644d49

                                                              SHA1

                                                              ebc656daac09839455a67776e78fa5979007ebd3

                                                              SHA256

                                                              86deac76786e2bd4ac4534e6c051c06657a10ecf0651e490f423046a6a543be1

                                                              SHA512

                                                              0c7c41d0dbb02c1b50c63a395f2348a2c104194c37894077e1522867cbc6caf724f5b3aebf0edb9f086744180fe031cfef052a8dc9cf8a0361162128dd5f26e8

                                                              Download Submit
                                                            • C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\MSVCP120.dll
                                                              Filesize

                                                              451KB

                                                              MD5

                                                              a34aed811909aae9262de05400a8f2a4

                                                              SHA1

                                                              43e91f7fedb04ef94b7d8b571408ea240ca5fd62

                                                              SHA256

                                                              4b0c0671495a3ea7ededb43ea4330b4b3e932be01eda42e58c20b1b6bf26e5e9

                                                              SHA512

                                                              590bd85cf61c682ebfcc52c598afb2c8d1050cfa9a2b912ece3acd6f2760b7799f26837aede88190b10cd9127c68af08a1c481edd8770845404aaa128422b9c9

                                                              Download Submit
                                                            • C:\Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\kwmusic.exe
                                                              Filesize

                                                              633KB

                                                              MD5

                                                              9d8f56976f4bee9c113114c762f4e92d

                                                              SHA1

                                                              b7cf53fd88f60acdf46b17b36ef73b2adcb5af83

                                                              SHA256

                                                              6b1bd3bdb325c2b1b3f4b3e8e14c8db3967a9d4ce76cfe78b5d490f4233b7af1

                                                              SHA512

                                                              4213abd658a2954a62eb12a7db7b13d677733fe5b143ec9c787246089bfe50cd5aaa013c8ec65545a7d7be7c0d097a943b4ee94d093827ff98b001ef6a4cab41

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\7z.dll
                                                              Filesize

                                                              893KB

                                                              MD5

                                                              04ad4b80880b32c94be8d0886482c774

                                                              SHA1

                                                              344faf61c3eb76f4a2fb6452e83ed16c9cce73e0

                                                              SHA256

                                                              a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338

                                                              SHA512

                                                              3e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\7z.exe
                                                              Filesize

                                                              160KB

                                                              MD5

                                                              a51d90f2f9394f5ea0a3acae3bd2b219

                                                              SHA1

                                                              20fea1314dbed552d5fedee096e2050369172ee1

                                                              SHA256

                                                              ac9674feb8f2fad20c1e046de67f899419276ae79a60e8cc021a4bf472ae044f

                                                              SHA512

                                                              c11f981136db7d9bde01046b1953fd924ff29447d41257da09dd762451e27390cea9b69e43206a8fff825ebcd4ddec5a6247bb502aefbd6e8285622caa985bf6

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\7z.exe
                                                              Filesize

                                                              160KB

                                                              MD5

                                                              a51d90f2f9394f5ea0a3acae3bd2b219

                                                              SHA1

                                                              20fea1314dbed552d5fedee096e2050369172ee1

                                                              SHA256

                                                              ac9674feb8f2fad20c1e046de67f899419276ae79a60e8cc021a4bf472ae044f

                                                              SHA512

                                                              c11f981136db7d9bde01046b1953fd924ff29447d41257da09dd762451e27390cea9b69e43206a8fff825ebcd4ddec5a6247bb502aefbd6e8285622caa985bf6

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\Download\download\ATL71.DLL
                                                              Filesize

                                                              87KB

                                                              MD5

                                                              79cb6457c81ada9eb7f2087ce799aaa7

                                                              SHA1

                                                              322ddde439d9254182f5945be8d97e9d897561ae

                                                              SHA256

                                                              a68e1297fae2bcf854b47ffa444f490353028de1fa2ca713b6cf6cc5aa22b88a

                                                              SHA512

                                                              eca4b91109d105b2ce8c40710b8e3309c4cc944194843b7930e06daf3d1df6ae85c1b7063036c7e5cd10276e5e5535b33e49930adbad88166228316283d011b8

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\Download\download\MSVCP71.dll
                                                              Filesize

                                                              492KB

                                                              MD5

                                                              a94dc60a90efd7a35c36d971e3ee7470

                                                              SHA1

                                                              f936f612bc779e4ba067f77514b68c329180a380

                                                              SHA256

                                                              6c483cbe349863c7dcf6f8cb7334e7d28c299e7d5aa063297ea2f62352f6bdd9

                                                              SHA512

                                                              ff6c41d56337cac074582002d60cbc57263a31480c67ee8999bc02fc473b331eefed93ee938718d297877cf48471c7512741b4aebc0636afc78991cdf6eddfab

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\Download\download\MSVCR71.dll
                                                              Filesize

                                                              340KB

                                                              MD5

                                                              ca2f560921b7b8be1cf555a5a18d54c3

                                                              SHA1

                                                              432dbcf54b6f1142058b413a9d52668a2bde011d

                                                              SHA256

                                                              c4d4339df314a27ff75a38967b7569d9962337b8d4cd4b0db3aba5ff72b2bfbb

                                                              SHA512

                                                              23e0bdd9458a5a8e0f9bbcb7f6ce4f87fcc9e47c1ee15f964c17ff9fe8d0f82dd3a0f90263daaf1ee87fad4a238aa0ee92a16b3e2c67f47c84d575768edba43e

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\Download\download\MiniTPFw.exe
                                                              Filesize

                                                              58KB

                                                              MD5

                                                              58bb62e88687791ad2ea5d8d6e3fe18b

                                                              SHA1

                                                              0ffb029064741d10c9cf3f629202aa97167883de

                                                              SHA256

                                                              f02fa7ddab2593492b9b68e3f485e59eb755380a9235f6269705f6d219dff100

                                                              SHA512

                                                              cd36b28f87be9cf718f0c44bf7c500d53186edc08889bcfa5222041ff31c5cbee509b186004480efbd99c36b2233182ae0969447f4051510e1771a73ed209da5

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\Download\download\MiniTPFw.exe
                                                              Filesize

                                                              58KB

                                                              MD5

                                                              58bb62e88687791ad2ea5d8d6e3fe18b

                                                              SHA1

                                                              0ffb029064741d10c9cf3f629202aa97167883de

                                                              SHA256

                                                              f02fa7ddab2593492b9b68e3f485e59eb755380a9235f6269705f6d219dff100

                                                              SHA512

                                                              cd36b28f87be9cf718f0c44bf7c500d53186edc08889bcfa5222041ff31c5cbee509b186004480efbd99c36b2233182ae0969447f4051510e1771a73ed209da5

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\Download\download\MiniThunderPlatform.exe
                                                              Filesize

                                                              262KB

                                                              MD5

                                                              9f1d3dfac55080c712c0281fb2eeeb47

                                                              SHA1

                                                              9109f9457f811d8d0e887469ffc9c2af793e8090

                                                              SHA256

                                                              a5622e2bf46cc2ec90c4dca70372f051bfb5bf55da3788b5dfca9429529d285b

                                                              SHA512

                                                              7e2df7f2aff2d95ca1dbe0dfb7c8c9388c7e8c023c8b9af9b6997140cefcca63fe5980a438b70da03ab6672c94033fb4e50d407c54530b5ce0b9169c39c50879

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\Download\download\MiniThunderPlatform.exe
                                                              Filesize

                                                              262KB

                                                              MD5

                                                              9f1d3dfac55080c712c0281fb2eeeb47

                                                              SHA1

                                                              9109f9457f811d8d0e887469ffc9c2af793e8090

                                                              SHA256

                                                              a5622e2bf46cc2ec90c4dca70372f051bfb5bf55da3788b5dfca9429529d285b

                                                              SHA512

                                                              7e2df7f2aff2d95ca1dbe0dfb7c8c9388c7e8c023c8b9af9b6997140cefcca63fe5980a438b70da03ab6672c94033fb4e50d407c54530b5ce0b9169c39c50879

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\Download\download\XLBugHandler.dll
                                                              Filesize

                                                              98KB

                                                              MD5

                                                              92154e720998acb6fa0f7bad63309470

                                                              SHA1

                                                              385817793b9f894ca3dd3bac20b269652df6cbc6

                                                              SHA256

                                                              1845df41da539bca264f59365bf7453b686b9098cc94cd0e2b9a20c74a561096

                                                              SHA512

                                                              37ba81f338af7de7ef2ac6bcf67b3aec96f9b748830ee3c0b152029871f7701e917b94a6b51acd7be6f8f02aea2b25f3b14ced1a218bf4868af04f5207bb5fff

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\Download\download\XLBugReport.exe
                                                              Filesize

                                                              242KB

                                                              MD5

                                                              67c767470d0893c4a2e46be84c9afcbb

                                                              SHA1

                                                              00291089b13a93f82ee49a11156521f13ea605cd

                                                              SHA256

                                                              64f8d68cc1cfc5b9cc182df3becf704af93d0f1cc93ee59dbf682c75b6d4ffc0

                                                              SHA512

                                                              d5d3a96dec616b0ab0cd0586fa0cc5a10ba662e0d5e4de4d849ac62ca5d60ec133f54d109d1d130b5f99ae73e7abfb284ec7d5ba55dca1a4f354c6af73c00e35

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\Download\download\dl_peer_id.dll
                                                              Filesize

                                                              89KB

                                                              MD5

                                                              dba9a19752b52943a0850a7e19ac600a

                                                              SHA1

                                                              3485ac30cd7340eccb0457bca37cf4a6dfda583d

                                                              SHA256

                                                              69a5e2a51094dc8f30788d63243b12a0eb2759a3f3c3a159b85fd422fc00ac26

                                                              SHA512

                                                              a42c1ec5594c6f6cae10524cdad1f9da2bdc407f46e685e56107de781b9bce8210a8cd1a53edacd61365d37a1c7ceba3b0891343cf2c31d258681e3bf85049d3

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\Download\download\download_engine.dll
                                                              Filesize

                                                              3.3MB

                                                              MD5

                                                              e164d5cc3d566708caf1aa2c0e842347

                                                              SHA1

                                                              52346ebc204cedee1f1f45e36da46267fc081ac7

                                                              SHA256

                                                              3245995a4d7417a8dffff27f416f8c2f8ae15eb9d8a57a6cd371f366f2c9b808

                                                              SHA512

                                                              08a65b118b791f537ae0d445a484889e57a6ae955917de92de79feef3ba01c52147824b5cc3d298d3413cb2ff140535e51182a63c1e4bef97dde3c0025634e54

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\Download\download\id.dat
                                                              Filesize

                                                              40B

                                                              MD5

                                                              d0aee12037dae8b448b5b5df98ed21c5

                                                              SHA1

                                                              14bf7765e5df943991b04b44764dfd6288c4876c

                                                              SHA256

                                                              4e74a22c6a0e43fc4afe7414e63145e8b37e3ebde2dad3ec46ee9f085e4a306f

                                                              SHA512

                                                              06c8f20fac11f9d39a0d8e5f1fe21237433f8fb7ef7e12fb563d57d42171d41a0ddf4c5c3ce9866f177c5c3118530028d75383eb21c67a1d7c323b3ae38c57a2

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\Download\download\zlib1.dll
                                                              Filesize

                                                              58KB

                                                              MD5

                                                              89f6488524eaa3e5a66c5f34f3b92405

                                                              SHA1

                                                              330f9f6da03ae96dfa77dd92aae9a294ead9c7f7

                                                              SHA256

                                                              bd29d2b1f930e4b660adf71606d1b9634188b7160a704a8d140cadafb46e1e56

                                                              SHA512

                                                              cfe72872c89c055d59d4de07a3a14cd84a7e0a12f166e018748b9674045b694793b6a08863e791be4f9095a34471fd6abe76828dc8c653be8c66923a5802b31e

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\Download\xldl.dll
                                                              Filesize

                                                              282KB

                                                              MD5

                                                              69fa23f05b7200185eba28f8ee5c5d89

                                                              SHA1

                                                              247bc859c90175d94d397f96af896168516af861

                                                              SHA256

                                                              62a7dacc4f1614995c2121e308de94418768571b80b8cdf1f80a2b0050df2567

                                                              SHA512

                                                              a5b6c8852c0a06d84bde38e4b460df3a8df6c59ad00f0e5926af511af15e12b72e8c2de2695de32b630203ded7ae503c60ae5f567780f58d77dc8e0c16e2ec04

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\QQPCMgr_1100122422.exe
                                                              Filesize

                                                              93.9MB

                                                              MD5

                                                              b15528bb954cd7f407e29450faf773d9

                                                              SHA1

                                                              af0195611b6850238c67dd390bd485e23e53b90b

                                                              SHA256

                                                              5bf4bec9b7fb39b07841061db20d28165b4e9671ff4cc89e49238c0d39bc0253

                                                              SHA512

                                                              686d6d2523ffd6d4c3790eb21f8d8aa2b0c6804ee5b662b63935376fb495c3419e8318d73dafe8431f49eff8aa858c60b56d1c1896a7f817c481ee32a7096997

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\TencentDownload\~1cd9f3b\PCMgr_Setup.exe
                                                              Filesize

                                                              92.7MB

                                                              MD5

                                                              e36629a1f68ec3690102245d743f6572

                                                              SHA1

                                                              1c0475d3f29d74a9a437b5fca2afbc1083b865d5

                                                              SHA256

                                                              b2bb3c22390eaedc3dd93d3aa180c86396cd33aecb976bccf3105fb083cd2967

                                                              SHA512

                                                              2e66be481d34ac517b1ad47194d477423ab296397ec5b3ae8221e0568331eb7f44a507cb6e4b623026cb16045e4ccc20c4e3471bc8feb2513c4413c45d35aed8

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\TencentDownload\~1cd9f3b\PCMgr_Setup.exe
                                                              Filesize

                                                              92.7MB

                                                              MD5

                                                              e36629a1f68ec3690102245d743f6572

                                                              SHA1

                                                              1c0475d3f29d74a9a437b5fca2afbc1083b865d5

                                                              SHA256

                                                              b2bb3c22390eaedc3dd93d3aa180c86396cd33aecb976bccf3105fb083cd2967

                                                              SHA512

                                                              2e66be481d34ac517b1ad47194d477423ab296397ec5b3ae8221e0568331eb7f44a507cb6e4b623026cb16045e4ccc20c4e3471bc8feb2513c4413c45d35aed8

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\XMDownload
                                                              Filesize

                                                              2.1MB

                                                              MD5

                                                              0eda2c01efb500d88c92c3be306e0910

                                                              SHA1

                                                              b9933537a1b314842bf3b56412d32be2ce48fbb6

                                                              SHA256

                                                              861cfede51bb8bb3e39bb428bbe88ff87245ef7a46aa0546b65410bc36f4653e

                                                              SHA512

                                                              00e7eed1d665984515926e3f5036ed6ca040a55bdeef271ef8841b2dd55ba0af23469fcfe56854e67a96ae466cc93a0550c8bd2ceac0e8f8909497c42cf1be64

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\curl.exe
                                                              Filesize

                                                              659KB

                                                              MD5

                                                              6b535f795bf0325178a4df17ce4ad09c

                                                              SHA1

                                                              66b9bcd039653ca654d779ebf40109ae4cd1d818

                                                              SHA256

                                                              264d69e8a7ca1afcdf4179429d74a9098187c3f8a5e06080d2758682313a42b4

                                                              SHA512

                                                              e3b0323570ef1faf4284e8199f0b0f9f2de8d49bcca63bc15890254221e0dccfc327d9ebb754b4c98d5e51771c732589f5ad43c7d09b11d8e8848317c2793f0b

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\curl.exe
                                                              Filesize

                                                              659KB

                                                              MD5

                                                              6b535f795bf0325178a4df17ce4ad09c

                                                              SHA1

                                                              66b9bcd039653ca654d779ebf40109ae4cd1d818

                                                              SHA256

                                                              264d69e8a7ca1afcdf4179429d74a9098187c3f8a5e06080d2758682313a42b4

                                                              SHA512

                                                              e3b0323570ef1faf4284e8199f0b0f9f2de8d49bcca63bc15890254221e0dccfc327d9ebb754b4c98d5e51771c732589f5ad43c7d09b11d8e8848317c2793f0b

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\kuwo_jm951.exe
                                                              Filesize

                                                              44.8MB

                                                              MD5

                                                              9c4d344d15d89b0e158a6246a78e7eaa

                                                              SHA1

                                                              42014ee3a40327d26d8b4d5db174f33ae4940d9f

                                                              SHA256

                                                              72bd768856271b2532beeaa340578e35fb0d8ce0b9366b61fe55414d1e0b0bb7

                                                              SHA512

                                                              368ebce770b29521d92ea3394a30e6665264e7b974f7ba83ecdb3fcdc94fa1275e034a59388228720d6224a9f8107d3d31405e596251e42b341c390f90c63ebd

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\小马激活Oem7F7.exe
                                                              Filesize

                                                              881KB

                                                              MD5

                                                              2b13b58ccbb7f3ce02c9bf957f7f529e

                                                              SHA1

                                                              ee82d4425ce1f6d5193822139a5f0abc8883cf38

                                                              SHA256

                                                              ef1edc756d5635b96d1700223a31c71bf3b1020222de4ee184161b44b16221ec

                                                              SHA512

                                                              b5e620e3ad4efe93359996e31240a90fb78968c0c27d14301427d6cdf93f22aa2c33e59f4b88e23803f2dd62d5801772bde0247675005b1649ef64edb6eff6be

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Local\Temp\小马激活Oem7F7.exe
                                                              Filesize

                                                              881KB

                                                              MD5

                                                              2b13b58ccbb7f3ce02c9bf957f7f529e

                                                              SHA1

                                                              ee82d4425ce1f6d5193822139a5f0abc8883cf38

                                                              SHA256

                                                              ef1edc756d5635b96d1700223a31c71bf3b1020222de4ee184161b44b16221ec

                                                              SHA512

                                                              b5e620e3ad4efe93359996e31240a90fb78968c0c27d14301427d6cdf93f22aa2c33e59f4b88e23803f2dd62d5801772bde0247675005b1649ef64edb6eff6be

                                                              Download Submit
                                                            • C:\Users\Admin\AppData\Roaming\Tencent\DeskUpdate\GlobalMgr.db
                                                              Filesize

                                                              190B

                                                              MD5

                                                              fcd8e070efeb7fb2c2d612c6313ae52e

                                                              SHA1

                                                              1020e76825cef5fe805c22770e8f36a5794ff75a

                                                              SHA256

                                                              9d37d49a8b720a275c177655aa141f6dbc037035a2c51ce58547b251cfcc8cfd

                                                              SHA512

                                                              bdb1ad0659ad2fafbbd0a27a4e18cb1729e700b076fff05d02d8817846cea4ebf2c8ceec3cba2a701cb857c80a3213a389ec16fd4fb429a57760912fa8d1d494

                                                              Download Submit
                                                            • \Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\DuiLib.dll
                                                              Filesize

                                                              1018KB

                                                              MD5

                                                              f4aa39bd6c7845b6e1c3a5922e2f06a9

                                                              SHA1

                                                              48c16bf2c1b07d7626038cbf3d54ae949e971b7f

                                                              SHA256

                                                              11f01e321831fa5417568711bcc77609b6d809efe25afad116f43a5adc6f8a55

                                                              SHA512

                                                              055100f158c8d98c6c3b8c700e933baeaf59b4afea0c1874b09dc48bdb03792c7f95d11a45b50943dde5041d930bb5f39c84edacd0a6df6f0bc19895d0d94b6d

                                                              Download Submit
                                                            • \Program Files (x86)\kuwo\kuwomusic\9.1.1.6_P2T1\bin\msvcp120.dll
                                                              Filesize

                                                              451KB

                                                              MD5

                                                              a34aed811909aae9262de05400a8f2a4

                                                              SHA1

                                                              43e91f7fedb04ef94b7d8b571408ea240ca5fd62

                                                              SHA256

                                                              4b0c0671495a3ea7ededb43ea4330b4b3e932be01eda42e58c20b1b6bf26e5e9

                                                              SHA512

                                                              590bd85cf61c682ebfcc52c598afb2c8d1050cfa9a2b912ece3acd6f2760b7799f26837aede88190b10cd9127c68af08a1c481edd8770845404aaa128422b9c9

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\7z.dll
                                                              Filesize

                                                              893KB

                                                              MD5

                                                              04ad4b80880b32c94be8d0886482c774

                                                              SHA1

                                                              344faf61c3eb76f4a2fb6452e83ed16c9cce73e0

                                                              SHA256

                                                              a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338

                                                              SHA512

                                                              3e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\Download\download\XLBugHandler.dll
                                                              Filesize

                                                              98KB

                                                              MD5

                                                              92154e720998acb6fa0f7bad63309470

                                                              SHA1

                                                              385817793b9f894ca3dd3bac20b269652df6cbc6

                                                              SHA256

                                                              1845df41da539bca264f59365bf7453b686b9098cc94cd0e2b9a20c74a561096

                                                              SHA512

                                                              37ba81f338af7de7ef2ac6bcf67b3aec96f9b748830ee3c0b152029871f7701e917b94a6b51acd7be6f8f02aea2b25f3b14ced1a218bf4868af04f5207bb5fff

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\Download\download\atl71.dll
                                                              Filesize

                                                              87KB

                                                              MD5

                                                              79cb6457c81ada9eb7f2087ce799aaa7

                                                              SHA1

                                                              322ddde439d9254182f5945be8d97e9d897561ae

                                                              SHA256

                                                              a68e1297fae2bcf854b47ffa444f490353028de1fa2ca713b6cf6cc5aa22b88a

                                                              SHA512

                                                              eca4b91109d105b2ce8c40710b8e3309c4cc944194843b7930e06daf3d1df6ae85c1b7063036c7e5cd10276e5e5535b33e49930adbad88166228316283d011b8

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\Download\download\dl_peer_id.dll
                                                              Filesize

                                                              89KB

                                                              MD5

                                                              dba9a19752b52943a0850a7e19ac600a

                                                              SHA1

                                                              3485ac30cd7340eccb0457bca37cf4a6dfda583d

                                                              SHA256

                                                              69a5e2a51094dc8f30788d63243b12a0eb2759a3f3c3a159b85fd422fc00ac26

                                                              SHA512

                                                              a42c1ec5594c6f6cae10524cdad1f9da2bdc407f46e685e56107de781b9bce8210a8cd1a53edacd61365d37a1c7ceba3b0891343cf2c31d258681e3bf85049d3

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\Download\download\dl_peer_id.dll
                                                              Filesize

                                                              89KB

                                                              MD5

                                                              dba9a19752b52943a0850a7e19ac600a

                                                              SHA1

                                                              3485ac30cd7340eccb0457bca37cf4a6dfda583d

                                                              SHA256

                                                              69a5e2a51094dc8f30788d63243b12a0eb2759a3f3c3a159b85fd422fc00ac26

                                                              SHA512

                                                              a42c1ec5594c6f6cae10524cdad1f9da2bdc407f46e685e56107de781b9bce8210a8cd1a53edacd61365d37a1c7ceba3b0891343cf2c31d258681e3bf85049d3

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\Download\download\download_engine.dll
                                                              Filesize

                                                              3.3MB

                                                              MD5

                                                              e164d5cc3d566708caf1aa2c0e842347

                                                              SHA1

                                                              52346ebc204cedee1f1f45e36da46267fc081ac7

                                                              SHA256

                                                              3245995a4d7417a8dffff27f416f8c2f8ae15eb9d8a57a6cd371f366f2c9b808

                                                              SHA512

                                                              08a65b118b791f537ae0d445a484889e57a6ae955917de92de79feef3ba01c52147824b5cc3d298d3413cb2ff140535e51182a63c1e4bef97dde3c0025634e54

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\Download\download\download_engine.dll
                                                              Filesize

                                                              3.3MB

                                                              MD5

                                                              e164d5cc3d566708caf1aa2c0e842347

                                                              SHA1

                                                              52346ebc204cedee1f1f45e36da46267fc081ac7

                                                              SHA256

                                                              3245995a4d7417a8dffff27f416f8c2f8ae15eb9d8a57a6cd371f366f2c9b808

                                                              SHA512

                                                              08a65b118b791f537ae0d445a484889e57a6ae955917de92de79feef3ba01c52147824b5cc3d298d3413cb2ff140535e51182a63c1e4bef97dde3c0025634e54

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\Download\download\msvcp71.dll
                                                              Filesize

                                                              492KB

                                                              MD5

                                                              a94dc60a90efd7a35c36d971e3ee7470

                                                              SHA1

                                                              f936f612bc779e4ba067f77514b68c329180a380

                                                              SHA256

                                                              6c483cbe349863c7dcf6f8cb7334e7d28c299e7d5aa063297ea2f62352f6bdd9

                                                              SHA512

                                                              ff6c41d56337cac074582002d60cbc57263a31480c67ee8999bc02fc473b331eefed93ee938718d297877cf48471c7512741b4aebc0636afc78991cdf6eddfab

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\Download\download\msvcr71.dll
                                                              Filesize

                                                              340KB

                                                              MD5

                                                              ca2f560921b7b8be1cf555a5a18d54c3

                                                              SHA1

                                                              432dbcf54b6f1142058b413a9d52668a2bde011d

                                                              SHA256

                                                              c4d4339df314a27ff75a38967b7569d9962337b8d4cd4b0db3aba5ff72b2bfbb

                                                              SHA512

                                                              23e0bdd9458a5a8e0f9bbcb7f6ce4f87fcc9e47c1ee15f964c17ff9fe8d0f82dd3a0f90263daaf1ee87fad4a238aa0ee92a16b3e2c67f47c84d575768edba43e

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\Download\download\msvcr71.dll
                                                              Filesize

                                                              340KB

                                                              MD5

                                                              ca2f560921b7b8be1cf555a5a18d54c3

                                                              SHA1

                                                              432dbcf54b6f1142058b413a9d52668a2bde011d

                                                              SHA256

                                                              c4d4339df314a27ff75a38967b7569d9962337b8d4cd4b0db3aba5ff72b2bfbb

                                                              SHA512

                                                              23e0bdd9458a5a8e0f9bbcb7f6ce4f87fcc9e47c1ee15f964c17ff9fe8d0f82dd3a0f90263daaf1ee87fad4a238aa0ee92a16b3e2c67f47c84d575768edba43e

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\Download\download\zlib1.dll
                                                              Filesize

                                                              58KB

                                                              MD5

                                                              89f6488524eaa3e5a66c5f34f3b92405

                                                              SHA1

                                                              330f9f6da03ae96dfa77dd92aae9a294ead9c7f7

                                                              SHA256

                                                              bd29d2b1f930e4b660adf71606d1b9634188b7160a704a8d140cadafb46e1e56

                                                              SHA512

                                                              cfe72872c89c055d59d4de07a3a14cd84a7e0a12f166e018748b9674045b694793b6a08863e791be4f9095a34471fd6abe76828dc8c653be8c66923a5802b31e

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\Download\xldl.dll
                                                              Filesize

                                                              282KB

                                                              MD5

                                                              69fa23f05b7200185eba28f8ee5c5d89

                                                              SHA1

                                                              247bc859c90175d94d397f96af896168516af861

                                                              SHA256

                                                              62a7dacc4f1614995c2121e308de94418768571b80b8cdf1f80a2b0050df2567

                                                              SHA512

                                                              a5b6c8852c0a06d84bde38e4b460df3a8df6c59ad00f0e5926af511af15e12b72e8c2de2695de32b630203ded7ae503c60ae5f567780f58d77dc8e0c16e2ec04

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\TencentDownload\~1cd9f3b\QQPCDownload.dll
                                                              Filesize

                                                              1.1MB

                                                              MD5

                                                              2f10670810f8260d8046f84a6c021ded

                                                              SHA1

                                                              5d9b2cd70cdf49ba129f86028fd3984875b7a643

                                                              SHA256

                                                              86ed0a152f943ea22e7785703180c3f32cb70aba4d89418682c689efbc8642da

                                                              SHA512

                                                              f079c76b43bec422bcbefc24e8130e9bcaf2b1f651111efefe3418edb96bd57fe6940a66a1e6cca1ebf12bbc1460f099e4e4f52d0a878bc36d5301f82f9e3c13

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\nst6F05.tmp\InstLancher.dll
                                                              Filesize

                                                              1.7MB

                                                              MD5

                                                              34939bd7a20c7c6800ad7977a1f0b1da

                                                              SHA1

                                                              eda1d13f48d1828ba7c46496f2056fac633d01a7

                                                              SHA256

                                                              7d43f7ea7111a109e5193f9670b11a73d3a8819a5753ae9ef4ce3205af908c98

                                                              SHA512

                                                              46c77ae746c6fd2e4283681d1af3dda58dbe04f854760ee8fe4cbb9d2890278951d229d9ee90373d120ae6fc7ad0f96bd0bc3f9c2489128bf887e40bbb5d8d3f

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\nst6F05.tmp\KuWoNsis_new.dll
                                                              Filesize

                                                              298KB

                                                              MD5

                                                              82f572276aff5f06f55240323ad8d267

                                                              SHA1

                                                              0eeef4b8aa4787a3912522187855c8c0743bbca5

                                                              SHA256

                                                              5f901e526effe89e783eb4acfdec0f485a465a98b9069d0b13ffd5e2ed73adfe

                                                              SHA512

                                                              b29a1faa150dbe70b2cffccb233d25548c812a2f773e031b76d9de314bc33ad4dad69b821f315535dc0afdcf0e6e5749d6487ff9eecac927999b93906ec15c0b

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\nst6F05.tmp\KuWoNsis_new.dll
                                                              Filesize

                                                              298KB

                                                              MD5

                                                              82f572276aff5f06f55240323ad8d267

                                                              SHA1

                                                              0eeef4b8aa4787a3912522187855c8c0743bbca5

                                                              SHA256

                                                              5f901e526effe89e783eb4acfdec0f485a465a98b9069d0b13ffd5e2ed73adfe

                                                              SHA512

                                                              b29a1faa150dbe70b2cffccb233d25548c812a2f773e031b76d9de314bc33ad4dad69b821f315535dc0afdcf0e6e5749d6487ff9eecac927999b93906ec15c0b

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\nst6F05.tmp\KuWoNsis_new.dll
                                                              Filesize

                                                              298KB

                                                              MD5

                                                              82f572276aff5f06f55240323ad8d267

                                                              SHA1

                                                              0eeef4b8aa4787a3912522187855c8c0743bbca5

                                                              SHA256

                                                              5f901e526effe89e783eb4acfdec0f485a465a98b9069d0b13ffd5e2ed73adfe

                                                              SHA512

                                                              b29a1faa150dbe70b2cffccb233d25548c812a2f773e031b76d9de314bc33ad4dad69b821f315535dc0afdcf0e6e5749d6487ff9eecac927999b93906ec15c0b

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\nst6F05.tmp\KuWoNsis_new.dll
                                                              Filesize

                                                              298KB

                                                              MD5

                                                              82f572276aff5f06f55240323ad8d267

                                                              SHA1

                                                              0eeef4b8aa4787a3912522187855c8c0743bbca5

                                                              SHA256

                                                              5f901e526effe89e783eb4acfdec0f485a465a98b9069d0b13ffd5e2ed73adfe

                                                              SHA512

                                                              b29a1faa150dbe70b2cffccb233d25548c812a2f773e031b76d9de314bc33ad4dad69b821f315535dc0afdcf0e6e5749d6487ff9eecac927999b93906ec15c0b

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\nst6F05.tmp\KuWoNsis_new.dll
                                                              Filesize

                                                              298KB

                                                              MD5

                                                              82f572276aff5f06f55240323ad8d267

                                                              SHA1

                                                              0eeef4b8aa4787a3912522187855c8c0743bbca5

                                                              SHA256

                                                              5f901e526effe89e783eb4acfdec0f485a465a98b9069d0b13ffd5e2ed73adfe

                                                              SHA512

                                                              b29a1faa150dbe70b2cffccb233d25548c812a2f773e031b76d9de314bc33ad4dad69b821f315535dc0afdcf0e6e5749d6487ff9eecac927999b93906ec15c0b

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\nst6F05.tmp\KuWoNsis_new.dll
                                                              Filesize

                                                              298KB

                                                              MD5

                                                              82f572276aff5f06f55240323ad8d267

                                                              SHA1

                                                              0eeef4b8aa4787a3912522187855c8c0743bbca5

                                                              SHA256

                                                              5f901e526effe89e783eb4acfdec0f485a465a98b9069d0b13ffd5e2ed73adfe

                                                              SHA512

                                                              b29a1faa150dbe70b2cffccb233d25548c812a2f773e031b76d9de314bc33ad4dad69b821f315535dc0afdcf0e6e5749d6487ff9eecac927999b93906ec15c0b

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\nst6F05.tmp\KuWoNsis_new.dll
                                                              Filesize

                                                              298KB

                                                              MD5

                                                              82f572276aff5f06f55240323ad8d267

                                                              SHA1

                                                              0eeef4b8aa4787a3912522187855c8c0743bbca5

                                                              SHA256

                                                              5f901e526effe89e783eb4acfdec0f485a465a98b9069d0b13ffd5e2ed73adfe

                                                              SHA512

                                                              b29a1faa150dbe70b2cffccb233d25548c812a2f773e031b76d9de314bc33ad4dad69b821f315535dc0afdcf0e6e5749d6487ff9eecac927999b93906ec15c0b

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\nst6F05.tmp\KuWoNsis_new.dll
                                                              Filesize

                                                              298KB

                                                              MD5

                                                              82f572276aff5f06f55240323ad8d267

                                                              SHA1

                                                              0eeef4b8aa4787a3912522187855c8c0743bbca5

                                                              SHA256

                                                              5f901e526effe89e783eb4acfdec0f485a465a98b9069d0b13ffd5e2ed73adfe

                                                              SHA512

                                                              b29a1faa150dbe70b2cffccb233d25548c812a2f773e031b76d9de314bc33ad4dad69b821f315535dc0afdcf0e6e5749d6487ff9eecac927999b93906ec15c0b

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\nst6F05.tmp\KuWoNsis_new.dll
                                                              Filesize

                                                              298KB

                                                              MD5

                                                              82f572276aff5f06f55240323ad8d267

                                                              SHA1

                                                              0eeef4b8aa4787a3912522187855c8c0743bbca5

                                                              SHA256

                                                              5f901e526effe89e783eb4acfdec0f485a465a98b9069d0b13ffd5e2ed73adfe

                                                              SHA512

                                                              b29a1faa150dbe70b2cffccb233d25548c812a2f773e031b76d9de314bc33ad4dad69b821f315535dc0afdcf0e6e5749d6487ff9eecac927999b93906ec15c0b

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\nst6F05.tmp\KuWoNsis_new.dll
                                                              Filesize

                                                              298KB

                                                              MD5

                                                              82f572276aff5f06f55240323ad8d267

                                                              SHA1

                                                              0eeef4b8aa4787a3912522187855c8c0743bbca5

                                                              SHA256

                                                              5f901e526effe89e783eb4acfdec0f485a465a98b9069d0b13ffd5e2ed73adfe

                                                              SHA512

                                                              b29a1faa150dbe70b2cffccb233d25548c812a2f773e031b76d9de314bc33ad4dad69b821f315535dc0afdcf0e6e5749d6487ff9eecac927999b93906ec15c0b

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\nst6F05.tmp\KuWoNsis_new.dll
                                                              Filesize

                                                              298KB

                                                              MD5

                                                              82f572276aff5f06f55240323ad8d267

                                                              SHA1

                                                              0eeef4b8aa4787a3912522187855c8c0743bbca5

                                                              SHA256

                                                              5f901e526effe89e783eb4acfdec0f485a465a98b9069d0b13ffd5e2ed73adfe

                                                              SHA512

                                                              b29a1faa150dbe70b2cffccb233d25548c812a2f773e031b76d9de314bc33ad4dad69b821f315535dc0afdcf0e6e5749d6487ff9eecac927999b93906ec15c0b

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\nst6F05.tmp\KuWoNsis_new.dll
                                                              Filesize

                                                              298KB

                                                              MD5

                                                              82f572276aff5f06f55240323ad8d267

                                                              SHA1

                                                              0eeef4b8aa4787a3912522187855c8c0743bbca5

                                                              SHA256

                                                              5f901e526effe89e783eb4acfdec0f485a465a98b9069d0b13ffd5e2ed73adfe

                                                              SHA512

                                                              b29a1faa150dbe70b2cffccb233d25548c812a2f773e031b76d9de314bc33ad4dad69b821f315535dc0afdcf0e6e5749d6487ff9eecac927999b93906ec15c0b

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\nst6F05.tmp\KwMusicNsis.dll
                                                              Filesize

                                                              419KB

                                                              MD5

                                                              06029e624f1d222e59ac641b2ce426b6

                                                              SHA1

                                                              6ba2875bee2eae79c0e1eaa8aa236038c8db6044

                                                              SHA256

                                                              09fb37e917faea5c966bc3418d1d7e46e3d0b9912cadd56486ba5bb5ac0f7b10

                                                              SHA512

                                                              516c04cfc31204879a0c938961208416ddd4ca7204606d630abe860c81422aa1316e45e29669ba01a7506af3f05284395c7c46524f2e73f36d3b4274203de70b

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\nst6F05.tmp\KwUnzip.dll
                                                              Filesize

                                                              157KB

                                                              MD5

                                                              a807ee958f2ef0f5aed5c97c7df56f90

                                                              SHA1

                                                              61c69bf8f0481ed2fea0506533a84584ee8053dc

                                                              SHA256

                                                              8643d35c7023f766fffaf472d6407610fa541fef9af6936051274e764bd835d4

                                                              SHA512

                                                              4d103a6eaba17ac974f8150e84fa5ffcdd8559ba82916f8df779394ef2357f7185fa9291a3ec607c0bb963ab848d2d29d0ee9fa2ffa41908047ee9fc7d6ed8ba

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\nst6F05.tmp\System.dll
                                                              Filesize

                                                              11KB

                                                              MD5

                                                              7df8fb4196186f28cb308f9952d7ef64

                                                              SHA1

                                                              f20a7259ad233ac3795b6e6537de658209a8fd40

                                                              SHA256

                                                              72253837028abed272e5d50a3a6771933e9dd1aad73e90b8db4538aa9c786cbf

                                                              SHA512

                                                              3f373d69664ce015ceab16c12ba4c806c3489b89ae9db282551ec2452acd2ced1d70ddd4de0ef8c56d62a715624c9d2ceddc968adf07e905f2e4c81c2850ae4b

                                                              Download Submit
                                                            • \Users\Admin\AppData\Local\Temp\nst6F05.tmp\inetc.dll
                                                              Filesize

                                                              61KB

                                                              MD5

                                                              8bde726084a37cacd13a7e03259f953f

                                                              SHA1

                                                              25400124fe8b399d659d5853f45e388a5a53b61a

                                                              SHA256

                                                              19a8e8aaa8a8d6c6e49ffd054b1c62f562eda5909aa6e7863c65c5f858f5fd18

                                                              SHA512

                                                              2f4932fade786312ba72c0f12d51bb1e561fd939597983dceccc0f0d7a53f18862f362473620c0788be039bb4977f0e23b541c61d67ab0ba9a043be963694b23

                                                              Download Submit
                                                            • memory/224-358-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/372-165-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/524-271-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/540-274-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/540-154-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/540-159-0x00000000068B0000-0x00000000068FC000-memory.dmp
                                                              Filesize

                                                              304KB

                                                              Download
                                                            • memory/540-170-0x0000000007110000-0x000000000715C000-memory.dmp
                                                              Filesize

                                                              304KB

                                                              Download
                                                            • memory/672-273-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/876-352-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/928-364-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/984-343-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/988-361-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/1008-362-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/1160-353-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/1392-351-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/1428-275-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/1496-350-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/1576-272-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/1624-349-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/1636-365-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/1640-528-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/1640-354-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/1820-182-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/1848-180-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/1860-357-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/1904-174-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/2204-346-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/2316-347-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/2704-114-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/2900-355-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/3032-251-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/3032-258-0x000000003F000000-0x000000003F001000-memory.dmp
                                                              Filesize

                                                              4KB

                                                              Download
                                                            • memory/3032-254-0x0000000036330000-0x0000000036340000-memory.dmp
                                                              Filesize

                                                              64KB

                                                              Download
                                                            • memory/3104-118-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/3196-240-0x0000000000BD0000-0x0000000000BFA000-memory.dmp
                                                              Filesize

                                                              168KB

                                                              Download
                                                            • memory/3196-225-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/3196-237-0x0000000000B50000-0x0000000000B5D000-memory.dmp
                                                              Filesize

                                                              52KB

                                                              Download
                                                            • memory/3196-236-0x0000000000B20000-0x0000000000B46000-memory.dmp
                                                              Filesize

                                                              152KB

                                                              Download
                                                            • memory/3196-238-0x0000000000B70000-0x0000000000B81000-memory.dmp
                                                              Filesize

                                                              68KB

                                                              Download
                                                            • memory/3196-227-0x0000000000580000-0x00000000005F5000-memory.dmp
                                                              Filesize

                                                              468KB

                                                              Download
                                                            • memory/3196-228-0x00000000001D0000-0x00000000001E9000-memory.dmp
                                                              Filesize

                                                              100KB

                                                              Download
                                                            • memory/3196-267-0x0000000003BC0000-0x0000000003BD5000-memory.dmp
                                                              Filesize

                                                              84KB

                                                              Download
                                                            • memory/3196-245-0x0000000000C10000-0x0000000000C20000-memory.dmp
                                                              Filesize

                                                              64KB

                                                              Download
                                                            • memory/3196-265-0x0000000003840000-0x0000000003868000-memory.dmp
                                                              Filesize

                                                              160KB

                                                              Download
                                                            • memory/3196-263-0x0000000003800000-0x000000000382D000-memory.dmp
                                                              Filesize

                                                              180KB

                                                              Download
                                                            • memory/3196-233-0x00000000009B0000-0x00000000009CA000-memory.dmp
                                                              Filesize

                                                              104KB

                                                              Download
                                                            • memory/3196-262-0x00000000037C0000-0x00000000037DE000-memory.dmp
                                                              Filesize

                                                              120KB

                                                              Download
                                                            • memory/3196-232-0x0000000000980000-0x00000000009AF000-memory.dmp
                                                              Filesize

                                                              188KB

                                                              Download
                                                            • memory/3196-255-0x0000000002F10000-0x0000000002F3D000-memory.dmp
                                                              Filesize

                                                              180KB

                                                              Download
                                                            • memory/3196-231-0x0000000000900000-0x0000000000973000-memory.dmp
                                                              Filesize

                                                              460KB

                                                              Download
                                                            • memory/3196-260-0x00000000034B0000-0x00000000034C5000-memory.dmp
                                                              Filesize

                                                              84KB

                                                              Download
                                                            • memory/3196-261-0x00000000034F0000-0x00000000034FF000-memory.dmp
                                                              Filesize

                                                              60KB

                                                              Download
                                                            • memory/3392-363-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/3496-342-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/3620-359-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/3644-268-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/3656-360-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/3664-177-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/3668-117-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/3672-529-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/3696-356-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/3780-147-0x00000000026D0000-0x0000000002A2C000-memory.dmp
                                                              Filesize

                                                              3.4MB

                                                              Download
                                                            • memory/3780-130-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/3780-142-0x000000006FFF0000-0x0000000070000000-memory.dmp
                                                              Filesize

                                                              64KB

                                                              Download
                                                            • memory/3780-146-0x00000000026D1000-0x0000000002943000-memory.dmp
                                                              Filesize

                                                              2.4MB

                                                              Download
                                                            • memory/3836-124-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/3848-348-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/3888-344-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/3932-276-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/3980-222-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/4036-212-0x0000000008110000-0x0000000008160000-memory.dmp
                                                              Filesize

                                                              320KB

                                                              Download
                                                            • memory/4036-252-0x0000000019F00000-0x0000000019F27000-memory.dmp
                                                              Filesize

                                                              156KB

                                                              Download
                                                            • memory/4036-213-0x0000000008170000-0x000000000817D000-memory.dmp
                                                              Filesize

                                                              52KB

                                                              Download
                                                            • memory/4036-219-0x0000000015190000-0x00000000151A0000-memory.dmp
                                                              Filesize

                                                              64KB

                                                              Download
                                                            • memory/4036-226-0x00000000181D0000-0x0000000018246000-memory.dmp
                                                              Filesize

                                                              472KB

                                                              Download
                                                            • memory/4036-214-0x00000000082D0000-0x00000000082FA000-memory.dmp
                                                              Filesize

                                                              168KB

                                                              Download
                                                            • memory/4036-211-0x00000000080E0000-0x00000000080FA000-memory.dmp
                                                              Filesize

                                                              104KB

                                                              Download
                                                            • memory/4036-269-0x0000000019420000-0x0000000019451000-memory.dmp
                                                              Filesize

                                                              196KB

                                                              Download
                                                            • memory/4036-208-0x0000000008053000-0x000000000806E000-memory.dmp
                                                              Filesize

                                                              108KB

                                                              Download
                                                            • memory/4036-215-0x0000000015140000-0x000000001516F000-memory.dmp
                                                              Filesize

                                                              188KB

                                                              Download
                                                            • memory/4036-250-0x00000000195E0000-0x00000000195F4000-memory.dmp
                                                              Filesize

                                                              80KB

                                                              Download
                                                            • memory/4036-248-0x00000000184B0000-0x0000000018578000-memory.dmp
                                                              Filesize

                                                              800KB

                                                              Download
                                                            • memory/4036-246-0x0000000018420000-0x000000001849E000-memory.dmp
                                                              Filesize

                                                              504KB

                                                              Download
                                                            • memory/4036-244-0x00000000183F0000-0x0000000018407000-memory.dmp
                                                              Filesize

                                                              92KB

                                                              Download
                                                            • memory/4036-209-0x00000000080B0000-0x00000000080C1000-memory.dmp
                                                              Filesize

                                                              68KB

                                                              Download
                                                            • memory/4036-241-0x00000000183A0000-0x00000000183DC000-memory.dmp
                                                              Filesize

                                                              240KB

                                                              Download
                                                            • memory/4036-198-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/4036-205-0x0000000014B90000-0x0000000015132000-memory.dmp
                                                              Filesize

                                                              5.6MB

                                                              Download
                                                            • memory/4036-207-0x0000000008080000-0x00000000080A6000-memory.dmp
                                                              Filesize

                                                              152KB

                                                              Download
                                                            • memory/4112-520-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/4136-530-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/4168-367-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/4212-368-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/4348-370-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/4372-371-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/4544-374-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/4580-375-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/4644-377-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/4664-378-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/4684-531-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/4692-533-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/4728-527-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/4732-523-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/4832-524-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/4868-532-0x0000000000000000-mapping.dmp
                                                              Download
                                                            • memory/4916-534-0x0000000000000000-mapping.dmp
                                                              Download