Overview

overview

8

Static

static

1

01c779a055...fc.exe

windows7_x64

8

01c779a055...fc.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    114s
  • max time network
    14s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    23-05-2022 18:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    01c779a0554bca6291489e79e6011ccc2b5eb2e4ed1ae4b7bd023e75cd3c98fc.exe

  • Size

    199KB

  • MD5

    540344e732f436a75fb8aa3559df919c

  • SHA1

    b9985854f9cc1a3e68455e174bc5a10a0ae6bda5

  • SHA256

    01c779a0554bca6291489e79e6011ccc2b5eb2e4ed1ae4b7bd023e75cd3c98fc

  • SHA512

    b3dcfc84cdafcc33d3368c13a82663f682919f5a58d4543f3f11ef52094c1db8a573ff5679966a5613dffe2610c73748c1dc48d14a1a0058a8feae92c219dd92

Score
8/10
bootkitdiscoverypersistence

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 29 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 14 IoCs
    installer
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\01c779a0554bca6291489e79e6011ccc2b5eb2e4ed1ae4b7bd023e75cd3c98fc.exe
    "C:\Users\Admin\AppData\Local\Temp\01c779a0554bca6291489e79e6011ccc2b5eb2e4ed1ae4b7bd023e75cd3c98fc.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C copy /b "KeLe2014Beta3.6.2Promote0326_20090195130.exe" + "C:\Windows\Fonts\SIMSUN.TTC" "KeLe2014Beta3.6.2Promote0326_20090195130.exe"
      2⤵
        PID:328
      • C:\Users\Admin\AppData\Local\Temp\nsyE044.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe
        KeLe2014Beta3.6.2Promote0326_20090195130.exe
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:872
        • C:\Program Files (x86)\Kele55\ServiceClient.exe
          "C:\Program Files (x86)\Kele55\ServiceClient.exe" -i
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:268
          • C:\Windows\SysWOW64\net.exe
            net start GuaGua-Service
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1364
        • C:\Program Files (x86)\Kele55\Kele55.exe
          "C:\Program Files (x86)\Kele55\Kele55.exe" -autorunroom
          3⤵
            PID:1208
            • C:\Program Files (x86)\Kele55\Update.exe
              "C:\Program Files (x86)\Kele55\Update.exe" 4.358
              4⤵
                PID:1880
          • C:\Users\Admin\AppData\Local\Temp\nsyE044.tmp\zzaz_01.exe
            zzaz_01.exe
            2⤵
              PID:432
            • C:\Users\Admin\AppData\Local\Temp\nsyE044.tmp\install1078565.exe
              install1078565.exe
              2⤵
                PID:2332
                • C:\Program Files (x86)\Rising\RSD\popwndexe.exe
                  "C:\Program Files (x86)\Rising\RSD\popwndexe.exe"
                  3⤵
                    PID:2624
                  • C:\Windows\system32\regsvr32.exe
                    "C:\Windows\system32\regsvr32.exe" /s RavExt64.dll
                    3⤵
                      PID:2980
                    • C:\Program Files (x86)\Rising\RAV\ravmond.exe
                      "C:\Program Files (x86)\Rising\RAV\ravmond.exe" -srv setup /SLIENCE
                      3⤵
                        PID:388
                    • C:\Program Files\Internet Explorer\iexplore.exe
                      "C:\Program Files\Internet Explorer\iexplore.exe" http://zhihuiweihai.net/MDFjNzc5YTA1NTRiY2E2MjkxNDg5ZTc5ZTYwMTFjY2MyYjVlYjJlNGVkMWFlNGI3YmQwMjNlNzVjZDNjOThmYy5leGU=/40.html
                      2⤵
                        PID:2672
                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
                          3⤵
                            PID:2740
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /C copy /b "Baidu_Com_90000294.exe" + "C:\Windows\Fonts\SIMSUN.TTC" "Baidu_Com_90000294.exe"
                          2⤵
                            PID:3032
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /C copy /b "2345Explorer_329242_silence.exe" + "C:\Windows\Fonts\SIMSUN.TTC" "2345Explorer_329242_silence.exe"
                            2⤵
                              PID:1632
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /C copy /b "SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe" + "C:\Windows\Fonts\SIMSUN.TTC" "SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe"
                              2⤵
                                PID:1484
                              • C:\Users\Admin\AppData\Local\Temp\nsyE044.tmp\SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
                                SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
                                2⤵
                                  PID:2596
                                  • C:\Windows\SysWOW64\regsvr32.exe
                                    "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\SHBHO.dll"
                                    3⤵
                                      PID:2984
                                    • C:\Windows\SysWOW64\regsvr32.exe
                                      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\SHIEPlugin.dll"
                                      3⤵
                                        PID:2680
                                      • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\FileAssociationsTool.exe
                                        "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\FileAssociationsTool.exe" /EnableAutoRun
                                        3⤵
                                          PID:2024
                                        • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\FileAssociationsTool.exe
                                          "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\FileAssociationsTool.exe" /ModifyMainShortcut
                                          3⤵
                                            PID:1072
                                          • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\FileAssociationsTool.exe
                                            "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\FileAssociationsTool.exe" /F
                                            3⤵
                                              PID:2924
                                            • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\FileAssociationsTool.exe
                                              "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\FileAssociationsTool.exe" /TSet
                                              3⤵
                                                PID:2136
                                              • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\FileAssociationsTool.exe
                                                "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\FileAssociationsTool.exe" /ReleaseSWF
                                                3⤵
                                                  PID:2300
                                                • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\FileAssociationsTool.exe
                                                  "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\FileAssociationsTool.exe" /InstallSuccess 0
                                                  3⤵
                                                    PID:2320
                                                  • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\FileAssociationsTool.exe
                                                    "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\FileAssociationsTool.exe" /ChangeSohuVARunToSHplayerRun
                                                    3⤵
                                                      PID:1640
                                                    • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\FileAssociationsTool.exe
                                                      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\FileAssociationsTool.exe" /PreventPinning "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\搜狐影音\卸载搜狐影音.lnk"
                                                      3⤵
                                                        PID:2480
                                                      • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\SHPlayer.exe
                                                        C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\SHPlayer.exe /auto
                                                        3⤵
                                                          PID:1360
                                                          • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\SHCefEngine.exe
                                                            "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=2008,2104274580618128580,15568793334459988732,131072 --disable-features=SameSiteByDefaultCookies --no-sandbox --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-05-23\20-04-37.log" --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.51 Safari/537.36 ifox/7.0.14.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAABQAAABAAAAAAAAAAAAAAAAYAAAAQAAAAAAAAAAEAAAAFAAAAEAAAAAAAAAABAAAABgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-05-23\20-04-37.log" --mojo-platform-channel-handle=2020 /prefetch:2
                                                            4⤵
                                                              PID:1352
                                                            • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\SHCefEngine.exe
                                                              "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\SHCefEngine.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,2104274580618128580,15568793334459988732,131072 --disable-features=SameSiteByDefaultCookies --lang=en-US --service-sandbox-type=utility --no-sandbox --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-05-23\20-04-37.log" --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.51 Safari/537.36 ifox/7.0.14.0" --lang=en-US --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-05-23\20-04-37.log" --mojo-platform-channel-handle=2856 /prefetch:8
                                                              4⤵
                                                                PID:2036
                                                              • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\SHCefEngine.exe
                                                                "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\SHCefEngine.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,2104274580618128580,15568793334459988732,131072 --disable-features=SameSiteByDefaultCookies --lang=en-US --service-sandbox-type=none --no-sandbox --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-05-23\20-04-37.log" --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.51 Safari/537.36 ifox/7.0.14.0" --lang=en-US --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-05-23\20-04-37.log" --mojo-platform-channel-handle=2892 /prefetch:8
                                                                4⤵
                                                                  PID:2996
                                                                • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\SHCefEngine.exe
                                                                  "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.14.0\SHCefEngine.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-05-23\20-04-37.log" --field-trial-handle=2008,2104274580618128580,15568793334459988732,131072 --disable-features=SameSiteByDefaultCookies --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-05-23\20-04-37.log" --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.51 Safari/537.36 ifox/7.0.14.0" --disable-extensions --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --mojo-platform-channel-handle=3028 /prefetch:1
                                                                  4⤵
                                                                    PID:2908
                                                            • C:\Users\Admin\AppData\Local\Temp\nsj2D99.tmp\GGExit.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\nsj2D99.tmp\GGExit.exe" 5
                                                              1⤵
                                                              • Executes dropped EXE
                                                              PID:1792
                                                            • C:\Program Files (x86)\Kele55\ResideClient.exe
                                                              ResideClient.exe
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Enumerates connected drives
                                                              • Writes to the Master Boot Record (MBR)
                                                              • Drops file in Windows directory
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:972
                                                            • C:\Program Files (x86)\Kele55\ServiceClient.exe
                                                              "C:\Program Files (x86)\Kele55\ServiceClient.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of SetWindowsHookEx
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1132
                                                            • C:\Windows\SysWOW64\net1.exe
                                                              C:\Windows\system32\net1 start GuaGua-Service
                                                              1⤵
                                                                PID:984
                                                              • C:\Program Files (x86)\Kele55\Update.exe
                                                                "C:\Program Files (x86)\Kele55\Update.exe" 4.358 1
                                                                1⤵
                                                                  PID:1364
                                                                • C:\Windows\system32\AUDIODG.EXE
                                                                  C:\Windows\system32\AUDIODG.EXE 0x524
                                                                  1⤵
                                                                    PID:2244
                                                                  • C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe
                                                                    "C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe"
                                                                    1⤵
                                                                      PID:2552
                                                                    • C:\Program Files (x86)\Rising\RAV\ravmond.exe
                                                                      "C:\Program Files (x86)\Rising\RAV\ravmond.exe"
                                                                      1⤵
                                                                        PID:528
                                                                      • C:\Windows\SysWOW64\svchost.exe
                                                                        C:\Windows\SysWOW64\svchost.exe -k netsvcs shsp
                                                                        1⤵
                                                                          PID:2872

                                                                        Network

                                                                        MITRE ATT&CK Matrix ATT&CK v6

                                                                        Initial Access

                                                                        Execution

                                                                        Persistence

                                                                        Bootkit

                                                                        1
                                                                        T1067

                                                                        Privilege Escalation

                                                                        Defense Evasion

                                                                        Credential Access

                                                                        Discovery

                                                                        Query Registry

                                                                        2
                                                                        T1012

                                                                        Peripheral Device Discovery

                                                                        1
                                                                        T1120

                                                                        System Information Discovery

                                                                        2
                                                                        T1082

                                                                        Lateral Movement

                                                                        Collection

                                                                        Exfiltration

                                                                        Command and Control

                                                                        Impact

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\$Recycle.Bin\$hf_mig$\update.dat
                                                                          Filesize

                                                                          48B

                                                                          MD5

                                                                          ffcf245ef20642a8523fca8e2fdf6bd6

                                                                          SHA1

                                                                          874aa209f82b4e0e10aec08cb6b33e851d7629a2

                                                                          SHA256

                                                                          4d56e252d6e324fd9687b830a95e7e51967079e750a775ed83caa2adccea2803

                                                                          SHA512

                                                                          4a79249c111aaebe203322a5d23224278908c58b02e3ac5e6129f1b18449a826d81d51924e510773c23950aa9a5cada5e7dbef53e32b9f3ce2dfb41d9c01b649

                                                                          Download Submit
                                                                        • C:\Documents and Settings\Default User\Local Settings\Temp\Temppc.bak
                                                                          Filesize

                                                                          48B

                                                                          MD5

                                                                          562ef1c356e2b6399b650c58a94b798b

                                                                          SHA1

                                                                          c052b2724ba761708246b39923c333738bd2e6c8

                                                                          SHA256

                                                                          dab632af8d184693b01b60eebe20fe7b878eb4d883fbfe6351b6aa16ce4b452a

                                                                          SHA512

                                                                          d2616d362ea192bd4a98e63694b90702813bf9815684f3046810a2d23342eb8d36a98ce5c6f6fc2fb341e2dc69d0b78167c68e763d2d9fe55ec04cd67af7be4c

                                                                          Download Submit
                                                                        • C:\MSOCache\ms0.dat
                                                                          Filesize

                                                                          48B

                                                                          MD5

                                                                          2b374e9742bb9f284fb41a4b43d97133

                                                                          SHA1

                                                                          d461797a82f5a4492ffecc8339a37afa87766b0e

                                                                          SHA256

                                                                          5ffe19fce13541edbe1476258402802e9f7f7dec2e65b4a222485d418a3b5f63

                                                                          SHA512

                                                                          cd10cb94d7991bae1f2a9ae2b67c2e3d918c8a30f8be4fa9a991f277c335c0227e344f28e8f27c51c89d8810afc5375a3fbac801a53b8c7b4c999f3c0852ef96

                                                                          Download Submit
                                                                        • C:\MSOCache\wcods.dat
                                                                          Filesize

                                                                          48B

                                                                          MD5

                                                                          8a9306237129a91976544edfd7bf41f6

                                                                          SHA1

                                                                          15f08cea7db047d3ef5b17280ddf9cf7cfa82981

                                                                          SHA256

                                                                          db6fa4ad14595a5b715c2503b0ebd9181cd5b90f8250d290a7bf3dbab7da1bed

                                                                          SHA512

                                                                          bfe8cb232e16f39571969f95327fdb1b97cd89d0ec8fd6a7ac9889e2ace330220f9e7b74b695f5381b8759bc0e65e61ca35e382c841c7371344c58a0fbdc6a71

                                                                          Download Submit
                                                                        • C:\Program Files (x86)\Kele55\Kele55.exe
                                                                          Filesize

                                                                          259KB

                                                                          MD5

                                                                          664ea7e283e9134e0aa5503e684c771a

                                                                          SHA1

                                                                          7c207cce171362cc04126d939608252ff5aaa22b

                                                                          SHA256

                                                                          631f7a5ef39a739baaacb07130b00e37b4785a6275ff060a9f5a6bfb77da428e

                                                                          SHA512

                                                                          707740f7dcfd4e99ada8a93cac6e69b9972eac98235a14b4be986efe0270b6b51fc37fdc7e8c8462959e3368402b59d6a34efb543e53192f3140461fcb3e855e

                                                                          Download Submit
                                                                        • C:\Program Files (x86)\Kele55\MFC71U.DLL
                                                                          Filesize

                                                                          318KB

                                                                          MD5

                                                                          4ffee67aba2319edd5d8c0c363b89ff8

                                                                          SHA1

                                                                          7b5d1c1c426387c80121ce01125cb121a543a360

                                                                          SHA256

                                                                          6b3bdbad1925adebfecc1ace641d02b9d7837a2c29666eec34c06c15557d8eb8

                                                                          SHA512

                                                                          6c5b5c18ed2906d7427659bfc029f5fbd583a2c71b83c7a05563de607d5ace66eab37275dabe94cf56283384d4ba1adf049f0ee43f3813f559e91fa10f3cac91

                                                                          Download Submit
                                                                        • C:\Program Files (x86)\Kele55\MSVCP71.dll
                                                                          Filesize

                                                                          270KB

                                                                          MD5

                                                                          600a027ebb6b4c7d1644b55f62e68881

                                                                          SHA1

                                                                          1936406dd16e9515d5123811d30bfaa868732fd1

                                                                          SHA256

                                                                          b1cf880f45a84930acc1618fdf0ffe8dcf763984b811c21290d291904c0a48f9

                                                                          SHA512

                                                                          9250a04aaf31145eb12a785902f06dca81cdcbe64841e46e41f0ae2140c0320d890d1c3829f49390150f1d01c2d501851ccd97bae267798f94de73949d8ac181

                                                                          Download Submit
                                                                        • C:\Program Files (x86)\Kele55\MSVCR71.dll
                                                                          Filesize

                                                                          345KB

                                                                          MD5

                                                                          ebb3e701588a92c36b4c902a3976e58a

                                                                          SHA1

                                                                          83cec9f2b486eb7d000aa0d716246ab044c2bf2e

                                                                          SHA256

                                                                          63ce7639ee0f0c16b7cf45c3f73b698887260bc3225cb25c26a97e2b09d92c3e

                                                                          SHA512

                                                                          23887dc229f6753100a06f9a6d3ea391d5b50778e6b239f6592675e53300fc8b4eb95796bbcf4123271213384ccf0773a1e2a09f8c68c2b58f2e6f074c7e53ac

                                                                          Download Submit
                                                                        • C:\Program Files (x86)\Kele55\ResideClient.exe
                                                                          Filesize

                                                                          255KB

                                                                          MD5

                                                                          e2955e16ad73c1398783d26a9f076acd

                                                                          SHA1

                                                                          7291d53ba36ac70efec249eac4041dc3214d3e32

                                                                          SHA256

                                                                          56f0df008269e332a43754ebc1a73840ea544d2d95ddd6fd270becf467f15f59

                                                                          SHA512

                                                                          2c91871824d88c388c79d2ae3e357cb56bacbead92dbd6fba2606ae21b7fb7aeb794f157087a3de92ad482dca153cf7f7e0f9a0b0e1fb70d1dcd8e9813ebae01

                                                                          Download Submit
                                                                        • C:\Program Files (x86)\Kele55\ResideClient.exe
                                                                          Filesize

                                                                          238KB

                                                                          MD5

                                                                          f74918146d01b427149d17d6e4cff721

                                                                          SHA1

                                                                          2155fb5e8d6e300f1ff340577c5d08012b2aa5ed

                                                                          SHA256

                                                                          6303501ced77097d3d62c4fd4a459f43e64012b1a8381a52c459c4a8d2fa58a6

                                                                          SHA512

                                                                          12f07c0f4e530feaeb9f232d32b771f600742ad5c273681e507de015538648b876b57ef067365458f4dd00d06119d58842a781c8f20e324f0530efdb12cefade

                                                                          Download Submit
                                                                        • C:\Program Files (x86)\Kele55\ServiceClient.dll
                                                                          Filesize

                                                                          109KB

                                                                          MD5

                                                                          94bc1d61355ac31197fb1d7263e1e44a

                                                                          SHA1

                                                                          ee38f54ad37a521fac824aaa123640b67f30aee4

                                                                          SHA256

                                                                          201af1c684cbf2447c2c87b9703f28813c66877e2296486e3a1a1dc451102087

                                                                          SHA512

                                                                          3f52803761a0c5ac967025bbc0e3c80de59b35e1c55c7d273fbdbb315fb685fde9fd3f338ecc4c18d6836168d38ae93d4f9de47259579d4558b402cb9971502d

                                                                          Download Submit
                                                                        • C:\Program Files (x86)\Kele55\ServiceClient.exe
                                                                          Filesize

                                                                          113KB

                                                                          MD5

                                                                          f73dfe587bb6dfb7a3fb792757daa066

                                                                          SHA1

                                                                          d48e893245b1b55f73730fd887a0a02ba1d65486

                                                                          SHA256

                                                                          84736855ef4b0143d1fe4c97953d70c85d5ffd442ff1e83fd417b22441ec0771

                                                                          SHA512

                                                                          6ac4ce1169a3132cf788bd81811e5fc7ca40e61ae327b0be13dc43cb7c9a94aa60bd9f8723559a4801d21298d59ebed8db004d91b2efb5648d48e6177b034df1

                                                                          Download Submit
                                                                        • C:\Program Files (x86)\Kele55\ServiceClient.exe
                                                                          Filesize

                                                                          113KB

                                                                          MD5

                                                                          f73dfe587bb6dfb7a3fb792757daa066

                                                                          SHA1

                                                                          d48e893245b1b55f73730fd887a0a02ba1d65486

                                                                          SHA256

                                                                          84736855ef4b0143d1fe4c97953d70c85d5ffd442ff1e83fd417b22441ec0771

                                                                          SHA512

                                                                          6ac4ce1169a3132cf788bd81811e5fc7ca40e61ae327b0be13dc43cb7c9a94aa60bd9f8723559a4801d21298d59ebed8db004d91b2efb5648d48e6177b034df1

                                                                          Download Submit
                                                                        • C:\Program Files (x86)\Kele55\crashreport.dll
                                                                          Filesize

                                                                          233KB

                                                                          MD5

                                                                          dc3080b8a568a302baf3d5029a21eab9

                                                                          SHA1

                                                                          ba5a7086f39add4a1c0fa18d89c9a615991ee382

                                                                          SHA256

                                                                          58bfa00054031fd55157dbfde8f639ac3e5e7e79047b8c362cd358a4661f196e

                                                                          SHA512

                                                                          699b8f7cb78f3ee3f6d5ef2e746f947fc38963ceadf37d675eb3797e343213be65e618c2cc379becd626f321b11fe81a8b9f9b08134231651eec741e60e54886

                                                                          Download Submit
                                                                        • C:\Program Files (x86)\Kele55\skin\MercuryChatHallSkin.ggs
                                                                          Filesize

                                                                          266KB

                                                                          MD5

                                                                          256356874f5011aa9474c1a4ad6b6982

                                                                          SHA1

                                                                          46be685cabdd3fc30de02571b9b46b04730554c6

                                                                          SHA256

                                                                          d84d2d4a45dc782b5e526b76b11251f04569557e58d2d8ce7ad484ff9615cfcc

                                                                          SHA512

                                                                          8eb1461474bb18c55e8ab9efb8114d8b0049df50b767714467ad66ef31ef9089544f661df2afda433428be7544a910c977e2bb913145be96b9ceda5f423d490d

                                                                          Download Submit
                                                                        • C:\Users\Admin\AppData\Local\Temp\nsj2D99.tmp\GGExit.exe
                                                                          Filesize

                                                                          54KB

                                                                          MD5

                                                                          14607f1d7790612a9ca212f4ab8f605a

                                                                          SHA1

                                                                          060450216bc1daeb380562f65358300f594f0b86

                                                                          SHA256

                                                                          e36913e299219488cae06555019aceb086d66d8d1d5024b9405933d4b3abec67

                                                                          SHA512

                                                                          611895f78dab311ace1ab14a5dd630e230b9884c5acf95232ccc13c75805c3da26d3d26304c3e341a85834d05dc1826394305fcefa5f2839bdf88f4c0ce9c868

                                                                          Download Submit
                                                                        • C:\Users\Admin\AppData\Local\Temp\nsyE044.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe
                                                                          Filesize

                                                                          167KB

                                                                          MD5

                                                                          9bae5c4474994b1c9ad321b2dddeb184

                                                                          SHA1

                                                                          aa4bcb0861adf4a2a1c958e9b1d36eb25b71f58f

                                                                          SHA256

                                                                          ff7a9477fb6d52b369659c4f6f84c46008af3dc144cc64ac838530ae160eb8f2

                                                                          SHA512

                                                                          66040153649bf99f039c009fdff53b75eb2e632ddd1c02c9f5e1793d4ce31d518411b3e6f70dd9194b92228a655a9e2b718d0cdc1bf5ffec68202b7f214dab2b

                                                                          Download Submit
                                                                        • C:\Users\Admin\AppData\Local\Temp\nsyE044.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe
                                                                          Filesize

                                                                          155KB

                                                                          MD5

                                                                          7aadd323a27f5be2a6bbd77f1e5a41a9

                                                                          SHA1

                                                                          6d769bb51d97b8b3a5557af699c4b7a29043106f

                                                                          SHA256

                                                                          3b8abd8820f0c2a77766a4413ec1cdd2af5a99b463ed3e5666125c649d062c3f

                                                                          SHA512

                                                                          404bf9f9ac3b34236d8df058790a9c170c843bfaf2a83a937250030b0ac532eaf1a324cd27c173ec000e0c6095e7606d9358d2b7c533e75519c985f4cc3dfad4

                                                                          Download Submit
                                                                        • C:\Users\Admin\AppData\Local\Temp\nsyE044.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe
                                                                          Filesize

                                                                          130KB

                                                                          MD5

                                                                          9d05c9d81cc541ae5ca9c4c638b0064e

                                                                          SHA1

                                                                          0eda7e2d43420d7e9b6e865a27bd843573ad9f56

                                                                          SHA256

                                                                          3cc5082edb82ae1bbfd8685e971182eaf174e24a5085019e8bb9e089557efdad

                                                                          SHA512

                                                                          7709f56c5a7cc2981fd89f137a5225ec7c1718926d46d1442e38e429730408f36a85f6526881c6c47dc6b08e1e164a463558316643c14bf9301aed3cf05527cb

                                                                          Download Submit
                                                                        • C:\Users\Admin\AppData\Local\Temp\nsyE044.tmp\zzaz_01.exe
                                                                          Filesize

                                                                          380KB

                                                                          MD5

                                                                          5a9fe2f8afc1490761a4719eb6e872c1

                                                                          SHA1

                                                                          03fde2996084e4bc8827c4009991b3c962e8e138

                                                                          SHA256

                                                                          0a7a0e36ced2797ffdb00f9ab80b87f070ae7c0037a808d7cf8479a5c30aa7fd

                                                                          SHA512

                                                                          50dfc4c65e7da095bfb379cdd26da46deaaf6a2c1e38f403e33cf4896c6baff3be7f3a317fe0c485b92c6a0e9f58b0d1a9b7fc92a7fc843bd09e499f464c7250

                                                                          Download Submit
                                                                        • C:\Users\Admin\AppData\Local\Temp\nsyE044.tmp\zzaz_01.exe
                                                                          Filesize

                                                                          353KB

                                                                          MD5

                                                                          843bab048a252cb080c5cbf82636484c

                                                                          SHA1

                                                                          347b023d8f7f51a976a5613c5e7cb67ac3642e8b

                                                                          SHA256

                                                                          5ad47adaaa7d9b4fa56d71ed0abf5d0498a4134cd29bed3b7e6161249e027e3a

                                                                          SHA512

                                                                          4c22b9c721f80d302a2082b4b4348c135e9f139ba9b43801e3763ef667e2cb7b308c59a34185d12e872c5d5cbc117099ac089282ea603be73175539a4ba0f039

                                                                          Download Submit
                                                                        • C:\WINDOWS\gsyspd.log
                                                                          Filesize

                                                                          48B

                                                                          MD5

                                                                          a79ad2a4062d54e70f3bbe9d8dca4596

                                                                          SHA1

                                                                          e0021c3f1396394f4a4a5e4fdc47b30c149695c4

                                                                          SHA256

                                                                          23c5fec8347218c7e558399a4cf3ce6be88b5d3555d6b493df07c44ae93adefa

                                                                          SHA512

                                                                          68c9a8dbdfd2977124a466d4b9dcef57722bfd5a788d2b9e669e298424bea5c4e5c90cf93421299c16a7f8d592a09ab34e460aa1d831164f8a585e9a58a88292

                                                                          Download Submit
                                                                        • C:\WINDOWS\msgpi.log
                                                                          Filesize

                                                                          48B

                                                                          MD5

                                                                          7dbbcb328a9e54e83de7d98da9864457

                                                                          SHA1

                                                                          e6918b1dd28f00fd993486e581c51a27130591ea

                                                                          SHA256

                                                                          ca669363900cd877b38d16bf15fc305c050f4d9bfdd040d98bbd9035920b5262

                                                                          SHA512

                                                                          3de0921d4c972be4c4f11d106d539dc04f0aa51a9b5a9646b21cda465000c67dc93715d94242ab30ce5d87f899455885bf8ad9771978c2b64dfc4ae5cabc9e65

                                                                          Download Submit
                                                                        • C:\ghos\giex
                                                                          Filesize

                                                                          48B

                                                                          MD5

                                                                          d06c85405a75da0c8ffcd03589d7b76e

                                                                          SHA1

                                                                          32f208ea885f1e63ede5e14cb3feba0dd6136cb7

                                                                          SHA256

                                                                          e79b2f2d67edb9a84a07037d5a228d639219ad6e111d621519416187e983dd9f

                                                                          SHA512

                                                                          09fd07143d457df005e9e73df0a6981670e9809fdfa7fee56ec698ce115192a479a114e59395f8acc0713178a0b9e3c60829e47a666812d2b170aba47fc124b1

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\ChatRoomUI.ocx
                                                                          Filesize

                                                                          33KB

                                                                          MD5

                                                                          a50b61d2a7ea450615f817419bcad8ed

                                                                          SHA1

                                                                          12b85bb0e9695f25866a7bcedcffa72fe7e9ef75

                                                                          SHA256

                                                                          82b62d74cc6be6b9925ada79f56952385c8dfe800ad8f6dd375fa090bd371c05

                                                                          SHA512

                                                                          3a13d880278aa155454254c67622b40608a1628dd31550aa14b24ed5739e71ef9bf7b1d3ea28fe7968e234337728600dc19f63a621c39f3b9936ad4adb214b2f

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\Kele55.exe
                                                                          Filesize

                                                                          337KB

                                                                          MD5

                                                                          ce14c5a4b954830aa2e1c7fc7c4f928f

                                                                          SHA1

                                                                          dbebe86ba6655a966fb4c8ff129602f59414df0e

                                                                          SHA256

                                                                          0a154cdf32372c7101ead8044973551535070050f1fffdfa1212333c56a459e9

                                                                          SHA512

                                                                          34539d6564ed47e3bf66178133ce8a0d86b3b55215c680adb4342c1a1c121b6dbac6ae8f5b284c2e4f38ead61af28839f26b7c7ef1734058470b5644da632783

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\Kele55.exe
                                                                          Filesize

                                                                          275KB

                                                                          MD5

                                                                          ce13794dbc82ac99eccc0a9c2f5a1c08

                                                                          SHA1

                                                                          204bb8a1af98a62f0428da037b96ad79581f169a

                                                                          SHA256

                                                                          c0498a686facc5fdb72ddfa9aaa88b2914373842c5cd62a4d816e12ac8499f70

                                                                          SHA512

                                                                          294a20539601f85d42fa1640e793d7c9cd1136b15438c4fde49f87c6f65a8666237d3d7509cf824dc4e5b9ea8acbf2852ab37520a240a9cfc245becff6279103

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\Kele55.exe
                                                                          Filesize

                                                                          307KB

                                                                          MD5

                                                                          42f70f3e6c1c3ad181fc04c16b0418a3

                                                                          SHA1

                                                                          b5b3756c1920560d37e08f276445e81fb73b971a

                                                                          SHA256

                                                                          eece4364c7b177c11b234c275fbc95f3d0a7bfff0a23015ad484f14175d28a1e

                                                                          SHA512

                                                                          708504b198e512584f38c2ee2f509078e57c3cbc108f7c060b1fbaafa991adab2e7ab4179fde22f58495410de078208be2f6d46bdf2615ced830804454c1efaa

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\MFC71u.dll
                                                                          Filesize

                                                                          270KB

                                                                          MD5

                                                                          cd528a4fcd6fbff8b7bc4ed6fdfe83a1

                                                                          SHA1

                                                                          a1d9205ba666e2faa9c2e4c1aac71a72d5688dbf

                                                                          SHA256

                                                                          9e1f802340e50093b20178a4fdb40321d4689ded472e5409b2577709224b479b

                                                                          SHA512

                                                                          a174299c3528bf4e7f22a226e2d15e08ca688214b299c066b14fc62538276af468b3e47338138b83b15e0a6fa3d78d9a7f8b03d1b33f856c25e64c39b8c6dcdb

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\MFC71u.dll
                                                                          Filesize

                                                                          318KB

                                                                          MD5

                                                                          efb0f45c128b12c04b7449b6a0b4499e

                                                                          SHA1

                                                                          232c412f1b9a7fd5c4207edd0f4d4e5d369c9886

                                                                          SHA256

                                                                          78ac26b4b1414e2dc69dd46882c36f23c4b970d505a4b8f8d37204e8cd54a0c4

                                                                          SHA512

                                                                          eb35652c128f7e822a3d6830c5fc8e3c6a62b699795ea5559462b952b5713aa3bae12df398939a117522de7bec02bc4cd6259ec88b3a9189437313532f00ab42

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\MFC71u.dll
                                                                          Filesize

                                                                          292KB

                                                                          MD5

                                                                          79ed4be0844d595e29370ce730d9d7ae

                                                                          SHA1

                                                                          ad9ddd07fffc26f09191f2bd8c07683bdf2f3b9a

                                                                          SHA256

                                                                          af82c6b8e2d5700181f665336e446df3d5f2bc0395928f0330c796d3ea9a14ff

                                                                          SHA512

                                                                          777610ffc94b47ce64f7ccc8948f062436837923415ae536b0bb4f16853cc76612bd1761b6c3961c4547f84b60a620b3ef540bc917c01234cad8fc85c6f889ba

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\MFC71u.dll
                                                                          Filesize

                                                                          335KB

                                                                          MD5

                                                                          fe3a69ea03cdc0dde6bef186aa6ef137

                                                                          SHA1

                                                                          3b37cf141fb6d75a8a21fc3e37be85d18ce8d10b

                                                                          SHA256

                                                                          211af447570d1924a9b97501f25bd6ba39bf6aab328ef2b550ecb69e995a4a95

                                                                          SHA512

                                                                          0d079ea705e902984aea74e05b5551e09874a95ff0c7e0146e5b50963920700f8cc3d86fc6b17b4ed667f5fdbfb1188a70ff28901861783da4f2907272998dc4

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\MFC71u.dll
                                                                          Filesize

                                                                          395KB

                                                                          MD5

                                                                          60321cf1a8714e8d3276766c9bb4f5f4

                                                                          SHA1

                                                                          9dde206c886d51de207ec7c7d04d9b467c10f204

                                                                          SHA256

                                                                          0e4575bb4ffbfa5966b7394c633ae9de05a8cf870dba2c4d358a8e299128d035

                                                                          SHA512

                                                                          85d93df0b4665a792f49fbd65ce5e6f73499464e6b2bf82c0724c1f63e550276d0bfe496dfa4da6324d3d213484878d64b3036a635c7176d9dc037667a446bee

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\RecommendInfo.dll
                                                                          Filesize

                                                                          124KB

                                                                          MD5

                                                                          28a7c4d28b9429dc0b277544f35478ce

                                                                          SHA1

                                                                          5c7dfad99c0c700a7c1a4b27cb3dba4b351ac8b7

                                                                          SHA256

                                                                          3a13870a07dc5d122918610934f1696f7744f53dbeee4aec7595a1228ea1d36f

                                                                          SHA512

                                                                          5917855b1f97b8545e090f470403cd201e93180857c24d27784a9971b25c0209944c0202a75efe18032c6a0ceab6b8309cf5fa8022547e9dd1e6a780364f5d78

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\ResideClient.exe
                                                                          Filesize

                                                                          269KB

                                                                          MD5

                                                                          45ae1e6a8f463423b859bc8fa3a9e41e

                                                                          SHA1

                                                                          3da933875c781808386236416d8d43f65873ce92

                                                                          SHA256

                                                                          54c6a23f1dac64c85f9cd15bc95ae55ba3010ae5c8f93a3d8ac8bbdff2f76d38

                                                                          SHA512

                                                                          6afc43b8e58645273c1383ee3488e03b081228bc1fe62984163c21dd10ee87bdd001cb66f5695f77f7b213b8732c8a6cf847ef84650b4548406e9b399f471389

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\ResideClient.exe
                                                                          Filesize

                                                                          269KB

                                                                          MD5

                                                                          45ae1e6a8f463423b859bc8fa3a9e41e

                                                                          SHA1

                                                                          3da933875c781808386236416d8d43f65873ce92

                                                                          SHA256

                                                                          54c6a23f1dac64c85f9cd15bc95ae55ba3010ae5c8f93a3d8ac8bbdff2f76d38

                                                                          SHA512

                                                                          6afc43b8e58645273c1383ee3488e03b081228bc1fe62984163c21dd10ee87bdd001cb66f5695f77f7b213b8732c8a6cf847ef84650b4548406e9b399f471389

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\ServiceClient.dll
                                                                          Filesize

                                                                          109KB

                                                                          MD5

                                                                          94bc1d61355ac31197fb1d7263e1e44a

                                                                          SHA1

                                                                          ee38f54ad37a521fac824aaa123640b67f30aee4

                                                                          SHA256

                                                                          201af1c684cbf2447c2c87b9703f28813c66877e2296486e3a1a1dc451102087

                                                                          SHA512

                                                                          3f52803761a0c5ac967025bbc0e3c80de59b35e1c55c7d273fbdbb315fb685fde9fd3f338ecc4c18d6836168d38ae93d4f9de47259579d4558b402cb9971502d

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\ServiceClient.exe
                                                                          Filesize

                                                                          113KB

                                                                          MD5

                                                                          f73dfe587bb6dfb7a3fb792757daa066

                                                                          SHA1

                                                                          d48e893245b1b55f73730fd887a0a02ba1d65486

                                                                          SHA256

                                                                          84736855ef4b0143d1fe4c97953d70c85d5ffd442ff1e83fd417b22441ec0771

                                                                          SHA512

                                                                          6ac4ce1169a3132cf788bd81811e5fc7ca40e61ae327b0be13dc43cb7c9a94aa60bd9f8723559a4801d21298d59ebed8db004d91b2efb5648d48e6177b034df1

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\crashreport.dll
                                                                          Filesize

                                                                          233KB

                                                                          MD5

                                                                          dc3080b8a568a302baf3d5029a21eab9

                                                                          SHA1

                                                                          ba5a7086f39add4a1c0fa18d89c9a615991ee382

                                                                          SHA256

                                                                          58bfa00054031fd55157dbfde8f639ac3e5e7e79047b8c362cd358a4661f196e

                                                                          SHA512

                                                                          699b8f7cb78f3ee3f6d5ef2e746f947fc38963ceadf37d675eb3797e343213be65e618c2cc379becd626f321b11fe81a8b9f9b08134231651eec741e60e54886

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\msvcp71.dll
                                                                          Filesize

                                                                          402KB

                                                                          MD5

                                                                          2926aa233d8031419be6cca112dbcbb0

                                                                          SHA1

                                                                          936f52730603eae8b91a8169d10ba324556cfbd5

                                                                          SHA256

                                                                          e7100b4bdd70fa75f66a8f6b57896ffb22f28b429136dd73ca5026a523c5e0ab

                                                                          SHA512

                                                                          615afcd4d8cf14a245bfefa81b9cabe9ff792ed19acf44ed610c5cf6cf455154995f36cc13fe8f2639bbe07745832196c608a6d2fe34749c2767b31cee8bae2d

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\msvcp71.dll
                                                                          Filesize

                                                                          335KB

                                                                          MD5

                                                                          1e97c85b667e45561101042add87c9b0

                                                                          SHA1

                                                                          669e02b9bf1742b50f808c81d708cceff3770d66

                                                                          SHA256

                                                                          2fe2406546d3fe0a92c1b6e5ae949fde42b62d498c77ed9583287aeb50090616

                                                                          SHA512

                                                                          5425f1eb95397e42f36164eb16530c95fc8ca7b2de372609b83ae51ab2a2da677e508eacddf8de1759434046916b31adbb7f5cc0bc43816f885f99d2b9b2b72e

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\msvcp71.dll
                                                                          Filesize

                                                                          391KB

                                                                          MD5

                                                                          78c90fa64e41d2fcb18ca197b8cacfb3

                                                                          SHA1

                                                                          ced43fe4dbaf4a921257878976c8ea62a7a9df5d

                                                                          SHA256

                                                                          3fc36c96fe98261e46866fbba933c411667b7587a08e31317e80c94db2a98994

                                                                          SHA512

                                                                          eccab60cdeb25cefd32c4f2de3622797ff05e4dc70e6957cd17b6aa92986979aa18f723b882dd56447ae7f00c858a2ce757dd55eef6d278d56f5fe918177f760

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\msvcr71.dll
                                                                          Filesize

                                                                          204KB

                                                                          MD5

                                                                          e784d8da97b45ee7d126a1869c897559

                                                                          SHA1

                                                                          36cbd3bae284b1b69583877375d922bb2751f736

                                                                          SHA256

                                                                          b2ffc342bb1d402fac186f1bd59215a9ab80d224f8fc486ca581a1272c9b912f

                                                                          SHA512

                                                                          e8e61056e4d94d0047825dbcba7e77fe628be13be3ee06af9dcce8f43f5d795281ceb4a2ba70c76681e1c43522b97bf528cbcaa45dba596b1c93da4cb1277c31

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\msvcr71.dll
                                                                          Filesize

                                                                          312KB

                                                                          MD5

                                                                          6ed25a80712c07ba6c125259a08da2c3

                                                                          SHA1

                                                                          3c0056065ce233eefb5c66cf250aba700eae15b1

                                                                          SHA256

                                                                          f60841c77aab751728c1e029be5baae54bb389b2917c3c70d9c4fa76d70d9b56

                                                                          SHA512

                                                                          316d749ba65c8285b682ed4107d2d658903c179f7e90c6b93b00be193031537a7ced934a3a568252b9f9f646cc296eedc29bb0bd4290d070139bd228fcf308b2

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\msvcr71.dll
                                                                          Filesize

                                                                          303KB

                                                                          MD5

                                                                          d840f211f86a9e246f9b3c489da0f5ad

                                                                          SHA1

                                                                          08f28ad2b2223304d5707810cce4e542ccc5eb5e

                                                                          SHA256

                                                                          f98c4f2688898e77558099bd72bfc2969357dc678997625688802aa8dffa3094

                                                                          SHA512

                                                                          9769e9fd27492819f152e421e847a7ba46aa02d617662dcfefa46370c7fb6e3f945df1a179e62ccb06a2b70e92d257728976d2993d8445fddcc8aae743e743bb

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\msvcr71.dll
                                                                          Filesize

                                                                          345KB

                                                                          MD5

                                                                          ebb3e701588a92c36b4c902a3976e58a

                                                                          SHA1

                                                                          83cec9f2b486eb7d000aa0d716246ab044c2bf2e

                                                                          SHA256

                                                                          63ce7639ee0f0c16b7cf45c3f73b698887260bc3225cb25c26a97e2b09d92c3e

                                                                          SHA512

                                                                          23887dc229f6753100a06f9a6d3ea391d5b50778e6b239f6592675e53300fc8b4eb95796bbcf4123271213384ccf0773a1e2a09f8c68c2b58f2e6f074c7e53ac

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\msvcr71.dll
                                                                          Filesize

                                                                          273KB

                                                                          MD5

                                                                          21eacdef88e73434b27a6648fa10b4b4

                                                                          SHA1

                                                                          463dd45ec570467cd0d67ac80fc13934a7e49928

                                                                          SHA256

                                                                          a8c9a2bb692f2c9da9cc8e8985ca603c1e6e2e859c9bbfa557e62c401107193f

                                                                          SHA512

                                                                          746178534bdf6a21494c5af1eb492bd5818d5d4003f2b67da0765a5e0299c1ee6d9c1c81c8f2b84df84340b54e47fff913a40ebde01d41e8e145ced0e49827bf

                                                                          Download Submit
                                                                        • \Program Files (x86)\Kele55\msvcr71.dll
                                                                          Filesize

                                                                          321KB

                                                                          MD5

                                                                          d717527bae140d234b2e36900d518255

                                                                          SHA1

                                                                          9f8a0446198d996358c5323347cf4d6b33cf52d5

                                                                          SHA256

                                                                          ddf2335fd105fbf63743648475ddad1eaddfe1cbe4613fbfcd4b930a82007013

                                                                          SHA512

                                                                          5d78c9b78977ec76552eefedd4ae1670119d328cdf01016cca13a8bab6fde0e3ea2f73d6e38c0a871c2d1441fcf2d36c21166bf2ca363eaf2888b118053b688a

                                                                          Download Submit
                                                                        • \Users\Admin\AppData\Local\Temp\nsj2D99.tmp\GGExit.exe
                                                                          Filesize

                                                                          54KB

                                                                          MD5

                                                                          14607f1d7790612a9ca212f4ab8f605a

                                                                          SHA1

                                                                          060450216bc1daeb380562f65358300f594f0b86

                                                                          SHA256

                                                                          e36913e299219488cae06555019aceb086d66d8d1d5024b9405933d4b3abec67

                                                                          SHA512

                                                                          611895f78dab311ace1ab14a5dd630e230b9884c5acf95232ccc13c75805c3da26d3d26304c3e341a85834d05dc1826394305fcefa5f2839bdf88f4c0ce9c868

                                                                          Download Submit
                                                                        • \Users\Admin\AppData\Local\Temp\nsj2D99.tmp\GGExit.exe
                                                                          Filesize

                                                                          54KB

                                                                          MD5

                                                                          14607f1d7790612a9ca212f4ab8f605a

                                                                          SHA1

                                                                          060450216bc1daeb380562f65358300f594f0b86

                                                                          SHA256

                                                                          e36913e299219488cae06555019aceb086d66d8d1d5024b9405933d4b3abec67

                                                                          SHA512

                                                                          611895f78dab311ace1ab14a5dd630e230b9884c5acf95232ccc13c75805c3da26d3d26304c3e341a85834d05dc1826394305fcefa5f2839bdf88f4c0ce9c868

                                                                          Download Submit
                                                                        • \Users\Admin\AppData\Local\Temp\nsj2D99.tmp\System.dll
                                                                          Filesize

                                                                          10KB

                                                                          MD5

                                                                          2b54369538b0fb45e1bb9f49f71ce2db

                                                                          SHA1

                                                                          c20df42fda5854329e23826ba8f2015f506f7b92

                                                                          SHA256

                                                                          761dcdf12f41d119f49dbdca9bcab3928bbdfd8edd67e314d54689811f9d3e2f

                                                                          SHA512

                                                                          25e4898e3c082632dfd493756c4cc017decbef43ffa0b68f36d037841a33f2a1721f30314a85597ac30c7ecc99b7257ea43f3a903744179578a9c65fcf57a8b7

                                                                          Download Submit
                                                                        • \Users\Admin\AppData\Local\Temp\nsy46F2.tmp\System.dll
                                                                          Filesize

                                                                          11KB

                                                                          MD5

                                                                          c17103ae9072a06da581dec998343fc1

                                                                          SHA1

                                                                          b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

                                                                          SHA256

                                                                          dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

                                                                          SHA512

                                                                          d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

                                                                          Download Submit
                                                                        • \Users\Admin\AppData\Local\Temp\nsy46F2.tmp\inetc.dll
                                                                          Filesize

                                                                          21KB

                                                                          MD5

                                                                          4b2ac1ce1a2d71e9655a92afb8f8c76b

                                                                          SHA1

                                                                          8d5086a8195e95d72667d6c7707778750ead5cdc

                                                                          SHA256

                                                                          b7481b29387fbc83ea24684919fec44eedb054d70dc7d4af81394f22184d1142

                                                                          SHA512

                                                                          b988bbc1d34e270736c073d2a2be7650c41f7d70d58671115665e48f19e8a8826f6c6e2d340ca7c82d6dd86e9c045acb9658bd4865ffd2ef71b596a7bd993ea4

                                                                          Download Submit
                                                                        • \Users\Admin\AppData\Local\Temp\nsy46F2.tmp\inetc.dll
                                                                          Filesize

                                                                          21KB

                                                                          MD5

                                                                          4b2ac1ce1a2d71e9655a92afb8f8c76b

                                                                          SHA1

                                                                          8d5086a8195e95d72667d6c7707778750ead5cdc

                                                                          SHA256

                                                                          b7481b29387fbc83ea24684919fec44eedb054d70dc7d4af81394f22184d1142

                                                                          SHA512

                                                                          b988bbc1d34e270736c073d2a2be7650c41f7d70d58671115665e48f19e8a8826f6c6e2d340ca7c82d6dd86e9c045acb9658bd4865ffd2ef71b596a7bd993ea4

                                                                          Download Submit
                                                                        • \Users\Admin\AppData\Local\Temp\nsy46F2.tmp\ip.dll
                                                                          Filesize

                                                                          16KB

                                                                          MD5

                                                                          4df6320e8281512932a6e86c98de2c17

                                                                          SHA1

                                                                          ae6336192d27874f9cd16cd581f1c091850cf494

                                                                          SHA256

                                                                          7744a495ceacf8584d4f6786699e94a09935a94929d4861142726562af53faa4

                                                                          SHA512

                                                                          7c468de59614f506a2ce8445ef00267625e5a8e483913cdd18636cea543be0ca241891e75979a55bb67eecc11a7ac0649b48b55a10e9a01362a0250839462d3b

                                                                          Download Submit
                                                                        • \Users\Admin\AppData\Local\Temp\nsyE044.tmp\Base64.dll
                                                                          Filesize

                                                                          4KB

                                                                          MD5

                                                                          f0e3845fefd227d7f1101850410ec849

                                                                          SHA1

                                                                          3067203fafd4237be0c186ddab7029dfcbdfb53e

                                                                          SHA256

                                                                          7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

                                                                          SHA512

                                                                          584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

                                                                          Download Submit
                                                                        • \Users\Admin\AppData\Local\Temp\nsyE044.tmp\ExecCmd.dll
                                                                          Filesize

                                                                          4KB

                                                                          MD5

                                                                          b9380b0bea8854fd9f93cc1fda0dfeac

                                                                          SHA1

                                                                          edb8d58074e098f7b5f0d158abedc7fc53638618

                                                                          SHA256

                                                                          1f4bd9c9376fe1b6913baeca7fb6df6467126f27c9c2fe038206567232a0e244

                                                                          SHA512

                                                                          45c3ab0f2bce53b75e72e43bac747dc0618342a3f498be8e2eb62a6db0b137fcdb1735da83051b14824996b5287109aa831e5859d6f21f0ed21b76b3d335418c

                                                                          Download Submit
                                                                        • \Users\Admin\AppData\Local\Temp\nsyE044.tmp\Inetc.dll
                                                                          Filesize

                                                                          20KB

                                                                          MD5

                                                                          50fdadda3e993688401f6f1108fabdb4

                                                                          SHA1

                                                                          04a9ae55d0fb726be49809582cea41d75bf22a9a

                                                                          SHA256

                                                                          6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

                                                                          SHA512

                                                                          e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

                                                                          Download Submit
                                                                        • \Users\Admin\AppData\Local\Temp\nsyE044.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe
                                                                          Filesize

                                                                          146KB

                                                                          MD5

                                                                          535dc21c0738974b46a5ab010f76c399

                                                                          SHA1

                                                                          0ed78a5e3d3c24b6dcdc78bfa534fd3f222080ae

                                                                          SHA256

                                                                          521c462f86734795cfe5ec7e7cb4091ca8d779b4ea9cfea11e1f492fe1aa2029

                                                                          SHA512

                                                                          7b956ba7a71e1c91c592b2aed9f1da364a2d852f5599967bf9a55fa153bce34b535abab310d0c4733910310af1c79665e567002332bb6e6477807bcb3eca7345

                                                                          Download Submit
                                                                        • \Users\Admin\AppData\Local\Temp\nsyE044.tmp\NSISdl.dll
                                                                          Filesize

                                                                          14KB

                                                                          MD5

                                                                          254f13dfd61c5b7d2119eb2550491e1d

                                                                          SHA1

                                                                          5083f6804ee3475f3698ab9e68611b0128e22fd6

                                                                          SHA256

                                                                          fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

                                                                          SHA512

                                                                          fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

                                                                          Download Submit
                                                                        • \Users\Admin\AppData\Local\Temp\nsyE044.tmp\NSISdl.dll
                                                                          Filesize

                                                                          14KB

                                                                          MD5

                                                                          254f13dfd61c5b7d2119eb2550491e1d

                                                                          SHA1

                                                                          5083f6804ee3475f3698ab9e68611b0128e22fd6

                                                                          SHA256

                                                                          fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

                                                                          SHA512

                                                                          fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

                                                                          Download Submit
                                                                        • \Users\Admin\AppData\Local\Temp\nsyE044.tmp\NSISdl.dll
                                                                          Filesize

                                                                          14KB

                                                                          MD5

                                                                          254f13dfd61c5b7d2119eb2550491e1d

                                                                          SHA1

                                                                          5083f6804ee3475f3698ab9e68611b0128e22fd6

                                                                          SHA256

                                                                          fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

                                                                          SHA512

                                                                          fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

                                                                          Download Submit
                                                                        • \Users\Admin\AppData\Local\Temp\nsyE044.tmp\System.dll
                                                                          Filesize

                                                                          11KB

                                                                          MD5

                                                                          00a0194c20ee912257df53bfe258ee4a

                                                                          SHA1

                                                                          d7b4e319bc5119024690dc8230b9cc919b1b86b2

                                                                          SHA256

                                                                          dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

                                                                          SHA512

                                                                          3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

                                                                          Download Submit
                                                                        • \Users\Admin\AppData\Local\Temp\nsyE044.tmp\zzaz_01.exe
                                                                          Filesize

                                                                          175KB

                                                                          MD5

                                                                          60df3a25590af278d0c7add59056b642

                                                                          SHA1

                                                                          c893e28a52c5ba6452067ef4470c0971f0a5669e

                                                                          SHA256

                                                                          933391a55910ca2ef8f8b2209d0fb240afc9b12fe5303c4bc0872e709394c4c7

                                                                          SHA512

                                                                          00027a19f20507ccfcc9ca6732c804e485d621beec15d50e7104cde3288ee7fc831c7dc608fdaf8ed96d7cbd650ce1ff1c2ddf94ce8a0e357afcfd5533f91066

                                                                          Download Submit
                                                                        • memory/268-81-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/268-87-0x0000000000230000-0x0000000000286000-memory.dmp
                                                                          Filesize

                                                                          344KB

                                                                          Download
                                                                        • memory/328-60-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/388-205-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/432-116-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/528-210-0x00000000004D0000-0x000000000050E000-memory.dmp
                                                                          Filesize

                                                                          248KB

                                                                          Download
                                                                        • memory/528-208-0x0000000000490000-0x00000000004CA000-memory.dmp
                                                                          Filesize

                                                                          232KB

                                                                          Download
                                                                        • memory/872-89-0x0000000000530000-0x0000000000553000-memory.dmp
                                                                          Filesize

                                                                          140KB

                                                                          Download
                                                                        • memory/872-76-0x0000000004520000-0x0000000004576000-memory.dmp
                                                                          Filesize

                                                                          344KB

                                                                          Download
                                                                        • memory/872-64-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/972-104-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/972-108-0x00000000002A0000-0x00000000002F6000-memory.dmp
                                                                          Filesize

                                                                          344KB

                                                                          Download
                                                                        • memory/984-95-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/1072-234-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/1208-133-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/1208-140-0x0000000000220000-0x0000000000276000-memory.dmp
                                                                          Filesize

                                                                          344KB

                                                                          Download
                                                                        • memory/1208-154-0x0000000004450000-0x000000000450F000-memory.dmp
                                                                          Filesize

                                                                          764KB

                                                                          Download
                                                                        • memory/1208-156-0x0000000000760000-0x0000000000787000-memory.dmp
                                                                          Filesize

                                                                          156KB

                                                                          Download
                                                                        • memory/1360-248-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/1364-94-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/1364-144-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/1364-145-0x00000000003A0000-0x00000000003F6000-memory.dmp
                                                                          Filesize

                                                                          344KB

                                                                          Download
                                                                        • memory/1484-224-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/1632-204-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/1640-240-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/1664-54-0x00000000761F1000-0x00000000761F3000-memory.dmp
                                                                          Filesize

                                                                          8KB

                                                                          Download
                                                                        • memory/1792-70-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/1880-148-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/1880-149-0x00000000002F0000-0x0000000000346000-memory.dmp
                                                                          Filesize

                                                                          344KB

                                                                          Download
                                                                        • memory/2024-232-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/2136-238-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/2300-242-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/2320-244-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/2332-166-0x00000000020F0000-0x0000000002109000-memory.dmp
                                                                          Filesize

                                                                          100KB

                                                                          Download
                                                                        • memory/2332-188-0x00000000056E1000-0x000000000574D000-memory.dmp
                                                                          Filesize

                                                                          432KB

                                                                          Download
                                                                        • memory/2332-187-0x00000000056E0000-0x0000000005757000-memory.dmp
                                                                          Filesize

                                                                          476KB

                                                                          Download
                                                                        • memory/2332-186-0x00000000056E1000-0x0000000005742000-memory.dmp
                                                                          Filesize

                                                                          388KB

                                                                          Download
                                                                        • memory/2332-193-0x0000000005701000-0x000000000571F000-memory.dmp
                                                                          Filesize

                                                                          120KB

                                                                          Download
                                                                        • memory/2332-158-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/2332-176-0x0000000003FED000-0x0000000003FF8000-memory.dmp
                                                                          Filesize

                                                                          44KB

                                                                          Download
                                                                        • memory/2332-201-0x00000000056E0000-0x0000000005704000-memory.dmp
                                                                          Filesize

                                                                          144KB

                                                                          Download
                                                                        • memory/2332-164-0x00000000003D0000-0x00000000003FE000-memory.dmp
                                                                          Filesize

                                                                          184KB

                                                                          Download
                                                                        • memory/2332-175-0x0000000003F80000-0x0000000003FF7000-memory.dmp
                                                                          Filesize

                                                                          476KB

                                                                          Download
                                                                        • memory/2332-182-0x00000000056E0000-0x0000000005704000-memory.dmp
                                                                          Filesize

                                                                          144KB

                                                                          Download
                                                                        • memory/2332-181-0x0000000004690000-0x00000000046B5000-memory.dmp
                                                                          Filesize

                                                                          148KB

                                                                          Download
                                                                        • memory/2332-160-0x0000000002260000-0x00000000022A4000-memory.dmp
                                                                          Filesize

                                                                          272KB

                                                                          Download
                                                                        • memory/2332-189-0x000000000574D000-0x0000000005758000-memory.dmp
                                                                          Filesize

                                                                          44KB

                                                                          Download
                                                                        • memory/2332-169-0x0000000002B50000-0x0000000002B74000-memory.dmp
                                                                          Filesize

                                                                          144KB

                                                                          Download
                                                                        • memory/2332-173-0x0000000003F80000-0x0000000003FF7000-memory.dmp
                                                                          Filesize

                                                                          476KB

                                                                          Download
                                                                        • memory/2480-246-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/2552-178-0x0000000000350000-0x0000000000369000-memory.dmp
                                                                          Filesize

                                                                          100KB

                                                                          Download
                                                                        • memory/2596-225-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/2624-179-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/2680-229-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/2924-236-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/2980-200-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp
                                                                          Filesize

                                                                          8KB

                                                                          Download
                                                                        • memory/2980-199-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/2984-227-0x0000000000000000-mapping.dmp
                                                                          Download
                                                                        • memory/3032-203-0x0000000000000000-mapping.dmp
                                                                          Download