Analysis
-
max time kernel
96s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
-
submitted
25-07-2022 03:44
General
-
Target
5660b555743a8b474992340e7e1e5c2baac9660da8a26c147bc2461bb1763526.exe
-
Size
2.8MB
-
MD5
5258c6b0da9f2e14626882430b0e93fb
-
SHA1
13e5a003ae1bad501cfe747e142aa09c2069126f
-
SHA256
5660b555743a8b474992340e7e1e5c2baac9660da8a26c147bc2461bb1763526
-
SHA512
a2257069b036a5ef9b084f9a58d565a5b4e577fe170a5fdf98f7fbfe158af86b4ecad3569c8b7b423fd646e7dfcaf9ef77dba44ad987653bec12913abf03661f
Malware Config
Signatures
-
suricata: ET MALWARE Possible Windows executable sent when remote host claims to send a Text File
suricata: ET MALWARE Possible Windows executable sent when remote host claims to send a Text File
-
Downloads MZ/PE file
-
Executes dropped EXE 30 IoCs
-
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Sets file execution options in registry 2 TTPs 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 64 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks for any installed AV software in registry 1 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 15 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies registry class 64 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5660b555743a8b474992340e7e1e5c2baac9660da8a26c147bc2461bb1763526.exe"C:\Users\Admin\AppData\Local\Temp\5660b555743a8b474992340e7e1e5c2baac9660da8a26c147bc2461bb1763526.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\V8._85416_20150820204011.exeV8._85416_20150820204011.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Tencent\QQBrowser\Service\PerfTraceService.exe"C:\Program Files (x86)\Tencent\QQBrowser\Service\PerfTraceService.exe" -installAndRun "QQBrowser Performance Service"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Tencent\QQBrowser\WebpDecodeFilter.dll"3⤵
- Loads dropped DLL
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe"C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe" -host=update -source=13⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe"C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe" -module=Assistant.dll -install3⤵
- Executes dropped EXE
- Sets file execution options in registry
- Checks computer location settings
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /u MetroLauncher64.dll4⤵
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /u MetroLauncher32.dll4⤵
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe"C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe" -module=Assistant.dll -installscheduletask3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe"C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe" -Module=QQBrowserFrame.dll -skinzipfactory3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe"C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe" -module=Assistant.dll -homepageimport3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe"C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe" -module=Assistant.dll -resetopenpage3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe"C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe" -module=Assistant.dll -installcoexistreport -installmode=13⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe"C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe" -module=QQBrowserFrame.dll -updatejumplist3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe"C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe" -sc=quicklaunchpinedshortcut -fixlaunch=03⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe"C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe" -host=extension -scope=4680 /prefetch:54⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe"C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe" "-host=tab" -scope=4680 -Cred=800 -group=0 -core=5 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe"C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe" "-host=tab" -scope=4680 -Cred=800 -group=0 -tid=1 -core=5 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe"C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe" -host= -Cred=2048 -scope=4680 -sc=quicklaunchpinedshortcut /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe"C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe" -host=net /prefetch:44⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe"C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe" -host=net /prefetch:44⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe"C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe" -module=Assistant.dll -installtxservice3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe"C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe" -module=Assistant.dll -setdefaultbrowser3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe"C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe" -module=Assistant.dll -installreport -name=QQBrowser_Setup_Hk_85416_3638.exe -parent=5660b555743a8b474992340e7e1e5c2baac9660da8a26c147bc2461bb1763526.exe -occupy= -occupyparent= -method=3 -result=0 -type=1 -changedir=0 -fstartup=1 -deskicon=1 -default=1 -directopen=3953 -userplan=1 -r1= -r2=3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C copy /b "C:\Users\Admin\AppData\Local\Temp\BaiduPlayer5SetupSilent_359.exe" + "C:\Windows\Fonts\mingliu.ttc" "C:\Users\Admin\AppData\Local\Temp\BaiduPlayer5SetupSilent_359.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\BaiduPlayer5SetupSilent_359.exeBaiduPlayer5SetupSilent_359.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\baidu\BDPlayer\5.1.1.9\PlayerApp.exe"C:\Program Files (x86)\baidu\BDPlayer\5.1.1.9\PlayerApp.exe" --action=install --desktop=1 --taskbar=13⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="xUpdate" dir=in program="C:\Program Files (x86)\baidu\BDPlayer\5.1.1.9\xUpdate.exe" action=allow description="C:\Program Files (x86)\baidu\BDPlayer\5.1.1.9\xUpdate.exe"4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="BDPlayer" dir=in program="C:\Program Files (x86)\baidu\BDPlayer\5.1.1.9\BDPlayer.exe" action=allow description="C:\Program Files (x86)\baidu\BDPlayer\5.1.1.9\BDPlayer.exe"4⤵
- Modifies Windows Firewall
-
C:\Program Files (x86)\baidu\BDPlayer\5.1.1.9\xReport.exe"C:\Program Files (x86)\baidu\BDPlayer\5.1.1.9\xReport.exe" pv &r=133032015314720000&op=install&ver=5.1.1.9&ch=359&module=BaiduPlayer5SetupSilent_3593⤵
- Executes dropped EXE
-
C:\Program Files (x86)\baidu\BDPlayer\5.1.1.9\BDPlayerTray.exe"C:\Program Files (x86)\baidu\BDPlayer\5.1.1.9\BDPlayerTray.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\baidu\BDPlayer\5.1.1.9\xReport.exe"C:\Program Files (x86)\baidu\BDPlayer\5.1.1.9\xReport.exe" pv &r=133032015415970000&op=lauch&ext=toolbar&ver=5.1.1.9&ch=359&module=BDPlayerTray4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C copy /b "C:\Users\Admin\AppData\Local\Temp\BFVCenter-y4bd[[AB005]].exe" + "C:\Windows\Fonts\mingliu.ttc" "C:\Users\Admin\AppData\Local\Temp\BFVCenter-y4bd[[AB005]].exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\BFVCenter-y4bd[[AB005]].exeBFVCenter-y4bd[[AB005]].exe2⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVKanDianYing.exe"C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVKanDianYing.exe" /taskbar3⤵
-
C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe"C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe" /Module="AllTask"4⤵
-
C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe"C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe" /Module="YiLanStartup"4⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVShellIcon64.dll"3⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVShellIcon64.dll"4⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\Baofeng\BFVKanDianYing\UGCFlash.dll"3⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\Baofeng\BFVKanDianYing\npBFVWebPlugin64.dll"3⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\Baofeng\BFVKanDianYing\npBFVWebPlugin.dll"3⤵
-
C:\Users\Admin\AppData\Local\Temp\uni1795887c.exeuni1795887c.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\AppData\Local\Temp\kinst_1_568.exekinst_1_568.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://120.55.106.224/NTY2MGI1NTU3NDNhOGI0NzQ5OTIzNDBlN2UxZTVjMmJhYWM5NjYwZGE4YTI2YzE0N2JjMjQ2MWJiMTc2MzUyNi5leGU=/40.html2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff227046f8,0x7fff22704708,0x7fff227047183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,8247486948618414912,17039949380023935961,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,8247486948618414912,17039949380023935961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,8247486948618414912,17039949380023935961,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8247486948618414912,17039949380023935961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8247486948618414912,17039949380023935961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,8247486948618414912,17039949380023935961,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3056 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,8247486948618414912,17039949380023935961,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5420 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8247486948618414912,17039949380023935961,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8247486948618414912,17039949380023935961,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:13⤵
-
C:\Users\Admin\AppData\Local\Temp\XMPSetupLite-SIjhaqws56.exeXMPSetupLite-SIjhaqws56.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\XMPSetupLite-SIjhaqws56\5.2.18.5894\XmpSetupAgent.exe"C:\Users\Admin\AppData\Local\Temp\XMPSetupLite-SIjhaqws56\5.2.18.5894\XmpSetupAgent.exe" /installdir "C:\Program Files (x86)\Thunder Network\XMP\V5.2.18.5894" /userdata "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894" /version "5.2.18.5894" /cmdfile "C:\Users\Admin\AppData\Local\Temp\XMPFB77.tmp"3⤵
-
C:\Users\Admin\AppData\Local\Temp\XMPSetupLite-SIjhaqws56\5.2.18.5894\XmpSetupAgent.exe"C:\Users\Admin\AppData\Local\Temp\XMPSetupLite-SIjhaqws56\5.2.18.5894\XmpSetupAgent.exe" /installdir "C:\Program Files (x86)\Thunder Network\XMP\V5.2.18.5894" /userdata "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894" /version "5.2.18.5894" /cmdfile "C:\Users\Admin\AppData\Local\Temp\XMPCBE.tmp"3⤵
-
C:\Users\Admin\AppData\Local\Temp\XMPSetupLite-SIjhaqws56\5.2.18.5894\XmpSetupAgent.exe"C:\Users\Admin\AppData\Local\Temp\XMPSetupLite-SIjhaqws56\5.2.18.5894\XmpSetupAgent.exe" /installdir "C:\Program Files (x86)\Thunder Network\XMP\V5.2.18.5894" /userdata "C:\Users\Public\Thunder Network\XMP5\V5.2.18.5894" /version "5.2.18.5894" /cmdfile "C:\Users\Admin\AppData\Local\Temp\XMPCCE.tmp"3⤵
-
C:\Program Files (x86)\Thunder Network\XMP\V5.2.18.5894\Bin\ThunderFW.exe"C:\Program Files (x86)\Thunder Network\XMP\V5.2.18.5894\Bin\ThunderFW.exe" "迅雷影音" "C:\Program Files (x86)\Thunder Network\XMP\V5.2.18.5894\Bin\XMP.exe"3⤵
-
C:\Program Files (x86)\Tencent\QQBrowser\Service\PerfTraceService.exe"C:\Program Files (x86)\Tencent\QQBrowser\Service\PerfTraceService.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Baofeng\BFVKanDianYing\npBFVWebPlugin64.dll"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Tencent\QQBrowser\Assistant.dllFilesize
417KB
MD5e93b5a4fd5050116a84cf52011c516c1
SHA138bd7e853618d6fc8438f60715571289c01b0974
SHA256e5ee45270cd623c9353c05349e7d0049a3f6caaad0a48c64af04d3523e07bc97
SHA5123520ab6e36a9e44164261d1a6b6c53880b03bb102e6eafec7167f39020ae33462e8f515184704cfcd3df752ee94711b8e185ac15c18056677075c29eadd1c0d7
-
C:\Program Files (x86)\Tencent\QQBrowser\Assistant.dllFilesize
417KB
MD5e93b5a4fd5050116a84cf52011c516c1
SHA138bd7e853618d6fc8438f60715571289c01b0974
SHA256e5ee45270cd623c9353c05349e7d0049a3f6caaad0a48c64af04d3523e07bc97
SHA5123520ab6e36a9e44164261d1a6b6c53880b03bb102e6eafec7167f39020ae33462e8f515184704cfcd3df752ee94711b8e185ac15c18056677075c29eadd1c0d7
-
C:\Program Files (x86)\Tencent\QQBrowser\Assistant.dllFilesize
417KB
MD5e93b5a4fd5050116a84cf52011c516c1
SHA138bd7e853618d6fc8438f60715571289c01b0974
SHA256e5ee45270cd623c9353c05349e7d0049a3f6caaad0a48c64af04d3523e07bc97
SHA5123520ab6e36a9e44164261d1a6b6c53880b03bb102e6eafec7167f39020ae33462e8f515184704cfcd3df752ee94711b8e185ac15c18056677075c29eadd1c0d7
-
C:\Program Files (x86)\Tencent\QQBrowser\Assistant.dllFilesize
417KB
MD5e93b5a4fd5050116a84cf52011c516c1
SHA138bd7e853618d6fc8438f60715571289c01b0974
SHA256e5ee45270cd623c9353c05349e7d0049a3f6caaad0a48c64af04d3523e07bc97
SHA5123520ab6e36a9e44164261d1a6b6c53880b03bb102e6eafec7167f39020ae33462e8f515184704cfcd3df752ee94711b8e185ac15c18056677075c29eadd1c0d7
-
C:\Program Files (x86)\Tencent\QQBrowser\Assistant.dllFilesize
417KB
MD5e93b5a4fd5050116a84cf52011c516c1
SHA138bd7e853618d6fc8438f60715571289c01b0974
SHA256e5ee45270cd623c9353c05349e7d0049a3f6caaad0a48c64af04d3523e07bc97
SHA5123520ab6e36a9e44164261d1a6b6c53880b03bb102e6eafec7167f39020ae33462e8f515184704cfcd3df752ee94711b8e185ac15c18056677075c29eadd1c0d7
-
C:\Program Files (x86)\Tencent\QQBrowser\Assistant.dllFilesize
417KB
MD5e93b5a4fd5050116a84cf52011c516c1
SHA138bd7e853618d6fc8438f60715571289c01b0974
SHA256e5ee45270cd623c9353c05349e7d0049a3f6caaad0a48c64af04d3523e07bc97
SHA5123520ab6e36a9e44164261d1a6b6c53880b03bb102e6eafec7167f39020ae33462e8f515184704cfcd3df752ee94711b8e185ac15c18056677075c29eadd1c0d7
-
C:\Program Files (x86)\Tencent\QQBrowser\QBExtensionFramework.dllFilesize
540KB
MD588f2d2382cce7ec315ca6860ff0c4075
SHA107eea3f61e2fa2d47682217b505d163f7f36fc9d
SHA256b2c6d93708c33068fe61c0b3733ec697b179d18fba79dfcbc6eacb716fc81d45
SHA51243bc572f67181ae5fbf26828cfdb82bd1867a69a2f74fb03346bb69cfda8d8fb2b834521bf86918c663df223bd721d1cc3837ebc8e3c164fde3f5dca92d71779
-
C:\Program Files (x86)\Tencent\QQBrowser\QBSafe.dllFilesize
443KB
MD516ae0a59da95783599969cb2a8cd7b0d
SHA1993030a80ecf26ebbb723053072a4084ea89d8b1
SHA256d63ed7d6a3f5b7d5e5e641bccd8e8644493f7bd91b98656ab58d1b893958a2d9
SHA5124a772c6300ee294aa0b7b86e8de8c88805f9509dcc9467dbe427fb918d1a4d98b597591f4fca2ef24f55bc6e0cdb11ccb8d21449424e622663d935b8005dd1d9
-
C:\Program Files (x86)\Tencent\QQBrowser\QBSafe.dllFilesize
443KB
MD516ae0a59da95783599969cb2a8cd7b0d
SHA1993030a80ecf26ebbb723053072a4084ea89d8b1
SHA256d63ed7d6a3f5b7d5e5e641bccd8e8644493f7bd91b98656ab58d1b893958a2d9
SHA5124a772c6300ee294aa0b7b86e8de8c88805f9509dcc9467dbe427fb918d1a4d98b597591f4fca2ef24f55bc6e0cdb11ccb8d21449424e622663d935b8005dd1d9
-
C:\Program Files (x86)\Tencent\QQBrowser\QBSafe.dllFilesize
443KB
MD516ae0a59da95783599969cb2a8cd7b0d
SHA1993030a80ecf26ebbb723053072a4084ea89d8b1
SHA256d63ed7d6a3f5b7d5e5e641bccd8e8644493f7bd91b98656ab58d1b893958a2d9
SHA5124a772c6300ee294aa0b7b86e8de8c88805f9509dcc9467dbe427fb918d1a4d98b597591f4fca2ef24f55bc6e0cdb11ccb8d21449424e622663d935b8005dd1d9
-
C:\Program Files (x86)\Tencent\QQBrowser\QBSafe.dllFilesize
443KB
MD516ae0a59da95783599969cb2a8cd7b0d
SHA1993030a80ecf26ebbb723053072a4084ea89d8b1
SHA256d63ed7d6a3f5b7d5e5e641bccd8e8644493f7bd91b98656ab58d1b893958a2d9
SHA5124a772c6300ee294aa0b7b86e8de8c88805f9509dcc9467dbe427fb918d1a4d98b597591f4fca2ef24f55bc6e0cdb11ccb8d21449424e622663d935b8005dd1d9
-
C:\Program Files (x86)\Tencent\QQBrowser\QBSafe.dllFilesize
443KB
MD516ae0a59da95783599969cb2a8cd7b0d
SHA1993030a80ecf26ebbb723053072a4084ea89d8b1
SHA256d63ed7d6a3f5b7d5e5e641bccd8e8644493f7bd91b98656ab58d1b893958a2d9
SHA5124a772c6300ee294aa0b7b86e8de8c88805f9509dcc9467dbe427fb918d1a4d98b597591f4fca2ef24f55bc6e0cdb11ccb8d21449424e622663d935b8005dd1d9
-
C:\Program Files (x86)\Tencent\QQBrowser\QBUtils.dllFilesize
1.7MB
MD5268905b968aace3dbaf5dd97391071e9
SHA13ea52528166806275bf9c6a7aa8d4f359a140889
SHA256caa9c84d342c14543ddaf861efcc7b8e997f2d8bd270d408ba9764e29fcc88fd
SHA5121f0483c53bb3901721f90071889036777ae84ea257b8afa98c04b8142bae321732d012484482ea556f6cca65ec1255459a08e4156cc3cd52fbc44541b2fb568b
-
C:\Program Files (x86)\Tencent\QQBrowser\QBUtils.dllFilesize
1.7MB
MD5268905b968aace3dbaf5dd97391071e9
SHA13ea52528166806275bf9c6a7aa8d4f359a140889
SHA256caa9c84d342c14543ddaf861efcc7b8e997f2d8bd270d408ba9764e29fcc88fd
SHA5121f0483c53bb3901721f90071889036777ae84ea257b8afa98c04b8142bae321732d012484482ea556f6cca65ec1255459a08e4156cc3cd52fbc44541b2fb568b
-
C:\Program Files (x86)\Tencent\QQBrowser\QBUtils.dllFilesize
1.7MB
MD5268905b968aace3dbaf5dd97391071e9
SHA13ea52528166806275bf9c6a7aa8d4f359a140889
SHA256caa9c84d342c14543ddaf861efcc7b8e997f2d8bd270d408ba9764e29fcc88fd
SHA5121f0483c53bb3901721f90071889036777ae84ea257b8afa98c04b8142bae321732d012484482ea556f6cca65ec1255459a08e4156cc3cd52fbc44541b2fb568b
-
C:\Program Files (x86)\Tencent\QQBrowser\QBUtils.dllFilesize
1.7MB
MD5268905b968aace3dbaf5dd97391071e9
SHA13ea52528166806275bf9c6a7aa8d4f359a140889
SHA256caa9c84d342c14543ddaf861efcc7b8e997f2d8bd270d408ba9764e29fcc88fd
SHA5121f0483c53bb3901721f90071889036777ae84ea257b8afa98c04b8142bae321732d012484482ea556f6cca65ec1255459a08e4156cc3cd52fbc44541b2fb568b
-
C:\Program Files (x86)\Tencent\QQBrowser\QBUtils.dllFilesize
1.7MB
MD5268905b968aace3dbaf5dd97391071e9
SHA13ea52528166806275bf9c6a7aa8d4f359a140889
SHA256caa9c84d342c14543ddaf861efcc7b8e997f2d8bd270d408ba9764e29fcc88fd
SHA5121f0483c53bb3901721f90071889036777ae84ea257b8afa98c04b8142bae321732d012484482ea556f6cca65ec1255459a08e4156cc3cd52fbc44541b2fb568b
-
C:\Program Files (x86)\Tencent\QQBrowser\QBUtils.dllFilesize
1.7MB
MD5268905b968aace3dbaf5dd97391071e9
SHA13ea52528166806275bf9c6a7aa8d4f359a140889
SHA256caa9c84d342c14543ddaf861efcc7b8e997f2d8bd270d408ba9764e29fcc88fd
SHA5121f0483c53bb3901721f90071889036777ae84ea257b8afa98c04b8142bae321732d012484482ea556f6cca65ec1255459a08e4156cc3cd52fbc44541b2fb568b
-
C:\Program Files (x86)\Tencent\QQBrowser\QBUtils.dllFilesize
1.7MB
MD5268905b968aace3dbaf5dd97391071e9
SHA13ea52528166806275bf9c6a7aa8d4f359a140889
SHA256caa9c84d342c14543ddaf861efcc7b8e997f2d8bd270d408ba9764e29fcc88fd
SHA5121f0483c53bb3901721f90071889036777ae84ea257b8afa98c04b8142bae321732d012484482ea556f6cca65ec1255459a08e4156cc3cd52fbc44541b2fb568b
-
C:\Program Files (x86)\Tencent\QQBrowser\QBUtils.dllFilesize
1.7MB
MD5268905b968aace3dbaf5dd97391071e9
SHA13ea52528166806275bf9c6a7aa8d4f359a140889
SHA256caa9c84d342c14543ddaf861efcc7b8e997f2d8bd270d408ba9764e29fcc88fd
SHA5121f0483c53bb3901721f90071889036777ae84ea257b8afa98c04b8142bae321732d012484482ea556f6cca65ec1255459a08e4156cc3cd52fbc44541b2fb568b
-
C:\Program Files (x86)\Tencent\QQBrowser\QBUtils.dllFilesize
1.7MB
MD5268905b968aace3dbaf5dd97391071e9
SHA13ea52528166806275bf9c6a7aa8d4f359a140889
SHA256caa9c84d342c14543ddaf861efcc7b8e997f2d8bd270d408ba9764e29fcc88fd
SHA5121f0483c53bb3901721f90071889036777ae84ea257b8afa98c04b8142bae321732d012484482ea556f6cca65ec1255459a08e4156cc3cd52fbc44541b2fb568b
-
C:\Program Files (x86)\Tencent\QQBrowser\QBUtils.dllFilesize
1.7MB
MD5268905b968aace3dbaf5dd97391071e9
SHA13ea52528166806275bf9c6a7aa8d4f359a140889
SHA256caa9c84d342c14543ddaf861efcc7b8e997f2d8bd270d408ba9764e29fcc88fd
SHA5121f0483c53bb3901721f90071889036777ae84ea257b8afa98c04b8142bae321732d012484482ea556f6cca65ec1255459a08e4156cc3cd52fbc44541b2fb568b
-
C:\Program Files (x86)\Tencent\QQBrowser\QBUtils.dllFilesize
1.7MB
MD5268905b968aace3dbaf5dd97391071e9
SHA13ea52528166806275bf9c6a7aa8d4f359a140889
SHA256caa9c84d342c14543ddaf861efcc7b8e997f2d8bd270d408ba9764e29fcc88fd
SHA5121f0483c53bb3901721f90071889036777ae84ea257b8afa98c04b8142bae321732d012484482ea556f6cca65ec1255459a08e4156cc3cd52fbc44541b2fb568b
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exeFilesize
119KB
MD5c3e4c6aaedb957ba059b51c1d2403c93
SHA1949e35c49a4500f872ef84ea01560af4b2868790
SHA2561415ff8057acbd5cbd24c6bd835df4c600e485009dbb052c635309a88ee69a34
SHA51246382dc454e0e78624cbd8f0634e6641b208195d03897fcc24bf1115ca9db9628dedc855312cd42c5174d461b8e44a0871f39f99473b2bf8bc0788f65a116755
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exeFilesize
119KB
MD5c3e4c6aaedb957ba059b51c1d2403c93
SHA1949e35c49a4500f872ef84ea01560af4b2868790
SHA2561415ff8057acbd5cbd24c6bd835df4c600e485009dbb052c635309a88ee69a34
SHA51246382dc454e0e78624cbd8f0634e6641b208195d03897fcc24bf1115ca9db9628dedc855312cd42c5174d461b8e44a0871f39f99473b2bf8bc0788f65a116755
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exeFilesize
119KB
MD5c3e4c6aaedb957ba059b51c1d2403c93
SHA1949e35c49a4500f872ef84ea01560af4b2868790
SHA2561415ff8057acbd5cbd24c6bd835df4c600e485009dbb052c635309a88ee69a34
SHA51246382dc454e0e78624cbd8f0634e6641b208195d03897fcc24bf1115ca9db9628dedc855312cd42c5174d461b8e44a0871f39f99473b2bf8bc0788f65a116755
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exeFilesize
119KB
MD5c3e4c6aaedb957ba059b51c1d2403c93
SHA1949e35c49a4500f872ef84ea01560af4b2868790
SHA2561415ff8057acbd5cbd24c6bd835df4c600e485009dbb052c635309a88ee69a34
SHA51246382dc454e0e78624cbd8f0634e6641b208195d03897fcc24bf1115ca9db9628dedc855312cd42c5174d461b8e44a0871f39f99473b2bf8bc0788f65a116755
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exeFilesize
119KB
MD5c3e4c6aaedb957ba059b51c1d2403c93
SHA1949e35c49a4500f872ef84ea01560af4b2868790
SHA2561415ff8057acbd5cbd24c6bd835df4c600e485009dbb052c635309a88ee69a34
SHA51246382dc454e0e78624cbd8f0634e6641b208195d03897fcc24bf1115ca9db9628dedc855312cd42c5174d461b8e44a0871f39f99473b2bf8bc0788f65a116755
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exeFilesize
119KB
MD5c3e4c6aaedb957ba059b51c1d2403c93
SHA1949e35c49a4500f872ef84ea01560af4b2868790
SHA2561415ff8057acbd5cbd24c6bd835df4c600e485009dbb052c635309a88ee69a34
SHA51246382dc454e0e78624cbd8f0634e6641b208195d03897fcc24bf1115ca9db9628dedc855312cd42c5174d461b8e44a0871f39f99473b2bf8bc0788f65a116755
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exeFilesize
119KB
MD5c3e4c6aaedb957ba059b51c1d2403c93
SHA1949e35c49a4500f872ef84ea01560af4b2868790
SHA2561415ff8057acbd5cbd24c6bd835df4c600e485009dbb052c635309a88ee69a34
SHA51246382dc454e0e78624cbd8f0634e6641b208195d03897fcc24bf1115ca9db9628dedc855312cd42c5174d461b8e44a0871f39f99473b2bf8bc0788f65a116755
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exeFilesize
119KB
MD5c3e4c6aaedb957ba059b51c1d2403c93
SHA1949e35c49a4500f872ef84ea01560af4b2868790
SHA2561415ff8057acbd5cbd24c6bd835df4c600e485009dbb052c635309a88ee69a34
SHA51246382dc454e0e78624cbd8f0634e6641b208195d03897fcc24bf1115ca9db9628dedc855312cd42c5174d461b8e44a0871f39f99473b2bf8bc0788f65a116755
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exeFilesize
119KB
MD5c3e4c6aaedb957ba059b51c1d2403c93
SHA1949e35c49a4500f872ef84ea01560af4b2868790
SHA2561415ff8057acbd5cbd24c6bd835df4c600e485009dbb052c635309a88ee69a34
SHA51246382dc454e0e78624cbd8f0634e6641b208195d03897fcc24bf1115ca9db9628dedc855312cd42c5174d461b8e44a0871f39f99473b2bf8bc0788f65a116755
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exeFilesize
119KB
MD5c3e4c6aaedb957ba059b51c1d2403c93
SHA1949e35c49a4500f872ef84ea01560af4b2868790
SHA2561415ff8057acbd5cbd24c6bd835df4c600e485009dbb052c635309a88ee69a34
SHA51246382dc454e0e78624cbd8f0634e6641b208195d03897fcc24bf1115ca9db9628dedc855312cd42c5174d461b8e44a0871f39f99473b2bf8bc0788f65a116755
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowserFrame.dllFilesize
1.6MB
MD568eb386277ed0c2e4a13b6c5731f236e
SHA1c831285069732bc3578a508052ce5e8723aac582
SHA25684ef4e2ec7265038cb82c4a4ee149e394c1a66b7f84853130fba167965d09f2a
SHA5126f9f76da55a863f6c817322b66c658492fc7d01a60673c7d622dc14baf2c6524f4fba4911c8b1419203f8ffc72c757c272001bf0fe67515411eaf2e9df035381
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowserFrame.dllFilesize
1.6MB
MD568eb386277ed0c2e4a13b6c5731f236e
SHA1c831285069732bc3578a508052ce5e8723aac582
SHA25684ef4e2ec7265038cb82c4a4ee149e394c1a66b7f84853130fba167965d09f2a
SHA5126f9f76da55a863f6c817322b66c658492fc7d01a60673c7d622dc14baf2c6524f4fba4911c8b1419203f8ffc72c757c272001bf0fe67515411eaf2e9df035381
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowserFrame.dllFilesize
1.6MB
MD568eb386277ed0c2e4a13b6c5731f236e
SHA1c831285069732bc3578a508052ce5e8723aac582
SHA25684ef4e2ec7265038cb82c4a4ee149e394c1a66b7f84853130fba167965d09f2a
SHA5126f9f76da55a863f6c817322b66c658492fc7d01a60673c7d622dc14baf2c6524f4fba4911c8b1419203f8ffc72c757c272001bf0fe67515411eaf2e9df035381
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowserFrame.dllFilesize
1.6MB
MD568eb386277ed0c2e4a13b6c5731f236e
SHA1c831285069732bc3578a508052ce5e8723aac582
SHA25684ef4e2ec7265038cb82c4a4ee149e394c1a66b7f84853130fba167965d09f2a
SHA5126f9f76da55a863f6c817322b66c658492fc7d01a60673c7d622dc14baf2c6524f4fba4911c8b1419203f8ffc72c757c272001bf0fe67515411eaf2e9df035381
-
C:\Program Files (x86)\Tencent\QQBrowser\QQBrowserFrame.dllFilesize
1.6MB
MD568eb386277ed0c2e4a13b6c5731f236e
SHA1c831285069732bc3578a508052ce5e8723aac582
SHA25684ef4e2ec7265038cb82c4a4ee149e394c1a66b7f84853130fba167965d09f2a
SHA5126f9f76da55a863f6c817322b66c658492fc7d01a60673c7d622dc14baf2c6524f4fba4911c8b1419203f8ffc72c757c272001bf0fe67515411eaf2e9df035381
-
C:\Program Files (x86)\Tencent\QQBrowser\Service\PerfTraceService.exeFilesize
272KB
MD51b47580cce6db40a3f389ebd6250795f
SHA1951ced03a17e826df41cd2314bb5079ba7fc74e3
SHA256f2adc20c2fa2e5fa02fda7469b6ac15a623f3cd098343198f54156f219716a7c
SHA512c864cbce5bbd7cccb8bec1e724fd884b053ff0ba3080d14a0afacc5cd55b9866f37cddc1a1d62cfb6fdca9a068663e2fff5c5ad32c3d55da49cca633606646e5
-
C:\Program Files (x86)\Tencent\QQBrowser\Skin\LightStripes.gtFilesize
92KB
MD53392ddb4180f8142e92da3d58fea803f
SHA184735708fa47056106c149407ea12abe27f6a138
SHA256fe7583042a86428eacb57cc27ad6134610308166995811e0d44de06b7d216b72
SHA5127212ad691a1b390d81539a28ad87ea3363e0b73b28a74412eab37392a3e0b487d103f557b4768caecc98a35a3281843f92a523b77b92acd01b3ffd6406ad6f3a
-
C:\Program Files (x86)\Tencent\QQBrowser\WebpDecodeFilter.dllFilesize
135KB
MD512650137ef731c4f2967bd670287e357
SHA12386ffa665080bea8c36075992a9e236c0e54105
SHA2567e9320481129c168c87200c1bcbc2d793046bd40d42cd198e3b610a0f08c48f1
SHA512968b9430b29c6520633cdf91ec3a7773d4da637d53c565db213c0a0f76b4316948457d4567cdecee8b4e96c2e106e167fc9a3c94ceb0a14da2dd442734e89c03
-
C:\Program Files (x86)\Tencent\QQBrowser\WebpDecodeFilter.dllFilesize
135KB
MD512650137ef731c4f2967bd670287e357
SHA12386ffa665080bea8c36075992a9e236c0e54105
SHA2567e9320481129c168c87200c1bcbc2d793046bd40d42cd198e3b610a0f08c48f1
SHA512968b9430b29c6520633cdf91ec3a7773d4da637d53c565db213c0a0f76b4316948457d4567cdecee8b4e96c2e106e167fc9a3c94ceb0a14da2dd442734e89c03
-
C:\Program Files (x86)\Tencent\QQBrowser\dr.dllFilesize
81KB
MD5699f0052d0c959f1a5b7c3926cce11fa
SHA11f5084eacdd96553831899771fc433270c852196
SHA2563e1f7276df5e11b20250186682464782a40f902bcc44b44e0956348921d027c8
SHA51254d1adf7b8bf0325b10e50d34787cdf3d2cd219c2a19e8ab74f4283a55dd8ebb6910c71141449107494e2ded4452ebf6c973e3ec022b67a2da175691a1d0cc5c
-
C:\Program Files (x86)\Tencent\QQBrowser\dr.dllFilesize
81KB
MD5699f0052d0c959f1a5b7c3926cce11fa
SHA11f5084eacdd96553831899771fc433270c852196
SHA2563e1f7276df5e11b20250186682464782a40f902bcc44b44e0956348921d027c8
SHA51254d1adf7b8bf0325b10e50d34787cdf3d2cd219c2a19e8ab74f4283a55dd8ebb6910c71141449107494e2ded4452ebf6c973e3ec022b67a2da175691a1d0cc5c
-
C:\Program Files (x86)\Tencent\QQBrowser\service\PerfTraceService.exeFilesize
272KB
MD51b47580cce6db40a3f389ebd6250795f
SHA1951ced03a17e826df41cd2314bb5079ba7fc74e3
SHA256f2adc20c2fa2e5fa02fda7469b6ac15a623f3cd098343198f54156f219716a7c
SHA512c864cbce5bbd7cccb8bec1e724fd884b053ff0ba3080d14a0afacc5cd55b9866f37cddc1a1d62cfb6fdca9a068663e2fff5c5ad32c3d55da49cca633606646e5
-
C:\Program Files (x86)\Tencent\QQBrowser\service\PerfTraceService.exeFilesize
272KB
MD51b47580cce6db40a3f389ebd6250795f
SHA1951ced03a17e826df41cd2314bb5079ba7fc74e3
SHA256f2adc20c2fa2e5fa02fda7469b6ac15a623f3cd098343198f54156f219716a7c
SHA512c864cbce5bbd7cccb8bec1e724fd884b053ff0ba3080d14a0afacc5cd55b9866f37cddc1a1d62cfb6fdca9a068663e2fff5c5ad32c3d55da49cca633606646e5
-
C:\Users\Admin\AppData\Local\Temp\12aue56ef66\QBInstaller.dllFilesize
622KB
MD5ce9341acc89b84af512afa5b68c7c0b0
SHA1c63900266799e535374166f2837667da1a85a500
SHA256beb45eb024534ac0970e6d9455a9d0c27d9a24aa11364ec023cd6c09339aa467
SHA5128c1e5ff28a557c4e6acf2393394ebba43123af1dafeca5e04e55b54805dacd215d23198fa4aaf6de8378ce398aaeb578170958dcd33840a8851e031a0b3756fa
-
C:\Users\Admin\AppData\Local\Temp\V8._85416_20150820204011.exeFilesize
4.9MB
MD53c4c8edac2cd495654fa87ffeefb77ce
SHA135d3ffb6b8e12ca3efc1a99957fd1e31ad40d998
SHA2566e7903668f26e1efd1bde8875682d0016bf48382d38576f3c5cdb01c56f9f61e
SHA512a4cccdd4fcb72ad5fed7f7b663481c7d81f0436d69c9c85da90d4cc59dbb7e702e1fe01fdd7431976f9725ecd7a7c40c2fe2752b0bb03ea19f13a241cb488d2e
-
C:\Users\Admin\AppData\Local\Temp\V8._85416_20150820204011.exeFilesize
4.9MB
MD53c4c8edac2cd495654fa87ffeefb77ce
SHA135d3ffb6b8e12ca3efc1a99957fd1e31ad40d998
SHA2566e7903668f26e1efd1bde8875682d0016bf48382d38576f3c5cdb01c56f9f61e
SHA512a4cccdd4fcb72ad5fed7f7b663481c7d81f0436d69c9c85da90d4cc59dbb7e702e1fe01fdd7431976f9725ecd7a7c40c2fe2752b0bb03ea19f13a241cb488d2e
-
C:\Users\Admin\AppData\Local\Temp\nso84F6.tmp\Base64.dllFilesize
4KB
MD5f0e3845fefd227d7f1101850410ec849
SHA13067203fafd4237be0c186ddab7029dfcbdfb53e
SHA2567c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554
SHA512584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a
-
C:\Users\Admin\AppData\Local\Temp\nso84F6.tmp\Base64.dllFilesize
4KB
MD5f0e3845fefd227d7f1101850410ec849
SHA13067203fafd4237be0c186ddab7029dfcbdfb53e
SHA2567c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554
SHA512584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a
-
C:\Users\Admin\AppData\Local\Temp\nso84F6.tmp\Inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nso84F6.tmp\Inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nso84F6.tmp\NSISdl.dllFilesize
14KB
MD5254f13dfd61c5b7d2119eb2550491e1d
SHA15083f6804ee3475f3698ab9e68611b0128e22fd6
SHA256fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
SHA512fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7
-
C:\Users\Admin\AppData\Local\Temp\nso84F6.tmp\NSISdl.dllFilesize
14KB
MD5254f13dfd61c5b7d2119eb2550491e1d
SHA15083f6804ee3475f3698ab9e68611b0128e22fd6
SHA256fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
SHA512fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7
-
C:\Users\Admin\AppData\Local\Temp\nso84F6.tmp\System.dllFilesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
C:\Users\Admin\AppData\Local\Temp\nso84F6.tmp\ZipDLL.dllFilesize
163KB
MD52dc35ddcabcb2b24919b9afae4ec3091
SHA19eeed33c3abc656353a7ebd1c66af38cccadd939
SHA2566bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
SHA5120ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901
-
C:\Users\Admin\AppData\Local\Temp\nso84F6.tmp\ZipDLL.dllFilesize
163KB
MD52dc35ddcabcb2b24919b9afae4ec3091
SHA19eeed33c3abc656353a7ebd1c66af38cccadd939
SHA2566bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
SHA5120ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901
-
C:\Users\Admin\AppData\Roaming\Tencent\QQBrowser\DB\homepage.dbFilesize
3KB
MD5d0e7295144a4af0f9ffb401ac44a740e
SHA1a4d164ace9e1269aa81f17340347050635e04a43
SHA256e31a32bffc11cbdb3579a1eb3f6794bbd39c5fabd15b0151a5fd4c68d878c328
SHA512065c79a0de85cc1406879113b9e9a14e31680e1c69a27ae2e8c2719a2fff58c8bf5fb62ae54229ddac417b3abf90fd1c471cbb84330a00506e840bbbf7850358
-
C:\Users\Admin\AppData\Roaming\Tencent\QQBrowser\Extensions8\{0508DF1F-2AB6-4fac-A99E-45BBBF24E1E6}\8.0.0.12\QBSafe.dllFilesize
443KB
MD516ae0a59da95783599969cb2a8cd7b0d
SHA1993030a80ecf26ebbb723053072a4084ea89d8b1
SHA256d63ed7d6a3f5b7d5e5e641bccd8e8644493f7bd91b98656ab58d1b893958a2d9
SHA5124a772c6300ee294aa0b7b86e8de8c88805f9509dcc9467dbe427fb918d1a4d98b597591f4fca2ef24f55bc6e0cdb11ccb8d21449424e622663d935b8005dd1d9
-
C:\Users\Admin\AppData\Roaming\Tencent\QQBrowser\Extensions8\{0508DF1F-2AB6-4fac-A99E-45BBBF24E1E6}\8.0.0.12\QBSafe.dllFilesize
443KB
MD516ae0a59da95783599969cb2a8cd7b0d
SHA1993030a80ecf26ebbb723053072a4084ea89d8b1
SHA256d63ed7d6a3f5b7d5e5e641bccd8e8644493f7bd91b98656ab58d1b893958a2d9
SHA5124a772c6300ee294aa0b7b86e8de8c88805f9509dcc9467dbe427fb918d1a4d98b597591f4fca2ef24f55bc6e0cdb11ccb8d21449424e622663d935b8005dd1d9
-
C:\Users\Admin\AppData\Roaming\Tencent\QQBrowser\InstModules\QBUtils.dllFilesize
1.7MB
MD5268905b968aace3dbaf5dd97391071e9
SHA13ea52528166806275bf9c6a7aa8d4f359a140889
SHA256caa9c84d342c14543ddaf861efcc7b8e997f2d8bd270d408ba9764e29fcc88fd
SHA5121f0483c53bb3901721f90071889036777ae84ea257b8afa98c04b8142bae321732d012484482ea556f6cca65ec1255459a08e4156cc3cd52fbc44541b2fb568b
-
C:\Users\Admin\AppData\Roaming\Tencent\QQBrowser\InstModules\QBUtils.dllFilesize
1.7MB
MD5268905b968aace3dbaf5dd97391071e9
SHA13ea52528166806275bf9c6a7aa8d4f359a140889
SHA256caa9c84d342c14543ddaf861efcc7b8e997f2d8bd270d408ba9764e29fcc88fd
SHA5121f0483c53bb3901721f90071889036777ae84ea257b8afa98c04b8142bae321732d012484482ea556f6cca65ec1255459a08e4156cc3cd52fbc44541b2fb568b
-
C:\Users\Admin\AppData\Roaming\Tencent\QQBrowser\InstModules\QBUtils.dllFilesize
1.7MB
MD5268905b968aace3dbaf5dd97391071e9
SHA13ea52528166806275bf9c6a7aa8d4f359a140889
SHA256caa9c84d342c14543ddaf861efcc7b8e997f2d8bd270d408ba9764e29fcc88fd
SHA5121f0483c53bb3901721f90071889036777ae84ea257b8afa98c04b8142bae321732d012484482ea556f6cca65ec1255459a08e4156cc3cd52fbc44541b2fb568b
-
memory/456-353-0x0000000000000000-mapping.dmp
-
memory/504-246-0x000000006FFE0000-0x000000006FFF0000-memory.dmpFilesize
64KB
-
memory/504-258-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/504-253-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/504-255-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/504-247-0x000000006FFE0000-0x000000006FFF0000-memory.dmpFilesize
64KB
-
memory/504-250-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/504-239-0x0000000000000000-mapping.dmp
-
memory/504-244-0x000000006FFE0000-0x000000006FFF0000-memory.dmpFilesize
64KB
-
memory/524-348-0x0000000000000000-mapping.dmp
-
memory/868-307-0x0000000000000000-mapping.dmp
-
memory/900-173-0x0000000000000000-mapping.dmp
-
memory/988-351-0x0000000000000000-mapping.dmp
-
memory/1156-349-0x0000000000000000-mapping.dmp
-
memory/1196-238-0x0000000000000000-mapping.dmp
-
memory/1308-152-0x0000000000000000-mapping.dmp
-
memory/1308-263-0x0000000000000000-mapping.dmp
-
memory/1396-182-0x0000000000000000-mapping.dmp
-
memory/1456-273-0x0000000000000000-mapping.dmp
-
memory/1540-311-0x0000000000000000-mapping.dmp
-
memory/1600-275-0x0000000000000000-mapping.dmp
-
memory/1684-337-0x0000000000000000-mapping.dmp
-
memory/1752-302-0x0000000000000000-mapping.dmp
-
memory/1852-278-0x0000000000000000-mapping.dmp
-
memory/1936-237-0x0000000000000000-mapping.dmp
-
memory/2032-354-0x0000000000000000-mapping.dmp
-
memory/2084-274-0x0000000000000000-mapping.dmp
-
memory/2324-212-0x0000000000000000-mapping.dmp
-
memory/2324-280-0x0000000000000000-mapping.dmp
-
memory/2440-352-0x0000000000000000-mapping.dmp
-
memory/2488-328-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/2488-291-0x0000000000000000-mapping.dmp
-
memory/2488-293-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/2528-149-0x0000000000000000-mapping.dmp
-
memory/2552-213-0x0000000000000000-mapping.dmp
-
memory/2716-297-0x0000000000000000-mapping.dmp
-
memory/2828-303-0x0000000000000000-mapping.dmp
-
memory/2876-156-0x0000000000000000-mapping.dmp
-
memory/2884-287-0x0000000000000000-mapping.dmp
-
memory/3164-178-0x0000000000000000-mapping.dmp
-
memory/3228-286-0x0000000000000000-mapping.dmp
-
memory/3396-260-0x0000000000000000-mapping.dmp
-
memory/3504-245-0x0000000000000000-mapping.dmp
-
memory/3516-170-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/3516-171-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/3516-159-0x0000000000000000-mapping.dmp
-
memory/3580-174-0x0000000000000000-mapping.dmp
-
memory/3584-334-0x0000000000000000-mapping.dmp
-
memory/3588-336-0x0000000000000000-mapping.dmp
-
memory/3676-234-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/3676-235-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/3676-236-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/3676-231-0x0000000000000000-mapping.dmp
-
memory/4040-305-0x0000000000000000-mapping.dmp
-
memory/4280-350-0x0000000000000000-mapping.dmp
-
memory/4436-330-0x0000000000000000-mapping.dmp
-
memory/4460-276-0x0000000000000000-mapping.dmp
-
memory/4496-271-0x0000000000530000-0x000000000055D000-memory.dmpFilesize
180KB
-
memory/4496-141-0x00000000039E0000-0x0000000003A0D000-memory.dmpFilesize
180KB
-
memory/4496-138-0x00000000022B1000-0x00000000022B4000-memory.dmpFilesize
12KB
-
memory/4496-133-0x00000000022B1000-0x00000000022B4000-memory.dmpFilesize
12KB
-
memory/4496-268-0x0000000000531000-0x0000000000534000-memory.dmpFilesize
12KB
-
memory/4496-270-0x0000000000531000-0x000000000054D000-memory.dmpFilesize
112KB
-
memory/4536-214-0x0000000000000000-mapping.dmp
-
memory/4568-277-0x0000000000000000-mapping.dmp
-
memory/4584-356-0x0000000000000000-mapping.dmp
-
memory/4640-282-0x0000000000000000-mapping.dmp
-
memory/4680-227-0x000000006FFE0000-0x000000006FFF0000-memory.dmpFilesize
64KB
-
memory/4680-229-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/4680-232-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/4680-220-0x0000000000000000-mapping.dmp
-
memory/4680-228-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/4680-230-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/4748-264-0x0000000000000000-mapping.dmp
-
memory/4784-309-0x0000000000000000-mapping.dmp
-
memory/4804-143-0x0000000000000000-mapping.dmp
-
memory/4808-331-0x0000000000000000-mapping.dmp
-
memory/4820-257-0x0000000000000000-mapping.dmp
-
memory/4884-176-0x0000000000000000-mapping.dmp
-
memory/4920-322-0x0000000019170000-0x000000001925F000-memory.dmpFilesize
956KB
-
memory/4920-312-0x0000000000000000-mapping.dmp
-
memory/5020-299-0x0000000000000000-mapping.dmp
-
memory/5108-296-0x0000000000000000-mapping.dmp