Overview

overview

8

Static

static

Draw.io _caMQZ.exe

windows7-x64

8

Draw.io _caMQZ.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    103s
  • max time network
    109s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    18-10-2022 11:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Draw.io _caMQZ.exe

  • Size

    5.1MB

  • MD5

    5347d1465f1abfbe142bee26234c2d42

  • SHA1

    43aa39e7c91122fac3ceff37278f878eb60df870

  • SHA256

    3eeab0e2bbd7e74117cf4d36fa98a7d0125fc46161a1193f0b72fca297f5c8ac

  • SHA512

    afe6c2b058056813ef2f6642c5e4593c37bfc12b38f7f8990e3a923e56922a7c2647eb2e214d7da22de60648475bf59b2b3a9f4818f2861dbc37f9f8e10815bd

  • SSDEEP

    49152:nhvEwVL6q9TUDEYh8ESu07hZPKBmeSOlNUA2lEj6T6RSUvfkt9Y:1LVQYA08RSUnkt6

Score
8/10
discoveryspywarestealer

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 23 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 26 IoCs
  • Modifies system certificate store 2 TTPs 22 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Draw.io _caMQZ.exe
    "C:\Users\Admin\AppData\Local\Temp\Draw.io _caMQZ.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1436
    • C:\Users\Admin\AppData\Local\Temp\Quick_Driver_Updater_exe_5101820221109291327051947\Quick_Driver_Updater.exe
      "C:\Users\Admin\AppData\Local\Temp\Quick_Driver_Updater_exe_5101820221109291327051947\Quick_Driver_Updater.exe" /verysilent /ppi=1 /ppinag=1 /ddtime=500 /delay=5 /source=sftqdu1 /pixel=SFT5696_SFT5567_RUNT
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1940
      • C:\Users\Admin\AppData\Local\Temp\is-DLOTC.tmp\Quick_Driver_Updater.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-DLOTC.tmp\Quick_Driver_Updater.tmp" /SL5="$201A0,5773230,1034240,C:\Users\Admin\AppData\Local\Temp\Quick_Driver_Updater_exe_5101820221109291327051947\Quick_Driver_Updater.exe" /verysilent /ppi=1 /ppinag=1 /ddtime=500 /delay=5 /source=sftqdu1 /pixel=SFT5696_SFT5567_RUNT
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:436
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /delete /tn "Quick Driver Updater_launcher" /f
          4⤵
            PID:1808
          • C:\Windows\SysWOW64\taskkill.exe
            "C:\Windows\System32\taskkill.exe" /f /im "qdu.exe"
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1968
          • C:\Windows\system32\schtasks.exe
            "schtasks" /Create /F /RL Highest /SC ONCE /st 00:00 /TN "Quick Driver Updater skipuac" /TR "'C:\Program Files\Quick Driver Updater\qdu.exe'"
            4⤵
            • Creates scheduled task(s)
            PID:1156
          • C:\Program Files\Quick Driver Updater\qdu.exe
            "C:\Program Files\Quick Driver Updater\qdu.exe" cntryphnno
            4⤵
            • Executes dropped EXE
            • Modifies system certificate store
            PID:1400
      • C:\Users\Admin\AppData\Local\Temp\draw_io-13_9_9-windows-installer_exe_1101820221109164704703562\draw.io-13.9.9-windows-installer.exe
        "C:\Users\Admin\AppData\Local\Temp\draw_io-13_9_9-windows-installer_exe_1101820221109164704703562\draw.io-13.9.9-windows-installer.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1608
    • C:\Program Files\draw.io\draw.io.exe
      "C:\Program Files\draw.io\draw.io.exe"
      1⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1600
      • C:\Program Files\draw.io\draw.io.exe
        "C:\Program Files\draw.io\draw.io.exe" --type=gpu-process --field-trial-handle=976,3422835706857449898,7175595767374947996,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=984 /prefetch:2
        2⤵
          PID:1228
        • C:\Program Files\draw.io\draw.io.exe
          "C:\Program Files\draw.io\draw.io.exe" --type=renderer --field-trial-handle=976,3422835706857449898,7175595767374947996,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Program Files\draw.io\resources\app.asar" --node-integration --node-integration-in-worker --no-sandbox --no-zygote --enable-remote-module --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1404 /prefetch:1
          2⤵
            PID:1348
          • C:\Program Files\draw.io\draw.io.exe
            "C:\Program Files\draw.io\draw.io.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=976,3422835706857449898,7175595767374947996,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1352 /prefetch:8
            2⤵
              PID:1740

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\Quick Driver Updater\qdu.exe
            Filesize

            4.0MB

            MD5

            dfe06df90a37a45b23e33f510dda9554

            SHA1

            370edde62c86c1cdae423e966c6e31d5f0bffb58

            SHA256

            68e15d06d36f57bb45c819e0a3aada7023493bfbea1d2cbd1f3c1f421fe4b546

            SHA512

            c3a5589006c4e194f2cc7d5c053cd1ddcd4f0a4cdc76d104c0a32c64f0fb0103755523c90e8cba4c3818b49f0b9e144d010d4b97003cf66b9779e0e776220d70

            Download Submit

          • C:\Program Files\Quick Driver Updater\qdu.exe
            Filesize

            4.0MB

            MD5

            dfe06df90a37a45b23e33f510dda9554

            SHA1

            370edde62c86c1cdae423e966c6e31d5f0bffb58

            SHA256

            68e15d06d36f57bb45c819e0a3aada7023493bfbea1d2cbd1f3c1f421fe4b546

            SHA512

            c3a5589006c4e194f2cc7d5c053cd1ddcd4f0a4cdc76d104c0a32c64f0fb0103755523c90e8cba4c3818b49f0b9e144d010d4b97003cf66b9779e0e776220d70

            Download Submit

          • C:\Program Files\Quick Driver Updater\qdu.exe.config
            Filesize

            3KB

            MD5

            b6cd223552358a991d62398d8a769bda

            SHA1

            21c4455118aabf5064f4743007ea31795f07ceac

            SHA256

            1d890e3d22dbd0177acb4d307b98e5ec491b8085b7ca70c08ef5bd666489b619

            SHA512

            a019eeefba7672e13891a3ce1c29dbe781535e7e5bb9d035c50bcc1de67c37f4dfa8a46f0972c3f88c8da8db21cc9b1fda139c31350ec9672dd5ee2d685c3b0e

            Download Submit

          • C:\Program Files\draw.io\chrome_100_percent.pak
            Filesize

            176KB

            MD5

            d5719b1f791ac999c3cfda2e4405bdce

            SHA1

            c5d94054bcb271dee08714c313476abd67be28ca

            SHA256

            7cb9d93a16e5621ab765e3f3b459f4698ae496035e283f2c0c390b188a487741

            SHA512

            ce75bde78ddf6bc394662c5d0ce107ba375b13bf75a31ba1888dffa74900fa86babd65ce222c38db73a11c8d54b3c6f6046b8f71ce80281eec884fd7f0cd1583

            Download Submit

          • C:\Program Files\draw.io\chrome_200_percent.pak
            Filesize

            313KB

            MD5

            0649df49260e18326c9a54545131aaec

            SHA1

            76de40e3b828cb42cb8b9beb31808ea2145eda56

            SHA256

            070a6cb68318a032ec17cd7b07f8af8bd6983f16997f50a231d232396a2f570f

            SHA512

            c196726564ea218c1e58121f43ab6f138a676a47cd53ad9099daec4cc3a491cf7f9127c56f31f8ec460080ba5f2f56eb2f6c7d37e286e05c4dbd9592552185d4

            Download Submit

          • C:\Program Files\draw.io\draw.io.exe
            Filesize

            29.2MB

            MD5

            88737ff08ec88613ec856f4c219b0e7d

            SHA1

            107793460ecb2ff8d05baab91101e10d1a95fb75

            SHA256

            7ad26a1c006f4d961f5c9c1ead3b072b7dbe1bbe03cddda14e11bdaad3484688

            SHA512

            c4273ea61afc9780e05c240d5daf120037c52d98177e953f60668c2de0bd91b33faab09188053365dfe43cde1368812ec50f8558df873ed999ac9667051fa40e

            Download Submit

          • C:\Program Files\draw.io\draw.io.exe
            Filesize

            256KB

            MD5

            753ec052e21ece291a79396f08fc3e42

            SHA1

            0df99fd362d341ac8331217db6a2c575d9804a39

            SHA256

            7935c13b14228f5ade6d6304b12c269c7c22091246724fd003ffec43584c247f

            SHA512

            c47522d6784fbed379685039c4c78da8629fff77958cf486fa52198fab10b8ab086a560688d893c64545cdbf092446b9640e497c62cd5952fa91659d4beba4e9

            Download Submit

          • C:\Program Files\draw.io\draw.io.exe
            Filesize

            14.4MB

            MD5

            d666ddc441f79a2fff4de7c8e14e704d

            SHA1

            5efff815d03c9735bce5f03d7b5581da785d0658

            SHA256

            cce5d4175e1083cf7db5635a051bc1a8e2d468f5f624816335c2d0ef758497fb

            SHA512

            d4535c266bb83c87239e35677825889d17d87d59a9503664ba66f17b03b05e05bf82fcec04836338d78bf7fbda05ad103b5fadefb29ee3975ab85fabb0397ca7

            Download Submit

          • C:\Program Files\draw.io\draw.io.exe
            Filesize

            2.6MB

            MD5

            eb083075a8b2f2533f19b803894a66cb

            SHA1

            f22286b63247d7c1318118f865df26ab4f29024c

            SHA256

            2390c2c4de0e763f9cc8344b073e382ec6879c139e5453977c4b5b6b05b6bb72

            SHA512

            5a22c75395390a1f921eebe5e0695a7d06e428edcd636fb27c01015454a9e92cee0adca43b7ea22930088329bca9b131d4c6a660c83e0fdc60c7eb5f4c62b4b5

            Download Submit

          • C:\Program Files\draw.io\ffmpeg.dll
            Filesize

            2.7MB

            MD5

            e1197e74621313b2597792f61355314e

            SHA1

            2c7999023cd7051805fc196a865986b01fdeef45

            SHA256

            a3d1b9c673d242c2d862c30acb308cfb89b19e1cfb0db1f79daf69cf0d78dfe7

            SHA512

            ebb4d025a7622aedde7a32bbb4a3c6f05c48fee32fb1839b50a3145660c71112273af152b5290c0a92ecbc52d12f81420dd032e685ae84cf1b578978fc16a35c

            Download Submit

          • C:\Program Files\draw.io\icudtl.dat
            Filesize

            10.0MB

            MD5

            9732e28c054db1e042cd306a7bc9227a

            SHA1

            6bab2e77925515888808c1ef729c5bb1323100dd

            SHA256

            27993e2079711d5f0f04a72f48fee88b269604c8e3fbdf50a7f7bb3f5bfc8d8e

            SHA512

            3eb67ab896a56dab4a2d6eea98f251affd6864c5f5b24f22b61b6acc1df4460d86f0a448f1983aac019e79ff930286c3510891be9d48ef07a93ff975a0e55335

            Download Submit

          • C:\Program Files\draw.io\locales\en-US.pak
            Filesize

            80KB

            MD5

            69d7c5168de6b4311a36c39ca7ca60f0

            SHA1

            40ff72437b51677065d68a6486e3b03e0a27102d

            SHA256

            fdeb2723f423dfe7ee4c19cc052398cbe796bfce7d432d0abe4ea40e6c6e3dab

            SHA512

            4e1fd01bd7d5f65f8aa2f0b2f4845106df916a53dd4898d0cec7fc538c2908d22f4ffd3dacf023c7854f4854534468a9bc93763be21075661501c6ceca2ca0e7

            Download Submit

          • C:\Program Files\draw.io\resources.pak
            Filesize

            4.1MB

            MD5

            977bdf44c3bd2fa5ece6f23915a7acc6

            SHA1

            df371edc31eb80fe0899447deac2921f519c8cc5

            SHA256

            2fe8dd43b377a908df6454ec3005b3e25409a82bfb45c35ba871f05cc578c21e

            SHA512

            d437bcc48bec3ad66a5cd0e6d6c3948276b897f6eca034b3c221ea1dc00fe7b27425d1491a1634b6ac843fc1f12aecd20bf2a7da5fe8023aac824adc0f791639

            Download Submit

          • C:\Program Files\draw.io\resources\app.asar
            Filesize

            28.8MB

            MD5

            668de3007603dad34f065b185a7b8134

            SHA1

            8db25db2515c0927167ed441fef430a132f69fbf

            SHA256

            4992421988d39cf9baf36d1618cb3f2e1d53f37f11d90455bef1cfa5c1e619e5

            SHA512

            fda1cb8613acae762dad462c935a7ebe5be95aa0863b9233c0ccdbf132751df18e73b0321ce555fdc211d338020f8320915d9cc024d482ce96ed66e91d70252c

            Download Submit

          • C:\Program Files\draw.io\v8_context_snapshot.bin
            Filesize

            167KB

            MD5

            e6206aadd29eb87ab1d398266885b5a4

            SHA1

            6bdb54ed5fe55c9a1977cf2f3b27bc0ed560a889

            SHA256

            e55f6e08ff8baed84b5de903466311ae08b15e99dbbea2b5764d855a52e6fad8

            SHA512

            82739ccbf1823dce179eba73948f1f2263213d12d684282dfaaed3f147528074df82468453ed33b504d10d84357d834c0f29d928274d45ddfdc69a88989f2522

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
            Filesize

            60KB

            MD5

            d15aaa7c9be910a9898260767e2490e1

            SHA1

            2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

            SHA256

            f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

            SHA512

            7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            342B

            MD5

            7edce996a99fbda8fdd5ce454a7d23ea

            SHA1

            12a967d58b43314d38e709d3a79c13963b423010

            SHA256

            5affe510961f9aac05653cec7d0f5ff5637e6cfc091c50a0e5be1cc340d3ad05

            SHA512

            112b271d0ad2426c75c2092c207c5ff5b4ea39d41e1b9486ccc01c09ced446fb60e7ddbb402d66048314ee7c991ac7ac6d645b3f125b2f8d5da3b1d483978ffb

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            342B

            MD5

            da9709a6b2251d46a6d1684ac30ab5d6

            SHA1

            af781b72ebcb54a255191a6cab2099bc3084cc63

            SHA256

            cfe834ca52a94126c8eef7a11f253b497b48e531d17210bf9543458f4f73fa29

            SHA512

            6ddb100de97bc912424606e234e8af5a4cf98bccfa6974b39e4a27e18be248946cc7cdbcfe9f48db789355d550133b9a7b0ed67d37ad8f89d3cb2eefa1694f26

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Quick_Driver_Updater_exe_5101820221109291327051947\Quick_Driver_Updater.exe
            Filesize

            6.4MB

            MD5

            4aae3da061f772f90bae6902c72f7cf2

            SHA1

            c27cbebaa722793d0208e9908079d2caea70dace

            SHA256

            4df4c5e467ca99103d85bb250cda1279240bc2a7e892a0b174d32d8efe18b903

            SHA512

            068fa6af3e7e7ab862ae7789d7fea5a6e748f7e8a9268e43bedbb26f6fce99d97ae9915907319ae1482e67cfd0fdfddfa01c0e74070624c51369bd61316d17bd

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Quick_Driver_Updater_exe_5101820221109291327051947\Quick_Driver_Updater.exe
            Filesize

            6.4MB

            MD5

            4aae3da061f772f90bae6902c72f7cf2

            SHA1

            c27cbebaa722793d0208e9908079d2caea70dace

            SHA256

            4df4c5e467ca99103d85bb250cda1279240bc2a7e892a0b174d32d8efe18b903

            SHA512

            068fa6af3e7e7ab862ae7789d7fea5a6e748f7e8a9268e43bedbb26f6fce99d97ae9915907319ae1482e67cfd0fdfddfa01c0e74070624c51369bd61316d17bd

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\draw_io-13_9_9-windows-installer_exe_1101820221109164704703562\draw.io-13.9.9-windows-installer.exe
            Filesize

            70.7MB

            MD5

            6383382cf2950ec6dab0255ad3426982

            SHA1

            2df82de8fd8408f0a7b96596f01cd1021ad816bf

            SHA256

            6adbe273b47867fa881e44e17549214741039be1db9fd1f51f23fab6727ea053

            SHA512

            00b08fda74d68c62867de01059f45a246a8294e534f36b40b6b5602bf2371ebebe800aa0260625a3ae7922a8c8e3289ba683c0a5d2db581e39c591e028e192ae

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\draw_io-13_9_9-windows-installer_exe_1101820221109164704703562\draw.io-13.9.9-windows-installer.exe
            Filesize

            70.7MB

            MD5

            6383382cf2950ec6dab0255ad3426982

            SHA1

            2df82de8fd8408f0a7b96596f01cd1021ad816bf

            SHA256

            6adbe273b47867fa881e44e17549214741039be1db9fd1f51f23fab6727ea053

            SHA512

            00b08fda74d68c62867de01059f45a246a8294e534f36b40b6b5602bf2371ebebe800aa0260625a3ae7922a8c8e3289ba683c0a5d2db581e39c591e028e192ae

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\is-DLOTC.tmp\Quick_Driver_Updater.tmp
            Filesize

            2.7MB

            MD5

            348e9aad9e445392ba5c9fe96daf6f8b

            SHA1

            e04d450778d05cabb111903892dda0cdb288cd98

            SHA256

            5bae7f43baa254ce2eba9018e11c575730427d4fdf3146165755cd4bb07c3e53

            SHA512

            c19e21b4ce0908bd5b0d7f606f6ee44d0b8839ddcab7067933092a707d21131b7379a1850e35475e57be62cba1b61abde61331bd1bccdd875e756bb296f34024

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\is-DLOTC.tmp\Quick_Driver_Updater.tmp
            Filesize

            2.7MB

            MD5

            348e9aad9e445392ba5c9fe96daf6f8b

            SHA1

            e04d450778d05cabb111903892dda0cdb288cd98

            SHA256

            5bae7f43baa254ce2eba9018e11c575730427d4fdf3146165755cd4bb07c3e53

            SHA512

            c19e21b4ce0908bd5b0d7f606f6ee44d0b8839ddcab7067933092a707d21131b7379a1850e35475e57be62cba1b61abde61331bd1bccdd875e756bb296f34024

            Download Submit

          • \Program Files\Quick Driver Updater\qdu.exe
            Filesize

            4.0MB

            MD5

            dfe06df90a37a45b23e33f510dda9554

            SHA1

            370edde62c86c1cdae423e966c6e31d5f0bffb58

            SHA256

            68e15d06d36f57bb45c819e0a3aada7023493bfbea1d2cbd1f3c1f421fe4b546

            SHA512

            c3a5589006c4e194f2cc7d5c053cd1ddcd4f0a4cdc76d104c0a32c64f0fb0103755523c90e8cba4c3818b49f0b9e144d010d4b97003cf66b9779e0e776220d70

            Download Submit

          • \Program Files\Quick Driver Updater\qdu.exe
            Filesize

            4.0MB

            MD5

            dfe06df90a37a45b23e33f510dda9554

            SHA1

            370edde62c86c1cdae423e966c6e31d5f0bffb58

            SHA256

            68e15d06d36f57bb45c819e0a3aada7023493bfbea1d2cbd1f3c1f421fe4b546

            SHA512

            c3a5589006c4e194f2cc7d5c053cd1ddcd4f0a4cdc76d104c0a32c64f0fb0103755523c90e8cba4c3818b49f0b9e144d010d4b97003cf66b9779e0e776220d70

            Download Submit

          • \Program Files\Quick Driver Updater\qdu.exe
            Filesize

            4.0MB

            MD5

            dfe06df90a37a45b23e33f510dda9554

            SHA1

            370edde62c86c1cdae423e966c6e31d5f0bffb58

            SHA256

            68e15d06d36f57bb45c819e0a3aada7023493bfbea1d2cbd1f3c1f421fe4b546

            SHA512

            c3a5589006c4e194f2cc7d5c053cd1ddcd4f0a4cdc76d104c0a32c64f0fb0103755523c90e8cba4c3818b49f0b9e144d010d4b97003cf66b9779e0e776220d70

            Download Submit

          • \Program Files\Quick Driver Updater\unins000.exe
            Filesize

            2.7MB

            MD5

            348e9aad9e445392ba5c9fe96daf6f8b

            SHA1

            e04d450778d05cabb111903892dda0cdb288cd98

            SHA256

            5bae7f43baa254ce2eba9018e11c575730427d4fdf3146165755cd4bb07c3e53

            SHA512

            c19e21b4ce0908bd5b0d7f606f6ee44d0b8839ddcab7067933092a707d21131b7379a1850e35475e57be62cba1b61abde61331bd1bccdd875e756bb296f34024

            Download Submit

          • \Program Files\draw.io\draw.io.exe
            Filesize

            72.8MB

            MD5

            202fe07ec150efa20374f020414e9e2e

            SHA1

            ad817e1256d8b4920e97ea1f101fe6605b86c052

            SHA256

            29a769d28f6a9b518a5ea7fe3ef8d2037dd62c99261f97b2bcd9acb3fd3dd1ee

            SHA512

            0614db0a3fcef25ad08b076e72571afbea07efafd682f740101f6269ea0262a419d303765592b44aeeab0b38ecbff0e10b6a92210d0d267cbc9b8bfa9a4cbda4

            Download Submit

          • \Program Files\draw.io\draw.io.exe
            Filesize

            74.1MB

            MD5

            bf9ea6f1c3b5bee6f14e1d59284cba2c

            SHA1

            da1a89e5c91a10753aa5f18be527c2129ad11f3c

            SHA256

            bc24fd79b542dfca873b1b20b6c623d106a0b73689597ba6bc398b78d73d8e02

            SHA512

            aeb8732913ea70b83487df41f246cff600278afefe057509108973e90450a1c8f84ce06816024e60db0087e17e3815e66474c474bc003e1695b258896b828f66

            Download Submit

          • \Program Files\draw.io\draw.io.exe
            Filesize

            72.9MB

            MD5

            a13d0f88a307182f89dfa4a4c5cc55bb

            SHA1

            eb5e187278bbafce917c1dcb2100cdf126c4629e

            SHA256

            10de96dee7e19b54fa8ef38974b3b24c38366636498f758224ddd38ff8ea2eac

            SHA512

            e4c6cbf07634824371f9f165dcee12cbe85dfc6f684f31b2ccd33c8150b543f557f01dd4a3bce2e9810be76cb11736fce006985a3d1093d02d20c28e4f666058

            Download Submit

          • \Program Files\draw.io\draw.io.exe
            Filesize

            72.5MB

            MD5

            9e9640edd54f7a6e7ec156bf41b9cb7f

            SHA1

            58170ca7150fe7485b1932eee52d94665c691919

            SHA256

            82dcdc60d99e80e6bfba906840db357dd9357e1b8e66ee75e8607e29dbd1fe57

            SHA512

            8399cca1b7f0ec655931d8386703f3d7d545b912406c303b73d29d2bce0a5e2eb3a354b3145c641c395724b5bb415e5158c9b7343bf73b5730c60022f7c55139

            Download Submit

          • \Program Files\draw.io\draw.io.exe
            Filesize

            70.6MB

            MD5

            1e010e1b0037b7c5bc9f07388b2c64de

            SHA1

            4eefaad47f826422da89c137af7d17e2c64b375e

            SHA256

            fafbbb30fa7c0ee479553aed3de6d98478ede171f56fc596be4fe440dbeeef27

            SHA512

            b51a1adc50d203eea7d52cd724c361fca7392cabd59f7c04bc4071f3b01757e13c7092c1576358064bf561a72b79236a70b01d903d1da1f75402568fdcd43c07

            Download Submit

          • \Program Files\draw.io\draw.io.exe
            Filesize

            70.5MB

            MD5

            9b3f25b040a7d4b9cbfbbfc225b64648

            SHA1

            fd864726737f18a39b76fc9e01db03459d434955

            SHA256

            aff53c5b603114a8e768215adeefd05d6717af802e187dfdc51abdad5d76389f

            SHA512

            604bacc1fc2362845e3d14aa19e38f3a0cd0bcc20b09e84e6a458e69a87ed0bd63c765fb7cab248c0d6af9f5bcd8bfb3863a459a3cfdec6e7284ed79b54083ab

            Download Submit

          • \Program Files\draw.io\draw.io.exe
            Filesize

            70.8MB

            MD5

            5f828270a16277a2a8d929cdc162f96b

            SHA1

            41446f221a972c33ba5454d99bc27edf0a674a4f

            SHA256

            3c341a1b575189a651cb94d928feaa999d716ecd94a9056f0689e5f57b415dff

            SHA512

            55d3f9ad48a0a8133cd16d0c5e4f3a756a9efaf13fcc2e1525dbf482f9f4fcf97a9b4730916a2de1cef020d0d7ffa5f5d71d2d5c166bc3506d6fd08fc812fe73

            Download Submit

          • \Program Files\draw.io\draw.io.exe
            Filesize

            26.6MB

            MD5

            b98757dac7ad09a488c9f3801ab17338

            SHA1

            3182142b5f5eaf7a2e854d5941d9368b59ac4baf

            SHA256

            bfa5447f22b2503373603d95bf9203aef994db53c4ffb5afb9cd99b916cee40f

            SHA512

            b1c41ff7bb3784815805ea1c61b14eab35ce26a7cffc501fc33b8fdf76e0ce754e88f567af094735294afc850e60c05f2cb67c5ca611178c3085e12afa8d4ff2

            Download Submit

          • \Program Files\draw.io\draw.io.exe
            Filesize

            3.4MB

            MD5

            30c29eef059915c3db482c8d25d5ae65

            SHA1

            affe5048e87631ae41688a601a74fcd532881b7f

            SHA256

            0e87dffd954600af2e1229853316ea4acd45fbe1d6292d2b29b950222f682954

            SHA512

            eb6e183c520a645e3c4f4a6a1b179c32e5cf8198fca59f4cdc7656d67be7356c65dc4fc2e725a3c93bb080675b1b8b7d09a4fce70d8fe6224550ba0bd431a028

            Download Submit

          • \Program Files\draw.io\ffmpeg.dll
            Filesize

            2.7MB

            MD5

            e1197e74621313b2597792f61355314e

            SHA1

            2c7999023cd7051805fc196a865986b01fdeef45

            SHA256

            a3d1b9c673d242c2d862c30acb308cfb89b19e1cfb0db1f79daf69cf0d78dfe7

            SHA512

            ebb4d025a7622aedde7a32bbb4a3c6f05c48fee32fb1839b50a3145660c71112273af152b5290c0a92ecbc52d12f81420dd032e685ae84cf1b578978fc16a35c

            Download Submit

          • \Program Files\draw.io\ffmpeg.dll
            Filesize

            2.1MB

            MD5

            b30cfa989a714f0bb14ccd52ce62cfbe

            SHA1

            7ed4d85cfd4fa3f940ae33fd130dc0fe59eabdb6

            SHA256

            e91e27ff9fc6428367c1312c2b7c0a156e45960b30b63b46b80fc92615a93358

            SHA512

            13a57e674ff54e6a1fc22f93b4b1c07eb7fc67125807cb4e6ea1a67ad9eece0508bfb1c56e1f3ad34b0fb29552d7c5fdb7344063cbe95020d081f178106a8320

            Download Submit

          • \Program Files\draw.io\ffmpeg.dll
            Filesize

            2.7MB

            MD5

            e1197e74621313b2597792f61355314e

            SHA1

            2c7999023cd7051805fc196a865986b01fdeef45

            SHA256

            a3d1b9c673d242c2d862c30acb308cfb89b19e1cfb0db1f79daf69cf0d78dfe7

            SHA512

            ebb4d025a7622aedde7a32bbb4a3c6f05c48fee32fb1839b50a3145660c71112273af152b5290c0a92ecbc52d12f81420dd032e685ae84cf1b578978fc16a35c

            Download Submit

          • \Users\Admin\AppData\Local\Temp\is-DLOTC.tmp\Quick_Driver_Updater.tmp
            Filesize

            2.7MB

            MD5

            348e9aad9e445392ba5c9fe96daf6f8b

            SHA1

            e04d450778d05cabb111903892dda0cdb288cd98

            SHA256

            5bae7f43baa254ce2eba9018e11c575730427d4fdf3146165755cd4bb07c3e53

            SHA512

            c19e21b4ce0908bd5b0d7f606f6ee44d0b8839ddcab7067933092a707d21131b7379a1850e35475e57be62cba1b61abde61331bd1bccdd875e756bb296f34024

            Download Submit

          • \Users\Admin\AppData\Local\Temp\nsoAF35.tmp\StdUtils.dll
            Filesize

            100KB

            MD5

            c6a6e03f77c313b267498515488c5740

            SHA1

            3d49fc2784b9450962ed6b82b46e9c3c957d7c15

            SHA256

            b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

            SHA512

            9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

            Download Submit

          • \Users\Admin\AppData\Local\Temp\nsoAF35.tmp\System.dll
            Filesize

            12KB

            MD5

            0d7ad4f45dc6f5aa87f606d0331c6901

            SHA1

            48df0911f0484cbe2a8cdd5362140b63c41ee457

            SHA256

            3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

            SHA512

            c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

            Download Submit

          • \Users\Admin\AppData\Local\Temp\nsoAF35.tmp\UAC.dll
            Filesize

            14KB

            MD5

            adb29e6b186daa765dc750128649b63d

            SHA1

            160cbdc4cb0ac2c142d361df138c537aa7e708c9

            SHA256

            2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

            SHA512

            b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

            Download Submit

          • \Users\Admin\AppData\Local\Temp\nsoAF35.tmp\WinShell.dll
            Filesize

            3KB

            MD5

            1cc7c37b7e0c8cd8bf04b6cc283e1e56

            SHA1

            0b9519763be6625bd5abce175dcc59c96d100d4c

            SHA256

            9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

            SHA512

            7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

            Download Submit

          • \Users\Admin\AppData\Local\Temp\nsoAF35.tmp\WinShell.dll
            Filesize

            3KB

            MD5

            1cc7c37b7e0c8cd8bf04b6cc283e1e56

            SHA1

            0b9519763be6625bd5abce175dcc59c96d100d4c

            SHA256

            9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

            SHA512

            7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

            Download Submit

          • \Users\Admin\AppData\Local\Temp\nsoAF35.tmp\nsDialogs.dll
            Filesize

            9KB

            MD5

            466179e1c8ee8a1ff5e4427dbb6c4a01

            SHA1

            eb607467009074278e4bd50c7eab400e95ae48f7

            SHA256

            1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172

            SHA512

            7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817

            Download Submit

          • \Users\Admin\AppData\Local\Temp\nsoAF35.tmp\nsProcess.dll
            Filesize

            4KB

            MD5

            f0438a894f3a7e01a4aae8d1b5dd0289

            SHA1

            b058e3fcfb7b550041da16bf10d8837024c38bf6

            SHA256

            30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

            SHA512

            f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

            Download Submit

          • \Users\Admin\AppData\Local\Temp\nsoAF35.tmp\nsis7z.dll
            Filesize

            424KB

            MD5

            80e44ce4895304c6a3a831310fbf8cd0

            SHA1

            36bd49ae21c460be5753a904b4501f1abca53508

            SHA256

            b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

            SHA512

            c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

            Download Submit

          • memory/436-73-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

            Filesize

            8KB

            Download

          • memory/436-67-0x0000000000000000-mapping.dmp

            Download

          • memory/1156-78-0x0000000000000000-mapping.dmp

            Download

          • memory/1228-154-0x0000000000000000-mapping.dmp

            Download

          • memory/1348-161-0x0000000000000000-mapping.dmp

            Download

          • memory/1400-95-0x000007FEECB00000-0x000007FEEDACA000-memory.dmp

            Filesize

            15.8MB

            Download

          • memory/1400-94-0x000007FEF2950000-0x000007FEF2E10000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/1400-93-0x000007FEEDAD0000-0x000007FEEE4F3000-memory.dmp

            Filesize

            10.1MB

            Download

          • memory/1400-80-0x0000000000000000-mapping.dmp

            Download

          • memory/1400-97-0x000007FEEB8A0000-0x000007FEECAF3000-memory.dmp

            Filesize

            18.3MB

            Download

          • memory/1436-54-0x000007FEFC331000-0x000007FEFC333000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1608-86-0x0000000000000000-mapping.dmp

            Download

          • memory/1740-158-0x0000000000000000-mapping.dmp

            Download

          • memory/1808-71-0x0000000000000000-mapping.dmp

            Download

          • memory/1940-70-0x0000000000400000-0x000000000050A000-memory.dmp

            Filesize

            1.0MB

            Download

          • memory/1940-96-0x0000000000400000-0x000000000050A000-memory.dmp

            Filesize

            1.0MB

            Download

          • memory/1940-63-0x0000000000400000-0x000000000050A000-memory.dmp

            Filesize

            1.0MB

            Download

          • memory/1940-62-0x0000000075711000-0x0000000075713000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1940-60-0x0000000000000000-mapping.dmp

            Download

          • memory/1968-72-0x0000000000000000-mapping.dmp

            Download