5ea34b7e57eb2739364fff49d71fbc67212b27499895774cf93406c089333a1f

Analysis

max time kernel
186s
max time network
191s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.exe
Size

584KB
MD5

5dd749927d1bfce97a8e766941decefa
SHA1

2f14dfca70001ac41433eba2feaeb3dd99379ada
SHA256

516fb75211c7bce16a5e0c625e25eebda7f2103ebece1473a7a45094cf79f12a
SHA512

9a8ae0478664470f264479c84cccef46a0c59432599acff6d7fca0334a866beed03520414d2c4a0cc1a86afbb705715f307df3e50bc7917b23361ffa858c4050
SSDEEP

12288:VbD1UDWNSVbJIwnPaBlPZ4SEha829ffi2Jx3h6wq6/c:V/1ULbJIwPOySEha/9ni2J18wq6/c

Score

10^/10

bootkit discovery evasion persistence trojan

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\K8Shell	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\K8Shell\ = "{53506455-E799-443f-ADDB-891CA6EFC928}"	regsvr32.exe

Downloads MZ/PE file
Executes dropped EXE 7 IoCs

Processes:

kuai8_c100019.exeK8GM.exeK8Update.exeK8GM.exeK8Bubble.exeK8Update.exeK8Update.exe

pid process

1500 kuai8_c100019.exe
1568 K8GM.exe
1852 K8Update.exe
1320 K8GM.exe
572 K8Bubble.exe
1304 K8Update.exe
1456 K8Update.exe
Modifies Windows Firewall 1 TTPs 4 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exenetsh.exenetsh.exe

pid process

1256 netsh.exe
1208 netsh.exe
1468 netsh.exe
1692 netsh.exe

pid	process
1500	kuai8_c100019.exe
1568	K8GM.exe
1852	K8Update.exe
1320	K8GM.exe
572	K8Bubble.exe
1304	K8Update.exe
1456	K8Update.exe

pid	process
1256	netsh.exe
1208	netsh.exe
1468	netsh.exe
1692	netsh.exe

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}\InprocServer32\ = "C:\\Program Files (x86)\\Kuai8\\tool_x64\\K8Shell.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}\InprocServer32\ = "C:\\Program Files (x86)\\Kuai8\\tool_x64\\K8ShellIcon.dll"	regsvr32.exe

Loads dropped DLL 64 IoCs

Processes:

setup.exekuai8_c100019.exeK8GM.exeK8Update.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeK8GM.exeK8Bubble.exeK8Update.exe

pid	process
1128	setup.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1568	K8GM.exe
1568	K8GM.exe
1568	K8GM.exe
1568	K8GM.exe
1568	K8GM.exe
1568	K8GM.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1852	K8Update.exe
1852	K8Update.exe
1852	K8Update.exe
1852	K8Update.exe
1852	K8Update.exe
2032	regsvr32.exe
1048	regsvr32.exe
1380	regsvr32.exe
952	regsvr32.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1320	K8GM.exe
1320	K8GM.exe
1500	kuai8_c100019.exe
1320	K8GM.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1500	kuai8_c100019.exe
1320	K8GM.exe
1320	K8GM.exe
572	K8Bubble.exe
572	K8Bubble.exe
572	K8Bubble.exe
572	K8Bubble.exe
572	K8Bubble.exe
1320	K8GM.exe
1320	K8GM.exe
1304	K8Update.exe
1304	K8Update.exe
1320	K8GM.exe
1320	K8GM.exe
1320	K8GM.exe
1320	K8GM.exe
1320	K8GM.exe
1320	K8GM.exe
1320	K8GM.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

K8Bubble.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\K8box = "\"C:\\Program Files (x86)\\Kuai8\\K8GM.exe\" -background"	K8Bubble.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

kuai8_c100019.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA kuai8_c100019.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kuai8_c100019.exe

Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

K8GM.exeK8Bubble.exeK8Update.exeK8Update.exeK8Update.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	K8GM.exe
File opened for modification	\??\PhysicalDrive0	K8Bubble.exe
File opened for modification	\??\PhysicalDrive0	K8Update.exe
File opened for modification	\??\PhysicalDrive0	K8Update.exe
File opened for modification	\??\PhysicalDrive0	K8Update.exe

Drops file in Program Files directory 37 IoCs

Processes:

kuai8_c100019.exe

description	ioc	process
File created	C:\Program Files (x86)\Kuai8\tool\K8RestoreWindow.dll	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\tool\K8Common.dll	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\tool\K8MiniPage.exe	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\tool\K8NetDetect.exe	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\K8Common.dll	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\K8Browser.exe	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\K8Version.dll	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\K8DLUtils.dll	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\tool\K8External.exe	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\tool\Microsoft.VC80.CRT.manifest	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\tool\K8ShellIcon.dll	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\K8GM.exe	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\tool\msvcp80.dll	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\tool\msvcr80.dll	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\K8Update.exe	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\K8UIRender.dll	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\tool\K8UIRender.dll	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\tool\K8PluginFix.exe	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\audio\complete.wav	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\K8Web.exe	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\tool\K8RTLFix.exe	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\msvcp80.dll	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\K8GameShell32.dll	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\K8GameShell64.dll	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\tool\K8Bubble.exe	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\tool\K8Tray.exe	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\K8UrlEncrypt.dll	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\K8DLPlatform.exe	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\tool\K8TaskBar.exe	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\tool_x64\K8Shell.dll	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\tool_x64\K8ShellIcon.dll	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\tool\K8Shell.dll	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\K8BugReport.exe	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\msvcr80.dll	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\Uninstall.exe	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\tool\K8DLUtils.dll	kuai8_c100019.exe
File created	C:\Program Files (x86)\Kuai8\Microsoft.VC80.CRT.manifest	kuai8_c100019.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

Processes:

K8GM.exekuai8_c100019.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\K8MiniPage.exe = "1"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\K8MiniPage.exe = "1"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\K8Web.exe = "1"	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\K8MiniPage.exe = "1"	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS\K8MiniPage.exe = "1"	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	kuai8_c100019.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\K8Web.exe = "1"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_Cross_Domain_Redirect_Mitigation\K8Web.exe = "1"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS\K8Web.exe = "1"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\K8Web.exe = "1"	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_Cross_Domain_Redirect_Mitigation	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_TABBED_BROWSING\K8MiniPage.exe = "1"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\K8MiniPage.exe = "1"	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\kuai8box.com\Total = "63"	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	kuai8_c100019.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_TABBED_BROWSING\K8Web.exe = "1"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\K8MiniPage.exe = "11000"	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	K8GM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	kuai8_c100019.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\K8GM.exe = "11000"	kuai8_c100019.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\K8Web.exe = "11000"	kuai8_c100019.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_TABBED_BROWSING	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\kuai8box.com\NumberOfSubdomains = "1"	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\yxh.kuai8box.com	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\yxh.kuai8box.com\ = "63"	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\K8Browser.exe = "11000"	kuai8_c100019.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\K8Web.exe = "1"	K8GM.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\kuai8box.com	K8GM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_Cross_Domain_Redirect_Mitigation\K8MiniPage.exe = "1"	K8GM.exe

Modifies registry class 33 IoCs

Processes:

regsvr32.exeregsvr32.exekuai8_c100019.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\K8Shell.DLL	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk\ShellEx\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\K8Shell	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\K8Shell	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GMShellIcon.DLL\AppID = "{92B0B94D-A0F1-4ede-A99D-9A5820E51F61}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}\InprocServer32\ = "C:\\Program Files (x86)\\Kuai8\\tool_x64\\K8ShellIcon.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings	kuai8_c100019.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\K8Shell.DLL\AppID = "{36BE2460-08C1-44bb-B0B7-8D45FAD1A960}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk\ShellEx\ContextMenuHandlers\K8Shell\ = "{53506455-E799-443f-ADDB-891CA6EFC928}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	kuai8_c100019.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{36BE2460-08C1-44bb-B0B7-8D45FAD1A960}\ = "K8Shell"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{92B0B94D-A0F1-4ede-A99D-9A5820E51F61}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}\ = "¿ì°ÉÓÎÏ·Ä¿Â¼Í¼±ê"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}\InprocServer32\ = "C:\\Program Files (x86)\\Kuai8\\tool_x64\\K8Shell.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GMShellIcon.DLL	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\K8Shell	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\K8Shell\ = "{53506455-E799-443f-ADDB-891CA6EFC928}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\K8Shell\ = "{53506455-E799-443f-ADDB-891CA6EFC928}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}\ = "¿ì°ÉÓÎÏ·ÓÒ¼ü²Ëµ¥À©Õ¹"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}\AppID = "{36BE2460-08C1-44bb-B0B7-8D45FAD1A960}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{36BE2460-08C1-44bb-B0B7-8D45FAD1A960}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\K8Shell\ = "{53506455-E799-443f-ADDB-891CA6EFC928}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{92B0B94D-A0F1-4ede-A99D-9A5820E51F61}\ = "K8ShellIcon"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{379CD200-C191-4f1e-9459-131ACD92130B}\AppID = "{92B0B94D-A0F1-4ede-A99D-9A5820E51F61}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53506455-E799-443f-ADDB-891CA6EFC928}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk\ShellEx\ContextMenuHandlers\K8Shell	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

kuai8_c100019.exeK8GM.exe

pid process

1500 kuai8_c100019.exe
1320 K8GM.exe
1320 K8GM.exe
1320 K8GM.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

K8GM.exeK8GM.exe

description pid process

Token: SeManageVolumePrivilege 1568 K8GM.exe
Token: SeManageVolumePrivilege 1320 K8GM.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

K8GM.exe

pid process

1320 K8GM.exe
1320 K8GM.exe
1320 K8GM.exe
1320 K8GM.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

K8GM.exe

pid process

1320 K8GM.exe
1320 K8GM.exe
1320 K8GM.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

K8GM.exe

pid process

1320 K8GM.exe
1320 K8GM.exe

pid	process
1500	kuai8_c100019.exe
1320	K8GM.exe
1320	K8GM.exe
1320	K8GM.exe

description	pid	process
Token: SeManageVolumePrivilege	1568	K8GM.exe
Token: SeManageVolumePrivilege	1320	K8GM.exe

pid	process
1320	K8GM.exe
1320	K8GM.exe
1320	K8GM.exe
1320	K8GM.exe

pid	process
1320	K8GM.exe
1320	K8GM.exe
1320	K8GM.exe

pid	process
1320	K8GM.exe
1320	K8GM.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup.exekuai8_c100019.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1128 wrote to memory of 1500	1128	setup.exe	kuai8_c100019.exe
PID 1128 wrote to memory of 1500	1128	setup.exe	kuai8_c100019.exe
PID 1128 wrote to memory of 1500	1128	setup.exe	kuai8_c100019.exe
PID 1128 wrote to memory of 1500	1128	setup.exe	kuai8_c100019.exe
PID 1128 wrote to memory of 1500	1128	setup.exe	kuai8_c100019.exe
PID 1128 wrote to memory of 1500	1128	setup.exe	kuai8_c100019.exe
PID 1128 wrote to memory of 1500	1128	setup.exe	kuai8_c100019.exe
PID 1500 wrote to memory of 1320	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1320	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1320	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1320	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1320	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1320	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1320	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1772	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1772	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1772	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1772	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1772	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1772	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1772	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1996	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1996	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1996	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1996	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1996	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1996	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1996	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1680	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1680	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1680	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1680	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1680	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1680	1500	kuai8_c100019.exe	cmd.exe
PID 1500 wrote to memory of 1680	1500	kuai8_c100019.exe	cmd.exe
PID 1320 wrote to memory of 1256	1320	cmd.exe	netsh.exe
PID 1320 wrote to memory of 1256	1320	cmd.exe	netsh.exe
PID 1320 wrote to memory of 1256	1320	cmd.exe	netsh.exe
PID 1320 wrote to memory of 1256	1320	cmd.exe	netsh.exe
PID 1320 wrote to memory of 1256	1320	cmd.exe	netsh.exe
PID 1320 wrote to memory of 1256	1320	cmd.exe	netsh.exe
PID 1320 wrote to memory of 1256	1320	cmd.exe	netsh.exe
PID 1996 wrote to memory of 1208	1996	cmd.exe	netsh.exe
PID 1996 wrote to memory of 1208	1996	cmd.exe	netsh.exe
PID 1996 wrote to memory of 1208	1996	cmd.exe	netsh.exe
PID 1996 wrote to memory of 1208	1996	cmd.exe	netsh.exe
PID 1996 wrote to memory of 1208	1996	cmd.exe	netsh.exe
PID 1996 wrote to memory of 1208	1996	cmd.exe	netsh.exe
PID 1996 wrote to memory of 1208	1996	cmd.exe	netsh.exe
PID 1772 wrote to memory of 1468	1772	cmd.exe	netsh.exe
PID 1772 wrote to memory of 1468	1772	cmd.exe	netsh.exe
PID 1772 wrote to memory of 1468	1772	cmd.exe	netsh.exe
PID 1772 wrote to memory of 1468	1772	cmd.exe	netsh.exe
PID 1772 wrote to memory of 1468	1772	cmd.exe	netsh.exe
PID 1772 wrote to memory of 1468	1772	cmd.exe	netsh.exe
PID 1772 wrote to memory of 1468	1772	cmd.exe	netsh.exe
PID 1500 wrote to memory of 1568	1500	kuai8_c100019.exe	K8GM.exe
PID 1500 wrote to memory of 1568	1500	kuai8_c100019.exe	K8GM.exe
PID 1500 wrote to memory of 1568	1500	kuai8_c100019.exe	K8GM.exe
PID 1500 wrote to memory of 1568	1500	kuai8_c100019.exe	K8GM.exe
PID 1500 wrote to memory of 1568	1500	kuai8_c100019.exe	K8GM.exe
PID 1500 wrote to memory of 1568	1500	kuai8_c100019.exe	K8GM.exe
PID 1500 wrote to memory of 1568	1500	kuai8_c100019.exe	K8GM.exe
PID 1680 wrote to memory of 1692	1680	cmd.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1128

C:\Users\Admin\AppData\Local\Temp\kuai8_c100019.exe
C:\Users\Admin\AppData\Local\Temp\kuai8_c100019.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c netsh firewall add allowedprogram program="C:\Program Files (x86)\Kuai8\K8GM.exe" name="快吧游戏管理器" mode=ENABLE scope=ALL
3⤵
- Suspicious use of WriteProcessMemory
PID:1320

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program="C:\Program Files (x86)\Kuai8\K8GM.exe" name="快吧游戏管理器" mode=ENABLE scope=ALL
4⤵
- Modifies Windows Firewall
PID:1256

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c netsh firewall add allowedprogram program="C:\Program Files (x86)\Kuai8\K8DLPlatform.exe" name="快吧游戏下载平台" mode=ENABLE scope=ALL
3⤵
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program="C:\Program Files (x86)\Kuai8\K8DLPlatform.exe" name="快吧游戏下载平台" mode=ENABLE scope=ALL
4⤵
- Modifies Windows Firewall
PID:1468

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c netsh firewall add allowedprogram program="C:\Program Files (x86)\Kuai8\tool\K8RTLFix.exe" name="快吧运行库检测程序" mode=ENABLE scope=ALL
3⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program="C:\Program Files (x86)\Kuai8\tool\K8RTLFix.exe" name="快吧运行库检测程序" mode=ENABLE scope=ALL
4⤵
- Modifies Windows Firewall
PID:1208

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c netsh firewall add allowedprogram program="C:\Program Files (x86)\Kuai8\tool\K8PluginFix.exe" name="快吧下载故障检测程序" mode=ENABLE scope=ALL
3⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program="C:\Program Files (x86)\Kuai8\tool\K8PluginFix.exe" name="快吧下载故障检测程序" mode=ENABLE scope=ALL
4⤵
- Modifies Windows Firewall
PID:1692

C:\Program Files (x86)\Kuai8\K8GM.exe
"C:\Program Files (x86)\Kuai8\K8GM.exe" -update_data
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Program Files (x86)\Kuai8\K8Update.exe
"C:\Program Files (x86)\Kuai8\K8Update.exe" -install
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
PID:1852

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Program Files (x86)\Kuai8\tool_x64\K8Shell.dll"
3⤵
- Loads dropped DLL
PID:2032

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\Kuai8\tool_x64\K8Shell.dll"
4⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:1048

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Program Files (x86)\Kuai8\tool_x64\K8ShellIcon.dll"
3⤵
- Loads dropped DLL
PID:1380

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\Kuai8\tool_x64\K8ShellIcon.dll"
4⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:952

C:\Program Files (x86)\Kuai8\K8GM.exe
"C:\Program Files (x86)\Kuai8\K8GM.exe" -atonce
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1320

C:\Program Files (x86)\Kuai8\K8Update.exe
"C:\Program Files (x86)\Kuai8\K8Update.exe" -update -delay=3 -type=1
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
PID:1304

C:\Program Files (x86)\Kuai8\K8Update.exe
"C:\Program Files (x86)\Kuai8\K8Update.exe" -installrun
4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1456

C:\Program Files (x86)\Kuai8\tool\K8Bubble.exe
"C:\Program Files (x86)\Kuai8\tool\K8Bubble.exe" -query_action
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
PID:572

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Change Default File Association

T1042

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Kuai8\K8Common.dll

Filesize
3.3MB

MD5
9dbd17cfcccdeb1d0e8656e9af070159

SHA1
b9e306b6f8ad865be04cc9066bb7991692a1d5a7

SHA256
12cfb097af907d3279262c0d50542b163029fea61efa79227c6a1362848bcbc7

SHA512
b97a6a2b9a0cba70223a0c5d10f5b141de2891b651092d614258b6b86750ca59f7e0004b4fb097e9e3499ef991519dfaa3827a0c59c6a6ad4c4601a1dbb057ae

Download Submit
C:\Program Files (x86)\Kuai8\K8DLUtils.dll

Filesize
850KB

MD5
961b9fa18e8a5b9cbad1bcf0bc50519c

SHA1
f9128b68da640be8a9b9735e1d84fd41ab5b84f7

SHA256
ad3f4769df26536e430a9972717d90263e140a6a01e96b3ae51502aa8579c966

SHA512
af1f312f35ced8534d2292a7a71d562715b7dd6819953804af1bce2ff4d8278b26826030fdffebdb9f9f1447dc29cf6f216204e589c255ee14c4f5b21b5a4536

Download Submit
C:\Program Files (x86)\Kuai8\K8GM.exe

Filesize
6.8MB

MD5
d323fbfadebfbfe2e706876306c73435

SHA1
767807502dbd2108599918e456ea3d1f256b1d07

SHA256
43169766768c788cc0e7ff405c0a583ddf62430b76ed72111eb8a75cf49a3b82

SHA512
ea083448e286f7fa8e10e1255706bbf0b78fa0963a3a14218aa0eddd61f4d6840ee140a4dd9717045c16d40c02ee2db99f51938da03c115d5a16a4bf77ef0366

Download Submit
C:\Program Files (x86)\Kuai8\K8GM.exe

Filesize
6.8MB

MD5
d323fbfadebfbfe2e706876306c73435

SHA1
767807502dbd2108599918e456ea3d1f256b1d07

SHA256
43169766768c788cc0e7ff405c0a583ddf62430b76ed72111eb8a75cf49a3b82

SHA512
ea083448e286f7fa8e10e1255706bbf0b78fa0963a3a14218aa0eddd61f4d6840ee140a4dd9717045c16d40c02ee2db99f51938da03c115d5a16a4bf77ef0366

Download Submit
C:\Program Files (x86)\Kuai8\K8GM.exe

Filesize
6.8MB

MD5
d323fbfadebfbfe2e706876306c73435

SHA1
767807502dbd2108599918e456ea3d1f256b1d07

SHA256
43169766768c788cc0e7ff405c0a583ddf62430b76ed72111eb8a75cf49a3b82

SHA512
ea083448e286f7fa8e10e1255706bbf0b78fa0963a3a14218aa0eddd61f4d6840ee140a4dd9717045c16d40c02ee2db99f51938da03c115d5a16a4bf77ef0366

Download Submit
C:\Program Files (x86)\Kuai8\K8UIRender.dll

Filesize
1.1MB

MD5
dfb0bd05098833981b5f931a6327b0b0

SHA1
f5aa8cc01a31c0dccbc2f969df71dc3995310666

SHA256
595147c84c87f44d44c1d3a3aff26c7bcb77d33979100e82ebeeb5309d1ac122

SHA512
e5da519d5d0f33339b84151e7b0b89d94f9642820b185f7e964b8af99044da67e9b203e82c9f9bc8755658066b33cbc5065f1618e38dd01f489c3b53c2939256

Download Submit
C:\Program Files (x86)\Kuai8\K8Update.exe

Filesize
346KB

MD5
6ac691a5b5aab00daf5137a7493bd272

SHA1
71cdd85c94c5d3716eb0572f207a8335183a8361

SHA256
f672642a477f0759054012de91acd0d443e68fa5b065796d480d1c9bce1db84f

SHA512
2d0efa77395a243553e753bcad44e8564b09baab7a89a0f4c71a20e67f61eabfc0891d863fc5b208b20f66c1420d6cb06d0879f6b339640ab85de1ecfe004843

Download Submit
C:\Program Files (x86)\Kuai8\K8Update.exe

Filesize
346KB

MD5
6ac691a5b5aab00daf5137a7493bd272

SHA1
71cdd85c94c5d3716eb0572f207a8335183a8361

SHA256
f672642a477f0759054012de91acd0d443e68fa5b065796d480d1c9bce1db84f

SHA512
2d0efa77395a243553e753bcad44e8564b09baab7a89a0f4c71a20e67f61eabfc0891d863fc5b208b20f66c1420d6cb06d0879f6b339640ab85de1ecfe004843

Download Submit
C:\Program Files (x86)\Kuai8\K8UrlEncrypt.dll

Filesize
36KB

MD5
6e95aa1e8f54458b82ea30aa845c735f

SHA1
4dc27dfbf81698b41d49368d6fa1ab85da78b6c7

SHA256
1aefa12b83e970b2da798e9afb5521432404cb72ee1e429c85b8ba7f78855069

SHA512
b72c6b27efeac2af51766f3c7a09f67995ed025795dc180efef3e1ef274a50947f56bb9fd6a1bb841bc996e010bd1d54831f1b640b53a2a0ec120d434b5e05ee

Download Submit
C:\Program Files (x86)\Kuai8\tool\K8Bubble.exe

Filesize
186KB

MD5
9ed7d9beb0d702dce498c6377a4deac2

SHA1
577f207e77610103c2590f31d8d88c8450f2f4a8

SHA256
8e8242f52a89e2422a548598e0c796aacb297e4affec6fe62d3a5242f337b61e

SHA512
d30939f9f29d58c897ae5681519a0d6ef741a7c1eb5161084d474a206dcc9b67702db5d3bf2606afc9198b15a1efa00deb74897c3006af15733c201b8d08bf8d

Download Submit
C:\Program Files (x86)\Kuai8\tool_x64\K8Shell.dll

Filesize
1.1MB

MD5
7e547dbc0892b7e074bf8e5fecdd2d7e

SHA1
950198338e876b9b8bbc8becca7c3bd8d54a6491

SHA256
0671e8585ff324900ee50e717d0e45d9494cfe95ab7fbb0d45504874c3cc9314

SHA512
73cdeda3ab7096cbac7a265bebb1614caa1d4aef4f62bc4b3e283671c48012a5282c6962123ee2c8ec725a7424092551fd8659bb08fe7661d0271d3bd70a9191

Download Submit
C:\Program Files (x86)\Kuai8\tool_x64\K8ShellIcon.dll

Filesize
1.1MB

MD5
eeeacdb8fa691800ff839927103803ae

SHA1
001e0f7ab17f9d1770902a26b9cf4aaf4f293f29

SHA256
cc79f6ddcec49203502158cb517efdef66380d8f50be519edd7f9c8f4535636d

SHA512
c3f7922ad5bb6ddf43e918828fa8c578cad4e9d188ad7251b104ce5ed8184bd6dfc27d0e9f8768430de605b9d0b5acf72bd1a684b90c41ab4211b5f1d200b196

Download Submit
C:\Users\Admin\AppData\Local\Temp\kuai8_c100019.exe

Filesize
11.8MB

MD5
df749e95c3bd248ce0e086be0c41801a

SHA1
c9523a0846ca569f9752967402b4f22f25af94fe

SHA256
7a8deaa528ef7e3cf7ea72df1b71bf76443274e144a48a598a4a37ee7a2213e0

SHA512
97f7203e562f60bb1be6aefa5eeef006661ac29df2a7be09c8c2c6e9c72522b57d4c7040c8856c90ccb7e5a9487556eb43645e062e2da9bb63e5698b521dda33

Download Submit
C:\Users\Admin\AppData\Local\Temp\kuai8_c100019.exe

Filesize
11.8MB

MD5
df749e95c3bd248ce0e086be0c41801a

SHA1
c9523a0846ca569f9752967402b4f22f25af94fe

SHA256
7a8deaa528ef7e3cf7ea72df1b71bf76443274e144a48a598a4a37ee7a2213e0

SHA512
97f7203e562f60bb1be6aefa5eeef006661ac29df2a7be09c8c2c6e9c72522b57d4c7040c8856c90ccb7e5a9487556eb43645e062e2da9bb63e5698b521dda33

Download Submit
C:\Users\Admin\AppData\Roaming\Kuai8\data\database.gmx

Filesize
4.6MB

MD5
7c56366a928de61e1bf8adf08531fbd5

SHA1
ec008a37a03086eac75fdd64f0b2ace76da5176c

SHA256
d2b51570724df5e4548c216af136c9ed780f547ba89f782657e01ab6322f8542

SHA512
8d062cac4071f536ba20a47e15e5d98aed002b9a641783ab50c24fda2e89504073df7fe15b350b89a78b3aced637ff99d4358f69374e602d7c6db51017b01b98

Download Submit
C:\Users\Admin\AppData\Roaming\Kuai8\data\plugin\top.gmx

Filesize
2KB

MD5
5585f1aa7957348f4a7d62ed61fe6862

SHA1
5a7aaf75eb1ac8c084b671e102af4fed24eaacf3

SHA256
9bbe1a7aed3f97b218547803da27f21a5686c3a82775410090441edf08aef1dd

SHA512
15e7b1137c5b7d1edd93134ab396b3ed0306420c1e1d9c326aa5e73995b948803923d822d84c83141a6d90f181d63c2c0352970a963143467bf6614f32576452

Download Submit
\Program Files (x86)\Kuai8\K8Common.dll

Filesize
3.3MB

MD5
9dbd17cfcccdeb1d0e8656e9af070159

SHA1
b9e306b6f8ad865be04cc9066bb7991692a1d5a7

SHA256
12cfb097af907d3279262c0d50542b163029fea61efa79227c6a1362848bcbc7

SHA512
b97a6a2b9a0cba70223a0c5d10f5b141de2891b651092d614258b6b86750ca59f7e0004b4fb097e9e3499ef991519dfaa3827a0c59c6a6ad4c4601a1dbb057ae

Download Submit
\Program Files (x86)\Kuai8\K8Common.dll

Filesize
3.3MB

MD5
9dbd17cfcccdeb1d0e8656e9af070159

SHA1
b9e306b6f8ad865be04cc9066bb7991692a1d5a7

SHA256
12cfb097af907d3279262c0d50542b163029fea61efa79227c6a1362848bcbc7

SHA512
b97a6a2b9a0cba70223a0c5d10f5b141de2891b651092d614258b6b86750ca59f7e0004b4fb097e9e3499ef991519dfaa3827a0c59c6a6ad4c4601a1dbb057ae

Download Submit
\Program Files (x86)\Kuai8\K8Common.dll

Filesize
3.3MB

MD5
9dbd17cfcccdeb1d0e8656e9af070159

SHA1
b9e306b6f8ad865be04cc9066bb7991692a1d5a7

SHA256
12cfb097af907d3279262c0d50542b163029fea61efa79227c6a1362848bcbc7

SHA512
b97a6a2b9a0cba70223a0c5d10f5b141de2891b651092d614258b6b86750ca59f7e0004b4fb097e9e3499ef991519dfaa3827a0c59c6a6ad4c4601a1dbb057ae

Download Submit
\Program Files (x86)\Kuai8\K8DLUtils.dll

Filesize
850KB

MD5
961b9fa18e8a5b9cbad1bcf0bc50519c

SHA1
f9128b68da640be8a9b9735e1d84fd41ab5b84f7

SHA256
ad3f4769df26536e430a9972717d90263e140a6a01e96b3ae51502aa8579c966

SHA512
af1f312f35ced8534d2292a7a71d562715b7dd6819953804af1bce2ff4d8278b26826030fdffebdb9f9f1447dc29cf6f216204e589c255ee14c4f5b21b5a4536

Download Submit
\Program Files (x86)\Kuai8\K8DLUtils.dll

Filesize
850KB

MD5
961b9fa18e8a5b9cbad1bcf0bc50519c

SHA1
f9128b68da640be8a9b9735e1d84fd41ab5b84f7

SHA256
ad3f4769df26536e430a9972717d90263e140a6a01e96b3ae51502aa8579c966

SHA512
af1f312f35ced8534d2292a7a71d562715b7dd6819953804af1bce2ff4d8278b26826030fdffebdb9f9f1447dc29cf6f216204e589c255ee14c4f5b21b5a4536

Download Submit
\Program Files (x86)\Kuai8\K8GM.exe

Filesize
6.8MB

MD5
d323fbfadebfbfe2e706876306c73435

SHA1
767807502dbd2108599918e456ea3d1f256b1d07

SHA256
43169766768c788cc0e7ff405c0a583ddf62430b76ed72111eb8a75cf49a3b82

SHA512
ea083448e286f7fa8e10e1255706bbf0b78fa0963a3a14218aa0eddd61f4d6840ee140a4dd9717045c16d40c02ee2db99f51938da03c115d5a16a4bf77ef0366

Download Submit
\Program Files (x86)\Kuai8\K8GM.exe

Filesize
6.8MB

MD5
d323fbfadebfbfe2e706876306c73435

SHA1
767807502dbd2108599918e456ea3d1f256b1d07

SHA256
43169766768c788cc0e7ff405c0a583ddf62430b76ed72111eb8a75cf49a3b82

SHA512
ea083448e286f7fa8e10e1255706bbf0b78fa0963a3a14218aa0eddd61f4d6840ee140a4dd9717045c16d40c02ee2db99f51938da03c115d5a16a4bf77ef0366

Download Submit
\Program Files (x86)\Kuai8\K8GM.exe

Filesize
6.8MB

MD5
d323fbfadebfbfe2e706876306c73435

SHA1
767807502dbd2108599918e456ea3d1f256b1d07

SHA256
43169766768c788cc0e7ff405c0a583ddf62430b76ed72111eb8a75cf49a3b82

SHA512
ea083448e286f7fa8e10e1255706bbf0b78fa0963a3a14218aa0eddd61f4d6840ee140a4dd9717045c16d40c02ee2db99f51938da03c115d5a16a4bf77ef0366

Download Submit
\Program Files (x86)\Kuai8\K8GM.exe

Filesize
6.8MB

MD5
d323fbfadebfbfe2e706876306c73435

SHA1
767807502dbd2108599918e456ea3d1f256b1d07

SHA256
43169766768c788cc0e7ff405c0a583ddf62430b76ed72111eb8a75cf49a3b82

SHA512
ea083448e286f7fa8e10e1255706bbf0b78fa0963a3a14218aa0eddd61f4d6840ee140a4dd9717045c16d40c02ee2db99f51938da03c115d5a16a4bf77ef0366

Download Submit
\Program Files (x86)\Kuai8\K8GM.exe

Filesize
6.8MB

MD5
d323fbfadebfbfe2e706876306c73435

SHA1
767807502dbd2108599918e456ea3d1f256b1d07

SHA256
43169766768c788cc0e7ff405c0a583ddf62430b76ed72111eb8a75cf49a3b82

SHA512
ea083448e286f7fa8e10e1255706bbf0b78fa0963a3a14218aa0eddd61f4d6840ee140a4dd9717045c16d40c02ee2db99f51938da03c115d5a16a4bf77ef0366

Download Submit
\Program Files (x86)\Kuai8\K8GM.exe

Filesize
6.8MB

MD5
d323fbfadebfbfe2e706876306c73435

SHA1
767807502dbd2108599918e456ea3d1f256b1d07

SHA256
43169766768c788cc0e7ff405c0a583ddf62430b76ed72111eb8a75cf49a3b82

SHA512
ea083448e286f7fa8e10e1255706bbf0b78fa0963a3a14218aa0eddd61f4d6840ee140a4dd9717045c16d40c02ee2db99f51938da03c115d5a16a4bf77ef0366

Download Submit
\Program Files (x86)\Kuai8\K8GM.exe

Filesize
6.8MB

MD5
d323fbfadebfbfe2e706876306c73435

SHA1
767807502dbd2108599918e456ea3d1f256b1d07

SHA256
43169766768c788cc0e7ff405c0a583ddf62430b76ed72111eb8a75cf49a3b82

SHA512
ea083448e286f7fa8e10e1255706bbf0b78fa0963a3a14218aa0eddd61f4d6840ee140a4dd9717045c16d40c02ee2db99f51938da03c115d5a16a4bf77ef0366

Download Submit
\Program Files (x86)\Kuai8\K8GM.exe

Filesize
6.8MB

MD5
d323fbfadebfbfe2e706876306c73435

SHA1
767807502dbd2108599918e456ea3d1f256b1d07

SHA256
43169766768c788cc0e7ff405c0a583ddf62430b76ed72111eb8a75cf49a3b82

SHA512
ea083448e286f7fa8e10e1255706bbf0b78fa0963a3a14218aa0eddd61f4d6840ee140a4dd9717045c16d40c02ee2db99f51938da03c115d5a16a4bf77ef0366

Download Submit
\Program Files (x86)\Kuai8\K8GM.exe

Filesize
6.8MB

MD5
d323fbfadebfbfe2e706876306c73435

SHA1
767807502dbd2108599918e456ea3d1f256b1d07

SHA256
43169766768c788cc0e7ff405c0a583ddf62430b76ed72111eb8a75cf49a3b82

SHA512
ea083448e286f7fa8e10e1255706bbf0b78fa0963a3a14218aa0eddd61f4d6840ee140a4dd9717045c16d40c02ee2db99f51938da03c115d5a16a4bf77ef0366

Download Submit
\Program Files (x86)\Kuai8\K8GM.exe

Filesize
6.8MB

MD5
d323fbfadebfbfe2e706876306c73435

SHA1
767807502dbd2108599918e456ea3d1f256b1d07

SHA256
43169766768c788cc0e7ff405c0a583ddf62430b76ed72111eb8a75cf49a3b82

SHA512
ea083448e286f7fa8e10e1255706bbf0b78fa0963a3a14218aa0eddd61f4d6840ee140a4dd9717045c16d40c02ee2db99f51938da03c115d5a16a4bf77ef0366

Download Submit
\Program Files (x86)\Kuai8\K8GM.exe

Filesize
6.8MB

MD5
d323fbfadebfbfe2e706876306c73435

SHA1
767807502dbd2108599918e456ea3d1f256b1d07

SHA256
43169766768c788cc0e7ff405c0a583ddf62430b76ed72111eb8a75cf49a3b82

SHA512
ea083448e286f7fa8e10e1255706bbf0b78fa0963a3a14218aa0eddd61f4d6840ee140a4dd9717045c16d40c02ee2db99f51938da03c115d5a16a4bf77ef0366

Download Submit
\Program Files (x86)\Kuai8\K8GM.exe

Filesize
6.8MB

MD5
d323fbfadebfbfe2e706876306c73435

SHA1
767807502dbd2108599918e456ea3d1f256b1d07

SHA256
43169766768c788cc0e7ff405c0a583ddf62430b76ed72111eb8a75cf49a3b82

SHA512
ea083448e286f7fa8e10e1255706bbf0b78fa0963a3a14218aa0eddd61f4d6840ee140a4dd9717045c16d40c02ee2db99f51938da03c115d5a16a4bf77ef0366

Download Submit
\Program Files (x86)\Kuai8\K8GM.exe

Filesize
6.8MB

MD5
d323fbfadebfbfe2e706876306c73435

SHA1
767807502dbd2108599918e456ea3d1f256b1d07

SHA256
43169766768c788cc0e7ff405c0a583ddf62430b76ed72111eb8a75cf49a3b82

SHA512
ea083448e286f7fa8e10e1255706bbf0b78fa0963a3a14218aa0eddd61f4d6840ee140a4dd9717045c16d40c02ee2db99f51938da03c115d5a16a4bf77ef0366

Download Submit
\Program Files (x86)\Kuai8\K8UIRender.dll

Filesize
1.1MB

MD5
dfb0bd05098833981b5f931a6327b0b0

SHA1
f5aa8cc01a31c0dccbc2f969df71dc3995310666

SHA256
595147c84c87f44d44c1d3a3aff26c7bcb77d33979100e82ebeeb5309d1ac122

SHA512
e5da519d5d0f33339b84151e7b0b89d94f9642820b185f7e964b8af99044da67e9b203e82c9f9bc8755658066b33cbc5065f1618e38dd01f489c3b53c2939256

Download Submit
\Program Files (x86)\Kuai8\K8UIRender.dll

Filesize
1.1MB

MD5
dfb0bd05098833981b5f931a6327b0b0

SHA1
f5aa8cc01a31c0dccbc2f969df71dc3995310666

SHA256
595147c84c87f44d44c1d3a3aff26c7bcb77d33979100e82ebeeb5309d1ac122

SHA512
e5da519d5d0f33339b84151e7b0b89d94f9642820b185f7e964b8af99044da67e9b203e82c9f9bc8755658066b33cbc5065f1618e38dd01f489c3b53c2939256

Download Submit
\Program Files (x86)\Kuai8\K8UIRender.dll

Filesize
1.1MB

MD5
dfb0bd05098833981b5f931a6327b0b0

SHA1
f5aa8cc01a31c0dccbc2f969df71dc3995310666

SHA256
595147c84c87f44d44c1d3a3aff26c7bcb77d33979100e82ebeeb5309d1ac122

SHA512
e5da519d5d0f33339b84151e7b0b89d94f9642820b185f7e964b8af99044da67e9b203e82c9f9bc8755658066b33cbc5065f1618e38dd01f489c3b53c2939256

Download Submit
\Program Files (x86)\Kuai8\K8Update.exe

Filesize
346KB

MD5
6ac691a5b5aab00daf5137a7493bd272

SHA1
71cdd85c94c5d3716eb0572f207a8335183a8361

SHA256
f672642a477f0759054012de91acd0d443e68fa5b065796d480d1c9bce1db84f

SHA512
2d0efa77395a243553e753bcad44e8564b09baab7a89a0f4c71a20e67f61eabfc0891d863fc5b208b20f66c1420d6cb06d0879f6b339640ab85de1ecfe004843

Download Submit
\Program Files (x86)\Kuai8\K8Update.exe

Filesize
346KB

MD5
6ac691a5b5aab00daf5137a7493bd272

SHA1
71cdd85c94c5d3716eb0572f207a8335183a8361

SHA256
f672642a477f0759054012de91acd0d443e68fa5b065796d480d1c9bce1db84f

SHA512
2d0efa77395a243553e753bcad44e8564b09baab7a89a0f4c71a20e67f61eabfc0891d863fc5b208b20f66c1420d6cb06d0879f6b339640ab85de1ecfe004843

Download Submit
\Program Files (x86)\Kuai8\K8Update.exe

Filesize
346KB

MD5
6ac691a5b5aab00daf5137a7493bd272

SHA1
71cdd85c94c5d3716eb0572f207a8335183a8361

SHA256
f672642a477f0759054012de91acd0d443e68fa5b065796d480d1c9bce1db84f

SHA512
2d0efa77395a243553e753bcad44e8564b09baab7a89a0f4c71a20e67f61eabfc0891d863fc5b208b20f66c1420d6cb06d0879f6b339640ab85de1ecfe004843

Download Submit
\Program Files (x86)\Kuai8\K8UrlEncrypt.dll

Filesize
36KB

MD5
6e95aa1e8f54458b82ea30aa845c735f

SHA1
4dc27dfbf81698b41d49368d6fa1ab85da78b6c7

SHA256
1aefa12b83e970b2da798e9afb5521432404cb72ee1e429c85b8ba7f78855069

SHA512
b72c6b27efeac2af51766f3c7a09f67995ed025795dc180efef3e1ef274a50947f56bb9fd6a1bb841bc996e010bd1d54831f1b640b53a2a0ec120d434b5e05ee

Download Submit
\Program Files (x86)\Kuai8\K8UrlEncrypt.dll

Filesize
36KB

MD5
6e95aa1e8f54458b82ea30aa845c735f

SHA1
4dc27dfbf81698b41d49368d6fa1ab85da78b6c7

SHA256
1aefa12b83e970b2da798e9afb5521432404cb72ee1e429c85b8ba7f78855069

SHA512
b72c6b27efeac2af51766f3c7a09f67995ed025795dc180efef3e1ef274a50947f56bb9fd6a1bb841bc996e010bd1d54831f1b640b53a2a0ec120d434b5e05ee

Download Submit
\Program Files (x86)\Kuai8\tool\K8Bubble.exe

Filesize
186KB

MD5
9ed7d9beb0d702dce498c6377a4deac2

SHA1
577f207e77610103c2590f31d8d88c8450f2f4a8

SHA256
8e8242f52a89e2422a548598e0c796aacb297e4affec6fe62d3a5242f337b61e

SHA512
d30939f9f29d58c897ae5681519a0d6ef741a7c1eb5161084d474a206dcc9b67702db5d3bf2606afc9198b15a1efa00deb74897c3006af15733c201b8d08bf8d

Download Submit
\Program Files (x86)\Kuai8\tool\K8Bubble.exe

Filesize
186KB

MD5
9ed7d9beb0d702dce498c6377a4deac2

SHA1
577f207e77610103c2590f31d8d88c8450f2f4a8

SHA256
8e8242f52a89e2422a548598e0c796aacb297e4affec6fe62d3a5242f337b61e

SHA512
d30939f9f29d58c897ae5681519a0d6ef741a7c1eb5161084d474a206dcc9b67702db5d3bf2606afc9198b15a1efa00deb74897c3006af15733c201b8d08bf8d

Download Submit
\Program Files (x86)\Kuai8\tool\K8Bubble.exe

Filesize
186KB

MD5
9ed7d9beb0d702dce498c6377a4deac2

SHA1
577f207e77610103c2590f31d8d88c8450f2f4a8

SHA256
8e8242f52a89e2422a548598e0c796aacb297e4affec6fe62d3a5242f337b61e

SHA512
d30939f9f29d58c897ae5681519a0d6ef741a7c1eb5161084d474a206dcc9b67702db5d3bf2606afc9198b15a1efa00deb74897c3006af15733c201b8d08bf8d

Download Submit
\Program Files (x86)\Kuai8\tool\K8Bubble.exe

Filesize
186KB

MD5
9ed7d9beb0d702dce498c6377a4deac2

SHA1
577f207e77610103c2590f31d8d88c8450f2f4a8

SHA256
8e8242f52a89e2422a548598e0c796aacb297e4affec6fe62d3a5242f337b61e

SHA512
d30939f9f29d58c897ae5681519a0d6ef741a7c1eb5161084d474a206dcc9b67702db5d3bf2606afc9198b15a1efa00deb74897c3006af15733c201b8d08bf8d

Download Submit
\Program Files (x86)\Kuai8\tool\K8Bubble.exe

Filesize
186KB

MD5
9ed7d9beb0d702dce498c6377a4deac2

SHA1
577f207e77610103c2590f31d8d88c8450f2f4a8

SHA256
8e8242f52a89e2422a548598e0c796aacb297e4affec6fe62d3a5242f337b61e

SHA512
d30939f9f29d58c897ae5681519a0d6ef741a7c1eb5161084d474a206dcc9b67702db5d3bf2606afc9198b15a1efa00deb74897c3006af15733c201b8d08bf8d

Download Submit
\Program Files (x86)\Kuai8\tool_x64\K8Shell.dll

Filesize
1.1MB

MD5
7e547dbc0892b7e074bf8e5fecdd2d7e

SHA1
950198338e876b9b8bbc8becca7c3bd8d54a6491

SHA256
0671e8585ff324900ee50e717d0e45d9494cfe95ab7fbb0d45504874c3cc9314

SHA512
73cdeda3ab7096cbac7a265bebb1614caa1d4aef4f62bc4b3e283671c48012a5282c6962123ee2c8ec725a7424092551fd8659bb08fe7661d0271d3bd70a9191

Download Submit
\Program Files (x86)\Kuai8\tool_x64\K8Shell.dll

Filesize
1.1MB

MD5
7e547dbc0892b7e074bf8e5fecdd2d7e

SHA1
950198338e876b9b8bbc8becca7c3bd8d54a6491

SHA256
0671e8585ff324900ee50e717d0e45d9494cfe95ab7fbb0d45504874c3cc9314

SHA512
73cdeda3ab7096cbac7a265bebb1614caa1d4aef4f62bc4b3e283671c48012a5282c6962123ee2c8ec725a7424092551fd8659bb08fe7661d0271d3bd70a9191

Download Submit
\Program Files (x86)\Kuai8\tool_x64\K8ShellIcon.dll

Filesize
1.1MB

MD5
eeeacdb8fa691800ff839927103803ae

SHA1
001e0f7ab17f9d1770902a26b9cf4aaf4f293f29

SHA256
cc79f6ddcec49203502158cb517efdef66380d8f50be519edd7f9c8f4535636d

SHA512
c3f7922ad5bb6ddf43e918828fa8c578cad4e9d188ad7251b104ce5ed8184bd6dfc27d0e9f8768430de605b9d0b5acf72bd1a684b90c41ab4211b5f1d200b196

Download Submit
\Program Files (x86)\Kuai8\tool_x64\K8ShellIcon.dll

Filesize
1.1MB

MD5
eeeacdb8fa691800ff839927103803ae

SHA1
001e0f7ab17f9d1770902a26b9cf4aaf4f293f29

SHA256
cc79f6ddcec49203502158cb517efdef66380d8f50be519edd7f9c8f4535636d

SHA512
c3f7922ad5bb6ddf43e918828fa8c578cad4e9d188ad7251b104ce5ed8184bd6dfc27d0e9f8768430de605b9d0b5acf72bd1a684b90c41ab4211b5f1d200b196

Download Submit
\Users\Admin\AppData\Local\Temp\kuai8_c100019.exe

Filesize
11.8MB

MD5
df749e95c3bd248ce0e086be0c41801a

SHA1
c9523a0846ca569f9752967402b4f22f25af94fe

SHA256
7a8deaa528ef7e3cf7ea72df1b71bf76443274e144a48a598a4a37ee7a2213e0

SHA512
97f7203e562f60bb1be6aefa5eeef006661ac29df2a7be09c8c2c6e9c72522b57d4c7040c8856c90ccb7e5a9487556eb43645e062e2da9bb63e5698b521dda33

Download Submit
\Users\Admin\AppData\Local\Temp\kuai8_c100019.exe

Filesize
11.8MB

MD5
df749e95c3bd248ce0e086be0c41801a

SHA1
c9523a0846ca569f9752967402b4f22f25af94fe

SHA256
7a8deaa528ef7e3cf7ea72df1b71bf76443274e144a48a598a4a37ee7a2213e0

SHA512
97f7203e562f60bb1be6aefa5eeef006661ac29df2a7be09c8c2c6e9c72522b57d4c7040c8856c90ccb7e5a9487556eb43645e062e2da9bb63e5698b521dda33

Download Submit
\Users\Admin\AppData\Local\Temp\kuai8_c100019.exe

Filesize
11.8MB

MD5
df749e95c3bd248ce0e086be0c41801a

SHA1
c9523a0846ca569f9752967402b4f22f25af94fe

SHA256
7a8deaa528ef7e3cf7ea72df1b71bf76443274e144a48a598a4a37ee7a2213e0

SHA512
97f7203e562f60bb1be6aefa5eeef006661ac29df2a7be09c8c2c6e9c72522b57d4c7040c8856c90ccb7e5a9487556eb43645e062e2da9bb63e5698b521dda33

Download Submit
\Users\Admin\AppData\Local\Temp\nsoFA78.tmp\K8NsisMiniExtend.dll

Filesize
1.2MB

MD5
68140a969a4761d3c4edb9622d8e272b

SHA1
6fdb0891cdc65b17e3446ee61735d44d8866355c

SHA256
f75abfc9edd6c57d7d4c64ff66cfa99e46ea79a688ce4f0083d3beb4aa70aab0

SHA512
94212839308abd1b29c84531fe31477e017651a36adc320f4eef821c5abd7806ad2a03be0a9ad049a41a895dd6faac8f1621a719b6a2a31b414ba0e5489511c6

Download Submit
\Users\Admin\AppData\Local\Temp\nsoFA78.tmp\K8NsisMiniExtend.dll

Filesize
1.2MB

MD5
68140a969a4761d3c4edb9622d8e272b

SHA1
6fdb0891cdc65b17e3446ee61735d44d8866355c

SHA256
f75abfc9edd6c57d7d4c64ff66cfa99e46ea79a688ce4f0083d3beb4aa70aab0

SHA512
94212839308abd1b29c84531fe31477e017651a36adc320f4eef821c5abd7806ad2a03be0a9ad049a41a895dd6faac8f1621a719b6a2a31b414ba0e5489511c6

Download Submit
\Users\Admin\AppData\Local\Temp\nsoFA78.tmp\K8NsisMiniExtend.dll

Filesize
1.2MB

MD5
68140a969a4761d3c4edb9622d8e272b

SHA1
6fdb0891cdc65b17e3446ee61735d44d8866355c

SHA256
f75abfc9edd6c57d7d4c64ff66cfa99e46ea79a688ce4f0083d3beb4aa70aab0

SHA512
94212839308abd1b29c84531fe31477e017651a36adc320f4eef821c5abd7806ad2a03be0a9ad049a41a895dd6faac8f1621a719b6a2a31b414ba0e5489511c6

Download Submit
\Users\Admin\AppData\Local\Temp\nsoFA78.tmp\K8NsisMiniExtend.dll

Filesize
1.2MB

MD5
68140a969a4761d3c4edb9622d8e272b

SHA1
6fdb0891cdc65b17e3446ee61735d44d8866355c

SHA256
f75abfc9edd6c57d7d4c64ff66cfa99e46ea79a688ce4f0083d3beb4aa70aab0

SHA512
94212839308abd1b29c84531fe31477e017651a36adc320f4eef821c5abd7806ad2a03be0a9ad049a41a895dd6faac8f1621a719b6a2a31b414ba0e5489511c6

Download Submit
\Users\Admin\AppData\Local\Temp\nsoFA78.tmp\K8NsisMiniExtend.dll

Filesize
1.2MB

MD5
68140a969a4761d3c4edb9622d8e272b

SHA1
6fdb0891cdc65b17e3446ee61735d44d8866355c

SHA256
f75abfc9edd6c57d7d4c64ff66cfa99e46ea79a688ce4f0083d3beb4aa70aab0

SHA512
94212839308abd1b29c84531fe31477e017651a36adc320f4eef821c5abd7806ad2a03be0a9ad049a41a895dd6faac8f1621a719b6a2a31b414ba0e5489511c6

Download Submit
\Users\Admin\AppData\Local\Temp\nsoFA78.tmp\K8NsisMiniExtend.dll

Filesize
1.2MB

MD5
68140a969a4761d3c4edb9622d8e272b

SHA1
6fdb0891cdc65b17e3446ee61735d44d8866355c

SHA256
f75abfc9edd6c57d7d4c64ff66cfa99e46ea79a688ce4f0083d3beb4aa70aab0

SHA512
94212839308abd1b29c84531fe31477e017651a36adc320f4eef821c5abd7806ad2a03be0a9ad049a41a895dd6faac8f1621a719b6a2a31b414ba0e5489511c6

Download Submit
\Users\Admin\AppData\Local\Temp\nsoFA78.tmp\K8NsisMiniExtend.dll

Filesize
1.2MB

MD5
68140a969a4761d3c4edb9622d8e272b

SHA1
6fdb0891cdc65b17e3446ee61735d44d8866355c

SHA256
f75abfc9edd6c57d7d4c64ff66cfa99e46ea79a688ce4f0083d3beb4aa70aab0

SHA512
94212839308abd1b29c84531fe31477e017651a36adc320f4eef821c5abd7806ad2a03be0a9ad049a41a895dd6faac8f1621a719b6a2a31b414ba0e5489511c6

Download Submit
\Users\Admin\AppData\Local\Temp\nsoFA78.tmp\K8NsisMiniExtend.dll

Filesize
1.2MB

MD5
68140a969a4761d3c4edb9622d8e272b

SHA1
6fdb0891cdc65b17e3446ee61735d44d8866355c

SHA256
f75abfc9edd6c57d7d4c64ff66cfa99e46ea79a688ce4f0083d3beb4aa70aab0

SHA512
94212839308abd1b29c84531fe31477e017651a36adc320f4eef821c5abd7806ad2a03be0a9ad049a41a895dd6faac8f1621a719b6a2a31b414ba0e5489511c6

Download Submit
\Users\Admin\AppData\Local\Temp\nsoFA78.tmp\K8NsisMiniExtend.dll

Filesize
1.2MB

MD5
68140a969a4761d3c4edb9622d8e272b

SHA1
6fdb0891cdc65b17e3446ee61735d44d8866355c

SHA256
f75abfc9edd6c57d7d4c64ff66cfa99e46ea79a688ce4f0083d3beb4aa70aab0

SHA512
94212839308abd1b29c84531fe31477e017651a36adc320f4eef821c5abd7806ad2a03be0a9ad049a41a895dd6faac8f1621a719b6a2a31b414ba0e5489511c6

Download Submit
\Users\Admin\AppData\Local\Temp\nsoFA78.tmp\System.dll

Filesize
11KB

MD5
75ed96254fbf894e42058062b4b4f0d1

SHA1
996503f1383b49021eb3427bc28d13b5bbd11977

SHA256
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

SHA512
58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

Download Submit
memory/572-158-0x0000000000000000-mapping.dmp

Download
memory/572-163-0x0000000000610000-0x0000000000724000-memory.dmp

Filesize
1.1MB

Download
memory/952-135-0x0000000000000000-mapping.dmp

Download
memory/1048-128-0x0000000000000000-mapping.dmp

Download
memory/1048-129-0x000007FEFC101000-0x000007FEFC103000-memory.dmp

Filesize
8KB

Download
memory/1128-54-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/1208-81-0x0000000000000000-mapping.dmp

Download
memory/1212-186-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/1212-196-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Filesize
4KB

Download
memory/1212-198-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/1212-174-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/1212-197-0x0000000003BD0000-0x0000000003BD1000-memory.dmp

Filesize
4KB

Download
memory/1212-175-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/1212-176-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Filesize
4KB

Download
memory/1212-177-0x0000000003BD0000-0x0000000003BD1000-memory.dmp

Filesize
4KB

Download
memory/1212-178-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/1212-179-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/1212-180-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Filesize
4KB

Download
memory/1212-192-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Filesize
4KB

Download
memory/1212-181-0x0000000003BD0000-0x0000000003BD1000-memory.dmp

Filesize
4KB

Download
memory/1212-182-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/1212-183-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/1212-191-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/1212-184-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Filesize
4KB

Download
memory/1212-185-0x0000000003BD0000-0x0000000003BD1000-memory.dmp

Filesize
4KB

Download
memory/1212-193-0x0000000003BD0000-0x0000000003BD1000-memory.dmp

Filesize
4KB

Download
memory/1212-200-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Filesize
4KB

Download
memory/1212-195-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/1212-187-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/1212-173-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/1212-199-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/1212-188-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Filesize
4KB

Download
memory/1212-189-0x0000000003BD0000-0x0000000003BD1000-memory.dmp

Filesize
4KB

Download
memory/1212-190-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/1212-194-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/1256-77-0x0000000000000000-mapping.dmp

Download
memory/1304-167-0x0000000000620000-0x0000000000734000-memory.dmp

Filesize
1.1MB

Download
memory/1304-165-0x0000000000000000-mapping.dmp

Download
memory/1320-148-0x0000000000AE0000-0x0000000000BF4000-memory.dmp

Filesize
1.1MB

Download
memory/1320-72-0x0000000000000000-mapping.dmp

Download
memory/1320-152-0x0000000000C00000-0x0000000000CD2000-memory.dmp

Filesize
840KB

Download
memory/1320-143-0x0000000000000000-mapping.dmp

Download
memory/1380-131-0x0000000000000000-mapping.dmp

Download
memory/1456-171-0x00000000004D0000-0x00000000005E4000-memory.dmp

Filesize
1.1MB

Download
memory/1456-168-0x0000000000000000-mapping.dmp

Download
memory/1468-83-0x0000000000000000-mapping.dmp

Download
memory/1500-56-0x0000000000000000-mapping.dmp

Download
memory/1568-85-0x0000000000000000-mapping.dmp

Download
memory/1568-96-0x00000000002E0000-0x00000000003F4000-memory.dmp

Filesize
1.1MB

Download
memory/1568-101-0x0000000000C70000-0x0000000000D42000-memory.dmp

Filesize
840KB

Download
memory/1680-76-0x0000000000000000-mapping.dmp

Download
memory/1692-91-0x0000000000000000-mapping.dmp

Download
memory/1772-73-0x0000000000000000-mapping.dmp

Download
memory/1852-118-0x0000000000460000-0x0000000000574000-memory.dmp

Filesize
1.1MB

Download
memory/1852-113-0x0000000000000000-mapping.dmp

Download
memory/1996-74-0x0000000000000000-mapping.dmp

Download
memory/2032-124-0x0000000000000000-mapping.dmp

Download