Overview

overview

8

Static

static

1

de382c48f5...e7.exe

windows7-x64

8

de382c48f5...e7.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 10:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    de382c48f5f3bff0235d7e614eeade7dc27af2d9c6345546f9b7cc590ab963e7.exe

  • Size

    228KB

  • MD5

    0e551e7947ec8a6b8708434bfa9df531

  • SHA1

    7485c7308666204afb9b29f30aaadc7d09426dd6

  • SHA256

    de382c48f5f3bff0235d7e614eeade7dc27af2d9c6345546f9b7cc590ab963e7

  • SHA512

    8e9b09709ef1859d45c1229e4b3d050b191cf053caaefae6872bfcabdec470f2484720e6244c5803b04f027c8f5afa32230f4a343f803153cc40a587a48a0ff5

  • SSDEEP

    6144:6sFZ1QvEXNYneNpOMKkcbPAMjThvnlanXI:x1Qs+nSOMKjb9hPlEI

Score
8/10
bootkitdiscoverypersistence

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 25 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 9 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 10 IoCs
    installer
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 45 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 24 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de382c48f5f3bff0235d7e614eeade7dc27af2d9c6345546f9b7cc590ab963e7.exe
    "C:\Users\Admin\AppData\Local\Temp\de382c48f5f3bff0235d7e614eeade7dc27af2d9c6345546f9b7cc590ab963e7.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1388
    • C:\Users\Admin\AppData\Local\Temp\nsy570.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe
      KeLe2014Beta3.6.2Promote0326_20090195130.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1764
      • C:\Users\Admin\AppData\Local\Temp\nsjA72B.tmp\GGExit.exe
        "C:\Users\Admin\AppData\Local\Temp\nsjA72B.tmp\GGExit.exe" 5
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1624
      • C:\Program Files (x86)\Kele55\ServiceClient.exe
        "C:\Program Files (x86)\Kele55\ServiceClient.exe" -i
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1928
        • C:\Windows\SysWOW64\net.exe
          net start GuaGua-Service
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1784
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start GuaGua-Service
            5⤵
              PID:904
        • C:\Program Files (x86)\Kele55\Kele55.exe
          "C:\Program Files (x86)\Kele55\Kele55.exe" -autorunroom
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1132
          • C:\Program Files (x86)\Kele55\Update.exe
            "C:\Program Files (x86)\Kele55\Update.exe" 4.358 1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:1568
          • C:\Program Files (x86)\Kele55\Update.exe
            "C:\Program Files (x86)\Kele55\Update.exe" 4.358
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:1976
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.caogenchuangyejidi.com/ZGUzODJjNDhmNWYzYmZmMDIzNWQ3ZTYxNGVlYWRlN2RjMjdhZjJkOWM2MzQ1NTQ2ZjliN2NjNTkwYWI5NjNlNy5leGU=/40.html
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1516
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275457 /prefetch:2
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1160
      • C:\Users\Admin\AppData\Local\Temp\nsy570.tmp\SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
        SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-run-x.exe
        2⤵
        • Executes dropped EXE
        • Registers COM server for autorun
        • Sets DLL path for service in the registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        PID:2444
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHBHO.dll"
          3⤵
            PID:2652
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHIEPlugin.dll"
            3⤵
            • Modifies registry class
            PID:2672
          • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
            "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /EnableAutoRun
            3⤵
            • Executes dropped EXE
            • Adds Run key to start application
            PID:2792
          • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
            "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /ModifyMainShortcut
            3⤵
            • Executes dropped EXE
            PID:2852
          • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
            "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /F
            3⤵
            • Executes dropped EXE
            • Modifies registry class
            PID:2884
          • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
            "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /TSet
            3⤵
            • Executes dropped EXE
            • Modifies registry class
            PID:2908
          • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHImageViewer.exe
            "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHImageViewer.exe" /AddAssoc
            3⤵
            • Executes dropped EXE
            • Modifies registry class
            PID:2932
          • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
            "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /ChangeSohuVARunToSHplayerRun
            3⤵
            • Executes dropped EXE
            • Modifies registry class
            PID:2956
          • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
            "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /ReleaseSWF
            3⤵
            • Executes dropped EXE
            • Modifies registry class
            PID:2980
          • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
            "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /InstallSuccess 0
            3⤵
            • Executes dropped EXE
            PID:3004
          • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
            "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /PreventPinning "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\搜狐影音\卸载搜狐影音.lnk"
            3⤵
            • Executes dropped EXE
            • Modifies registry class
            PID:2052
          • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHPlayer.exe
            C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHPlayer.exe /auto
            3⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Checks processor information in registry
            • Modifies system certificate store
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2128
            • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
              "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=1976,5134435569367483285,16309376874541150861,131072 --disable-features=BlockInsecurePrivateNetworkRequests --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\06-54-07.log" --mojo-platform-channel-handle=2060 /prefetch:2
              4⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:2172
              • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe
                C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe player,C:\Users\Admin\Documents\搜狐影音\log\dump\SHCefEngine\SHCefEngine_7.0.18.0_f4d4aea0-4463-46f8-80a0-fd42db7d584c_20221128_065408.dmp,C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\06-54-08.log,
                5⤵
                • Executes dropped EXE
                PID:2700
            • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
              "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,5134435569367483285,16309376874541150861,131072 --disable-features=BlockInsecurePrivateNetworkRequests --lang=en-US --service-sandbox-type=utility --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\06-54-07.log" --mojo-platform-channel-handle=2900 /prefetch:8
              4⤵
              • Executes dropped EXE
              PID:2420
            • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
              "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,5134435569367483285,16309376874541150861,131072 --disable-features=BlockInsecurePrivateNetworkRequests --lang=en-US --service-sandbox-type=none --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\06-54-07.log" --mojo-platform-channel-handle=2904 /prefetch:8
              4⤵
              • Executes dropped EXE
              PID:2432
            • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
              "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --disable-extensions --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\06-54-07.log" --field-trial-handle=1976,5134435569367483285,16309376874541150861,131072 --disable-features=BlockInsecurePrivateNetworkRequests --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --mojo-platform-channel-handle=3128 /prefetch:1
              4⤵
              • Executes dropped EXE
              • Checks computer location settings
              PID:2688
            • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
              "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=1976,5134435569367483285,16309376874541150861,131072 --disable-features=BlockInsecurePrivateNetworkRequests --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\06-54-07.log" --mojo-platform-channel-handle=2084 /prefetch:2
              4⤵
              • Executes dropped EXE
              PID:820
              • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe
                C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe player,C:\Users\Admin\Documents\搜狐影音\log\dump\SHCefEngine\SHCefEngine_7.0.18.0_5d18fd44-74ae-4b93-8a11-c367a7f6b1ad_20221128_065409.dmp,C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\06-54-09.log,
                5⤵
                  PID:2952
              • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
                "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=1976,5134435569367483285,16309376874541150861,131072 --disable-features=BlockInsecurePrivateNetworkRequests --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\06-54-07.log" --mojo-platform-channel-handle=2088 /prefetch:2
                4⤵
                  PID:3060
                • C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
                  "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --disable-extensions --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-28\06-54-07.log" --field-trial-handle=1976,5134435569367483285,16309376874541150861,131072 --disable-features=BlockInsecurePrivateNetworkRequests --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --mojo-platform-channel-handle=4048 /prefetch:1
                  4⤵
                    PID:2476
            • C:\Program Files (x86)\Kele55\ServiceClient.exe
              "C:\Program Files (x86)\Kele55\ServiceClient.exe"
              1⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1492
              • C:\Program Files (x86)\Kele55\ResideClient.exe
                ResideClient.exe
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates connected drives
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:1276
            • C:\Windows\system32\AUDIODG.EXE
              C:\Windows\system32\AUDIODG.EXE 0x55c
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2232
            • C:\Windows\SysWOW64\svchost.exe
              C:\Windows\SysWOW64\svchost.exe -k netsvcs shsp
              1⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              PID:2760

            Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Program Files (x86)\Kele55\Kele55.exe
                    Filesize

                    2.4MB

                    MD5

                    cbe7f9c49ed678a24fad00244c71829a

                    SHA1

                    a917b0e55fc6eb7d90d06792082b0c3986cd71de

                    SHA256

                    5055f4f65558211fc6300e56293f8fa97f2a9527ebd88eb6bb8f1d1106014182

                    SHA512

                    040687b0ef6f4f36221a7e1a5bcdf8520ec8c202eee97e17fdf56aefeeca6fc0fb8d33c43348846c7e50e70c8b38597d49c2116ccbc11fd8d8c0adc23f3a76b0

                    Download Submit

                  • C:\Program Files (x86)\Kele55\Kele55.exe
                    Filesize

                    2.4MB

                    MD5

                    cbe7f9c49ed678a24fad00244c71829a

                    SHA1

                    a917b0e55fc6eb7d90d06792082b0c3986cd71de

                    SHA256

                    5055f4f65558211fc6300e56293f8fa97f2a9527ebd88eb6bb8f1d1106014182

                    SHA512

                    040687b0ef6f4f36221a7e1a5bcdf8520ec8c202eee97e17fdf56aefeeca6fc0fb8d33c43348846c7e50e70c8b38597d49c2116ccbc11fd8d8c0adc23f3a76b0

                    Download Submit

                  • C:\Program Files (x86)\Kele55\MFC71U.DLL
                    Filesize

                    1.0MB

                    MD5

                    03df065a8dba0d71993fd8090e397d5d

                    SHA1

                    296f0ca29ea4103942384fa13e9b8c745b77da48

                    SHA256

                    68174cec32d3170389fe538c10328596db724488259727eed54e401c8f411ba4

                    SHA512

                    650ad429c391bfbab69e387e396e9da2613ec800e5f15c14df4acb25525036c3aec4bba41e966ec0e3842fd69dd6feaf7f4c6b4beb32758644e59d6fb5674ebe

                    Download Submit

                  • C:\Program Files (x86)\Kele55\MSVCP71.dll
                    Filesize

                    493KB

                    MD5

                    e5d08ef3e7b1d377b0e8c5417c959811

                    SHA1

                    e35cf02aa4a1a4b4abc11a4ca5f742f58b79758b

                    SHA256

                    b70e7e0b3102cefe3c19f9e9c9067947d5ff97f533694124e110cf77617601b8

                    SHA512

                    764cdae4d9414e550adee64884e70a8cbd7078b2c3b6b8a58e2dba9a093f949d1a4cfb6158a33f487c48b81b21dbc9af57b7c9809b35ffabf0148d139f998f2f

                    Download Submit

                  • C:\Program Files (x86)\Kele55\MSVCR71.dll
                    Filesize

                    345KB

                    MD5

                    ebb3e701588a92c36b4c902a3976e58a

                    SHA1

                    83cec9f2b486eb7d000aa0d716246ab044c2bf2e

                    SHA256

                    63ce7639ee0f0c16b7cf45c3f73b698887260bc3225cb25c26a97e2b09d92c3e

                    SHA512

                    23887dc229f6753100a06f9a6d3ea391d5b50778e6b239f6592675e53300fc8b4eb95796bbcf4123271213384ccf0773a1e2a09f8c68c2b58f2e6f074c7e53ac

                    Download Submit

                  • C:\Program Files (x86)\Kele55\ResideClient.exe
                    Filesize

                    269KB

                    MD5

                    45ae1e6a8f463423b859bc8fa3a9e41e

                    SHA1

                    3da933875c781808386236416d8d43f65873ce92

                    SHA256

                    54c6a23f1dac64c85f9cd15bc95ae55ba3010ae5c8f93a3d8ac8bbdff2f76d38

                    SHA512

                    6afc43b8e58645273c1383ee3488e03b081228bc1fe62984163c21dd10ee87bdd001cb66f5695f77f7b213b8732c8a6cf847ef84650b4548406e9b399f471389

                    Download Submit

                  • C:\Program Files (x86)\Kele55\ResideClient.exe
                    Filesize

                    269KB

                    MD5

                    45ae1e6a8f463423b859bc8fa3a9e41e

                    SHA1

                    3da933875c781808386236416d8d43f65873ce92

                    SHA256

                    54c6a23f1dac64c85f9cd15bc95ae55ba3010ae5c8f93a3d8ac8bbdff2f76d38

                    SHA512

                    6afc43b8e58645273c1383ee3488e03b081228bc1fe62984163c21dd10ee87bdd001cb66f5695f77f7b213b8732c8a6cf847ef84650b4548406e9b399f471389

                    Download Submit

                  • C:\Program Files (x86)\Kele55\ServiceClient.dll
                    Filesize

                    109KB

                    MD5

                    94bc1d61355ac31197fb1d7263e1e44a

                    SHA1

                    ee38f54ad37a521fac824aaa123640b67f30aee4

                    SHA256

                    201af1c684cbf2447c2c87b9703f28813c66877e2296486e3a1a1dc451102087

                    SHA512

                    3f52803761a0c5ac967025bbc0e3c80de59b35e1c55c7d273fbdbb315fb685fde9fd3f338ecc4c18d6836168d38ae93d4f9de47259579d4558b402cb9971502d

                    Download Submit

                  • C:\Program Files (x86)\Kele55\ServiceClient.exe
                    Filesize

                    113KB

                    MD5

                    f73dfe587bb6dfb7a3fb792757daa066

                    SHA1

                    d48e893245b1b55f73730fd887a0a02ba1d65486

                    SHA256

                    84736855ef4b0143d1fe4c97953d70c85d5ffd442ff1e83fd417b22441ec0771

                    SHA512

                    6ac4ce1169a3132cf788bd81811e5fc7ca40e61ae327b0be13dc43cb7c9a94aa60bd9f8723559a4801d21298d59ebed8db004d91b2efb5648d48e6177b034df1

                    Download Submit

                  • C:\Program Files (x86)\Kele55\ServiceClient.exe
                    Filesize

                    113KB

                    MD5

                    f73dfe587bb6dfb7a3fb792757daa066

                    SHA1

                    d48e893245b1b55f73730fd887a0a02ba1d65486

                    SHA256

                    84736855ef4b0143d1fe4c97953d70c85d5ffd442ff1e83fd417b22441ec0771

                    SHA512

                    6ac4ce1169a3132cf788bd81811e5fc7ca40e61ae327b0be13dc43cb7c9a94aa60bd9f8723559a4801d21298d59ebed8db004d91b2efb5648d48e6177b034df1

                    Download Submit

                  • C:\Program Files (x86)\Kele55\ServiceClient.exe
                    Filesize

                    113KB

                    MD5

                    f73dfe587bb6dfb7a3fb792757daa066

                    SHA1

                    d48e893245b1b55f73730fd887a0a02ba1d65486

                    SHA256

                    84736855ef4b0143d1fe4c97953d70c85d5ffd442ff1e83fd417b22441ec0771

                    SHA512

                    6ac4ce1169a3132cf788bd81811e5fc7ca40e61ae327b0be13dc43cb7c9a94aa60bd9f8723559a4801d21298d59ebed8db004d91b2efb5648d48e6177b034df1

                    Download Submit

                  • C:\Program Files (x86)\Kele55\Update.exe
                    Filesize

                    257KB

                    MD5

                    2ffe11691d7bbb86d9797b4c8d17d856

                    SHA1

                    0cf5db68147582a66e5fce3346255b0a01b7b8af

                    SHA256

                    359640d3431d764e1a514c74074ec0074d196f10abae78d1d6a67e38f187d62d

                    SHA512

                    9f65ba1fa5a5d2d67384ddfab8200048a2664ff66eb79f91a7b63ab5733b1a8d052eedc6d42c715ac833f504f4a3e93c163ba55f0184a20f46c3eea1d4a730bb

                    Download Submit

                  • C:\Program Files (x86)\Kele55\Update.exe
                    Filesize

                    257KB

                    MD5

                    2ffe11691d7bbb86d9797b4c8d17d856

                    SHA1

                    0cf5db68147582a66e5fce3346255b0a01b7b8af

                    SHA256

                    359640d3431d764e1a514c74074ec0074d196f10abae78d1d6a67e38f187d62d

                    SHA512

                    9f65ba1fa5a5d2d67384ddfab8200048a2664ff66eb79f91a7b63ab5733b1a8d052eedc6d42c715ac833f504f4a3e93c163ba55f0184a20f46c3eea1d4a730bb

                    Download Submit

                  • C:\Program Files (x86)\Kele55\crashreport.dll
                    Filesize

                    233KB

                    MD5

                    dc3080b8a568a302baf3d5029a21eab9

                    SHA1

                    ba5a7086f39add4a1c0fa18d89c9a615991ee382

                    SHA256

                    58bfa00054031fd55157dbfde8f639ac3e5e7e79047b8c362cd358a4661f196e

                    SHA512

                    699b8f7cb78f3ee3f6d5ef2e746f947fc38963ceadf37d675eb3797e343213be65e618c2cc379becd626f321b11fe81a8b9f9b08134231651eec741e60e54886

                    Download Submit

                  • C:\Program Files (x86)\Kele55\skin\MercuryChatHallSkin.ggs
                    Filesize

                    7.4MB

                    MD5

                    9e4c83ee8188ebee6941cb82246b1b4d

                    SHA1

                    9efb00992af0fc5e392a32aa0ae39fde48ca19da

                    SHA256

                    bd65492632cc4824e00f21ef2beb3a419cb613c9cba1c8d3f4d577c4be592094

                    SHA512

                    352a2ae92583ce6f3040318622b99196a7b9a097ea0d3ebf3dba6faf0ee68ddebb989f9421a7ab82ee9073c00d256b1a1e0d31cad29ad63be343b90b74d4a5ba

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\nsjA72B.tmp\GGExit.exe
                    Filesize

                    54KB

                    MD5

                    14607f1d7790612a9ca212f4ab8f605a

                    SHA1

                    060450216bc1daeb380562f65358300f594f0b86

                    SHA256

                    e36913e299219488cae06555019aceb086d66d8d1d5024b9405933d4b3abec67

                    SHA512

                    611895f78dab311ace1ab14a5dd630e230b9884c5acf95232ccc13c75805c3da26d3d26304c3e341a85834d05dc1826394305fcefa5f2839bdf88f4c0ce9c868

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\nsjA72B.tmp\GGExit.exe
                    Filesize

                    54KB

                    MD5

                    14607f1d7790612a9ca212f4ab8f605a

                    SHA1

                    060450216bc1daeb380562f65358300f594f0b86

                    SHA256

                    e36913e299219488cae06555019aceb086d66d8d1d5024b9405933d4b3abec67

                    SHA512

                    611895f78dab311ace1ab14a5dd630e230b9884c5acf95232ccc13c75805c3da26d3d26304c3e341a85834d05dc1826394305fcefa5f2839bdf88f4c0ce9c868

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\nsy570.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe
                    Filesize

                    14.5MB

                    MD5

                    7bc1957672229fee0b41897d3ec17d49

                    SHA1

                    d8060209bfdc9e25236f1848a644faf27bde1c83

                    SHA256

                    3e2e7e1b0ae2af1b973fe76b1962ef92af4b55420df8cf5c240d676a7de4f183

                    SHA512

                    631e3fc58cbfe87ee8729c28378718c28891908ffd42af93ea12ff92126d898ae6362e96873b1c3dd43fc4351255b1cfa9b304d4c6c2cd795ab937fadfb69c76

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\nsy570.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe
                    Filesize

                    14.5MB

                    MD5

                    7bc1957672229fee0b41897d3ec17d49

                    SHA1

                    d8060209bfdc9e25236f1848a644faf27bde1c83

                    SHA256

                    3e2e7e1b0ae2af1b973fe76b1962ef92af4b55420df8cf5c240d676a7de4f183

                    SHA512

                    631e3fc58cbfe87ee8729c28378718c28891908ffd42af93ea12ff92126d898ae6362e96873b1c3dd43fc4351255b1cfa9b304d4c6c2cd795ab937fadfb69c76

                    Download Submit

                  • \Program Files (x86)\Kele55\ChatRoomUI.ocx
                    Filesize

                    33KB

                    MD5

                    a50b61d2a7ea450615f817419bcad8ed

                    SHA1

                    12b85bb0e9695f25866a7bcedcffa72fe7e9ef75

                    SHA256

                    82b62d74cc6be6b9925ada79f56952385c8dfe800ad8f6dd375fa090bd371c05

                    SHA512

                    3a13d880278aa155454254c67622b40608a1628dd31550aa14b24ed5739e71ef9bf7b1d3ea28fe7968e234337728600dc19f63a621c39f3b9936ad4adb214b2f

                    Download Submit

                  • \Program Files (x86)\Kele55\Kele55.exe
                    Filesize

                    2.4MB

                    MD5

                    cbe7f9c49ed678a24fad00244c71829a

                    SHA1

                    a917b0e55fc6eb7d90d06792082b0c3986cd71de

                    SHA256

                    5055f4f65558211fc6300e56293f8fa97f2a9527ebd88eb6bb8f1d1106014182

                    SHA512

                    040687b0ef6f4f36221a7e1a5bcdf8520ec8c202eee97e17fdf56aefeeca6fc0fb8d33c43348846c7e50e70c8b38597d49c2116ccbc11fd8d8c0adc23f3a76b0

                    Download Submit

                  • \Program Files (x86)\Kele55\Kele55.exe
                    Filesize

                    2.4MB

                    MD5

                    cbe7f9c49ed678a24fad00244c71829a

                    SHA1

                    a917b0e55fc6eb7d90d06792082b0c3986cd71de

                    SHA256

                    5055f4f65558211fc6300e56293f8fa97f2a9527ebd88eb6bb8f1d1106014182

                    SHA512

                    040687b0ef6f4f36221a7e1a5bcdf8520ec8c202eee97e17fdf56aefeeca6fc0fb8d33c43348846c7e50e70c8b38597d49c2116ccbc11fd8d8c0adc23f3a76b0

                    Download Submit

                  • \Program Files (x86)\Kele55\Kele55.exe
                    Filesize

                    2.4MB

                    MD5

                    cbe7f9c49ed678a24fad00244c71829a

                    SHA1

                    a917b0e55fc6eb7d90d06792082b0c3986cd71de

                    SHA256

                    5055f4f65558211fc6300e56293f8fa97f2a9527ebd88eb6bb8f1d1106014182

                    SHA512

                    040687b0ef6f4f36221a7e1a5bcdf8520ec8c202eee97e17fdf56aefeeca6fc0fb8d33c43348846c7e50e70c8b38597d49c2116ccbc11fd8d8c0adc23f3a76b0

                    Download Submit

                  • \Program Files (x86)\Kele55\Kele55.exe
                    Filesize

                    2.4MB

                    MD5

                    cbe7f9c49ed678a24fad00244c71829a

                    SHA1

                    a917b0e55fc6eb7d90d06792082b0c3986cd71de

                    SHA256

                    5055f4f65558211fc6300e56293f8fa97f2a9527ebd88eb6bb8f1d1106014182

                    SHA512

                    040687b0ef6f4f36221a7e1a5bcdf8520ec8c202eee97e17fdf56aefeeca6fc0fb8d33c43348846c7e50e70c8b38597d49c2116ccbc11fd8d8c0adc23f3a76b0

                    Download Submit

                  • \Program Files (x86)\Kele55\Kele55.exe
                    Filesize

                    2.4MB

                    MD5

                    cbe7f9c49ed678a24fad00244c71829a

                    SHA1

                    a917b0e55fc6eb7d90d06792082b0c3986cd71de

                    SHA256

                    5055f4f65558211fc6300e56293f8fa97f2a9527ebd88eb6bb8f1d1106014182

                    SHA512

                    040687b0ef6f4f36221a7e1a5bcdf8520ec8c202eee97e17fdf56aefeeca6fc0fb8d33c43348846c7e50e70c8b38597d49c2116ccbc11fd8d8c0adc23f3a76b0

                    Download Submit

                  • \Program Files (x86)\Kele55\Kele55.exe
                    Filesize

                    2.4MB

                    MD5

                    cbe7f9c49ed678a24fad00244c71829a

                    SHA1

                    a917b0e55fc6eb7d90d06792082b0c3986cd71de

                    SHA256

                    5055f4f65558211fc6300e56293f8fa97f2a9527ebd88eb6bb8f1d1106014182

                    SHA512

                    040687b0ef6f4f36221a7e1a5bcdf8520ec8c202eee97e17fdf56aefeeca6fc0fb8d33c43348846c7e50e70c8b38597d49c2116ccbc11fd8d8c0adc23f3a76b0

                    Download Submit

                  • \Program Files (x86)\Kele55\MFC71u.dll
                    Filesize

                    1.0MB

                    MD5

                    03df065a8dba0d71993fd8090e397d5d

                    SHA1

                    296f0ca29ea4103942384fa13e9b8c745b77da48

                    SHA256

                    68174cec32d3170389fe538c10328596db724488259727eed54e401c8f411ba4

                    SHA512

                    650ad429c391bfbab69e387e396e9da2613ec800e5f15c14df4acb25525036c3aec4bba41e966ec0e3842fd69dd6feaf7f4c6b4beb32758644e59d6fb5674ebe

                    Download Submit

                  • \Program Files (x86)\Kele55\MFC71u.dll
                    Filesize

                    1.0MB

                    MD5

                    03df065a8dba0d71993fd8090e397d5d

                    SHA1

                    296f0ca29ea4103942384fa13e9b8c745b77da48

                    SHA256

                    68174cec32d3170389fe538c10328596db724488259727eed54e401c8f411ba4

                    SHA512

                    650ad429c391bfbab69e387e396e9da2613ec800e5f15c14df4acb25525036c3aec4bba41e966ec0e3842fd69dd6feaf7f4c6b4beb32758644e59d6fb5674ebe

                    Download Submit

                  • \Program Files (x86)\Kele55\MFC71u.dll
                    Filesize

                    1.0MB

                    MD5

                    03df065a8dba0d71993fd8090e397d5d

                    SHA1

                    296f0ca29ea4103942384fa13e9b8c745b77da48

                    SHA256

                    68174cec32d3170389fe538c10328596db724488259727eed54e401c8f411ba4

                    SHA512

                    650ad429c391bfbab69e387e396e9da2613ec800e5f15c14df4acb25525036c3aec4bba41e966ec0e3842fd69dd6feaf7f4c6b4beb32758644e59d6fb5674ebe

                    Download Submit

                  • \Program Files (x86)\Kele55\MFC71u.dll
                    Filesize

                    1.0MB

                    MD5

                    03df065a8dba0d71993fd8090e397d5d

                    SHA1

                    296f0ca29ea4103942384fa13e9b8c745b77da48

                    SHA256

                    68174cec32d3170389fe538c10328596db724488259727eed54e401c8f411ba4

                    SHA512

                    650ad429c391bfbab69e387e396e9da2613ec800e5f15c14df4acb25525036c3aec4bba41e966ec0e3842fd69dd6feaf7f4c6b4beb32758644e59d6fb5674ebe

                    Download Submit

                  • \Program Files (x86)\Kele55\MFC71u.dll
                    Filesize

                    1.0MB

                    MD5

                    03df065a8dba0d71993fd8090e397d5d

                    SHA1

                    296f0ca29ea4103942384fa13e9b8c745b77da48

                    SHA256

                    68174cec32d3170389fe538c10328596db724488259727eed54e401c8f411ba4

                    SHA512

                    650ad429c391bfbab69e387e396e9da2613ec800e5f15c14df4acb25525036c3aec4bba41e966ec0e3842fd69dd6feaf7f4c6b4beb32758644e59d6fb5674ebe

                    Download Submit

                  • \Program Files (x86)\Kele55\MFC71u.dll
                    Filesize

                    1.0MB

                    MD5

                    03df065a8dba0d71993fd8090e397d5d

                    SHA1

                    296f0ca29ea4103942384fa13e9b8c745b77da48

                    SHA256

                    68174cec32d3170389fe538c10328596db724488259727eed54e401c8f411ba4

                    SHA512

                    650ad429c391bfbab69e387e396e9da2613ec800e5f15c14df4acb25525036c3aec4bba41e966ec0e3842fd69dd6feaf7f4c6b4beb32758644e59d6fb5674ebe

                    Download Submit

                  • \Program Files (x86)\Kele55\RecommendInfo.dll
                    Filesize

                    141KB

                    MD5

                    c5b6f976be3dc938a24d3ef537ed6d92

                    SHA1

                    db6a17965a8b7e1fccbfe4273cbcd8da8e7607c5

                    SHA256

                    5e4c0c1f19aee6de56b711b0fe7b9ed4e83f9b47bde01b7944bbc77211e5aa0b

                    SHA512

                    90dabcd921b4022916127f1a115b8b434883c80afc5a78660f5957aae0984b6c1ea2e2996ffdb88ee099425a00b14f2e57efd8e28eeb6bd01acc77ee811c2c73

                    Download Submit

                  • \Program Files (x86)\Kele55\ResideClient.exe
                    Filesize

                    269KB

                    MD5

                    45ae1e6a8f463423b859bc8fa3a9e41e

                    SHA1

                    3da933875c781808386236416d8d43f65873ce92

                    SHA256

                    54c6a23f1dac64c85f9cd15bc95ae55ba3010ae5c8f93a3d8ac8bbdff2f76d38

                    SHA512

                    6afc43b8e58645273c1383ee3488e03b081228bc1fe62984163c21dd10ee87bdd001cb66f5695f77f7b213b8732c8a6cf847ef84650b4548406e9b399f471389

                    Download Submit

                  • \Program Files (x86)\Kele55\ResideClient.exe
                    Filesize

                    269KB

                    MD5

                    45ae1e6a8f463423b859bc8fa3a9e41e

                    SHA1

                    3da933875c781808386236416d8d43f65873ce92

                    SHA256

                    54c6a23f1dac64c85f9cd15bc95ae55ba3010ae5c8f93a3d8ac8bbdff2f76d38

                    SHA512

                    6afc43b8e58645273c1383ee3488e03b081228bc1fe62984163c21dd10ee87bdd001cb66f5695f77f7b213b8732c8a6cf847ef84650b4548406e9b399f471389

                    Download Submit

                  • \Program Files (x86)\Kele55\ServiceClient.dll
                    Filesize

                    109KB

                    MD5

                    94bc1d61355ac31197fb1d7263e1e44a

                    SHA1

                    ee38f54ad37a521fac824aaa123640b67f30aee4

                    SHA256

                    201af1c684cbf2447c2c87b9703f28813c66877e2296486e3a1a1dc451102087

                    SHA512

                    3f52803761a0c5ac967025bbc0e3c80de59b35e1c55c7d273fbdbb315fb685fde9fd3f338ecc4c18d6836168d38ae93d4f9de47259579d4558b402cb9971502d

                    Download Submit

                  • \Program Files (x86)\Kele55\ServiceClient.exe
                    Filesize

                    113KB

                    MD5

                    f73dfe587bb6dfb7a3fb792757daa066

                    SHA1

                    d48e893245b1b55f73730fd887a0a02ba1d65486

                    SHA256

                    84736855ef4b0143d1fe4c97953d70c85d5ffd442ff1e83fd417b22441ec0771

                    SHA512

                    6ac4ce1169a3132cf788bd81811e5fc7ca40e61ae327b0be13dc43cb7c9a94aa60bd9f8723559a4801d21298d59ebed8db004d91b2efb5648d48e6177b034df1

                    Download Submit

                  • \Program Files (x86)\Kele55\ServiceClient.exe
                    Filesize

                    113KB

                    MD5

                    f73dfe587bb6dfb7a3fb792757daa066

                    SHA1

                    d48e893245b1b55f73730fd887a0a02ba1d65486

                    SHA256

                    84736855ef4b0143d1fe4c97953d70c85d5ffd442ff1e83fd417b22441ec0771

                    SHA512

                    6ac4ce1169a3132cf788bd81811e5fc7ca40e61ae327b0be13dc43cb7c9a94aa60bd9f8723559a4801d21298d59ebed8db004d91b2efb5648d48e6177b034df1

                    Download Submit

                  • \Program Files (x86)\Kele55\ServiceClient.exe
                    Filesize

                    113KB

                    MD5

                    f73dfe587bb6dfb7a3fb792757daa066

                    SHA1

                    d48e893245b1b55f73730fd887a0a02ba1d65486

                    SHA256

                    84736855ef4b0143d1fe4c97953d70c85d5ffd442ff1e83fd417b22441ec0771

                    SHA512

                    6ac4ce1169a3132cf788bd81811e5fc7ca40e61ae327b0be13dc43cb7c9a94aa60bd9f8723559a4801d21298d59ebed8db004d91b2efb5648d48e6177b034df1

                    Download Submit

                  • \Program Files (x86)\Kele55\Update.exe
                    Filesize

                    257KB

                    MD5

                    2ffe11691d7bbb86d9797b4c8d17d856

                    SHA1

                    0cf5db68147582a66e5fce3346255b0a01b7b8af

                    SHA256

                    359640d3431d764e1a514c74074ec0074d196f10abae78d1d6a67e38f187d62d

                    SHA512

                    9f65ba1fa5a5d2d67384ddfab8200048a2664ff66eb79f91a7b63ab5733b1a8d052eedc6d42c715ac833f504f4a3e93c163ba55f0184a20f46c3eea1d4a730bb

                    Download Submit

                  • \Program Files (x86)\Kele55\crashreport.dll
                    Filesize

                    233KB

                    MD5

                    dc3080b8a568a302baf3d5029a21eab9

                    SHA1

                    ba5a7086f39add4a1c0fa18d89c9a615991ee382

                    SHA256

                    58bfa00054031fd55157dbfde8f639ac3e5e7e79047b8c362cd358a4661f196e

                    SHA512

                    699b8f7cb78f3ee3f6d5ef2e746f947fc38963ceadf37d675eb3797e343213be65e618c2cc379becd626f321b11fe81a8b9f9b08134231651eec741e60e54886

                    Download Submit

                  • \Program Files (x86)\Kele55\msvcp71.dll
                    Filesize

                    493KB

                    MD5

                    e5d08ef3e7b1d377b0e8c5417c959811

                    SHA1

                    e35cf02aa4a1a4b4abc11a4ca5f742f58b79758b

                    SHA256

                    b70e7e0b3102cefe3c19f9e9c9067947d5ff97f533694124e110cf77617601b8

                    SHA512

                    764cdae4d9414e550adee64884e70a8cbd7078b2c3b6b8a58e2dba9a093f949d1a4cfb6158a33f487c48b81b21dbc9af57b7c9809b35ffabf0148d139f998f2f

                    Download Submit

                  • \Program Files (x86)\Kele55\msvcp71.dll
                    Filesize

                    493KB

                    MD5

                    e5d08ef3e7b1d377b0e8c5417c959811

                    SHA1

                    e35cf02aa4a1a4b4abc11a4ca5f742f58b79758b

                    SHA256

                    b70e7e0b3102cefe3c19f9e9c9067947d5ff97f533694124e110cf77617601b8

                    SHA512

                    764cdae4d9414e550adee64884e70a8cbd7078b2c3b6b8a58e2dba9a093f949d1a4cfb6158a33f487c48b81b21dbc9af57b7c9809b35ffabf0148d139f998f2f

                    Download Submit

                  • \Program Files (x86)\Kele55\msvcp71.dll
                    Filesize

                    493KB

                    MD5

                    e5d08ef3e7b1d377b0e8c5417c959811

                    SHA1

                    e35cf02aa4a1a4b4abc11a4ca5f742f58b79758b

                    SHA256

                    b70e7e0b3102cefe3c19f9e9c9067947d5ff97f533694124e110cf77617601b8

                    SHA512

                    764cdae4d9414e550adee64884e70a8cbd7078b2c3b6b8a58e2dba9a093f949d1a4cfb6158a33f487c48b81b21dbc9af57b7c9809b35ffabf0148d139f998f2f

                    Download Submit

                  • \Program Files (x86)\Kele55\msvcr71.dll
                    Filesize

                    345KB

                    MD5

                    ebb3e701588a92c36b4c902a3976e58a

                    SHA1

                    83cec9f2b486eb7d000aa0d716246ab044c2bf2e

                    SHA256

                    63ce7639ee0f0c16b7cf45c3f73b698887260bc3225cb25c26a97e2b09d92c3e

                    SHA512

                    23887dc229f6753100a06f9a6d3ea391d5b50778e6b239f6592675e53300fc8b4eb95796bbcf4123271213384ccf0773a1e2a09f8c68c2b58f2e6f074c7e53ac

                    Download Submit

                  • \Program Files (x86)\Kele55\msvcr71.dll
                    Filesize

                    345KB

                    MD5

                    ebb3e701588a92c36b4c902a3976e58a

                    SHA1

                    83cec9f2b486eb7d000aa0d716246ab044c2bf2e

                    SHA256

                    63ce7639ee0f0c16b7cf45c3f73b698887260bc3225cb25c26a97e2b09d92c3e

                    SHA512

                    23887dc229f6753100a06f9a6d3ea391d5b50778e6b239f6592675e53300fc8b4eb95796bbcf4123271213384ccf0773a1e2a09f8c68c2b58f2e6f074c7e53ac

                    Download Submit

                  • \Program Files (x86)\Kele55\msvcr71.dll
                    Filesize

                    345KB

                    MD5

                    ebb3e701588a92c36b4c902a3976e58a

                    SHA1

                    83cec9f2b486eb7d000aa0d716246ab044c2bf2e

                    SHA256

                    63ce7639ee0f0c16b7cf45c3f73b698887260bc3225cb25c26a97e2b09d92c3e

                    SHA512

                    23887dc229f6753100a06f9a6d3ea391d5b50778e6b239f6592675e53300fc8b4eb95796bbcf4123271213384ccf0773a1e2a09f8c68c2b58f2e6f074c7e53ac

                    Download Submit

                  • \Program Files (x86)\Kele55\msvcr71.dll
                    Filesize

                    345KB

                    MD5

                    ebb3e701588a92c36b4c902a3976e58a

                    SHA1

                    83cec9f2b486eb7d000aa0d716246ab044c2bf2e

                    SHA256

                    63ce7639ee0f0c16b7cf45c3f73b698887260bc3225cb25c26a97e2b09d92c3e

                    SHA512

                    23887dc229f6753100a06f9a6d3ea391d5b50778e6b239f6592675e53300fc8b4eb95796bbcf4123271213384ccf0773a1e2a09f8c68c2b58f2e6f074c7e53ac

                    Download Submit

                  • \Program Files (x86)\Kele55\msvcr71.dll
                    Filesize

                    345KB

                    MD5

                    ebb3e701588a92c36b4c902a3976e58a

                    SHA1

                    83cec9f2b486eb7d000aa0d716246ab044c2bf2e

                    SHA256

                    63ce7639ee0f0c16b7cf45c3f73b698887260bc3225cb25c26a97e2b09d92c3e

                    SHA512

                    23887dc229f6753100a06f9a6d3ea391d5b50778e6b239f6592675e53300fc8b4eb95796bbcf4123271213384ccf0773a1e2a09f8c68c2b58f2e6f074c7e53ac

                    Download Submit

                  • \Program Files (x86)\Kele55\msvcr71.dll
                    Filesize

                    345KB

                    MD5

                    ebb3e701588a92c36b4c902a3976e58a

                    SHA1

                    83cec9f2b486eb7d000aa0d716246ab044c2bf2e

                    SHA256

                    63ce7639ee0f0c16b7cf45c3f73b698887260bc3225cb25c26a97e2b09d92c3e

                    SHA512

                    23887dc229f6753100a06f9a6d3ea391d5b50778e6b239f6592675e53300fc8b4eb95796bbcf4123271213384ccf0773a1e2a09f8c68c2b58f2e6f074c7e53ac

                    Download Submit

                  • \Program Files (x86)\Kele55\msvcr71.dll
                    Filesize

                    345KB

                    MD5

                    ebb3e701588a92c36b4c902a3976e58a

                    SHA1

                    83cec9f2b486eb7d000aa0d716246ab044c2bf2e

                    SHA256

                    63ce7639ee0f0c16b7cf45c3f73b698887260bc3225cb25c26a97e2b09d92c3e

                    SHA512

                    23887dc229f6753100a06f9a6d3ea391d5b50778e6b239f6592675e53300fc8b4eb95796bbcf4123271213384ccf0773a1e2a09f8c68c2b58f2e6f074c7e53ac

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\nsjA72B.tmp\GGExit.exe
                    Filesize

                    54KB

                    MD5

                    14607f1d7790612a9ca212f4ab8f605a

                    SHA1

                    060450216bc1daeb380562f65358300f594f0b86

                    SHA256

                    e36913e299219488cae06555019aceb086d66d8d1d5024b9405933d4b3abec67

                    SHA512

                    611895f78dab311ace1ab14a5dd630e230b9884c5acf95232ccc13c75805c3da26d3d26304c3e341a85834d05dc1826394305fcefa5f2839bdf88f4c0ce9c868

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\nsjA72B.tmp\GGExit.exe
                    Filesize

                    54KB

                    MD5

                    14607f1d7790612a9ca212f4ab8f605a

                    SHA1

                    060450216bc1daeb380562f65358300f594f0b86

                    SHA256

                    e36913e299219488cae06555019aceb086d66d8d1d5024b9405933d4b3abec67

                    SHA512

                    611895f78dab311ace1ab14a5dd630e230b9884c5acf95232ccc13c75805c3da26d3d26304c3e341a85834d05dc1826394305fcefa5f2839bdf88f4c0ce9c868

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\nsjA72B.tmp\GGExit.exe
                    Filesize

                    54KB

                    MD5

                    14607f1d7790612a9ca212f4ab8f605a

                    SHA1

                    060450216bc1daeb380562f65358300f594f0b86

                    SHA256

                    e36913e299219488cae06555019aceb086d66d8d1d5024b9405933d4b3abec67

                    SHA512

                    611895f78dab311ace1ab14a5dd630e230b9884c5acf95232ccc13c75805c3da26d3d26304c3e341a85834d05dc1826394305fcefa5f2839bdf88f4c0ce9c868

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\nsjA72B.tmp\GGExit.exe
                    Filesize

                    54KB

                    MD5

                    14607f1d7790612a9ca212f4ab8f605a

                    SHA1

                    060450216bc1daeb380562f65358300f594f0b86

                    SHA256

                    e36913e299219488cae06555019aceb086d66d8d1d5024b9405933d4b3abec67

                    SHA512

                    611895f78dab311ace1ab14a5dd630e230b9884c5acf95232ccc13c75805c3da26d3d26304c3e341a85834d05dc1826394305fcefa5f2839bdf88f4c0ce9c868

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\nsjA72B.tmp\System.dll
                    Filesize

                    10KB

                    MD5

                    2b54369538b0fb45e1bb9f49f71ce2db

                    SHA1

                    c20df42fda5854329e23826ba8f2015f506f7b92

                    SHA256

                    761dcdf12f41d119f49dbdca9bcab3928bbdfd8edd67e314d54689811f9d3e2f

                    SHA512

                    25e4898e3c082632dfd493756c4cc017decbef43ffa0b68f36d037841a33f2a1721f30314a85597ac30c7ecc99b7257ea43f3a903744179578a9c65fcf57a8b7

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\nsy570.tmp\Base64.dll
                    Filesize

                    4KB

                    MD5

                    f0e3845fefd227d7f1101850410ec849

                    SHA1

                    3067203fafd4237be0c186ddab7029dfcbdfb53e

                    SHA256

                    7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

                    SHA512

                    584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\nsy570.tmp\Inetc.dll
                    Filesize

                    20KB

                    MD5

                    50fdadda3e993688401f6f1108fabdb4

                    SHA1

                    04a9ae55d0fb726be49809582cea41d75bf22a9a

                    SHA256

                    6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

                    SHA512

                    e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\nsy570.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe
                    Filesize

                    14.5MB

                    MD5

                    7bc1957672229fee0b41897d3ec17d49

                    SHA1

                    d8060209bfdc9e25236f1848a644faf27bde1c83

                    SHA256

                    3e2e7e1b0ae2af1b973fe76b1962ef92af4b55420df8cf5c240d676a7de4f183

                    SHA512

                    631e3fc58cbfe87ee8729c28378718c28891908ffd42af93ea12ff92126d898ae6362e96873b1c3dd43fc4351255b1cfa9b304d4c6c2cd795ab937fadfb69c76

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\nsy570.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe
                    Filesize

                    14.5MB

                    MD5

                    7bc1957672229fee0b41897d3ec17d49

                    SHA1

                    d8060209bfdc9e25236f1848a644faf27bde1c83

                    SHA256

                    3e2e7e1b0ae2af1b973fe76b1962ef92af4b55420df8cf5c240d676a7de4f183

                    SHA512

                    631e3fc58cbfe87ee8729c28378718c28891908ffd42af93ea12ff92126d898ae6362e96873b1c3dd43fc4351255b1cfa9b304d4c6c2cd795ab937fadfb69c76

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\nsy570.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe
                    Filesize

                    14.5MB

                    MD5

                    7bc1957672229fee0b41897d3ec17d49

                    SHA1

                    d8060209bfdc9e25236f1848a644faf27bde1c83

                    SHA256

                    3e2e7e1b0ae2af1b973fe76b1962ef92af4b55420df8cf5c240d676a7de4f183

                    SHA512

                    631e3fc58cbfe87ee8729c28378718c28891908ffd42af93ea12ff92126d898ae6362e96873b1c3dd43fc4351255b1cfa9b304d4c6c2cd795ab937fadfb69c76

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\nsy570.tmp\NSISdl.dll
                    Filesize

                    14KB

                    MD5

                    a5f8399a743ab7f9c88c645c35b1ebb5

                    SHA1

                    168f3c158913b0367bf79fa413357fbe97018191

                    SHA256

                    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

                    SHA512

                    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\nsy570.tmp\NSISdl.dll
                    Filesize

                    14KB

                    MD5

                    a5f8399a743ab7f9c88c645c35b1ebb5

                    SHA1

                    168f3c158913b0367bf79fa413357fbe97018191

                    SHA256

                    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

                    SHA512

                    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\nsy570.tmp\System.dll
                    Filesize

                    11KB

                    MD5

                    c17103ae9072a06da581dec998343fc1

                    SHA1

                    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

                    SHA256

                    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

                    SHA512

                    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

                    Download Submit

                  • memory/820-214-0x0000000003BD0000-0x000000000445C000-memory.dmp

                    Filesize

                    8.5MB

                    Download

                  • memory/1132-136-0x0000000000BF0000-0x0000000000E50000-memory.dmp

                    Filesize

                    2.4MB

                    Download

                  • memory/1132-160-0x0000000004350000-0x000000000440F000-memory.dmp

                    Filesize

                    764KB

                    Download

                  • memory/1132-113-0x00000000006D0000-0x0000000000726000-memory.dmp

                    Filesize

                    344KB

                    Download

                  • memory/1132-139-0x0000000000400000-0x0000000000660000-memory.dmp

                    Filesize

                    2.4MB

                    Download

                  • memory/1132-128-0x0000000000BF0000-0x0000000000E50000-memory.dmp

                    Filesize

                    2.4MB

                    Download

                  • memory/1132-165-0x0000000000400000-0x0000000000660000-memory.dmp

                    Filesize

                    2.4MB

                    Download

                  • memory/1132-164-0x0000000000BF0000-0x0000000000E50000-memory.dmp

                    Filesize

                    2.4MB

                    Download

                  • memory/1132-162-0x0000000000280000-0x00000000002A7000-memory.dmp

                    Filesize

                    156KB

                    Download

                  • memory/1276-148-0x00000000004C0000-0x0000000000516000-memory.dmp

                    Filesize

                    344KB

                    Download

                  • memory/1388-54-0x0000000075711000-0x0000000075713000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/1492-134-0x0000000000230000-0x0000000000286000-memory.dmp

                    Filesize

                    344KB

                    Download

                  • memory/1764-102-0x00000000004E0000-0x00000000004F0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/1764-79-0x0000000000450000-0x00000000004A6000-memory.dmp

                    Filesize

                    344KB

                    Download

                  • memory/1764-100-0x0000000000340000-0x0000000000350000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/1764-89-0x0000000000860000-0x0000000000883000-memory.dmp

                    Filesize

                    140KB

                    Download

                  • memory/1928-92-0x0000000000240000-0x0000000000296000-memory.dmp

                    Filesize

                    344KB

                    Download

                  • memory/2128-194-0x000000006EAD0000-0x000000006EAE0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/2128-193-0x000000006E360000-0x000000006E370000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/2172-197-0x000000006E360000-0x000000006E370000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/2172-198-0x0000000003F00000-0x000000000478C000-memory.dmp

                    Filesize

                    8.5MB

                    Download