74591a60abf83dcc096f4495f1b8bc031aaaca4a276644d0134ca7505cb1ec53

Resubmissions

31/12/2022, 16:51

221231-vdaqfaaa33 8

31/12/2022, 16:42

221231-t7syfaaa24 8

31/12/2022, 16:30

221231-tz265shh92 8

Analysis

max time kernel
591s
max time network
586s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2022, 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GLP_installer_1000218456_market.exe
Size

3.6MB
MD5

a0a25bdacd989feb80f73dfccd8c37bc
SHA1

0eb7a30e7315594465e01ea42e103161e55087c0
SHA256

74591a60abf83dcc096f4495f1b8bc031aaaca4a276644d0134ca7505cb1ec53
SHA512

e71239fbf84e59747777080ffe988555d62cb2f5474064887742df10832682ac76f5112c531d9811318dc0a7ee810750149a6fc7e27082c8dd784680c507e0e7
SSDEEP

49152:v08OhxtUg9OUi82w6aQp9dgS1GUL38XhCOYc3iJXe9emEPGKOPkQThMYRMnm7LBd:v08vdsGaQNgS1C6e6ngKpqh

Score

8^/10

bootkit discovery evasion persistence

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\UniFairy_x64.sys	AndroidEmulatorEn.exe

Executes dropped EXE 18 IoCs

pid	Process
688	Market.exe
4592	Tinst.exe
4580	QMEmulatorService.exe
4424	AppMarket.exe
4332	wmpf_installer.exe
1304	syzs_dl_svr.exe
3116	cef_frame_render.exe
3896	cef_frame_render.exe
3300	cef_frame_render.exe
2404	cef_frame_render.exe
3460	cef_frame_render.exe
2240	UI.exe
4628	TInst.exe
3160	AOW_Rootfs_100.exe
4016	TInst.exe
3900	AndroidEmulatorEn.exe
2056	Updater32.exe
4268	TP3Helper.exe

Modifies Windows Firewall 1 TTPs 13 IoCs

evasion

Modify Existing Service

T1031

pid	Process
4388	Netsh.exe
4332	Netsh.exe
4840	Netsh.exe
1196	Netsh.exe
628	Netsh.exe
760	Netsh.exe
1652	Netsh.exe
4404	Netsh.exe
452	Netsh.exe
4952	Netsh.exe
1688	Netsh.exe
2304	Netsh.exe
3728	Netsh.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	GLP_installer_1000218456_market.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	AppMarket.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	cef_frame_render.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	cef_frame_render.exe

Loads dropped DLL 64 IoCs

pid	Process
2728	GLP_installer_1000218456_market.exe
4580	QMEmulatorService.exe
4580	QMEmulatorService.exe
4580	QMEmulatorService.exe
4580	QMEmulatorService.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4332	wmpf_installer.exe
3116	cef_frame_render.exe
3116	cef_frame_render.exe
3116	cef_frame_render.exe
3116	cef_frame_render.exe
3116	cef_frame_render.exe
3116	cef_frame_render.exe
3116	cef_frame_render.exe
4424	AppMarket.exe
4424	AppMarket.exe
3116	cef_frame_render.exe
3116	cef_frame_render.exe
3896	cef_frame_render.exe
3896	cef_frame_render.exe
3896	cef_frame_render.exe
3896	cef_frame_render.exe
3896	cef_frame_render.exe
3896	cef_frame_render.exe
3300	cef_frame_render.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	GLP_installer_1000218456_market.exe
File opened for modification	\??\PhysicalDrive0	QMEmulatorService.exe
File opened for modification	\??\PhysicalDrive0	AppMarket.exe
File opened for modification	\??\PhysicalDrive0	AndroidEmulatorEn.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent\DeskUpdate\GlobalMgr.db	QMEmulatorService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent\DeskUpdate\GlobalMgr.db	QMEmulatorService.exe

Suspicious use of NtCreateThreadExHideFromDebugger 17 IoCs

pid	Process
3900	AndroidEmulatorEn.exe
3900	AndroidEmulatorEn.exe
3900	AndroidEmulatorEn.exe
3900	AndroidEmulatorEn.exe
3900	AndroidEmulatorEn.exe
3900	AndroidEmulatorEn.exe
3900	AndroidEmulatorEn.exe
3900	AndroidEmulatorEn.exe
3900	AndroidEmulatorEn.exe
3900	AndroidEmulatorEn.exe
3900	AndroidEmulatorEn.exe
3900	AndroidEmulatorEn.exe
3900	AndroidEmulatorEn.exe
3900	AndroidEmulatorEn.exe
3900	AndroidEmulatorEn.exe
3900	AndroidEmulatorEn.exe
3900	AndroidEmulatorEn.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\img\aim_icon.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\NewOpGuid\btn_next_down.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\Record\bar-model-down.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\DMAERes\layout\language\dmlg_tr.xml	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\DMAERes\themes\theme0\image\ae_msg_waricon.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\README_EN.md	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\api-ms-win-crt-utility-l1-1-0.dll	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\QQPCCommonMgr\res\ScrollBar\All_vertscrollbar_arrowDownNormal.gft	TInst.exe
File created	\??\c:\program files\txgameassistant\appmarket\api-ms-win-core-synch-l1-2-0.dll	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\hardwarecheck\egine_tip.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\window\web_load_error.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\KeyMap\icon_tip.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\KeyMap\sgame_heros\aov_header\Aieister.jpg	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\NewOpGuid\Sgame\special_map_normal.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\QQPCCommonMgr\res\SysButton\sysbtn_setting_down.gft	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\Resource\com.tencent.tmgp.sgame\ClickAnimation\0007.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\ucrtbase.dll	TInst.exe
File created	C:\Program Files\TxGameAssistant\UI\ConfigFile.zip	AppMarket.exe
File created	\??\c:\program files\txgameassistant\ui\libEGL_translator_v3.dll	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\QQPCCommonMgr\res\SwitchButton\swbtn_open_down.gft	TInst.exe
File created	\??\c:\program files\txgameassistant\appmarket\api-ms-win-core-timezone-l1-1-0.dll	Tinst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\button\setting_s\snapshot_normal.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\KeyMap\plane\unsel_hover.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\NewOpGuid\Cf_Znjw\bkg1.gft	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\Record\window_bkg_Fold.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\DMAERes\layout\xml\UserGuideTipWnd.xml	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\Resource\com.tencent.KiHan\Default.cur	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\KeyMap\sgame_heros\header\妲己.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\sysbutton\memboost_down.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\sysbutton\toolset_hover.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\Resource\com.tencent.tmgp.coslegend\LDown.cur	TInst.exe
File created	C:\Program Files\TxGameAssistant\UI\ConfigFile\SceneTips.xml	AppMarket.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\hardwarecheck\progress\9.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\tvoice_entry\oversea\normal\63.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\update\loading_2.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\syzsweb\module\component-style.72c23333.js	Tinst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\KeyMap\checkbox\seled_down.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\QQPCCommonMgr\res\Logo\LogoHoverAnimation\Logo_Hover_02.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\QQPCCommonMgr\res\MessageBox\sysmessagebox_errorFile.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\QQPCCommonMgr\res\SysButton\close_normal_gray.png	TInst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\tvoice_entry\oversea\normal\94.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\syzsweb\single-page.html	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\syzsweb\static\libs\jquery-3.6.0.min.js	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\uires\window\reload_normal.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\windowbackground\androideumlator_main.gft	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\DMAERes\themes\theme0\image\mapkey_WASD_chk.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\NewOpGuid\Sgame\button_h_start.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\Record\window_bkg_Expand.png	TInst.exe
File created	\??\c:\program files\txgameassistant\appmarket\api-ms-win-core-errorhandling-l1-1-0.dll	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\Menu\menuEx_background.bmp	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\AppMarket\Res\webctrl\loading\4.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\DL\syzs_dl_svr.exe	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\syzsweb\module\lib-ovb-event-emitter.973d4370.js	Tinst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\ComboBox\comboboxEraseButton_Normal.gft	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\sysbutton\shop_normal.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\TypeDef\Theme.xml	TInst.exe
File opened for modification	C:\Program Files\TxGameAssistant\UI\whitelist.conf	AppMarket.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\syzsweb\module\lib-thumbplayer-tvk-utils.c82377fb.js	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\pages\syzsweb\static\media\logo-about-edu.f4e07ec5.png	Tinst.exe
File created	\??\c:\program files\txgameassistant\appmarket\TGVoiceCfg.ini	Tinst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\I18N\config-ru.xml	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\KeyMap\slider\foreground.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\QQPCCommonMgr\res\TipWindow\tips_logo.png	TInst.exe
File created	\??\c:\program files\txgameassistant\ui\AndroidEmulator\res\NewOpGuid\freefire\tip_start_tr.png	TInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AndroidEmulatorEn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AndroidEmulatorEn.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2328	systeminfo.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Tencent\MobileGamePC	QMEmulatorService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Tencent\MobileGamePC\sf = "C:\\Temp\\TxGameDownload\\MobileGamePCShared"	QMEmulatorService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Tencent\MobileGamePC	QMEmulatorService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	QMEmulatorService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Tencent	QMEmulatorService.exe

Modifies registry class 27 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TencentMobileGameAssistant	Tinst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TencentMobileGameAssistant\DefaultIcon	Tinst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TencentMobileGameAssistant\shell\open	Tinst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\syzs.apk\DefalutIcon\ = "C:\\Program Files\\TxGameAssistant\\AppMarket\\apk.ico"	GLP_installer_1000218456_market.exe
Key created	\REGISTRY\MACHINE\Software\Classes\syzs.apk\DefalutIcon	AppMarket.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TencentMobileGameAssistant\ = "TMGAProtocol"	Tinst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TencentMobileGameAssistant\shell	Tinst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\syzs.apk\DefalutIcon\ = "C:\\Program Files\\TxGameAssistant\\AppMarket\\apk.ico"	AppMarket.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TencentMobileGameAssistant\URL Protocol = "C:\\Program Files\\TxGameAssistant\\AppMarket\\AppMarket.exe"	Tinst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\syzs.apk	GLP_installer_1000218456_market.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\syzs.apk\Shell\Open\Command	GLP_installer_1000218456_market.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\syzs.apk\Shell\Open\Command\ = "C:\\Program Files\\TxGameAssistant\\AppMarket\\AppMarket.exe -localpkg %1 -from localapk"	GLP_installer_1000218456_market.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.xapk\ = "syzs.apk"	AppMarket.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TencentMobileGameAssistant\DefaultIcon\DefaultIcon = "C:\\Program Files\\TxGameAssistant\\AppMarket\\AppMarket.exe,1Ȁ"	Tinst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\syzs.apk\DefalutIcon	GLP_installer_1000218456_market.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\syzs.apk\Shell	GLP_installer_1000218456_market.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TencentMobileGameAssistant\shell\open\command	Tinst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TencentMobileGameAssistant\shell\open\command\ = "\"C:\\Program Files\\TxGameAssistant\\AppMarket\\AppMarket.exe\" \"%1\""	Tinst.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.apk	GLP_installer_1000218456_market.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.apk\ = "syzs.apk"	GLP_installer_1000218456_market.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\syzs.apk\DefalutIcon	GLP_installer_1000218456_market.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.xapk	AppMarket.exe
Key created	\REGISTRY\MACHINE\Software\Classes\syzs.apk\Shell\Open\Command	AppMarket.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\syzs.apk\Shell\Open\Command\ = "C:\\Program Files\\TxGameAssistant\\AppMarket\\AppMarket.exe -localpkg %1 -from localapk"	AppMarket.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\syzs.apk\Shell\Open	GLP_installer_1000218456_market.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4246620582-653642754-1174164128-1000\{713CD195-45FF-4D98-BC65-1E573B310E37}	cef_frame_render.exe
Key created	\REGISTRY\MACHINE\Software\Classes\syzs.apk\Shell\Open\Command	GLP_installer_1000218456_market.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Program Files\TxGameAssistant\UI:750c7dca.gfcces	AndroidEmulatorEn.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2728	GLP_installer_1000218456_market.exe
2728	GLP_installer_1000218456_market.exe
4592	Tinst.exe
4592	Tinst.exe
4580	QMEmulatorService.exe
4580	QMEmulatorService.exe
4580	QMEmulatorService.exe
4580	QMEmulatorService.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
3116	cef_frame_render.exe
3116	cef_frame_render.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
3896	cef_frame_render.exe
3896	cef_frame_render.exe
3300	cef_frame_render.exe
3300	cef_frame_render.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
2404	cef_frame_render.exe
2404	cef_frame_render.exe
3460	cef_frame_render.exe
3460	cef_frame_render.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4628	TInst.exe
4628	TInst.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4016	TInst.exe
4016	TInst.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe
4424	AppMarket.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
648	Process not Found

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4592	Tinst.exe
Token: SeManageVolumePrivilege	1304	syzs_dl_svr.exe
Token: SeDebugPrivilege	4628	TInst.exe
Token: SeDebugPrivilege	4016	TInst.exe
Token: 35	3900	AndroidEmulatorEn.exe
Token: SeDebugPrivilege	3900	AndroidEmulatorEn.exe
Token: SeLoadDriverPrivilege	3900	AndroidEmulatorEn.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4424	AppMarket.exe
4424	AppMarket.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4424	AppMarket.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4268	TP3Helper.exe
4268	TP3Helper.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 688	2728	GLP_installer_1000218456_market.exe	89
PID 2728 wrote to memory of 688	2728	GLP_installer_1000218456_market.exe	89
PID 2728 wrote to memory of 688	2728	GLP_installer_1000218456_market.exe	89
PID 2728 wrote to memory of 4592	2728	GLP_installer_1000218456_market.exe	91
PID 2728 wrote to memory of 4592	2728	GLP_installer_1000218456_market.exe	91
PID 2728 wrote to memory of 4592	2728	GLP_installer_1000218456_market.exe	91
PID 4592 wrote to memory of 1688	4592	Tinst.exe	94
PID 4592 wrote to memory of 1688	4592	Tinst.exe	94
PID 4592 wrote to memory of 1688	4592	Tinst.exe	94
PID 4592 wrote to memory of 628	4592	Tinst.exe	97
PID 4592 wrote to memory of 628	4592	Tinst.exe	97
PID 4592 wrote to memory of 628	4592	Tinst.exe	97
PID 4592 wrote to memory of 2304	4592	Tinst.exe	99
PID 4592 wrote to memory of 2304	4592	Tinst.exe	99
PID 4592 wrote to memory of 2304	4592	Tinst.exe	99
PID 4592 wrote to memory of 760	4592	Tinst.exe	101
PID 4592 wrote to memory of 760	4592	Tinst.exe	101
PID 4592 wrote to memory of 760	4592	Tinst.exe	101
PID 4592 wrote to memory of 1652	4592	Tinst.exe	103
PID 4592 wrote to memory of 1652	4592	Tinst.exe	103
PID 4592 wrote to memory of 1652	4592	Tinst.exe	103
PID 4592 wrote to memory of 4388	4592	Tinst.exe	105
PID 4592 wrote to memory of 4388	4592	Tinst.exe	105
PID 4592 wrote to memory of 4388	4592	Tinst.exe	105
PID 2728 wrote to memory of 4424	2728	GLP_installer_1000218456_market.exe	107
PID 2728 wrote to memory of 4424	2728	GLP_installer_1000218456_market.exe	107
PID 2728 wrote to memory of 4424	2728	GLP_installer_1000218456_market.exe	107
PID 4424 wrote to memory of 4332	4424	AppMarket.exe	109
PID 4424 wrote to memory of 4332	4424	AppMarket.exe	109
PID 4424 wrote to memory of 4332	4424	AppMarket.exe	109
PID 4424 wrote to memory of 1304	4424	AppMarket.exe	110
PID 4424 wrote to memory of 1304	4424	AppMarket.exe	110
PID 4424 wrote to memory of 1304	4424	AppMarket.exe	110
PID 4424 wrote to memory of 3116	4424	AppMarket.exe	114
PID 4424 wrote to memory of 3116	4424	AppMarket.exe	114
PID 4424 wrote to memory of 3116	4424	AppMarket.exe	114
PID 4424 wrote to memory of 3896	4424	AppMarket.exe	116
PID 4424 wrote to memory of 3896	4424	AppMarket.exe	116
PID 4424 wrote to memory of 3896	4424	AppMarket.exe	116
PID 4424 wrote to memory of 3300	4424	AppMarket.exe	117
PID 4424 wrote to memory of 3300	4424	AppMarket.exe	117
PID 4424 wrote to memory of 3300	4424	AppMarket.exe	117
PID 4424 wrote to memory of 2328	4424	AppMarket.exe	118
PID 4424 wrote to memory of 2328	4424	AppMarket.exe	118
PID 4424 wrote to memory of 2328	4424	AppMarket.exe	118
PID 4424 wrote to memory of 2404	4424	AppMarket.exe	123
PID 4424 wrote to memory of 2404	4424	AppMarket.exe	123
PID 4424 wrote to memory of 2404	4424	AppMarket.exe	123
PID 4424 wrote to memory of 3460	4424	AppMarket.exe	124
PID 4424 wrote to memory of 3460	4424	AppMarket.exe	124
PID 4424 wrote to memory of 3460	4424	AppMarket.exe	124
PID 4424 wrote to memory of 2240	4424	AppMarket.exe	126
PID 4424 wrote to memory of 2240	4424	AppMarket.exe	126
PID 4424 wrote to memory of 2240	4424	AppMarket.exe	126
PID 4424 wrote to memory of 4628	4424	AppMarket.exe	127
PID 4424 wrote to memory of 4628	4424	AppMarket.exe	127
PID 4424 wrote to memory of 4628	4424	AppMarket.exe	127
PID 4628 wrote to memory of 3728	4628	TInst.exe	129
PID 4628 wrote to memory of 3728	4628	TInst.exe	129
PID 4628 wrote to memory of 3728	4628	TInst.exe	129
PID 4628 wrote to memory of 4404	4628	TInst.exe	131
PID 4628 wrote to memory of 4404	4628	TInst.exe	131
PID 4628 wrote to memory of 4404	4628	TInst.exe	131
PID 4628 wrote to memory of 4332	4628	TInst.exe	133

C:\Users\Admin\AppData\Local\Temp\GLP_installer_1000218456_market.exe
"C:\Users\Admin\AppData\Local\Temp\GLP_installer_1000218456_market.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Market.exe
  "C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Market.exe"
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\Tinst.exe
  "C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\Tinst.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\SysWOW64\Netsh.exe
    "C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="AppMarket" dir=in program="c:\program files\txgameassistant\appmarket\AppMarket.exe" action=allow
    3⤵
    - Modifies Windows Firewall
    PID:1688
- - C:\Windows\SysWOW64\Netsh.exe
    "C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="TInst" dir=in program="c:\program files\txgameassistant\appmarket\TInst.exe" action=allow
    3⤵
    - Modifies Windows Firewall
    PID:628
- - C:\Windows\SysWOW64\Netsh.exe
    "C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="bugreport" dir=in program="c:\program files\txgameassistant\appmarket\bugreport.exe" action=allow
    3⤵
    - Modifies Windows Firewall
    PID:2304
- - C:\Windows\SysWOW64\Netsh.exe
    "C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="QQExternal" dir=in program="c:\program files\txgameassistant\appmarket\QQExternal.exe" action=allow
    3⤵
    - Modifies Windows Firewall
    PID:760
- - C:\Windows\SysWOW64\Netsh.exe
    "C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="GameDownload" dir=in program="c:\program files\txgameassistant\appmarket\GameDownload.exe" action=allow
    3⤵
    - Modifies Windows Firewall
    PID:1652
- - C:\Windows\SysWOW64\Netsh.exe
    "C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="TUpdate" dir=in program="c:\program files\txgameassistant\appmarket\GF186\TUpdate.exe" action=allow
    3⤵
    - Modifies Windows Firewall
    PID:4388
- C:\Program Files\TxGameAssistant\AppMarket\AppMarket.exe
  "C:\Program Files\TxGameAssistant\AppMarket\AppMarket.exe" -apksupplyid 1000218456 -from TGBDownloader
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Program Files\TxGameAssistant\AppMarket\wmpf_installer.exe
    wmpf_installer.exe --log-level=0 --product-id=1004 --wmpf-sdk-version=1162 --mojo-platform-channel-handle=1412
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4332
- - C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe
    "C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe" --conf-path="C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.cfg" --daemon --log="C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.log" --rpc-secret=33005b4d525a09e3bc30519e70412f6f
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1304
- - C:\Program Files\TxGameAssistant\AppMarket\cef_frame_render.exe
    "C:\Program Files\TxGameAssistant\AppMarket\cef_frame_render.exe" --type=gpu-process --field-trial-handle=2744,7459613964839933902,13581675502012171265,131072 --disable-features=OutOfBlinkCors --no-sandbox --log-file="C:\Program Files\TxGameAssistant\AppMarket\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36 Tencent AppMarket/3.11.2854.80" --lang=en-US --gpu-preferences=KAAAAAAAAADgAAAgAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:\Program Files\TxGameAssistant\AppMarket\debug.log" --service-request-channel-token=3373949727770753855 --mojo-platform-channel-handle=2764 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:3116
- - C:\Program Files\TxGameAssistant\AppMarket\cef_frame_render.exe
    "C:\Program Files\TxGameAssistant\AppMarket\cef_frame_render.exe" --type=utility --field-trial-handle=2744,7459613964839933902,13581675502012171265,131072 --disable-features=OutOfBlinkCors --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Program Files\TxGameAssistant\AppMarket\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36 Tencent AppMarket/3.11.2854.80" --lang=en-US --log-file="C:\Program Files\TxGameAssistant\AppMarket\debug.log" --service-request-channel-token=17583395878071008954 --mojo-platform-channel-handle=3340 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3896
- - C:\Program Files\TxGameAssistant\AppMarket\cef_frame_render.exe
    "C:\Program Files\TxGameAssistant\AppMarket\cef_frame_render.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --force-device-scale-factor=1.00 --log-file="C:\Program Files\TxGameAssistant\AppMarket\debug.log" --field-trial-handle=2744,7459613964839933902,13581675502012171265,131072 --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files\TxGameAssistant\AppMarket\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36 Tencent AppMarket/3.11.2854.80" --disable-pdf-extension=1 --ppapi-flash-path="PepperFlash\pepflashplayer.dll" --ppapi-flash-version=18.0.0.209 --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=6289244044321190948 --renderer-client-id=4 --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3300
- - C:\Windows\SysWOW64\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:2328
- - C:\Program Files\TxGameAssistant\AppMarket\cef_frame_render.exe
    "C:\Program Files\TxGameAssistant\AppMarket\cef_frame_render.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --force-device-scale-factor=1.00 --log-file="C:\Program Files\TxGameAssistant\AppMarket\debug.log" --field-trial-handle=2744,7459613964839933902,13581675502012171265,131072 --disable-features=OutOfBlinkCors --disable-gpu-compositing --lang=en-US --log-file="C:\Program Files\TxGameAssistant\AppMarket\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36 Tencent AppMarket/3.11.2854.80" --disable-pdf-extension=1 --ppapi-flash-path="PepperFlash\pepflashplayer.dll" --ppapi-flash-version=18.0.0.209 --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=5931813681849133259 --renderer-client-id=5 --mojo-platform-channel-handle=4136 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    PID:2404
- - C:\Program Files\TxGameAssistant\AppMarket\cef_frame_render.exe
    "C:\Program Files\TxGameAssistant\AppMarket\cef_frame_render.exe" --type=gpu-process --field-trial-handle=2744,7459613964839933902,13581675502012171265,131072 --disable-features=OutOfBlinkCors --disable-gpu-sandbox --use-gl=disabled --no-sandbox --log-file="C:\Program Files\TxGameAssistant\AppMarket\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36 Tencent AppMarket/3.11.2854.80" --lang=en-US --gpu-preferences=KAAAAAAAAADoAAAgAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:\Program Files\TxGameAssistant\AppMarket\debug.log" --service-request-channel-token=9934544745049312649 --mojo-platform-channel-handle=4264 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3460
- - C:\Temp\TxGameDownload\Component\UI\9f29e4d23bf81eee0eeccca53d21888a\UI.exe
    "C:\Temp\TxGameDownload\Component\UI\9f29e4d23bf81eee0eeccca53d21888a\UI.exe"
    3⤵
    - Executes dropped EXE
    PID:2240
- - C:\Temp\TxGameDownload\Component\UI\9f29e4d23bf81eee0eeccca53d21888a\Setup\TInst.exe
    "C:\Temp\TxGameDownload\Component\UI\9f29e4d23bf81eee0eeccca53d21888a\Setup\TInst.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Windows\SysWOW64\Netsh.exe
      "C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="AndroidEmulator" dir=in program="c:\program files\txgameassistant\ui\AndroidEmulator.exe" action=allow
      4⤵
      Modifies Windows Firewall
      PID:3728
  - - C:\Windows\SysWOW64\Netsh.exe
      "C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="AndroidEmulatorEx" dir=in program="c:\program files\txgameassistant\ui\AndroidEmulatorEx.exe" action=allow
      4⤵
      Modifies Windows Firewall
      PID:4404
  - - C:\Windows\SysWOW64\Netsh.exe
      "C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="AndroidEmulatorEn" dir=in program="c:\program files\txgameassistant\ui\AndroidEmulatorEn.exe" action=allow
      4⤵
      Modifies Windows Firewall
      PID:4332
  - - C:\Windows\SysWOW64\Netsh.exe
      "C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="adb" dir=in program="c:\program files\txgameassistant\ui\adb.exe" action=allow
      4⤵
      Modifies Windows Firewall
      PID:452
  - - C:\Windows\SysWOW64\Netsh.exe
      "C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="TInst" dir=in program="c:\program files\txgameassistant\ui\TInst.exe" action=allow
      4⤵
      Modifies Windows Firewall
      PID:4952
  - - C:\Windows\SysWOW64\Netsh.exe
      "C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="bugreport" dir=in program="c:\program files\txgameassistant\ui\bugreport.exe" action=allow
      4⤵
      Modifies Windows Firewall
      PID:4840
  - - C:\Windows\SysWOW64\Netsh.exe
      "C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="TxGaDcc" dir=in program="c:\program files\txgameassistant\ui\TxGaDcc.exe" action=allow
      4⤵
      Modifies Windows Firewall
      PID:1196
- - C:\Temp\TxGameDownload\Component\AOW_Rootfs_100\0d3c4084bcff6724f0fddc85a6e2df6c\AOW_Rootfs_100.exe
    "C:\Temp\TxGameDownload\Component\AOW_Rootfs_100\0d3c4084bcff6724f0fddc85a6e2df6c\AOW_Rootfs_100.exe" -vmindex 100
    3⤵
    - Executes dropped EXE
    PID:3160
- - C:\Program Files\TxGameAssistant\AOW_Rootfs_100\TInst.exe
    "C:\Program Files\TxGameAssistant\AOW_Rootfs_100\TInst.exe" -vm 100
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4016
- - C:\Program Files\TxGameAssistant\UI\AndroidEmulatorEn.exe
    "C:\Program Files\TxGameAssistant\UI\AndroidEmulatorEn.exe" -cmd InstallApk -param -i "C:\Temp\TxGameDownload\MobileGamePCShared\com_activision_callofduty_shooter_372f8cd68f0988e515ad3301a09b34b5.apk" -p "com.activision.callofduty.shooter" -ver "1.0.35" -engine "aow" -vm "100" -from AppMarket
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Checks processor information in registry
    - NTFS ADS
    - Suspicious use of AdjustPrivilegeToken
    PID:3900
  - - C:\Program Files\TxGameAssistant\UI\pluginsen\Updater32.exe
      "C:\Program Files\TxGameAssistant\UI\pluginsen\Updater32.exe"
      4⤵
      Executes dropped EXE
      PID:2056
    - - C:\Program Files\TxGameAssistant\UI\pluginsen\TP3Helper.exe
        
        "C:\Program Files\TxGameAssistant\UI\pluginsen\TP3Helper.exe" 10000 3
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4268

C:\Program Files\TxGameAssistant\AppMarket\QMEmulatorService.exe
"C:\Program Files\TxGameAssistant\AppMarket\QMEmulatorService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Market.exe

Filesize
95.6MB

MD5
327dc17a2f9850e896c6e6be44c65bcc

SHA1
260092fe8e6125858956ff21aaca7af51d8cc3ce

SHA256
c0dfd0829ef07aaf549c8b546d041b17544d4b3ba28d530af58dfa01627d1901

SHA512
6f02de464c644ca457555a85e00038d8cc636ffec310f7bcf6bfa8136a9a7280541953100a2495a62f7c17c8b681453cf0de2a5c520319673a28709d17c0e977

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Market.exe

Filesize
95.6MB

MD5
327dc17a2f9850e896c6e6be44c65bcc

SHA1
260092fe8e6125858956ff21aaca7af51d8cc3ce

SHA256
c0dfd0829ef07aaf549c8b546d041b17544d4b3ba28d530af58dfa01627d1901

SHA512
6f02de464c644ca457555a85e00038d8cc636ffec310f7bcf6bfa8136a9a7280541953100a2495a62f7c17c8b681453cf0de2a5c520319673a28709d17c0e977

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\AECommonDll.dll

Filesize
530KB

MD5
76fb3398289368dc9b43e9d33ed614b3

SHA1
cd4869384ce979ae7eb9f526bbd5a72bfe7aa474

SHA256
31cba72e1b554b0e49dea9b0738fb36098b1ad614d87d1b23d8ce484d42854bc

SHA512
34298757c683dcba4c8a4d67ae28cc36398310b1787f45477849025c3f68d4523fd6866b2a1a79145b66b118ac6d210ce73194590534bc5b949ee38b877afa30

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\AowGame.xml

Filesize
233KB

MD5
cfe1caa7108001868a173fd014c401f3

SHA1
42a9e8a397d715db0be4236fa23d3243d6cf92f8

SHA256
9aa6bdd4cc60e1d6ffdde5c76d6ac195254c3186ee3cd817db140871c25e1797

SHA512
17aa6d05d9f7ae2e365198a2f20a93c4df9d2701a9adab51d765728ac7306fa6d6985f34c329cab3cb3dce46d4f185e7c6caad6528000d465bb555e5b27b1432

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\AppMarket\I18N\1025\GFStringBundle.xml

Filesize
4KB

MD5
95fbc628435390e27f0b3e44588efefa

SHA1
0b3ec4ddbeb28e3bdd46e1d860b130317ad981cb

SHA256
173e6a9c3f2433f1df223a88b9b594fd6fc7ca0466979b01c3dac64e943ef508

SHA512
0001887f88a4e058ac547a32604265ed2af16e4b5f48ad371ee20b0711556d068c5fafbc9377946118caa37f76a05c26e625bcd2f8291276725061e6a9ef32d9

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\AppMarket\I18N\1025\StringBundle.xml

Filesize
6KB

MD5
051ccdfaed4a5e7a3f08018f308389d0

SHA1
a2fe00ed6f2d348c781620cb52c6bcaa33fbcc37

SHA256
f02b76bcafc50f26b54562e8fdc6a01bb3091abf50942f834aaebd0187250df0

SHA512
3a0fc59fa37ea884369780585da4fe5d8b9a8b4b81172712bca9f1058cca8848a9f3aa9b15d14beed133b7f5bc8d09dffbb4fef6d178765c70b9d8072be0f600

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\AppMarket\I18N\1028\GFStringBundle.xml

Filesize
4KB

MD5
eb31e11bee249db5b31768048321da79

SHA1
b80990cbb863cf6f37d73c3ffff871502ab11d43

SHA256
43166ec540d7f849f4f275a1e3388012ec6076297626dd1fce64a7832c66ac4e

SHA512
0b9f3586b368637b9dbab39a5c325cf3903d89b0ec05a55223d1f3e240c3785c67779e2481153f8ec4c2c0f34f6083827f9986faefe3b77754df115e51116e12

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\AppMarket\I18N\1028\StringBundle.xml

Filesize
5KB

MD5
60c7b23dff92d4f4c0e33f46321f1b30

SHA1
414b7c5972d6b3f4bb5d3083b512887dc3fc6ccc

SHA256
4a24395569b3a6423896062b7eb4482c72d94ea585be0ab9cbc2aacab2ca34cf

SHA512
5ba5aef84d5bd7ede7bf247efee8addc31563ca181985cb954b00e81a1588ed396bece978e288431100079fa8ad3427a63c67c55918b5538950d01e9f1b7ebd0

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\AppMarket\I18N\1031\GFStringBundle.xml

Filesize
4KB

MD5
94e9c8953d4f752d69bf2959fc000574

SHA1
d702b4d9591fbcb63a1da27b6e7c6300e333f6b2

SHA256
6c4128b96a1ddaa79f15037c78d1b4c764cfae049b25538ab3c158f72ab803c7

SHA512
9aef93a6abc9d4446b5460256abc830821cf1e646bef204d1deae2cb740abbce3304519477cae359608b6eda24f19ebf733d042396fe9001d74ebdd175b6d517

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\AppMarket\I18N\1031\StringBundle.xml

Filesize
6KB

MD5
d2e9d761c1f254b218ba543a22407080

SHA1
4882d462a0e6781fcc2faf448cafc76f74073672

SHA256
d3712ed0f80fe99b25853553295cf08c31b1efc3baa0e0ca8c87ebcb325f2ea1

SHA512
c409ca63ea5539d5a77efd971c9114951f12831ec2b3e41e742d8ed113fdfb930091f593edf58150276d008710f42cdeb8ebfb10c30bfaf61d7d3a1e690b62fd

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\AppMarket\I18N\1033\GFStringBundle.xml

Filesize
3KB

MD5
fc8ce34f4a62b9303302c1bca236af54

SHA1
98e924ac192dcf6d76a5e9db51252ffeec16e183

SHA256
1568009a2e2b87fd2c80bd1238773e11bb096f7db0165c9cb0124a913dc4bbc2

SHA512
8be121cdf463dd207d436abb758a07f89f83ee73127428fc868eff927c9b14afacf6685bb1e27b681c50eff1eee6f417c403aa4513960c5268a471388f40bbd0

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\AppMarket\I18N\1033\StringBundle.xml

Filesize
5KB

MD5
90453f8aa43a7f5e17a86296bb56941d

SHA1
42e40e6f0555bdd1d56c1caa4b5e5a1b5b80bba4

SHA256
42b4ae064d79b8a024eb70641e011979669cac8e406ad8044f47eac11c4cc2cb

SHA512
5c76051c99670af0a9ec4ec6222ca26867a2d9ad29e22401b49c7a2ab422de717114855c35403b00b00f619be6bcf8d0470983c027df49c690839c22fe0b88ad

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\AppMarket\I18N\1034\GFStringBundle.xml

Filesize
3KB

MD5
4998303fa5231e1917ee2137e7db3c1f

SHA1
2c01ceb6f418caaacaf1855ec47b1fc5e0332334

SHA256
620ab83068cd322af0adb2d7ddaec618511d61a6b562039d37aa8ed02b522024

SHA512
92be16a66c3e885d08fc2d882d91f3b636fb25a86fe8856fedde89a1223d03bc348980cde5e6f7916cade941b8c736dca1a4e765b88133cb66a18232fabb5515

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\AppMarket\I18N\1034\StringBundle.xml

Filesize
5KB

MD5
2ff254a0f814f17ea7cde2125f08256e

SHA1
763660feb848d4cfb19f5a0b417cc9e216e3caf6

SHA256
1e33c2cf9e160521a957f3b37da09ff4a9fea91653b9192f9c418330f5a25960

SHA512
587cdaf36fcf490496eddcc398306e96c92c4c110c02e4121ee476b7570e302d1a17793bf6473cf9d55558e90dae83489a27883aa1de00595345e01fba16f781

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\AppMarket\I18N\1041\GFStringBundle.xml

Filesize
4KB

MD5
8c29a2326c6d2d3090cccb379c6f1dd7

SHA1
9069406ba0755938eababdbddb8e5d1f236ef79c

SHA256
490046317f3aa7e73792ad6fde8d6a0ddafc142e066cd5719aff8e84c8de2924

SHA512
3fce2fe04c506bd4d73c008678b0b7cdb88202b6876cf4cef3aad8f0edcf1e4a168bdc84e0a08a520f34f4f85bce992ad3b4b3a81078a4eac811051b31718de0

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\AppMarket\I18N\1041\StringBundle.xml

Filesize
6KB

MD5
407116b275f0c4f31d46c3b9f228c04b

SHA1
3a06b0a890de3c7e8a5e8e2238e327a7cf7420fb

SHA256
6b061d80c2ed56828148833da3464b6ab57a8bb7fcbc70a4737978e356698955

SHA512
72667ef126931c295bca88cf8ff64b1a9856e59c47a6ee1297a5713fc11c92e4e214f101fd0fe0d36f8f78a3f5b121d4844f1b67fe63f3469eabdb3c52851af4

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\AppMarket\common.xml

Filesize
9KB

MD5
c771097a1d490053e97638198f2f02d8

SHA1
f2d060f6e91688425e56e4b4f846f4ba4425f0ba

SHA256
175760389e292e7bbdc8ba697551dee44d9e3727e54df1d50a6bbbb3db6d503c

SHA512
28a70542fa4a2e1d6d434512bf46c92297a96266c40d46e54ce7e00a80bce438165d705e1828385dce434f59360b0e7135134e09da27eb4d72a5bbc7e26fc54d

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\AppMarket\gf-config.xml

Filesize
450B

MD5
f7b1bcf930a68845930ac056877658e1

SHA1
2b97e403cfe29f39f0b908404d293af077c47a3f

SHA256
9ce36b7d7b85d4c1b23b773cf78eb7c688ea3f0abe00a2bdbec30b6f9994b384

SHA512
bc5be9f320607a89d3c84c2c481cf12c046f132cbbcf0753a32aee94d0b3c3ac7f60eb13f21c218487461fb927645f2771d6457abb19ace1266865dc6e1e85f3

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\Config.ini

Filesize
7KB

MD5
ba50063cd1a85f562d5c6a92f28fc062

SHA1
41d01f5bc2c800424277dc39ddfb4a70bdbaf00e

SHA256
1d02987a9b23cb3c11ad6c8123446efcd8e43c0069a616ff09dfc80426a82861

SHA512
2fe0aa3e2b6dd171f25d792991328737a15905d290a3d32c4fbe6bc452976c6cd88e157b98a032f1348e53d26e4eeae9928d430e700849baa95e9c73207079b3

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\TInst.exe

Filesize
658KB

MD5
23a3f179498ac8f4ac76174fcf68776c

SHA1
4571e3414749a917f8876b0ba032b3a5ca23d2aa

SHA256
5f808adcd1298cb73459ef9dfa427a033bc8296b86d2fd017e3e5a85d69759cc

SHA512
ca6f94f75b6fbbb0b5c85fe6aa35ebe864e0a49195972c6c0a141fb52361e5c9f1649a49757cd427efd8f611707a423deb8f66c73e08a6e09a54d85e4fc8297d

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\Tinst.exe

Filesize
658KB

MD5
23a3f179498ac8f4ac76174fcf68776c

SHA1
4571e3414749a917f8876b0ba032b3a5ca23d2aa

SHA256
5f808adcd1298cb73459ef9dfa427a033bc8296b86d2fd017e3e5a85d69759cc

SHA512
ca6f94f75b6fbbb0b5c85fe6aa35ebe864e0a49195972c6c0a141fb52361e5c9f1649a49757cd427efd8f611707a423deb8f66c73e08a6e09a54d85e4fc8297d

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\aowgameex2.dat

Filesize
1KB

MD5
486ba0b209d0378ea43517551fce1c3d

SHA1
a5efa32527ccdc90b34c53aafa7d8f2624ba0ebd

SHA256
da7871fbae900338af75f096f5ad1164a10bfec2c029757eea4300297d603ab4

SHA512
721728ae75669105738cb5c9dbfef25fe7c2443763cc4ca2c4cd9e30d73007846c8280bca6e62cbbc500e1918cacd451169bd9641f209edae06bca80ca40768f

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-console-l1-1-0.dll

Filesize
18KB

MD5
11e55839fcb3a53bdfed2a27fb7d5e80

SHA1
e585a1ed88696cd310c12f91ffa27f17f354b4f4

SHA256
f6bdc8ffd172b44f4d169707d9a457aeef619872661229b8629ee4f15eefff0d

SHA512
bec9419e35de03cc145b3c974833f73f1a5082d886de4739351b93bb4cc6c0234efd0e35ad845faba83fa600c4a7d5343eaae949a837d00d5528e6db79438ee4

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-datetime-l1-1-0.dll

Filesize
18KB

MD5
9f3cf9f22836c32d988d7c7e0a977e1b

SHA1
1e7bbd6175bdb04826e60de07aa496493c9b3a3b

SHA256
7d588a5a958e32875d7bd346d1371e6ebfd9d5d2ede47755942badfc9c74e207

SHA512
16c98e6aec67ffe4558c6d3f881301490be5d8a714c1adc6735005613251adb8e1c2cb9b1c0d2504a9a99c61a06b0e30c944ca603fc00fbb18cd20ba1c9bd697

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-debug-l1-1-0.dll

Filesize
18KB

MD5
64978e199a7239d2c911876447a7f05b

SHA1
0048ce6724db08c64441ce6e573676bc8ae94bf9

SHA256
92b947f1d6236f86ed7e105cff19e23c13d1968861426511b775905e1d26b47a

SHA512
9c64211895473ffc7162b56b0b8e732dec54cf03ea9b9b36fe3cc3339c35fc71fc7173d4e146989db399cb1bcb063079378bb6f778f7d2591cd545550038397c

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
18KB

MD5
9d74d89f2679c0c5ddb35a1ef30bd182

SHA1
22eaed07a6e477a4001f9467b5462cf4cc15cc16

SHA256
e207ffc6fef144e5d393e79de75f8f20d223f1ac33a011eeb822d30fa2031046

SHA512
725626e961d32398ea5aa120ac0339deeb493fc02ee7ef4d8e586173fdbf768b5cbb1f16f093ae4ecfee87e661170f8f832777640a353df5d651af4a62a2d819

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-file-l1-1-0.dll

Filesize
21KB

MD5
d826d27c73d9f2420fb39fbe0745c7f0

SHA1
6e68e239f1a58185c7dad0fcfaac9ecfd2e5726c

SHA256
c0e5d482bd93bf71a73c01d0c1ec0722ea3260eba1f4c87e797bae334b5e9870

SHA512
c49843eb10e4e54c66e0e194dbd29ceab9094bdfe745b6a858cb03e34d73a6326f54804e5e5505deacc87146cbdfba17a0f02e62e76c685bce0cd1ff41962ff4

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
ec4f2cb68dcf7e96516eb284003be8bb

SHA1
fb9237719b5e21b9db176e41bdf125e6e7c01b11

SHA256
3816bbb7dd76d8fc6a7b83a0ed2f61b23dd5fc0843d3308ee077cb725d5c9088

SHA512
6cbda80c476a9fcf46458cac45229c96dc9df251230531e25088e834cd954db9ff4561e744f76495f9c57a4068b7635c72c6f9ff838436c54142297ee310b236

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-file-l1-2-1.dll

Filesize
18KB

MD5
a32230b9bfdb8813e94d095222aafa11

SHA1
04b9d7d2a3f92a0054af2547fb6176385cc9738b

SHA256
7068d2b8aea252294e6b5c3bf3630475d0a91e11877f11a04e8ed1f91196410f

SHA512
6484c7c7fe574d797c74c285353040dfa364b9a9425cbfa4a4c8bba698176656c78e228a33c9eeae39a97caf2ab192f1f02dba472824f8a5757db5f14c76e2b0

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
b9287eb7bcbfdcec2e8d4198fd266509

SHA1
1375b6ff6121ec140668881f4a0b02f0c517f6c7

SHA256
096409422ecd1894e4d6289fd2d1c7490bd83daff0c1e3d16c36c78bd477b895

SHA512
b86348d3f42d0ff465066a14c281088c73ec5e03efacdaabe27a410b054a8a81b438d7e5d030b0d95f53b07783911b8b8200581d4e0b6f1b3cc79f4aae1d67df

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-handle-l1-1-0.dll

Filesize
18KB

MD5
6a35a52d536e34ba060a19d06b1dac80

SHA1
0494a9cbf898e5babb6e697fc2de04a128d2fc35

SHA256
a369ef130749bf8cd9f67055179e6f537f200c060af47493d49473912a95021e

SHA512
a8aeb58bcf4b314212c2ab5a8fd3c2edeb97e680f774171d4a79390aa23bb62a414aef0ecd5286ffb68b7ed8f6e713ff1892d6d4cc2cbb67de916c6062e762d9

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-heap-l1-1-0.dll

Filesize
18KB

MD5
ee5c2fb7bc23bfd06ff32556cc7c3b4d

SHA1
5d60ebf016219bbec340d353a4fa541fff596d3f

SHA256
efc9f0e32bce971900ddf66a1a9e68daa3bfb2099a1ba9f24c6ee82da2cbd6e8

SHA512
5d1b8a130c27d8eb63ca0c836bdf63e76afb311de26ed4f25b073bda843ebfa25e136849e3882822257e3783058f30af818a96764d60821a40329cff4e1badac

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
18KB

MD5
48a5e206d92f3102256ec65e8d570ee0

SHA1
76024fad398dfa4734afce0cc2e5ac117f090ba6

SHA256
a272ae4fc60e511f48950b08f106fcdd3bc86831df908ee78d630f1ae921880c

SHA512
65407da566b571e050c25448be6042e84b0c1c7248422cba00b543af9de425a723b0c7c54c4eb6f534e42b1679a058562d500875ddc4f2b52e6b8e6107b1b575

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
18KB

MD5
e33f52e89dfc376eaf7aa655f260ca76

SHA1
b66e1f934f491544190714966031b6dfd2e349ec

SHA256
0bd03e89a539aaa3100e2f7d9a058964730320e55aee1f85be8fd243eea7017a

SHA512
95cb889599801ba7fa225b633d0fe25fdcc8b495dee5eba05b15a6e53a8a3643b5defe1a881236c40f4fa4365d6775ece067dbb526afdf2015f4d1355c9dfc57

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
dbb81fcc74c59490008ee59bffff5a6d

SHA1
edbb465ab3bea3a4df3f05e5a4e816edbe195c3b

SHA256
f33e6ac5d3e1c4f1d89564fb6aeeac170486c073b67694380755049dbc48eec1

SHA512
2847a73e952bd5f2448264e0bfc8dc1dcd37f8b02d6d6f525ef0cb69c8e634fdcc4637876361b22c53244659039ed305c015435834b61eea15015fed45e9c374

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-memory-l1-1-0.dll

Filesize
18KB

MD5
0ee9e0c830a7534dcfc9be72146796f9

SHA1
cecc860b494135482ae693f8e252301073a98578

SHA256
8f3f0fd765a37f48162f0bd00c3047e79b4eda355223bfcbed4d35b51349cfcc

SHA512
47161e02f4478464ab45c1e3bf9d244d34613e0e68ebe48511a9a0c4e7f8ddb0c1dfd59707c6968c5d76d5027cd19ef748d1235bf74b976410ea6672a6a4bcaf

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
18KB

MD5
1557093add722d1c5a97c359bfcd0d77

SHA1
a8ce995f00a12a81a13d3ef47ce0834178ed69a4

SHA256
3a20635a223e68418c22858413e8c603aac25723de1cb0f54dd675349ec3213d

SHA512
b7acd6882b4d36b52f1e49e4b61ddd025de8503f765b72c94ec5a0d85b6ced513c348f7c4898675728c851a2632ad71c78937cdec9dff994b7b27ed2d85cdddd

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
19KB

MD5
2a61e4e21bf255107884b6520af5bbcc

SHA1
884eb1a835bcde4e7fd98134f0be797229f4239a

SHA256
64742ee0729cbe72555247b0165fae03bea7a6b0147869253dae3bb0072173e8

SHA512
d0ca104904352586bbd3da654125b3df9355fe250938a465e8e900d135cec397f1118fdf54829b076df82b8e45fcd7656c2c7aa33ad3c0af5189f7a55e43f498

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
20KB

MD5
d5c4b8f7260563f72150a84fe884ee31

SHA1
dae1185359ed25a4974504cd1ceaacde28d4318e

SHA256
02839f3b2bdf6adfc89d2f800cc8acda59a40c3e7ce14ef3026f4c72e202297d

SHA512
09ca23413eecf1df94aa36e53fc6fff0f402f21eda2ef79be6aa087818a5bb82ed98db790a2b5cf4ef91a8f70d8e27f56313bc2054a26872d2cad611c472f0b7

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
f61b9ecb79cd20fc2e8fce87286cfe43

SHA1
7a48accbe43e156f886f1f2836f74e1043feec59

SHA256
bfa24f94ba095174b82d3657f8ecc689eab8ff380c69b1c9a7e311eb70d66386

SHA512
42ab62087bbc9fc9c9003ae96ebb9e9bbfa3db4eb74bd6746da035d53d1002015d8482ecb92620ec65c42b8b2b41d9b0a7793e105b0cf8cb6f713a2bc03241db

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-profile-l1-1-0.dll

Filesize
17KB

MD5
a472bd416bdc12668523670360650910

SHA1
831d930ef9917e0dccacd8e7f7fd6f3d90082441

SHA256
48dceeea29558966c391cda34e5755386c2e7e252ea0a03d8d1f21e3cb370c5b

SHA512
166134e6c3403f4437e10afb514a55677481d3b03f7cfdf17917a0bb6fa1f387feae58d7dd5dfbc375eae66d24f10c3163ba5958c22beb6978c0b778c2883b6f

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
17KB

MD5
525a156e0ff61306fd44bf7937cacfae

SHA1
6a9a88317a55c939c0cb9f77256f5c3f961d0562

SHA256
41c69b545d931045a280f83b2f5fbe0ea18c35ac42dfca54b661b42fe8e4f982

SHA512
c99147eba45e9561b7a2802b0c15a2df2ac886ce95a95f2980f8bf4d1dff92a69b94f11cd17383b577303f24295b1b7e52b8c80ad26c0bb08862c726b9cd8841

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-string-l1-1-0.dll

Filesize
18KB

MD5
e57ec98e69961e45cc7a4e0666d26b7d

SHA1
70462a1d68bf49908fcb7186743a47a1affc5d7d

SHA256
52c9b061c4c74eeb70019edde2b690c7e9d9744979a3b718d6687b3a83f00def

SHA512
4a450bcbce0eb3f98f78af07673227a55cdf8e7840fa892196cbb8d0f90551b32731f70f171644f8097fda97d57caa4b7430023671b19881764613231a20cdc9

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-synch-l1-1-0.dll

Filesize
20KB

MD5
99572ae21d1c8afe3d02f1124979e911

SHA1
5b17addc80b1406a3eaa615f5e37d92e953a0bb7

SHA256
e7d39dcb79d739ec030e9a4e2165b264a24c400566056e1fda267fdd1a8b36bd

SHA512
27ca8149d1f0c625de90a3f4cd4a4930ab0c1362ee10a7131ebfd2a88065c2a34c8ad7fb6d95ce33072146b9309488cbfe122984606d631b99d925e3fc42fcff

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
e4110aa5c8a32b63de2c85e0bc297c54

SHA1
6039680f47750cf56d0c9a1768de815a44b83de7

SHA256
01bb32d692b86ebb39a76893125e0f3aaf957c6e4bd682fb46eac32f6fb65be7

SHA512
0631ea8224403ca113dff9b17852e92c1fcb2820e4f335b668b12689d2a8f058ba33905692f2fd0f4897f8f766db816747ec95478d854b75a0803d2c899e6d98

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
19KB

MD5
a13048905fc64cd2103094c871c6d826

SHA1
cebb1a74bd5196a3fe174a20543335074a1b7397

SHA256
fb23439a5982e723e8e4ae1a5a35f9bbbfba1e76feb4596668f57093b231da6b

SHA512
e23effc6c17177d07f43955cc8ffa17ed05cc2c0a6430078b37de8536170dc3cb4f8970eba1049b10a789ab5acb423745f9d842dac4d63d5714751186a3f071d

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
00b548bf3eab7a6debce296ee5e877de

SHA1
ae18022eb78c192ac3baee32664b9eb011194772

SHA256
d592b91a087c001f9ea38dc5912a90c78fad3a368879d04fd7e5650ed374c8dc

SHA512
3ba15d9a0f1680c2b182cf04fbbfcb0d4f1b607519c161c590928930ad1b3eba8bd417575a51305b9552f0abf0064c74267336ec09cea709aed9228e4eac799e

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-core-util-l1-1-0.dll

Filesize
18KB

MD5
96d9965ea02eefeadf1f122dfa724449

SHA1
c6f9eb1babe64b30fb1ff6b74e93db8ac41d1294

SHA256
4f31b2888ca82bd1ff40d71e2d11500456b99940dd469bfb097fcd304676fa38

SHA512
4018eae1e00899a5bd392c9b4f25561cf03292011f52387edd77058f49bd1b7456570f0108338088e5711bf5d6ba33aeb2c7bcd5d24d2744b173ff75bba0347b

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-crt-conio-l1-1-0.dll

Filesize
19KB

MD5
032a139ea3cc41f2bb801cd580759a75

SHA1
4d88e10bcc4e75edc83bca578510d53fc827aa1a

SHA256
905f86530c56c9b453dd8bd9770440de0f6f35aa84b171de747a04d112e35aad

SHA512
4f574dfe92e90c7d6f162c0b69dd56c96031790abe15e52121c7e44980bbab86914ee06fc153fa5f3a77c4f1c6e4c24d7044507880a80b587872477708506a50

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-crt-convert-l1-1-0.dll

Filesize
22KB

MD5
94e386a317faa200aa1dc270ce54e5fd

SHA1
e352ced285c04378bc3f6af4b30fa69df70b8974

SHA256
e4ccd13d5861e3e28984fc7263d79b580a0bc7bbe0d234ed8f1a69706ef908f3

SHA512
f622d303adecdce6ff88acc779d108556c2fdbe1f4140092d2d637c2fc1aaf651c1798291239e1334aabea702d7d380150922abd4e0122cbfc9c079a64dc0e76

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
e8ccecac4f06679b9d5e77333d216ee0

SHA1
377363813d0fc18083bdb0456a66efb6598a763a

SHA256
2cf24c6aac48261ab04eb616e85dd707417697764f860fc29dd3955dd2c49226

SHA512
e37db74e11138639e3bb02270589f977bfd803d450ff098d474ca461fd1fabc8e646a177a2082fd0a901fbe15225c4d352567a561c453f56ad8e0097838b945e

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
42153324a982f848d7a49bb7406125c2

SHA1
f0878690d23ad0c905f0a6ec37e9ea1edb813195

SHA256
fcd8b213e2e9962b84d1eec4296bbefdf4465398a235e118be12c878fdc08c05

SHA512
1710b3fd90210dd6603f2104de249704cad9d83acdc0c6b96ac24e20c4913679b1e4ee41bb7812d919ba76cadb36f7bd8210ee127325fd9db6b542cf2d0b7f69

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-crt-heap-l1-1-0.dll

Filesize
19KB

MD5
aad41d33906cfdb31681ce8276648481

SHA1
6367d1990873c5af2f5d05d31ea083fb8b127883

SHA256
242cb185643df586a5f55735e8810b8d2b6b095c78be206e42cdaae7665bb2cf

SHA512
43b2cf09fcb13211f5bcab6942050e03dfb9ce36b727727f7c764df3754f332f04dc81f411e55caeecfa676c43dd1e977f29b0042c485babaaad609c239a84a9

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
bc75b80a80802146e79c383c94542f06

SHA1
7da2020a855ea6c003d905551a28af456e7519c2

SHA256
81a7a98e11ae94236f34a82a0d450a1100a9b8e752205248de0037a764b91a07

SHA512
0b6a8f6809f1a39c90bfe58ef0d05d997be307cb18771ff8fed6539bf7e19ee8cc3bedc44e1c22f34441db9b82a6470d3814fc7465d1ea82fa30d37278a0fe65

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
1028042a84aefe816280f22a4517dc68

SHA1
b3437beb0e5a6a062678a0b32cea98f3c5e33580

SHA256
4a88f73cae12080b9a637f76f8ab1b8ac29829817ff03ddd611a25b6981ee573

SHA512
1da4a2d152943447950ae5de80360741c8a827647d1568c18b026376645f15cc9b5d1915dbdb43278adeac1423b20d6e1c97f6ad67ce724a0d91ec84c4e5250c

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
26KB

MD5
b7e1023ebbf0e5018c58b5488c03a643

SHA1
b10d3a570d4a44b87480d015aac4d04ef3f0a355

SHA256
e7238f5e38d3991e9d6219255e8cd951d6dd431402c4b4b295a68bd43efa3d48

SHA512
c5536416aeba4b37931e2961a29ea4c8679f6d942289325c9067d46b36797e404c0d8dfd01ce997e89bd42a7f084029d2f2d3cd7485b8cec5e66db50ac1df565

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-crt-private-l1-1-0.dll

Filesize
71KB

MD5
538057da2c6ec8b927904346bb808792

SHA1
1156a3d1a653678b9f85aa64ff65bd3c10510b5e

SHA256
f8720e9250c5d5aace6918e1f67f6105f2cd08c0cf55633d2b6b28032d904e9a

SHA512
228531381ae55e7c1a24cfe36101325cd0b95899f2a125c72e82043f13248236171ad89a497e5b1d6c19a5febb8d2bd38cb43e81fbd753f3088aaee1c1791b7d

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-crt-process-l1-1-0.dll

Filesize
19KB

MD5
4aa747ecc612240d522c23b51a8be7c1

SHA1
b037be0bc321e9329c7cf0dbf609fdb9b2d82fb4

SHA256
ecc116471ccfa09c599d389d71a574ebed01260b9760021a40665c4d8a22257d

SHA512
fb8c0d4f661fe6c8ce6cd04a3c0661a2f0b6058223edbfea811891aedd343d006c22a8524bf8508c2cc396853252477d5cf3c520889650a24d661f4964bce5c9

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
2f10f2255271b09d58af75f58476899c

SHA1
ca37f8e4c99fb178e718e99eed286d1ef32b00fc

SHA256
24bc147f7c8a2dfcbe9296d83ce75a1f2c02076d8f6e6c81f6032c927ed5888a

SHA512
74d85f5a40bd22eb9c85973bda5e596c3688096dc78fb6984f84ded4757ae82d77894c4cae0f24de77d211bbd869f9a4120a104d7c2ed161b4bb7b8568cf5103

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
65fe48962755451a1a5bab26e6fd978d

SHA1
d1322c477fe4ff61eedf9433b8deddee27f5adb9

SHA256
5a3d9a0a2c1f9b14cb52d9cce92b761ec1fe0460ea7d994179c96648455ead84

SHA512
940269af2c3a8b5b43ca936df1bb5338ae5166f04c34a163b5938895d19bdd7eadc156add1b96b5508e06088419a7d8f466f40bf01e64b4c547fbc1b20328ed7

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
a3eccd7f2f2c45d1553055593278645a

SHA1
23cd6aed1b198ca515d7adb213efae780fbf0537

SHA256
d51dfd972e6df5e8185dce0b4eb26dccb0527c5f1c63bc081677335f69b92b67

SHA512
1dbf60f5df95e72b98b72faccb52f83585bc0bc5b1f65c259e8568d812461b738bb37c96e72e2f272370788cc7dcd7a8e5a698d9fb2c773ce0e17978c19ef858

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
c8f1a3b19e5103751202010805bce5c9

SHA1
179cf585ce939d05f9610d4b684e4dda6f452f76

SHA256
d5e2fb8495bbbfb66b2612cd5179c1a5f4746dcdd043ecd474363ffe4a8deb4f

SHA512
879fbe66e5440cbe01bd1814a36345fce6454196c8457969d2ee9e93b749df91d0d95b1da1d368063b7ef2a3ed538449b456eb2c7507a27de60105a0d37dcb71

Download Submit
C:\Temp\TxGameDownload\Component\AppMarket\327dc17a2f9850e896c6e6be44c65bcc\Setup\api-ms-win-crt-utility-l1-1-0.dll

Filesize
18KB

MD5
e0aeba2d9d9ae584d6c1aa0f5929526b

SHA1
3f97b977d8877398d350b373fd441867167bd2ba

SHA256
4eca5b9e5be5750b0bc03fd74b6d5e351cb6d70fd63d5f740a1a122f906390e0

SHA512
cfa02a7afa052c5149a741500063f110462d272af417c33bedeac6ad3af424b181144c8045adc04a44a54dffca4639ae3c135f23d64bcfb66f7d3aa980143799

Download Submit
C:\Users\Admin\AppData\Local\Tencent\TxGameAssistant\TGBDownloader\dr.dll

Filesize
74KB

MD5
2814acbd607ba47bdbcdf6ac3076ee95

SHA1
50ab892071bed2bb2365ca1d4bf5594e71c6b13b

SHA256
5904a7e4d97eeac939662c3638a0e145f64ff3dd0198f895c4bf0337595c6a67

SHA512
34c73014ffc8d38d6dd29f4f84c8f4f9ea971bc131f665f65b277f453504d5efc2d483a792cdea610c5e0544bf3997b132dcdbe37224912c5234c15cdb89d498

Download Submit
memory/3900-259-0x0000000007C80000-0x0000000007CFA000-memory.dmp

Filesize
488KB

Download
memory/3900-254-0x00000000032D0000-0x00000000032F4000-memory.dmp

Filesize
144KB

Download
memory/3900-243-0x0000000036670000-0x0000000036680000-memory.dmp

Filesize
64KB

Download
memory/3900-244-0x0000000003AF0000-0x0000000003BE0000-memory.dmp

Filesize
960KB

Download
memory/3900-249-0x0000000007DA0000-0x0000000007F40000-memory.dmp

Filesize
1.6MB

Download
memory/3900-264-0x0000000007D00000-0x0000000007D63000-memory.dmp

Filesize
396KB

Download
memory/3900-242-0x0000000036670000-0x0000000036680000-memory.dmp

Filesize
64KB

Download
memory/3900-270-0x0000000003370000-0x0000000003398000-memory.dmp

Filesize
160KB

Download
memory/4424-215-0x0000000000C04000-0x0000000000C06000-memory.dmp

Filesize
8KB

Download
memory/4424-213-0x0000000000C04000-0x0000000000C06000-memory.dmp

Filesize
8KB

Download
memory/4424-225-0x0000000000C04000-0x0000000000C06000-memory.dmp

Filesize
8KB

Download
memory/4424-220-0x0000000000C04000-0x0000000000C06000-memory.dmp

Filesize
8KB

Download
memory/4424-217-0x000000006A870000-0x000000006A880000-memory.dmp

Filesize
64KB

Download
memory/4424-211-0x0000000000C02000-0x0000000000C05000-memory.dmp

Filesize
12KB

Download
memory/4424-205-0x0000000000C02000-0x0000000000C05000-memory.dmp

Filesize
12KB

Download
memory/4424-207-0x0000000000C02000-0x0000000000C05000-memory.dmp

Filesize
12KB

Download
memory/4424-209-0x0000000000C02000-0x0000000000C05000-memory.dmp

Filesize
12KB

Download