Analysis

  • max time kernel
    137s
  • max time network
    165s
  • platform
    windows10-1703_x64
  • resource
    win10-20230915-en
  • resource tags

    arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08-10-2023 16:01

General

  • Target

    MeiqiaWinLatest3.1.8.6.exe

  • Size

    80.4MB

  • MD5

    d0cb9b0cd6bceb772f57aa24aa90e75c

  • SHA1

    58b4a1f461341fdb91cdaca868fcf620722fd0e9

  • SHA256

    50bb46b0c0f11fd4e16ad93b7a29b0e424be5a78f9bcee6c71445cfa32e04881

  • SHA512

    fa98061c573a50de7ba7a8a0fdde87b3d49fef4616b3e94f380df2ef14946db82aaf0f09c49120fddbc40f4da4a1b912caec73df7c6fb1c7e5af1aed608f3dd6

  • SSDEEP

    1572864:lh4ex4EsqQaFAGMhx2PZnYCOfr7PlPho+nS0YzI3zgq0y+xwTLY3FEUFkOQ:HtpQaF5M7MxSkT0MI3zgq07eTM3SUFk1

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 11 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MeiqiaWinLatest3.1.8.6.exe
    "C:\Users\Admin\AppData\Local\Temp\MeiqiaWinLatest3.1.8.6.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Program Files (x86)\Meiqia\Meiqia\meiqia.exe
      "C:\Program Files (x86)\Meiqia\Meiqia\meiqia.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5104
      • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe
        "C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1904
        • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe
          "C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\com.meiqia.windows" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1620 --field-trial-handle=1624,i,8617073978499058984,17588370422920550971,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
          4⤵
            PID:3040
          • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe
            "C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\com.meiqia.windows" --mojo-platform-channel-handle=1904 --field-trial-handle=1624,i,8617073978499058984,17588370422920550971,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
            4⤵
              PID:4972
            • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe
              "C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\com.meiqia.windows" --app-user-model-id=美洽 --app-path="C:\Program Files (x86)\Meiqia\Meiqia\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2792 --field-trial-handle=1624,i,8617073978499058984,17588370422920550971,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
              4⤵
                PID:292
            • C:\Program Files (x86)\Meiqia\Meiqia\Meiq.exe
              "C:\Program Files (x86)\Meiqia\Meiqia\Meiq.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:5008

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Meiqia\Meiqia\CrashHandler.dll

          Filesize

          106KB

          MD5

          27e8d8c108d48b106edc7cf40f624877

          SHA1

          1cbdfd5d75ed2e187fdc259733527963c8752f2e

          SHA256

          e150138f8f126a6058ed0cb7a1306d06683eb87fc8072e10c78251e97555d592

          SHA512

          9ec0220138ed102c9ccaba230d30a22e6921ee89dc85414c0faec28a09e6eb052ee8bb205898a156a750f1babbe8fc736e1e7d279b34d31a2ec272aca5767a1d

        • C:\Program Files (x86)\Meiqia\Meiqia\D3DCompiler_47.dll

          Filesize

          4.7MB

          MD5

          2191e768cc2e19009dad20dc999135a3

          SHA1

          f49a46ba0e954e657aaed1c9019a53d194272b6a

          SHA256

          7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

          SHA512

          5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

        • C:\Program Files (x86)\Meiqia\Meiqia\HipsDB.dll

          Filesize

          305KB

          MD5

          e15e4bd0e7732b3e9440582b5704a09c

          SHA1

          6163c0169c394ff356a50ce4826587bc0522c884

          SHA256

          1091980e9093c99be5b7140e080f113aabbfdf55080534831ae0b7739f7fcbbb

          SHA512

          2111eec41de36d37b7bab73c5d112cc4c168133003cf36177f2ca71a2bfe5e8dde0143c6af9106a91996ded600b0b7c66a24afe23d2ae45ce2d4058b0ef6fff5

        • C:\Program Files (x86)\Meiqia\Meiqia\Meiq.exe

          Filesize

          811KB

          MD5

          9714e9832bb0fa60423674c7af1e175c

          SHA1

          bfab7ed6ff6469941ab363ffea1a975c66dd69c5

          SHA256

          15917ba7169f638674466184209fb24f5788957abce57e7d5400d26d077b44dd

          SHA512

          fa0d63df62305f5d01bd49e2e151ab6f9940079f1b30861542b356c2bc8e14b6b55a0c5923cb530b889f9e33364b58c5bd7f80a22cd3a7003fe124e586eb3f7c

        • C:\Program Files (x86)\Meiqia\Meiqia\Meiq.exe

          Filesize

          811KB

          MD5

          9714e9832bb0fa60423674c7af1e175c

          SHA1

          bfab7ed6ff6469941ab363ffea1a975c66dd69c5

          SHA256

          15917ba7169f638674466184209fb24f5788957abce57e7d5400d26d077b44dd

          SHA512

          fa0d63df62305f5d01bd49e2e151ab6f9940079f1b30861542b356c2bc8e14b6b55a0c5923cb530b889f9e33364b58c5bd7f80a22cd3a7003fe124e586eb3f7c

        • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe

          Filesize

          76.6MB

          MD5

          2433897f9911c81fd132b8eeada4df32

          SHA1

          a4091c72d9eee680c5e9764facef95dd8b3998e5

          SHA256

          78284b2f65b2f8271529b6ba435a786e438b13e8cf3268f9fad1e2e9fcc7e526

          SHA512

          3dfc7b540fedcafef41caede0814abed075e8138dd7c93c1f4c26d5b787b1d7ff35bca0892c1d1e9118b893fc8c8777d76952bc95573984f7f4056baf0f72d59

        • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe

          Filesize

          46.8MB

          MD5

          6942e8ef9c5607f21ba202067cb6d38e

          SHA1

          6eda2554a0c59377bd4efb6bdb4111c6ead26ab7

          SHA256

          8f7468f328747f8b0bd08559c70f84731de8898e74cb556b55cd5b901451e0db

          SHA512

          049b131f7957f4c214be37f9145b833e576fd58352f10a1a8c9ed75243d692278a63b26f4d0d9ea07fe416978e1bf5c9cf246b321f9ad7e98169f983534f9181

        • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe

          Filesize

          34.9MB

          MD5

          09bf3fc8d6f1625e9a3b15d270e85881

          SHA1

          f42ef5fea303c18070f2f0b7020f4d2a4536691e

          SHA256

          6ae365055cdf914c81fd4833d53bb0d8767c9937949fbc5bae7c6dbdfcff1110

          SHA512

          4cf4f29ec989bc39f0c28c47d6cf4b9feeb535bd665fcde40d90f89ebbb60b889051d59286e753b9e716259fac9156ac1dae40b2a5b5737950f79e61727beedb

        • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe

          Filesize

          33.9MB

          MD5

          7395cef40998f08e39e6647ea083d7fb

          SHA1

          28534faf5f82646343219afa811672798c353a76

          SHA256

          6cf8202cf8fd3d345056032747e1529c681c37e8cf12a565bfe29afac52b786d

          SHA512

          3176617ff95897108ac9f08ed8fb35f932bb4d8b51edf30ab431fcc3ff5227bba5472b17d0ba5c35d5f6b1865676d198d7f1026c39a35ab962887e796891e969

        • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe

          Filesize

          33.4MB

          MD5

          e4b3654f5e3261e05e532e0c171bd6b4

          SHA1

          3d75b3204e40296c575be34c4b50f1b90fb01857

          SHA256

          8c1e948d468147198ea7e8641600ac9b6c830d5319255cf44c52ed4a356e1697

          SHA512

          b9eb1e503b893147d0e4ddd7b445a42467b827fd6db5b0c3b5af1c8d070be0168ccecce9f2fff168fc98e94443f9db13c3b2111fe9cc434f06ce82e564c17c79

        • C:\Program Files (x86)\Meiqia\Meiqia\behavior.dll

          Filesize

          331KB

          MD5

          1b9d24c87bc25a9b4a5f049eff61831d

          SHA1

          bb36ead6328e0f5e64bafaff6a60a74da10275e5

          SHA256

          bbd952dade3cae9fd1f894ef7fa1d1da03816d8ad11721a5405198af83d6e497

          SHA512

          33b7b4db38a1775ab53916316d3913acc99db3f1737d672f82e3a1bd199a5dcfd11307b5c0b25abea83b6a2a3e43200c12e2f76085e35caba904fcdd345934f8

        • C:\Program Files (x86)\Meiqia\Meiqia\chrome_100_percent.pak

          Filesize

          132KB

          MD5

          443c58245eeb233d319abf7150b99c31

          SHA1

          f889ce6302bd8cfbb68ee9a6d8252e58b63e492d

          SHA256

          99ca6947d97df212e45782bbd5d97bfb42112872e1c42bab4209ceedf66dc760

          SHA512

          081f3ee4a5e40fdc8bb6f16f2cfd47edde2bd8f3b5349775526092a770b090c05308d4289ecdda3d541cf7f0579ac64b529930fd128edad9b0991dfa00b0e9bc

        • C:\Program Files (x86)\Meiqia\Meiqia\chrome_200_percent.pak

          Filesize

          191KB

          MD5

          81b5b74fe16c7c81870f539d5c263397

          SHA1

          27526cc2b68a6d2b539bd75317a20c9c5e43c889

          SHA256

          cb4fd141a5c4d188a3ecb203e9d41a3afca648724160e212289adcac666fbff4

          SHA512

          b2670e2dfa495ccc7874c21d0413cfbebfd4a2f14fc0217e823ec6a16ac1181f8e06bfe7c2d32543167bc3a2e929c7f0af1a5f90182e95913ba2292fa7cadb80

        • C:\Program Files (x86)\Meiqia\Meiqia\ffmpeg.dll

          Filesize

          2.7MB

          MD5

          fe6b711452966d13db36cdee15bb32b9

          SHA1

          9e89a6d8f56dcd0bea0d11131b3e84946764f4c8

          SHA256

          82d427385334978cf701cd7cfb07e1ea9f7078fe716324004320c690ccdeec0f

          SHA512

          8ef68e7a547f92cbb6a8e5b0128d74e2cd0d334e806ea5aab2d2c4c4e78f7c20a2df623d7940cd27720e54be5cca4a16249ad29005c8c015084b9a3a41e2589e

        • C:\Program Files (x86)\Meiqia\Meiqia\hrcomm.dll

          Filesize

          139KB

          MD5

          c7370004ab1d530e589e4d94d7cbe043

          SHA1

          d77fdea2be8c4527287501eac8ac96c4e9b97e27

          SHA256

          dfd1976a012f9a02bb343138a48fbf8640c65731726967c8c2de600438621eea

          SHA512

          f60bb15a0efd32593000cfdfd92fb734029790f99761d12ef5653a2aeeba5890532d8928ddd86927136ae0e5e0bf791ca49c72f19db52e514e5176a9e3d71364

        • C:\Program Files (x86)\Meiqia\Meiqia\icudtl.dat

          Filesize

          10.1MB

          MD5

          2134e5dbc46fb1c46eac0fe1af710ec3

          SHA1

          dbecf2d193ae575aba4217194d4136bd9291d4db

          SHA256

          ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41

          SHA512

          b9b50614d9baebf6378e5164d70be7fe7ef3051cfff38733fe3c7448c5de292754bbbb8da833e26115a185945be419be8dd1030fc230ed69f388479853bc0fcb

        • C:\Program Files (x86)\Meiqia\Meiqia\jansson.dll

          Filesize

          359KB

          MD5

          94140e827a0960e4d5b00e04378526d3

          SHA1

          0ddb9943b4480fc769ebd2357c16dfecad319104

          SHA256

          3808f179810ccf44d4ad770850f132ddd8978017801a8cb6536c3221d74d6e1c

          SHA512

          2acef1e4e435c246f13b9001bfdc83c352fa5ec8ad7e12b93d2b81ee13d3a49229d58f74b97b062cb85d0a6c44da05862da4c71ec4be98b63630a9d8be03a088

        • C:\Program Files (x86)\Meiqia\Meiqia\libcobra.dll

          Filesize

          426KB

          MD5

          c45a0141c517dd1d481f08bb76333a05

          SHA1

          a18255bccee6c98ef6c6d41e93567e4f20c135ef

          SHA256

          f2a1ff120e261e2bc66e5d1f0b74bad865cfc158aae24f35c94bee598e226890

          SHA512

          de7f233ca66cb24c0a9c5690331acfc0f7c1b13a9b411d57fa3ce2f9b4eeeb7733f1eef6890ff9895e95e7d9a560c060be54652e4fddcaf282f016ae6a40f805

        • C:\Program Files (x86)\Meiqia\Meiqia\libcodecs.dll

          Filesize

          1.8MB

          MD5

          22379aca080abf93f58ef661711690a9

          SHA1

          5bb7979e671f8843aeb58f70474f15a545a7bc43

          SHA256

          fdc28be3baf7dcd4760795ba9a3724bd4e4940e1cb123b85e8567efe3be2b0d6

          SHA512

          a188242ed1d2c660167d09dc3bc1532efcb67dfaeb423b179b0f869b8dee79b1daccdadd2a2d502e8d47cf854c561e1c57944e4533c1f5b57223474db3d8893b

        • C:\Program Files (x86)\Meiqia\Meiqia\libegl.dll

          Filesize

          469KB

          MD5

          30a2910b839e4a73a0bc6ea04b494b84

          SHA1

          6e5a9d13667cfa6afe50138a5ff995f88a783b85

          SHA256

          dad11bf5dee241e8b182785b7aa8d0d008c08c394097701f90ea8d5381e70fd6

          SHA512

          c8a5035b2cc1dd6c1514b20be214e7cb03acdcae95208e8119ed5aa08784598e0a90778eddf73710ec2104c5ab04d7b63251679d391c0016fb6bb81388b2e277

        • C:\Program Files (x86)\Meiqia\Meiqia\libglesv2.dll

          Filesize

          7.1MB

          MD5

          cff57a1a15a2c73f156f3598bfaddd55

          SHA1

          13b097e7a1c9dc47419f8fc1f53a86af42a09d7f

          SHA256

          44393afbd99d287f5590007915405888a59cf5872175643f53a03c394b735068

          SHA512

          536caad0dcb416156724284b3b726ee234a0bca3a1abb6fad92f2ec175337466191146da5db55b5cda9f6f489a6d154f2a41998e77521629ff42d30d81d16fb3

        • C:\Program Files (x86)\Meiqia\Meiqia\libxsse.dll

          Filesize

          1.0MB

          MD5

          b1fd79daec18373aaa488b59dd2c178e

          SHA1

          ddb20cec5b29e3345c1c2729741093050c34602d

          SHA256

          49a2c690ce1cd5fc0fa3d09ac36e6afc543a9642da7bce9656f7a63e91b8bf2f

          SHA512

          80989ba49e75a4608d374029b4202d347b31dee7849c31acb7a85908348b1132d343fa955609cb997046d68cb13b12ded53b5f9372ff86332e60ecf43c175264

        • C:\Program Files (x86)\Meiqia\Meiqia\locales\en-US.pak

          Filesize

          351KB

          MD5

          06d28839ea0b3aab4597ba8646a53a96

          SHA1

          9c6a74aae8c783546d613c6f38cbfc8f5e3736f1

          SHA256

          69c1a2e1b30d83612decf1a8dd7b124a04f58e9f2465876726f02f7f7d5eb54a

          SHA512

          a432542dc98795ce0ea6fa4a6bbcbae8ba126f1fda025a9ad6ff3fa67eee85dcf7afc6678f5100bb1543c4d00ac75043ea92e64b65c9ef6bd946ce3dc4d5ae71

        • C:\Program Files (x86)\Meiqia\Meiqia\meiqia.exe

          Filesize

          92KB

          MD5

          ca5c9c54686070fb3a8424a449b2fb73

          SHA1

          2066e4d3039116273b909aed8c2d0ed8364b5490

          SHA256

          2c4581e8919c771a7b40ddcaca1103c3ff7bbeeadff5e3f9a475bc103ac68699

          SHA512

          91e16e749fc345829ec0b4b5af136fd6da6d03256babe36d3d80f92d7ba37be4dfc106c479053047bfd7a41f37491e96bf2c1805e27e0e64e93fe977aff80cef

        • C:\Program Files (x86)\Meiqia\Meiqia\meiqia.exe

          Filesize

          92KB

          MD5

          ca5c9c54686070fb3a8424a449b2fb73

          SHA1

          2066e4d3039116273b909aed8c2d0ed8364b5490

          SHA256

          2c4581e8919c771a7b40ddcaca1103c3ff7bbeeadff5e3f9a475bc103ac68699

          SHA512

          91e16e749fc345829ec0b4b5af136fd6da6d03256babe36d3d80f92d7ba37be4dfc106c479053047bfd7a41f37491e96bf2c1805e27e0e64e93fe977aff80cef

        • C:\Program Files (x86)\Meiqia\Meiqia\meiqia.exe

          Filesize

          92KB

          MD5

          ca5c9c54686070fb3a8424a449b2fb73

          SHA1

          2066e4d3039116273b909aed8c2d0ed8364b5490

          SHA256

          2c4581e8919c771a7b40ddcaca1103c3ff7bbeeadff5e3f9a475bc103ac68699

          SHA512

          91e16e749fc345829ec0b4b5af136fd6da6d03256babe36d3d80f92d7ba37be4dfc106c479053047bfd7a41f37491e96bf2c1805e27e0e64e93fe977aff80cef

        • C:\Program Files (x86)\Meiqia\Meiqia\resources.pak

          Filesize

          4.9MB

          MD5

          b72a7ef97e1e9421f2fc5e95a2236cbd

          SHA1

          3895d403f2326204dae0753684faf7e78a9f7b54

          SHA256

          692e4256fa8a11bbc3a90a52a257e1e99126c4fd9592a34ad45e6f90b0208f9f

          SHA512

          0e7480af4c29875f2f07e8756ff9f1cf98fae6f47a503343afb8463da2fa478c5812e9d7c1f8f3ad80edff3911ee6bbe4f92d8a9b34a3f3e6ea7c10af99a74a3

        • C:\Program Files (x86)\Meiqia\Meiqia\resources\app.asar

          Filesize

          1.7MB

          MD5

          d1cff6c69741f668d2915fa94f442cec

          SHA1

          baf20d1ce4c5e726adfea9e3ae0902f73793164c

          SHA256

          c6ab11978e5ccd59b1d36cfb87ed3ce97f00084bfae028ce81595ec43e5f0050

          SHA512

          88f1f50440069c9b0293922d906b241196a15445967dc9e7bb232163dcf5d27c002cf5836372095388f3182d1c93e03637be21b767d18c85c02fe1f6d33bd4b9

        • C:\Program Files (x86)\Meiqia\Meiqia\scenter.dll

          Filesize

          453KB

          MD5

          3e87729818d4f4c2b2e8a7401fc474f9

          SHA1

          21f3be5a2f782a0e6809ead54f295def6fa10d13

          SHA256

          9be053bb07a54a7df2d160654c6483a9d18728938fa572152c580292c0d66960

          SHA512

          7908a3596432f1707ae471b421199c9fc71bae67016a98235c906907c20558e015ab3955eaca3893255ea30f84a7b432295166e1548d8cb7e8beef8e7bd337cd

        • C:\Program Files (x86)\Meiqia\Meiqia\sqlite.dll

          Filesize

          1.1MB

          MD5

          26c9ce3bdf52015052dc88d9a374fef4

          SHA1

          c1076a7a43ad65a63e8525cfd36c23e6db0fc2c1

          SHA256

          9ed3eb742dd49c6ea048c1e3f9d1364510738a3a9d0f611bb705a0f670a1ef1e

          SHA512

          173217e5ab51bfe6c9ec2d0718cfb8e4555c2f4a9cb9e6318fd4cd93236312d3072dc7eaca118f6cfbd7019dda4d7662de879129d913280e0ae165a8d7a6f30a

        • C:\Program Files (x86)\Meiqia\Meiqia\uactmon.dll

          Filesize

          382KB

          MD5

          dc1a8fff5fd34f40df78a29f5d9a45d4

          SHA1

          ba74b4a01e5f7918c75d604c1a4cad0fbeacdc38

          SHA256

          27b90aa8b9266f305e54d012a83212ad77a7ac5f74b747a78b18db4d30d00a80

          SHA512

          5fc69ddf76d48e605a16465e1bc0aaab035561baa01f539de0c1f863b0e45bea73a6e9fa787443378ab31a841a39aee2ae57440d385959667f9323d6ef0f2870

        • C:\Program Files (x86)\Meiqia\Meiqia\usysdiag.dll

          Filesize

          541KB

          MD5

          1c0dee8882cba2d4afccf2e7adddec27

          SHA1

          8d5c6aaea80b16ca290ace5d910eadae33f2287c

          SHA256

          14ad4b9bf96cd056d796c724522013a0bc8edbbcee71d1171bdeb2a50c0d316a

          SHA512

          3a4bf427239ea9a4af614b81e263f0d1f2541ad11c7e7f26790f0bc2f25e7724920c4711fb74b577eb06908d1cad28f738d53ee87aa491053e7f716fb878d640

        • C:\Program Files (x86)\Meiqia\Meiqia\v8_context_snapshot.bin

          Filesize

          564KB

          MD5

          1006cf9bb21a971a07efe5e0379c137f

          SHA1

          1b0c502a6f99ff9721e8b34bd1298e0aa2a348c0

          SHA256

          d4e45bd5cfcf5a4a50dba4fa3a5d1bcec38b96a84cfd18dd64093356d1e52499

          SHA512

          42cb092cf3954ea118c2dcbece4b5ab8ed25458e663e01c9c18144d53cfde788aff35978dd36990b2bfa5c8c33c88ea6e7ab16d1cec1aff7bf6c726412872fc4

        • C:\Program Files (x86)\Meiqia\Meiqia\vk_swiftshader.dll

          Filesize

          5.0MB

          MD5

          65a2889caaa276af0e68a46450ef4dd7

          SHA1

          2000c6fcdf1b1a24ebf467529e5d11c6cf979418

          SHA256

          415ba8fd3e545a037fca24d5cc74e2cdd3d43d20003635a37877617660ca7366

          SHA512

          b84ce45e123732b90dd5c6b66da202742b81a6e9e0e3d18560c3220bc585fa03fb3d20346767f9d7e424329b97ce871c3e855d56f05bae846cec9b56c895661c

        • C:\Users\Admin\AppData\Local\Temp\$inst\0001.tmp

          Filesize

          8.0MB

          MD5

          ad800eadffcf3c7a2b244cc09abb6ce7

          SHA1

          7be87d3d42dd21ae3e460844a783e91f62a3fe9c

          SHA256

          a441671bd18a2de563780ee52391c9df41828a7a8b24b26187007457366e410d

          SHA512

          b847afd9508bd1921aec59a8815a29ba061dbe1e41128bf19d2fb04c63ec7875e182c8ad5b8583beb5eea993e97fa46cbf0110920ba09c38a8a1b07410da0d3e

        • C:\Users\Admin\AppData\Local\Temp\$inst\0002.tmp

          Filesize

          8.0MB

          MD5

          47fb00d9a25c019719119c913d2788ad

          SHA1

          f5c2091e32a92207b9cb3a1994901c612d3bb898

          SHA256

          6c34463044fa650f42c3f82a3f02baf6838fe377c4c972f503ecd20ee3a0c38e

          SHA512

          b218bc4f3b730bcf82868558f152732b27ddf34523f2bd337b3d75b1d5dccdd6711e47a2309fb5d863f58f6969f2a2bbee82cbc01ffb65edadf3a0223a31f1c9

        • C:\Users\Admin\AppData\Local\Temp\$inst\0008.tmp

          Filesize

          8.0MB

          MD5

          9375515bdcd8a8380e386623e7746fb3

          SHA1

          5c2dc4da94ec99d88884f2e6661ed1ef13de7720

          SHA256

          31a7142295180d35b5bf0ae2ca6b5cceffce4a1e14f7b1b67efb8ae23ffa854a

          SHA512

          428d36d5fe32820b49260d25a881b4fca8b30cec883d2940c462a4724b16c1a125dcdb9952ed5d72c788b57e1cbe6d24e81d6865bd378da0441a0a78cc56cb10

        • C:\Users\Admin\AppData\Local\Temp\$inst\0009.tmp

          Filesize

          8.0MB

          MD5

          10c5bc39aaa8df4e345a659b8331ad6c

          SHA1

          74b9a87564630632037fbadd8c855466e194013d

          SHA256

          17f230b3f357b194ccfc18f7e51c037552c919f15de0f1b972812325b3e7b661

          SHA512

          6fa13796b0aabeb5e28078fcd1d7f59e8b4fa6cf532df69085c76941f15b93c6ab603e96f14d6cec632ca6889716744c523f22c76999cb7117105f14e3a9f82c

        • C:\Users\Admin\AppData\Local\Temp\$inst\0010.tmp

          Filesize

          192KB

          MD5

          0cc446c3806bf36ce37857616e806183

          SHA1

          167937c25acdd99bc225d03e0a620a75c32c3bf4

          SHA256

          83922c662affa538b3aa770d0bd3e0518b1d5fd99abb03c76c8554de242cd34e

          SHA512

          58c7605aa9c122394b0b6e663af08f92dd0c4bf7bb251499113c45f324c08ffa11cc59e8d4bdc071fbb67715aff4941d004062154b8fd622f19f1a5ce0cd44fc

        • C:\Users\Admin\AppData\Roaming\com.meiqia.windows\Session Storage\CURRENT

          Filesize

          16B

          MD5

          46295cac801e5d4857d09837238a6394

          SHA1

          44e0fa1b517dbf802b18faf0785eeea6ac51594b

          SHA256

          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

          SHA512

          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

        • \Program Files (x86)\Meiqia\Meiqia\CrashHandler.dll

          Filesize

          106KB

          MD5

          27e8d8c108d48b106edc7cf40f624877

          SHA1

          1cbdfd5d75ed2e187fdc259733527963c8752f2e

          SHA256

          e150138f8f126a6058ed0cb7a1306d06683eb87fc8072e10c78251e97555d592

          SHA512

          9ec0220138ed102c9ccaba230d30a22e6921ee89dc85414c0faec28a09e6eb052ee8bb205898a156a750f1babbe8fc736e1e7d279b34d31a2ec272aca5767a1d

        • \Program Files (x86)\Meiqia\Meiqia\HipsDB.dll

          Filesize

          305KB

          MD5

          e15e4bd0e7732b3e9440582b5704a09c

          SHA1

          6163c0169c394ff356a50ce4826587bc0522c884

          SHA256

          1091980e9093c99be5b7140e080f113aabbfdf55080534831ae0b7739f7fcbbb

          SHA512

          2111eec41de36d37b7bab73c5d112cc4c168133003cf36177f2ca71a2bfe5e8dde0143c6af9106a91996ded600b0b7c66a24afe23d2ae45ce2d4058b0ef6fff5

        • \Program Files (x86)\Meiqia\Meiqia\behavior.dll

          Filesize

          331KB

          MD5

          1b9d24c87bc25a9b4a5f049eff61831d

          SHA1

          bb36ead6328e0f5e64bafaff6a60a74da10275e5

          SHA256

          bbd952dade3cae9fd1f894ef7fa1d1da03816d8ad11721a5405198af83d6e497

          SHA512

          33b7b4db38a1775ab53916316d3913acc99db3f1737d672f82e3a1bd199a5dcfd11307b5c0b25abea83b6a2a3e43200c12e2f76085e35caba904fcdd345934f8

        • \Program Files (x86)\Meiqia\Meiqia\d3dcompiler_47.dll

          Filesize

          4.7MB

          MD5

          2191e768cc2e19009dad20dc999135a3

          SHA1

          f49a46ba0e954e657aaed1c9019a53d194272b6a

          SHA256

          7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

          SHA512

          5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

        • \Program Files (x86)\Meiqia\Meiqia\ffmpeg.dll

          Filesize

          2.7MB

          MD5

          fe6b711452966d13db36cdee15bb32b9

          SHA1

          9e89a6d8f56dcd0bea0d11131b3e84946764f4c8

          SHA256

          82d427385334978cf701cd7cfb07e1ea9f7078fe716324004320c690ccdeec0f

          SHA512

          8ef68e7a547f92cbb6a8e5b0128d74e2cd0d334e806ea5aab2d2c4c4e78f7c20a2df623d7940cd27720e54be5cca4a16249ad29005c8c015084b9a3a41e2589e

        • \Program Files (x86)\Meiqia\Meiqia\ffmpeg.dll

          Filesize

          2.7MB

          MD5

          fe6b711452966d13db36cdee15bb32b9

          SHA1

          9e89a6d8f56dcd0bea0d11131b3e84946764f4c8

          SHA256

          82d427385334978cf701cd7cfb07e1ea9f7078fe716324004320c690ccdeec0f

          SHA512

          8ef68e7a547f92cbb6a8e5b0128d74e2cd0d334e806ea5aab2d2c4c4e78f7c20a2df623d7940cd27720e54be5cca4a16249ad29005c8c015084b9a3a41e2589e

        • \Program Files (x86)\Meiqia\Meiqia\ffmpeg.dll

          Filesize

          2.7MB

          MD5

          fe6b711452966d13db36cdee15bb32b9

          SHA1

          9e89a6d8f56dcd0bea0d11131b3e84946764f4c8

          SHA256

          82d427385334978cf701cd7cfb07e1ea9f7078fe716324004320c690ccdeec0f

          SHA512

          8ef68e7a547f92cbb6a8e5b0128d74e2cd0d334e806ea5aab2d2c4c4e78f7c20a2df623d7940cd27720e54be5cca4a16249ad29005c8c015084b9a3a41e2589e

        • \Program Files (x86)\Meiqia\Meiqia\ffmpeg.dll

          Filesize

          2.7MB

          MD5

          fe6b711452966d13db36cdee15bb32b9

          SHA1

          9e89a6d8f56dcd0bea0d11131b3e84946764f4c8

          SHA256

          82d427385334978cf701cd7cfb07e1ea9f7078fe716324004320c690ccdeec0f

          SHA512

          8ef68e7a547f92cbb6a8e5b0128d74e2cd0d334e806ea5aab2d2c4c4e78f7c20a2df623d7940cd27720e54be5cca4a16249ad29005c8c015084b9a3a41e2589e

        • \Program Files (x86)\Meiqia\Meiqia\hrcomm.dll

          Filesize

          139KB

          MD5

          c7370004ab1d530e589e4d94d7cbe043

          SHA1

          d77fdea2be8c4527287501eac8ac96c4e9b97e27

          SHA256

          dfd1976a012f9a02bb343138a48fbf8640c65731726967c8c2de600438621eea

          SHA512

          f60bb15a0efd32593000cfdfd92fb734029790f99761d12ef5653a2aeeba5890532d8928ddd86927136ae0e5e0bf791ca49c72f19db52e514e5176a9e3d71364

        • \Program Files (x86)\Meiqia\Meiqia\jansson.dll

          Filesize

          359KB

          MD5

          94140e827a0960e4d5b00e04378526d3

          SHA1

          0ddb9943b4480fc769ebd2357c16dfecad319104

          SHA256

          3808f179810ccf44d4ad770850f132ddd8978017801a8cb6536c3221d74d6e1c

          SHA512

          2acef1e4e435c246f13b9001bfdc83c352fa5ec8ad7e12b93d2b81ee13d3a49229d58f74b97b062cb85d0a6c44da05862da4c71ec4be98b63630a9d8be03a088

        • \Program Files (x86)\Meiqia\Meiqia\libEGL.dll

          Filesize

          469KB

          MD5

          30a2910b839e4a73a0bc6ea04b494b84

          SHA1

          6e5a9d13667cfa6afe50138a5ff995f88a783b85

          SHA256

          dad11bf5dee241e8b182785b7aa8d0d008c08c394097701f90ea8d5381e70fd6

          SHA512

          c8a5035b2cc1dd6c1514b20be214e7cb03acdcae95208e8119ed5aa08784598e0a90778eddf73710ec2104c5ab04d7b63251679d391c0016fb6bb81388b2e277

        • \Program Files (x86)\Meiqia\Meiqia\libGLESv2.dll

          Filesize

          7.1MB

          MD5

          cff57a1a15a2c73f156f3598bfaddd55

          SHA1

          13b097e7a1c9dc47419f8fc1f53a86af42a09d7f

          SHA256

          44393afbd99d287f5590007915405888a59cf5872175643f53a03c394b735068

          SHA512

          536caad0dcb416156724284b3b726ee234a0bca3a1abb6fad92f2ec175337466191146da5db55b5cda9f6f489a6d154f2a41998e77521629ff42d30d81d16fb3

        • \Program Files (x86)\Meiqia\Meiqia\libcobra.dll

          Filesize

          426KB

          MD5

          c45a0141c517dd1d481f08bb76333a05

          SHA1

          a18255bccee6c98ef6c6d41e93567e4f20c135ef

          SHA256

          f2a1ff120e261e2bc66e5d1f0b74bad865cfc158aae24f35c94bee598e226890

          SHA512

          de7f233ca66cb24c0a9c5690331acfc0f7c1b13a9b411d57fa3ce2f9b4eeeb7733f1eef6890ff9895e95e7d9a560c060be54652e4fddcaf282f016ae6a40f805

        • \Program Files (x86)\Meiqia\Meiqia\libcodecs.dll

          Filesize

          1.8MB

          MD5

          22379aca080abf93f58ef661711690a9

          SHA1

          5bb7979e671f8843aeb58f70474f15a545a7bc43

          SHA256

          fdc28be3baf7dcd4760795ba9a3724bd4e4940e1cb123b85e8567efe3be2b0d6

          SHA512

          a188242ed1d2c660167d09dc3bc1532efcb67dfaeb423b179b0f869b8dee79b1daccdadd2a2d502e8d47cf854c561e1c57944e4533c1f5b57223474db3d8893b

        • \Program Files (x86)\Meiqia\Meiqia\libxsse.dll

          Filesize

          1.0MB

          MD5

          b1fd79daec18373aaa488b59dd2c178e

          SHA1

          ddb20cec5b29e3345c1c2729741093050c34602d

          SHA256

          49a2c690ce1cd5fc0fa3d09ac36e6afc543a9642da7bce9656f7a63e91b8bf2f

          SHA512

          80989ba49e75a4608d374029b4202d347b31dee7849c31acb7a85908348b1132d343fa955609cb997046d68cb13b12ded53b5f9372ff86332e60ecf43c175264

        • \Program Files (x86)\Meiqia\Meiqia\scenter.dll

          Filesize

          453KB

          MD5

          3e87729818d4f4c2b2e8a7401fc474f9

          SHA1

          21f3be5a2f782a0e6809ead54f295def6fa10d13

          SHA256

          9be053bb07a54a7df2d160654c6483a9d18728938fa572152c580292c0d66960

          SHA512

          7908a3596432f1707ae471b421199c9fc71bae67016a98235c906907c20558e015ab3955eaca3893255ea30f84a7b432295166e1548d8cb7e8beef8e7bd337cd

        • \Program Files (x86)\Meiqia\Meiqia\sqlite.dll

          Filesize

          1.1MB

          MD5

          26c9ce3bdf52015052dc88d9a374fef4

          SHA1

          c1076a7a43ad65a63e8525cfd36c23e6db0fc2c1

          SHA256

          9ed3eb742dd49c6ea048c1e3f9d1364510738a3a9d0f611bb705a0f670a1ef1e

          SHA512

          173217e5ab51bfe6c9ec2d0718cfb8e4555c2f4a9cb9e6318fd4cd93236312d3072dc7eaca118f6cfbd7019dda4d7662de879129d913280e0ae165a8d7a6f30a

        • \Program Files (x86)\Meiqia\Meiqia\uactmon.dll

          Filesize

          382KB

          MD5

          dc1a8fff5fd34f40df78a29f5d9a45d4

          SHA1

          ba74b4a01e5f7918c75d604c1a4cad0fbeacdc38

          SHA256

          27b90aa8b9266f305e54d012a83212ad77a7ac5f74b747a78b18db4d30d00a80

          SHA512

          5fc69ddf76d48e605a16465e1bc0aaab035561baa01f539de0c1f863b0e45bea73a6e9fa787443378ab31a841a39aee2ae57440d385959667f9323d6ef0f2870

        • \Program Files (x86)\Meiqia\Meiqia\usysdiag.dll

          Filesize

          541KB

          MD5

          1c0dee8882cba2d4afccf2e7adddec27

          SHA1

          8d5c6aaea80b16ca290ace5d910eadae33f2287c

          SHA256

          14ad4b9bf96cd056d796c724522013a0bc8edbbcee71d1171bdeb2a50c0d316a

          SHA512

          3a4bf427239ea9a4af614b81e263f0d1f2541ad11c7e7f26790f0bc2f25e7724920c4711fb74b577eb06908d1cad28f738d53ee87aa491053e7f716fb878d640

        • \Program Files (x86)\Meiqia\Meiqia\vk_swiftshader.dll

          Filesize

          5.0MB

          MD5

          65a2889caaa276af0e68a46450ef4dd7

          SHA1

          2000c6fcdf1b1a24ebf467529e5d11c6cf979418

          SHA256

          415ba8fd3e545a037fca24d5cc74e2cdd3d43d20003635a37877617660ca7366

          SHA512

          b84ce45e123732b90dd5c6b66da202742b81a6e9e0e3d18560c3220bc585fa03fb3d20346767f9d7e424329b97ce871c3e855d56f05bae846cec9b56c895661c

        • memory/292-480-0x00007FFC4F500000-0x00007FFC4F501000-memory.dmp

          Filesize

          4KB

        • memory/292-479-0x00007FFC4F410000-0x00007FFC4F411000-memory.dmp

          Filesize

          4KB

        • memory/292-491-0x00000185CFAC0000-0x00000185CFB6A000-memory.dmp

          Filesize

          680KB

        • memory/2908-403-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

        • memory/2908-374-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

        • memory/2908-11-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

        • memory/2908-362-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

        • memory/2908-156-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

        • memory/5008-412-0x0000000074530000-0x0000000074600000-memory.dmp

          Filesize

          832KB