Analysis

  • max time kernel
    118s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-10-2023 16:01

General

  • Target

    MeiqiaWinLatest3.1.8.6.exe

  • Size

    80.4MB

  • MD5

    d0cb9b0cd6bceb772f57aa24aa90e75c

  • SHA1

    58b4a1f461341fdb91cdaca868fcf620722fd0e9

  • SHA256

    50bb46b0c0f11fd4e16ad93b7a29b0e424be5a78f9bcee6c71445cfa32e04881

  • SHA512

    fa98061c573a50de7ba7a8a0fdde87b3d49fef4616b3e94f380df2ef14946db82aaf0f09c49120fddbc40f4da4a1b912caec73df7c6fb1c7e5af1aed608f3dd6

  • SSDEEP

    1572864:lh4ex4EsqQaFAGMhx2PZnYCOfr7PlPho+nS0YzI3zgq0y+xwTLY3FEUFkOQ:HtpQaF5M7MxSkT0MI3zgq07eTM3SUFk1

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MeiqiaWinLatest3.1.8.6.exe
    "C:\Users\Admin\AppData\Local\Temp\MeiqiaWinLatest3.1.8.6.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\Program Files (x86)\Meiqia\Meiqia\meiqia.exe
      "C:\Program Files (x86)\Meiqia\Meiqia\meiqia.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4152
      • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe
        "C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2660
        • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe
          "C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\com.meiqia.windows" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1704 --field-trial-handle=1708,i,11657416124538870414,18069721900821274629,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
          4⤵
            PID:4980
          • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe
            "C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\com.meiqia.windows" --mojo-platform-channel-handle=2032 --field-trial-handle=1708,i,11657416124538870414,18069721900821274629,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
            4⤵
              PID:3328
            • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe
              "C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\com.meiqia.windows" --app-user-model-id=美洽 --app-path="C:\Program Files (x86)\Meiqia\Meiqia\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2444 --field-trial-handle=1708,i,11657416124538870414,18069721900821274629,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
              4⤵
                PID:4468
              • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe
                "C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\com.meiqia.windows" --app-user-model-id=美洽 --app-path="C:\Program Files (x86)\Meiqia\Meiqia\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3276 --field-trial-handle=1708,i,11657416124538870414,18069721900821274629,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                4⤵
                  PID:1628
                • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe
                  "C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\com.meiqia.windows" --app-user-model-id=美洽 --app-path="C:\Program Files (x86)\Meiqia\Meiqia\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3368 --field-trial-handle=1708,i,11657416124538870414,18069721900821274629,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                  4⤵
                    PID:4340
                  • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe
                    "C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\com.meiqia.windows" --app-user-model-id=美洽 --app-path="C:\Program Files (x86)\Meiqia\Meiqia\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3464 --field-trial-handle=1708,i,11657416124538870414,18069721900821274629,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                    4⤵
                      PID:1492
                    • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe
                      "C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\com.meiqia.windows" --app-user-model-id=美洽 --app-path="C:\Program Files (x86)\Meiqia\Meiqia\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3408 --field-trial-handle=1708,i,11657416124538870414,18069721900821274629,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                      4⤵
                        PID:4124
                    • C:\Program Files (x86)\Meiqia\Meiqia\Meiq.exe
                      "C:\Program Files (x86)\Meiqia\Meiqia\Meiq.exe"
                      3⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:3424

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files (x86)\Meiqia\Meiqia\CrashHandler.dll

                  Filesize

                  106KB

                  MD5

                  27e8d8c108d48b106edc7cf40f624877

                  SHA1

                  1cbdfd5d75ed2e187fdc259733527963c8752f2e

                  SHA256

                  e150138f8f126a6058ed0cb7a1306d06683eb87fc8072e10c78251e97555d592

                  SHA512

                  9ec0220138ed102c9ccaba230d30a22e6921ee89dc85414c0faec28a09e6eb052ee8bb205898a156a750f1babbe8fc736e1e7d279b34d31a2ec272aca5767a1d

                • C:\Program Files (x86)\Meiqia\Meiqia\CrashHandler.dll

                  Filesize

                  106KB

                  MD5

                  27e8d8c108d48b106edc7cf40f624877

                  SHA1

                  1cbdfd5d75ed2e187fdc259733527963c8752f2e

                  SHA256

                  e150138f8f126a6058ed0cb7a1306d06683eb87fc8072e10c78251e97555d592

                  SHA512

                  9ec0220138ed102c9ccaba230d30a22e6921ee89dc85414c0faec28a09e6eb052ee8bb205898a156a750f1babbe8fc736e1e7d279b34d31a2ec272aca5767a1d

                • C:\Program Files (x86)\Meiqia\Meiqia\D3DCompiler_47.dll

                  Filesize

                  4.7MB

                  MD5

                  2191e768cc2e19009dad20dc999135a3

                  SHA1

                  f49a46ba0e954e657aaed1c9019a53d194272b6a

                  SHA256

                  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

                  SHA512

                  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

                • C:\Program Files (x86)\Meiqia\Meiqia\HipsDB.dll

                  Filesize

                  305KB

                  MD5

                  e15e4bd0e7732b3e9440582b5704a09c

                  SHA1

                  6163c0169c394ff356a50ce4826587bc0522c884

                  SHA256

                  1091980e9093c99be5b7140e080f113aabbfdf55080534831ae0b7739f7fcbbb

                  SHA512

                  2111eec41de36d37b7bab73c5d112cc4c168133003cf36177f2ca71a2bfe5e8dde0143c6af9106a91996ded600b0b7c66a24afe23d2ae45ce2d4058b0ef6fff5

                • C:\Program Files (x86)\Meiqia\Meiqia\HipsDB.dll

                  Filesize

                  305KB

                  MD5

                  e15e4bd0e7732b3e9440582b5704a09c

                  SHA1

                  6163c0169c394ff356a50ce4826587bc0522c884

                  SHA256

                  1091980e9093c99be5b7140e080f113aabbfdf55080534831ae0b7739f7fcbbb

                  SHA512

                  2111eec41de36d37b7bab73c5d112cc4c168133003cf36177f2ca71a2bfe5e8dde0143c6af9106a91996ded600b0b7c66a24afe23d2ae45ce2d4058b0ef6fff5

                • C:\Program Files (x86)\Meiqia\Meiqia\Meiq.exe

                  Filesize

                  811KB

                  MD5

                  9714e9832bb0fa60423674c7af1e175c

                  SHA1

                  bfab7ed6ff6469941ab363ffea1a975c66dd69c5

                  SHA256

                  15917ba7169f638674466184209fb24f5788957abce57e7d5400d26d077b44dd

                  SHA512

                  fa0d63df62305f5d01bd49e2e151ab6f9940079f1b30861542b356c2bc8e14b6b55a0c5923cb530b889f9e33364b58c5bd7f80a22cd3a7003fe124e586eb3f7c

                • C:\Program Files (x86)\Meiqia\Meiqia\Meiq.exe

                  Filesize

                  811KB

                  MD5

                  9714e9832bb0fa60423674c7af1e175c

                  SHA1

                  bfab7ed6ff6469941ab363ffea1a975c66dd69c5

                  SHA256

                  15917ba7169f638674466184209fb24f5788957abce57e7d5400d26d077b44dd

                  SHA512

                  fa0d63df62305f5d01bd49e2e151ab6f9940079f1b30861542b356c2bc8e14b6b55a0c5923cb530b889f9e33364b58c5bd7f80a22cd3a7003fe124e586eb3f7c

                • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe

                  Filesize

                  66.6MB

                  MD5

                  dfd75479775512fef27a5b496eeabc7c

                  SHA1

                  2af4d56d5927862aa5ebd594720a8767a2e0cdb2

                  SHA256

                  0bfd22bdd0f920d4f6d65b1e53ac1d9af192fe3c739434ab05efa8509f8fc45c

                  SHA512

                  ed1fd69b59d4899db4f0109fb1f95e34ca9c24cf0d590ffee8d9727e1952257e394fd79841d970b8f78018d41c268dfc2bc1b5f51837b6ae567638547ad37f00

                • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe

                  Filesize

                  57.4MB

                  MD5

                  79d940902e928f40e5b3739ff10963e2

                  SHA1

                  edb1757816cfd67dbe0b95695751ebdb8e6fcb69

                  SHA256

                  4cb234536b11c69829512e9ea8576b02e958c5ae1d3f5b18e39c03bf744a22d4

                  SHA512

                  5696ceeb1b7b4c0c24874a2abcc6b8c3595797a1325c5c0a3b4fddf61c059bd93bd692764cf6e2a76e37bdbcb957fea60f4638a1faaf9a843f270419259dac2f

                • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe

                  Filesize

                  52.8MB

                  MD5

                  dc885162ff134ca97881e3421ab8164c

                  SHA1

                  2d79a38bf45ad7828f864e05adb085b4766a395c

                  SHA256

                  fbccba36088d951b681eeef76ca38ec0269bbd0b3e964756de167c12dcfbbbdc

                  SHA512

                  75cb27b516dbc6570b6323e74599bb63a01eadb601ce03e7cd970ad3c29a81be3fa24734576d59f0159abe4fef9357c7f933b97e7a3641c834dfe9d3c86898de

                • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe

                  Filesize

                  50.7MB

                  MD5

                  e57c683a8f9a9cd7e85414a10a77d4b2

                  SHA1

                  340738da5ccc8a9dc62a54805a562f9507ec6761

                  SHA256

                  73b9369feaf449423d925ed569e79dfc2abb63bb43c97dbd3334b099c463c2f5

                  SHA512

                  135009557285d70da2e8daa8faba6e4aef77a23f8619633571896a9a44485ccd4f2bdb86e40e106025b4867af0874b6ac3bc50545e7ca0c5d19bebf9f38f29b6

                • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe

                  Filesize

                  51.1MB

                  MD5

                  ab05bb9054de3748243d89273df4ab8d

                  SHA1

                  e8bbfb3324cc52a2d9b366a3c40fac057b9b7450

                  SHA256

                  e00e775333b604e2d1b4573f7ce2457d219727273b0968b73e63b0cdb4e78eec

                  SHA512

                  8341da896c6b1f3e08c97494c97d16185fe49bbc5682a8cd943da8c0fdae9b8dbeaf91bf6adb591d41cb7b9643d254818200742c0e346371f642c90a0a954919

                • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe

                  Filesize

                  40.7MB

                  MD5

                  f9b9e1bca5b09480940545966a8184d5

                  SHA1

                  43b0882cfb0cdc95362af8c3c19970d340b9e71f

                  SHA256

                  ce8702cd973c58f33b5e1ee3a63cb554c2f31215e38e828dc8ea9f2731cd71ca

                  SHA512

                  eceff2022feac9808d7f1e6b45718a87a453cc10a44d4b26b52729dda0399197efba8311eb4249b6a72efa071b1dcd228cbf0f7460998c96393a9e1e9bb1a73c

                • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe

                  Filesize

                  41.2MB

                  MD5

                  c7145f4e780044a22415419c084ae035

                  SHA1

                  9c05a929dd356e699c7238c4aeede4daab5f2223

                  SHA256

                  e83eb18fef10018949ee314f24cc1de5d9bc9524a86d473f9cd7dcbf6b423e00

                  SHA512

                  fa05dad61b2a0c6bbfc3bb70fecfb16d4a9c2304c13112a648a41781635fc9868dccaa366b6b9fe92e79eec6d26a4a090629f6aef4c42a9b56fb5221675b2df1

                • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe

                  Filesize

                  16.2MB

                  MD5

                  975974dede1b05bcbc70d72e47bea790

                  SHA1

                  d580bf47bdca8e50e9950bb85504700a16941dd7

                  SHA256

                  fc66f6e4b59d5f76e2e833c3c5f17b5c18dc247aecbb18b142abef6cb9e7e38a

                  SHA512

                  5696f92ae6f5f2ded47c1ec43c33da2084be84ca56365e96ada7cced8a34063f56b200bf49a089726b20aae530af829d2d0f3bcb1e4bc22c5d907fd6273a1910

                • C:\Program Files (x86)\Meiqia\Meiqia\Meiqi.exe

                  Filesize

                  16.1MB

                  MD5

                  321cfad43f88c0f357aaf8106e790df1

                  SHA1

                  e66e6b3e40631bd3bf3745cf6fcc35d12d22e113

                  SHA256

                  6ef3318dc381aefdc00475d021fac48fca08d0844a0c94620a86475b22eac36f

                  SHA512

                  aa4a633f6f0ef5091aa1347cec409866d973c44406455dca0edeb4150057870ed673817a035dc81d2c2fe5125ef0315eeda3e7353795bbec5c18b396689baa4f

                • C:\Program Files (x86)\Meiqia\Meiqia\behavior.dll

                  Filesize

                  331KB

                  MD5

                  1b9d24c87bc25a9b4a5f049eff61831d

                  SHA1

                  bb36ead6328e0f5e64bafaff6a60a74da10275e5

                  SHA256

                  bbd952dade3cae9fd1f894ef7fa1d1da03816d8ad11721a5405198af83d6e497

                  SHA512

                  33b7b4db38a1775ab53916316d3913acc99db3f1737d672f82e3a1bd199a5dcfd11307b5c0b25abea83b6a2a3e43200c12e2f76085e35caba904fcdd345934f8

                • C:\Program Files (x86)\Meiqia\Meiqia\behavior.dll

                  Filesize

                  331KB

                  MD5

                  1b9d24c87bc25a9b4a5f049eff61831d

                  SHA1

                  bb36ead6328e0f5e64bafaff6a60a74da10275e5

                  SHA256

                  bbd952dade3cae9fd1f894ef7fa1d1da03816d8ad11721a5405198af83d6e497

                  SHA512

                  33b7b4db38a1775ab53916316d3913acc99db3f1737d672f82e3a1bd199a5dcfd11307b5c0b25abea83b6a2a3e43200c12e2f76085e35caba904fcdd345934f8

                • C:\Program Files (x86)\Meiqia\Meiqia\chrome_100_percent.pak

                  Filesize

                  132KB

                  MD5

                  443c58245eeb233d319abf7150b99c31

                  SHA1

                  f889ce6302bd8cfbb68ee9a6d8252e58b63e492d

                  SHA256

                  99ca6947d97df212e45782bbd5d97bfb42112872e1c42bab4209ceedf66dc760

                  SHA512

                  081f3ee4a5e40fdc8bb6f16f2cfd47edde2bd8f3b5349775526092a770b090c05308d4289ecdda3d541cf7f0579ac64b529930fd128edad9b0991dfa00b0e9bc

                • C:\Program Files (x86)\Meiqia\Meiqia\chrome_200_percent.pak

                  Filesize

                  191KB

                  MD5

                  81b5b74fe16c7c81870f539d5c263397

                  SHA1

                  27526cc2b68a6d2b539bd75317a20c9c5e43c889

                  SHA256

                  cb4fd141a5c4d188a3ecb203e9d41a3afca648724160e212289adcac666fbff4

                  SHA512

                  b2670e2dfa495ccc7874c21d0413cfbebfd4a2f14fc0217e823ec6a16ac1181f8e06bfe7c2d32543167bc3a2e929c7f0af1a5f90182e95913ba2292fa7cadb80

                • C:\Program Files (x86)\Meiqia\Meiqia\d3dcompiler_47.dll

                  Filesize

                  4.7MB

                  MD5

                  2191e768cc2e19009dad20dc999135a3

                  SHA1

                  f49a46ba0e954e657aaed1c9019a53d194272b6a

                  SHA256

                  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

                  SHA512

                  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

                • C:\Program Files (x86)\Meiqia\Meiqia\ffmpeg.dll

                  Filesize

                  2.7MB

                  MD5

                  fe6b711452966d13db36cdee15bb32b9

                  SHA1

                  9e89a6d8f56dcd0bea0d11131b3e84946764f4c8

                  SHA256

                  82d427385334978cf701cd7cfb07e1ea9f7078fe716324004320c690ccdeec0f

                  SHA512

                  8ef68e7a547f92cbb6a8e5b0128d74e2cd0d334e806ea5aab2d2c4c4e78f7c20a2df623d7940cd27720e54be5cca4a16249ad29005c8c015084b9a3a41e2589e

                • C:\Program Files (x86)\Meiqia\Meiqia\ffmpeg.dll

                  Filesize

                  2.7MB

                  MD5

                  fe6b711452966d13db36cdee15bb32b9

                  SHA1

                  9e89a6d8f56dcd0bea0d11131b3e84946764f4c8

                  SHA256

                  82d427385334978cf701cd7cfb07e1ea9f7078fe716324004320c690ccdeec0f

                  SHA512

                  8ef68e7a547f92cbb6a8e5b0128d74e2cd0d334e806ea5aab2d2c4c4e78f7c20a2df623d7940cd27720e54be5cca4a16249ad29005c8c015084b9a3a41e2589e

                • C:\Program Files (x86)\Meiqia\Meiqia\ffmpeg.dll

                  Filesize

                  2.7MB

                  MD5

                  fe6b711452966d13db36cdee15bb32b9

                  SHA1

                  9e89a6d8f56dcd0bea0d11131b3e84946764f4c8

                  SHA256

                  82d427385334978cf701cd7cfb07e1ea9f7078fe716324004320c690ccdeec0f

                  SHA512

                  8ef68e7a547f92cbb6a8e5b0128d74e2cd0d334e806ea5aab2d2c4c4e78f7c20a2df623d7940cd27720e54be5cca4a16249ad29005c8c015084b9a3a41e2589e

                • C:\Program Files (x86)\Meiqia\Meiqia\ffmpeg.dll

                  Filesize

                  2.7MB

                  MD5

                  fe6b711452966d13db36cdee15bb32b9

                  SHA1

                  9e89a6d8f56dcd0bea0d11131b3e84946764f4c8

                  SHA256

                  82d427385334978cf701cd7cfb07e1ea9f7078fe716324004320c690ccdeec0f

                  SHA512

                  8ef68e7a547f92cbb6a8e5b0128d74e2cd0d334e806ea5aab2d2c4c4e78f7c20a2df623d7940cd27720e54be5cca4a16249ad29005c8c015084b9a3a41e2589e

                • C:\Program Files (x86)\Meiqia\Meiqia\ffmpeg.dll

                  Filesize

                  2.7MB

                  MD5

                  fe6b711452966d13db36cdee15bb32b9

                  SHA1

                  9e89a6d8f56dcd0bea0d11131b3e84946764f4c8

                  SHA256

                  82d427385334978cf701cd7cfb07e1ea9f7078fe716324004320c690ccdeec0f

                  SHA512

                  8ef68e7a547f92cbb6a8e5b0128d74e2cd0d334e806ea5aab2d2c4c4e78f7c20a2df623d7940cd27720e54be5cca4a16249ad29005c8c015084b9a3a41e2589e

                • C:\Program Files (x86)\Meiqia\Meiqia\ffmpeg.dll

                  Filesize

                  2.7MB

                  MD5

                  fe6b711452966d13db36cdee15bb32b9

                  SHA1

                  9e89a6d8f56dcd0bea0d11131b3e84946764f4c8

                  SHA256

                  82d427385334978cf701cd7cfb07e1ea9f7078fe716324004320c690ccdeec0f

                  SHA512

                  8ef68e7a547f92cbb6a8e5b0128d74e2cd0d334e806ea5aab2d2c4c4e78f7c20a2df623d7940cd27720e54be5cca4a16249ad29005c8c015084b9a3a41e2589e

                • C:\Program Files (x86)\Meiqia\Meiqia\ffmpeg.dll

                  Filesize

                  2.7MB

                  MD5

                  fe6b711452966d13db36cdee15bb32b9

                  SHA1

                  9e89a6d8f56dcd0bea0d11131b3e84946764f4c8

                  SHA256

                  82d427385334978cf701cd7cfb07e1ea9f7078fe716324004320c690ccdeec0f

                  SHA512

                  8ef68e7a547f92cbb6a8e5b0128d74e2cd0d334e806ea5aab2d2c4c4e78f7c20a2df623d7940cd27720e54be5cca4a16249ad29005c8c015084b9a3a41e2589e

                • C:\Program Files (x86)\Meiqia\Meiqia\ffmpeg.dll

                  Filesize

                  2.7MB

                  MD5

                  fe6b711452966d13db36cdee15bb32b9

                  SHA1

                  9e89a6d8f56dcd0bea0d11131b3e84946764f4c8

                  SHA256

                  82d427385334978cf701cd7cfb07e1ea9f7078fe716324004320c690ccdeec0f

                  SHA512

                  8ef68e7a547f92cbb6a8e5b0128d74e2cd0d334e806ea5aab2d2c4c4e78f7c20a2df623d7940cd27720e54be5cca4a16249ad29005c8c015084b9a3a41e2589e

                • C:\Program Files (x86)\Meiqia\Meiqia\ffmpeg.dll

                  Filesize

                  2.7MB

                  MD5

                  fe6b711452966d13db36cdee15bb32b9

                  SHA1

                  9e89a6d8f56dcd0bea0d11131b3e84946764f4c8

                  SHA256

                  82d427385334978cf701cd7cfb07e1ea9f7078fe716324004320c690ccdeec0f

                  SHA512

                  8ef68e7a547f92cbb6a8e5b0128d74e2cd0d334e806ea5aab2d2c4c4e78f7c20a2df623d7940cd27720e54be5cca4a16249ad29005c8c015084b9a3a41e2589e

                • C:\Program Files (x86)\Meiqia\Meiqia\hrcomm.dll

                  Filesize

                  139KB

                  MD5

                  c7370004ab1d530e589e4d94d7cbe043

                  SHA1

                  d77fdea2be8c4527287501eac8ac96c4e9b97e27

                  SHA256

                  dfd1976a012f9a02bb343138a48fbf8640c65731726967c8c2de600438621eea

                  SHA512

                  f60bb15a0efd32593000cfdfd92fb734029790f99761d12ef5653a2aeeba5890532d8928ddd86927136ae0e5e0bf791ca49c72f19db52e514e5176a9e3d71364

                • C:\Program Files (x86)\Meiqia\Meiqia\hrcomm.dll

                  Filesize

                  139KB

                  MD5

                  c7370004ab1d530e589e4d94d7cbe043

                  SHA1

                  d77fdea2be8c4527287501eac8ac96c4e9b97e27

                  SHA256

                  dfd1976a012f9a02bb343138a48fbf8640c65731726967c8c2de600438621eea

                  SHA512

                  f60bb15a0efd32593000cfdfd92fb734029790f99761d12ef5653a2aeeba5890532d8928ddd86927136ae0e5e0bf791ca49c72f19db52e514e5176a9e3d71364

                • C:\Program Files (x86)\Meiqia\Meiqia\icudtl.dat

                  Filesize

                  10.1MB

                  MD5

                  2134e5dbc46fb1c46eac0fe1af710ec3

                  SHA1

                  dbecf2d193ae575aba4217194d4136bd9291d4db

                  SHA256

                  ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41

                  SHA512

                  b9b50614d9baebf6378e5164d70be7fe7ef3051cfff38733fe3c7448c5de292754bbbb8da833e26115a185945be419be8dd1030fc230ed69f388479853bc0fcb

                • C:\Program Files (x86)\Meiqia\Meiqia\jansson.dll

                  Filesize

                  359KB

                  MD5

                  94140e827a0960e4d5b00e04378526d3

                  SHA1

                  0ddb9943b4480fc769ebd2357c16dfecad319104

                  SHA256

                  3808f179810ccf44d4ad770850f132ddd8978017801a8cb6536c3221d74d6e1c

                  SHA512

                  2acef1e4e435c246f13b9001bfdc83c352fa5ec8ad7e12b93d2b81ee13d3a49229d58f74b97b062cb85d0a6c44da05862da4c71ec4be98b63630a9d8be03a088

                • C:\Program Files (x86)\Meiqia\Meiqia\jansson.dll

                  Filesize

                  359KB

                  MD5

                  94140e827a0960e4d5b00e04378526d3

                  SHA1

                  0ddb9943b4480fc769ebd2357c16dfecad319104

                  SHA256

                  3808f179810ccf44d4ad770850f132ddd8978017801a8cb6536c3221d74d6e1c

                  SHA512

                  2acef1e4e435c246f13b9001bfdc83c352fa5ec8ad7e12b93d2b81ee13d3a49229d58f74b97b062cb85d0a6c44da05862da4c71ec4be98b63630a9d8be03a088

                • C:\Program Files (x86)\Meiqia\Meiqia\libEGL.dll

                  Filesize

                  469KB

                  MD5

                  30a2910b839e4a73a0bc6ea04b494b84

                  SHA1

                  6e5a9d13667cfa6afe50138a5ff995f88a783b85

                  SHA256

                  dad11bf5dee241e8b182785b7aa8d0d008c08c394097701f90ea8d5381e70fd6

                  SHA512

                  c8a5035b2cc1dd6c1514b20be214e7cb03acdcae95208e8119ed5aa08784598e0a90778eddf73710ec2104c5ab04d7b63251679d391c0016fb6bb81388b2e277

                • C:\Program Files (x86)\Meiqia\Meiqia\libGLESv2.dll

                  Filesize

                  7.1MB

                  MD5

                  cff57a1a15a2c73f156f3598bfaddd55

                  SHA1

                  13b097e7a1c9dc47419f8fc1f53a86af42a09d7f

                  SHA256

                  44393afbd99d287f5590007915405888a59cf5872175643f53a03c394b735068

                  SHA512

                  536caad0dcb416156724284b3b726ee234a0bca3a1abb6fad92f2ec175337466191146da5db55b5cda9f6f489a6d154f2a41998e77521629ff42d30d81d16fb3

                • C:\Program Files (x86)\Meiqia\Meiqia\libcobra.dll

                  Filesize

                  426KB

                  MD5

                  c45a0141c517dd1d481f08bb76333a05

                  SHA1

                  a18255bccee6c98ef6c6d41e93567e4f20c135ef

                  SHA256

                  f2a1ff120e261e2bc66e5d1f0b74bad865cfc158aae24f35c94bee598e226890

                  SHA512

                  de7f233ca66cb24c0a9c5690331acfc0f7c1b13a9b411d57fa3ce2f9b4eeeb7733f1eef6890ff9895e95e7d9a560c060be54652e4fddcaf282f016ae6a40f805

                • C:\Program Files (x86)\Meiqia\Meiqia\libcobra.dll

                  Filesize

                  426KB

                  MD5

                  c45a0141c517dd1d481f08bb76333a05

                  SHA1

                  a18255bccee6c98ef6c6d41e93567e4f20c135ef

                  SHA256

                  f2a1ff120e261e2bc66e5d1f0b74bad865cfc158aae24f35c94bee598e226890

                  SHA512

                  de7f233ca66cb24c0a9c5690331acfc0f7c1b13a9b411d57fa3ce2f9b4eeeb7733f1eef6890ff9895e95e7d9a560c060be54652e4fddcaf282f016ae6a40f805

                • C:\Program Files (x86)\Meiqia\Meiqia\libcodecs.dll

                  Filesize

                  1.8MB

                  MD5

                  22379aca080abf93f58ef661711690a9

                  SHA1

                  5bb7979e671f8843aeb58f70474f15a545a7bc43

                  SHA256

                  fdc28be3baf7dcd4760795ba9a3724bd4e4940e1cb123b85e8567efe3be2b0d6

                  SHA512

                  a188242ed1d2c660167d09dc3bc1532efcb67dfaeb423b179b0f869b8dee79b1daccdadd2a2d502e8d47cf854c561e1c57944e4533c1f5b57223474db3d8893b

                • C:\Program Files (x86)\Meiqia\Meiqia\libcodecs.dll

                  Filesize

                  1.8MB

                  MD5

                  22379aca080abf93f58ef661711690a9

                  SHA1

                  5bb7979e671f8843aeb58f70474f15a545a7bc43

                  SHA256

                  fdc28be3baf7dcd4760795ba9a3724bd4e4940e1cb123b85e8567efe3be2b0d6

                  SHA512

                  a188242ed1d2c660167d09dc3bc1532efcb67dfaeb423b179b0f869b8dee79b1daccdadd2a2d502e8d47cf854c561e1c57944e4533c1f5b57223474db3d8893b

                • C:\Program Files (x86)\Meiqia\Meiqia\libegl.dll

                  Filesize

                  469KB

                  MD5

                  30a2910b839e4a73a0bc6ea04b494b84

                  SHA1

                  6e5a9d13667cfa6afe50138a5ff995f88a783b85

                  SHA256

                  dad11bf5dee241e8b182785b7aa8d0d008c08c394097701f90ea8d5381e70fd6

                  SHA512

                  c8a5035b2cc1dd6c1514b20be214e7cb03acdcae95208e8119ed5aa08784598e0a90778eddf73710ec2104c5ab04d7b63251679d391c0016fb6bb81388b2e277

                • C:\Program Files (x86)\Meiqia\Meiqia\libglesv2.dll

                  Filesize

                  7.1MB

                  MD5

                  cff57a1a15a2c73f156f3598bfaddd55

                  SHA1

                  13b097e7a1c9dc47419f8fc1f53a86af42a09d7f

                  SHA256

                  44393afbd99d287f5590007915405888a59cf5872175643f53a03c394b735068

                  SHA512

                  536caad0dcb416156724284b3b726ee234a0bca3a1abb6fad92f2ec175337466191146da5db55b5cda9f6f489a6d154f2a41998e77521629ff42d30d81d16fb3

                • C:\Program Files (x86)\Meiqia\Meiqia\libxsse.dll

                  Filesize

                  1.0MB

                  MD5

                  b1fd79daec18373aaa488b59dd2c178e

                  SHA1

                  ddb20cec5b29e3345c1c2729741093050c34602d

                  SHA256

                  49a2c690ce1cd5fc0fa3d09ac36e6afc543a9642da7bce9656f7a63e91b8bf2f

                  SHA512

                  80989ba49e75a4608d374029b4202d347b31dee7849c31acb7a85908348b1132d343fa955609cb997046d68cb13b12ded53b5f9372ff86332e60ecf43c175264

                • C:\Program Files (x86)\Meiqia\Meiqia\libxsse.dll

                  Filesize

                  1.0MB

                  MD5

                  b1fd79daec18373aaa488b59dd2c178e

                  SHA1

                  ddb20cec5b29e3345c1c2729741093050c34602d

                  SHA256

                  49a2c690ce1cd5fc0fa3d09ac36e6afc543a9642da7bce9656f7a63e91b8bf2f

                  SHA512

                  80989ba49e75a4608d374029b4202d347b31dee7849c31acb7a85908348b1132d343fa955609cb997046d68cb13b12ded53b5f9372ff86332e60ecf43c175264

                • C:\Program Files (x86)\Meiqia\Meiqia\locales\en-US.pak

                  Filesize

                  351KB

                  MD5

                  06d28839ea0b3aab4597ba8646a53a96

                  SHA1

                  9c6a74aae8c783546d613c6f38cbfc8f5e3736f1

                  SHA256

                  69c1a2e1b30d83612decf1a8dd7b124a04f58e9f2465876726f02f7f7d5eb54a

                  SHA512

                  a432542dc98795ce0ea6fa4a6bbcbae8ba126f1fda025a9ad6ff3fa67eee85dcf7afc6678f5100bb1543c4d00ac75043ea92e64b65c9ef6bd946ce3dc4d5ae71

                • C:\Program Files (x86)\Meiqia\Meiqia\meiqia.exe

                  Filesize

                  92KB

                  MD5

                  ca5c9c54686070fb3a8424a449b2fb73

                  SHA1

                  2066e4d3039116273b909aed8c2d0ed8364b5490

                  SHA256

                  2c4581e8919c771a7b40ddcaca1103c3ff7bbeeadff5e3f9a475bc103ac68699

                  SHA512

                  91e16e749fc345829ec0b4b5af136fd6da6d03256babe36d3d80f92d7ba37be4dfc106c479053047bfd7a41f37491e96bf2c1805e27e0e64e93fe977aff80cef

                • C:\Program Files (x86)\Meiqia\Meiqia\meiqia.exe

                  Filesize

                  92KB

                  MD5

                  ca5c9c54686070fb3a8424a449b2fb73

                  SHA1

                  2066e4d3039116273b909aed8c2d0ed8364b5490

                  SHA256

                  2c4581e8919c771a7b40ddcaca1103c3ff7bbeeadff5e3f9a475bc103ac68699

                  SHA512

                  91e16e749fc345829ec0b4b5af136fd6da6d03256babe36d3d80f92d7ba37be4dfc106c479053047bfd7a41f37491e96bf2c1805e27e0e64e93fe977aff80cef

                • C:\Program Files (x86)\Meiqia\Meiqia\meiqia.exe

                  Filesize

                  92KB

                  MD5

                  ca5c9c54686070fb3a8424a449b2fb73

                  SHA1

                  2066e4d3039116273b909aed8c2d0ed8364b5490

                  SHA256

                  2c4581e8919c771a7b40ddcaca1103c3ff7bbeeadff5e3f9a475bc103ac68699

                  SHA512

                  91e16e749fc345829ec0b4b5af136fd6da6d03256babe36d3d80f92d7ba37be4dfc106c479053047bfd7a41f37491e96bf2c1805e27e0e64e93fe977aff80cef

                • C:\Program Files (x86)\Meiqia\Meiqia\resources.pak

                  Filesize

                  4.9MB

                  MD5

                  b72a7ef97e1e9421f2fc5e95a2236cbd

                  SHA1

                  3895d403f2326204dae0753684faf7e78a9f7b54

                  SHA256

                  692e4256fa8a11bbc3a90a52a257e1e99126c4fd9592a34ad45e6f90b0208f9f

                  SHA512

                  0e7480af4c29875f2f07e8756ff9f1cf98fae6f47a503343afb8463da2fa478c5812e9d7c1f8f3ad80edff3911ee6bbe4f92d8a9b34a3f3e6ea7c10af99a74a3

                • C:\Program Files (x86)\Meiqia\Meiqia\resources\app.asar

                  Filesize

                  1.7MB

                  MD5

                  d1cff6c69741f668d2915fa94f442cec

                  SHA1

                  baf20d1ce4c5e726adfea9e3ae0902f73793164c

                  SHA256

                  c6ab11978e5ccd59b1d36cfb87ed3ce97f00084bfae028ce81595ec43e5f0050

                  SHA512

                  88f1f50440069c9b0293922d906b241196a15445967dc9e7bb232163dcf5d27c002cf5836372095388f3182d1c93e03637be21b767d18c85c02fe1f6d33bd4b9

                • C:\Program Files (x86)\Meiqia\Meiqia\scenter.dll

                  Filesize

                  453KB

                  MD5

                  3e87729818d4f4c2b2e8a7401fc474f9

                  SHA1

                  21f3be5a2f782a0e6809ead54f295def6fa10d13

                  SHA256

                  9be053bb07a54a7df2d160654c6483a9d18728938fa572152c580292c0d66960

                  SHA512

                  7908a3596432f1707ae471b421199c9fc71bae67016a98235c906907c20558e015ab3955eaca3893255ea30f84a7b432295166e1548d8cb7e8beef8e7bd337cd

                • C:\Program Files (x86)\Meiqia\Meiqia\scenter.dll

                  Filesize

                  453KB

                  MD5

                  3e87729818d4f4c2b2e8a7401fc474f9

                  SHA1

                  21f3be5a2f782a0e6809ead54f295def6fa10d13

                  SHA256

                  9be053bb07a54a7df2d160654c6483a9d18728938fa572152c580292c0d66960

                  SHA512

                  7908a3596432f1707ae471b421199c9fc71bae67016a98235c906907c20558e015ab3955eaca3893255ea30f84a7b432295166e1548d8cb7e8beef8e7bd337cd

                • C:\Program Files (x86)\Meiqia\Meiqia\sqlite.dll

                  Filesize

                  1.1MB

                  MD5

                  26c9ce3bdf52015052dc88d9a374fef4

                  SHA1

                  c1076a7a43ad65a63e8525cfd36c23e6db0fc2c1

                  SHA256

                  9ed3eb742dd49c6ea048c1e3f9d1364510738a3a9d0f611bb705a0f670a1ef1e

                  SHA512

                  173217e5ab51bfe6c9ec2d0718cfb8e4555c2f4a9cb9e6318fd4cd93236312d3072dc7eaca118f6cfbd7019dda4d7662de879129d913280e0ae165a8d7a6f30a

                • C:\Program Files (x86)\Meiqia\Meiqia\sqlite.dll

                  Filesize

                  1.1MB

                  MD5

                  26c9ce3bdf52015052dc88d9a374fef4

                  SHA1

                  c1076a7a43ad65a63e8525cfd36c23e6db0fc2c1

                  SHA256

                  9ed3eb742dd49c6ea048c1e3f9d1364510738a3a9d0f611bb705a0f670a1ef1e

                  SHA512

                  173217e5ab51bfe6c9ec2d0718cfb8e4555c2f4a9cb9e6318fd4cd93236312d3072dc7eaca118f6cfbd7019dda4d7662de879129d913280e0ae165a8d7a6f30a

                • C:\Program Files (x86)\Meiqia\Meiqia\uactmon.dll

                  Filesize

                  382KB

                  MD5

                  dc1a8fff5fd34f40df78a29f5d9a45d4

                  SHA1

                  ba74b4a01e5f7918c75d604c1a4cad0fbeacdc38

                  SHA256

                  27b90aa8b9266f305e54d012a83212ad77a7ac5f74b747a78b18db4d30d00a80

                  SHA512

                  5fc69ddf76d48e605a16465e1bc0aaab035561baa01f539de0c1f863b0e45bea73a6e9fa787443378ab31a841a39aee2ae57440d385959667f9323d6ef0f2870

                • C:\Program Files (x86)\Meiqia\Meiqia\uactmon.dll

                  Filesize

                  382KB

                  MD5

                  dc1a8fff5fd34f40df78a29f5d9a45d4

                  SHA1

                  ba74b4a01e5f7918c75d604c1a4cad0fbeacdc38

                  SHA256

                  27b90aa8b9266f305e54d012a83212ad77a7ac5f74b747a78b18db4d30d00a80

                  SHA512

                  5fc69ddf76d48e605a16465e1bc0aaab035561baa01f539de0c1f863b0e45bea73a6e9fa787443378ab31a841a39aee2ae57440d385959667f9323d6ef0f2870

                • C:\Program Files (x86)\Meiqia\Meiqia\usysdiag.dll

                  Filesize

                  541KB

                  MD5

                  1c0dee8882cba2d4afccf2e7adddec27

                  SHA1

                  8d5c6aaea80b16ca290ace5d910eadae33f2287c

                  SHA256

                  14ad4b9bf96cd056d796c724522013a0bc8edbbcee71d1171bdeb2a50c0d316a

                  SHA512

                  3a4bf427239ea9a4af614b81e263f0d1f2541ad11c7e7f26790f0bc2f25e7724920c4711fb74b577eb06908d1cad28f738d53ee87aa491053e7f716fb878d640

                • C:\Program Files (x86)\Meiqia\Meiqia\usysdiag.dll

                  Filesize

                  541KB

                  MD5

                  1c0dee8882cba2d4afccf2e7adddec27

                  SHA1

                  8d5c6aaea80b16ca290ace5d910eadae33f2287c

                  SHA256

                  14ad4b9bf96cd056d796c724522013a0bc8edbbcee71d1171bdeb2a50c0d316a

                  SHA512

                  3a4bf427239ea9a4af614b81e263f0d1f2541ad11c7e7f26790f0bc2f25e7724920c4711fb74b577eb06908d1cad28f738d53ee87aa491053e7f716fb878d640

                • C:\Program Files (x86)\Meiqia\Meiqia\v8_context_snapshot.bin

                  Filesize

                  564KB

                  MD5

                  1006cf9bb21a971a07efe5e0379c137f

                  SHA1

                  1b0c502a6f99ff9721e8b34bd1298e0aa2a348c0

                  SHA256

                  d4e45bd5cfcf5a4a50dba4fa3a5d1bcec38b96a84cfd18dd64093356d1e52499

                  SHA512

                  42cb092cf3954ea118c2dcbece4b5ab8ed25458e663e01c9c18144d53cfde788aff35978dd36990b2bfa5c8c33c88ea6e7ab16d1cec1aff7bf6c726412872fc4

                • C:\Program Files (x86)\Meiqia\Meiqia\vk_swiftshader.dll

                  Filesize

                  5.0MB

                  MD5

                  65a2889caaa276af0e68a46450ef4dd7

                  SHA1

                  2000c6fcdf1b1a24ebf467529e5d11c6cf979418

                  SHA256

                  415ba8fd3e545a037fca24d5cc74e2cdd3d43d20003635a37877617660ca7366

                  SHA512

                  b84ce45e123732b90dd5c6b66da202742b81a6e9e0e3d18560c3220bc585fa03fb3d20346767f9d7e424329b97ce871c3e855d56f05bae846cec9b56c895661c

                • C:\Program Files (x86)\Meiqia\Meiqia\vk_swiftshader.dll

                  Filesize

                  5.0MB

                  MD5

                  65a2889caaa276af0e68a46450ef4dd7

                  SHA1

                  2000c6fcdf1b1a24ebf467529e5d11c6cf979418

                  SHA256

                  415ba8fd3e545a037fca24d5cc74e2cdd3d43d20003635a37877617660ca7366

                  SHA512

                  b84ce45e123732b90dd5c6b66da202742b81a6e9e0e3d18560c3220bc585fa03fb3d20346767f9d7e424329b97ce871c3e855d56f05bae846cec9b56c895661c

                • C:\Users\Admin\AppData\Local\Temp\$inst\0001.tmp

                  Filesize

                  8.0MB

                  MD5

                  ad800eadffcf3c7a2b244cc09abb6ce7

                  SHA1

                  7be87d3d42dd21ae3e460844a783e91f62a3fe9c

                  SHA256

                  a441671bd18a2de563780ee52391c9df41828a7a8b24b26187007457366e410d

                  SHA512

                  b847afd9508bd1921aec59a8815a29ba061dbe1e41128bf19d2fb04c63ec7875e182c8ad5b8583beb5eea993e97fa46cbf0110920ba09c38a8a1b07410da0d3e

                • C:\Users\Admin\AppData\Local\Temp\$inst\0002.tmp

                  Filesize

                  8.0MB

                  MD5

                  47fb00d9a25c019719119c913d2788ad

                  SHA1

                  f5c2091e32a92207b9cb3a1994901c612d3bb898

                  SHA256

                  6c34463044fa650f42c3f82a3f02baf6838fe377c4c972f503ecd20ee3a0c38e

                  SHA512

                  b218bc4f3b730bcf82868558f152732b27ddf34523f2bd337b3d75b1d5dccdd6711e47a2309fb5d863f58f6969f2a2bbee82cbc01ffb65edadf3a0223a31f1c9

                • C:\Users\Admin\AppData\Local\Temp\$inst\0008.tmp

                  Filesize

                  8.0MB

                  MD5

                  9375515bdcd8a8380e386623e7746fb3

                  SHA1

                  5c2dc4da94ec99d88884f2e6661ed1ef13de7720

                  SHA256

                  31a7142295180d35b5bf0ae2ca6b5cceffce4a1e14f7b1b67efb8ae23ffa854a

                  SHA512

                  428d36d5fe32820b49260d25a881b4fca8b30cec883d2940c462a4724b16c1a125dcdb9952ed5d72c788b57e1cbe6d24e81d6865bd378da0441a0a78cc56cb10

                • C:\Users\Admin\AppData\Local\Temp\$inst\0009.tmp

                  Filesize

                  8.0MB

                  MD5

                  10c5bc39aaa8df4e345a659b8331ad6c

                  SHA1

                  74b9a87564630632037fbadd8c855466e194013d

                  SHA256

                  17f230b3f357b194ccfc18f7e51c037552c919f15de0f1b972812325b3e7b661

                  SHA512

                  6fa13796b0aabeb5e28078fcd1d7f59e8b4fa6cf532df69085c76941f15b93c6ab603e96f14d6cec632ca6889716744c523f22c76999cb7117105f14e3a9f82c

                • C:\Users\Admin\AppData\Local\Temp\$inst\0010.tmp

                  Filesize

                  192KB

                  MD5

                  0cc446c3806bf36ce37857616e806183

                  SHA1

                  167937c25acdd99bc225d03e0a620a75c32c3bf4

                  SHA256

                  83922c662affa538b3aa770d0bd3e0518b1d5fd99abb03c76c8554de242cd34e

                  SHA512

                  58c7605aa9c122394b0b6e663af08f92dd0c4bf7bb251499113c45f324c08ffa11cc59e8d4bdc071fbb67715aff4941d004062154b8fd622f19f1a5ce0cd44fc

                • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                  Filesize

                  2B

                  MD5

                  f3b25701fe362ec84616a93a45ce9998

                  SHA1

                  d62636d8caec13f04e28442a0a6fa1afeb024bbb

                  SHA256

                  b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                  SHA512

                  98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                • C:\Users\Admin\AppData\Roaming\com.meiqia.windows\Cache\Cache_Data\f_000032

                  Filesize

                  185KB

                  MD5

                  a9673bd087b4e5e2cd21862f8b7d8054

                  SHA1

                  0854f56b37b3c7c3938ebdd75a79be32c94b281d

                  SHA256

                  d4226b650de255fdc92e6ba1b89181c445fa23e82e86a1de62059ffde35081b2

                  SHA512

                  3e919945421b284915da26cd49d55db1e4c5b0530cfafec936982e2b6f400e372b98df78d1f07813a473cf9f26699e9c1ffa555904d6d2b4fc819b2c202afaba

                • C:\Users\Admin\AppData\Roaming\com.meiqia.windows\Network\TransportSecurity

                  Filesize

                  856B

                  MD5

                  5b88c05844a51e83ef9693b68e0857e5

                  SHA1

                  8286805d6686cb4062d7b97a3e24411414163436

                  SHA256

                  0c44b8e686e9342be378b7f047a14351348c3dcaba9006652ebf6f466adc3848

                  SHA512

                  6ec9cc037ed5a0c0a9093cfd68bb7fbd35fa254b90b777264c754bff2f77b6b0e5d6b0b8794c333206eb635ed37dd2df3fded62b68070619713be4b473032222

                • C:\Users\Admin\AppData\Roaming\com.meiqia.windows\Network\TransportSecurity~RFe59e9f9.TMP

                  Filesize

                  856B

                  MD5

                  59b12d9a2201e86f3050132eb04339bd

                  SHA1

                  eca525a9dfa4aaa9b32f50c81975d06d42940bbb

                  SHA256

                  09a755df9e6fd2a808d326a48958b16ad018f5860bcfce76cfa8b75b94d71b44

                  SHA512

                  d279a75c596d3d164497a54da3550f443dbbfc28b59526f261b713619dbef7115716927e0a5d2ca87ffc387813801fb8402cc6441925e553dd1f33bf46cc24fe

                • C:\Users\Admin\AppData\Roaming\com.meiqia.windows\Session Storage\CURRENT

                  Filesize

                  16B

                  MD5

                  46295cac801e5d4857d09837238a6394

                  SHA1

                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                  SHA256

                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                  SHA512

                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                • memory/1308-11-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/1308-276-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/1308-364-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/1308-373-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/1492-994-0x00000268F0A10000-0x00000268F0ABD000-memory.dmp

                  Filesize

                  692KB

                • memory/1628-804-0x00000269C6780000-0x00000269C682D000-memory.dmp

                  Filesize

                  692KB

                • memory/4340-806-0x00000204CEF00000-0x00000204CEFAD000-memory.dmp

                  Filesize

                  692KB

                • memory/4468-784-0x000002552C740000-0x000002552C7ED000-memory.dmp

                  Filesize

                  692KB

                • memory/4468-489-0x00007FFAEFA00000-0x00007FFAEFA01000-memory.dmp

                  Filesize

                  4KB

                • memory/4468-490-0x00007FFAEF7A0000-0x00007FFAEF7A1000-memory.dmp

                  Filesize

                  4KB