ffd63fe2aeaa91f05bef47b3583290ccdba3f44912ab8b67044f3d58bf817ebf

Resubmissions

11-11-2023 01:44

231111-b5tg3sdf9y 6

Analysis

max time kernel
143s
max time network
158s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
11-11-2023 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Stormshot.PC.V1.0_4c9ef25b2f.exe
Size

2.8MB
MD5

6aae47cbaa4c56095a1eb0422c1d2ecb
SHA1

34e29d1801d270a2bd7ac02d4ea84c14c553d66f
SHA256

ffd63fe2aeaa91f05bef47b3583290ccdba3f44912ab8b67044f3d58bf817ebf
SHA512

d6b2406922d2618816db55110bf12a8579b69325e0c196d0d2508bafec68a0430acf48482160bf42cca4bd0995d864abfa2425e8e5af794c8d8d1c430fee4cff
SSDEEP

49152:c8ZQVqWu+fqu79LNTRBO1L2VQjJY80KruthaPVu+2zE0y5VCmdAlacRk3Y:vZARtBEqVQq80ThzTzEElask3Y

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\st_global = "C:\\Program Files (x86)\\FunPlus\\StormShot\\Launcher.exe"	PC-Launcher.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	PC-Launcher.exe
File opened (read-only)	\??\F:	PC-Launcher.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\prefs\st_global_setting.ini	PC-Launcher.exe
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\vcruntime140.dll	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\msvcp100.dll	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\Plugin\7z.21.07\Far\is-IDRP1.tmp	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\InstallSettings.ini	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\translations\is-A1SJ3.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\uninstall.lnk	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\virtualkeyboard\qtvirtualkeyboard_hangul.dll	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5WebSockets.dll	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\is-2TDQE.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\iconengines\is-60O0E.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\is-MOQQ8.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\is-P6I9D.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\QtQuick\Timeline\is-PKRRO.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\is-E07BN.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\imageformats\is-NG2UF.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\Plugin\7z.21.07\x64\is-EAFM1.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\is-PTO6U.tmp	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\uninstall\unins000.dat	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\is-DOUKF.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\qmltooling\is-8Q6Q2.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\QtQml\StateMachine\is-KT5FR.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\translations\is-GOTCT.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\imageformats\is-DVSC8.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\imageformats\is-6FPDF.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\Plugin\7z.21.07\Far\is-3TI7E.tmp	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\FPX.dll	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\FPXGameManager32.dll	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\virtualkeyboard\qtvirtualkeyboard_thai.dll	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\SDL2.dll	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\is-QHJID.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\is-HV0FF.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\Plugin\7z.21.07\Far\is-F7ITL.tmp	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\styles\qwindowsvistastyle.dll	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5QuickWidgets.dll	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\libcrypto-1_1.dll	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5RemoteObjects.dll	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\fpxcore.dll	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\libcrypto-1_1-x64.dll	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\concrt140.dll	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\is-TBNTI.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\is-G9626.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\qmltooling\is-JUL7H.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\config\is-QA8CJ.tmp	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\QtQml\StateMachine\qtqmlstatemachine.dll	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\translations\is-SPJJF.tmp	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\D3Dcompiler_47.dll	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\Plugin\7z.21.07\7za.exe	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\is-8209O.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\QtQml\StateMachine\is-V4UMV.tmp	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\Plugin\7z.21.07\Far\7-ZipFar64.dll	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\imageformats\is-LFKIU.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\is-98MS6.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\translations\is-GIOPG.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\translations\is-7PF9A.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\translations\is-UUIUP.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\qmltooling\is-JQDRE.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\Plugin\7z.21.07\Far\is-2F89B.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\Plugin\7z.21.07\Far\is-A42OG.tmp	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\Plugin\7z.21.07\x64\is-IB3N9.tmp	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\qmltooling\qmldbg_messages.dll	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\postproc-55.dll	st_4c9ef25b2f.tmp
File opened for modification	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\qmltooling\qmldbg_server.dll	st_4c9ef25b2f.tmp
File created	C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\is-850EB.tmp	st_4c9ef25b2f.tmp

Executes dropped EXE 4 IoCs

pid	Process
2716	st_4c9ef25b2f.exe
2888	st_4c9ef25b2f.tmp
2192	Launcher.exe
2336	PC-Launcher.exe

Loads dropped DLL 48 IoCs

pid	Process
2716	st_4c9ef25b2f.exe
2888	st_4c9ef25b2f.tmp
2888	st_4c9ef25b2f.tmp
2888	st_4c9ef25b2f.tmp
2192	Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Stormshot.PC.V1.0_4c9ef25b2f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Stormshot.PC.V1.0_4c9ef25b2f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	PC-Launcher.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	PC-Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	PC-Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	PC-Launcher.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\funplus.st	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids	st_4c9ef25b2f.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids\StormShotFile.myp	st_4c9ef25b2f.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StormShotFile.myp\shell\open\command\ = "\"C:\\Program Files (x86)\\FunPlus\\StormShot\\Launcher.exe\" \"%1\""	st_4c9ef25b2f.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\funplus.st\ = "URL:funplus.st Protocol"	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\funplus.st\shell\open	Launcher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\StormShotFile.myp\shell\open\command	st_4c9ef25b2f.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StormShotFile.myp\shell\open	st_4c9ef25b2f.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StormShotFile.myp\shell\open\command	st_4c9ef25b2f.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp	st_4c9ef25b2f.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StormShotFile.myp\DefaultIcon\ = "C:\\Program Files (x86)\\FunPlus\\StormShot\\Launcher.exe,0"	st_4c9ef25b2f.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StormShotFile.myp	st_4c9ef25b2f.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\funplus.st\shell\open\command\ = "C:\\Program Files (x86)\\FunPlus\\StormShot\\Launcher.exe %1"	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Launcher.exe\SupportedTypes	st_4c9ef25b2f.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Launcher.exe\SupportedTypes\.myp	st_4c9ef25b2f.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\funplus.st\shell	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Launcher.exe	st_4c9ef25b2f.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\funplus.st\DefaultIcon	Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\funplus.st\DefaultIcon\ = "C:\\Program Files (x86)\\FunPlus\\StormShot\\Launcher.exe"	Launcher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.myp\OpenWithProgids	st_4c9ef25b2f.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	st_4c9ef25b2f.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\funplus.st\shell\open\command	Launcher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\StormShotFile.myp	st_4c9ef25b2f.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StormShotFile.myp\ = "StormShot File"	st_4c9ef25b2f.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StormShotFile.myp\shell	st_4c9ef25b2f.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\StormShotFile.myp\DefaultIcon	st_4c9ef25b2f.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\Launcher.exe\SupportedTypes	st_4c9ef25b2f.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\funplus.st\URL Protocol	Launcher.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	PC-Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	PC-Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	PC-Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	PC-Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	PC-Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d4624030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	PC-Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e260f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	PC-Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	PC-Launcher.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2336	PC-Launcher.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3024	Stormshot.PC.V1.0_4c9ef25b2f.exe
2888	st_4c9ef25b2f.tmp
2888	st_4c9ef25b2f.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2336	PC-Launcher.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	904	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	904	AUDIODG.EXE
Token: 33	904	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	904	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2888	st_4c9ef25b2f.tmp
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe
2336	PC-Launcher.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2716	3024	Stormshot.PC.V1.0_4c9ef25b2f.exe	30
PID 3024 wrote to memory of 2716	3024	Stormshot.PC.V1.0_4c9ef25b2f.exe	30
PID 3024 wrote to memory of 2716	3024	Stormshot.PC.V1.0_4c9ef25b2f.exe	30
PID 3024 wrote to memory of 2716	3024	Stormshot.PC.V1.0_4c9ef25b2f.exe	30
PID 3024 wrote to memory of 2716	3024	Stormshot.PC.V1.0_4c9ef25b2f.exe	30
PID 3024 wrote to memory of 2716	3024	Stormshot.PC.V1.0_4c9ef25b2f.exe	30
PID 3024 wrote to memory of 2716	3024	Stormshot.PC.V1.0_4c9ef25b2f.exe	30
PID 2716 wrote to memory of 2888	2716	st_4c9ef25b2f.exe	31
PID 2716 wrote to memory of 2888	2716	st_4c9ef25b2f.exe	31
PID 2716 wrote to memory of 2888	2716	st_4c9ef25b2f.exe	31
PID 2716 wrote to memory of 2888	2716	st_4c9ef25b2f.exe	31
PID 2716 wrote to memory of 2888	2716	st_4c9ef25b2f.exe	31
PID 2716 wrote to memory of 2888	2716	st_4c9ef25b2f.exe	31
PID 2716 wrote to memory of 2888	2716	st_4c9ef25b2f.exe	31
PID 2888 wrote to memory of 2192	2888	st_4c9ef25b2f.tmp	33
PID 2888 wrote to memory of 2192	2888	st_4c9ef25b2f.tmp	33
PID 2888 wrote to memory of 2192	2888	st_4c9ef25b2f.tmp	33
PID 2888 wrote to memory of 2192	2888	st_4c9ef25b2f.tmp	33
PID 2888 wrote to memory of 2192	2888	st_4c9ef25b2f.tmp	33
PID 2888 wrote to memory of 2192	2888	st_4c9ef25b2f.tmp	33
PID 2888 wrote to memory of 2192	2888	st_4c9ef25b2f.tmp	33
PID 2192 wrote to memory of 2336	2192	Launcher.exe	34
PID 2192 wrote to memory of 2336	2192	Launcher.exe	34
PID 2192 wrote to memory of 2336	2192	Launcher.exe	34
PID 2192 wrote to memory of 2336	2192	Launcher.exe	34
PID 2192 wrote to memory of 2336	2192	Launcher.exe	34
PID 2192 wrote to memory of 2336	2192	Launcher.exe	34
PID 2192 wrote to memory of 2336	2192	Launcher.exe	34

C:\Users\Admin\AppData\Local\Temp\Stormshot.PC.V1.0_4c9ef25b2f.exe
"C:\Users\Admin\AppData\Local\Temp\Stormshot.PC.V1.0_4c9ef25b2f.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\st_4c9ef25b2f.exe
  C:\Users\Admin\AppData\Local\Temp\st_4c9ef25b2f.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Admin\AppData\Local\Temp\is-NTQNQ.tmp\st_4c9ef25b2f.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-NTQNQ.tmp\st_4c9ef25b2f.tmp" /SL5="$40162,53379863,1641472,C:\Users\Admin\AppData\Local\Temp\st_4c9ef25b2f.exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Program Files (x86)\FunPlus\StormShot\Launcher.exe
      "C:\Program Files (x86)\FunPlus\StormShot\Launcher.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2192
    - - C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\PC-Launcher.exe
        
        "C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\PC-Launcher.exe" --currentPath="C:\Program Files (x86)\FunPlus\StormShot" --configVersion=1.0.0.61 --launchExe="C:\Program Files (x86)\FunPlus\StormShot\Launcher.exe"
        5⤵
        Adds Run key to start application
        Enumerates connected drives
        Drops file in Program Files directory
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Modifies system certificate store
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2336

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x560
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\MSVCP140.dll

Filesize
425KB

MD5
d4e9ae2301232a7599807ae02023187e

SHA1
af68af4f51c1affd0a8c29b3e707642636374583

SHA256
322af358aad037db8136623586e65fedbba3040b355f76ed34e7aa1763b2dc89

SHA512
5fe2cba77f0c285c519142a71cc1e6216b4ad78077aebf1c3f23e84e4b8fcd7f9cb6363668674869e3bd2c56ffd178b2c2d51725ab38e0a2338e5dc15d7d05f8

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\MSVCP140_1.dll

Filesize
20KB

MD5
ca7c343e1f6ffdacd0818b9e46ad58a5

SHA1
9731858d1cc5f1c1ca3bb2253df8feb9a912b8f2

SHA256
87428634883461f50ef4dc812273dc8822cf608b32ef6f11bcc61223052c1ae1

SHA512
13602dbd97f41dfb32f9c2cb5fcc263fd2663667374372b4414f64f0f56191419a79e74add3286524710d1b75869933cd21c8d8401ff6df6d711dd8efc8800d9

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\PC-Launcher.exe

Filesize
8.9MB

MD5
6244816e26872278c4977588490030ef

SHA1
19f451ba7840a0fc1d7a2310b5f279a755dc146d

SHA256
a7729adbe47ef9455f7c3a2c9026fea81ea77b673820ae1c5397aa3375244baa

SHA512
63f392021bdfd2eb8369fbc7c6f49ecf35443afa0e264a0a91c482f799c0a88616801814601a39c475eda1b8ea53a7bd4b72cc92f0f82695031ef6b6848ec5ba

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\PC-Launcher.exe

Filesize
8.9MB

MD5
6244816e26872278c4977588490030ef

SHA1
19f451ba7840a0fc1d7a2310b5f279a755dc146d

SHA256
a7729adbe47ef9455f7c3a2c9026fea81ea77b673820ae1c5397aa3375244baa

SHA512
63f392021bdfd2eb8369fbc7c6f49ecf35443afa0e264a0a91c482f799c0a88616801814601a39c475eda1b8ea53a7bd4b72cc92f0f82695031ef6b6848ec5ba

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5Core.dll

Filesize
5.2MB

MD5
ccb1f269d09dae974fe338ac807966f0

SHA1
5bbc886073b68ac54c28e5cd2f81392b532e5c55

SHA256
1cd06fffc17269a864fec6ec8f47bbf8af3f5d1cfa391f173ae63da4c7a7b498

SHA512
2e82eebae0b9c4c7f7168aa89082d51e45c8622ad831c13b1a2219ba22db50dcff9e4846642dbfe8103f18bc8277d35753494be7aaa3791929975d135345f4b8

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5Gui.dll

Filesize
5.7MB

MD5
00375b48f58242be0aeb9fea5db47a34

SHA1
f5ff390642cf75f562aa43e5041b3ecaeae19e8e

SHA256
b5d8b8997a484f342739e15689b4a29389c1cd99e61d8a2ab208bc5644c1d8a8

SHA512
3aa570d2395019bea0be84523a1c81f9a8bc8ae984066f478aa7ff967fbc241f150bc23b0d9bd727a960b0799d84e1d36d46a7bd8e5ff95b60b24a4cc92130b0

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5Network.dll

Filesize
1.0MB

MD5
6ac9a28a6fbc7f48e7504f34b5480797

SHA1
348d596e4566cc99cb7b78ba4e9076ba9d8a1d38

SHA256
fc6179c80db2afb79f67b2f0e39ed1739717129ae30b8b81c6155f17ba83c576

SHA512
a3a5da0bce62d5ec48563b93e4faf59e89162afa8f5c01ae23198490b9b202251baa550582d84d83e51187b93ca77b7bb7a3c3ec07950b283f49e16beb6f077a

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5Qml.dll

Filesize
2.9MB

MD5
2247c7ba00ffd5fb0b8bed697e7e7ab3

SHA1
0977e47d8efb192fd2a05c845e5633109858ea0d

SHA256
61bc4ed1824d6c1327d298a7a788d7ce3d8a2e64dd9e7955fd08088920890642

SHA512
2331e1d1dfb71f1482efd1d5ba4c71e67ca84570e089a020d4cfc9341dc3053bd79a39448ad952b53f9055ca49cbbbd6b0f1d071f96ca5b16a3e3d7fa585949c

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5QmlModels.dll

Filesize
349KB

MD5
b79193c4770635dbc6d578d4bc24142a

SHA1
83aea1916910f865449a2db90a68e9c1cfd22a1f

SHA256
e488c6ae94e9610f8df22a97732c918f3261c32a897c3c357e6fc8995e94810b

SHA512
37f362fe14dfebacf32cea643a59a059f6e6116c6986516c98681b0314290894c9cfc7571d7ce04dbeab93aad5a869eb7ff586a88f7b30606e1ce05a6cd94a46

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5Quick.dll

Filesize
3.4MB

MD5
474a9e2de31376e21bce06d9cacef668

SHA1
c3ee8d3008d1daa6cce23d1261ea3f7bf4ab5308

SHA256
82156019afb320612a4b48243b05c7c8477770c83b23af836c7c99563fa26786

SHA512
5c894e47ff3853f1d692e3ab8f773ed70161cb05e497b8cc9412a060366dd7ddb4bc01939671d5ad6853d83c4a7641625d0b4f6eacf40d34401e3f12269773df

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5QuickWidgets.dll

Filesize
72KB

MD5
a2075c10b993bccd74523823d362a727

SHA1
e2f324e0f29bfa2b4016649aacecb71074e7a835

SHA256
2f3f0142e9b82e5c6d4f84c04578255a957981ee14ac96d76f5b93f0ca1c6769

SHA512
2dfd91deb83fa0ba2115ec8c03cd20515063fcf69a6919e5fa023672251d519664d33e8662670625745f85784445a559133c03a10bc7986859221045bbd07216

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5WebSockets.dll

Filesize
125KB

MD5
aaeac5122ab6a42e8b186ea771a72cc7

SHA1
26194f8d020d332990f33883294eb51bb8472bea

SHA256
41da80ee11c6d9caffa0ec863e61faf665c0ab3fea5add6febf131d2ad45071e

SHA512
f38b8c176f03c47bb7ed7942edfbcff7be20b1e796c5fa62a4fec2e3c7b664de06989699cd50be9c1cbae3501a9ac854870030576f5a4a8cc1cabf19bd73cf21

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5Widgets.dll

Filesize
4.3MB

MD5
a372a06ef5d5dfaeca77e54597585e03

SHA1
035c5bc89dd0fbe93ce411ebcb808c5fb50cc63d

SHA256
14230cbb6fcabd799c0269723c0f77dc46d4b89789b3d8eba0920ea217548c5a

SHA512
e68a5df0a1a70f0a11127d071dc528dec43a0d7e34ae568b282f3ed888a674b8ae0c80c0714d7f04fdc4a2fe4e820ae4629bf3429be7ab606784d9107b9f8604

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\SDL2.dll

Filesize
981KB

MD5
97fdf81d1efaa5349e2684d6b8d6800b

SHA1
ee32a078a2d895890afbf55786eebe7963d7dad7

SHA256
edb4ddac5c18222177c61f2cdbbfe9a7bf5d995da0f11c662650dc8648dc6cc1

SHA512
32975506d0cf7f9b4fc4a1f569192d41d60106b558303e9bcf611b908cd019a1ab7b404cc757c89888e7870564671bb3984726d5e664795b1e4032773c6abb19

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\VCRUNTIME140.dll

Filesize
76KB

MD5
2cec885177f8e329a314f975806d0e3d

SHA1
942d6525d23833ac51af1fd0cb6c18f0aacc90fa

SHA256
e4989178cb90a65428bcb19b2f1d2c811ab66077b38c0645522d8669b176b99e

SHA512
210d12d8912341e1625bbc603060aaf37ded1fec58fe677b0f92dd5bdc89d1629f29b50f7e95985bda6c7f316790f753dee2305d154ae94f5ee7816886e91fb1

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\avcodec-58.dll

Filesize
30.0MB

MD5
4104f6ce0c03244245fa8514acd42750

SHA1
96d8952d7671f32cf01c942200f2093b00e7db20

SHA256
eb8a69d363a71aa1e2088e52fb8e290d7e5f086c9e349138ed074846a9c2fe39

SHA512
e13ecdf97595fa4cee6a6cdbf2609882035dbfe071918b86ea29f658ba4ecff79bc641e22fb1aa13f2e8d94412e30246c222a67defef823d26794d665cc229d5

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\avfilter-7.dll

Filesize
6.8MB

MD5
9633000349e44e076b7752bc1ca51817

SHA1
a5bd2e46329eab85c81b4ab4ca65fa978bf71cc1

SHA256
39a91796fafe9d2efc2cea0de239179a3a2d406ea482af310710e6f5fed00083

SHA512
665e619c270d36ddc9ceff33eb2eb7eca695454af86e606d210ad8586e59c0ea693fe6e7706e1c00e3f1060b1c44686461da2bfa5f3f5ce15110715fc824e29d

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\avformat-58.dll

Filesize
5.7MB

MD5
fe9ebd34a08c7435d9709356820edba2

SHA1
b8912f6d245d15d32c262af2f16af4ec65331cfa

SHA256
8d5c9d928e9a49e19458489a03ec4d6a3e608909f48cfd6157ba1c6623107718

SHA512
c3d429cf4e73c27548df303a29e8999d23dc4f40b0826e2aa71cb26298c18962c87041f471cb8ec369aa206377ef535047f8d6088d1c075de84c7eaa507b5de5

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\avutil-56.dll

Filesize
640KB

MD5
60b41052a192625213696e44c615214b

SHA1
eae79465da62b09ffbb9ea86caa09b82dd62a8e7

SHA256
5f6d92ea508b9c2b8836cc2a757e60657a424d7c40ccfc6edfb3cf66468ac0c3

SHA512
1b4f3c778a34c40850746a113567acefe97c0b45a21479abcfa8ffa81486b119214f1c0692d36589e34bc9dd0a42ba22c9e9127f508b073d64d7477fc21c9449

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\iconengines\qsvgicon.dll

Filesize
40KB

MD5
34732c85bc4f9bb4a4a2297a0aa20aad

SHA1
7e8d22f248e8d23b208807df1c86db99435afe49

SHA256
79e48711e6bdd497e9efc7c423f34f30d742db0aa04c0febd3b214004526a818

SHA512
3cb974eca119d2f521219c9f8037cd484d116a41ab3c8f2886b2219b75ff16c7accf619ba985645d1a8dc2c32c7acb10b03e3169111e786bd90a18fd69267f17

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\imageformats\qgif.dll

Filesize
38KB

MD5
6f1b578054aadf5e184d9153a0537364

SHA1
136c349a97957f406e45a60247fc1d2bd4296294

SHA256
c0964a239ba5b0b5262ac6ed36d41ba4b8c466d5e8cfc8577f8a061197e6272d

SHA512
28cc8d72e524dfbebc6ae35c150f874c082652cc6bc1d99712d0211219e893d63dfefeed8981dd2ed1097cf217d852c50845355d39691045bf19d53fa171750c

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\imageformats\qicns.dll

Filesize
42KB

MD5
3e887a30afb41edefc0651eed9478942

SHA1
5c132f72c3fb02497d565bfe066d1813e4d1e668

SHA256
af8a95934fddaee350425a26206b732567d6f47e52b33853447382e553df1916

SHA512
e9319e42349b491c9afb0ca72a1696f8af15e2b4bc9db0667057fecfd8b4fc7166c7ac4a0d764cd036c0784b5731b881a3da58d0914469b6e5495168172f8a48

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\platforms\qwindows.dll

Filesize
1.2MB

MD5
981f9dc4f537012d21aab34071896788

SHA1
58e0c4baf55f1908c6abf8f2b81fa5cab6a5c840

SHA256
334f317e5afd0b9cf05e85ba1c241e57cc84833658c6db04595c0f1accdfe69c

SHA512
d4327a401909fe8b0e9cf561c525a51fbd6e168cf6daf1513653c524b08d0fe12b9b2db588a3398ef1285e993cd3078a9d3770a676a001c61f3f358178266e5d

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\postproc-55.dll

Filesize
111KB

MD5
c01ef967c4b2954a35739856f8e3aad0

SHA1
6f1acdd12773fe915e7559ea8c82008c3590b336

SHA256
d90ac8ff8dee9bfbcc932d3751db1a55e62a5e507299d36849b0f31e38730f7f

SHA512
b12fe1fc23ccdc1ff4979e39adb06829fcb6dafa90522e4b3fe30787c2462af04adfaf4ab9724175cf5419c3417de184ac87afbe3e073edc458ee220c3218706

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\styles\qwindowsvistastyle.dll

Filesize
132KB

MD5
b65e3ef6042684b489d0cb2574b4d144

SHA1
98747aec7f187d03ee2604fca947744efcab0b99

SHA256
9fd317f3da3eee0d53dc78687aad61440dfbc30a0d42169be434731e11f423bb

SHA512
980a7e9a9265c275beeba3469a0e676bb68f0b18ee760b43c0b9ab9856a11cf23175d10b53532299e1f8c1f5b74aaace61352eef398b4307267812a698f0e008

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\swresample-3.dll

Filesize
304KB

MD5
d665e9827bb31204020df5f4ec23b3d4

SHA1
f579549db8ae38a792be3d0f88b8272d08165349

SHA256
886f99c2296f88014cf146a7a7453bedfaf7e650011fc5a6c01a2064bd8881e3

SHA512
36a5923bffefc6dabc627ff6e2c01c5e893c8b2650711ea6ec44a66e7d97a717244d702f0877be08d9ad6e691732a65d011253f0cf2dd4989b28f371473aec53

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\swscale-5.dll

Filesize
504KB

MD5
a377c134506f22f93a2e69fcb344acc6

SHA1
35017b15b9086a7918fe6c9b42fbc8de9cc70337

SHA256
71ab19a4d1b98e300f132de30fbf9af2f78b0a02d0900fed643915eb6eac1a69

SHA512
313c1203a16b1efd1ba40171d0c7185516e6413cdb184a66ab65bed99d671cd5209a845254fc0979331d836bbf195b1df350693cc4426f41b05de5a5fbe7682d

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\1.0.0.61\uninstall.exe

Filesize
982KB

MD5
b69664b1c21063c2b042449c87eecdac

SHA1
4ec1e85ab1d237fa3409e2a9aeb7730e9ad45c57

SHA256
a8c181a677ebab0516a20279821568e879ea1820d0c3fa24fc586a0996302c32

SHA512
24d2b4adbf5c60fc585b99db23ce8947a9ab7f65802916cef3ef29aef068c2a3169a2453fdac4cf015dd3fdc61c2d9d86408adeadaf921b4f32070546172b7bb

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\InstallSettings.ini

Filesize
123B

MD5
d691b06122683b6aa8f4e51acafc3821

SHA1
a913eda9497993757818c18ecedbcd95749d730c

SHA256
ea7e59e43fe6f2358c940cd79ea7dbf57a67a8ef774d0346a3e099077d6e8284

SHA512
c764d3f83076196946e4ddce77af47b5134ef4c1d062d49e453a8c1d7a8100915ad8ba7bde3709529910da188af33305dccdfb44a78923b1b84b2580407de316

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\Launcher.exe

Filesize
1.1MB

MD5
f00e8e76d59d70bbecf038a6babc85e8

SHA1
fc09a85c6dacbfc134d69cadecd05721f0530884

SHA256
737c2a6c7bab4cb87e10b17a4560fcf6b844971b1c36dc825ab249f7a751bbf4

SHA512
31f4fd6eb30c557b4bf8076fd9299dc01da5fd2a14fad07629ab9e5dc5f916a46a4699b33576f344b0e48f6b179f273f4cd29ffa333413b4f05f6a6f69488b36

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\Launcher.exe

Filesize
1.1MB

MD5
f00e8e76d59d70bbecf038a6babc85e8

SHA1
fc09a85c6dacbfc134d69cadecd05721f0530884

SHA256
737c2a6c7bab4cb87e10b17a4560fcf6b844971b1c36dc825ab249f7a751bbf4

SHA512
31f4fd6eb30c557b4bf8076fd9299dc01da5fd2a14fad07629ab9e5dc5f916a46a4699b33576f344b0e48f6b179f273f4cd29ffa333413b4f05f6a6f69488b36

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\config\version.ini

Filesize
16B

MD5
d71e4fc5fc269e15b266dfbf98cef0e4

SHA1
98b611e37b5023084c6a1165150a556c76b4a5a6

SHA256
0f13b86c4b95ade138a6c0d1359ce58cefb5b1b1344b5170a5d6d24983b2fb9e

SHA512
9d5804e4986fce15a0e45e285e29b017a98a5f2bd91d1ddad2a14563ebadd17aba1a6fd3227f632061116e08a6022226f00808a81b485d8941d2c54f424c5e8c

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\is-OGAPJ.tmp

Filesize
1.1MB

MD5
f00e8e76d59d70bbecf038a6babc85e8

SHA1
fc09a85c6dacbfc134d69cadecd05721f0530884

SHA256
737c2a6c7bab4cb87e10b17a4560fcf6b844971b1c36dc825ab249f7a751bbf4

SHA512
31f4fd6eb30c557b4bf8076fd9299dc01da5fd2a14fad07629ab9e5dc5f916a46a4699b33576f344b0e48f6b179f273f4cd29ffa333413b4f05f6a6f69488b36

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\prefs\st_global_setting.ini

Filesize
45B

MD5
181c02fa80dea8bf64e135a5c788fc4c

SHA1
d0810b571d78b9c2aeee07dde67c4e68aee8acff

SHA256
47faaa8f369a07ebae36b1c80860222a19dfe2faf9e0292c81b4274ff60fc7c5

SHA512
3bc81ec4c72c0002954d4c13a937cfc939eb6a35f0fb5db80f87b1c1a82a11a05deb21243d1dc42b0e979475b5e63e8971965b22dc00f1282b2cfa40bc2b0f65

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\uninstall\FPXInstaller.dll

Filesize
1010KB

MD5
6ecddc274b977c787d3110c0e5048d9c

SHA1
ff5f024520f844da22359af2cb6a3d138bbc28d5

SHA256
11ebba6c0959ddbf7a82a6dfdf36777c8c91d38962a0fe052f50703bd2cd6b42

SHA512
5552f0198fff6189d27dcd985771f7f3617a74392b77a68946f5bdb7f67b6509add129d7524a9c8b017cd30a41d0e77df19e138abf8e03b203237cde4ba3f445

Download Submit
C:\Program Files (x86)\FunPlus\StormShot\uninstall\unins000.exe

Filesize
3.7MB

MD5
0d01214bd640f58c27314047fb208967

SHA1
0e36fa03b123d5a12f4c81e16203a63463ebbef5

SHA256
01740e208bf37a32e665380ca4df335ce7e2b6a6a3dc8ab734a95eb4d6b3373e

SHA512
03c9c615440e2cfdd4c49ad88ff8046f6f7cd85381aa2d18f5593700292016a4559992c8b179c2d4fddc711c4c37859720c2e9620a3471de80fbb89be1f31327

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0f45425874dd71ff7ce3f38b85104f0

SHA1
fd9817995f205b34ca4dabb9a174cb9452554fac

SHA256
faed31b88971d5d38cdb1f921ec8434c3b57a203a419a21145cb4ddcf685ed0e

SHA512
b82555c11b72bfaf60b0512392e58780f98ddcc13fe0e03abc769e2e23dd2aed89e8bff7cbb62e60298c828f0af1effbc49ee195c21a3c094c97f673808531e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab21F4.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2226.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-NTQNQ.tmp\st_4c9ef25b2f.tmp

Filesize
3.7MB

MD5
8373d4e62a94878ea1af40ca2fb5b1d2

SHA1
7ab8dbbd25b02ce053578d72ccb94723efaa802d

SHA256
e84e4ef7ae77f6c67c287a2c0bdb47d706ae37b2dce3ed18c6d45f7ab8c36777

SHA512
8071e53b1159f2e9e4405247fb4540f9da82be5de906c9fc255d12f517a5f7b69c0ba2df2ae11c86e7a96929bffaf7f72f9ca723e1bb9fcf6ebddbf2c48c65af

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-NTQNQ.tmp\st_4c9ef25b2f.tmp

Filesize
3.7MB

MD5
8373d4e62a94878ea1af40ca2fb5b1d2

SHA1
7ab8dbbd25b02ce053578d72ccb94723efaa802d

SHA256
e84e4ef7ae77f6c67c287a2c0bdb47d706ae37b2dce3ed18c6d45f7ab8c36777

SHA512
8071e53b1159f2e9e4405247fb4540f9da82be5de906c9fc255d12f517a5f7b69c0ba2df2ae11c86e7a96929bffaf7f72f9ca723e1bb9fcf6ebddbf2c48c65af

Download Submit
C:\Users\Admin\AppData\Local\Temp\st_4c9ef25b2f.exe

Filesize
52.4MB

MD5
2dd6593bf8934eebaa3effb889ec03b0

SHA1
fc96e4f015156047280d7f99570de6ae81488dda

SHA256
d53bea3bfed0739885810c87ad5be9124b93bb90e9b88a1a5b883b48bf7aaaf3

SHA512
ac5247777b1743c199167f49166cb52b7a20e0dd7d06abfaae10e02654bbd4b773939ac0c628f86c71aefcbf75501cdc89ed395a491d93d0747e9a8be60fc6c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\st_4c9ef25b2f.exe

Filesize
52.4MB

MD5
2dd6593bf8934eebaa3effb889ec03b0

SHA1
fc96e4f015156047280d7f99570de6ae81488dda

SHA256
d53bea3bfed0739885810c87ad5be9124b93bb90e9b88a1a5b883b48bf7aaaf3

SHA512
ac5247777b1743c199167f49166cb52b7a20e0dd7d06abfaae10e02654bbd4b773939ac0c628f86c71aefcbf75501cdc89ed395a491d93d0747e9a8be60fc6c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\st_4c9ef25b2f.exe

Filesize
52.4MB

MD5
2dd6593bf8934eebaa3effb889ec03b0

SHA1
fc96e4f015156047280d7f99570de6ae81488dda

SHA256
d53bea3bfed0739885810c87ad5be9124b93bb90e9b88a1a5b883b48bf7aaaf3

SHA512
ac5247777b1743c199167f49166cb52b7a20e0dd7d06abfaae10e02654bbd4b773939ac0c628f86c71aefcbf75501cdc89ed395a491d93d0747e9a8be60fc6c7

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\PC-Launcher.exe

Filesize
8.9MB

MD5
6244816e26872278c4977588490030ef

SHA1
19f451ba7840a0fc1d7a2310b5f279a755dc146d

SHA256
a7729adbe47ef9455f7c3a2c9026fea81ea77b673820ae1c5397aa3375244baa

SHA512
63f392021bdfd2eb8369fbc7c6f49ecf35443afa0e264a0a91c482f799c0a88616801814601a39c475eda1b8ea53a7bd4b72cc92f0f82695031ef6b6848ec5ba

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5Core.dll

Filesize
5.2MB

MD5
ccb1f269d09dae974fe338ac807966f0

SHA1
5bbc886073b68ac54c28e5cd2f81392b532e5c55

SHA256
1cd06fffc17269a864fec6ec8f47bbf8af3f5d1cfa391f173ae63da4c7a7b498

SHA512
2e82eebae0b9c4c7f7168aa89082d51e45c8622ad831c13b1a2219ba22db50dcff9e4846642dbfe8103f18bc8277d35753494be7aaa3791929975d135345f4b8

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5Gui.dll

Filesize
5.7MB

MD5
00375b48f58242be0aeb9fea5db47a34

SHA1
f5ff390642cf75f562aa43e5041b3ecaeae19e8e

SHA256
b5d8b8997a484f342739e15689b4a29389c1cd99e61d8a2ab208bc5644c1d8a8

SHA512
3aa570d2395019bea0be84523a1c81f9a8bc8ae984066f478aa7ff967fbc241f150bc23b0d9bd727a960b0799d84e1d36d46a7bd8e5ff95b60b24a4cc92130b0

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5Network.dll

Filesize
1.0MB

MD5
6ac9a28a6fbc7f48e7504f34b5480797

SHA1
348d596e4566cc99cb7b78ba4e9076ba9d8a1d38

SHA256
fc6179c80db2afb79f67b2f0e39ed1739717129ae30b8b81c6155f17ba83c576

SHA512
a3a5da0bce62d5ec48563b93e4faf59e89162afa8f5c01ae23198490b9b202251baa550582d84d83e51187b93ca77b7bb7a3c3ec07950b283f49e16beb6f077a

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5Qml.dll

Filesize
2.9MB

MD5
2247c7ba00ffd5fb0b8bed697e7e7ab3

SHA1
0977e47d8efb192fd2a05c845e5633109858ea0d

SHA256
61bc4ed1824d6c1327d298a7a788d7ce3d8a2e64dd9e7955fd08088920890642

SHA512
2331e1d1dfb71f1482efd1d5ba4c71e67ca84570e089a020d4cfc9341dc3053bd79a39448ad952b53f9055ca49cbbbd6b0f1d071f96ca5b16a3e3d7fa585949c

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5QmlModels.dll

Filesize
349KB

MD5
b79193c4770635dbc6d578d4bc24142a

SHA1
83aea1916910f865449a2db90a68e9c1cfd22a1f

SHA256
e488c6ae94e9610f8df22a97732c918f3261c32a897c3c357e6fc8995e94810b

SHA512
37f362fe14dfebacf32cea643a59a059f6e6116c6986516c98681b0314290894c9cfc7571d7ce04dbeab93aad5a869eb7ff586a88f7b30606e1ce05a6cd94a46

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5Quick.dll

Filesize
3.4MB

MD5
474a9e2de31376e21bce06d9cacef668

SHA1
c3ee8d3008d1daa6cce23d1261ea3f7bf4ab5308

SHA256
82156019afb320612a4b48243b05c7c8477770c83b23af836c7c99563fa26786

SHA512
5c894e47ff3853f1d692e3ab8f773ed70161cb05e497b8cc9412a060366dd7ddb4bc01939671d5ad6853d83c4a7641625d0b4f6eacf40d34401e3f12269773df

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5QuickWidgets.dll

Filesize
72KB

MD5
a2075c10b993bccd74523823d362a727

SHA1
e2f324e0f29bfa2b4016649aacecb71074e7a835

SHA256
2f3f0142e9b82e5c6d4f84c04578255a957981ee14ac96d76f5b93f0ca1c6769

SHA512
2dfd91deb83fa0ba2115ec8c03cd20515063fcf69a6919e5fa023672251d519664d33e8662670625745f85784445a559133c03a10bc7986859221045bbd07216

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5WebSockets.dll

Filesize
125KB

MD5
aaeac5122ab6a42e8b186ea771a72cc7

SHA1
26194f8d020d332990f33883294eb51bb8472bea

SHA256
41da80ee11c6d9caffa0ec863e61faf665c0ab3fea5add6febf131d2ad45071e

SHA512
f38b8c176f03c47bb7ed7942edfbcff7be20b1e796c5fa62a4fec2e3c7b664de06989699cd50be9c1cbae3501a9ac854870030576f5a4a8cc1cabf19bd73cf21

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\Qt5Widgets.dll

Filesize
4.3MB

MD5
a372a06ef5d5dfaeca77e54597585e03

SHA1
035c5bc89dd0fbe93ce411ebcb808c5fb50cc63d

SHA256
14230cbb6fcabd799c0269723c0f77dc46d4b89789b3d8eba0920ea217548c5a

SHA512
e68a5df0a1a70f0a11127d071dc528dec43a0d7e34ae568b282f3ed888a674b8ae0c80c0714d7f04fdc4a2fe4e820ae4629bf3429be7ab606784d9107b9f8604

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\SDL2.dll

Filesize
981KB

MD5
97fdf81d1efaa5349e2684d6b8d6800b

SHA1
ee32a078a2d895890afbf55786eebe7963d7dad7

SHA256
edb4ddac5c18222177c61f2cdbbfe9a7bf5d995da0f11c662650dc8648dc6cc1

SHA512
32975506d0cf7f9b4fc4a1f569192d41d60106b558303e9bcf611b908cd019a1ab7b404cc757c89888e7870564671bb3984726d5e664795b1e4032773c6abb19

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\avcodec-58.dll

Filesize
30.0MB

MD5
4104f6ce0c03244245fa8514acd42750

SHA1
96d8952d7671f32cf01c942200f2093b00e7db20

SHA256
eb8a69d363a71aa1e2088e52fb8e290d7e5f086c9e349138ed074846a9c2fe39

SHA512
e13ecdf97595fa4cee6a6cdbf2609882035dbfe071918b86ea29f658ba4ecff79bc641e22fb1aa13f2e8d94412e30246c222a67defef823d26794d665cc229d5

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\avfilter-7.dll

Filesize
6.8MB

MD5
9633000349e44e076b7752bc1ca51817

SHA1
a5bd2e46329eab85c81b4ab4ca65fa978bf71cc1

SHA256
39a91796fafe9d2efc2cea0de239179a3a2d406ea482af310710e6f5fed00083

SHA512
665e619c270d36ddc9ceff33eb2eb7eca695454af86e606d210ad8586e59c0ea693fe6e7706e1c00e3f1060b1c44686461da2bfa5f3f5ce15110715fc824e29d

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\avformat-58.dll

Filesize
5.7MB

MD5
fe9ebd34a08c7435d9709356820edba2

SHA1
b8912f6d245d15d32c262af2f16af4ec65331cfa

SHA256
8d5c9d928e9a49e19458489a03ec4d6a3e608909f48cfd6157ba1c6623107718

SHA512
c3d429cf4e73c27548df303a29e8999d23dc4f40b0826e2aa71cb26298c18962c87041f471cb8ec369aa206377ef535047f8d6088d1c075de84c7eaa507b5de5

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\avutil-56.dll

Filesize
640KB

MD5
60b41052a192625213696e44c615214b

SHA1
eae79465da62b09ffbb9ea86caa09b82dd62a8e7

SHA256
5f6d92ea508b9c2b8836cc2a757e60657a424d7c40ccfc6edfb3cf66468ac0c3

SHA512
1b4f3c778a34c40850746a113567acefe97c0b45a21479abcfa8ffa81486b119214f1c0692d36589e34bc9dd0a42ba22c9e9127f508b073d64d7477fc21c9449

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\msvcp140.dll

Filesize
425KB

MD5
d4e9ae2301232a7599807ae02023187e

SHA1
af68af4f51c1affd0a8c29b3e707642636374583

SHA256
322af358aad037db8136623586e65fedbba3040b355f76ed34e7aa1763b2dc89

SHA512
5fe2cba77f0c285c519142a71cc1e6216b4ad78077aebf1c3f23e84e4b8fcd7f9cb6363668674869e3bd2c56ffd178b2c2d51725ab38e0a2338e5dc15d7d05f8

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\msvcp140_1.dll

Filesize
20KB

MD5
ca7c343e1f6ffdacd0818b9e46ad58a5

SHA1
9731858d1cc5f1c1ca3bb2253df8feb9a912b8f2

SHA256
87428634883461f50ef4dc812273dc8822cf608b32ef6f11bcc61223052c1ae1

SHA512
13602dbd97f41dfb32f9c2cb5fcc263fd2663667374372b4414f64f0f56191419a79e74add3286524710d1b75869933cd21c8d8401ff6df6d711dd8efc8800d9

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\platforms\qwindows.dll

Filesize
1.2MB

MD5
981f9dc4f537012d21aab34071896788

SHA1
58e0c4baf55f1908c6abf8f2b81fa5cab6a5c840

SHA256
334f317e5afd0b9cf05e85ba1c241e57cc84833658c6db04595c0f1accdfe69c

SHA512
d4327a401909fe8b0e9cf561c525a51fbd6e168cf6daf1513653c524b08d0fe12b9b2db588a3398ef1285e993cd3078a9d3770a676a001c61f3f358178266e5d

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\postproc-55.dll

Filesize
111KB

MD5
c01ef967c4b2954a35739856f8e3aad0

SHA1
6f1acdd12773fe915e7559ea8c82008c3590b336

SHA256
d90ac8ff8dee9bfbcc932d3751db1a55e62a5e507299d36849b0f31e38730f7f

SHA512
b12fe1fc23ccdc1ff4979e39adb06829fcb6dafa90522e4b3fe30787c2462af04adfaf4ab9724175cf5419c3417de184ac87afbe3e073edc458ee220c3218706

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\styles\qwindowsvistastyle.dll

Filesize
132KB

MD5
b65e3ef6042684b489d0cb2574b4d144

SHA1
98747aec7f187d03ee2604fca947744efcab0b99

SHA256
9fd317f3da3eee0d53dc78687aad61440dfbc30a0d42169be434731e11f423bb

SHA512
980a7e9a9265c275beeba3469a0e676bb68f0b18ee760b43c0b9ab9856a11cf23175d10b53532299e1f8c1f5b74aaace61352eef398b4307267812a698f0e008

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\swresample-3.dll

Filesize
304KB

MD5
d665e9827bb31204020df5f4ec23b3d4

SHA1
f579549db8ae38a792be3d0f88b8272d08165349

SHA256
886f99c2296f88014cf146a7a7453bedfaf7e650011fc5a6c01a2064bd8881e3

SHA512
36a5923bffefc6dabc627ff6e2c01c5e893c8b2650711ea6ec44a66e7d97a717244d702f0877be08d9ad6e691732a65d011253f0cf2dd4989b28f371473aec53

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\swscale-5.dll

Filesize
504KB

MD5
a377c134506f22f93a2e69fcb344acc6

SHA1
35017b15b9086a7918fe6c9b42fbc8de9cc70337

SHA256
71ab19a4d1b98e300f132de30fbf9af2f78b0a02d0900fed643915eb6eac1a69

SHA512
313c1203a16b1efd1ba40171d0c7185516e6413cdb184a66ab65bed99d671cd5209a845254fc0979331d836bbf195b1df350693cc4426f41b05de5a5fbe7682d

Download Submit
\Program Files (x86)\FunPlus\StormShot\1.0.0.61\vcruntime140.dll

Filesize
76KB

MD5
2cec885177f8e329a314f975806d0e3d

SHA1
942d6525d23833ac51af1fd0cb6c18f0aacc90fa

SHA256
e4989178cb90a65428bcb19b2f1d2c811ab66077b38c0645522d8669b176b99e

SHA512
210d12d8912341e1625bbc603060aaf37ded1fec58fe677b0f92dd5bdc89d1629f29b50f7e95985bda6c7f316790f753dee2305d154ae94f5ee7816886e91fb1

Download Submit
\Program Files (x86)\FunPlus\StormShot\Launcher.exe

Filesize
1.1MB

MD5
f00e8e76d59d70bbecf038a6babc85e8

SHA1
fc09a85c6dacbfc134d69cadecd05721f0530884

SHA256
737c2a6c7bab4cb87e10b17a4560fcf6b844971b1c36dc825ab249f7a751bbf4

SHA512
31f4fd6eb30c557b4bf8076fd9299dc01da5fd2a14fad07629ab9e5dc5f916a46a4699b33576f344b0e48f6b179f273f4cd29ffa333413b4f05f6a6f69488b36

Download Submit
\Program Files (x86)\FunPlus\StormShot\uninstall\unins000.exe

Filesize
3.7MB

MD5
0d01214bd640f58c27314047fb208967

SHA1
0e36fa03b123d5a12f4c81e16203a63463ebbef5

SHA256
01740e208bf37a32e665380ca4df335ce7e2b6a6a3dc8ab734a95eb4d6b3373e

SHA512
03c9c615440e2cfdd4c49ad88ff8046f6f7cd85381aa2d18f5593700292016a4559992c8b179c2d4fddc711c4c37859720c2e9620a3471de80fbb89be1f31327

Download Submit
\Users\Admin\AppData\Local\Temp\is-NTQNQ.tmp\st_4c9ef25b2f.tmp

Filesize
3.7MB

MD5
8373d4e62a94878ea1af40ca2fb5b1d2

SHA1
7ab8dbbd25b02ce053578d72ccb94723efaa802d

SHA256
e84e4ef7ae77f6c67c287a2c0bdb47d706ae37b2dce3ed18c6d45f7ab8c36777

SHA512
8071e53b1159f2e9e4405247fb4540f9da82be5de906c9fc255d12f517a5f7b69c0ba2df2ae11c86e7a96929bffaf7f72f9ca723e1bb9fcf6ebddbf2c48c65af

Download Submit
\Users\Admin\AppData\Local\Temp\is-V763A.tmp\FPXInstaller.dll

Filesize
1010KB

MD5
6ecddc274b977c787d3110c0e5048d9c

SHA1
ff5f024520f844da22359af2cb6a3d138bbc28d5

SHA256
11ebba6c0959ddbf7a82a6dfdf36777c8c91d38962a0fe052f50703bd2cd6b42

SHA512
5552f0198fff6189d27dcd985771f7f3617a74392b77a68946f5bdb7f67b6509add129d7524a9c8b017cd30a41d0e77df19e138abf8e03b203237cde4ba3f445

Download Submit
memory/2336-446-0x000000006C740000-0x000000006C83F000-memory.dmp

Filesize
1020KB

Download
memory/2336-442-0x0000000073B50000-0x0000000074223000-memory.dmp

Filesize
6.8MB

Download
memory/2336-409-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2336-448-0x0000000002E30000-0x0000000002E3A000-memory.dmp

Filesize
40KB

Download
memory/2336-433-0x0000000006030000-0x0000000006470000-memory.dmp

Filesize
4.2MB

Download
memory/2336-435-0x0000000006470000-0x0000000006670000-memory.dmp

Filesize
2.0MB

Download
memory/2336-437-0x0000000002E30000-0x0000000002E3A000-memory.dmp

Filesize
40KB

Download
memory/2336-438-0x0000000002E30000-0x0000000002E3A000-memory.dmp

Filesize
40KB

Download
memory/2336-439-0x0000000071090000-0x000000007384B000-memory.dmp

Filesize
39.7MB

Download
memory/2336-440-0x0000000074CD0000-0x0000000074D87000-memory.dmp

Filesize
732KB

Download
memory/2336-441-0x0000000074C20000-0x0000000074CA9000-memory.dmp

Filesize
548KB

Download
memory/2336-449-0x0000000002E30000-0x0000000002E3A000-memory.dmp

Filesize
40KB

Download
memory/2336-443-0x0000000070AD0000-0x000000007108F000-memory.dmp

Filesize
5.7MB

Download
memory/2336-444-0x0000000074BF0000-0x0000000074C14000-memory.dmp

Filesize
144KB

Download
memory/2336-445-0x00000000748F0000-0x000000007497E000-memory.dmp

Filesize
568KB

Download
memory/2336-447-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2716-24-0x0000000000400000-0x000000000059E000-memory.dmp

Filesize
1.6MB

Download
memory/2716-9-0x0000000000400000-0x000000000059E000-memory.dmp

Filesize
1.6MB

Download
memory/2716-364-0x0000000000400000-0x000000000059E000-memory.dmp

Filesize
1.6MB

Download
memory/2888-17-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2888-79-0x0000000000400000-0x00000000007C3000-memory.dmp

Filesize
3.8MB

Download
memory/2888-362-0x0000000000400000-0x00000000007C3000-memory.dmp

Filesize
3.8MB

Download