98dbc4970873c4081e26167f395c67613e49073ae3313aebf0cd2b6817558a5e

Analysis

max time kernel
138s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
17/01/2024, 23:16 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63dd4a4d622d588ce5cb1b2f574cb117.exe
Size

44KB
MD5

63dd4a4d622d588ce5cb1b2f574cb117
SHA1

166f59ad8f4ec5c62f5d75deffdaba324de2df98
SHA256

98dbc4970873c4081e26167f395c67613e49073ae3313aebf0cd2b6817558a5e
SHA512

0a46268eb5fce7f97d89a79a530d06b69f1b0d774ebd899d33b170dcd797ee13aa27091d831bb4a243ab795b153cc84badc65e667460e5e82a596533341271e7
SSDEEP

768:d9vFpUux6xYClVwmZWSbv0sRutZlQtY8r:dJUQIeSbvva0tBr

Score

8^/10

bootkit discovery persistence upx

Malware Config

Signatures

Downloads MZ/PE file

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0006000000023afa-2770.dat	acprotect

Executes dropped EXE 4 IoCs

pid	Process
2432	PPTV(pplive)_forqd339.exe
4716	PPAP.exe
820	PPAP.exe
876	IconBubble.exe

Loads dropped DLL 46 IoCs

pid	Process
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
4520	regsvr32.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
4716	PPAP.exe
4716	PPAP.exe
4716	PPAP.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
820	PPAP.exe
820	PPAP.exe
820	PPAP.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000023afa-2770.dat	upx
behavioral2/memory/2432-2775-0x00000000043B0000-0x00000000043C2000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PPAP = "\"C:\\Program Files (x86)\\Common Files\\PPLiveNetwork\\PPAP.exe\" -background"	PPTV(pplive)_forqd339.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	PPAP.exe
File opened for modification	\??\PhysicalDrive0	PPTV(pplive)_forqd339.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\kindling.dll	PPTV(pplive)_forqd339.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default\notop_down.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\previous_down.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\scrollbar_pageup_hover.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default\mute4_hover.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\chrome\push_pop.xml	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default\edu2_right.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default\max_down.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default\menu_hover.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default2\btn_info_disabled.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\passport_bot_bg_down.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\chrome\SkipAds.xml	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default2\hot_4.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\tab\1\1\2.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default\mute_normal.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\tab\8\3\2.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic\shift2new_down.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic\speed0.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default2\mypptv_on.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\brightness.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic\avatar_bg_s.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default2\close_hover.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default2\gbg_top.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default2\mypptv_arrow_disabled.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default2\titlebar_r.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default\bg_right_bot.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic\edu2_close_down.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\common\common\radio_checked_disabled.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\3xgiving\button_down.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\min_down.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\icons\PPTV.MP4.ico	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\arrow-default.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\list_epg_bk.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\resizemini1.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default\hot_3.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default2\resize1002.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default2\resize2001.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\chrome\PPGameFail.xml	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic\list_cate_new.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic\passport_bot_bg_hover.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default\mute4_disabled.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default2\frame_bottom_r.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default2\loading_list.gif	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\3xgiving\speed1.png	PPTV(pplive)_forqd339.exe
File opened for modification	C:\Program Files (x86)\Common Files\PPLiveNetwork\InstallLog.txt	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default\gbg_right.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default2\hj_expand.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\btn_screendisable.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\edu2_close_hover.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\tab\7\1\2.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default\resizeback.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default2\download_wait.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default2\small\play_hover.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\set_bg_right.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\chrome\CodecFail.xml.js	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic\max_down.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic\btn_screennormal.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\s_close_down.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default\gbg_left_bot.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\3xgiving\arrow-hover.png	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\3xgiving\exbg_top.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\3xgiving\strengthenbtn02.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default\exbg_right_top.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\default2\ex_button.bmp	PPTV(pplive)_forqd339.exe
File created	C:\Program Files (x86)\PPLive\PPTV\skins\3xgiving\gbg_left_top.bmp	PPTV(pplive)_forqd339.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0009000000022480-2.dat	nsis_installer_1
behavioral2/files/0x0009000000022480-2.dat	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{95B3F550-91C4-4627-BCC4-521288C52977}\Default Visible = "Yes"	PPTV(pplive)_forqd339.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{95B3F550-91C4-4627-BCC4-521288C52977}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"	PPTV(pplive)_forqd339.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CA7DFF65-E473-4efe-ADF0-FC1E50CDFC82}	PPAP.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Extensions\{95B3F550-91C4-4627-BCC4-521288C52977}	PPTV(pplive)_forqd339.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{95B3F550-91C4-4627-BCC4-521288C52977}\MenuText = "PPLive"	PPTV(pplive)_forqd339.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{95B3F550-91C4-4627-BCC4-521288C52977}\HotIcon = "C:\\Program Files (x86)\\PPLive\\PPTV\\icons\\PPLive.ico"	PPTV(pplive)_forqd339.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CA7DFF65-E473-4efe-ADF0-FC1E50CDFC82}\AppName = "PPAP.exe"	PPAP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{95B3F550-91C4-4627-BCC4-521288C52977}\ButtonText = "PPLive"	PPTV(pplive)_forqd339.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{95B3F550-91C4-4627-BCC4-521288C52977}\Icon = "C:\\Program Files (x86)\\PPLive\\PPTV\\icons\\PPLive.ico"	PPTV(pplive)_forqd339.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{95B3F550-91C4-4627-BCC4-521288C52977}\Exec = "C:\\Program Files (x86)\\PPLive\\PPTV\\PPLive.exe"	PPTV(pplive)_forqd339.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CA7DFF65-E473-4efe-ADF0-FC1E50CDFC82}\AppPath = "%CommonProgramFiles%\\PPLiveNetwork"	PPAP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CA7DFF65-E473-4efe-ADF0-FC1E50CDFC82}\Policy = "3"	PPAP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{95B3F550-91C4-4627-BCC4-521288C52977}\MenuStatusBar = "PPLive"	PPTV(pplive)_forqd339.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{377AC21C-4921-4C3F-9240-7756548790FB}\1.0\FLAGS	PPAP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF0D1A14-1033-41A2-A589-240C01EDC078}\TypeLib\ = "{6F770594-0FC9-44DB-AD75-47C808CB7B44}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{628DF9B1-785D-44BA-AC9D-E9E226F01987}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{579A418B-2440-4278-9CC1-25E85E1C9D09}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{579A418B-2440-4278-9CC1-25E85E1C9D09}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{377AC21C-4921-4C3F-9240-7756548790FB}\1.0	PPAP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB37F5E2-E5EC-4E8D-8978-420074EA4DC0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{579A418B-2440-4278-9CC1-25E85E1C9D09}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PPLive.Lite.1\ = "PPLive Lite Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MngModule.Manager.2\CLSID\ = "{CA7DFF65-E473-4efe-ADF0-FC1E50CDFC82}"	PPAP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6F770594-0FC9-44DB-AD75-47C808CB7B44}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA7DFF65-E473-4efe-ADF0-FC1E50CDFC82}\ = "Manager Class"	PPAP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{04987413-5E4A-472F-9899-0A092233239E}\TypeLib\ = "{377AC21C-4921-4C3F-9240-7756548790FB}"	PPAP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04987413-5E4A-472F-9899-0A092233239E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	PPAP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Synacast\InstallerName = "PPTV(pplive)_forqd339"	PPTV(pplive)_forqd339.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF0D1A14-1033-41A2-A589-240C01EDC078}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ifupt.Update.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{579A418B-2440-4278-9CC1-25E85E1C9D09}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Synacast\Shell\Open\Command	PPTV(pplive)_forqd339.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ifupt.Update\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pptv\Shell	PPTV(pplive)_forqd339.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA7DFF65-E473-4efe-ADF0-FC1E50CDFC82}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\PPLiveNetwork\\MngModule.dll"	PPAP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF0D1A14-1033-41A2-A589-240C01EDC078}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF0D1A14-1033-41A2-A589-240C01EDC078}\Insertable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6F770594-0FC9-44DB-AD75-47C808CB7B44}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{628DF9B1-785D-44BA-AC9D-E9E226F01987}\TypeLib\ = "{6F770594-0FC9-44DB-AD75-47C808CB7B44}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB37F5E2-E5EC-4E8D-8978-420074EA4DC0}\ProgID\ = "Ifupt.DPlugin.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6F770594-0FC9-44DB-AD75-47C808CB7B44}\1.0\0\win32\ = "C:\\Program Files (x86)\\Internet Explorer\\PPLite\\plugin\\pplugin2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA7DFF65-E473-4efe-ADF0-FC1E50CDFC82}\ProgID	PPAP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA7DFF65-E473-4efe-ADF0-FC1E50CDFC82}\VersionIndependentProgID\ = "MngModule.Manager.2"	PPAP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF0D1A14-1033-41A2-A589-240C01EDC078}\ProgID\ = "PPLive.Lite.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF0D1A14-1033-41A2-A589-240C01EDC078}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C016F89-DC77-481D-A82F-A5345DFB7FB8}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA7DFF65-E473-4efe-ADF0-FC1E50CDFC82}	PPAP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA7DFF65-E473-4efe-ADF0-FC1E50CDFC82}\LocalServer32\ = "C:\\Program Files (x86)\\Common Files\\PPLiveNetwork\\PPAP.exe"	PPAP.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB37F5E2-E5EC-4E8D-8978-420074EA4DC0}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C016F89-DC77-481D-A82F-A5345DFB7FB8}\ = "_IEwaOCXEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB37F5E2-E5EC-4E8D-8978-420074EA4DC0}\VersionIndependentProgID\ = "Ifupt.DPlugin"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA7DFF65-E473-4efe-ADF0-FC1E50CDFC82}\ProgID\ = "MngModule.Manager.2"	PPAP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6F770594-0FC9-44DB-AD75-47C808CB7B44}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C016F89-DC77-481D-A82F-A5345DFB7FB8}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{579A418B-2440-4278-9CC1-25E85E1C9D09}\ = "IEwaOCX"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF0D1A14-1033-41A2-A589-240C01EDC078}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E62D3029-1430-49F8-9470-2A192B02E433}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA7DFF65-E473-4efe-ADF0-FC1E50CDFC82}\InprocServer32	PPAP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA7DFF65-E473-4efe-ADF0-FC1E50CDFC82}\TypeLib	PPAP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{203AFF7C-C6A8-46F5-B32C-C6A7F4E79A62}\ = "_IManagerEvents"	PPAP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF0D1A14-1033-41A2-A589-240C01EDC078}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB37F5E2-E5EC-4E8D-8978-420074EA4DC0}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB37F5E2-E5EC-4E8D-8978-420074EA4DC0}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ppl\Version = "2.7.3"	PPTV(pplive)_forqd339.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pptv\URL Protocol	PPTV(pplive)_forqd339.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{203AFF7C-C6A8-46F5-B32C-C6A7F4E79A62}\ = "_IManagerEvents"	PPAP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF0D1A14-1033-41A2-A589-240C01EDC078}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E62D3029-1430-49F8-9470-2A192B02E433}\ = "Update Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB37F5E2-E5EC-4E8D-8978-420074EA4DC0}\InprocServer32\ = "C:\\Program Files (x86)\\Internet Explorer\\PPLite\\plugin\\pplugin2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA7DFF65-E473-4efe-ADF0-FC1E50CDFC82}\LocalServer32	PPAP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{203AFF7C-C6A8-46F5-B32C-C6A7F4E79A62}\TypeLib\ = "{377AC21C-4921-4C3F-9240-7756548790FB}"	PPAP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PPLive.Lite\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ifupt.DPlugin.1\CLSID\ = "{AB37F5E2-E5EC-4E8D-8978-420074EA4DC0}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Synacast\Custom = "qd-all-slient-open-nlaunch-nscreen"	PPTV(pplive)_forqd339.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB37F5E2-E5EC-4E8D-8978-420074EA4DC0}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6F770594-0FC9-44DB-AD75-47C808CB7B44}\1.0\ = "pplugin 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ppl\URL Protocol	PPTV(pplive)_forqd339.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3096	63dd4a4d622d588ce5cb1b2f574cb117.exe
3096	63dd4a4d622d588ce5cb1b2f574cb117.exe
3096	63dd4a4d622d588ce5cb1b2f574cb117.exe
3096	63dd4a4d622d588ce5cb1b2f574cb117.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe
2432	PPTV(pplive)_forqd339.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 2432	3096	63dd4a4d622d588ce5cb1b2f574cb117.exe	89
PID 3096 wrote to memory of 2432	3096	63dd4a4d622d588ce5cb1b2f574cb117.exe	89
PID 3096 wrote to memory of 2432	3096	63dd4a4d622d588ce5cb1b2f574cb117.exe	89
PID 2432 wrote to memory of 4520	2432	PPTV(pplive)_forqd339.exe	90
PID 2432 wrote to memory of 4520	2432	PPTV(pplive)_forqd339.exe	90
PID 2432 wrote to memory of 4520	2432	PPTV(pplive)_forqd339.exe	90
PID 2432 wrote to memory of 4716	2432	PPTV(pplive)_forqd339.exe	99
PID 2432 wrote to memory of 4716	2432	PPTV(pplive)_forqd339.exe	99
PID 2432 wrote to memory of 4716	2432	PPTV(pplive)_forqd339.exe	99
PID 2432 wrote to memory of 820	2432	PPTV(pplive)_forqd339.exe	100
PID 2432 wrote to memory of 820	2432	PPTV(pplive)_forqd339.exe	100
PID 2432 wrote to memory of 820	2432	PPTV(pplive)_forqd339.exe	100
PID 2432 wrote to memory of 876	2432	PPTV(pplive)_forqd339.exe	101
PID 2432 wrote to memory of 876	2432	PPTV(pplive)_forqd339.exe	101
PID 2432 wrote to memory of 876	2432	PPTV(pplive)_forqd339.exe	101
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63
PID 876 wrote to memory of 3524	876	IconBubble.exe	63

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3524
- C:\Users\Admin\AppData\Local\Temp\63dd4a4d622d588ce5cb1b2f574cb117.exe
  "C:\Users\Admin\AppData\Local\Temp\63dd4a4d622d588ce5cb1b2f574cb117.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\PPTV(pplive)_forqd339.exe
    "C:\\PPTV(pplive)_forqd339.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Writes to the Master Boot Record (MBR)
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Program Files (x86)\Internet Explorer\PPLite\plugin\pplugin2.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:4520
  - - C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe
      "C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" /RegServer
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies Internet Explorer settings
      Modifies registry class
      PID:4716
  - - C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe
      "C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" /LoadModule MngModule.dll /T 1 /C forqd339 /F 0 /G 2.7.3 /H 1 /I PPTV(pplive)_forqd339 /L 0 /M OK /N 1 /O 1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Writes to the Master Boot Record (MBR)
      PID:820
  - - C:\Program Files (x86)\PPLive\PPTV\IconBubble.exe
      "C:\Program Files (x86)\PPLive\PPTV\IconBubble.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:876

Network

DNS

download.pplive.com

63dd4a4d622d588ce5cb1b2f574cb117.exe

Remote address:

8.8.8.8:53

Request

download.pplive.com

IN A

Response

download.pplive.com

IN CNAME

njgxlvs-dl.gslb.pptv.com

njgxlvs-dl.gslb.pptv.com

IN A

58.215.136.250

njgxlvs-dl.gslb.pptv.com

IN A

58.215.136.251
GET

http://download.pplive.com/PPTV(pplive)_forqd339.exe

63dd4a4d622d588ce5cb1b2f574cb117.exe

Remote address:

58.215.136.250:80

Request

GET /PPTV(pplive)_forqd339.exe HTTP/1.1
Accept: */*
User-Agent: Agentcc
Host: download.pplive.com
Cache-Control: no-cache

Response

HTTP/1.1 301 Moved Permanently

Server: styx
Date: Wed, 17 Jan 2024 23:16:28 GMT
Content-Type: text/html
Content-Length: 177
Connection: keep-alive
Location: http://ossapp.suning.com/pcoss/dl/PPTV(pplive)_forqd339.exe
DNS

ossapp.suning.com

63dd4a4d622d588ce5cb1b2f574cb117.exe

Remote address:

8.8.8.8:53

Request

ossapp.suning.com

IN A

Response

ossapp.suning.com

IN CNAME

snpub.suning.com

snpub.suning.com

IN CNAME

webimgsnipv46.suninggslb.cn

webimgsnipv46.suninggslb.cn

IN CNAME

btdhttppubv46.suning.com.volcgslb.com

btdhttppubv46.suning.com.volcgslb.com

IN CNAME

sx-common-all.volcgtm.com

sx-common-all.volcgtm.com

IN A

113.219.195.214

sx-common-all.volcgtm.com

IN A

115.54.23.191

sx-common-all.volcgtm.com

IN A

116.162.28.219

sx-common-all.volcgtm.com

IN A

116.162.51.162

sx-common-all.volcgtm.com

IN A

119.36.90.133

sx-common-all.volcgtm.com

IN A

119.96.78.12

sx-common-all.volcgtm.com

IN A

120.226.34.135

sx-common-all.volcgtm.com

IN A

120.226.192.100

sx-common-all.volcgtm.com

IN A

123.6.65.100

sx-common-all.volcgtm.com

IN A

123.6.72.100

sx-common-all.volcgtm.com

IN A

123.53.183.132

sx-common-all.volcgtm.com

IN A

175.6.201.100

sx-common-all.volcgtm.com

IN A

111.174.12.100

sx-common-all.volcgtm.com

IN A

113.219.144.86

sx-common-all.volcgtm.com

IN A

113.219.164.219
GET

http://ossapp.suning.com/pcoss/dl/PPTV(pplive)_forqd339.exe

63dd4a4d622d588ce5cb1b2f574cb117.exe

Remote address:

113.219.195.214:80

Request

GET /pcoss/dl/PPTV(pplive)_forqd339.exe HTTP/1.1
Accept: */*
User-Agent: Agentcc
Cache-Control: no-cache
Host: ossapp.suning.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: Byte-nginx
Content-Type: application/octet-stream
Content-Length: 11553192
Connection: keep-alive
Accept-Ranges: bytes
Age: 2127597
Cache-Control: max-age=7776000
Content-Disposition: filename="PPTV(pplive)_forqd339.exe"
Etag: ec4db5e4
Last-Modified: Fri, 15 Jan 2021 03:33:22 GMT
Requestid: MTAuMTA4LjQ2LjE1Nzo6ODg4OHwxNzAzNDA1NzkyfDI4NjgzNzQwMQ==
Strict-Transport-Security: max-age=300
X-Bdcdn-Cache-Status: TCP_HIT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Request-Id: 705fd697a2071608ea6e16329b9ca067
X-Request-Ip: 89.149.23.59
X-Response-Cache: edge_hit
X-Response-Cinfo: 89.149.23.59
X-Sdoss-Expiration:
X-Sdoss-Request-Id: MTAuMTA4LjQ2LjE1Nzo6ODg4OHwxNzAzNDA1NzkyfDI4NjgzNzQwMQ==
X-Tt-Trace-Tag: id=5
X-Xss-Protection: 1; mode=block
Date: Wed, 17 Jan 2024 23:16:29 GMT
via: cache08.csct
DNS

250.136.215.58.in-addr.arpa

Remote address:

8.8.8.8:53

Request

250.136.215.58.in-addr.arpa

IN PTR

Response
DNS

214.195.219.113.in-addr.arpa

Remote address:

8.8.8.8:53

Request

214.195.219.113.in-addr.arpa

IN PTR

Response
DNS

241.150.49.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.150.49.20.in-addr.arpa

IN PTR

Response
DNS

9.134.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

9.134.221.88.in-addr.arpa

IN PTR

Response

9.134.221.88.in-addr.arpa

IN PTR

a88-221-134-9deploystaticakamaitechnologiescom
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

133.211.185.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.211.185.52.in-addr.arpa

IN PTR

Response
DNS

ins-version.pplive.com

PPTV(pplive)_forqd339.exe

Remote address:

8.8.8.8:53

Request

ins-version.pplive.com

IN A

Response
DNS

157.123.68.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

157.123.68.40.in-addr.arpa

IN PTR

Response
DNS

206.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.23.85.13.in-addr.arpa

IN PTR

Response
DNS

217.135.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

217.135.221.88.in-addr.arpa

IN PTR

Response

217.135.221.88.in-addr.arpa

IN PTR

a88-221-135-217deploystaticakamaitechnologiescom
DNS

ins.pplive.com

PPTV(pplive)_forqd339.exe

Remote address:

8.8.8.8:53

Request

ins.pplive.com

IN A

Response

ins.pplive.com

IN CNAME

ins.pplive.com.suninggslb.cn

ins.pplive.com.suninggslb.cn

IN CNAME

sptyweb.suninggslb.cn

sptyweb.suninggslb.cn

IN CNAME

btdhttppub.pptv.com.volcgslb.com

btdhttppub.pptv.com.volcgslb.com

IN CNAME

ovx-common.bpltm.com

ovx-common.bpltm.com

IN A

143.244.38.1

ovx-common.bpltm.com

IN A

143.244.38.2
GET

http://ins.pplive.com/config/pptv/qd-all-slient-open-nlaunch-nscreen/forqd339/bind_en-us.ini

PPTV(pplive)_forqd339.exe

Remote address:

143.244.38.1:80

Request

GET /config/pptv/qd-all-slient-open-nlaunch-nscreen/forqd339/bind_en-us.ini HTTP/1.1
User-Agent: NSIS_InetLoad (Mozilla)
Host: ins.pplive.com
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: Byte-nginx
Content-Type: text/plain;charset=gb2312
Content-Length: 0
Connection: keep-alive
Age: 31
Cache-Control: max-age=3600
Expires: Thu, 18 Jan 2024 00:16:28 GMT
Last-Modified: Wed, 17 Jan 2024 23:16:28 GMT
Pragma: public
Set-Cookie: _snstyxuid=FD148C52AE88U7WW; domain=.pplive.com; path=/; expires=Thu, 18-Jan-24 00:16:28 GMT
Vary: Accept-Encoding
X-Bdcdn-Cache-Status: TCP_HIT
X-Request-Id: 59667161e7b7a15ce21c01accf431ba4
X-Request-Ip: 89.149.23.59
X-Response-Cache: edge_hit
X-Response-Cinfo: 89.149.23.59
X-Tt-Trace-Tag: id=5
Date: Wed, 17 Jan 2024 23:16:59 GMT
via: mixed01.oversea-UK-LON1
DNS

1.38.244.143.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.38.244.143.in-addr.arpa

IN PTR

Response

1.38.244.143.in-addr.arpa

IN PTR

unn-143-244-38-1 datapacketcom
DNS

h.synacast.com

PPAP.exe

Remote address:

8.8.8.8:53

Request

h.synacast.com

IN A

Response

h.synacast.com

IN CNAME

data.gslb.pptv.com

data.gslb.pptv.com

IN CNAME

data1.gslb.pptv.com

data1.gslb.pptv.com

IN A

36.155.192.113

data1.gslb.pptv.com

IN A

58.215.136.112

data1.gslb.pptv.com

IN A

58.215.136.113

data1.gslb.pptv.com

IN A

36.155.192.112
DNS

41.134.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

41.134.221.88.in-addr.arpa

IN PTR

Response

41.134.221.88.in-addr.arpa

IN PTR

a88-221-134-41deploystaticakamaitechnologiescom
DNS

85.65.42.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

85.65.42.20.in-addr.arpa

IN PTR

Response

58.215.136.250:80

http://download.pplive.com/PPTV(pplive)_forqd339.exe

http

63dd4a4d622d588ce5cb1b2f574cb117.exe

405 B
575 B
6
4

HTTP Request

GET http://download.pplive.com/PPTV(pplive)_forqd339.exe

HTTP Response

301
113.219.195.214:80

http://ossapp.suning.com/pcoss/dl/PPTV(pplive)_forqd339.exe

http

63dd4a4d622d588ce5cb1b2f574cb117.exe

555.6kB
11.9MB
8526
8520

HTTP Request

GET http://ossapp.suning.com/pcoss/dl/PPTV(pplive)_forqd339.exe

HTTP Response

200
143.244.38.1:80

http://ins.pplive.com/config/pptv/qd-all-slient-open-nlaunch-nscreen/forqd339/bind_en-us.ini

http

PPTV(pplive)_forqd339.exe

426 B
780 B
5
3

HTTP Request

GET http://ins.pplive.com/config/pptv/qd-all-slient-open-nlaunch-nscreen/forqd339/bind_en-us.ini

HTTP Response

200
36.155.192.113:80

h.synacast.com

PPAP.exe

260 B
5
58.215.136.112:80

h.synacast.com

PPAP.exe

260 B
5
58.215.136.113:80

h.synacast.com

PPAP.exe

260 B
5

8.8.8.8:53

download.pplive.com

dns

63dd4a4d622d588ce5cb1b2f574cb117.exe

65 B
132 B
1
1

DNS Request

download.pplive.com

DNS Response

58.215.136.250

58.215.136.251
8.8.8.8:53

ossapp.suning.com

dns

63dd4a4d622d588ce5cb1b2f574cb117.exe

63 B
448 B
1
1

DNS Request

ossapp.suning.com

DNS Response

113.219.195.214

115.54.23.191

116.162.28.219

116.162.51.162

119.36.90.133

119.96.78.12

120.226.34.135

120.226.192.100

123.6.65.100

123.6.72.100

123.53.183.132

175.6.201.100

111.174.12.100

113.219.144.86

113.219.164.219
8.8.8.8:53

250.136.215.58.in-addr.arpa

dns

73 B
122 B
1
1

DNS Request

250.136.215.58.in-addr.arpa
8.8.8.8:53

214.195.219.113.in-addr.arpa

dns

74 B
162 B
1
1

DNS Request

214.195.219.113.in-addr.arpa
8.8.8.8:53

241.150.49.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

241.150.49.20.in-addr.arpa
8.8.8.8:53

9.134.221.88.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

9.134.221.88.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

133.211.185.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

133.211.185.52.in-addr.arpa
8.8.8.8:53

ins-version.pplive.com

dns

PPTV(pplive)_forqd339.exe

68 B
135 B
1
1

DNS Request

ins-version.pplive.com
8.8.8.8:53

157.123.68.40.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

157.123.68.40.in-addr.arpa
8.8.8.8:53

206.23.85.13.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

206.23.85.13.in-addr.arpa
8.8.8.8:53

217.135.221.88.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

217.135.221.88.in-addr.arpa
8.8.8.8:53

ins.pplive.com

dns

PPTV(pplive)_forqd339.exe

60 B
230 B
1
1

DNS Request

ins.pplive.com

DNS Response

143.244.38.1

143.244.38.2
8.8.8.8:53

1.38.244.143.in-addr.arpa

dns

71 B
116 B
1
1

DNS Request

1.38.244.143.in-addr.arpa
8.8.8.8:53

h.synacast.com

dns

PPAP.exe

60 B
173 B
1
1

DNS Request

h.synacast.com

DNS Response

36.155.192.113

58.215.136.112

58.215.136.113

36.155.192.112
8.8.8.8:53

41.134.221.88.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

41.134.221.88.in-addr.arpa
8.8.8.8:53

85.65.42.20.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

85.65.42.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PPTV(pplive)_forqd339.exe

Filesize
11.0MB

MD5
1748355f3c629e3394d0e95d1a3d84f7

SHA1
3bfa087161217212df6728cf5165f24c832d4269

SHA256
d29ea43858cb2bef5ab94bece6051f25904de513e8199ec48a27fd1fb0797455

SHA512
281db8e2a9af15b83cc0eacc9d09b5aede3b132518c00ac65a5023905f93a7a53654023b6cf6e7bed605a634ab71206824532cc527cefeb32b20c85eba94b1b8

Download Submit
C:\Program Files (x86)\Common Files\PPLiveNetwork\MngModule.dll

Filesize
970KB

MD5
0f11eec6f0277db75f8673907911223e

SHA1
d5fe27ed211f9484af386ac66b051a473aa2ccac

SHA256
a2f97b83d51f32958ba3c98a942bd2e945714df079b5982d07b7c33b615319bd

SHA512
6d9f09c2df288ebcdf57c64a6a1e22a5e3de79b58966467f162f480462b2c7a4048c4a335f98c371913ee5ce8b7fe0ebb50d1ec42fb8dd062b8d5c3d718419b6

Download Submit
C:\Program Files (x86)\Common Files\PPLiveNetwork\product.ini

Filesize
208B

MD5
7c6b15d3bbba0df9acf839939109d111

SHA1
2543afc6e8331705a9da76d7e71fcef5e3815e00

SHA256
e22ed42069c8909e520aeccf0c32ab5b55ee3b18ccd6358a0dfe08f040205f72

SHA512
a75b9fbb74d3708c489bcd76d7c5e9ea4c87d7b3ec57859a6858b79a6fac787deda7303eb65a3366c3f7ec61a5729066b0dbcef814d23bbc4be9ea187a24b08b

Download Submit
C:\Program Files (x86)\Common Files\PPLiveNetwork\sqlite3.dll

Filesize
504KB

MD5
b8a7b1f27c5d6b29ca363671307d8ec9

SHA1
5f190843d7bdbfbf86805d36003479df24b3a9cc

SHA256
4b55e4fae8b9d12c8ef971f037bc37c5e592fa3382bd5e4a08d2b3ddd112b559

SHA512
e7bd5c77078fe64478ca821fae29b550febdd5833d496a3d479ea4afc63822b55d81f2da2dc65b9f194edb019d4dfc951ad4af2ad970ff4b74a123ccddc3c8ea

Download Submit
C:\Program Files (x86)\Internet Explorer\PPLite\plugin\pplugin2.dll

Filesize
245KB

MD5
7ad3dd1b506f0ea9ca66c587bc11f250

SHA1
bfe05398095ff0f89b7a02e34106a11b6acaba14

SHA256
bdd7ba5a788448cac3cf5a2cc056dcddb1fed05e4339d99df8a21b1642bd2b9c

SHA512
acba06a420f5a32e12c2949583412f657745ddc38f33abd001de4bcfed6e82f941fe0a334d0c03e72af00336ba3da2e35521a9ca69bb06214321c8eb34b24d6c

Download Submit
C:\Program Files (x86)\PPLive\PPTV\GdiPlus.dll

Filesize
1.7MB

MD5
0c38476c6e51c95144f648b78fb579d8

SHA1
1a85ebc7203e7f0dc5297e6c5a056d52d45c447c

SHA256
04495ada069d6d176f14115738782cc8660c575e90046919a02792c274260f02

SHA512
5800fd07a1ab41a14aa1d413d0d2e54583e61086937bbc6b9b8901726f6944fb75fabc45ef1ae44ca9a0b00240c5df50a8a826ce7f2a33581ec21f9fd47be8d1

Download Submit
C:\Program Files (x86)\PPLive\PPTV\IconBubble.exe

Filesize
141KB

MD5
10b1f471b515d61bd7222b177cc3a3f3

SHA1
86daf1f57f30f2c6b4dde3046c7fa2f0aafebdc6

SHA256
381373f003328da3e07e8a2828161ae360f036d2881c9a5bf34c7b08c3754837

SHA512
d078a8ce2dac4d6baf16b6acbb2b64d8d5f3f91aa3c5610faaf1dfbadff3bf437c95d0dca82436f4e7dada5e3638e6a9a629b731a566b7af8bdbd0130398bbbf

Download Submit
C:\Program Files (x86)\PPLive\PPTV\PPLive.exe

Filesize
429KB

MD5
dd81a3a96c4394441968724ff84b3ba5

SHA1
0d693baf3072b57b9583c1e4bce640d7b96db90d

SHA256
fde74bb7f920835d2abc40fe45b3c5f7ec2ece0160575ebbe5bf496f2d8ee2d1

SHA512
a81d91a023f3f1d0224b232efe40dc6865ccf5c2ba05204b8867fc1eeb4df4c6e35fe36a87a4ca7548f05badd0e8e3ce5e04b20f4bdde0df617744c1b6d53b1a

Download Submit
C:\Program Files (x86)\PPLive\PPTV\PPP.dll

Filesize
723KB

MD5
9c95a89d6a0285a3805929ef8cbe498d

SHA1
a4c6b422c5c48bf4bb9065682d6f47d379ee896f

SHA256
3736e24bc36df9eedf8b4309852d467bcb8e9b1b65f85035603f37865cfdc7a1

SHA512
2ce43499313bf208ec6e1672d343b6853440acf72418c4fa7b1f28997e813a2fd5dc3c0e63cab8c12747b9be792ef3df91a219785824a477d625ab83a6b58872

Download Submit
C:\Program Files (x86)\PPLive\PPTV\crashreporter.exe

Filesize
193KB

MD5
05f960cb9448bb0c86698cde29912484

SHA1
b190a9aca1e84088ba884e56350d813af1b89eb6

SHA256
37bc466f71dfcd28152724b3ebf09aa70b6c5e15b34c6f3dee6214c125ba0b93

SHA512
9aff5ae6ff602738f17bf1e03cb0e4afeb6e6d01f375efc1ec7cbf03230dcb26bdcc573259d8a561ff31f037b1605e38fcd733ccf526d861847d37d1bb13dd0a

Download Submit
C:\Program Files (x86)\PPLive\PPTV\player\CoreAAC.ax

Filesize
312KB

MD5
b0ffac757be8d6cc41e1131eb2b0d959

SHA1
0e41733a050bc2ed53fda6337d6501b9942317c2

SHA256
04bf38bbd9cb8287582f9a2fb8b06e0ab30f06f676a93f4a56656b576f10e597

SHA512
356ecf4902f767f74670e5fcd57f26fb8a43710d0a2b3a995877e6f265119b2f091c6e5e3457dfa1767c6e4043afc470cc7090f43dd997b27c0e94c7e102bee3

Download Submit
C:\Program Files (x86)\PPLive\PPTV\player\CoreAVC.2.0.0.0.ax

Filesize
265KB

MD5
a45cfb1f058297ae981f8afeef056b8d

SHA1
e454ed585a0f19d3119cef725958ea19c93cd7cf

SHA256
779768aa0bf2270422e1686547ae622238e7b7cf37ce212a1d75caf8628c1508

SHA512
efa87c97e4f76d5fbd73d2e0c5c580c719518d4e3e7e16efdb1355b659c9584956bc7df944f0d637f069f359a046fe65bfd178e4cbaf97fbb5921ebd29e09aa0

Download Submit
C:\Program Files (x86)\PPLive\PPTV\player\CoreAVC.ax

Filesize
181KB

MD5
c264fed121afd44bda8bf0ff8f4e4269

SHA1
7480a3b26b81045a1504e68e15225682bcc6f440

SHA256
cb8d9d80dcd48d9a9e3d87c847c47125f7201a98fb5abb4bd6c443322071b951

SHA512
99ed4b723b2b7a90fce8e9bf9ee8d5a1440c4d569638ff6a1aa59354c8bca91618a13c440f754fad3ae22c306709da35b4c53b8a00a09753027eaed0d238052b

Download Submit
C:\Program Files (x86)\PPLive\PPTV\player\HTTP_ASF_SOURCE.ax

Filesize
511KB

MD5
2ca0666cb7eebc4f31d1b1cd5567defa

SHA1
57937bc69d62e8405742137b94172b129274c77d

SHA256
5ccfce12fdeb592955cd14154446374a547864a6b5ef1a5a5d9cd801121a0128

SHA512
bac83324d390f961aec228ddee702a0709e9e59501500592e8fc5f30e0236719836b86c880e9cc90af3747c2b23dcce7ce1b7b29121740c82a0b9fb8fc086e41

Download Submit
C:\Program Files (x86)\PPLive\PPTV\player\MP4Splitter.ax

Filesize
509KB

MD5
bb01bfdc1bfe48cf9c18180bf6539917

SHA1
25d0a11d31857fef74e9b98dcabd96f24d89c774

SHA256
050649bb8dc43e68753de7567e17972cbcec1a2dacf243befeb12dc51517f7cc

SHA512
f4fa00923ee61f0fcb53c8ebfd65b27db54a7663e5d60d8a56f7d08f33e2e1c467aa0b58899fbd62ac2261b185655cc94bac9ce85e2ed3b0c32336daa5346ba5

Download Submit
C:\Program Files (x86)\PPLive\PPTV\player\OPlayer.ocx

Filesize
1.1MB

MD5
1ad3ffc6af95217cf4c2a122d31b008e

SHA1
2fd5962c154f37e2eb065f95bace312a5eb2aae5

SHA256
876154f60b727d34d83ac0e39111daf09ca6a9f60160b163fd821996b2f3c914

SHA512
6321b36dff3f746ed2a84a5ec5c048c40a1943de5530d6d2895b94157746cd8c3d1735f5ae1b0a2b8f9795be6a3e5bd58e9be09c80981e27bb5905099bcc45ff

Download Submit
C:\Program Files (x86)\PPLive\PPTV\player\VSFilter.dll

Filesize
1.0MB

MD5
b39dc3255554f143f09b72307386e588

SHA1
845ff5d11441fc228c023ab303412e34832649a2

SHA256
b1b4ea22e2ef42f451c96520374338b0de53b36880c66f3b946294cc0e6117e0

SHA512
482e3a4e11db48f824f909c8f7218f62df752d60f9319890c8996df148d2e3bfd92fad7f0223be9a56675a8981f9ffefbd8e2066179da35f214b7fca77d91fdc

Download Submit
C:\Program Files (x86)\PPLive\PPTV\player\audioswitcher.ax

Filesize
304KB

MD5
9ab21c1c96fcb113ff93cd641b88112e

SHA1
d5ffe5945ebbeaf73a0e1d7470d0a2f72b08f6ff

SHA256
bff1bf09ff63a3fd600cbf36684aa01da6a08b63498ae549b15f0964572c3ea6

SHA512
44cf7f6d8e51aa6c8d98f1c5456c391fe812d6df4c6b68450d0ba4ee920e86a22433f22ee3f367a8f1183c0276fbe0eaeb2de7987ac9acf51f542a0a84451293

Download Submit
C:\Program Files (x86)\PPLive\PPTV\restore.dll

Filesize
131KB

MD5
a38f927758155d12f23a2a6a8a1ce9db

SHA1
6dd7276659dea0a8b683516241f9cfed0afd1ff8

SHA256
07271afceea12e449baf356274f06c620c93b9d69171ae48daff459668574b1a

SHA512
b7ebcbe0a1619cbaa9e7f63227b26df5d790a2ebc86c09e774c19510f64bde418731ac40aa8776786822d86e90317b0d67ba9671b56a32c24a20a90791c372e5

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\3xgiving\btn_close_1.bmp

Filesize
2KB

MD5
760a135b6c9b225139660b8bb687f9e3

SHA1
78d9f8948c3f702d7fd4384ebe38801175c2ef2c

SHA256
d234a4a183498ecbca5f75960448f75de356f421be25a8497785bb635be148fd

SHA512
b8d54c79b418eb5c11025e998eaca08835aeac45012565d5d938b958350ecd8fa682116d5337dfe241369461a7988ce6f0e1ca3f264a451ad1fc2a2ba39c2dd0

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\3xgiving\btn_close_2.bmp

Filesize
2KB

MD5
33dff70c70ecf484777c322e8b8c31b5

SHA1
005db5d56fda6b6e3365b41f2c243221312380e3

SHA256
9aee0eca6a855b68c7e081796c5ce9d97bc71e71d17ff34f9905e8ee58f8bdd9

SHA512
68552d2003c297f29ebcab422585a57391ec194212ca21b59e30f8514b7a986a37e6c016d97aafcb6bd89d852de62d42d04320242bf84b14bafa456246159c8e

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\3xgiving\btn_close_3.bmp

Filesize
2KB

MD5
cec7f94682f9cb1bd8b34b243751d273

SHA1
de8ffc735c3c125d4c203f2ef5418b6112c44ebb

SHA256
6eac094e2e711075cd6134e4750b75768ccd8f7791b7e7d7e028b6a53c0eb212

SHA512
fcf44e86f6a6ff21fc747749f24087581ef28211eb407911e86037cf94dd98cdc802027befd6bc1e327e274aafee98454a6d27163d9468603fe6a7771f80e063

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\3xgiving\btn_min_1.bmp

Filesize
2KB

MD5
8ebf8173247c0b0bf193305aaa3ebb5e

SHA1
ff8f59e8a53f1b300d6179ac122ad35bb5f83c4c

SHA256
9bf80417f9cace7d9514fdc5da22551d244231caaad47c357eb9e1bc8e4fd82e

SHA512
7532ad5c493a5c6607415c8b3e51fbb80c391217c17c88724294e8bf9afe40964a970749b3bbbccb7d9661d90169302056d94437b38eefa8128c32b3da38976b

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\3xgiving\btn_min_2.bmp

Filesize
2KB

MD5
7e1b657aa377af26f9a9301cebe769da

SHA1
b9ff3bf6066aaff57bb046ce088247fa446b9a28

SHA256
ad73e5086f32dfa2a194fc674c78794bd7d91b40cf27c5955251ccdd237d5baa

SHA512
8e792d622b0faa883549b26f4a655330c718f40867717096d3f5cde43bd415f2c473e3dd92ca2429d290c58a6a44ee0ba5c74de4b49ea896d17f75a7bf6d3174

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\3xgiving\btn_min_3.bmp

Filesize
2KB

MD5
3bee2423bbff84c509592511a01c268d

SHA1
263a9b856fc616234c6a92c9e4e846da0f6ab161

SHA256
5b9c20ec21d779783985c31900f2830245827c5749f497bb6e2dce6c241ae8bd

SHA512
bf1a45680b2fcabb254c7e9a18ac208f3b1573399e17fd5ec35efa877a1b7753d97f3153803a92c27dfa95028da1e46fe982753b82fddc5f7da8a737c0683a55

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\3xgiving\list_livebtn.png

Filesize
890B

MD5
ca6696b2c20ccc81426e35681dbe872a

SHA1
1d6993392c5e58615b78d7e153c6da2d1da553bb

SHA256
00d844a37dc87d7b2708797e668e131f5264437a684696ec0faef2bc94f04642

SHA512
9facf3bf6de491c55b3da35c686b358588b5a0548a8ceb3eb0f2ad1c9abea30104e82ee4977ebe72e08fda21f05f2c7ccab433a30f4db9427346bec2722553fa

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\3xgiving\mini_main_l.bmp

Filesize
176B

MD5
e43b10a921bcba93f6a419447c700768

SHA1
278d5a9201004311b3a8653669e39fb3b4beafb6

SHA256
0d1cc530369580a77fbb2521ffde11ee5566a0a6292f5a001419743a0f63842d

SHA512
1e3d6a0b16d07f26e9071a21cc4493ba8b566ffe7660f41e762565de196812e2ed9769dd81b150bb02bccd156de8e6ad190509306aac01de7b18e418f63e287c

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\3xgiving\mini_main_r.bmp

Filesize
176B

MD5
0403d666ebb7c1cfed597747b4c0dcb2

SHA1
f885d5dbdc8907f1177e93fa385f9793f08ccd61

SHA256
2054d5ed50fffa0c3c6389886d4caa87d724e28f3a469661149d8c8ceddd2e1c

SHA512
27f8c6156c663c957097e6a1213fd15550f8d6a56272c9a038df8d7e34dcad6c691bea7929312b27122deff213f300fc646e99996f82013ddaebb2b3da3bba2e

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\3xgiving\mini_title_l.bmp

Filesize
6KB

MD5
b8ba40dc8ced69cc261eca866cb3c251

SHA1
5f787dabccdf646729b9e9b05ed9fd90be9b5eab

SHA256
47143b94d947fdcaa89569b434370f265796a749f51086b369eddc208d05c214

SHA512
c2a58b21cac326f9495335b37afc29a2fced7dd8a0b2d91bdb6da16714c2d3d1b9fe6e7121510c7a78154f8e95943165df16f8902548ec2fc6f366d6d0135bfb

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\3xgiving\mini_title_m.bmp

Filesize
1KB

MD5
79dc829998d5f6ba3c7d8a62d58c1d95

SHA1
0dd01c09a1f09609e9f378aefb83a7f0acb13600

SHA256
10ddb67f59ae22827ab70be17df3f892499a1fe68cde2462bbed6becda75c5ce

SHA512
05761394fdfa096220ae94bf5f50670f428d34d4776720af1e2b7841638c546d1cd9f1c91a75476757766b15ef4aa2a71e25f0dce857cf7f0e44ce76fe8b5cc2

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\3xgiving\mini_title_r.bmp

Filesize
696B

MD5
656a6fd0374e5688fdda6fe5d453219c

SHA1
54686fbf2dbdaa9e1d41656ea340a5641b0c138d

SHA256
1ea6e22c3df42f3a3df23c324d496ae7ccb595f0d3b1cfb811f6517d84b2d73b

SHA512
e61cc7a2fa49f58e1a4ddab42698185b350360d904b8fff57a8a60605955391eaa69f11381b0679d46159dc5d4330fe9b3b99f8fe1751b950182aa8226a1d754

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\3xgiving\scrollbar_vthumbgripper_down.bmp

Filesize
488B

MD5
0129dd07526b63a36f43dfd8a09291d9

SHA1
cfa05b8bc2d13a67c1a71692040bcf6ae5a2a2b6

SHA256
cfdd7e892c56661c8b29d442efbec58aa39569e1a4e52157e660b3acbd342d53

SHA512
9d6814486c6f340ea12c25764c9b4e1d4208fddfcf49b6ecbd9ddb6785c67279b03fcfdef3cb3b21e46a608a32e51cdd5efbd1d1a872a67351b41041225182e0

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\1.png

Filesize
1KB

MD5
52114270d4fb76f6615503eebb2d29c1

SHA1
7300ff5a877fd755821a07b4f35576cecbd69540

SHA256
253457c2a79f239b7c7a0c0da796dffa01d441ce9f6c7af41484d8877e0ca216

SHA512
ab9727893ab6346a03c336bd03635926dd0248d1d552fe13073415df3af99f20cc1afcb2e1f1ee47f49d61235f013a45693144b1c73fdd7683fc5680f86bcb9b

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\PPLive32by32.bmp

Filesize
3KB

MD5
bd78e68df830acb96a6918dedd2700d0

SHA1
d7bc6a941b63e0d2be05d11a6f83020bdd455601

SHA256
a1629a6b4096b6e740b622341a1031f8281e8c285bdcb62e6ef3b8edf878d28d

SHA512
bdfb005e75494fa1a4a5ef961a2cbfca879fabb219f2e562bc52c5b56f0d2a89f0f5d48e61f0cd70e2b2845d3636fa5345650158fd7861e14e3b4df22243351b

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\PlayProgressThumb_hover.png

Filesize
278B

MD5
e3c95fd0decbce29667523ed382863a2

SHA1
a429de75c84ba321f4b4487822ff14f29dd2cb38

SHA256
a1fd235a4438341243aa62cb8ab35f74104cc98d8f62f13b603a17eb760b776d

SHA512
d5b4c7e8f039a8f37c272dd2a41f7bd2362b88fdc511c7718b53e3f25d16ed11f5c00990e6519a5b1d36a61e22b043c1932f8d60f50b8897ba79bbd84bddf779

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\ad_close.bmp

Filesize
568B

MD5
8d50be88be04be8e0155f5225e9d1550

SHA1
487a319dfaa3893a87f7811deb315849bc4b357d

SHA256
44afba3fa4f4d535489cee02146f1f68d9f8a7d4f1ec39b7a1bd137d82693993

SHA512
ac6d3b2aac550423d830dbc353e97d2bc7b83dd19919edcfbb33bed923156b572489070e7d13e0b31b01ba73c561e6bdd5e1e78e8cec6fba3743b061f69342b8

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\adselector_title.jpg

Filesize
6KB

MD5
9852d150fc3785c163952f0b41a64905

SHA1
508fdd9fc211f508f4505005ceccbd5ce2fd31fe

SHA256
7da180cd261e4ea0a99ef56f149df84eb1b0e469321d32e6295963603715ef93

SHA512
a9894dc4d17389e1c6be2b4338f8c8bfb35968e66f8f15c2231b7e472ce16ae02cd4dd43d2c704dc6ba045ca0534a2c5c663058ea476e5ad06b6992e630d9de2

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\alert.png

Filesize
2KB

MD5
3bdeca61baeca59b9bd65262a4a51db2

SHA1
9ced2ad9e511105a3550d3b2d7ea7024fc01163f

SHA256
409589332bad9d9342d2c54b9e360f5bcab3af4ca81c0cf4383a47b13a8ff0bc

SHA512
a36c5b059cdcd8b879b434147d424131493b7f0b106de98078c62cee954b0fd5f4fc626f4a3b77140f2ef1e1a032f89c09ec685ef2e7090c71f71ed4fe7b5542

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\arrow-default.png

Filesize
41KB

MD5
3d125a1c5f5b65e26a1fc7747ba318ff

SHA1
a90d6ac9cf10c9b1106c54f27189ae0d5e9be1e5

SHA256
dc546683fa259d0c4af111a553d356e2a75f9c42fff3a32deff9f025b38b8afc

SHA512
cf5913192fed9d67c2edcb7694067816bf6406ef9d25d1c3dd6d40fedd281963ed6c6b0b142ef490291557257a2f9b78813f2a532e191f0f799bec2c92ca852e

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\arrow-hover.png

Filesize
40KB

MD5
2c437087de8e31e019dcc40f6ebf0e8b

SHA1
d4c68f1a23d63bb2b936b5ca485dd4a13cee4fd0

SHA256
d539cd4c4e1478fe960d626f1af1334c0b72fc89ad106bfbee05bc9734a2f7e0

SHA512
3dad5c97c698f71da94459d2510047fbd7c446d6a7653f9652a5897b1d046be2227aa67779d535707129fe5995d3ddac0199a782c0c95670e0c0a988c7246bf4

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\asc.png

Filesize
20KB

MD5
b442ac71f81a1d7a4d0dc3223082cf80

SHA1
e11669abda01cf1166d035c74f40406421f6d16b

SHA256
a558814753f664d97ba013a6aa476ceb4d5e8358d8c933f688d4716f7ef2b85b

SHA512
da526062faee350e447cd811a7859d222b348958612193a8c54e7fd064777192b91f9370b39e3f18de66a7b21830cd2f9497020eb0fc933846be1a32d3d843ba

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\bdclose.png

Filesize
198B

MD5
e655c6bcc124dfc32795545eb4d8f45c

SHA1
b0abc57a5bcbc7dc988c3493919def67a3667be8

SHA256
7478de11ee4c45d30caff388ec9905387e23f65ee038bdcf495115325f7cd65a

SHA512
933a74b5a7c4d748bc4bc3279e398671c6e2f771cab66e582682b95f762fed5f8d61e1c9ac48cc76d4d6a46d13d36b6cf293c329c3232369e78167e4f8c8ff4c

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\bg_Classic2New.png

Filesize
4KB

MD5
3b273fc641fcd06f5a21ba1c876c4870

SHA1
256c9b4702196b7469e8aad06ed19e9c7b8b9b03

SHA256
3c25a01bd0ad1e729687b89bab99e82924d9c4638c1a1f5e2d1d817944088234

SHA512
a7985777cc269db6d3a3f8e545c86ce0f21794609fde155d5bef7f08c0c9e7ac32b4b14a42319a3e1418853aa00fcf17ffce8bf5c28738c79cd071d12852a5f8

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\bg_numTip.png

Filesize
3KB

MD5
18a77c43d836dd077162bcfbab15adec

SHA1
71f0566b0e53cb3fff87966b0bfb351a1abf3f90

SHA256
045db4f37319b07644d103e275fbaa038fad1d6d7b79769c7531cf94dfa5ad64

SHA512
50ea2d3acefef5fc6d570e1e59c80b485a181cf6a08c9d34645668417c11ce1bf70f2b7ce3212c2a1321838762a84317dfb6eed7d38d6ff1bdb42e3ea32f28f3

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\brightness.png

Filesize
278B

MD5
eed9de70cd0c1f56dceab14ff6dd3677

SHA1
846913f22aee1c07c3e5b488cf73a9a5fd2794db

SHA256
b1a49378b111489ac5605410eaf798cca28b8d21de889da0dc72ae9be40188cd

SHA512
1fd6e7dbdddfadbe4f3aa773aa0e1bffb6d5f1ea2878ce719e966f7e56ad0d1d431c47bbef2c92e09c52310e7f3854e10e69d515f79e5638d837c9fbeaef35c3

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\button.bmp

Filesize
5KB

MD5
33d445985d21ca704eb07585267a9e9f

SHA1
a1dfa99d254c36621dc1f9e3f31b3f22e373cde3

SHA256
f9fd780b52e7e062a70c2826d745d00046b6114be233977be5e5f4273efe6bf0

SHA512
9b6d169d5845cf6777f19f2d7a8295b438e5fe7faf96d3346def9fd37595ab196edfb99f81c142d1784f5b966d4115affa1d0213ec4902d1c0a065cdd9640615

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\button_down.bmp

Filesize
5KB

MD5
48a02ef41d64920135e7727f9d74cb11

SHA1
f1fd6cb2df9e66505486af0f72178de8bdd4093d

SHA256
8d87f30cb1bf431b8a89006f07b1f9377544d5b7c91a14e954eb2da512f6f3f2

SHA512
ee251668b4740c9e3159930c587ab81b07d6dbbf873df4f073267122b7bb31a0fdad52805e2bc145c49872b502570ea816df4addb943860b45713ed5785e5eda

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\button_hover.bmp

Filesize
5KB

MD5
db53cfcd2dde5d12e11447817805eb47

SHA1
4123dbbf9192ee8729c8f84a6df4df8135e725d0

SHA256
c797c18e22627caa1c1262ad925fac9f776dbdd699ea55fafaee0982880d3c9d

SHA512
a8bd43b533d11ffe8c05351b1b24d4a13485c9914a803084c6fe35a9974072f69d3e57519ae0a4864423d86d418624c5eb842530fb4cefab392fbb28a33c4a1d

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\ch_vip.png

Filesize
443B

MD5
3e13dfa5ec62b88de5bc9927c463c4ae

SHA1
da0324e3a4a379163255b7b56cf67a818019b14c

SHA256
cf3b3841f88492820d8a9fa714390c6f363f0219e768236604d62fabe44f2ba9

SHA512
ba24a24c5b4fdb6a2c48ef0e77ae970a46dacab0532ef77a31c1392f834c178f5883ccebfa29c028368c9366ef64c70021b72bb4adc72821594add1a4c0e6b60

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\check_alarm.bmp

Filesize
822B

MD5
73bb9adc70739516bdf7f0b3fe4b6a3b

SHA1
3d4049c8dbc20dc29ed11e657bb8d86654a56c52

SHA256
516f241906f0a8e6065dbb284ad720c281624aac4a87b4314db202028d65b59f

SHA512
d9431a5cc2d9b7775b086e9ced935ec4d7240f186369053c10eaf2b6761e65157e184baf3adfbd18fa8ad8e6e553bf861126461ebad7893610ce3141a0761188

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\check_ok.bmp

Filesize
886B

MD5
6e6866ff9c9e9ff685c40505c3d7b786

SHA1
f2445e1b6cf6f438b0b26fe556c8d738b02a1dd9

SHA256
d4e03445db40227f863a35adbdb1dc0e0fb9eb67a3b9f5fe5aa0d8aff835fc85

SHA512
7162662306f71eb6423c561fe7ebb0c1abdcf006e980a19a6d5451e3eef7b5a27f86530a6e9ec077c1af4730e01a8c6c150c902020051584ff28f4ef9c213b73

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\checkstart.png

Filesize
4KB

MD5
f6a54ba6bf081816a3d1b38cb7348d19

SHA1
dfc6c99c8c3a50dbb7b6e9fedf75be93eccecee3

SHA256
21b152cc636228409aebf524083c0b1a7379df5dedb3f504a4ebd8372e3948f8

SHA512
903442e6ede5e0d5d50430bb8f7dcd8d84976ef67cfb2387eb3d0cd2ff89530179276c329001c43026b2ee6db6cb084a323c92ac48086768a40f80c4cab57f0e

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\checkstart_hover.png

Filesize
4KB

MD5
7bfb9cfbea0a31447d9e411848204eaf

SHA1
85985399824f013bc96351fdb8c0251d68ea497f

SHA256
a64330b07e347153abd8abcac81d5c44d8f4e9a6110b5dd4b6ae3c27fb0d3894

SHA512
b31aec7912a0ef04c9bb7e655c02c8ca988f6531249954fdc381d919634acba6527d8dc0834a8d5ceab8b47d383a410ddcb8b9964703eef94247570377c99350

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\checkstop.png

Filesize
4KB

MD5
8faa774008aa9f1fcb9d4830b5395278

SHA1
57753ce356442e15f6377153abefb1816242bb74

SHA256
8cc9e3deebb4819260cbbe67b4d05df474983cf8d9a1bbd84e453141e4f3719b

SHA512
1e8827d16f74d1a816bc51c443012a4e9c2ee06c68efee6adafe87883d1c5b8749e4436c5a2b6799a2568aad5333e2096e55ab91462753444d7d4e1e1ab0dab5

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\checkstop_down.png

Filesize
4KB

MD5
52862957a26b819adc2fc3344f2ef3a6

SHA1
c869cacfa72f1333dcbbbba0dc77bd45f54de8f6

SHA256
affe354c4f68f84221f7839aa48c5738caacecd51d746c7e34bfde9b0eef209a

SHA512
7b4ce029533c92183321ccc5d077972631b862334c188cae3281b7c576fc2b85c71b2cb329f03096658384a958e2fd7e3a811a4105331d39b8f4969f8eca8296

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\checkstop_hover.png

Filesize
4KB

MD5
d5c0bcbe20762df42c1750cfce0257d6

SHA1
240f37c303d0bd64f03233efe66d9af66ad0b798

SHA256
70ea60ba946ca4699abafb13c0effa9026e7617e8d0bd86e6bfc914cf01e2b33

SHA512
a7f40d674dc50553289766f6f404595f0bc80c43f601f1d32f2c3a83cc14db2df6d2159f3fdbf1ae68d1497fc39cf36cf0ed592ab40aad48353997c01a10ef90

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\close_numTip_hover.png

Filesize
320B

MD5
9ff1062f4c58ffb6c9ef27f96d3af1f0

SHA1
1316ec0dba67c87200f79c290df98be7decdfc8a

SHA256
02f4232011e2918ad889404829d05ce9e540cfe3a62be529724439a35bf8912b

SHA512
76850b4dd3f36dcb70e8e38bd73d6c62b98550a3d918b4645d6f3c9bc329d816f81a821dc90a067cde6887629a49cd80393d60a34180d4e204b1c66558bd855b

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\close_numTip_normal.png

Filesize
204B

MD5
6d5979de605b5fa8dd2e1960fe71760c

SHA1
e5ec662751e9f957e300941d6dfb3b759a28a1a0

SHA256
abd2f3aeaea4ef4559115a2bfe471e7be43b913996c98e7b2da1a371f7f9d08d

SHA512
ecce539deb23f72c92abb06262ca39e92866c6f5dda9e486f8b02f993bc493465fdae1b6a85f17307906a80d27ca461678d6dc5cda8a1ef5407d11cf8abc3350

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\color_thumb.png

Filesize
191B

MD5
fcd15e0371ff8518c09edce561ca28b9

SHA1
cb8ab2736fc59513dae36ce22632a2ff7d57ce16

SHA256
022b68cbfc4044e63ebb3fe98bf45258a3529c1490f9cc9b4958d5402e288e6e

SHA512
ac42eaa7febe49caea2432f8d729900f11af4f80a875befc465bfcb09ed353b725b7ea9ddb5654912acc987d28cd0cefb97a91ac6fa92d1cc6803a0860d0050c

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\common\checkbox.bmp

Filesize
576B

MD5
8504e16a8c9f289537a8c404a3e322a4

SHA1
2e9532e8a72407cec10a662df3711cd0c2886eec

SHA256
aeb7452c9d202abffcc53022c46cd8faede0ffa4f4821e024c0720261fa60d8c

SHA512
2f775aa1b9e3f5addd88baaa3b83dc7e34cb90b1a650e7e20338d9d7febd77434ec84512e0b2c2ecd67928341f13db885da53f8ed6f623387f14b05e6f348756

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\common\checkbox_checked.bmp

Filesize
576B

MD5
1539514ae6d730e1cfc7a69aecd80e2e

SHA1
bd8f47a99dbf8ad6979aef6b0bce60397935ca46

SHA256
7397f699faaaf9363177e0d0e074c4ac5a19a7bdfc6b7c2e32586c466b39dadc

SHA512
80821fa6a07889c4cc280202c81c6bc8b10e39b997cff359c8df45f988de226aad517f674262e98ed6690be3cc433a600852cf14ccc4eea4b96165d4e09cd7ae

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\common\checkbox_checked_disabled.bmp

Filesize
576B

MD5
b12368f6e1b8ce7ff4c96158b3aef9a9

SHA1
0ca69176b2808eb81724de4af36a51a89724de45

SHA256
4215fe3f6ca2011a8c386bb7254ede56c11cce6010bbd6764e9c4d0121621d6b

SHA512
3892ec9f8f7fa1090b43e8a68a2863d5c17ffc68ad983d7968fb4ed2cd4882b73660526f42d7cb6c76a3d621baf99dc4fce4b7f4de95529ca1b4b95e39c03681

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\common\checkbox_checked_down.bmp

Filesize
576B

MD5
cbc56ad6a2f4734a0c3fa226b2582b4b

SHA1
2775109a99f3b952806a202bbf2601fbedc246ad

SHA256
5e1777c91fa4a4412a688dea4948361a462bc464f0deed828a0dd3122f2add85

SHA512
c60127dfbb8c8f561f0263620a1c6c1edcc9a1066cfc290cae3dd3fff59b84f45e1d3bfc1bbf13c8694c8789e526dfa369265204d5f20f3c98a0ae8bd59496a0

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\common\checkbox_checked_hover.bmp

Filesize
576B

MD5
8621ff9d66b415016211d73f6d8c34e6

SHA1
9c0168e47f39399a140bce460cd2cb0d6baa3c19

SHA256
94f7483f0229e440f5fc077b0fb0dc00d710f7814d09e5549bdf73dceb53b95d

SHA512
3dccce990e6f9d4527ae4dabe529e6022d43deef74a1d52acf53abc22a6a6179ab14aa82a8d371d7dcd93b8755ee76c8d5147688ba41170af47646825174b194

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\common\checkbox_disabled.bmp

Filesize
576B

MD5
7a8393855689e236c5ef6caeff7f6d08

SHA1
cb41894013484d722c0424d71193900e1dc6dc7e

SHA256
a718c983d1d6f5c100a8c831be3585421ecf8d12dd6123e15e30e3b6c7ed808d

SHA512
2697f81de839db35bfbe5a85059e70baa2f82f5f8798bbb68bf8483dbd89c199544bb4bc1c34251f0b16dc01e41fb3ca7e35a606c0ff2055ee1f7dbb371aff64

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\common\checkbox_down.bmp

Filesize
576B

MD5
c91400d11e7e21a77be3754759e072ba

SHA1
1ecd1fb0ab06a160649fe88a87b8ba906f0d71b8

SHA256
cffc7129fe1626f8f803d7d24020d7625a003e492913173ed7e7759dfb0bd46d

SHA512
e1af4a260686f94c10496a44ed592db759f3c697450a2d724b465055c7edbe3b1df33378101f02c8e5b9af288f07ed9de5cf11413137a547ff8f5d64540e70e8

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\common\checkbox_hover.bmp

Filesize
576B

MD5
899994d10caecb0536298f7c1d733cc7

SHA1
8a5657d28d16bc365458c72360d5ea8ab8a138ff

SHA256
a0c9c8fc2f0bef2092dc38fef5acfcb7f3d19a6fb27a94d270c878a16bb16732

SHA512
872fa4f6bed95753023a925e5c8a2feda72d5642fa94f3f318ec72fa2c30685bc46b341368df0e33257d31d826e3e9d8660a603cdd83224a27c25e4751de470e

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\common\radio.png

Filesize
3KB

MD5
72715ef6db655782dd7e447b9adafe0a

SHA1
435d37cec5cad575f544ec42165dd7d5db7f6ebb

SHA256
f0dcd15af06267badb1d01a9a4b9a376da53a4996f8fab5e5b5bc8ed0d0d5ea3

SHA512
79c76593cfec88a943092f848a42d41a708eeba185e81695a6b87330d5e4a800c3cc1290e7a5e856bfbb94f37f193a623a0de049393c4e86d64d639629768c84

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\common\radio_checked.png

Filesize
3KB

MD5
433f402cfec042629945b5bdea713e18

SHA1
7c62edb9ebbc93d59d75ddd5799d4e21161d201d

SHA256
0016838375afb51bad967899fd2eca286f2c27f84ec1005b054bd80d108c00c2

SHA512
ed3fea9226604a454e227c59b29c0b6a4d4aaafa88e064fd6c31a2a7ca8e5776dd853e25718be74174f204216ff7c245bd3b4daad99615994b6043d1cd31beab

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\common\radio_checked_disabled.png

Filesize
2KB

MD5
50e8e363f1e7fba15f1117c11268583e

SHA1
b6d4da1992c499d6989bee6a9e1612f909e02d0f

SHA256
f20db24dbc28551489acbb642e6e2a830bbb0b523cfb29ea6604f354d6d20872

SHA512
be990f2b63bb9b7986550e3c339d801f1f2cbf7c74b182aaef27f0034ce5b1b6391932f10d66ff3680b4fd408e8741834afac4d9b555da41dea6ae2c71139fe8

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\common\radio_checked_down.png

Filesize
3KB

MD5
5d9c2d8ad99cec3fa2b21515b96ffabc

SHA1
d74817adcecbbcfe19bf5178df7bf2220a0b4f4b

SHA256
bf780c8c221c3ef4a1bb8b91718782e9307f62557da419568c64af912c47b481

SHA512
16ed132ca2d869b4dd9d19637e5207ae75c10e1ae516c1179f8ab34a6884d96b38a71dc549767d51543779708c27e0bc8ae3dea9ce683c65bde97dbbac863fb3

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\common\radio_checked_hover.png

Filesize
3KB

MD5
91670588aec0db6c234783b46fff519f

SHA1
de17fa85af07388800352239fa6d34b33bf1c54d

SHA256
3fbc4981251b997fc05c4fa5683fece9cc407ec7c97a0c77295f17297fb1f807

SHA512
6150da1d5244dc88ef504ba98de008c6001767f14f57048ffa9b1afb4d64a89c1e628039f8ea4bbb0aa62386c32e6f79cca9f859b7ea44a8c6e01ae9725a13d7

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\common\radio_disabled.png

Filesize
2KB

MD5
b04a98e0f87e8262be019bc29138be93

SHA1
a0e22059e9bb199731286d4d1a56416f56939467

SHA256
5dde8dd578cbe8dfa3d6075462a2f00a7ea33586ae7314581747644f54b72bb6

SHA512
6ca598de1fa7c6c9b677fd5e8075e469a0604134993d83076654229279909770875b6f4942b0835f86e4591dfe7497df52adaca403c9c963394faeeaeaa5b4df

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\common\radio_down.png

Filesize
3KB

MD5
a11b23c7a81bdbde6ee793d6548c2bf9

SHA1
59191208520763ae9e1206dcd40923c5f5065d97

SHA256
58e218e25f24cfdb89fe145b3325bc26d4ce637cffad725e918bf483380b55b8

SHA512
1c32b17543cd34463b4ef605dc947ed21357f510aeb9b54a516b671b68638a5e8ff26a64342157a32ff9bb4740dabd4af73a862e711dff37ed3cd34bcd462e69

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\common\radio_hover.png

Filesize
3KB

MD5
823a32ae4003e97345b2e83d1dbc0ff7

SHA1
21ba87facfc45b650e20477992d74fd583e06ceb

SHA256
be18b68f4fc767765527f860c422e3cb6875f5ad0738feac1753943af35c507e

SHA512
65df4f1aa6931c814b5aa6eca86bb158508b30ec35d12946e5ccb4d11a265404fc90cd98e8e26662c47e1521436822bf10845c7e8ff34da202b9791b43131829

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\contrast.png

Filesize
362B

MD5
da9e6a0ecd6aa00b4b31e24cbf642075

SHA1
7a1131c4b6b978a2cf6eec371d46c7a8310ee429

SHA256
ad94e787da752b6462f68ec79d0da9022b32a20bbab5771dd2caaa41536cf35b

SHA512
34e8d9b711a33673b17a276179932e18c715bbceccc447a265b8b31de222dfe37fb250107f1d218a2d827c07862369899c9ac5cc66f539af9439f9ed8f477ffb

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\des.png

Filesize
21KB

MD5
c93de37b0174dc3d7aa8262163c1c7a1

SHA1
15b72ef241ca211dffb59f9b92c373b3e1332b42

SHA256
39702331541d0cf7e3d04d2381c1d2982d49eef48fb34e24712e059d489f1dad

SHA512
0b0d92b5570d3bf3294c25e701a57491d90a6691ca532c4f786ff9971fee977639e0ee2d0a5b5f7cf249652153001702b4e9356e776a7daf89ca073f87e4878d

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\edu2_close.bmp

Filesize
822B

MD5
d0510a119778a636460aea9b591b3a77

SHA1
9974b7bf3052378a42ffd08c65708362b019b8d1

SHA256
f56f6951873feee0454de40802fe78b51a1c3943050f5ef0a76d83a02c462bdb

SHA512
b2b726d9fd8c0866d332a597e7296db512351060f10ab530952a8be6669ddc7d235c2c9e187a351e27eee947f23299b735c20166f43c836f17bd4d82b5d2ddda

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\edu2_close_down.bmp

Filesize
822B

MD5
05193da01662b3a70446bf166be3cd60

SHA1
2b5a75ce4396d2300cd62dbb44464cb556ee4c9c

SHA256
98af7340b68b2861e06c6bfae597a0369c86aca17164ab6d62b39d8186adeffa

SHA512
1b9d9cf832d04f3fbbcc1f8e03fc723bcd501890ad4c451e1114b7d7d693bebf406ca47faf5f18473b2c22c139957833fef49d0a94481f505a38f982105d07f4

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\edu2_close_down.png

Filesize
2KB

MD5
c5b931254b98f0dbdb87e2f92b55d50e

SHA1
408886e6fd912e57347df06dacef33551311d5cd

SHA256
f8e241145370defd67e753abcd1b2a947415717ee6e8e099cc0a22421b82e596

SHA512
03a527a9a8e0e2b4898cfd5d6d6c6e3eaf19438d7a6982b7427d268c7e0a0674b3b6a3718fbb17f6ea7ff870d0b4440253f9ecef27bad30d2034dc99ff6d38b5

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\edu2_close_hover.bmp

Filesize
822B

MD5
b1a2d643583fbe0f8459f50482907305

SHA1
2f8912a1debdaa721bb8f6fed470204ad6867851

SHA256
3f65e6bbb16d00ec69ca29f205060f0c493e316fac8522c055b519a0994d5614

SHA512
9f2b98984e182c2521f1f2120cb5c4a6491fc1261980be91db8b1fca2a53a847d4d06c3cf29d12b49266341375ec549eb5c5983ac3a34fe2b28033b55415e016

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\edu2_down.bmp

Filesize
120B

MD5
0bde14829b7832ffe7e6f3fe63d7c7e9

SHA1
df8e00b4f81d5ae7074c170cfad174efc9aadc6b

SHA256
b7edf5cff6bd02e090544457d97293d8920cc1e1bbeebc084216dbcc3609aa75

SHA512
e8be2e2cf2762313f0c30f71385f2b63d0d227e65149693aa4d7bd5885dcb2c4c4bb1d861613c4398410ffb2847690004730b494b381900ff16b2aa26407c00c

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\edu2_down_triangle.bmp

Filesize
1KB

MD5
0da3d9e752672ca4f6d870748987d740

SHA1
493e0be8f03e4fcbbc290549f5ffd13fabdc0a67

SHA256
3add26a36fe2308824c2e60d13d88d88a96b2990107a8f1c5481b6548ac90622

SHA512
a28da42872eaa95ad83b882b771c278ae4e7c0f174645cc9fb51c02f8e00797e8e77d00e3af1c2c7a9bda724a90a42cecc8a0d52076e1f26aa744d755305b098

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\edu2_downleft.bmp

Filesize
104B

MD5
aa894671b1de2e43b3e8bff3f7129433

SHA1
5d0ab7a8aa793a513ea103218d4b62df62f6af33

SHA256
296bce0093ce9778561ba2094f7940ff828d1867ce51b2015b5930a95ac03057

SHA512
1b27368edacb708a34d5a90bcab2a29c8e49515012d9c71f8624261cc4b32803ea84c0839100f170b52bd067ee93e9d251ca28b5cf3a11786eb0c03bf3e6e254

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\edu2_downright.bmp

Filesize
104B

MD5
c9fb284c90288891fba913cff3893e23

SHA1
219f23640e5ad99e679c35998817503d419f7187

SHA256
8f5a402191ccf3be75ea7c51da382a758abcd67afa0a11b35ed0305c93bc6fb9

SHA512
bef47221eb79ec5fc124676d685607ea90a2b25b2203e0200e2ce620f12c69f1e70cf306ced8be735a140983a9867387d3c08168ef2c424372361ad62cc50b00

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\edu2_left.bmp

Filesize
116B

MD5
e75335c022345b10a945b308f62978fe

SHA1
d1bb60c1ee86236fe06b38ef8aae22455d3437bf

SHA256
c88265dc37e83fc0d823d46047d3751558edc2f6373ed292b7615754354f252d

SHA512
009d5773c01a8ce5a7bdfcbdf528a1b387c530846e6d80ac1430011e8c2f641618f8b80dc79eb0e5c165a7c9a07c3e61f36932bd85fa913fb3f4b5aa6f42a2ca

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\edu2_right.bmp

Filesize
116B

MD5
f4a8b1de9bc77bca1bce230848a11a7a

SHA1
1843d098e3ea058e01fef22deafe43f4e9e18ba4

SHA256
c815a0310ef04d3f053a858092ec11f8c69681e348d29c9cf17e607fbc7ba95d

SHA512
009b131a0e087641150e6cb96f606bbd0dd9553870a5a4a178f908e63f7360525f72c4a864ecefd0615310bfdfe8a9ddde0329f217c36293d960741470d76925

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\edu2_triangle.png

Filesize
1KB

MD5
bb062a8b11a038ab44579c65eaa3b6da

SHA1
8913c817e9572830b59d1493b43dd2f627a41e9f

SHA256
12af568c5f00240d03dc901db694374ccfb9676431495ad18baf43ddf528385b

SHA512
eacf1d4a2c1836a25ad141e3a65c8aedbc3f78e7d2311d561092e4f5ebca58e3f5d1e690a520f92fee0af4ca4f3ad9ed67c74c6c90aa9fec5dd2094f0ef54dc2

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\edu2_up.bmp

Filesize
120B

MD5
12ff8b4e405d4d09936e3571f0d209e9

SHA1
b0df3dc0e42a4ee8e9af7a8e4fc92a450731ef1b

SHA256
d4c13fd8bac1ed48065757f7c7d69093c8d08f3cb6f12e3d69f6f73f0dcf5902

SHA512
546c2a1f3637b6dfd8fd3bd4af0180836e248cfc5e929b277a78072614befca43a6d5db191ef5042648345e8e02642e091e4a3dd4ce98b7fcb882638a3cf5daf

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\edu2_up_triangle.bmp

Filesize
1KB

MD5
f8cc6bed03498bf7b90282396076e41b

SHA1
031bbf4147e1c0be7ba966648b6b99a76c8772a0

SHA256
a9b963104daee18b090a12546c145a812e4c3ee8b7de3d06444860b80f148a57

SHA512
ee4d53fdc57a527b45c6e05d52024669b02a1bbb0e33b622b4561bbeff9cda080287c5913b89464df0faf3962e96a703d197be298cd00b600505a1b16e33c9ae

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\edu2_upleft.bmp

Filesize
104B

MD5
16f14706890566b0eb5254ecb3fc97e7

SHA1
c4dd270dc6fdd23de8c6441624008cb0bc24ef43

SHA256
06c7a4e480e8f3edb45aa4a17568f6a57e20289d8a7eb19f8b13236be40da038

SHA512
58549d1564b5a271ce8eb6c64b47730ec48a97b7828d59cc45bc4a70eaa0e3bbc744f566fab8e63c17bb9193a2a73047bdcc4f6978e19376481bbec337252a79

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\edu2_upright.bmp

Filesize
104B

MD5
cbe15f5d02ae82ff9c21490981c27b12

SHA1
c70e01d50143937f0d02b665808d7977525e0cbd

SHA256
6c3f3ae0f6c69ae1987a41f60a288a55f5c75528ce956dc09b0fc7393b829117

SHA512
4571a468caba15a721104dcfa1006f5ddfa73acf388318889b9c3ae5b187b8e3edf96f17587fc4008ef80261b0f03203458513cb2ddd7b7e3875fd0cf7842c93

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\expanding.gif

Filesize
1KB

MD5
60249f6848b18c8260ed4623e7fcf118

SHA1
737391e6d8b91d5925d8ce345db8c22d636ea95e

SHA256
bc28ea567d75cf6920076593840bd3b501f7c99db8b1c107cd846781cb909a30

SHA512
0f36b757dee0b3e638286b578b14af663bdd63a25996674f709fb5be49ab54737e107c21d601c336716ad2c156952497d567ed3529c957dfdd4a982c503e716a

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\expanding.png

Filesize
353B

MD5
4b4cf6e1c9589b48cec69323d76ec092

SHA1
3c99839deaf46e0f66d245751eda34549c4f9d02

SHA256
a215671057b0fd3baa4f539f853f8fb6b737681a2e4beba3b19abccfa3e53a77

SHA512
317a13411b88937db6d6d4005b011065353bd759b0bc096cd76f72f1c8f1d68addf2138bfffa236f2bf357fe1a2951e67d18a05eb0d0523f512059ed23e19ec2

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\groupbox.png

Filesize
21KB

MD5
390e86f42259327dc362cbf7b59a2226

SHA1
9343820d3173d3060f3b811fada4cb9bb7a87929

SHA256
6450a849088e981ee697a4f25ce424e4bf7b0a3f59acc6410cbb1f1f3448f75d

SHA512
c23c17e112157f21c900f069d072bcbb74058ca7adc665752f8f47fd42648af8f256e561ecbcf5897a8d8b5465f9c531b17e8f2397849ec93857a7c1643f392b

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\hj_expand.png

Filesize
284B

MD5
b6f866c68a941fa91048a5ca8fcc7b88

SHA1
e98ef722265de906e19a82d2e5df29f8187cd024

SHA256
98a30e5549d5a285298e783a6eca5511a28d611535133ee4411a1173e6fa18c6

SHA512
d4561a237900dff0cdba42552c76b30a9897022776042bc10a994b74eaca296da409aa7aa4ec1bc46e82c5872b8a4356cbd5115bc7bcc4f2bee807056bde6129

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\hj_expand_new.png

Filesize
299B

MD5
f58451ec22c22f333670884c8f46536b

SHA1
2c2dd3e8b6c028522e88428a4f2888801e7ed991

SHA256
ce5b6bd0b890f6003dbc228e40930b3eb1b50f6beda64b85c1f229e3c5a08b0b

SHA512
41e27d7ecc7037756e02f6a312bf51ebb4a0e731c043a4db61a0851b22fd5187b2a2526c3e0b376a7123da3bfbb79daa9a0bc4ae99376d2298dd24fecdaf577c

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\hj_unexpand.png

Filesize
295B

MD5
0437bc7aa2e3a3037e21185557b2aa7e

SHA1
6bf436263d276599fe6b2bf7d49f5bc63c7e8a39

SHA256
22deb36e7741acbb9abd905944206f080ee58326915e04792d3b2381717c616d

SHA512
dca841d9d58927b5cbde20da94c7cb12c2456f11cee3a88a53e8c51b58fcfe447bc77019def737588653e5b02588092f520e11d17eac89fe48b056c9bf80bf16

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\hj_unexpand_new.png

Filesize
267B

MD5
dba17a9700ede456d0e86be64d947734

SHA1
0c14b13734e1ce593d30cb5c4307ca790d5af1f8

SHA256
72354ce558806431d21b5d9d767a6a706a8dbece9df5b31da150f9095475498d

SHA512
37890f1fc6c8bc1aa9746432840823966ef970cf9bcfe45bc096231c3ec4e581a5d0d12942a5ec7f92735781d857f695a3b61c8a2df5b1566a9ceda0bfa0bb58

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\hot_0.bmp

Filesize
344B

MD5
fea4c836d174b57e0b1a560a74969a97

SHA1
6d99873d1b123b31de8b922264a2799d1028b363

SHA256
e1c11cfcce35a728e65efa87bd9ec10facebb82066aaccf5fc2c41cb5d4c96c3

SHA512
8808e0e8e036dcaa8f5e6902edeb55e86881d6599dabdb18a19dfe0a437dd0ee45cf4d6ae82e240b00226a8e03921a8ae02a0c855848081764b58f9a5da6f8a9

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\ico-exit.png

Filesize
1KB

MD5
955fec2b0b1ec18018847f72937daf93

SHA1
66e640d74b4c7f62da78c874d58f10e7f6b8ec3f

SHA256
fde885cd76ac9e95c705db0500fd202dc1dd61582e520fed5503e15feacdbba9

SHA512
94c65e937ed021f5139c5cda0a718109690e62896e90f0741854e7c439d329a849dfb132442c7ff097f77ccdf112d41a08bf8620c79390240c4f192392fb62c9

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\ico-setting.png

Filesize
1KB

MD5
cc9ccbcb5c2a55cbaafbdb9407313e33

SHA1
ade74545b7999b967cd7408b81c159c1a2d6ea27

SHA256
3336084f09fba69a738323eaf1902fe645c10d6b8fc1ad5991c4fab983af53b8

SHA512
b036ce313e9089ffb5d6b6e4df9d650bb59c3b7b6d0eb26518df2dcbc547f210a6c17e10df251d715e192fb49679bbc72df65767549166026f23982651d1178c

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\ie.png

Filesize
895B

MD5
c2e01e32f5986d82d8d0a8cb1b849fec

SHA1
586fa498bb4d11d798bfd1a438a9b2ee81ba9341

SHA256
b9da785e2dceb5be401170ff71414de729421a78373f9ea33701706eb1f4ab14

SHA512
28ad62f2c77d6da11c1d80975f285f5f495b538ae2f47267e84c6d9ee95a7acbf7f332805efe9b85e9a55f2d3fc8e17d8d1007bdd428c6e4624571fd501d335f

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\info_arrow.bmp

Filesize
138B

MD5
60b61df7f3bac2281b201a9c1b017986

SHA1
124e8e3b41c11e70a319e0dde96d4dd50a50d1ad

SHA256
ae31b69ed4bd0528009ec27f0b71bd7827baed3e696cee77871f7f79ede6180d

SHA512
81ff610b6fe353ca6a1dd4da0a9bbce9b43032bf860d01ee4011422d627661afa0f58bcb50a104102a7020940f47e01c38e7aa8d313aeabd9d940a576e7cc06c

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\list_close.png

Filesize
347KB

MD5
f4c67dfd54dc76409f10bffbeec9653c

SHA1
ccb38618ad06a443d20d6a6383cc87eca9eb9b75

SHA256
27f8680fce002312387a061ac8846a55b63f61d81784478948c50742bc665bf7

SHA512
cc7376056dcd2f6a7ed40a2d2058cf01a4a4883b63f23aa8435a0171fb0e4f8a3afd6b92e2ce7e97434b32cd147b7bf2b80c4a74e1e0375b6a439bf5f2444978

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\list_hot3.png

Filesize
22KB

MD5
f4bc2f54afd291f79da294afb28bb4c2

SHA1
2c8ea5b86403532edc9dd89fd05b10e81885524d

SHA256
1a95c2d0a8cf4c64d96e97343bb113582c2d24244b259a1751d9992c4e56eb60

SHA512
cbfbeff09032a317ae2d165b2b78acab0db5149b6376a390b95be708622b0e4460d63135633fd5f3a0b2e5a5749de6896e71bdcd03bc2d81c9fcad1acac2361d

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\list_hot4.png

Filesize
20KB

MD5
1513c11bb3ac1cba85a015f73f58a35d

SHA1
89bdc9079aefc83607ac1394437e17477f775639

SHA256
fb4e6d1ccba70d00e0dba06dbd9dc184dc3ffa5e49031266458c5e790173d663

SHA512
474eff6d3508aedfdded9646aab941c7d62504ab72b76ea5602d8408b91aa80f527e60f42c8b374af272fce72af65d274978e69a303d7070a8ee6e47192b4fae

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\list_new3.png

Filesize
20KB

MD5
324ebfb22f51fa93a440fb48f2a7537c

SHA1
cf25997e336785ad4d71acd30c1d64ab5202868a

SHA256
19b4d0f750420be05b67e11786db484ccb6268305d1b51a0b7cb55b0c17964ef

SHA512
103b3c9e8223a7a67f942d432b03d03fc263d5e9c3f8e3632f4595fb34c319e0e41c0ee429ade1ae8efb640f73c847d634cdc54e6607090afd5321994a756fd1

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\list_search.png

Filesize
1KB

MD5
3b5d282ad85161af7f41b9de28748c97

SHA1
064121ce15afabb9d3c6f0096f53ef900fd418a3

SHA256
eb42fd5c0239abe8029193dd65e05e6a988a07ad7124cd2cc360ce79317e2ac8

SHA512
e26a517deab936f8537f95376daf3a22448b31d9502e38967513b0aaee936a2a6603a7c9caeb453a4ddbec9f8873c67fef798174fc46f6c7dd29002120348d2a

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\list_so_bot1.png

Filesize
42KB

MD5
b7588565aa9d5bdf7cb099bfb734ad2b

SHA1
661926dfa105e8608e1ecad18f49488cad3dd3d5

SHA256
61f58e3c6afce9f02623e0a75869422b210856b313fa6d237838d5f09311890f

SHA512
7334a5e75e45036df7e0c83c592daf7ab60729a1316f87c1401f80c66cfc5bb29b146abe3dd3bca87031e8e4275f055662987bf3c1ce1c5fa34c407eb2c9eaf0

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\logo.jpg

Filesize
23KB

MD5
b6791b83cb6bc477fa10d6e643288a4c

SHA1
b8f91637b8b3d42165878a289cca05c2a5c292ef

SHA256
653fc34f5d6ff7f1c52d324e7a89f0d80dc9fc957453108a231616045f1131b3

SHA512
d523735f2e30c2ce887d5a401bdb67655c929727cf2bcbb8807b84137d6a6ea1aa86cc9959c41c39a06055564956e9a77f19160a0b3a278facbaf368b63d1edd

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\mini_bottom_l.bmp

Filesize
368B

MD5
10af50c0969b6503662c6e91e7131976

SHA1
99933ae3716240274c20de624075636c50d945fb

SHA256
f485895d9802662781a2826ee136a754c459ba9b74fa8c8f70b5e49867ec4d03

SHA512
b6a221be4aeabcb1a92278ed5b64087d2c07e26bbea5e1d330d254d57d710bb33f14ee1e7efe05e410855050dbafe669f7490b2481c343d1092d411a491a12fb

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\mini_bottom_m.bmp

Filesize
888B

MD5
8ce94651a33660e672e528ccbfe36018

SHA1
0b1d8bf9734b4bbc3d9aa135b47cb398ee81a57a

SHA256
ec28045e7c86a960336b647d17904f0385b0f3b992939d6c804192e04380df9d

SHA512
9e12e44daccd99a277acd32ce30918cc3e125b9b52f3009f8ab48b025c148f600da89075e382ed002251fb7acf8e1e703f92be037bb0c4b9f248bf4c46f6c4c3

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\mini_bottom_r.bmp

Filesize
368B

MD5
42ac6ebfdeb3e2b89302db7c13b65e40

SHA1
3af025a905bca406393f207182f6e58037208dc1

SHA256
67401fd8b0a683310e8b927bb9a88d8ddff7cd1caf51886039c5a0ecc7f6eb39

SHA512
5655779cffe16af7e7c4f09af6ba3190293e2ab242019c2677d807353daba1c8da6f183a21d4fd06b701722c8cfff3e0264dd99cbfd19042129f138f575fa1ad

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\miniclose.bmp

Filesize
6KB

MD5
1913f4e524baeb4f4c57b085e9baacdd

SHA1
b403b57b47f9fbbf74bc652e29b49343361e0700

SHA256
b0270b80813eb3f58f4c5b8ea48d992d7c64a87101f2533e8aa0e191ab377f8e

SHA512
b996000d07831bf60cebe07f90197be742666ae44bc3c2cd8ca922d2e06df9c149217aa2c5e43f58818db0da44057a976d04b171a1edcf6748ee82578cd38672

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\newsbg.png

Filesize
1KB

MD5
598cb1909a609643badf57cb1eeed73c

SHA1
888c72c5db5ae3a1539069482d7474feeb8926af

SHA256
0b81a0246f3834541a37a622bd0cdb3e4fb1c269cd1153839c71c552649e7867

SHA512
9bcc018a6ecb27a7797e54aa7fc9651e20c2d08be6a1fac9e08afdfe81c3dc2ce76278bf38c8dfb0061a104cab0e76f0fa69896b5368320c86d53a74c0a91e78

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\passport_menu.gif

Filesize
12KB

MD5
9250eb1978c1c32e34b521dec84e3113

SHA1
bbac89b9aaa77ecd802b081498073c1dde8de8ae

SHA256
71971eb5546b0b69f590c23a1b864eed6848915e58380163887e8ec71701409d

SHA512
5a5cb87bc4657372d61b135710724821bbf5103bd2e7b2ce32ddfc2f14d959481ccb3bdacd1b65d0f34141ce009df50a65c1e7ad305b93768f410d2fadd8f7d1

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\passport_menu_down.gif

Filesize
12KB

MD5
a90f376d23e5b34fd52bec97dfbeccf5

SHA1
86647ba1588d1e670875dab85c655074a35887fa

SHA256
d726fa3d794cf48c0655bde715f0d83074b8003e7da00be43a76462e80edf7e7

SHA512
d8b8c41c3f071bbad9256c29a04f4f5d2207e6edc5a0a77ce7173bb31c8f094b9ada4e8f44cd5390b2200dc87823c68db784ad31e8cf2afba9217bf75630d4d6

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\passport_menu_hover.gif

Filesize
12KB

MD5
9afef1dfbb25e8c68be1a184be838467

SHA1
8aecab5b1101a3dace56b6d71e2d1fbaf7fcf01b

SHA256
a7c12beb73aacbb1b45392d360ccebb398471210434c24dc1a2d2de26ddb035b

SHA512
a7c158fa87a2bf63b6564340bfd62f3e28f8af6713ac9f0838adf5d8bff1ec1467086f8139d34b9f97f18d5d0131bbd54a4572d0721cb3d96cceb096b1a25f4a

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\pause_close.bmp

Filesize
2KB

MD5
921f9e0f79e738cbcb7277cefe25b3d7

SHA1
fbee296dc8d8736df309b1fca3e334cda7fd7e4e

SHA256
9ba700e07659becfe2b296cd7a7e404a1867aa35324e947872a9e747753fc4d2

SHA512
438ad298d729d1d3ee8d0c647d865238a53f8bdc23b75d21ba7126352bd55af844f811cdaf3c10a6280c27327454ee43ce3aa5916b3d60f4702c053235a25226

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\pdot.png

Filesize
21KB

MD5
ee83c8b645256913f438718512ddb49e

SHA1
4abe533ae10c1fc66d85323ce0b66ad3754141ba

SHA256
cbdee398a05cadcc97837fcef690556621a2c5ecbce141d4dffecaf2e43afb63

SHA512
38931f88a130dc5b4a01e6f401a90bf332d8f4343a084255ae3bccb736b90e4f7db109c3a86908f1a9e737f544138327817a220e4b6308c98d2d6f04cb3c77b8

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\pop_close.png

Filesize
20KB

MD5
8fb223589dad37a8595886ae859df90b

SHA1
517be41b0027f5bdceae198eaf1d26cf6d3e7c0b

SHA256
483de28a8b3ff923f647b178cbb2359136ddcc39b28cb2ab49dc3b1bce15e882

SHA512
83080fd3e9210c394b7c8243d6afd0556ed92007e7032f71f232c011e277134f995e679922cf16d3c3e4916c7832a2adbb4a13095386d271779d22b6d5346f41

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\pop_hot_bg.png

Filesize
1KB

MD5
684216b214c3dfddea795f9fad810c09

SHA1
f61612dc07de83e28a43e94c1b7993b096991831

SHA256
935a1311fab214afa1b04c2293362a823b92f72d471bd7d669e164eb0c10e8d2

SHA512
c498065ed09142bc3c71cf7583f613430ccfeecac3cad94fd7c83494eb3a74e7438fd00664785109d3c9504dce451ea237bb4fddd1870dbb4efa82b45c350db5

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\pushplay.png

Filesize
3KB

MD5
db6b0ec13b1b5cdcf55103bccddddd57

SHA1
911a55ce429a221b6c361836b43df306925475bc

SHA256
2094e4e6b2594ba9f91e1e94787dae614b1121ad9a45799d82bd127d4f9352ac

SHA512
971f18f3d1bea1011577ed7dc8db64bd8734fc0f5e82d8587bffb9658bae094f2a907b3786de4a0ce6516eb20798130c332512a1d0f3ce5b17bff56a14ba46b9

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\resizeratebg.bmp

Filesize
3KB

MD5
bf60ded0842986f57dfd06b7e8f3e99e

SHA1
05e4e4efedf14c2e56fa821b30fe620b47d29601

SHA256
a413d31a6ca377f82b0b8c468a894c5320074b7f550db73a29d1fca0c079c587

SHA512
eb7a64bcde6b489f762186f353ae580cc678a805c28c88fba5d8d6bb05fdff5f8deedd436adb4a39d008d5a866fdeb3f9345f8f38640b9014c190eeaa8482944

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\saturation.png

Filesize
366B

MD5
3fd951a3e06d2995e56bb8221ec02895

SHA1
3f2b88d60263cfa90251fc46f13fb1f1b7d95d57

SHA256
82da527e2bd2d206ea9be36b03efd9b327debd13f1669d5547d667a7c2e6e0a1

SHA512
1e09ad7101d91b01213e372bbe3a1db78933042bf3d7c05c36d448e4c942f2fff92225e04ce24d362a7a172d17ee9cbe68daa59069e387a3d06a451be5c3d339

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\scrollbar_pagedown.bmp

Filesize
938B

MD5
8cef089386ebde8d75be4f1ff484dedf

SHA1
9b0d2df216ab05a77dd2d26e25f74ad0f74215e7

SHA256
00ef4863718b02036cba33c6c6a9c418257055ae9ecc05e2e9e363ff7164d31c

SHA512
27aeb168cc70c16ae64f60507250c935038bec80c084c0d54b8a273ec3f4311d02c3c3cf1320a4b87286760187d0654f17bdaf5a7698f970624973912f64d822

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\stream_hover.bmp

Filesize
1016B

MD5
e791d7ee07013cfbfe0692c2b55cf82e

SHA1
aef27b8b3308ea2913d3e33c98103c9306ac1dd2

SHA256
6cee322110c470229ed01a2bfcb0e3f54d183c1b6ee8cdb62488cb382fee4dc3

SHA512
34b91fb6adacba67c840c8b8172f32102c531085f5f89e43fc99e801d6834bc27c0a5828c636d3ac965a3e4715552714b6854782f1730d804870d2495afc917b

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\stream_spot.bmp

Filesize
104B

MD5
5fb6117b007a471e1f2d73cd2936a160

SHA1
9862ea79f4f78803a3d2eab3973e732bec16d5b4

SHA256
59a7eb234a828149cdbdb1eb68eb07302fb1f1083c0b4fbbe0b8fa4f2ce04092

SHA512
eeac0290fafb5153cbb8ec7846e4524ae7abaa9fe6f67574a644c4e99f19061e78c4031188478b3887d46d7926c4334014f846828ff50665114e237c685a0129

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\updatetipclose.bmp

Filesize
3KB

MD5
bca7af70687d7cbc48dd68b7dcb008f7

SHA1
b040f7070c5aaf79cd35074bcb54677ea33f3456

SHA256
303b1ba9ef2cb8067df89488b2766d3689c93dce0ba6b52761b8f20455c7e8cb

SHA512
b2fc433cf549164f2888cd2db260a31d45f4b4900cf26e632238d0a6094b4d3546c3e7f95812cfc21c757e24db19eca31c51e85ed6db1ee48d963b23624d99ed

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\classic_b\white_dot.png

Filesize
130B

MD5
6279a788e5bbf0f129ac093a86075e12

SHA1
60edba3ea26be33b929f12a865fc67a1ebe1f925

SHA256
d4bc2c78b5c5d0e11c6050fdc13671031fdef0af74c4adb08f890ecb797a7257

SHA512
2b660d150708026bb868667b63ad4709d1e3e3ba3363a7fe2d87a7a9fc812f450804bd6859708213a677b48d06abb6807cdaa6305b99941ab98209c4f7eaff93

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\default2\edu2_close.png

Filesize
2KB

MD5
164185a2b1eb74d7857478c43c2c00ba

SHA1
b9232419aa45be96cb081fec1645c948639c89c5

SHA256
28bd25c08a606846c28fb8ba0b31761ddcfb4706dc7bf7883f1330ab322868b8

SHA512
5a464f616488ca4ee8a4d8f73085598473eaf281c6f5760df7cf5ad0fb405a563b6a026c99258c7a35645641c1720786991ac421a39f4b9e82771cf4b3ec608b

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\default2\list_HD.png

Filesize
544B

MD5
22b53edfe6e1d6bde4c145fe4eeb01a5

SHA1
11e8c70756e18ffb8b7c03cb17f9f8e1ccbd9cb6

SHA256
9ed30eb5783647a0f4d3838dd9a4df81794c0234b237e73327aa7b24cfc28f43

SHA512
7ffbed90c92b76d73fd4f537ef1c7d92ecc3ea533c0382a89c2c835e29f7a8af86e46c9f898879814b47c0a6d64b88ae509f63aafc7d6d26b4ec5b80c2e2ac68

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\default2\list_livebtn_down.png

Filesize
757B

MD5
cb96f0c57d50eeadf658f1bd858353ee

SHA1
2367654541eaf27ed1e86b506d3199c18f183ed7

SHA256
36630d09b394828852c5133a3ee909c8d2b5b402cf81477a5036597259943a1d

SHA512
e5a5343e5f3fd57b6f6f8207b86ac13ae9d29213af646aabe9dc5e287989052106c23ee6c809a0cc5024449852435eb897154bc94b68e984dff5759c4d0bc2fc

Download Submit
C:\Program Files (x86)\PPLive\PPTV\skins\default\scrollbar_pagedown_hover.bmp

Filesize
938B

MD5
164b0e5435d98c9b78e5a8b2f67032f0

SHA1
7e97a10a4889f0a40fc09fe0af457994a3f29b54

SHA256
6909bc2d3367d8d28a4f43b4b5dfdfa0118f9d3bc36d758ecfba3241cb0a3e23

SHA512
b1f52be072d6ffcd901bcad633dd74c50eb499f8945158ac1009e7f3690406d43e49dc5469858113e334a5ab12f24560f5d1d9e5af9cb56c9b4287633ae5027a

Download Submit
C:\Program Files (x86)\PPLive\PPTV\uilib.dll

Filesize
710KB

MD5
e99b830adcc096ce62d780fdd90814fa

SHA1
b89d936e5f54fff99ed35174372360300fd08de8

SHA256
2591577448723f483ce559970d1ae513007be03e5a4c9c4729acc839a7861932

SHA512
8cd49094dcc6b6107fe2992e6757da60f284d659bc86e2e1c9ce7024b02b1c48eb5df111091ae7461d02be6b89b7d8ee25eaeac6bf68886820fa086905ad5b56

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst3507.tmp\BindDLL.dll

Filesize
49KB

MD5
45ee47b84617f225b8991c78675e649a

SHA1
5ee71b44abbd9823f0b5e5e93d4bc42da7048669

SHA256
021d056a03fd6a15154caef3faa98dd5388a1338552f8b5c89edffaa9e5a838d

SHA512
9ecab1b534a5a8abe67dc52d443f8ea93dc3844fddea6c6d285e208e600beb529c418559c0b4632e2f4db5c52fb55b5d64b4d207d25356f2c161b91e67862fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst3507.tmp\CommonFuncDll.dll

Filesize
65KB

MD5
65be95b06245e4e636ddcf2c5ec01bf9

SHA1
f4a2c5183c0ae94d71001b6341b69573645abb78

SHA256
0694e66c722eb2d6e9be3460f8a11a80aabe8618c951ee315a0e2a86c914ec4e

SHA512
81d7a7397d02761989e450e4ceb90634820c21f3c7329b0f34a2f090e7392a98cf1b4cb3666ebde0e1cae828984ba75fb784799263f1af4ca43c3bf49867795a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst3507.tmp\FindProcDLL.dll

Filesize
20KB

MD5
943ccc923be093185c04e893245e55c4

SHA1
5d48cfcbe7a659e8c1da7127aced2cffb8e6d125

SHA256
893607cef43f3dbe210b301c6b91d426a4eca11694d8feb5104edd329365f57d

SHA512
5006e7b312a3182b4d638a38579ff1bbbaecf288995d23135d201745b4d2b999357ce8ca051decd51c55620fc144e536d51846f73e42d76c5cd058a00c5661f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst3507.tmp\GetCommentsInfoDll.dll

Filesize
53KB

MD5
aa61ac6aa49a499b30dce871869bb6be

SHA1
cfce11e23f1678fe9e46bc72b54ccc546c6e79aa

SHA256
c5a4a3674b518f7378a900665ac94d39a305f92dccaed5a879c328d6cc308ae7

SHA512
bd1facaded3bb2fa47901e0e0cc27a5376fe11c140a5be26a95a38fd66a1799109dd97ece1c413fd226ef5da3ebf55b0999c80b8bc1eab828a84a4600d84108d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst3507.tmp\GetVersion.dll

Filesize
5KB

MD5
2e2412281a205ed8d53aafb3ef770a2d

SHA1
3cae4138e8226866236cf34f8fb00dafb0954d97

SHA256
db09adb6e17b6a0b31823802431ff5209018ee8c77a193ac8077e42e5f15fb00

SHA512
6d57249b7e02e1dfed2e297ec35fb375ecf3abc893d68694f4fa5f2e82ec68c129af9cc5ce3dd4025147309c0832a2847b69334138f3d29c5572ff4e1b16f219

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst3507.tmp\InetLoad.dll

Filesize
23KB

MD5
7a10bf1243756d9cfbf6a5160d0daa23

SHA1
5770bab5f288383e316e2e59b427f7eac1e50347

SHA256
64d779b5bac8a2b8a31a83cb3b4171141b4809e3e126a546a4c1f7570ee93210

SHA512
3a8d37a47a17893388ad9f58028d98ff0687ecc9fc9f0b0501650544985e3ec257c113381a3910b3b0cc8a06fe4e26fea1b65adfd4768822e6e638a9215841bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst3507.tmp\PPInstallLog.dll

Filesize
41KB

MD5
a04d44787b28d37b4334c184ea4faae8

SHA1
47a5038f2fc45841420a89f08eefd35191aa1fe7

SHA256
34f0eb6f3b7deda82929fba6993eb27cd26d0b791be8031ce0b4729a7dc9dd46

SHA512
a529e5c412dce90f34e13a185e81b757adf140447167b310d056d2b380873683e5b6681f5810be7d1194cfdd64eda25b87a1a5aae70ed4e48be5aa64acbd5346

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst3507.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst3507.tmp\cknsis.dll

Filesize
51KB

MD5
08089179f184f92fafe82e690b335bcf

SHA1
f272226069706e1e2d009e95e408b3303a8b1662

SHA256
58eac56896032ca3babd1093b25be14c1a54ecbec2c7ad0f9ae6b87ffba2a30c

SHA512
6277e5151628a0e8e78006e8c69c44b89c988352e1de02de149dd162bb2a5dcffa3f1bf2844d8a621c1768ea12b8597ddbb1abc375312240873f1151aa0a2dda

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst3507.tmp\nsRandom.dll

Filesize
21KB

MD5
ab467b8dfaa660a0f0e5b26e28af5735

SHA1
596abd2c31eaff3479edf2069db1c155b59ce74d

SHA256
db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73

SHA512
7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst3507.tmp\pnsis.dll

Filesize
72KB

MD5
dde7cd3719145ecf3c89d2a1e79ca1f3

SHA1
92802c38f88c4d57f0b1153b04b4de43af4adcde

SHA256
c930819a0f64879fe3a96c606da4be49613693a43b9b1060dc870bec7b3ab47a

SHA512
dd67858919fea31f0d4df0c012dc9605fc68bb7512924fee04ae41528d02f8f7ddfd32949841b676735a9d3d81f7dcb455854f20467a4a40ee9f48babd5bee5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst3507.tmp\time.dll

Filesize
10KB

MD5
38977533750fe69979b2c2ac801f96e6

SHA1
74643c30cda909e649722ed0c7f267903558e92a

SHA256
b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35

SHA512
e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53

Download Submit
memory/2432-2733-0x00000000043B0000-0x00000000043C2000-memory.dmp

Filesize
72KB

Download
memory/2432-2718-0x00000000043B0000-0x00000000043C1000-memory.dmp

Filesize
68KB

Download
memory/2432-2726-0x00000000043D0000-0x00000000043E2000-memory.dmp

Filesize
72KB

Download
memory/2432-2710-0x00000000043A0000-0x00000000043AC000-memory.dmp

Filesize
48KB

Download
memory/2432-56-0x0000000003B50000-0x0000000003B62000-memory.dmp

Filesize
72KB

Download
memory/2432-2701-0x0000000003B50000-0x0000000003B5F000-memory.dmp

Filesize
60KB

Download
memory/2432-2775-0x00000000043B0000-0x00000000043C2000-memory.dmp

Filesize
72KB

Download
memory/2432-188-0x0000000003B50000-0x0000000003B61000-memory.dmp

Filesize
68KB

Download
memory/2432-195-0x00000000041A0000-0x00000000041B2000-memory.dmp

Filesize
72KB

Download
memory/2432-2693-0x0000000003B50000-0x0000000003B5E000-memory.dmp

Filesize
56KB

Download
memory/4716-2785-0x0000000060900000-0x000000006096E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.