Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    17/05/2024, 05:15

General

  • Target

    SecuriteInfo.com.PUA.RiskWare.Youxun.22766.22244.exe

  • Size

    4.2MB

  • MD5

    322f6e2c296183cbd2d177304e896b6d

  • SHA1

    1271eaa59e3451a331613c4c6a529bbba1f8334b

  • SHA256

    37f9ef58121be8aea583bce2112f5192bbff22aa3eda063f1978626bc42d6177

  • SHA512

    a87ab7e218515187c031e21e8a19c443a2d35b2231c94a23da7e7ee622c05d7224d302f6e4c244bc9554a05cbe2130a8c3610a151ed4e6a55192db172d16f224

  • SSDEEP

    98304:9WTFeiFYbqNMQZyXNG2NbAHfr88Owb/v30uRLEqJ3oNURsUmE:sxXabqN2k1T8GXHRLXJ3oKNmE

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.PUA.RiskWare.Youxun.22766.22244.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.PUA.RiskWare.Youxun.22766.22244.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\MiniClient.exe
      "C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\MiniClient.exe" -anzhuang
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\GameRender.exe
        "C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\GameRender.exe" -ptype:4 -cp:0 -biw:393504 -from: -ha:1 -useiecookie:0
        3⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1284

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\GameRender.exe

    Filesize

    608KB

    MD5

    0d50650038b3c1f054ebca3383204008

    SHA1

    28a33c7141abd4bb893a64d66e078301d3ec538f

    SHA256

    d254cec5a991aab692bc0607f86d0c14f4d0a6664c521f4c51f0260369c6e5af

    SHA512

    c1d257a544c7dafc8262cb0aeb0bead9a9ef385b304c4f983ff59b7282bd4d3812c6558817479a9d1a212822ace7756041aabe7873c0a3865523b831c1561110

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\game.ini

    Filesize

    81B

    MD5

    dab9adc314be606c79c3095c0d5a47b5

    SHA1

    8b29ffd372d1bd179fcc6d2f728cae1bd528ab5c

    SHA256

    0946b9312c31891ddfc56da701bd04674a86aeef799d42c1b57b68f36f55e325

    SHA512

    eac1bb0c9169ce658910f964591b29deb69a35808c2d00b16178aa90654139171446e4eb01392b005c45aaa387a6ed1be5e366043052486f0461245a6a2b82b9

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient.xml

    Filesize

    733B

    MD5

    6315fd5d56d72d2090eff67683e35277

    SHA1

    28568118498ac0e099c7e777610cd13e16ce0f6e

    SHA256

    f29e8976c23d06cbb6151802683ce0f7f1db78e93a42312d7e285e2885d6a9ea

    SHA512

    9093873e214d6a04609054f37b5a201e6da670668f996951ecbfb9959ba603e92ac0c56e13065295c151c7ce5bec7cea9c99f112740762a3a4601064cd15975b

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\bosskey01.png

    Filesize

    2KB

    MD5

    d8fb9b8f6e0a273211abadb5003ff80c

    SHA1

    9b137faf775f6a8b2f5d2e86043815a66c023925

    SHA256

    21cbfc98ba36ba75c380ce69db0f28c51a7d75708156612120dca32c083e815e

    SHA512

    16d386209b67b1cd43840c9b2592e525f03781534e3c7d83bde901d14c8c8a89df7bb48569fdd25d6fd0fade3ef7a5ed22c30d8b1267e5f633162c8464b99555

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\bosskey02.png

    Filesize

    2KB

    MD5

    33f9408ef3d50f0f94c524bbfd737a4d

    SHA1

    8ee75b058914941c461aa257633798ef2c98f3a8

    SHA256

    51d34e1cda0a4141e829a1f8be9f7e96038001720f6b4f7738afeb39b1982c0a

    SHA512

    be31564954e56625fae7bfd71bf4c09d6aff689a3053eba6b0b16b1cecc9951d34e9dce4f0072aea42d6a8212cb371967f7a4c4bdfc7bfcc39cc5fc892a1896b

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\bosskey03.png

    Filesize

    2KB

    MD5

    65bff7fe67bcb05d39778a2eee2c4636

    SHA1

    50487042f1c9bda311874826cc260ae94df1f742

    SHA256

    fef998d70a3690edd14007aa3696a1ac0704c5a209d9d411bd414d4da174409d

    SHA512

    a6c1d6e0dd3c4cf455f69470a1bd6382413e0960de22f5e833d006a9c71402be4e62f43b1f417811656ba3738d9d4d3df864e83594930e6c667fbccd48598307

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\close01.png

    Filesize

    308B

    MD5

    b1980ff47aa6d6d19a9c6b2819d98181

    SHA1

    7368ac58570ce8a3ddb7bed37caa31c2593386db

    SHA256

    a79ce6e8742b8ac3b54dd6a39406fb687ce73af6391cfb94bdbf8d4dc1743152

    SHA512

    5b9bf9f2968ba0feb9de7e20c3d30c58f226b0456af29034ff40ba2b00c0b1c5be98336c1381930be43fabdd10f9c9aac176fb3b9b10b08345a3822296943dae

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\close02.png

    Filesize

    319B

    MD5

    109a733a0fc0a5f893172c883c8862a0

    SHA1

    0b97689f4a0ab82ebe37e083c04920e750316fcb

    SHA256

    2a8d4e033839ad236ce82afa22b7ed8fd010efb620f9fdcbee0561309d918d06

    SHA512

    2b2cdb2793ff0955e9c5ac9f60d06c211ca9d7ee5698397658423b9c6c27106dab4f1a4605ac57610189fd2d0737ed4affd7a9e804284dc7b705062355af5280

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\close03.png

    Filesize

    321B

    MD5

    f92e09ea7e80524883631416cd8751e3

    SHA1

    504100b73e09f66503908d2903670d3860a12d39

    SHA256

    b60e92c06cb2a08dbd75af307d69f5d3746926badd40f19cffe8a71d0492a90b

    SHA512

    6cb1c6106996e12956b65c5a295286e91ca9b92b33e871c73177b27c18091846356639f159c0f165ec9f508882b14ba48d0e68de1cb9e76ed184d8763dcede62

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\fullscreen01.png

    Filesize

    1KB

    MD5

    cab831ef8d3755e66eae454f56577ac5

    SHA1

    6abccdfb345c3a596d8bfdd087a59fb98b4a1161

    SHA256

    c0ff3d9bd82cc64095467d9701136695d846da8bcc0c3455daefaf827afef28e

    SHA512

    494d91d475ed8d6579a265b4d92f217fd9aa68d2036e581ffb9859f2706b04dad84c2cf656b2834928ea9f049252f414a3055052e7292033536f02b94f7db8c3

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\fullscreen02.png

    Filesize

    1KB

    MD5

    c51561c1c2e029a1aac6430bda8854ed

    SHA1

    06e2751d1d303db77cdbfe6857194868b9feb5ef

    SHA256

    812e936241950abb5c4f678827b99ae2a443addc21592719fb894213a60f99fb

    SHA512

    abf0225bf3fbf6b3e137652fc1e7c3e7ecb4f7b9a0ba4920cad520adc2228c16ae7c26426b41fb223100af59fb4cc42a8fb893582f6ebd311ecdb40bf33103d6

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\fullscreen03.png

    Filesize

    1KB

    MD5

    a4422feb3372f95d1829e8e08994e428

    SHA1

    65d60a023f9beec6603969eba0cb5db313d0092d

    SHA256

    04eb792176f2f7e7b6eab98eff8fac93e362b493f85acbb153222af210fabe4b

    SHA512

    7d5613580d263a84d39b260820291c87546c40f7fa930ced10bea60724b7d90bd93ec6a497f50883c8e67cb6f5375e8042d3a80df8196c1d50165276c32a67ba

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\hide01.png

    Filesize

    1KB

    MD5

    824365f2956fb99f6e0e2aa77f1befb0

    SHA1

    366675d25b6781a4ee36f35a6078b6de3b80ec3a

    SHA256

    6dd08b0a1e166d53e700f6e10f50aa774cf52c0dbda17fc41d75086354e04742

    SHA512

    0283b3f5a9fa21735540fc25a85f1adf82e5793dc496ae5c2e760825104bf5e26d575a0f64ea602789f4018331f17d4d514fa000df89595fd4959cc6c13733a7

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\hide02.png

    Filesize

    1KB

    MD5

    0452db7a3fd9178b97c7116fd1808c31

    SHA1

    823b9db07cfe21edd035759252f6b2cf0212f642

    SHA256

    70d157ff71f7c9630be664c4c9f01d7746c51551757899e2e405fa8efcc6fc3d

    SHA512

    08f92b44dfe3e501df9e7a608b7bcf61ed614ac84dcaae5455965087d7c4dd6c4f2175e8a85e0e479eccdcaea8efaf224e4a31277d1cd3d3514ba74903a7df56

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\hide03.png

    Filesize

    1KB

    MD5

    2abc839a826f71a386be99abc014a2cd

    SHA1

    546fa17f78e507b43964d83a193082a168555b04

    SHA256

    39560d3397fcc42667a1f757215f4fd9445f6a47bab25feb8c08adfe49a53505

    SHA512

    ebfa3ff92131caf64ddf81ff406a2688bb43b699a7e620660284042e26e0a770f478a2e0f4fbe0e19a8d41aabefd051ab0ba24a223eef5ffdaf30b1fa32fbb97

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\home01.png

    Filesize

    1KB

    MD5

    a722febe4b45a35fcc7f4a55e55f8ec7

    SHA1

    fe72d6568cb9596d85d569c97e864a9801702dd7

    SHA256

    580232525d80ce2afb2484ce50d839a818dac269a16b943d37896ea721e03174

    SHA512

    e5e3cebf5c6e05f72e8c074491db96430a7c2e5f14ac36647b87e26422e4f8c31a25934247b1e4e68ede708bc5308ca79b189f2a5850ed01947772c4db1e0081

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\home02.png

    Filesize

    1KB

    MD5

    e413f11764f7c4c0ba24bc5b3f778884

    SHA1

    d509e94c7a4427b6c85abfa598846b4e13c78d76

    SHA256

    b97e3fe9c83f6e882a3cea0144d44293b0babdf8812dd352047dd758da098c1e

    SHA512

    ba5cde8e2d5675d9db4f37aaf2b5bc622278e980c5fad4883ff29c167c131cff3752f923a2c82d607d0cd25ed1f8d783f408e28fda946b32b78b75eef306584c

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\home03.png

    Filesize

    1KB

    MD5

    682ad83f1102eeecc5f9bde1184ade9d

    SHA1

    a3f55a85fa0585d68f3c7f5798e8c78efbed4246

    SHA256

    b4b7c1a1c6cc48e6c074f6beeab916b2f09cf2a0df6466d40c3865ab661398e1

    SHA512

    4a4f8c2cf6278ff63a3cf40d09999a82bd3e60a2e4035f96664920414d2e052de077532e1defec670de9ebe86d259845b3aaef2f32d4fb570e87c7e72257c079

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\mainbg.png

    Filesize

    798KB

    MD5

    5fab44780204953a040d21e4055a6cb0

    SHA1

    f5f7d58fa9e5a70714f6421d1420f3b549626f69

    SHA256

    35530c32d99ae1542d9a9629e72fa6fae86b91730d8d985909c62e60ce031b76

    SHA512

    6491ed2f89968d89d217d89706ba7a4655b1f55ca6dfe8709c6091259a5bea04b3e4acc4e43c2a1db170a81414297b62d8a48aa08f8103740f2d0ef2f7d38463

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\mainclose01.png

    Filesize

    2KB

    MD5

    c9b4468d1df6d532750b7b2764563c79

    SHA1

    bfe2272299aba6954b855693004041da590b96e6

    SHA256

    e8ec8c37b25a241c9bd42ecacaa54fd60778e137ae9be3558f65df692db2da2d

    SHA512

    3c820460467ad10782fa0a5085efb56145688d042ed18da197014872fd44f6e0c0aba3232ba381ade40f9ffdbc5497a9c786ed9778a25774924077226c184da9

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\mainclose02.png

    Filesize

    3KB

    MD5

    d0f2d023fe94e1c1f476b3985e3f59e1

    SHA1

    019d95b7207d04b012b8987302c0702a70cf0636

    SHA256

    6fc84ebcb7315e584ebd7b53e44a0db9bef931ac40d63d8492fbb165d669a39d

    SHA512

    ada5f5a31cd72822cd48c90bd6f539e8e9055dbe9c85ce431a3f1d14a03e089e73f728ff65bcae89360e0d05e55005e9834dbdfba83dc804555cfb2a18cde7ad

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\mainmin01.png

    Filesize

    2KB

    MD5

    35c46a6ae36af491feb02d7025066d2f

    SHA1

    ab37c304b3d3555e71c6980084851fe8a7b53ded

    SHA256

    efc26bd66efed5f587047b5f6dbd67c62a03f9c22c1ee29197e6f625160f7006

    SHA512

    df61ca66085e59d88aeac8038f5b4cf2f02332ec873272dd5d7a9a6a0e175feee0ed9aa89926d78dea2476a04fcd95fb308e6a10c69061694c4018f9a47da495

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\mainmin02.png

    Filesize

    2KB

    MD5

    ed7a51157b708370278f8eebabcf66b6

    SHA1

    1f10461439ee6580c5b9aec1844c7c24d732574f

    SHA256

    88a00874c667f81b4e5c8e9e33b8d39ed1b78d54ebef509584295227d30df52e

    SHA512

    b84a2cf0b330836afda9864e6b9c55d4f5e3b821524e52301d9e6286c7c25395ef3c3bfd2882b97d951fab1e3bc8ff035b12f82cc5778f84f7364ca8f80a1550

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\max01.png

    Filesize

    1KB

    MD5

    bfa3c58838a350f2138a255cd684cf73

    SHA1

    36dcf83e755bfbdc79568f3a8a54e8da8cee7eb6

    SHA256

    e116650a9820d299569c787ec1c0de67c67bd5aa9ca989e0377e0dd8979275d6

    SHA512

    dd22505bef1671b8314592611a2fb5567af24e73cfd575ec3993541229ac06511a186ca65ec376e1d8f94f75c46be90e3bfb07af0e919d45b4443e0bf2e6a28d

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\max02.png

    Filesize

    1KB

    MD5

    52d0405d781fd3c82d895fbd4d5c60f8

    SHA1

    924b25d5a1dd8b4821b1ab631c77153ac70d56f4

    SHA256

    66c3b7bbeba84c85041cbac941640f1610e4e481af5109f7743d1a465ab4c8df

    SHA512

    cc608f90a87d69b17a0dbc9bb39988006509d68bc6d09583952322bda5b46575563ce777e3f5aa58a962a41f545dffcf82e82dee6b3289b585626e6a8618ccc1

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\max03.png

    Filesize

    258B

    MD5

    e4362bcd93c0f9388b4f93e161e3948f

    SHA1

    db89059d3ac442c97241253f38d67e7000fc57dd

    SHA256

    6c938cfd3ee4d518df17efe0872c78b15b2b7e2f82a53b381536744951ad7617

    SHA512

    5a222f1873a750081579f877ab8b4e49c56a04573063070c45417ff6976d85bff7e9182df7098a8115d93d74ba8bfca4ec2093ef41b3531eca9c3af7c1516be3

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\min01.png

    Filesize

    1KB

    MD5

    ec77721255b943c9f2634eb7df250ead

    SHA1

    49c6cadf66bd77df6fd341b1057d714be3088cf1

    SHA256

    7de659db4f2d3daa5f52b90be28f6bdcecfa385553adb3752dd45a604d83983a

    SHA512

    2a28f42da59764a995b3f266ead0ab635aad0e1e9bcaf4b8abbc7a0de4cf0a32135a0a8804c0147388b58e3c108654157fbc41114ad5330e68645f5fe2e0a8d7

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\min02.png

    Filesize

    1KB

    MD5

    d170c02193f561461a2c61cb4f7b11e1

    SHA1

    792e244f2deb21e2186efd756be737866a691cf1

    SHA256

    65ecdbe9020034c43a97e6e2d12acf1f5ba739b104d746a706d189cc42b9e69f

    SHA512

    54e970fc0db8e6e96f1bcca0044dffb1c75f97c7d039505813af7e85a98a7e8ded43ef0824ef39903502c170f013deeea96434e1a473f6474a1a3a44efc2273e

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\min03.png

    Filesize

    1KB

    MD5

    67a3c8289fbb86efffa79ed72b169279

    SHA1

    b0a20fe5e6ae7269f336e2a1d82a04f222b26e2e

    SHA256

    70c233958ec7f9f474a5dce81c63cb48111adf48f4da413824a877ddc7e10266

    SHA512

    3f091241b4ca0bb3fa84e7b9bec56eaa5f4839edad9dc41a9f95158dc94a44467b2dfc6371d7286f8611e0985594719930e7b46a87d8081900b54bd429032cb6

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\pay01.png

    Filesize

    2KB

    MD5

    b6f5bef82fbe5e471ab88bebe64949a3

    SHA1

    897b8b93586a04031a3d1ae3917c002c2da91ca2

    SHA256

    0f8aa236b2520282ffb12b66c9f9e4b63a92a172812cad1db05cd2df67b3f758

    SHA512

    ff5b71b36f1b25f29346c263f2f6c93aab17e025de4effcb2da33f932180d3a1359867957211b80b8649255742bf731cd98e4e6882ba5948386462617cca783e

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\pay02.png

    Filesize

    2KB

    MD5

    6281a7a0cf0327e96181875af7fa2a00

    SHA1

    e5a016693b998b6cf119e7394409936910e1d009

    SHA256

    39d10c372b2af1fa8667b7b454e336cb2ca90c19ddd711d407ddcdef8afad470

    SHA512

    ed364bf6d26fb2529240344fe03cd1aaca88c9a0d68b12331fe90d32c19d2c0495597291bd6f0b822219e07bb6c777b67c5a4a13c609b0c9df017e3892c9a5a5

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\pay03.png

    Filesize

    2KB

    MD5

    873fcd045dd9857168fcda2b8d2adfb4

    SHA1

    39ac050e9e2b46b243e65433b8dfd2552b7e7c07

    SHA256

    a194f540543bda4d70f436f827dacb0d5f01b628872a40b5b23ae5c61ab28329

    SHA512

    76c970dc705be005429eb3d4134dfb6ad2423d09d4e93cd97050b7f4ebcf34ee3cb6c747deb0a05d579ad1d82e75ccbfac3ca26e2699d0adcb3f294fa78c971d

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\refresh01.png

    Filesize

    1KB

    MD5

    1506c03bd3753bf1fb3ef5773baa3fbe

    SHA1

    454129850be04dbf4ca006ed718a312ce56f10de

    SHA256

    49052282c9318f4e657571b55f3aa72b23500b86eb6f3d480105e506e2091e7d

    SHA512

    30c4a01aee2168890ed4bcd5bbd3787ba8980b51ce9b20dda478ea3337e601dac3f657af043dfe3dbd12a2aa61732659c3be31ceb766b49f2a734745095e33dc

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\refresh02.png

    Filesize

    1KB

    MD5

    062dad69ce0c4ba022814ac18d9344fc

    SHA1

    068f5942711b869340d84d088b7a33af46e96d8f

    SHA256

    9e50d5202d0f5235618c338bcd8bf838282d9569aa26472b6312d152f5656eab

    SHA512

    49f7ab0d8b28f598748a1df00256668e668f3df8ddcd5996638c551ee60513021cb4edb9060e3e3f78dff3ba3a164932b3e02bc57c46183d76b5ca78957af53c

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\refresh03.png

    Filesize

    1KB

    MD5

    a7c1e76c5075443d80385bd55281abf4

    SHA1

    77b93dce8e3d18e7218ee35cf0ddebde349aca66

    SHA256

    9d3263a7680e048f6f61f94cebe95e3a56155480bb63c052620f9f99faa7951c

    SHA512

    9870d7f701695c91a7a4dd27d7af21b52ad76e282f41e291115f8baa07c239761e6c496e6064918a12311b7a985e644449305bb28fb4b657427697d4b7a5ec5e

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\restore01.png

    Filesize

    1KB

    MD5

    5e73652908f2be6b9a23a5e04b940d3d

    SHA1

    110d3974d0fabf56e4c57e86a0f9e189f1bff09f

    SHA256

    ead8184df634506d486a650cf68dce4f31d28eb816f42af03b2887dd19f57496

    SHA512

    55e140ad1b8481fbb44fae82a913a01ca5142847213a913f9d6c80667f4c0d1359e8249320ad7144e9498965966280cf4075fd1c935c48955c8865364a99411d

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\restore02.png

    Filesize

    279B

    MD5

    7c3e781df232a4693012f7d78414a551

    SHA1

    7b371119a1350ce105923d713d2d9e5d0b7d5772

    SHA256

    e900ab141e9a0a3df385b05466b79d8f0b512bef08ed49265014c94be2cb7f28

    SHA512

    e33b3c821df56ba8b607eb0acef505006e7745c7071384eaca992353d8a32eb101e8420c67817ba901ab11bf57cef4a35b2f3772621253d0f37cd210ac041ec6

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\restore03.png

    Filesize

    291B

    MD5

    f24ec6b2ddfffe24b53b61fb4cb8f7ae

    SHA1

    10be192ff98fe4d145b5417e86f5da028883ad92

    SHA256

    0fce885ab9083b12f364b5785547436886c5e376b0d94a195e8a0ce4fe003e29

    SHA512

    236af0db00a8710562cf602ae65c21b32af457955a7c809c930ad36080209be5050d1e6c8bd65ad9eb8aacf32ff73f9fe10a015f2ff4334d10d0bceafdef6775

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\service01.png

    Filesize

    1KB

    MD5

    a7625f6d0e4e743b1779731c8df00267

    SHA1

    ccf3fe027f5746fc11e4d3de13679e76b53845f4

    SHA256

    5dfe2a8ead9e6ddbd3ccbd36b3c8f8af63b96d1e2b7a4c0e5cd42769c0a2d268

    SHA512

    5901bb8f8a034fd820134d3869c3f57f62608b9f94f5bfd0ec282203eaa64690848ba3545d67b5b58e13c0d7b2e91f1909f600642af6d33e31a2bdee5b1e79a1

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\service02.png

    Filesize

    1KB

    MD5

    0711a63388c2e7e0b1149fb69f43d82f

    SHA1

    21f9c657c2502fc12092b507d378a1af4b1a1e20

    SHA256

    0f57b89b32b63fe2a187c9152b4667919c61d41d52224015abcde268361c68c4

    SHA512

    d77e9b241a11201fc5c3e3c2a828d1fc62424027de6aa0e23de0becc96be7606d43baafaf74df36ddad5cd3151ed0ba77ff2933aacfe91903ab2e9236687c39e

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\service03.png

    Filesize

    1KB

    MD5

    a8c608ce291a2ceb1e8f750aa7f169dc

    SHA1

    9b2f3dd7403782ad47d97c74b47c44507741312c

    SHA256

    ec68a620c91b35855c81b75ecf5d5318d82616c2d201b4bb3d8223751c6a13ee

    SHA512

    18014c7d749b82fc8087b5005df0eefd15c660792d9444399ab1138245a91ef2e0d95a67191e3522c7e98493e145a20f9b28342e7dfbc45a48fadf5db2e545ad

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\skin.xml

    Filesize

    5KB

    MD5

    c73e0952b2d892325707ee4462d8c4e0

    SHA1

    cf06412b7e632a22b32f17ef63f1458d5a79eecf

    SHA256

    a429a7180f6eac82759a9f4ffee99cecfce274969c3671aa706452ac35ac27aa

    SHA512

    a19b5f3f5d8e9355427b1154bf35f883a7590143d1b87bbf4b3d1e3f878990b848d2dcc91abec0525c17824a86daeb8a05e8b4d3ad98ff9c6f61257f28605b6a

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\soundoff01.png

    Filesize

    1KB

    MD5

    a1710774a792be2527141423300ad448

    SHA1

    4759bbd12c1be54ea62ad377c65ee5e6a257df4e

    SHA256

    1ff9ad290e5cb2245fb9b8b1e9a2f469107722c42106a6cd1c82f35cf55cc293

    SHA512

    fa8a1a31ca038df80ae395b4629e3159585314012c28e6f515d581358ace24fca4722e95dd3e8e511c92ea5c0e7154f13e15b197c4318ceb60cb2d6092184b95

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\soundoff02.png

    Filesize

    1KB

    MD5

    ef0e3de67bc5b8b857704950ccb30301

    SHA1

    43fd3dfc7d708e09ad85f6839f8764f3e6709b6c

    SHA256

    e6c38b95fb3659ad74a1294f74feea92a7c00f516b24b3b83b492c0e97d2c77b

    SHA512

    e8b939b3ffc3741863d6e8c9d6e42968da2607f22a91935a5a99578223318d2702dbb390390dfcf735a46ef59d8bd816a189209ac655a1fc8ea021fbb008de01

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\soundoff03.png

    Filesize

    1KB

    MD5

    ca9945f9ad7759f6c9978a3e1a45eaad

    SHA1

    46bf847ea3bea1579675c0db998a084766f54679

    SHA256

    bfce88b33a626ec785670c9ed2a7c7a6a90b364f8b4fcc52ecdaf871b9d8a09d

    SHA512

    c6cf6f7505b1e27eab8de96236e315f2230d555f1b9750dad7e4a7c5ec0971cda826b943b9def7d8a71f4aab2cf5fb5236274fbc4a5d8c673841a53f60b05896

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\soundon01.png

    Filesize

    1KB

    MD5

    9f2ec2d8eca7aa6fdf684928824a6714

    SHA1

    98c3d7be7753f2fa26900af3f3d46b5f9ef5b2b3

    SHA256

    3285654edc06ddf2afcbe0352e7e48e2ed20ee21a45c04b2348ce8ff22fcbd15

    SHA512

    b39abb24c09aeaa54facc0bceffa1518ce350c5dba9e63c73647233c9037caa89c641434dd40381bf3c221b20ab29b243a29fa463cec31a3e73cf89e09a8a73f

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\soundon02.png

    Filesize

    1KB

    MD5

    e075712b26463a3b320297f4b86d8376

    SHA1

    e525dfa1a29d90f288b1916700551d104a2acb83

    SHA256

    8068e702c5418e4c758fbba915db6d80ac4914435537bda98b2c125c624101aa

    SHA512

    9a23170cd92ec21e86d17f5a3af072bfb028945038c7935e1b31cb03ad51a34cfc4659aff412af3f61fd3f61594225accf13b447997b8ea009a382bf2288c974

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\skin\MiniClient\soundon03.png

    Filesize

    1KB

    MD5

    fdcfb14f461603361e84dea69c003134

    SHA1

    f016cbf566ae1165c23d8e09bec289c82979fd8f

    SHA256

    7e3d530cf3cd0a260945149773c4fc6d8beb9fd62d1c8d6165a7160593aafc50

    SHA512

    548ca0c72534b91752eb1265c6e632b41154a3b8a02caa7ebe20960765e0f4ed9da95ad08657e59cdb0953fe2c9d0547f91072816850172e4a06c814381afa02

  • C:\Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\zlib1.dll

    Filesize

    105KB

    MD5

    b8a9e91134e7c89440a0f95470d5e47b

    SHA1

    3cbcee30fc0a7e9807931bc0dafceb627042bfc9

    SHA256

    42967a768f341d9ce5174eb38a4d63754c3c41739e7d88f4e39cd7354c1fac71

    SHA512

    e8583ea94b9d1321889359317e367abc88e90e96d0d9243258244a527ffa2b13ab97d0787693ca328960ceb934ea11eefd14abafd640a654473c26e420d2ec54

  • \Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\MiniClient.exe

    Filesize

    4.5MB

    MD5

    936955d0c2959a3ffb8c586718d8e6b3

    SHA1

    01c04741b3e77de7ebdb598a0a8dd3b967dfffb8

    SHA256

    dd190e210e545d39cf304cfcaf4335803e907553aa6547103a8b21b9656b88e8

    SHA512

    a8e478a252ced5ed1025c8b299624f246fb1929d864ae497152cbeb75a1d55475df947d790bf77bf7a4a179fa886ce57d0550020b83636b9e9973618675013df

  • \Users\Admin\AppData\Roaming\3dmÈý¹úȺӢ´«\uninst.exe

    Filesize

    502KB

    MD5

    1a0d8ba35bc0f7f3e81dbd33738f1e6a

    SHA1

    3f0fcf39f70df52a00f4fc31473f046650dba410

    SHA256

    992a4624a43642d6cd22350aaf229957cb98d02f5bfc084011586611d4f8552c

    SHA512

    e802b007ea4018423dd4c412d6ed9895cb35b78477a3b8638bbad3a86b7116575ef1d2f054101bd07f191b34de9314d40730e91426f06191b67abb3fd7f89acc

  • memory/1284-119-0x000000006FFF0000-0x0000000070000000-memory.dmp

    Filesize

    64KB

  • memory/1284-124-0x0000000076A34000-0x0000000076A35000-memory.dmp

    Filesize

    4KB

  • memory/1284-122-0x000000006FFF0000-0x0000000070000000-memory.dmp

    Filesize

    64KB

  • memory/1284-118-0x000000006FFF0000-0x0000000070000000-memory.dmp

    Filesize

    64KB

  • memory/1284-117-0x000000006FFF0000-0x0000000070000000-memory.dmp

    Filesize

    64KB

  • memory/1284-116-0x000000006FFF0000-0x0000000070000000-memory.dmp

    Filesize

    64KB

  • memory/1284-123-0x000000006FFF0000-0x0000000070000000-memory.dmp

    Filesize

    64KB

  • memory/1284-120-0x000000006FFF0000-0x0000000070000000-memory.dmp

    Filesize

    64KB

  • memory/1284-125-0x0000000076A20000-0x0000000076B30000-memory.dmp

    Filesize

    1.1MB

  • memory/1284-115-0x00000000000F0000-0x00000000000F1000-memory.dmp

    Filesize

    4KB

  • memory/1284-174-0x00000000000F0000-0x00000000000F1000-memory.dmp

    Filesize

    4KB

  • memory/2560-110-0x0000000000090000-0x0000000000091000-memory.dmp

    Filesize

    4KB

  • memory/2560-172-0x0000000062E80000-0x0000000062EA2000-memory.dmp

    Filesize

    136KB