Analysis
-
max time kernel
114s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2024, 15:11
Static task
static1
Behavioral task
behavioral1
Sample
0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe
Resource
win10v2004-20241007-en
General
-
Target
0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe
-
Size
1.2MB
-
MD5
948b45f0c26a433435f6b881d38fdf80
-
SHA1
f996307d9fc781f322c3c4f659120eacbf412a02
-
SHA256
0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2f
-
SHA512
ecbad1e6197bb2a18e4c784cdff0c1ae832e1b73ede6e905b491f00bfc236c30546c78f162edb085bca8f9c858a1d3ea2978cc5172f7d12c789ee1a827c9b82d
-
SSDEEP
24576:hvpH41Cl36RgrO/+sQWdKHsJYrrg0H+2UbDC:pmvQpOY3gH2UbD
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ QQPCRtp.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 5 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\TAOKernelEx64_ev.sys QQPCTray.exe File created C:\Windows\system32\Drivers\TAOAcceleratorEx64_ev.sys QQPCTray.exe File opened for modification C:\Windows\system32\Drivers\TAOAcceleratorEx64_ev.sys QQPCTray.exe File created C:\Windows\system32\Drivers\TFsFltX64_ev.sys QQPCMgr_Setup.exe File created C:\Windows\system32\Drivers\TAOKernelEx64_ev.sys QQPCTray.exe -
Sets service image path in registry 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QQPCRTP\ImagePath = "\"C:\\Program Files (x86)\\Tencent\\QQPCMgr\\17.1.25794.211\\QQPCRtp.exe\" -r" QQPCMgr_Setup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QQSysMonX64\ImagePath = "\\??\\C:\\Program Files (x86)\\Tencent\\QQPCMgr\\17.1.25794.211\\QQSysMonX64_EV.sys" QQPCRtp.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\tsnethlpx64\ImagePath = "\\??\\C:\\Program Files (x86)\\Tencent\\QQPCMgr\\17.1.25794.211\\TsNetHlpX64_ev.sys" QQPCRtp.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QQPCRTP\ImagePath = "\"C:\\Program Files (x86)\\Tencent\\QQPCMgr\\17.1.25794.211\\QQPCRTP.exe\" -r" QQPCTray.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QMUdisk\ImagePath = "\\??\\C:\\Program Files (x86)\\Tencent\\QQPCMgr\\17.1.25794.211\\QMUdisk64_ev.sys" QQPCTray.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 11 IoCs
pid Process 4528 QQPCMgr_Setup.exe 1996 QQPCSoftCmd.exe 4428 QQPCRTP.exe 4436 QQPCRTP.exe 1612 QQPCRTP.exe 3196 QQPCRtp.exe 1596 QQPCTray.exe 2104 QQPCTray.exe 1464 UpdateTrayIcon.exe 4900 UpdateTrayIcon64.exe 3448 QMHwDrX64.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\QQPCRTP QQPCRTP.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\QQPCRTP\ = "service" QQPCRTP.exe -
Loads dropped DLL 64 IoCs
pid Process 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 1996 QQPCSoftCmd.exe 1996 QQPCSoftCmd.exe 1996 QQPCSoftCmd.exe 1996 QQPCSoftCmd.exe 1996 QQPCSoftCmd.exe 1996 QQPCSoftCmd.exe 1996 QQPCSoftCmd.exe 1996 QQPCSoftCmd.exe 1996 QQPCSoftCmd.exe 4428 QQPCRTP.exe 4428 QQPCRTP.exe 4428 QQPCRTP.exe 4428 QQPCRTP.exe 4428 QQPCRTP.exe 4928 regsvr32.exe 4428 QQPCRTP.exe 4428 QQPCRTP.exe 4428 QQPCRTP.exe 1744 regsvr32.exe 1744 regsvr32.exe 1744 regsvr32.exe 1584 regsvr32.exe 4436 QQPCRTP.exe 4436 QQPCRTP.exe 4436 QQPCRTP.exe 4436 QQPCRTP.exe 4436 QQPCRTP.exe 4436 QQPCRTP.exe 4436 QQPCRTP.exe 4436 QQPCRTP.exe 4436 QQPCRTP.exe 1612 QQPCRTP.exe 1612 QQPCRTP.exe 1612 QQPCRTP.exe 1612 QQPCRTP.exe 1612 QQPCRTP.exe 1612 QQPCRTP.exe 1612 QQPCRTP.exe 1612 QQPCRTP.exe 1612 QQPCRTP.exe -
Modifies file permissions 1 TTPs 3 IoCs
pid Process 4164 icacls.exe 868 icacls.exe 2676 icacls.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\QMContextScan\ = "{63332668-8CE1-445D-A5EE-25929176714E}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\QMContextScan regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\QMContextScan regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\QMContextScan\ = "{63332668-8CE1-445D-A5EE-25929176714E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\QMContextScan regsvr32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ QQPCTray = "\"C:\\Program Files (x86)\\Tencent\\QQPCMgr\\17.1.25794.211\\QQPCTray.exe\" /regrun" QQPCMgr_Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ QQPCTray = "\"C:\\Program Files (x86)\\Tencent\\QQPCMgr\\17.1.25794.211\\QQPCTray.exe\" /regrun" QQPCRtp.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA QQPCTray.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\U: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\Y: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\Z: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\E: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\M: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\P: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\S: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\W: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\H: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\K: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\N: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\G: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\J: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\Q: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\R: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\V: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\X: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\I: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\L: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened (read-only) \??\O: 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 QQPCMgr_Setup.exe File opened for modification \??\PhysicalDrive0 QQPCTray.exe File opened for modification \??\PhysicalDrive0 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened for modification F:\autorun.inf 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe -
Drops file in System32 directory 55 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent\QQPCMgr\beacon\bc_0WIN0DJ6VL4UY2KW_09.db QQPCRtp.exe File created C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll QQPCMgr_Setup.exe File opened for modification C:\Windows\SysWOW64\msvcp140_atomic_wait.dll QQPCMgr_Setup.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent\QQPCMgr\beacon\bc_0WIN0DJ6VL4UY2KW_09.db-wal QQPCRtp.exe File created C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll QQPCMgr_Setup.exe File opened for modification C:\Windows\SysWOW64\msvcp140_1.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll QQPCMgr_Setup.exe File opened for modification C:\Windows\SysWOW64\vcomp140.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll QQPCMgr_Setup.exe File opened for modification C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll QQPCMgr_Setup.exe File opened for modification C:\Windows\SysWOW64\concrt140.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll QQPCMgr_Setup.exe File opened for modification C:\Windows\SysWOW64\vcruntime140.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll QQPCMgr_Setup.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent\QQPCMgr\beacon\bc_0WIN0DJ6VL4UY2KW_09.db-journal QQPCRtp.exe File created C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll QQPCMgr_Setup.exe File opened for modification C:\Windows\SysWOW64\vccorlib140.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll QQPCMgr_Setup.exe File opened for modification C:\Windows\SysWOW64\msvcp140_2.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll QQPCMgr_Setup.exe File opened for modification C:\Windows\SysWOW64\msvcp140.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\ucrtbase.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll QQPCMgr_Setup.exe File opened for modification C:\Windows\SysWOW64\vcamp140.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll QQPCMgr_Setup.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent\QQPCMgr\beacon\bc_0WIN0DJ6VL4UY2KW_09.db-shm QQPCRtp.exe -
resource yara_rule behavioral2/memory/2112-18-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-9-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-21-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-7-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-27-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-28-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-19-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-6-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-8-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-30-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-38-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-37-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-39-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-40-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-41-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-43-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-44-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-45-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-47-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-49-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-51-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-52-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-57-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-58-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-61-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-60-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-64-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-65-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-67-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-68-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-69-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-72-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-73-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-76-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-77-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-83-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-85-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-86-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-89-0x0000000002380000-0x000000000343A000-memory.dmp upx behavioral2/memory/2112-93-0x0000000002380000-0x000000000343A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\api-ms-win-crt-stdio-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\SystemAidBox\api-ms-win-crt-multibyte-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\DownloaderMgrScript.dat QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\SystemAidBox\bugreport.exe QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QMTrayPlugin\QMPublicTipsTrayPlugin\QMPublicTipsTrayPlugin.tpc QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\TVL00003.tvl QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QMTrayPlugin\QMSysOptimizeAssist\denoiser_info.ini QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\TSVulEngine.dll QQPCMgr_Setup.exe File opened for modification C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\api-ms-win-core-datetime-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\ClinicData\res\transparent.ico QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\imageformats\qwbmp.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\QMNetMon\GFCustom.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QMLogCenter.exe QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\QMNetMon\GF.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\TAOKernel.sys QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\SystemAidBox\api-ms-win-core-memory-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\FtsysSoftUninstall\FtsysSoftUninstall.tpc QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\SysHomePage\SysHomePage.rdb QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\tsmsc.DAT QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\TSVulFWX64.DAT QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\IEStartPage\browserlist.dat QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QQPCSoftMgr.dat QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\TAO\MFConfig.etf QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\TVL00000.tvl QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\WeChatOCR_1.0.1.23\Model\sohu_simp.txt QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\QMNetMon\api-ms-win-core-errorhandling-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QMRecordPreview.exe QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QMTrayPlugin\qmavtrayplugin\sm10.dat QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\WeChatOCR_1.0.1.23\api-ms-win-crt-locale-l1-1-0.dll QQPCMgr_Setup.exe File opened for modification C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QMUpdate\xGraphic32.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\platforms\qwindows.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\ContextMenuMgrPlugin\ClsidDictionary.etf QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\FtsysSoftUninstall\FtsysSoftUninstall.rdb QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\HPScanUIPlugin\HPScanUIPlugin.rdb QQPCMgr_Setup.exe File opened for modification C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\api-ms-win-crt-process-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\SystemAidBox\api-ms-win-crt-process-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\WeChatOCR_1.0.1.23\api-ms-win-core-debug-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\SystemAidBox\TSSysKit.sys QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\ToolBoxUIPlugin\ToolBoxUIPlugin.rdb QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\SoftVerInfo.etf QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\TSWebDownLoadProtectX64.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\QMProxyPlugin\QMProxyPlugin.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QMIpc.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QMUpdate\api-ms-win-core-profile-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\QMNetMon\api-ms-win-crt-convert-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\api-ms-win-crt-string-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\cef\devtools_resources.pak QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\msvcp140_2.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\NodisturbOOList.etf QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\apps\AppCtrlInfo\SystemAidBoxCtrl.xml QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\GFCustom.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QMTray.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\QMNetMon\api-ms-win-core-processthreads-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QMTrayPlugin\QMTrayPlugin.xml QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QQPCMgrCmdline.xml QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\TSVulInc.dat QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\SystemAidBox\api-ms-win-core-profile-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QQPCHW-x64_ev.sys QQPCMgr_Setup.exe File opened for modification C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\msvcp140_1.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QMUpdate\api-ms-win-core-errorhandling-l1-1-0.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\InjectHostExe64.exe QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\plugins\SystemAidBox\QMNetworkMgr.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QMTrayPlugin\QMAutoTaskPlugin\QMAutoTaskPlugin.dll QQPCMgr_Setup.exe File created C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QMTrayPlugin\qmavtrayplugin\QMShield64.png QQPCMgr_Setup.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e577f71 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe File opened for modification C:\Windows\SYSTEM.INI 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQPCMgr_Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQPCSoftCmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQPCRtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQPCRTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQPCRTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQPCTray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UpdateTrayIcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQPCTray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQPCRTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{16EE6530-8649-4F42-A9E4-F6A3295AF975}\AppPath = "C:\\Program Files (x86)\\Tencent\\QQPCMgr\\17.1.25794.211\\" QQPCMgr_Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{16EE6530-8649-4F42-A9E4-F6A3295AF975}\AppName = "QQPCClinic.exe" QQPCMgr_Setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{16EE6530-8649-4F42-A9E4-F6A3295AF975}\Policy = "3" QQPCMgr_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute QQPCMgr_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\PCMgrRepairIEExtensions QQPCMgr_Setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\PCMgrRepairIEExtensions\WarnOnOpen = "0" QQPCMgr_Setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{16EE6530-8649-4F42-A9E4-F6A3295AF975} QQPCMgr_Setup.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_30 = 3874d037c712e567e705819e9fffc6764c1730e303922a5627c3e522bd2e1d1772dd7bcab44d527be9ac3844cc6f8805188c8b03fe5e907a41eb2eb7dc0042abb0ea69b90e283ebc42668e27068229fb6a85dc95fdcc299b6f7076efc919204756b7efd831727771bcadb8e8fa7ceb1ba8ffbfd631778d67 QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defQuietSimpleVersion = 7a74ea37 QQPCSoftCmd.exe Key created \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg QQPCMgr_Setup.exe Key created \REGISTRY\USER\QMConfig\QQDoctor QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_54 = 3874d037c712e067e6058b9e8affc77671170de3329229563fc3ed22822e0c174bdd71caa54d497befac2544cf6f8f05 QQPCMgr_Setup.exe Key created \REGISTRY\USER\QMConfig\QQDoctor\DrRtp\Hips QQPCTray.exe Key created \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\NeedReportCleanRecord = 7a74ea37 QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_24 = 3874d037c712e567e705819e9fffc6764c1730e303922a5627c3e522bd2e1d1772dd7bcab44d527be9ac3844cc6f8805188c8b03fe5e907a41eb2eb7dc0042abb0ea69b90e283ebc42668e27068229fb6a85dc95fdcc299b6f7076efc919204756b7efd831727771bcadb8e8fa7ceb1ba8ffbfd631778d67 QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_37 = 3874d037c712e267fc05809e9cffdb765a172ee31b9238562ac3f722952e351776dd2bcaf44d QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defTipsBehaviourLocal = 7a74ea37 QQPCSoftCmd.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\SaveUploadFile QQPCRtp.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defPromptOnSecureDesktop = 7a74ea37 QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defUSBShowOpenTips = 7a74ea37 QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\TJAviraUpdateWindowShow = 7b74ea37 QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_27 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fae052b8cbd03fa5e977a4beb26b7f7007cab85ea59b9082830bc43669527408210fb5385e595e1cc1b9b5b706befd119344778b7ded82e726d718ead9fe8eb7cf81bfaff98d62c779267eeab772d18b2321c41de561f QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defLastReportCloseBusinessTips = 7874 QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defLogCenterEveryDayReport = 4944d803b623874aa536ee QQPCTray.exe Key created \REGISTRY\USER\QMConfig QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_5 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e141774dd7bcab34d507bffac3944de6f8f05 QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_7 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fae052b8cbd03fa5e977a4beb26b7f7007cab85ea59b9082830bc43669527408210fb5385e595e1cc1b9b5b706befd119344778b7ddd82872657192ad9fe8ae7cc71bbfffa5d63177a167ccab712d14b2201c47de441fc2b84706c3bbcbcac1480e998b4e866c9621d267 QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_48 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fae052b8cbd03fa5e977a4beb26b7f7007cab85ea59b9082830bc43669527408210fb5385e595e1cc1b9b5b706befd119344778b7ddd82872657192ad9fe8ae7cc71bbfffa5d63177a167ccab712d14b2201c47de441fc2b84706c3bbd9cad1480299904e9c6c8a21d167d3193a10660b696bc6b1d877fff7faa1d901095d7634d067a388 QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\Area2_SaveGarbage = 7b74ea379b12b567 QQPCTray.exe Key created \REGISTRY\USER\.DEFAULT\Software\Tencent QQPCRtp.exe Key created \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg QMHwDrX64.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_44 = 3874d037c712e567e705819e9fffc6764c1730e367920d563ac3e822842e23173bdd30cabe4d057bacac7e44f66fbf052b8cb103fa5e917a4beb61b7ed0058ab80ea5fb90928 QQPCMgr_Setup.exe Key created \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg QQPCSoftCmd.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpeedupRockeQQMsgGuidShowCnt = 7a74ea37 QQPCSoftCmd.exe Key created \REGISTRY\USER\QMConfig\QQDoctor QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\FtSysAutoCleanCycle = 7b74ea37 QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defUSBShowAutoScanEx = 7a74ea37 QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_13 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e1d176edd6bcaaf4d5e7b QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_25 = 3874d037c712e067e6058b9e8affc77671170de3329229563fc3ed22822e0c175fdd7dcab54d567beeac3844da6f QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\FTSysStringSwitchSize = c562ea37 QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_22 = 3874d037c712e567e705819e9fffc6764c1730e303922a5627c3e522bd2e1d1772dd7bcab44d527be9ac3844cc6f8805188c8b03fe5e907a41eb2eb7dc0042abb0ea69b90e283ebc42668e27068229fb6a85dc95fdcc QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_32 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fb0052b8cbf03f65e927a79eb0cb7c20052ab9eea55b9092830bc56668e277a8233fb6685dc95eccc1a9b487077effa190e476ab7ebd82872477181ad88e8e67cef1b QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defEnableLUA = 7b74ea37 QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\DrRtp\Hips\VulRtpState = 7a74ea37 QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_11 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fae052b8cbd03fa5e977a4beb26b7f7007cab85ea59b9082830bc43669527408210fb5385e595e1cc1b9b5b706befd119344778b7ddd82872657192ad9fe8ae7cc71bbfffa5d63177 QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_43 = 3874d037c712e567e705819e9fffc6764c1730e367920d563ac3e822842e23173bdd30cabe4d057bacac7e44f66fbf052b8cb103fa5e917a4beb61b7ed0058ab80ea5fb90928 QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_53 = 3874d037c712e067e6058b9e8affc77671170de3329229563fc3ed22822e0c1756dd6dcab54d547bf9ac QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\LastMemScanTime = 5954a5509b12b567 QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defUSBShowAutoScan = 7a74ea37 QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_6 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e16177add6ecaa94d4f7bf3ac2344cf6f8f05 QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\UpdateVersion QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\QMClientConfigItemSize_31004 = 7f74ea37 QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_34 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fb0052b8cbf03f65e927a79eb0cb7c20052ab9eea55b9092830bc56668e277a8233fb6685dc95eccc1a9b487077effa190f474db7fdd828726b7192ad92e8 QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_47 = 3874d037c712e567e705819e9fffc6764c1730e303922a5627c3e522bd2e1d1772dd7bcab44d527be9ac3844cc6f8805188c8b03fe5e907a41eb2eb7dc0042abb0ea69b90e283ebc42668e27068229fb6a85dc95fdcc299b6f7076efc919204756b7efd831727771bcadaae8ea7ce71bb3ffa5d62d778e67e8ab712d1ab2331c5cde531fcab81406cbbbf7cada4803998a4e QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defCreateMainLinkTime = 5b54a5509b12b567 QQPCSoftCmd.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\SaveUploadFileCleanedNew = 7a74ea37 QQPCRtp.exe Key created \REGISTRY\USER\QMConfig QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\TAOBusinessCfg_flag = 4a74dd37a8128667a705dd9ec0ff8c761c1765e34e92735637c3e522872e33172edd2dcafe4d5b7bffac3644ce6fc505718ce903f25ec77a41eb74b79b0052ab8dea0db94e286fbc5266ca27158257fb3c858795ebcc QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\GCSetupPCMgrTime = 9373e6379912b6679a05e39edfffb476 QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_38 = 3874d037c712e567e705819e9fffc6764c1730e367920d563ac3e822842e23173bdd30cabe4d057bacac7e44 QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defConsentPromptBehaviorAdmin = 7e74ea37 QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defUSBShowTrayIcon = 7a74ea37 QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_46 = 3874d037c712e067e6058b9e8affc77671170de3329229563fc3ed22822e0c175fdd77caa54d487bf7ac3244c46f8805378c QQPCMgr_Setup.exe Key created \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\Speedup_Growth_Value_Guide = 7b74ea37 QQPCTray.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_16 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e14177edd6bcaad4d497bf5ac2744 QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_20 = 3874d037c712e267fc05809e9cffdb765a172ee31b920d563cc3ea22952e2317 QQPCMgr_Setup.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\NewVersionAvailable QQPCMgr_Setup.exe Key created \REGISTRY\USER\.DEFAULT\SoftWare QQPCRtp.exe Set value (data) \REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\QM_HardWare_VGAINFO_NVIDIA GeForce RTX 3060 Ti = 7b74ea37d512e367dc05aa9eb1fff5760d171ae322920d563cc3f622822e35173bdd4aca924d657bbaac64449a6fca05748cfc03c35e977a25eb35b7f70060abbdea6ab9392812bc576688277a8255fb38859c95b9cc5b9b0d7031ef91197e4710b7a0d86e723571d1adb7e8ea7cf81becffffd66a779967f0ab6f2d27b2231c47de131f9bb81a06fbbbf4cad9486f99f94ef26ce321a267a7194810070b1d6bafb1ae779af7daa18d01665d1934bc67d088c99700a6166931ced9c54096df49f21c2013c747f11229c945bb48186366146d5452544c6f79e7853d664892bc6d7ca36c7ac1bf6de1b7cc349dd22a183dffbc1c76196491851e138d294fbab8d725d1b17395d15e67c0915b44ab17df61bd48580c993c0c2657c58b7e06ebff1882e388c9ab7f833ba156e841c453c3f0870adecb958ebc79d20c5635af22aa75c053e2450ba01fb5bce37284bc2fed57ead61a021607da0b1be9f655da6f5fde5c158e59186a606c6d570767020135b5d8a7c42f395bd2559b9f8565e71447dc5c2f8e45500ffdec30a8a39bcebb722c1575cbdf99b13bdc8c1769d5c7f0cd01a168ece5819c96cdb8ba964fb4063e27714293ba9ae719d82879f94eb71d7c866614ec2e9c26b8a1708f38171482a0e78674da4a8bdfcafa58d3637cfd48ac0eafde243fb3c02739a65e387b2904baf275f3ba8f7ee29a20a3908e30bad892d56790db4dde60bc93c0571043033acfc1 QMHwDrX64.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E2A79C5-48F1-4182-BCF9-E92857BDA980}\Shell\Open\Command\ = "C:\\Program Files (x86)\\Tencent\\QQPCMgr\\17.1.25794.211\\QQPCSoftMgr.exe /page=uninst /parent=controlpanelitem" QQPCMgr_Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMContextScan.QMContextScanMenu.1\ = "QMContextScanMenu Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\ = "QMContextScanMenu Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMSoft\Shell\Open QQPCMgr_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMSoft\Shell\Open\Command QQPCMgr_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PCMgrRepairIEExtensions\DefaultIcon QQPCMgr_Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PCMgrRepairIEExtensions\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Tencent\\QQPCMgr\\17.1.25794.211\\QQPCMgr.exe\"%1 " QQPCMgr_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMContextScan.QMContextScanMenu\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMRemote\ = "腾讯电脑管家" QQPCMgr_Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMRemote\Shell\Open\ QQPCMgr_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\QMContextScan.DLL regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMContextScan.QMContextScanMenu\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command QQPCMgr_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PCMgrRepairIEExtensions QQPCMgr_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E2A79C5-48F1-4182-BCF9-E92857BDA980}\DefaultIcon QQPCMgr_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMSoft\URL Protocol = "\"C:\\Program Files (x86)\\Tencent\\QQPCMgr\\17.1.25794.211\\QQPCSoftMgr.exe\"" QQPCMgr_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node QQPCMgr_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMContextScan.QMContextScanMenu regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMRemote\Shell\Open QQPCMgr_Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\Open\command\ = "\"C:\\Program Files (x86)\\Tencent\\QQPCMgr\\17.1.25794.211\\QQPCFileOpen.exe\" \"%1\"" QQPCMgr_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMRemote\Shell QQPCMgr_Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\ProgID\ = "QMContextScan.QMContextScanMenu.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\QMContextScan\ = "{63332668-8CE1-445D-A5EE-25929176714E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\QMContextScan\ = "{63332668-8CE1-445D-A5EE-25929176714E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QQPCMgr.qbox\DefaultIcon\ = "C:\\Program Files (x86)\\Tencent\\QQPCMgr\\17.1.25794.211\\image\\qbox.ico,0" QQPCMgr_Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PCMgrRepairIEExtensions\DefaultIcon\ = "C:\\Program Files (x86)\\Tencent\\QQPCMgr\\17.1.25794.211\\QQPCMgr.exe" QQPCMgr_Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMContextScan.QMContextScanMenu\CurVer\ = "QMContextScan.QMContextScanMenu.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMContextScan.QMContextScanMenu.1\CLSID\ = "{63332668-8CE1-445D-A5EE-25929176714E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\InprocServer32\ = "C:\\Program Files (x86)\\Tencent\\QQPCMgr\\17.1.25794.211\\QMContextScan.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMContextScan.QMContextScanMenu\CLSID\ = "{63332668-8CE1-445D-A5EE-25929176714E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMRemote QQPCMgr_Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMRemote\URL Protocol = "\"C:\\Program Files (x86)\\Tencent\\QQPCMgr\\17.1.25794.211\\QMRemote.exe\"" QQPCMgr_Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PCMgrRepairIEExtensions\URL Protocol QQPCMgr_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.qbox\ = "QQPCMgr.qbox" QQPCMgr_Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMRemote\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Tencent\\QQPCMgr\\17.1.25794.211\\QQPCMgr.exe\" /pullRemote \"%1\"" QQPCMgr_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMSoft QQPCMgr_Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMContextScan.QMContextScanMenu\ = "QMContextScanMenu Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell QQPCMgr_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\opendlg QQPCMgr_Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\QMContextScan.DLL\AppID = "{7A30415C-ABEE-4674-B64B-4CA145EEB0CA}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMContextScan.QMContextScanMenu.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{63332668-8CE1-445D-A5EE-25929176714E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\QMContextScan\ = "{63332668-8CE1-445D-A5EE-25929176714E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\QMContextScan regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Unknown QQPCMgr_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7A30415C-ABEE-4674-B64B-4CA145EEB0CA}\ = "QMContextScan" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PCMgrRepairIEExtensions\Shell\Open QQPCMgr_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\QMContextScan regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\QMContextScan regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMSoft\Shell QQPCMgr_Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7A30415C-ABEE-4674-B64B-4CA145EEB0CA}\ = "QMContextScan" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\VersionIndependentProgID\ = "QMContextScan.QMContextScanMenu" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\QMContextScan regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID QQPCMgr_Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\TypeLib\ = "{593BE60A-1C6A-44F9-946D-A5EAB2D53511}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\QMContextScan\ = "{63332668-8CE1-445D-A5EE-25929176714E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\ProgID\ = "QMContextScan.QMContextScanMenu.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\InprocServer32\ = "C:\\Program Files (x86)\\Tencent\\QQPCMgr\\17.1.25794.211\\QMContextScan64.dll" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe 4528 QQPCMgr_Setup.exe -
Suspicious behavior: LoadsDriver 35 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found 3196 QQPCRtp.exe 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe Token: SeDebugPrivilege 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 1596 QQPCTray.exe 1596 QQPCTray.exe 4900 UpdateTrayIcon64.exe 1464 UpdateTrayIcon.exe 1596 QQPCTray.exe 1596 QQPCTray.exe 1596 QQPCTray.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 1596 QQPCTray.exe 1596 QQPCTray.exe 1596 QQPCTray.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 768 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 8 PID 2112 wrote to memory of 776 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 9 PID 2112 wrote to memory of 64 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 13 PID 2112 wrote to memory of 2628 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 44 PID 2112 wrote to memory of 2664 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 45 PID 2112 wrote to memory of 2820 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 48 PID 2112 wrote to memory of 3440 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 56 PID 2112 wrote to memory of 3568 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 57 PID 2112 wrote to memory of 3760 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 58 PID 2112 wrote to memory of 3848 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 59 PID 2112 wrote to memory of 3908 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 60 PID 2112 wrote to memory of 4000 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 61 PID 2112 wrote to memory of 4176 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 62 PID 2112 wrote to memory of 4840 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 64 PID 2112 wrote to memory of 1436 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 75 PID 2112 wrote to memory of 4736 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 81 PID 2112 wrote to memory of 768 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 8 PID 2112 wrote to memory of 776 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 9 PID 2112 wrote to memory of 64 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 13 PID 2112 wrote to memory of 2628 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 44 PID 2112 wrote to memory of 2664 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 45 PID 2112 wrote to memory of 2820 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 48 PID 2112 wrote to memory of 3440 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 56 PID 2112 wrote to memory of 3568 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 57 PID 2112 wrote to memory of 3760 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 58 PID 2112 wrote to memory of 3848 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 59 PID 2112 wrote to memory of 3908 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 60 PID 2112 wrote to memory of 4000 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 61 PID 2112 wrote to memory of 4176 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 62 PID 2112 wrote to memory of 4840 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 64 PID 2112 wrote to memory of 1436 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 75 PID 2112 wrote to memory of 768 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 8 PID 2112 wrote to memory of 776 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 9 PID 2112 wrote to memory of 64 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 13 PID 2112 wrote to memory of 2628 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 44 PID 2112 wrote to memory of 2664 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 45 PID 2112 wrote to memory of 2820 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 48 PID 2112 wrote to memory of 3440 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 56 PID 2112 wrote to memory of 3568 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 57 PID 2112 wrote to memory of 3760 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 58 PID 2112 wrote to memory of 3848 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 59 PID 2112 wrote to memory of 3908 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 60 PID 2112 wrote to memory of 4000 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 61 PID 2112 wrote to memory of 4176 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 62 PID 2112 wrote to memory of 4840 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 64 PID 2112 wrote to memory of 1436 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 75 PID 2112 wrote to memory of 768 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 8 PID 2112 wrote to memory of 776 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 9 PID 2112 wrote to memory of 64 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 13 PID 2112 wrote to memory of 2628 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 44 PID 2112 wrote to memory of 2664 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 45 PID 2112 wrote to memory of 2820 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 48 PID 2112 wrote to memory of 3440 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 56 PID 2112 wrote to memory of 3568 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 57 PID 2112 wrote to memory of 3760 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 58 PID 2112 wrote to memory of 3848 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 59 PID 2112 wrote to memory of 3908 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 60 PID 2112 wrote to memory of 4000 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 61 PID 2112 wrote to memory of 4176 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 62 PID 2112 wrote to memory of 4840 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 64 PID 2112 wrote to memory of 1436 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 75 PID 2112 wrote to memory of 768 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 8 PID 2112 wrote to memory of 776 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 9 PID 2112 wrote to memory of 64 2112 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe 13 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2628
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2664
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2820
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe"C:\Users\Admin\AppData\Local\Temp\0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops autorun.inf file
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2112 -
C:\Users\Admin\AppData\Roaming\tencent\QQPCMgr\Download\QQPCMgr_Setup.exe"C:\Users\Admin\AppData\Roaming\tencent\QQPCMgr\Download\QQPCMgr_Setup.exe" /S ##silence=1&handle=786534&update=1&supply=79401&forceinstall=1&qqpcmgr=0&DownloadSetupInOne=13⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4528 -
C:\Windows\system32\cmd.execmd.exe /C icacls C:\Windows\System32\msvcp140.dll /grant Administrator:F4⤵PID:2996
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\msvcp140.dll /grant Administrator:F5⤵
- Modifies file permissions
PID:4164
-
-
-
C:\Windows\system32\cmd.execmd.exe /C icacls C:\Windows\System32\vcruntime140.dll /grant Administrator:F4⤵PID:2472
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\vcruntime140.dll /grant Administrator:F5⤵
- Modifies file permissions
PID:868
-
-
-
C:\Windows\system32\cmd.execmd.exe /C icacls C:\Windows\System32\vcruntime140_1.dll /grant Administrator:F4⤵PID:1112
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\vcruntime140_1.dll /grant Administrator:F5⤵
- Modifies file permissions
PID:2676
-
-
-
C:\Windows\SysWOW64\cacls.exe"cacls" "C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211" /t /e /c /g SYSTEM:f4⤵
- System Location Discovery: System Language Discovery
PID:5004
-
-
C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QQPCSoftCmd.exe"C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QQPCSoftCmd.exe" /command=SetSimpleVersionConfig /SimpleVersion=2 /From=Installer4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1996
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" "/c "chcp 65001 && C:\Windows\system32\netsh.exe -f C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e58edb6\firewallLog.txt"4⤵
- System Location Discovery: System Language Discovery
PID:2940 -
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
- System Location Discovery: System Language Discovery
PID:4616
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe -f C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e58edb6\firewallLog.txt5⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2912
-
-
-
C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QQPCRTP.exe"C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QQPCRTP.exe" -i4⤵
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4428
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QMContextScan64.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4928 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QMContextScan64.dll"5⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Modifies registry class
PID:1584
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QMContextScan.dll"4⤵
- Loads dropped DLL
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1744
-
-
C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QQPCRTP.exe"C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QQPCRTP.exe" -e4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4436
-
-
C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QQPCRTP.exe"C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QQPCRTP.exe" -s4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1612
-
-
C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QQPCTray.exe"C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QQPCTray.exe" /regrun4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2104
-
-
C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e58edb6\UpdateTrayIcon.exe"C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e58edb6\UpdateTrayIcon.exe" -t QQPCTray.exe -c 1 -p 1 -v 0 -h "" -d "C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e58edb6\UpdateTrayIcon64.exe"C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e58edb6\UpdateTrayIcon64.exe"5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:4900
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3568
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3760
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3848
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3908
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4000
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4176
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4840
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1436
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4736
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:1916
-
C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QQPCRtp.exe"C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QQPCRtp.exe" -r1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Sets service image path in registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: LoadsDriver
PID:3196 -
C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QQPCTray.exe"C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QQPCTray.exe" /elevated /regrun2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1596 -
C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\QMHwDrX64.exeQMHwDrX64.exe /starthwdetect3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3448
-
-
-
C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\qmbinsx64.exe"C:\Program Files (x86)\Tencent\QQPCMgr\17.1.25794.211\qmbinsx64.exe" /install2⤵PID:432
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
3Safe Mode Boot
1Modify Registry
9Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5cfaf2115281d53fd3fc456cf0927f207
SHA179f2fe2a1ff5ba1b2c9a7e69195f3e8a594c1374
SHA256ded1e0d1466c978674583c895836192e3b5831e8c227aaada02d80df22543493
SHA51243c8e7a39107cd269efd9cd8d76ae7f3432a19c17b4069a4b9ff8d56d4f57f1649f95173f48eddb52f09e96b742abf7404bafe156b2100f07a881b0b9008bba7
-
Filesize
33KB
MD5df298a38c3b0f674c2ac28432eed2fa7
SHA13a7c6bf97d3fe0c11706c1e7a510d1734b2ffaae
SHA256924979c93e7e194d545eab65c69b4324b31274f504bfaf2b428aabdd7190520a
SHA5124a41e048fb7f0f8186147d861916d4e6eca9c0bc0ab98e3f432b623651d68973925b641d413462d5ff93a47f844d2eff9e40da3c73e255070bd9f8a19ae02a03
-
Filesize
35KB
MD575abcd24a9f62201a2b16b71c8facd1b
SHA1eb35b44143728e931d7744d1ae6f9b108528be4a
SHA2563a12f336b72c59a874969a14638cc5d055646a5a7ecd94c2fc5dce13e7d796a7
SHA512caf9fecf6315833db6fe5073834601db2fcbb5949ae0b75ba657a85d0fb296f9842d671492e9b7990d7a781fc4481b2738230f1e74534fb71b21cbec6e2f36a3
-
Filesize
40KB
MD5a826d1ac9f033155e6c7f9e192f34c40
SHA1c69ff13e00e89f37432da930acb6236164f6cb4a
SHA256fba178108c80b1d8e573399bd7c8af3ec6c34252c7f85b9054b1ebd5d3a25219
SHA512bdaabbc368848bb15a6b44b4fe077cfe44c5b5d5be947f02be191a20c8fb9010f520db35f2cffab3eb6d0814e5009c0894e6e88e3a010b8a85a9452697a5acac
-
Filesize
39KB
MD50ec75d87cd294622cd48268ec785ff42
SHA105d7c27cd7b1504ccefef4d1bcf57bbc36cfafcd
SHA25647a3744c87e439da754e0726dda1c30e325a2df57530490566d449e7b733c202
SHA5128f8e381fc5cf2d61a28fa0aeb42bdeef8167a9577b1dbbcc92298d96681f64b507968579c43d78a6b558ec4122d0b7001d389f36bf4da23b2e3de915c13bb3a7
-
Filesize
51KB
MD5de4c37943a465c6bc82976da66e4e553
SHA1ea4bb5b27e6f161fa1093ff5f732ba1ab998564c
SHA2560be83ecbc97d1be0ef75b14c6d70a1c358694407451db14714e2f3af2df0225f
SHA51220b836d15043f62c408ee025c7e9521a2582829591a66a58a4e59225f148413391253289e8bc7993c94061737602ef9cfbee1196645c0c0f027e4d8591344cb5
-
Filesize
52KB
MD5ef8dcc0c9a6f7cc82d86a96192ba78d4
SHA1695075a6e45414dd578f3fc63b118a4bd3d966a4
SHA2563dd19815252f983b022757982600ae72f78265fae76a8f39cf40f64351cdf800
SHA512f963dd6561471ca7143fe8e5414e989a669f14c0272bc4ef49ed4b9799ac0bafce40016bf3034d131ec8fae2d7a48af3cf8609144286657e6729362012f82204
-
Filesize
60KB
MD5369d2e79ad8d21fee961efe005cb683c
SHA1148f7c491c9dad37bb41cac74e58ba73232fbcba
SHA2565b4b6ba27e706e9de78a08c52066853e3b625ecaed865d51cf99da888259f963
SHA512edb299791cca565e8d87b73e53293fccabf4b05a1abdede66cfa6ac9168cd347aa0d378a4a38d8c4f1d2367642598dd94ea5372baddc18ae267327d6049963cb
-
Filesize
59KB
MD5df48217a495c909a4cf97d39223e38e0
SHA19fc4499707f4a1b2f69d0d90c26a3f946c8bfc47
SHA256d9f4836d4c4ece112b2cc8387d1deb4d1f46924652d155a862fdf46080b08b78
SHA512d5d751b291ca13c8bf884529d9ca6734f1b550a2715a10c304987977718ec610c11a735082b1be92ba7d1af8e5f465435b96934d8362cd75b4e95ffdb115e50e
-
Filesize
1.2MB
MD5d41b239ea495a1883ce1ca33990e7e23
SHA11b3c926d868eb3fea8d0d8dc27ca31b01db1ea2d
SHA25631f4e451d7d248b5a183920defdf5eda399a6eae9e0c3f13a9a554af79c93be1
SHA512e3ed3825ebc75c3b4182b8b389b7b7f9d6b387297a528ce3043671b5a62b09e8a33d89929c02b00feb95fac4bf6ccdb48bcbfdc01ce044a15b9ad0e92bbe3963
-
Filesize
74B
MD5270d8593cb4139a891e643e2599b63d9
SHA1cf0cb86738820a9f1f3b62c74db4310aec034601
SHA2563003e5c3469be8bccf072bbf8680b03cec64c4cc9591da0fa61d5f29614ff7bd
SHA512cfbc6c1f8d25b38df2e27b3f25833cde81e7355dd539d019877f535a01cb5c9e3a6a5162b012c55078fe92e5582d3f9629d0713049509c79c5b510b56b16f8a0
-
Filesize
712B
MD5fc5caa67659e0720eae12bb448f4aa86
SHA1945661f0ef12041fe7b87e3ed8c9493960dddf8e
SHA2560078b9bf87d95f42b3f16350494fbacabc667d94a8e46e224675217a98f39a2a
SHA51253cff332e21bdafdf6a4695ca9c09e9e8133b6b29fffb6f7a737e4a5f2201ef5e563c823127d0a959e3e37abd5ba5b6a01a1a7e413a32a4e5151205875d1d72d
-
Filesize
1.3MB
MD54d3881dec77cc8647ff77299719ded01
SHA1b5fba8b09b40d073e921c35f69d0c1b97d29d5a8
SHA256e6d311c8fc87f5a9bb8b599175bf054ad772fa17f9be3df59317a6af93bd53ec
SHA5123f67407d4bd8d4b81a0866feff2e4e24cbf10ce364d55f1703adf8d45d021a9806e46d492f52355317a982dd28435d364e3d20686f01b9f349f2c5a415b3ebdb
-
Filesize
203KB
MD5d4c9f0ab1b6e8a787cf97be03617f4db
SHA196b1bdefde67e0c8d5d3e68e4a2c051070dfc875
SHA256fc02684919700e64c7dc5c80217fa211be971a44fadaa7d030de02e383f52129
SHA512d8f28d32ae1c7d2b1ecdbc6ccf0c72ffa4b9b4eb431a52f6b07fd6d564d7976603a615367779cfbca804498323c0cafdc76c18eea28115c6d86340934d1a2cf0
-
Filesize
4.4MB
MD5c892aabf0e6de36f3792aba7f06fc5f6
SHA1258f9127be0bad1697327bc9686c1e535c95d6c4
SHA256260558c9fa4cef2db260f97dcc384ae37065f1de48b9f054ccf460b2328a1ff8
SHA5122ac00f881ca28ddd141957940b22e3731702e78e5f787fa740df2450cfb66a93d897b3e18b58619a6ad8fc7f689486c9192caf5269b23e3c8efac762fb09782b
-
Filesize
156KB
MD59251fa0af2e779c6f4cc2de65fef6b0e
SHA1970dc4ae87de008340536247376e8dd001a0802c
SHA25611283380c06d48f7b0ebb8b6bcfe83f40c7cc013db15196074b47ec2be6185f7
SHA512cd5d583d82446fa4b207528b075365f217586d6cc6a6c10b1cc1c5d012a90029a659bae560beddc70d682a7b66104f1ed9b7d4cda717f384508e49413180add7
-
Filesize
3.6MB
MD5429cdc136639a17281f11fef6cc50488
SHA1d1ef48a681b26ffef0f7854ed896c95218509194
SHA256ad861f17fea951caa1ef05da9ad7dadb5c97eb15aa8e006f6a8656f6ffa4745c
SHA51269012ed9be0c59b4e2b906070df61f40c2654ee41736ba6984d9bb949ed59c50c5ee9c85710b82f693f3e89b1bf14285dc3c8557c49e29b7d58d2026e15c0e2a
-
Filesize
158KB
MD55b50ad26d072935593e5ddbb8c31ceca
SHA19552cd8807a159587a73a56ee618279da0003b65
SHA25638aa94731d808ccb62ac0f089caacfaa9dfa5c9ced96e0792d77beca4b837999
SHA512dd6c658dfa8fb66e79cb0cb598003712c3eabcb3e4049b78d28e06b0f83c3aadc0f99c77ae482f8d3816b3db32e6b34b99853d7bf253f7ed3b505bf627d36a37
-
Filesize
18KB
MD5aab52e0385a66e157bb440cb5e3cd3db
SHA155421c5e58951921843c0944d18e22391bf05c8d
SHA256baa6eae9e3742c736327da12c0e2e586e65a0b6d667547c638fd1287886f022e
SHA5124bdbb93d8259ee344ce6a6138cdda2fb19bef280f8aa06daa5640125754a808ee4a68302bdf1bc5a87362b886e826414c0f43643b068a7925966adb9bca0a487
-
Filesize
18KB
MD5f97b671fac0baebca98059a9b099c4f9
SHA1433f4850353d7ec03b3215d77cda5f0874e67439
SHA256d9b96b975a90b0a8c08ffe6d2185b6714d75bd8fd3d8346aff4a069d44960f73
SHA512f2c8510f1b166248259781d4c910358bd89fca4d8e39b3963adfd26fa999b4991f08ca966c265ec3f9161d704844a15caf97dddc88fa2ae95cb075245e990063
-
Filesize
18KB
MD57c1f03e83bcafe58ff99b3abb9e7de43
SHA115e8676f12f7ec0bf102b772839cb0bf8f1b551e
SHA256c8fc616e5591d0b77c592059e2fe2cecb54b1219a72d9a92fd09f396fd340cf7
SHA512e3206b7863795f3d6251ea788caea466fea6dc89678c8623ccbde27286dcdcde9158b3132296912ff06b3bd913f91bcb2ac9f21d0654f6389adc086870e9e0bd
-
Filesize
22KB
MD5350e52ba8f75e06b370e7d7b60c97c7f
SHA124e81d8178a368b31e906a43ab70cd4912430dab
SHA256c332a484a959a2241c43767f7eff8067855dfaff6ced79f03de154de99269b34
SHA51231f7d32895e37aa35e89c5bdcadebb15eab87c30761c02aacac622048f05c91c2d52ded7b2225c2ef75cddcf8c58f714dbb8ebc579d0e58ff308df06c24e4411
-
Filesize
18KB
MD5856be91f8f44394cf92be1af50530521
SHA16baebcc3dee03fa7dc17500d8540925307cb9beb
SHA256ad487c96c39271db2c3340bb106fa8f3f2b401b100b3d342813c09fbfbddbd05
SHA5128ae6f848c1ae7831fa012f87387e6334351545c185329d905ac9108694fab4b073487cba621154062e8fd357d65303938a47ba71b3d1047640bc30d5ca3d2ac1
-
Filesize
18KB
MD515f59e829f9f2020e9c47a10deee718c
SHA1365522c1e3a230b19cd4d82d8f0bdc944ac8435e
SHA25693b28bff2f9d64a02f8362224ca45bfe4d6bb7fa6f83403ba9adec300dc7904c
SHA512b8fbbf6403aa7db868cb2581ddabfff20c7e1912a4c41107fd91034c54020a344ce8f0fb4ca2f32f20e79486c5fe87177b2744f1ef593ddb5414d2adfd18b971
-
Filesize
18KB
MD5b801c68f8146904adb86869f5c3477a5
SHA1ffb860ca10040ecaf5ae4a61a9c11db3e2eeeca6
SHA256d83d3edef8ddbecf31af7437653e66adeb303947ef3da31a1280a485422e475f
SHA512dbb7f1fb13d313da2047bff45ec0300d7e2f66337110fae20217137b9a6784663b42c56b135a4cae21b367d7f1650a9d158a71793bfd1822e527d6310ad6dd2a
-
Filesize
19KB
MD5db5013d1a02d899314b9518da6d0b2e0
SHA13e1e8df8f2f4a2184a50e11da015635a5558b477
SHA25647adb171040b53b068e2dc259ebc75562dcec8811d68b7c4b0c16a797d7388ba
SHA512eaeae30f1427be40614e1818c67648448c0808ace554ce1ab0441b5525673ad1dde7ab4d124858442fe9590048a3bb241b639375d3f89ef7185bd15d4cf0024f
-
Filesize
19KB
MD586e369bd8455272049bb60a53624aeee
SHA1b7ff6dc01ab07ca32cf030697fdaf1162112adcf
SHA256fe8c2607e57e6779b6485ae08e658bd7b98d79147946f262d6b3699de9259d43
SHA512606fd78d1a39996d623f4ce431401a4c91cf2a401bce6d04371bfe3a2b0e701f04167d9f7c897c9b73813544af0a474948ce3e23e7825b273af590b86907b92d
-
Filesize
19KB
MD5f72de8f45343b9f0135f4d71a3b67fc2
SHA167cef9a3bc9891cf41146c25879835ad7b2defbe
SHA256307ac04192de5a107ee66c9a4bdc16f95cede35ff39f50d811a8d5defe6e044c
SHA512fdd8900264800117c238757abf62ed5c8883761a1895fcda4bb149534596690871ba3494523df34e4239cb45851a9db85266ff393fddbcb1e1ca3dd049c4475c
-
Filesize
21KB
MD5a675093b0d146773b5a2010a0adfd021
SHA1cfb93918c25c4359788680ccc140381fab1e9358
SHA256a6d2196e5c8b17851ea134f1ac02481846f78b0075860cb6eb4f90e0243449e6
SHA51256ad8adf41c7ed0f04ffc371dc7d538127ae245fea8783a4b0af5e92940656e0b41a0bcb88ac263b3d2efcf8396cf196993d882ffe0d74c1094b31f47558d27c
-
Filesize
19KB
MD5ce7d62974e002ed7736117fce3d25b38
SHA14225fbf9f73ffca92c18f04fb650452f80ea0fcf
SHA25601eca7b03ce90601768acb131d61875e418197234891fb71a2695aaa2f13857a
SHA512bd151a8d135b540ba573af01e6089e03a6981ef97fb1e6e3465312815787b563d7c205371f0fe06b674e1924b15fedaab239d012615e38b5192bf4d2170dd60b
-
Filesize
18KB
MD5ebceb63468278a061ce4b95d12d723c5
SHA19bd01a59d1986883410f09a1fbc76876edf57332
SHA256082cff6fd2437f7208af7ebd56b8961bd16761255c6f1214499e93975301b300
SHA512f20f9888441caafb4e23d41e00282fbc37593d0492aec86bf7840c9b1136d070202391b809a70854634a738611017ba85f5c354a9983687277f46032fd2cd91d
-
Filesize
19KB
MD566012263fdc48ac26001f3814bcabf20
SHA12839fca8a2eab6eef2be42d06fe903d24fbd4b7d
SHA256a10d248ecd4a326912a390066bac1314715ee3801332f4a9c64b5cff264883b4
SHA5125e3eab7bc734e7c2936ec061ac7702f1feda6bb772bb89e9a17b06dc722db226f9913ca4103c366be303070a879eaac4a41c8568a678347dfd170b69539f4e48
-
Filesize
20KB
MD508d5b94e8b88fc6aaaa67969b03640e2
SHA16bf348389a0a1ecd2a8e64a67d64433e264e0313
SHA25693bfe4c4663c0a2807f5cd3be67a8a21dc93c5b097b934c17aa3cb4c4374173c
SHA51258d09fbcc4e7c3ca1cb2ec2f9928629c18c0ac3603419e8ba02faa3adec33cb8285d5199785ff2049461ce04f784035c5c0d651b02f58d93e7e677fa9932b849
-
Filesize
19KB
MD594015263f243bf376bf138dfb1cb7b46
SHA13938fd323dea0686a83daba2da70060b5def2036
SHA25685f410b3c539aaa2ac8b5be976af982a8765fea315671badf542c5a0c71d600d
SHA51220f86cab8de07309cc64aece34ffd334ae74a847afedeb48b93848381c3ff721c18270bf0515171c213b9260936960fbdab4f67c3d3211f27b7bac34808f88f1
-
Filesize
18KB
MD5d6f950aede59a00c9ae0affe0b63b6a4
SHA1abd6bdf43e4f3569474a26a7763327baabf155e0
SHA2568bfe8d485bf8e6bf91833f6cf61e5f054f6edbf5dfb2095967ab3db0759d59a6
SHA512bc37453defe631089159b0f3ae9fe9eaa43465b32aaa88dd31212d0e50da01823395e5875447c9a2e7cc2d2edada1f62c0663b8adf0ba0b72e552715fd787a9d
-
Filesize
18KB
MD5e2dc3af0989b0f05159851ee4453cebd
SHA1ec902ec05b855388c9a7c2a336f0de30f817d49b
SHA2566c14cdc684c2dff9170de29533c521f58c3501eb8cc088de9c9b930eee048c5f
SHA51266b7eed319e92b9f87677496e2194388d291a520201c9615c139821981b7615713cf90fbe2479a45610bbaf8dc30a8d5c9ce6eb57a27645f655f4d3eff340fd7
-
Filesize
18KB
MD51292ae17b93cc2f8504d025fd1b71a01
SHA102fd7c6e25bb418738ea393ef7003f770f8691a1
SHA256a03360d7024a4aa1013cc2cca408c1343666c7dae6bff61501d0e80d44cfb759
SHA51210c0b9d8264918522eef08afa51b9d19e365d0664d7da6c6c64cf37627fa60b5603c5a47a5a4963c44922fe5d4fc3f19a549ae216e8bad9e4da3c671cbe67434
-
Filesize
20KB
MD5230070639ef8c8833d67782526d9e8fc
SHA12ca8951ab202b8f2bf289d9ea08af74695626baf
SHA256139736ebca31050f4ed7339a6979595755df0acce0cf97097cdfc937de8d32e1
SHA512b8daa7c3365bc8bcf7ff76a3002d69e3c39ce0a0c052353317242ada8bad899ad034a1f079f9d75cf0dfbd6e680c2cf77dd37ce231a39217996a3bf89c6a2e47
-
Filesize
19KB
MD5e38bd734e85d06860085772a7ceac43e
SHA14c8c141c63462ff5400c8d961d4f05e4bba0f66f
SHA256e295a8633b5eaad0ab47707059bc5dc5da02dbea01b2d3c4bc8a19e466abddf4
SHA5128c2ed8659b5e1f9bc871c8697bcf99ba9291a118586929af3cc599454c4edda88b4ccba2f0d824cb8c62c08c9966cbd5ac78f3a475425fdd4c35ada7cc8d7edf
-
Filesize
19KB
MD5f69d3b75d2becfc53a29ce3decf62fe7
SHA128ad9523af0b3d569f959803cdc01f1dee87cf53
SHA256460fa4cb795fab56d0949518d1c1d76d48dd55b3f9a02b3db421e79f98a64619
SHA512f2653f4006ccee2a2e06227e75a95c0a702a625622311f5879a3b689078bfc623606fd7e4dd051f9987c624e922980c4c3a7c4852ce8cfc98fc11aa7115e4ac0
-
Filesize
18KB
MD54dab6a8fe6c24b68fb16a3a6b58c1faf
SHA1fc0a753b747b8d24a1e2ef0c59a43b855c35fe9b
SHA256cfcd287ced91a432b1b0f5f30eb4f9bf6409420b3994fb51c87b0b4ca21535b0
SHA51269a9fd4134a3e09b9f22f660d8512fa2894684d6dc692d12435a7c4f73b0edabec7427e86d83519b43a544608850085b83cfebe26ffd0ca687f6cf491a5cf902
-
Filesize
18KB
MD51d9c2a07188ccfaf5e0f550abd56386a
SHA15d24d2af2096b078af3a7af67c7977fdf3d72f07
SHA256a6f1d195bbb68a168a07f95c273e89fe5a5eb02bac3ac76dbeb46ccd7b85ed72
SHA5127fa9c78527975c6e5cc42170eb02f5d706a6edc6419484fc81cf0548fc129039337b756d5bdae942f3e5b545ed540559df5c37cb287cd24ebeca95e7464ac670
-
Filesize
19KB
MD5be3a982da0d0fd0b06d08ba4bb75e608
SHA1ece449270ac8ee8283003a5ce3faa48ed63c0435
SHA2564ab9e0da1f2c4994b2f9c9debd4f543c3ab2404d13666816d7c4c74aa1ab2e2b
SHA512acdf9ad191075d3c392a8144e0a8ab5afd4fcc5f6a647f697b305cfd70cc646663f769c9c19b04d89e3f62ab5b19109e0c79f32ee8ea52ecc0091a7597e97234
-
Filesize
22KB
MD5c08072b6f3943d9695fff0be053b7296
SHA18f41ca441cc2deb670ffd7ba851956304862f5b5
SHA256c580b0002cfcfaac2449085b26df4dc13fd92aac7edb580a9133f252534abbe7
SHA512c8cf719ba70919b0dd5c0f8d3010c4c7a2e6c893a3e7f22449c8713e8ab47c65a5784550c58af4604f63806ab33d5e4fd7a518c3034628c1bf0d2c5c6c715cb2
-
Filesize
19KB
MD5e5e1a3ef0c1cf856dca6f71c239bfcde
SHA11d66842144767280f835811644980f72dde28edd
SHA2563c56a518dac09ff5dc34d99a97129051ddc93a1c907cca8274e8d08aa9f77e3c
SHA512d885ed122f58026df16668df16cfde5d5cb81b51b9154305c3298cb4d6b1f5241a91a65c332c8d2cbfb8b5ff4faa25d2b085cd43862ede6397aef8521347b20b
-
Filesize
20KB
MD54265854cf7082a0effaca9913ba1b584
SHA168ae4cd0f36c3b45da8810c7fe802feefc528396
SHA256e861fbd1dd21bd09bede9ef4ced4fe32c1dd5e72f9d788cd41b7314290a638c5
SHA51264c233c4922e6bb7982d4866fa20f7542c330b4b3a565720bf3dad97829cf85997f05b9c13656fdb52b93cf889e6450b02efe5a62ce3737f3d30e047313cb19c
-
Filesize
19KB
MD5b811b6df1b996ecb5bc65ccb5275e3ce
SHA1add783af63ed7453abcc0e7789bb424d1f3d5aee
SHA25667a11355b9edc7cf9dd2e1e73ffbe00e00156926af8c93bcc1e254702b9ffa24
SHA512b3eb1cee930333fb257c05ef273bf963adf7ace6b3ee172b65db493eafc60e382be3d3330317cadc03e9af1a03d1ae1b68e1a8ee2e88c70d33241e44ddb5b6de
-
Filesize
19KB
MD5776384baba12ee60dd9caa8fc65ac017
SHA1648aa40d1237fe6e9c19a14d543ba9cf3e9105a4
SHA25654ad6fb80f28a8cd4424424f413c8f22a1cd6a617eb759aba2f7c2e90cbdc4f8
SHA51296fecb891ee0d951eea77a1f7f587f8bd4bf1ec152340ac005e65ca42db33cca988b32477dfb7f8f2c0852ade748f42be5017182c7a7a02b2633aee6631bb147
-
Filesize
29KB
MD5c45a47b83a34843225ecd6dda2114af4
SHA13c89bfd1fc20c1dd68fc2aa3eef98b97007d73fe
SHA256101427a9f932d4160b3c9be04065d495576ab40a8109d9117a4d33f8b542a30d
SHA512173817ab46a55576ea4e3b540e61d69200335389a9f3366f17b36e6d0ae9963f4b0fef8e62e7dd0776ef3d23f3284b3b5ef9e505d2b67b77f41ae39451b51583
-
Filesize
26KB
MD594d26026d6b10f2cea7b6125813471ba
SHA1c4463518bbdf7d9019c822cf365455c562661632
SHA256f42cfc5cf9682e31404f262d9954f7e4ba6de35a510ea7d7683097663840cb45
SHA5122de164f89b22c539e2927c266bd2e8c21a0af2dfff338d8dda26e3108318338a296061a72c528d96e75c893867e65144174921bbf4464be32a6ff11cf29fac1c
-
Filesize
72KB
MD5d7d5dc0cc105ea8cf525862b4567637f
SHA1fb651705e958a9f2a436013e567624f18eba85f5
SHA256705e20df0cf4de0299072b7294ed57302b26ecb76d409ed7ecf2f2fea3d59947
SHA512515472b9604ce7f05ce70f9b3c2b0b84930de956534fb8360cd6d107577adee47e8e85d99bbe4cc143f1a8ce6605f4261f4c85fd445b7e89de3f28c28d42a41a
-
Filesize
19KB
MD50b21712051d25cc0666f5e6d41b64bb8
SHA11d37f8f1facaf3205582608a9de3c3d212ecde0a
SHA2565ab5fc3ba961a43d6d100933178121a7d8486b936f5ebc5e276e739f2e1da5b9
SHA5123605f4902e08c901056071af76e09abf6e95572d69b6b0790f36be1dde7b79c3171df7fec229d51cd508abb0768200c195feb8f424e524c981242b43d80fca11
-
Filesize
23KB
MD5fb2dc78b138f3fe4b7e5b3a3cf9760e4
SHA1e9a82189ba821544bd63f5af6d78e757dce9a8cb
SHA256d92e0f00c59425e74ed419c158414e2c1e34047d10072dcb9215a5c91b4050e0
SHA5121c0760a0dc6772b090fac8990d3a218f7c1c85d006e901896fcf09d2df34f6220e8101866ae627c9446d2169913b948d4724ff07af4b75cc3513a5dfaf9c9bd0
-
Filesize
24KB
MD5125c4539da3d6aee3a2942bced7f06a3
SHA17dcb0f9091831e017af66a7a21cc80e71ad8b804
SHA2564ba617cadc3806532eecd00957b2329ea8472224891228b99da3aacb002b75e9
SHA512bd506a780ea711117b159ccfd167c995861964553f9091fbe386062d1b9bb75d79db8001601130973c57ed26de9bf2b666f61f0e4a247086ec8942e03beb5ff6
-
Filesize
24KB
MD5290a004945b199b2aed82959b1623626
SHA1f19020da6f6b99045b912e45cce1c0e00bdb6efd
SHA256c6aff750c97c94a594f6cfd6db2998c45e3c0cd9b4f779df1e8e72dc7b606534
SHA512cce8c4f606508aa90e279472107816337355bff09459db5175b8ae875dcdef26be09a82d498c09c97abdd119a72c1b3d39a1a40d97b6cb94c746217f0d72e1c6
-
Filesize
21KB
MD5dfd30f7dd0c43184de48d97d16cd5b41
SHA14462932615fb930deeb610f1354ee505845c7f82
SHA2565baa7efce0f3739812913e1a24d1cd326cd1fb53058719b415c835ecd2840e8a
SHA51254c2101c6b404a5e77534bcb7ca07ba56af3ad7404b262339081e958df1b928eaa76a3542d17331639ed0fb2ca2b92ca714ec543a53c728be0e5130cd064d179
-
Filesize
19KB
MD5156fb885f50d94624ca16289f21c1d66
SHA1401e0ed9537cb1982dfbce4d869c664c22df5839
SHA256d793426ab222bdfc51f136f07663cdf34b31847ee32241e6f3589b3fc1886c22
SHA5128b03a50a7192bc35342f1c0e4c1931be8a60b29735d1dd5debe6f37b443cfa9adad5846ca5e2787e19d52cafe8a1f4f872f6858418bc00ad2612436d6f9c49e0
-
Filesize
237KB
MD5ec5a86b5e7bdffd50e022e431287273a
SHA1f8ca0cd2955ee86c2f8ae2e9f1514071dba314fb
SHA256290f577461b2d4197db0b7d09341225c90cf066984f965e54c9fa4aa16ba6687
SHA512d712c835da99cbc98bbb031301ebc339103df25ab651dbe6c0b4bb90e2646ef43680a93834f1846d84969e7e7d66ce7df91f3381c6a570fa723f02d704f3b262
-
Filesize
20KB
MD54b30f6c86cf6932f2297ffc5e64d2bfb
SHA1e16f032af4d319002a0db8514d97c1ca23fef42f
SHA256f92ec09eb6b666e42cd52ef912f298fb79c264ef3272735f69f99684b88585df
SHA5129c1cca4ec49e40a955284be42bf38a3a9a1264aa04d69fc2bbfc6cb9ef2c32bf99b496740629b283eaa944d8b8166ce755443656640f5c65f98924940d295588
-
Filesize
162KB
MD53a28743d8c814cf347398ea2544a298f
SHA12530dd3f6ce41942e592f926dd30a08d8de3ad81
SHA2568aa3ddacd2b2cf998e5b641dda4bfed07f689849521a6794e0db4f9354d3edb5
SHA512238ed143f46c272377df78e7a1e33a7239bef7013ecab37e3ce93fd24c640ec62648bbd7ff01be05c147aa9576a0baa4e5a0ab978f151ecafb1c33f4eec308bb
-
Filesize
50KB
MD5792b0131510130442bb66c3a7d12ae90
SHA162ddb095d7e07020a69ed5ed704778a92b0be976
SHA256bb2981af3a123a95822a55c0bd3c470ba6ed6c0151ffad09717583fc6abfcba0
SHA51238de9c71d9e95aa1b2ee31972c8a273afefd2f124de0ce3e6f247b123077db4a374aa32ca9f8b786fea4910119c71f1831af5f4c0273ea93b5e860afdce7e0e3
-
Filesize
18KB
MD54d24e093ee8fb09955109923b8951a7c
SHA1e09b5cee8a7ee36a0cf0fc7a17859ec60799f03e
SHA256e5fb7a7cf24a854463d6a00b2aebd50e4acef58d2c1535246069ff3f4a1dd027
SHA5122dd1403db4a1c47fba7ab0271d88d33bfaa8ab5c0f4e5e054596dea042c6fe74095b92ad4f2f78b98d5fa5713061321f8e38c1e2196702e89fd04691c15f5f9c
-
Filesize
1.5MB
MD5228d92fd761d75b5805ffb826ca36a01
SHA1985f49e179928994fa75c14a9959ef93f5108343
SHA256b9ccd40455be8ed200f66c172427b105d6f713a7c0f7425f674a02a871558d7a
SHA51230bf2b01cb955bd938bdd89e772644147269b77274a9d3ce3b6515d84fa4f75ccbd6d53282d7cf72e964fa045a7e7f2578e91f26809a116c85c2b736940ef195
-
Filesize
3.2MB
MD58322da5c83f3f8cd994d865e2dc435ad
SHA16821d00d0f9a5b9f41fedaaf23c89941fafae432
SHA256b4e7a0385f22ff3e7dfb00d282fa2f56048575626b3faaca1aae786342170a9f
SHA5127ee9803bc278d5b2f91f901164abdca27a29adc588c77e5ccfbaaf691d6b30e9d33a33d1beed72a9b01716bb9ecf851ee694cdedb01bcabeab26a64657ed68cc
-
Filesize
576KB
MD5a386ff19b6962b217c075cb1c3a06c9c
SHA10c2aedb9d8c5525fafed0542b665800e5bef2c92
SHA25634869c68792b769e9636a14f2691458906826a6d28b0221cd3dc4f714fd9c4e8
SHA512aa42553a34547713964261ed2f72cea67f7177855f9a24a0030220840b06bb9ad34678c195511ad77bef4ebce8e3cff78aad552657ccb86752cff72251568d29
-
Filesize
8.1MB
MD5771479bf1c78e5fd05207117d3e09869
SHA1597f017b03d0a7a1931576b0fbdde4d0a1e0e813
SHA25647184397758dcef922073b0db919509151ab46725c37418295b8036e1c3b1730
SHA5121c4b7894f09e2019e8192fe3116e5c1905a4b0d1438c4a097a2631696b06bdd1de0b9e98813b44724be6aec1b63dce3439e6d93d33c2cba21c29cfa005a53a39
-
Filesize
2.5MB
MD5aa5ba207320d9d5429761e84d21e6263
SHA18d411b2966deb6206959c6b0467121dedf2953ec
SHA25611e2918475241452d88d3bc140bd348ac55cee52bc308f0e741c7313c32a0e98
SHA51264b862f5d74c2c86782eb664ca813bf53a92aa7c0c96d18e9878759512dea5041809542ef701f4b324e4fd461c9c5f672d14d7705cacb786e37f8866ce0a0e05
-
Filesize
350KB
MD552023600a39f92454b5c3854faec37f7
SHA144d37d614896d045d628bc561f691abe801f434b
SHA256767e1d26e65e5a792a29d9d66c05a302bb1282fd0889494d15da4a13102b8f46
SHA512323f2d22c1196eb1040c11452b4a225424ef3fe6cb32ea24a2ee8c2738f848b759fe4e7a1c45719bc478bffb4365b0fc41bba99824a148b20ac7aa27daa3caa3
-
Filesize
530KB
MD5ddb7d1d960f52573060e5e3f9531141f
SHA1c58ca0e64e24fae2f5a789bcac548458542c2b0f
SHA256acf52236abd117c28073bc383b5cc0c8095d2daf54de04a3df9bc4c30b611203
SHA5122845b43db1f8f3c0ad75ab43381d61ebbec423ef36f1434f8a39028db6d01179638692058d44c4565f5fd9967ee20a0890a37385cbe3bac05d7a4189fd84c837
-
Filesize
900KB
MD5d0d8cf4e5302fdef07168d7ce184de5d
SHA1872b72e0910a3d5f142e85c309ed4295a8cbd95f
SHA2561ff49fa3db1b3aa78459544594f72f7aebf2ba285476c2c8a064bd887ea7f565
SHA512a7569fcc47526da6532d97244172596e8d3900f2cc142709c0bb95ec2447dab5411ae0cc9bbf430470b6734781c5bc748857f5ff56d8a82980e93a40a5a86a09
-
Filesize
390KB
MD5f89482c2c8a495993e2117d5d1bdf442
SHA1fbda41c9a499f9d82e1cf69d06e4c6e16895f0f3
SHA256aaa4364b8fd322f8878d91f8b76319ed71357e2a7e91d0f732d7857d067ceb2d
SHA512121f882af64fd67afa86d0ac1b6b172b1dc9720078a0f6744a5c778911f22e4dd50b0c9d5509307c393dcc1131b3b5eff6d088da8d4c12d309b3facdc46a334a
-
Filesize
261KB
MD556c2c3a73f528f95a1b70f68d3704518
SHA140d1c3cb0a3d9a35ec580540ea6bae39fa6b8261
SHA256517bd079e0108d150b6f3b42afcc578fc5ca690ee8dd0f638e23eb0df07af8a3
SHA5125bbac3d08a1db6dd249c12b65dc49423ee6d12091d058d608b1eb193c7d11b0ba35c591041b721b35f9fe2cfe40eafd7c4cc17f06509d11dc615a9c34d7a17ee
-
Filesize
135KB
MD549b855efea2ebe9e104fefa017cc9878
SHA129448f4b8d7678ba63a5c8e1fd3585a19bf307bb
SHA256ae780948e9ca4e6968dc72a2b32d55409b685e4326db735b0679e32512506cb3
SHA512774429a80c04e35037a8494fdc0944f3dea22bd0610b1534847764e669025c90b1a092ca2c9d3a5f6c065fbb869682b9a5f22fa860657ce3a13934f1e9be2005
-
Filesize
1KB
MD55ea04caa0686dd71f031f55b2f2c5bea
SHA1bf0139847620c3dd225ab30297bac470e181cc7f
SHA256d8aa2c78a308f549350c9e5f16f28d253ac72adbd27d9f6f359804d221fd6fe8
SHA5127503517a6430ecc579df29adb367c74d2fe6eadaebacba53cb9a784c856771f086db377134c3417f5d08ec884ba3118b1f731028377f179d5cc28115809236f4
-
Filesize
320B
MD5d14cca4bbf141429cba8a7c30f74ba48
SHA1b5e5e02d9691636d037ef9eea96c7ce98d96fb25
SHA256cbd0d16510e9bc43fe0794b3d08b1d6ecb0d7f2ac6e8525b9c8be1fdffb36999
SHA512def3c5faaacab9e6a44e83d7a02f64928c384b52673d589456a2e5d822dcff014a59db5f3d5ec3f3649e16cc304dc333c9ca080a06f160ce07ddeadd804dc93a
-
Filesize
221B
MD5eeab5ebeedbce30102841341289f5714
SHA12db8f6720356627b8d8aaa463cccbe3151cb8bbb
SHA2564ad88cb10b193b0fbc69e3354d3ca4d7c1a391900eaf928c82b67118ab61ac4d
SHA512f818521b819be171afe04c5d3e6c71eb21a33a30b3dd7d019b5a7d25ede80b19dc1785517956c73a7e5fc6a2bdc8b50aec774af1155dec5db75b045adb842006
-
Filesize
1KB
MD5bb99d23579ba44356998995ca4ee0b3b
SHA1f1863de77209a4612837f829037124ddef79316e
SHA25632edf8b157d63ba98d9a3756389af1dff123d50788d0bd2cfc88eeccf5aa4b41
SHA512efeefca6fe975a3b38033f6c710c6321b22a72d5fb97affed96735805b979ab39ce8445868a8e28ab285962dcfb330bdd2c1f7784177323d610eb66da12866d9
-
Filesize
12KB
MD5b5ebc8e133bde1042d5d1bfc86a96322
SHA1608c872978e86e4f69e896e65230299321d644e6
SHA256f481a86548061fbec469f161f9f1e069a1fbdbb490775927c1c348543a861a9e
SHA512ef96b7e7db7ab8dbfb3ac62b9d809cb7e3195a91c81c1d78c02a639aa5f8b28aeae9b484799cdcf4823230cdeaf5003c0cdd317739ea06462b10d355e9fcd73a
-
Filesize
4KB
MD5919c55edad80607e82834449cc50fd2a
SHA12bb491f5833a3d8a756615f7274ecad43d69ebfc
SHA2567c312b129df70c1a7bb554b63ba1eb3f80d76462b4fc531d23b0fb4d59a4d48e
SHA512e641e802911ab6ba7076f9c1e3ee886003741c8348a4373c30e42e05f2997599ca51de1f928b1d6794d21a4b4c983cba777c81bd14705121513198ff296621e8
-
Filesize
2KB
MD58f8c5ba7ad74ffecb36e9ddc1edfc61d
SHA124ea0277765bc52823a726cdbdb33d421170a44b
SHA256ed48c21445621c1ca579fdd674232e6f01cdf8ef24916bbf77f3e943437ebcee
SHA512a7915a7a59b84bc3f5584721ac445c0c12fa5442183d5c8d13e39df10e99b7cea223fde5ac35c8383b012a60455cfa4bb73c655ee3772a4aea4b0f1fe7b540e9
-
Filesize
1.3MB
MD58eac6c3146f7d8db62a773e32bc6cf53
SHA1a5d3ad50eac345e298cdb3b7f80f4966fb4234c1
SHA25628d2477926de5d5a8ffcb708cb0c95c3aa9808d757f77b92f82ad4aa50a05cc8
SHA512c3b9a21e0f649699401b5def8b3ec4939a336086d8f470d1d79c69ebccf9ffeafbe9133303d89bc6d0beb713624be52d93ce3bc3204bf62f91fedb2879f868fe
-
C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e58edb6\library\Win_msvc2015\x86\System\api-ms-win-core-console-l1-1-0.dll
Filesize19KB
MD5bcbfcd896e50e591b22e237c903fb523
SHA12358537e316afaca3b61ea797b58ff60c1ef99c0
SHA2568f28bbea2ac836fe993c2fccbc7920c6e0fb5cd3fba7956a85273ebe2282fb15
SHA5121a9812c4fe427e89254df346721cfc93ef52d5547d293a987516b43c21e7baa51ee76f6dacebe87334a67ba54b98633e603b4da21b8264240561e1801e922eeb
-
Filesize
190B
MD5287d75ce63212a23f2b38c907880c442
SHA1430229651ea9cd620aefc62fe90eb7013bcab821
SHA2568070de48847c80df69a1f8d29a6f4d4a898235a0e53f5dd0c9fa12c19616a766
SHA5120b033df86eacab10f16a242b160544d447e842ae75c5e45a16b3a6c137ffc34032df3b5149b0895b8b9d29835b32c8288efb8fd1002bc7e659d80b2e3e79db02
-
Filesize
426KB
MD50a0042fe544c91cd57bc2f7ef40bb974
SHA18bf31f44ba3e47b8b186c3d8cc219a4d2f67da63
SHA2564190f0a1306257ced4975448794e1d42be312e334ffccfb4910a4a39cde9df57
SHA512c4c56c06cd40213ebdcead6a256510b44beefc3a18d7f84efebcd05bac7bb1b942f97b7f7798420ca8ff0c1592f32301d751554fb63125b4703feadfced2f6be
-
Filesize
74KB
MD5afa8fb684eded0d4ca6aa03aebea446f
SHA198bbb8543d4b3fbecebb952037adb0f9869a63a5
SHA25644de8d0dc9994bff357344c44f12e8bfff8150442f7ca313298b98e6c23a588e
SHA5126669eec07269002c881467d4f4af82e5510928ea32ce79a7b1f51a71ba9567e8d99605c5bc86f940a7b70231d70638aeb2f6c2397ef197bd4c28f5e9fad40312
-
Filesize
100KB
MD56b8e61941c88a80933adb126e5c2c9bc
SHA138364b913fe6d19a5ae70a4828774f7ba5695d8d
SHA256ceb2c96db4e310724b3e79539e2abfe29955860f48c41069d15a59dd539c9fb5
SHA5128808da67ee9d0f34aa8892d587a488cd837545b7a86443c3e5989359d14788002a5a83a5cffb63522b3eb4905b5db9b2ad5876415887925aa04e3fb18d6af1d2
-
Filesize
97KB
MD53bf466ded005192efba9bfaa6285379e
SHA129b17f7da99d31632da494ff8853a482fb99e525
SHA256f0c3b1f5d3dcf9b33db6358c59c83bfc4087d0fa331f9bd981c38204ce907d13
SHA512b2d4c9a987dae2ed2c0b49d339ce68340cbb31f84ea784043b5e21c8e43a1117bb1c898a4ed9bd5ac11382f95117f316ccd77d34515a5497c7cd9b0de6351e1e