081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e

Analysis

max time kernel
136s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 09:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
Size 1.3MB
Sample260903-lzcmgseq51
SHA256 081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e
MD5 6c66dcde2170aeab57b9ddfd5a68b0c2
SHA1 f3317710fd3f380655bf3080246393dac68f0765
SHA512 e1822e62b1be9e6bdc85d7ea9a2620d93122a51c50ff685dde9bb6cbe008c17b091d2d636b72a0b319e2b9b022750c52342ac875c1dd98a41f2f9aadb11a6570
SSDEEP 24576:v7M/vXd0GFi/eytAEuJ7qxu3qJ9ps1Rg8ZwyBKfPuAhYt2iH/6w2pZPvpf7Qg6aE:v7Kfd0GFi/pAEE74fe1R3JgfLhYtvCRY
TLSH
T1625501213792C077D7E300318A82C7A8627B7ED169EF9D07BBD07E4DDA3015EAA35A51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware bootkit discovery execution persistence spyware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4296	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
8	4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\Drivers\TFsFltX64_ev.sys	QQPCMgr_Setup.exe

Executes dropped EXE 5 IoCs

pid	Process
4908	Logo1_.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4272	QQPCMgr_Setup.exe
3128	QQPCSoftCmd.exe
2828	QQPCTray.exe

Loads dropped DLL 14 IoCs

pid	Process
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4272	QQPCMgr_Setup.exe
3128	QQPCSoftCmd.exe
3128	QQPCSoftCmd.exe
3128	QQPCSoftCmd.exe
3128	QQPCSoftCmd.exe
3128	QQPCSoftCmd.exe
3128	QQPCSoftCmd.exe
3128	QQPCSoftCmd.exe
3128	QQPCSoftCmd.exe
2828	QQPCTray.exe
2828	QQPCTray.exe
2828	QQPCTray.exe
2828	QQPCTray.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ QQPCTray = "\"C:\\Program Files (x86)\\Tencent\\QQPCMgr\\18.1.30302.212\\QQPCTray.exe\" /regrun"	QQPCMgr_Setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
File opened for modification	\??\PhysicalDrive0	QQPCMgr_Setup.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\.tab_sdk_storage\mmkv.default	QQPCMgr_Setup.exe
File opened for modification	C:\Windows\SysWOW64\.tab_sdk_storage\mmkv.default.crc	QQPCMgr_Setup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\SoftMgr\PCSoftMgrToolsDll.dll	QQPCMgr_Setup.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\Qt64\QMSetting.exe	QQPCMgr_Setup.exe
File opened for modification	C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMUpdate\GFCustom.dll	QQPCMgr_Setup.exe
File created	C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\plugins\QMNetMon\ucrtbase.dll	QQPCMgr_Setup.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Temp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\Qt64\imageformats\qtiff.dll	QQPCMgr_Setup.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Notifications\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	Logo1_.exe
File created	C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\Qt64\setting_plugins\QMUsPlugin\QMUsPlugin.dll	QQPCMgr_Setup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QtRes\QQPCMgr_MiniHome.rcc	QQPCMgr_Setup.exe
File created	C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\StartupMgrDll.dll	QQPCMgr_Setup.exe
File created	C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\api-ms-win-core-errorhandling-l1-1-0.dll	QQPCMgr_Setup.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	Logo1_.exe
File created	C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMAssocScan.dll	QQPCMgr_Setup.exe
File created	C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\plugins\QMNetMon\api-ms-win-core-util-l1-1-0.dll	QQPCMgr_Setup.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMUpdate\imageformats\qwbmp.dll	QQPCMgr_Setup.exe
File created	C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMUpdate\Qt5WinExtras.dll	QQPCMgr_Setup.exe
File created	C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\TAVInterface.dll	QQPCMgr_Setup.exe
File created	C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMUpdate\api-ms-win-core-datetime-l1-1-0.dll	QQPCMgr_Setup.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
File created	C:\Windows\Logo1_.exe	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3956	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QQPCMgr_Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QQPCSoftCmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QQPCTray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\PCMgrRepairIEExtensions\WarnOnOpen = "0"	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\PCMgrRepairIEExtensions	QQPCMgr_Setup.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_13 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e1d176edd6bcaaf4d5e7b	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_19 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fae052b8cbd03fa5e977a4beb26b7f7007cab85ea59b9082830bc43669527408210fb5385e595e1cc1b9b5b706befd119344778b7c0d83972707197ad84e8fc7ce11bfaff98d62c779267eeab772d18b2321c41de561f	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_21 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fae052b8cbd03fa5e977a4beb26b7f7007cab85ea59b9082830bc43669527408210fb5385e595e1cc1b9b5b706befd119344778b7dad83972697190ad87e8ef7cfe1bbfffb8d6	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_29 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fae052b8cbd03fa5e977a4beb26b7f7007cab85ea59b9082830bc43669527408210fb5385e595e1cc1b9b5b706befd119344778b7ddd82872657192ad9fe8ae7cc71bbfffa5d63177a167ccab712d14b2201c47de441fc2b84706c3bbcbcac1480e998b4e866c9621d267	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_44 = 3874d037c712e567e705819e9fffc6764c1730e367920d563ac3e822842e23173bdd30cabe4d057bacac7e44f66fbf052b8cb103fa5e917a4beb61b7ed0058ab80ea5fb90928	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_55 = 3874d037c712e067e6058b9e8affc77671170de3329229563fc3ed22822e0c174ddd71caa24d587bf5ac2444	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_8 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fae052b8cbd03fa5e977a4beb26b7f7007cab85ea59b9082830bc43669527408210fb5385e595e1cc1b9b5b706befd119344778b7dcd83972677185ad85e8fa7c	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_25 = 3874d037c712e067e6058b9e8affc77671170de3329229563fc3ed22822e0c175fdd7dcab54d567beeac3844da6f	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_32 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fb0052b8cbf03f65e927a79eb0cb7c20052ab9eea55b9092830bc56668e277a8233fb6685dc95eccc1a9b487077effa190e476ab7ebd82872477181ad88e8e67cef1b	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_56 = 3874d037c712e267fc05809e9cffdb765a172ee31b92395636c3f7228e2e251769dd7bcaa34d4e7b	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defQuietSimpleVersion = 7a74ea37	QQPCSoftCmd.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_6 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e16177add6ecaa94d4f7bf3ac2344cf6f8f05	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_28 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fb0052b8cbf03f65e927a	QQPCMgr_Setup.exe
Key created	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_37 = 3874d037c712e267fc05809e9cffdb765a172ee31b9238562ac3f722952e351776dd2bcaf44d	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_39 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e001772dd7bcab24d487be8ac3244d96f	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_42 = 3874d037c712e567e705819e9fffc6764c1730e367920d563ac3e822842e23173bdd30cabe4d057bacac7e44	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_11 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fae052b8cbd03fa5e977a4beb26b7f7007cab85ea59b9082830bc43669527408210fb5385e595e1cc1b9b5b706befd119344778b7ddd82872657192ad9fe8ae7cc71bbfffa5d63177	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_14 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e061772dd7ccaa34d527be9ac	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_43 = 3874d037c712e567e705819e9fffc6764c1730e367920d563ac3e822842e23173bdd30cabe4d057bacac7e44f66fbf052b8cb103fa5e917a4beb61b7ed0058ab80ea5fb90928	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_45 = 3874d037c712e567e705819e9fffc6764c1730e303922a5627c3e522bd2e1d1772dd7bcab44d527be9ac3844cc6f8805188c8b03fe5e907a41eb2eb7dc0042abb0ea6eb91f2832bc40669627478210fb6a85c195	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defTipsBehaviourLocal = 7a74ea37	QQPCSoftCmd.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSimpleVersionNetConfig = 7b74ea37	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_16 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e14177edd6bcaad4d497bf5ac2744	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_23 = 3874d037c712e567e705819e9fffc6764c1730e303922a5627c3e522bd2e1d1772dd7bcab44d527be9ac3844cc6f8805188c8b03fe5e907a41eb2eb7dc0042abb0ea69b90e283ebc42668e27068229fb6a85dc95fdcc299b6f7076efc919204756b7efd831727771	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_34 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fb0052b8cbf03f65e927a79eb0cb7c20052ab9eea55b9092830bc56668e277a8233fb6685dc95eccc1a9b487077effa190f474db7fdd828726b7192ad92e8	QQPCMgr_Setup.exe
Key created	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg	QQPCSoftCmd.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_31 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e16177add6ecaa94d4f7bf3ac2344cf6f8f05	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_36 = 3874d037c712e267fc05809e9cffdb765a172ee3	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_7 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fae052b8cbd03fa5e977a4beb26b7f7007cab85ea59b9082830bc43669527408210fb5385e595e1cc1b9b5b706befd119344778b7ddd82872657192ad9fe8ae7cc71bbfffa5d63177a167ccab712d14b2201c47de441fc2b84706c3bbcbcac1480e998b4e866c9621d267	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_9 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fae052b8cbd03fa5e977a4beb26b7f7007cab85ea59b9082830bc43669527408210fb5385e595e1cc1b9b5b706befd119344778b7ddd839726a7184adbfe8e17c	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_33 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fb0052b8cbf03f65e927a79eb0cb7c20052ab9eea55b9092830bc56668e277a8233fb6685dc95eccc1a9b487077effa190e476ab7ebd8287247718fad84e8e57ce31bbfffb8d6	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\NewVersionAvailable	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpeedupSkinTipsLastVersion = 7474ea37	QQPCSoftCmd.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_35 = 3874d037c712e567e705819e9fffc6764c1730e303922a5627c3e522	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_59 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fb0052b8cbf03f65e927a79eb0cb7c20052ab9eea55b9092830bc56668e277a8233fb6685dc95eccc1a9b487077effa19054751b7fcd832725871a2ad9ee8fc7ce41b	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpeedupRockeQQMsgGuidShowCnt = 7a74ea37	QQPCSoftCmd.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defCreateMainLinkTime = 5c31735d9b12b567	QQPCSoftCmd.exe
Key created	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_20 = 3874d037c712e267fc05809e9cffdb765a172ee31b920d563cc3ea22952e2317	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_22 = 3874d037c712e567e705819e9fffc6764c1730e303922a5627c3e522bd2e1d1772dd7bcab44d527be9ac3844cc6f8805188c8b03fe5e907a41eb2eb7dc0042abb0ea69b90e283ebc42668e27068229fb6a85dc95fdcc	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_24 = 3874d037c712e567e705819e9fffc6764c1730e303922a5627c3e522bd2e1d1772dd7bcab44d527be9ac3844cc6f8805188c8b03fe5e907a41eb2eb7dc0042abb0ea69b90e283ebc42668e27068229fb6a85dc95fdcc299b6f7076efc919204756b7efd831727771bcadb8e8fa7ceb1ba8ffbfd631778d67	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_40 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_47 = 3874d037c712e567e705819e9fffc6764c1730e303922a5627c3e522bd2e1d1772dd7bcab44d527be9ac3844cc6f8805188c8b03fe5e907a41eb2eb7dc0042abb0ea69b90e283ebc42668e27068229fb6a85dc95fdcc299b6f7076efc919204756b7efd831727771bcadaae8ea7ce71bb3ffa5d62d778e67e8ab712d1ab2331c5cde531fcab81406cbbbf7cada4803998a4e	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_5 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e141774dd7bcab34d507bffac3944de6f8f05	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_27 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fae052b8cbd03fa5e977a4beb26b7f7007cab85ea59b9082830bc43669527408210fb5385e595e1cc1b9b5b706befd119344778b7ded82e726d718ead9fe8eb7cf81bfaff98d62c779267eeab772d18b2321c41de561f	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defNormalShowAppStore = 7a74ea37	QQPCMgr_Setup.exe
Key created	\REGISTRY\USER\QMConfig	QQPCMgr_Setup.exe
Key created	\REGISTRY\USER\QMConfig\QQDoctor	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\TestWritable = 7b74ea37	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_38 = 3874d037c712e567e705819e9fffc6764c1730e367920d563ac3e822842e23173bdd30cabe4d057bacac7e44	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\UpdateTipsHistory	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_0 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e14177edd6bcaad4d497bf5ac2744	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_26 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fae052b8cbd03fa5e977a4beb26b7	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_41 = 3874d037c712e267fc05809e9cffdb765a172ee31b9218562ac3f722b62e1f174cdd2ecaf24d	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_46 = 3874d037c712e067e6058b9e8affc77671170de3329229563fc3ed22822e0c175fdd77caa54d487bf7ac3244c46f8805378c	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_53 = 3874d037c712e067e6058b9e8affc77671170de3329229563fc3ed22822e0c1756dd6dcab54d547bf9ac	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defUninstControlpanel = 7a74ea37	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_48 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fae052b8cbd03fa5e977a4beb26b7f7007cab85ea59b9082830bc43669527408210fb5385e595e1cc1b9b5b706befd119344778b7ddd82872657192ad9fe8ae7cc71bbfffa5d63177a167ccab712d14b2201c47de441fc2b84706c3bbd9cad1480299904e9c6c8a21d167d3193a10660b696bc6b1d877fff7faa1d901095d7634d067a388	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_54 = 3874d037c712e067e6058b9e8affc77671170de3329229563fc3ed22822e0c174bdd71caa54d497befac2544cf6f8f05	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\UpdateVersion	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_2 = 3874d037c712e067e6058b9e8affc77671171ce3239226563ac3ea22bd2e11176bdd68ca824d5c7beeac3644f66fae052b8cbd03fa5e977a4beb26b7f7007cab85ea59b9082830bc43669527408210fb5385e595e1cc1b9b5b706befd119344778b7ddd82872657192ad9fe8ae7cc71bbfffa5d63177a167ccab712d14b2201c47de441fc2b84706	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpecialFolderPath_Cache_30 = 3874d037c712e567e705819e9fffc6764c1730e303922a5627c3e522bd2e1d1772dd7bcab44d527be9ac3844cc6f8805188c8b03fe5e907a41eb2eb7dc0042abb0ea69b90e283ebc42668e27068229fb6a85dc95fdcc299b6f7076efc919204756b7efd831727771bcadb8e8fa7ceb1ba8ffbfd631778d67	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSpeedupUserGuideConfig = 844beac7	QQPCSoftCmd.exe

Modifies registry class 59 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQPCMgr.qbox	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMRemote\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Tencent\\QQPCMgr\\18.1.30302.212\\QQPCMgr.exe\" /pullRemote \"%1\""	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMSoft\Shell	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMAi\ = "腾讯电脑管家"	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PCMgrRepairIEExtensions\DefaultIcon\ = "C:\\Program Files (x86)\\Tencent\\QQPCMgr\\18.1.30302.212\\QQPCMgr.exe"	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMRemote\Shell\Open\Command	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PCMgrRepairIEExtensions\ = "URL: 电脑管家-修复IE插件"	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E2A79C5-48F1-4182-BCF9-E92857BDA980}\ = "强力卸载"	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQPCMgr.qbox\shell\command\ = "C:\\Program Files (x86)\\Tencent\\QQPCMgr\\18.1.30302.212\\QQPCFileSafe.exe \"%1\""	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMSoft	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQPCMgr.qbox\shell\	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQPCMgr.qbox\shell\open\ = "打开文件保险柜"	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E2A79C5-48F1-4182-BCF9-E92857BDA980}\Shell\Open\Command\ = "C:\\Program Files (x86)\\Tencent\\QQPCMgr\\18.1.30302.212\\QQPCSoftMgr.exe /page=uninst /parent=controlpanelitem"	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMRemote\Shell\Open	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMSoft\Shell\	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E2A79C5-48F1-4182-BCF9-E92857BDA980}\DefaultIcon\ = "C:\\Program Files (x86)\\Tencent\\QQPCMgr\\18.1.30302.212\\QQPCSoftMgr.exe"	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.qbox\ = "QQPCMgr.qbox"	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMAi\URL Protocol = "\"C:\\Program Files (x86)\\Tencent\\QQPCMgr\\18.1.30302.212\\Qt64\\QMUI.exe\""	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PCMgrRepairIEExtensions\Shell	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PCMgrRepairIEExtensions\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Tencent\\QQPCMgr\\18.1.30302.212\\QQPCMgr.exe\"%1 "	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQPCMgr.qbox\ = "QQ保险柜文件(.qbox)"	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMSoft\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Tencent\\QQPCMgr\\18.1.30302.212\\QQPCMgr.exe\" /pullSoft \"%1\""	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMAi	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMAi\Shell\	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMAi\Shell\Open	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E2A79C5-48F1-4182-BCF9-E92857BDA980}\Shell\Open\Command	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQPCMgr.qbox\DefaultIcon\ = "C:\\Program Files (x86)\\Tencent\\QQPCMgr\\18.1.30302.212\\image\\qbox.ico,0"	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQPCMgr.qbox\shell	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMRemote	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMRemote\Shell	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMSoft\Shell\Open	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMAi\Shell\Open\	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PCMgrRepairIEExtensions\Shell\Open	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E2A79C5-48F1-4182-BCF9-E92857BDA980}\DefaultIcon	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMRemote\ = "腾讯电脑管家"	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMRemote\Shell\Open\	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMAi\Shell	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PCMgrRepairIEExtensions	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PCMgrRepairIEExtensions\Shell\Open\Command	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E2A79C5-48F1-4182-BCF9-E92857BDA980}\Shell\Open	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQPCMgr.qbox\shell\open	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMSoft\URL Protocol = "\"C:\\Program Files (x86)\\Tencent\\QQPCMgr\\18.1.30302.212\\QQPCSoftMgr.exe\""	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMSoft\Shell\Open\	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQPCMgr.qbox\DefaultIcon	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMSoft\Shell\Open\Command	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMAi\Shell\Open\Command	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PCMgrRepairIEExtensions\DefaultIcon	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E2A79C5-48F1-4182-BCF9-E92857BDA980}	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQPCMgr.qbox\shell\command	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMRemote\URL Protocol = "\"C:\\Program Files (x86)\\Tencent\\QQPCMgr\\18.1.30302.212\\QMRemote.exe\""	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMRemote\Shell\	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMSoft\ = "腾讯电脑管家"	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E2A79C5-48F1-4182-BCF9-E92857BDA980}\InfoTip = "使用电脑管家强力卸载功能卸载软件"	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.qbox	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMAi\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Tencent\\QQPCMgr\\18.1.30302.212\\QQPCMgr.exe\" /ai_guide \"%1\""	QQPCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PCMgrRepairIEExtensions\URL Protocol	QQPCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E2A79C5-48F1-4182-BCF9-E92857BDA980}\Shell	QQPCMgr_Setup.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4908	Logo1_.exe
4908	Logo1_.exe
4908	Logo1_.exe
4908	Logo1_.exe
4908	Logo1_.exe
4908	Logo1_.exe
4908	Logo1_.exe
4908	Logo1_.exe
4908	Logo1_.exe
4908	Logo1_.exe
4908	Logo1_.exe
4908	Logo1_.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4908	Logo1_.exe
4908	Logo1_.exe
4908	Logo1_.exe
4908	Logo1_.exe
4908	Logo1_.exe
4908	Logo1_.exe
4908	Logo1_.exe
4908	Logo1_.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe
4272	QQPCMgr_Setup.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
820	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeBackupPrivilege	4272	QQPCMgr_Setup.exe
Token: SeRestorePrivilege	4272	QQPCMgr_Setup.exe
Token: SeBackupPrivilege	4272	QQPCMgr_Setup.exe
Token: SeRestorePrivilege	4272	QQPCMgr_Setup.exe
Token: SeDebugPrivilege	4272	QQPCMgr_Setup.exe
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeIncreaseQuotaPrivilege	4296	powershell.exe
Token: SeSecurityPrivilege	4296	powershell.exe
Token: SeTakeOwnershipPrivilege	4296	powershell.exe
Token: SeLoadDriverPrivilege	4296	powershell.exe
Token: SeSystemProfilePrivilege	4296	powershell.exe
Token: SeSystemtimePrivilege	4296	powershell.exe
Token: SeProfSingleProcessPrivilege	4296	powershell.exe
Token: SeIncBasePriorityPrivilege	4296	powershell.exe
Token: SeCreatePagefilePrivilege	4296	powershell.exe
Token: SeBackupPrivilege	4296	powershell.exe
Token: SeRestorePrivilege	4296	powershell.exe
Token: SeShutdownPrivilege	4296	powershell.exe
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeSystemEnvironmentPrivilege	4296	powershell.exe
Token: SeRemoteShutdownPrivilege	4296	powershell.exe
Token: SeUndockPrivilege	4296	powershell.exe
Token: SeManageVolumePrivilege	4296	powershell.exe
Token: 33	4296	powershell.exe
Token: 34	4296	powershell.exe
Token: 35	4296	powershell.exe
Token: 36	4296	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5596 wrote to memory of 3956	5596	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe	90
PID 5596 wrote to memory of 4908	5596	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe	91
PID 4908 wrote to memory of 3188	4908	Logo1_.exe	92
PID 3188 wrote to memory of 240	3188	net.exe	94
PID 3956 wrote to memory of 4720	3956	cmd.exe	96
PID 4720 wrote to memory of 4272	4720	081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe	98
PID 4272 wrote to memory of 5192	4272	QQPCMgr_Setup.exe	99
PID 4272 wrote to memory of 4296	4272	QQPCMgr_Setup.exe	101
PID 4272 wrote to memory of 3128	4272	QQPCMgr_Setup.exe	104

C:\Users\Admin\AppData\Local\Temp\081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
"C:\Users\Admin\AppData\Local\Temp\081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6884.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Users\Admin\AppData\Local\Temp\081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe
    "C:\Users\Admin\AppData\Local\Temp\081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe"
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Users\Admin\AppData\Roaming\tencent\QQPCMgr\Download\QQPCMgr_Setup.exe
      "C:\Users\Admin\AppData\Roaming\tencent\QQPCMgr\Download\QQPCMgr_Setup.exe" /S ##silence=1&handle=524862&update=1&supply=79578&forceinstall=1&qqpcmgr=0&DownloadSetupInOne=1
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Writes to the Master Boot Record (MBR)
      Drops file in System32 directory
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\Windows\SysWOW64\cacls.exe
        
        "cacls" "C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212" /t /e /c /g SYSTEM:f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5192
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; $OutputEncoding=[System.Text.Encoding]::UTF8; $ErrorActionPreference='Stop'; try { Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Tencent\QQPCMgr' -Force; Write-Host 'OK: Add-MpPreference done' } catch { Write-Host ('ERR: ' + $_.Exception.Message); exit 1 }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4296
    - - C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCSoftCmd.exe
        
        "C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCSoftCmd.exe" /command=SetSimpleVersionConfig /SimpleVersion=2 /From=Installer
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies data under HKEY_USERS
        
        PID:3128
    - - C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCRTP.exe
        
        "C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCRTP.exe" -i
        5⤵
        
        PID:4952
    - - C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\15031.exe
        
        "C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\15031.exe" -i
        5⤵
        
        PID:5628
    - - C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMContextMenuApp.exe
        
        "C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMContextMenuApp.exe" /i
        5⤵
        
        PID:2856
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMContextUninstall64.dll"
        5⤵
        
        PID:1364
      - C:\Windows\system32\regsvr32.exe
        
        /s "C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMContextUninstall64.dll"
        6⤵
        
        PID:5788
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4108

C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCTray.exe
"C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCTray.exe" /regrun
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2828
- C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\InjectHostExe64.exe
  "C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\InjectHostExe64.exe"
  2⤵
  PID:4124
- C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMHwDrX64.exe
  QMHwDrX64.exe /starthwdetect
  2⤵
  PID:1728
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\FileSmashMenu64.dll"
  2⤵
  PID:5252
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\FileSmashMenu64.dll"
    3⤵
    PID:3692
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\FileSmashMenu.dll"
  2⤵
  PID:4076

C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\qmudisk64_ev.sys
"C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMUdisk64_ev.sys"
1⤵
PID:5528

C:\Windows\system32\Drivers\TFsFltX64_ev.sys
system32\Drivers\TFsFltX64_ev.sys
1⤵
PID:1000

C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCRTP.exe
"C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCRTP.exe" -r
1⤵
PID:5012

C:\Windows\system32\Drivers\TAOAcceleratorEx64_ev.sys
C:\Windows\system32\Drivers\TAOAcceleratorEx64_ev.sys
1⤵
PID:4880

C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\TSSysKit64_ev.sys
"C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\TSSysKit64_EV.sys"
1⤵
PID:1932

C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCRTP.exe
"C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCRTP.exe" -r
1⤵
PID:5072
- C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCSoftCmd.exe
  "C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCSoftCmd.exe" /command=GetQimei
  2⤵
  PID:2756

C:\Windows\system32\Drivers\TAOKernelEx64_ev.sys
C:\Windows\system32\Drivers\TAOKernelEx64_ev.sys
1⤵
PID:2256

C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\15031.exe
"C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\15031.exe" "-r"
1⤵
PID:3420

C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCRtp.exe
"C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCRtp.exe" -r
1⤵
PID:1000
- C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCSoftCmd.exe
  "C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCSoftCmd.exe" /command=GetQimei
  2⤵
  PID:6088

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004CC
1⤵
PID:1956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 4467aa1382752d482b558a20acbc8900be262d3a3fc14bd4f557f3687d6f7ca8
MD5 d8237a94014e7bdd40a9072a2dcdd4d6
SHA1 3689a8c694422a22625ca58278fd106b70c5f2e6
SHA512 43a37f53b5554e9d9d43bee9d81f199add08a0314878922b75d428d436a7ac852996a208a1c9f706588fe6b97b7a4fe7c9f182341fcf156494cb4db7c78c3c24
SSDEEP 3072:LftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:LVfjmN2G7/fYfLvzB+QFyn
TLSH
T1B7C37C1371D08871E5B10C3449E1EAA19E3FBD620B409EA737C467BE0F317D1DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GF.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\GF.dll
Size 3.2MB
SHA256 4c6afe9332f1afbcd609f6b0159b43ffb058702f05e3b0e3c1e3a4562bed4a5c
MD5 3ac2ae85e70cfce9b85d32c0b5c611bf
SHA1 45c5836cc42673ec7aa471b09e79d9332fead180
SHA512 a351e26d9ae3a70eb5a3ef17b04e3f2bafab953676bba7d86b71d73b692140ee89c748194dac5dba29c6cecbb1283b2065613a196b24af91533e59d18e8478e4
SSDEEP 49152:/KkiiefHXvWP7V/EsTJWASbXi/Q8c4AfN2LNQmopZ8uaGaJQJ+eAT:/Kvief/AR/EsTJWpbS/QiCGGIQ2
TLSH
T151F5391237E0C425E1BB13B62E2AF7BD827EF9605F70C2EF1B98264D29719C25521727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GFCustom.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\GFCustom.dll
Size 576KB
SHA256 fafb004073f77207f67f3ecb1dd5739e8e95f7f177557b55a783daf393f3b158
MD5 c15a2d43aad0bfad6eeca5a6703c5848
SHA1 b892d2134183ff1234dc13f0f868d2b5d7f5595a
SHA512 2f2399d276137ce3ba695c5fdf26ac142e3500a20befea3fd23c9333dc45d9b7ed3b339baf6b154259d91e9b9c888b660650ffec834fd4c29ed5219ea665ca48
SSDEEP 6144:I7DZmQzXW6yniCcrbBHZIflyCaLoIKuhkCoVt:qrgRCIflnaLoLt
TLSH
T139C4085337A6C129FBAD817E192AA71A90EEF56003D481DFDC4859EB18639C209F7337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QMCommon.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMCommon.dll
Size 1.3MB
SHA256 ee2a772755cb5f2131b4a58bace7bacc5d291ea49f777e0c9a1ab42a92be78fa
MD5 e118d2199de59472ddb710ca1b391d2b
SHA1 8f25f7d4cce64a40e4ca4923544106459e8d7d80
SHA512 edfc84de5c63ab515d7b1d07ec16da032714edd1e88b1fcfa8c7e9c4899d48fe48280dfd068837d43c1406f2846bdac2c9413bf3c84e66f050644c3abaf73eb4
SSDEEP 24576:RD6KMYRRVthNbrQFjS3pMO2q7QmUIZ+t2otSZYHZUhJBz4DsAh:RpTfpr2+3aO2HmjacYKWsAh
TLSH
T120555B313BAA8431E1B207B1593EA56B827EB8710F3686CFA3C43F6D9A315D15B31716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QMFeatureCtrl.dat

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMFeatureCtrl.dat
Size 8KB
SHA256 0183cb424f77ec60bb5bdddfc415c50c74eeeba783daa45c394586be759764af
MD5 7f4317f9a859f4a778e34d2d40a52d48
SHA1 ea7701392b9bfad8c26f41fbe1de7b5f985df6a6
SHA512 1a7cc075df9a825cfd0ea73e8b666ba6521c091c89ff9d96d652db6c3fdfad7215a0712296fc097b201ee878f12f97e9ea24b4764cb21a99064d8595d86f1f35
SSDEEP 96:ZC2q4ftAgeOA9NDRHpwn4XENSYD4ZJM5eQuFbICJufbAg8MAVFDRwpwn4ACzGqGb:HeWxeG8VS/BnX2SGt3ve7mqnj8
TLSH
T183028D63C9595CBF2974D1B9A6982A05F32B831F86D094CFF13C944D0FBA7D27148A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QMGuid64.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMGuid64.dll
Size 298KB
SHA256 c4acc43c54f75276db93ee45313639f920c1d33495d78afa1f19139c75dab99b
MD5 616bdd6a76168eb65e7677a63625392d
SHA1 fef9e64529d41fc5830340d75500ae9094325787
SHA512 9e82bf9580e94dba00dc9e059b9eed115d3a95e610e2b79e157cdd693bdc9af1f005390efe732c6070fb495c3bac6ef6da97cfac0242127f101fbb964e25747d
SSDEEP 3072:PzNNcig2X3W60NyCywG7+7HHTO3F1xyajGGjDqozLYYW1Dwm4l9qqck2OEicdmbb:Pfd63G+TO3FNR3qVYWSZchmjX+0
TLSH
T187545A5672D904BDE5EBE27DA6979943FAB638030361DEDF0390092A1E537D0BE38760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QMIpc.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMIpc.dll
Size 233KB
SHA256 92389323eefda56cbd3b4abfdbae7b30423cacd9aa26c39a0f9904a64afd1337
MD5 47b1f0ecc7ef63351a1e26f28c9b7107
SHA1 c065336715cf4e049a070f723d13f652928fa9d9
SHA512 84bcf8451c21cc788edef9cd84ded482153e2df4de64d7a00a672a543e6ea3b29d771655f2ff1bddadffd2ef3583ff0811c53e18a2585dc62dcab6e05516e417
SSDEEP 6144:+PR/ksa/qyoDzpIGIEEEX53pHmBCxXC9ScWgDXu:+Z/FZ2GdEEp30AXfwXu
TLSH
T11534DA613FDD883DEAEE0372987BD79B913EBA700F7590DF93982D5E09219C15A30612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QMIpc64.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMIpc64.dll
Size 313KB
SHA256 cc7bc6ce8e26a2e06757231b3c2414d06597ac8c9ccc9422f1495b2390cfae54
MD5 a45c68f007ea0dbe04dc7cf56a654fff
SHA1 19985d05b74b210df7509bb323a44fa8812fa766
SHA512 417f8e8757acbcedca87aecad4e2c4c1f2b884dd8d7654f2067d009d41ff07c74a5babf803eb2536c10dfe7cdb47f213d671d8bb35e20b6554a57d88ad11de38
SSDEEP 6144:gcQf1SE1tiMNt7rffu0e1HFMZkaPqrSafhx:HsIE1tVzHf7Z3vy
TLSH
T137647C16B3A805B5E1B78279CAE7C907E7B3B8610761DBCF1260471A3F237E06A39751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QMEventBus64.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMLauncher\QMEventBus64.dll
Size 103KB
SHA256 b50746e967708bb58f3e5079b3dcc5947c9d038cef0de824e27269fa9669cb3a
MD5 338c0b8927cf16f743b320163110506c
SHA1 f99ac6df650bb6131f53431da3b6a531b77b03a9
SHA512 27e9cf5ef49bf764a03f49f23621efc26af4d465816e964166924d534b20e06d5ddb459313da0e2ebd4e0e21d69374f5dc9af62cd18eebc54ee180a0e5050c42
SSDEEP 3072:KmnXqLTvZA9ZTCKii+7M+XHwvY7lJUICIP202XFHjlCc:KmX8TvZA9ZTCKii+7M+XHwvMlwXFHjlV
TLSH
T151A34957B2E800A8E577D67D9AE7890BEBB2B4591B21D7CF0320425E0F23BD16D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QMLogEx64.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMLauncher\QMLib\QMLogEx64.dll
Size 89KB
SHA256 286db7b249c2ceda0e29f33d8d167ddce615857d279f8f288bfac89883c88fc6
MD5 60c57388574af8c523a70e95b667eb47
SHA1 e024db628e99ce0e6f720b80a9b492adcca296db
SHA512 10039aa732123a71a4cd92c2f9e27b562c45f7df81975aa1df228764d16ca689e9d168ea194f272be1e24d689dd3e89bed03b5f9fa2788eb6f1dfa6f7039fb4a
SSDEEP 1536:/XPfjhKMNfS2CG7BihZVLmc8DDX3rfBVgcla7Y8:/XHdKMNKWoZVLVmDX3rfHgclaZ
TLSH
T181931656B3E800A9F5A792B99E778517D733F0224721D7CF9260C2192F327E45E35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QMLogEx.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMLogEx.dll
Size 80KB
SHA256 84906a1a40bcc371c99a080386f960b5cbaf7db225442f42d51eb32e923dd440
MD5 b1f1de587291593d06d5509897b1c39c
SHA1 052f616d28e3e8264f51eb68329360d98fc91e85
SHA512 dfd5039b8a37f1790d4a2abd03785dc23e9f9990328b6bd2c157c2fa21b9ac689020f548bf109a1f6d5af3b3a689ae2c23bed4034ebbb80e1c1cd6bcc0ef2a49
SSDEEP 1536:s7CnHBGW46Gi40YmsqLGIY+973j3HL/lp4ccd75Ej:lEW46Gh0rsqzYO3j3HL/lp4llEj
TLSH
T1F4834B117EE848A8F9EB06B1787587B7A23AF5726FB180CFA352825D1D306D26D30717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QMNetworkMgr.ini

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMNetworkMgr.ini
Size 118B
SHA256 e46572e5e54f2956ad5f8957e18372e38f276519fa4f1d52d2dc77c076007010
MD5 3c0d72adeb835f229aeaf34bab2f650c
SHA1 483a6e28e47d0d2875f3e3e2ab46885cff1d6c53
SHA512 aa2315a9fe14609fb1e0478164f158f1a8552b40cd8ed6ed203d319922110ac2cd348c3563f2c00353a521fe3b9865b2b09aa794022f7aa4751cc69b3fe74f82
TLSH
T1AAB09220269EACD86A5D0427090840BD01349288856A8BF40A632A0A3CAA110330BF81
MD5 SHA1 SHA512 TLSH

Submit Download

QMPrivilege.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMPrivilege.dll
Size 442KB
SHA256 39f478ef209a6fa18c9587f44f4bad4665b230b81d9933d4e2ac2856e0d783a8
MD5 3fec272e29dea4b835f37d34be291372
SHA1 1d42980cc2b2bc192d81338d85f008e8b331ce82
SHA512 e2e54f49a68b2fa3834f82fadbebaf85f9f85c19fe18e690bf8e7c4bb3151c898ff9ccca144d8f634f76be00fab17d9fe6831ef628ea82b271dce3fd0494ba1b
SSDEEP 6144:Uc6fM3bFhMZlYJi3C26t0rNtbwrBnBQMY8sgyD8YD12T:Uc6fM3bFhpJLHANpwrBnnYEJ
TLSH
T144A49F51BF8041B3E4AD073995A91B313AFDBA303BB3CBCB6788017A8E95340DF55666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QMQtCommon.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMQtCommon.dll
Size 137KB
SHA256 c4b6c7cbc4253221231016e54e2c0427559dc53e232550116bcb96d865596076
MD5 7f8d673df4c86297a81a2224b69b2fb6
SHA1 10bacdf6055acc77a3dc693e08b799de7eedde62
SHA512 e23d75c3369297e22d616433c671ef8fd26e2910fe73ccdd466829587e3859419aafdeb13ee76535be0932f9bf092c43027e1839a7eb1b54c8f05a01548e49c1
SSDEEP 1536:aZVpB8ZhVgLi6nJbLV+iUxTwIGx62jJxMBOegmDncE7bu9:YB8ZhGLi0JbLkiUSIGH4DncE+9
TLSH
T1FAD35CBAE69D9D67F724C3BCD9045875312A64F7EFC18280D290BB1F29311C60C5EAE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QMStuck.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMStuck.dll
Size 108KB
SHA256 e911344d2b1f8fe457afc9b963fae97919f2793bbd743a67385930e49f00cbb2
MD5 136a7d683c29cd4bdb58c84d08516d49
SHA1 0f6217acebc67938f3da19a51dc13c0da63796d2
SHA512 b5ba59cfc39c480fb5eec6869e0b68e573ddcccb9bbf109d9c29155612507d9cc9815b10f6b7e83db165cf3f30266f8b39900e23456a02c4eb82cf84fa1e18ca
SSDEEP 3072:TZpZeLCMhJVnl0lo2XEF93Ttpivb6DT8UT/KX:6CMhzqo2oHDTlr2
TLSH
T144B33A207E99E135E9AD82B91CB97B77817BA9348FF244C77B041FA959206C23E30717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QMStuck.ini

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMStuck.ini
Size 694B
SHA256 cecfe49dca215a249f6ada2847aca5f7c64449d75cb03f6faadb932251ee0c7c
MD5 24b4fefc7f9494effacc66127f18b943
SHA1 bd7a60d461146a6fdc8a16769a9b3d17e3506322
SHA512 95770891b60e7f092ac74906db1dc14f67079b25c825d56ec6c86ddd1525033d3473560793a26d8291b98a68f56a10aafbf4e8379d45c95be73055eae6be81a6
TLSH
T18F01109F6802C547A025FF72CADC02BC36F2E94DC0AA0B9AB5A25C088567115C042D35
MD5 SHA1 SHA512 TLSH

Submit Download

QMTray.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QMTray.dll
Size 6.9MB
SHA256 6554404e738dbc29051c8ced4c3af56670cc0ae209dee0c72d7149b8e2f16401
MD5 4c93f832137b2209803d26d044c8c84c
SHA1 d8f847fb8695d17d5c730e69be92997dc635dd87
SHA512 7945b5da9a68f09990174669aec00b64f77ff6904cd01076e7f4105068bf4349e8909e7bb43811623e1dac3fed24276196e9c75982181916d817b007448a1207
SSDEEP 98304:B6eiUmeaun1G9hP8Ax7rlfBB5zTJEo3VvSUUk3UMpCAsvPgKUrUBn9yXH1B1PLXd:B660C1G9hpZfMIE41vieH71DBII
TLSH
T11576E022375DC036E6EE52B15D79EBAA842DBC314BB441CBB2C87B5E54315C22B31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QQPCMgr.exe

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCMgr.exe
Size 103KB
SHA256 a445b26e8214f873aa989eaec46104d5119e8b16b223b412c6cea9d96611e241
MD5 bc38709001835e4bf8de305512c74236
SHA1 fa6cec9aeb2fff4bceddf0b7cd34d2b6784e7984
SHA512 98b1c563fc581104fff77da70a06edda9b73deaad5d8b16ead8e091014cb9a9b2cf370f297d0978955c57e32b40e4d5afc23de437ab4f17ebbca6243861ba378
SSDEEP 1536:zHsFS6iOuPqk7GPCt+ck1y5ZIgDmVcaMde2qSOSy7Ex:zHsFN0ick17gDmHMMKOSywx
TLSH
T166A30B9DB54ACCEBFD61B3F0986465BD01EEAA283B547BCB5280E6C935391C10D2853F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QQPCRTP.exe

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCRTP.exe
Size 609KB
SHA256 cf2d9f56163aef1594682e70f0a182eb280a4eb108f962a8c01413369b3f6156
MD5 c1e99d62b347e7acc58cc00402c3ed4b
SHA1 4134c0deccee8db2d4e7e08e7334b8ed40203e45
SHA512 6835fe837fe4003df68ce37af785736ad48d3ea9596d83c6d8f61302a91afde2605c8cc0b49e154aa1cc45c6df6f342bea70a4c52478b143f45908a4544b30e1
SSDEEP 12288:DqBThBVpi3oboD4Z6f+ueuDuOO+2OOm+e2eeOZ88dh2deu++u+7RPDhke/+hSdFE:mBVB7i3RD4jqe/ASnE
TLSH
T11FD44A21379D8933F6B22235ADA5F796B47ABDB00FA582CB7380695C09709C09937737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QQPCSoftCmd.exe

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCSoftCmd.exe
Size 635KB
SHA256 665a06fc17e5a2a1ed7e5f52a838872b9e7f4e458f5abed943dd8c0b1266f7de
MD5 08e02d4151bbe92e74474c4be69a668a
SHA1 35f71f5b7f80d612fb7e6e4a130238dfda8fe8d2
SHA512 abbb8ccd3e478a31c1f2d247a213254bd1591c11c6a2757116c564c9aa8abb43852643e482ebd6834ef0e8d4c7372df07232accb3035c8cb6bcb0a91609987f7
SSDEEP 12288:NzuzJikykAmw/izRJg1IKSY6/tmHsdFojX+W7x7KHsXA7zcE1ozoxux:NqzJEkAmw/izRJg4BIHsdFojX+yeDzcv
TLSH
T1C0D45B213BAAC535E67252F15D389B66817DFC301F7285CB63846F2E98604D26F36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QQPCSoftMgr.exe

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCSoftMgr.exe
Size 131KB
SHA256 e23d29da58a7774d7539b57755c247742add6b9ba3085d0ad0c9c62be942e90b
MD5 9d843a99c13249624e2b52ed8715ef81
SHA1 d23a3967e49a44c3e3312000a207964259981497
SHA512 919d63cc463e2a0ef488cb367073b2d26542e64cb9e5f1064c0cc5644bb3862b374948d7cf661fee19f937d833b7b44bb5a20b617c1d07587107aa46f8d6efa5
SSDEEP 1536:OiEg/O0EX1JbQD0xhMNsrhEQo5Hteopd17B24:O5rJbrXMNQeBNeq1tP
TLSH
T137D3D57A75A3847DEC6385F67E658C3CA47FBC30369382B1F141BA099B362546DD22E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QQPCTray.exe

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QQPCTray.exe
Size 190KB
SHA256 003256ef6cfad9a8747eec0ea0e8f64e33a9fb19ec4310e37a2210b9767cbd21
MD5 2b8a54d63a5c67e6d9586989e83b5d5d
SHA1 888187af9e1ac88b6f175738d99e3aa69c8f4c54
SHA512 1ffe34d4fa095596097f57a468126dd4c0e3a8f63784fa36938207d497b2d05b2230285e1cbdf5c801b96f5cd55b630bdb8e731d7a14fbab89a7ba0576420dec
SSDEEP 3072:4oNkOn+eckdD5d492rZf5vp2BV3Y7m0ci5DEc6hHoYSk:9zn+epim5vp2BV3Y7m078ck
TLSH
T1C7147FC0265E6A23F3B6353D0F29FFED45786D1047C096AB3D962A1A1971DE32C2325E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\Qt5Core.dll
Size 5.2MB
SHA256 e3d25891fe6f8d3828cc8daa236586661f859e37501b9f9321ac8aa910c1a0cc
MD5 3602e6f453bd078aa6af1aa85f31e958
SHA1 ae9b68a96ace71d3d8f59ea1b7f7785d48a4b233
SHA512 b29c0d5b934d5f330558a30df66e17cb4e194d384bb3c67f759f60dfed28d4f624d066c3ffa0f07a4754a95bc36c2baade3ee3be7c48d6ecdaf09dd7eb864543
SSDEEP 98304:Hd7VDg9q56qmlpYNJsv6tWKFdu9CXvxVlB:H5VDFJsv6tWKFdu9CXrlB
TLSH
T15D469EE27667C23AE9A68230897AE76F0535EC014F1285C7935C771949B1AF13F3B60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QMNetworkMgr64.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\Qt64\QMNetworkMgr64.dll
Size 576KB
SHA256 77ebd51b70ee3a1aa2e826a6bdd7bb8df595ecf663dc0314d30411c92e47d134
MD5 2a95f120874c4b04a62176efce528719
SHA1 72d3e73f895af848338e59e70ff725b8d1e6b044
SHA512 31849b18aedce5732294d6f7801c8565015344fe70c5ea525ef760c9e876e9127c48ff8693f3f44ae03affcda3d71c89148b40c2ce800aaf3048e3bb8d54a692
SSDEEP 12288:pRK5GrCIJ6ctlHHWfksX96hhy/PWYgeWYg955/155/RmYEedWDLE:LaIoct1BsN6S/e7EwW/E
TLSH
T194C48C1667AA03B9E07B9134DAEB9A13F6727C560791EACF03A0565A0F737D04B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtLottie.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\QtLottie.dll
Size 110KB
SHA256 8711421d2e86f492dd2d18ccee9f542fc73d6abf45d83da29f33533e6e13c7fd
MD5 1fb1fe0c5e5eabb9341f142d1b0de25c
SHA1 21088feeb37431f215f12ed18d2de3db4f37d3b7
SHA512 503f6fe2adafa17f8aa4adc297b4db56b154c26009f5129368f5e05ada56e601368f0a6dcc9b130862f263529c47a91dccd2c00ddd8fb40bd316f0f7d0554205
SSDEEP 3072:TrmMoZLTLn978oh4MD1V/Hr3swMHzDDdu6V1DF:XmMoJn978oh4MD1V/Hr3swMHzDDdu6jx
TLSH
T197B37DB13A1A0056D5BA92719C69939B9139B8544FD243D3E71F7E9E1C302D23EFB207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RefuseInject.dat

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\RefuseInject.dat
Size 10KB
SHA256 09da7c56690bb382f8a0a79b746c0aa74325bdf3d2469e23312d7e8c002d876e
MD5 9e0b9802c5f0cbce06653283afd9b091
SHA1 7518e6b12784a50cf3034ed8933c0c4d4bd7075d
SHA512 d622f4cf5c0aefaa90cde7a3113d851d4d7f4ebf8b9d868465bf45c73d755792849334ad126d4ea0038619ea176ff574f35826fdf079f75162ff3aa63f92c008
SSDEEP 192:jkHwAORDcGoZxeSazA+Fc0ZQOs9DPaLiYQM46vY5O3M9P2QRlrUS52:jkHwAriUSZQXtaLiYQ+EO89PXr32
TLSH
T15A22AF96F58ADD84A7C8B312DEE1CF8CBD776805DAA3C7A70A981E328810754D24FD1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RefuseInject.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\RefuseInject.dll
Size 330KB
SHA256 002220343d57ad1566823be68d5c6a5b137a0d42a49a4a71d9fa0ca02411ff3e
MD5 d64c25abbc53c090af7dda1ceb88abb9
SHA1 18a904652454d978129c91c40b36799acd334349
SHA512 81781cb882948123c15394ba116e3e162e848858cb674bd32ac153fe3749c7ee4d39e74a09cc5084e036a995f0e9cd76a846ed93469fe6527df71f0c759da240
SSDEEP 6144:v/sDEBNGv9meJZYUKso5+ETpUXH9FnPywYgR:Nev+CoFVUaw1R
TLSH
T19A743B213A958036DAFA0675A9FE875BA17D79245F31C8CFA3C45F4D09216C36E30B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Common.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\SoftMgr\Common.dll
Size 3.6MB
SHA256 d23f1fd3033dd2d3a0a994ba712a455961a286b3e8bdc032f26b971ad01755c4
MD5 5d2e620748bf5ae31ad2d0a73866c82a
SHA1 3685390319f2ef5fbebbc292047291707743f0ca
SHA512 34db304b64a8a581e28fab990b6b0d59615fea719c0637d86040759cd16d2fc5b91d0b06eac34c81993ab378edc8f0fafbc703f007a08bb1d1d646a2abf3b25e
SSDEEP 49152:VrGdyNw3MevCkUAe+XvX5lhXE9rrhaikHjiWydZU2QDQk6BMeQ0rI2wzBTRBA+hG:VCdCw3MeoAeCXKRaiJsehreO
TLSH
T18D066C217691C039D2A74372ED2AE6AD4779B5795FF182EB33D822CD29309C27A35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

beacon_sdk64.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\SoftMgr\beacon_sdk64.dll
Size 1.9MB
SHA256 7432bffc9958e8dbc39ee48bc821f445858a082862a9f767b75f562f72b0ad96
MD5 eb54d31a296005db34166dd964ad3bd5
SHA1 f9146f44ea8ec336beee19438789db023fec3f32
SHA512 de41957241e2d4e52641a6a8e31451278e5a2659d2c7ae6dbadd816fec156e6b4ffd104529419ed52baa611f36a0b88e9fb0662c6dae76ab834e494111b74cb4
SSDEEP 49152:JWbQIPt9ZAgDWRy+Guomec1MWrPVQP36ToA7:AVwz
TLSH
T1AB958E47A3A800F9C6ABD27CC6475A0BEBB1B40517619BDF13A48A7A1F13BE1177E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SysOpt.ini

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\SysOpt.ini
Size 18B
SHA256 5fc49781c790e0af996ad15a2f91ff53e7ce82ac7e431fddc45475e68aa14f15
MD5 b433f0cd8ec11ca0d6939fd6402dfc29
SHA1 d30cbf3824ff8b761655e57d8f9dd950e2d5eac3
SHA512 59a4ae941fc73f2b37550ff60fe4a6b1cc58a5520cf73e9490156ea20667904ce7bb028915f67890a18703788850a934086ef1b7ba2d87b5454c09bff4952d12
MD5 SHA1 SHA512

Submit Download

concrt140.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\WeChatOCR_1.0.1.28\concrt140.dll
Size 237KB
SHA256 290f577461b2d4197db0b7d09341225c90cf066984f965e54c9fa4aa16ba6687
MD5 ec5a86b5e7bdffd50e022e431287273a
SHA1 f8ca0cd2955ee86c2f8ae2e9f1514071dba314fb
SHA512 d712c835da99cbc98bbb031301ebc339103df25ab651dbe6c0b4bb90e2646ef43680a93834f1846d84969e7e7d66ce7df91f3381c6a570fa723f02d704f3b262
SSDEEP 6144:ESM2yFExAZvA2LwG/LTEcDDsLIdKd3uNqW82Cfpu9vVQlSdu6bpIo12z/NpJ9YO:z1PfI4AqW82WEtu6bpI5zN
TLSH
T196346EA1344044F7F77B03328428E7B995BEE68027EB85D71F6CA65A1E346C1EA33593
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\WeChatOCR_1.0.1.28\msvcp140.dll
Size 426KB
SHA256 4190f0a1306257ced4975448794e1d42be312e334ffccfb4910a4a39cde9df57
MD5 0a0042fe544c91cd57bc2f7ef40bb974
SHA1 8bf31f44ba3e47b8b186c3d8cc219a4d2f67da63
SHA512 c4c56c06cd40213ebdcead6a256510b44beefc3a18d7f84efebcd05bac7bb1b942f97b7f7798420ca8ff0c1592f32301d751554fb63125b4703feadfced2f6be
SSDEEP 12288:/gc0BGzePo6+J+4P0xYv7IQgVhUgiW6QR7t5s03Ooc8dHkC2espkWK:R01Po6+J+dxYv7IQgy03Ooc8dHkC2egD
TLSH
T116943932BB464DF1E48913B971C9472193F9FC610362E3C397DAF12A2F566C6A633A50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\WeChatOCR_1.0.1.28\msvcp140_1.dll
Size 20KB
SHA256 f92ec09eb6b666e42cd52ef912f298fb79c264ef3272735f69f99684b88585df
MD5 4b30f6c86cf6932f2297ffc5e64d2bfb
SHA1 e16f032af4d319002a0db8514d97c1ca23fef42f
SHA512 9c1cca4ec49e40a955284be42bf38a3a9a1264aa04d69fc2bbfc6cb9ef2c32bf99b496740629b283eaa944d8b8166ce755443656640f5c65f98924940d295588
SSDEEP 384:Zv2tlmpNhYQjEy3d5Wc45gW8414gHRN74qJ/AlGskCu:Z+cgtyIP4K/x8u
TLSH
T1EBA23C82FF644963E99E183051B9E5536D78ABD01FE052D72B92F31E0CD67C2EE30919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_codecvt_ids.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\WeChatOCR_1.0.1.28\msvcp140_codecvt_ids.dll
Size 18KB
SHA256 e5fb7a7cf24a854463d6a00b2aebd50e4acef58d2c1535246069ff3f4a1dd027
MD5 4d24e093ee8fb09955109923b8951a7c
SHA1 e09b5cee8a7ee36a0cf0fc7a17859ec60799f03e
SHA512 2dd1403db4a1c47fba7ab0271d88d33bfaa8ab5c0f4e5e054596dea042c6fe74095b92ad4f2f78b98d5fa5713061321f8e38c1e2196702e89fd04691c15f5f9c
SSDEEP 384:NZDSdV3lIjIjG2dhWiyEW4O14gHRN7WuNzhKlROWt:NZc32jPZx7A
TLSH
T18C823BC2EB280887FDA71D7052E4E853AE3CBBD51D6091171B96F6181C97BC2FE24629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\WeChatOCR_1.0.1.28\ucrtbase.dll
Size 900KB
SHA256 1ff49fa3db1b3aa78459544594f72f7aebf2ba285476c2c8a064bd887ea7f565
MD5 d0d8cf4e5302fdef07168d7ce184de5d
SHA1 872b72e0910a3d5f142e85c309ed4295a8cbd95f
SHA512 a7569fcc47526da6532d97244172596e8d3900f2cc142709c0bb95ec2447dab5411ae0cc9bbf430470b6734781c5bc748857f5ff56d8a82980e93a40a5a86a09
SSDEEP 24576:+0qW/eQNMe7KtlQzn4pz+xJlEInEFmcvIZPoy4z1k0:X/eoF54prB
TLSH
T112156A617885C161CCFA61F81AAEF232057EB5944F70A8C337D40FFEE5651E02A3B65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\WeChatOCR_1.0.1.28\vcruntime140.dll
Size 74KB
SHA256 44de8d0dc9994bff357344c44f12e8bfff8150442f7ca313298b98e6c23a588e
MD5 afa8fb684eded0d4ca6aa03aebea446f
SHA1 98bbb8543d4b3fbecebb952037adb0f9869a63a5
SHA512 6669eec07269002c881467d4f4af82e5510928ea32ce79a7b1f51a71ba9567e8d99605c5bc86f940a7b70231d70638aeb2f6c2397ef197bd4c28f5e9fad40312
SSDEEP 1536:L2HuqvERNjBwySXtVaSvrgOFw9RxKMniecbCerlLi:L2HZMRNjKySdLcOiHiecbCerhi
TLSH
T1BD739E4278C082B2D56E4A79057AF612673DAA200FD15FDB7FD85988AF75AC0EF31213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

beacon_sdk.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\beacon_sdk.dll
Size 1.5MB
SHA256 21c91f9769bcc05fd6e8dbd4e593499d1c5da7fdbbdb94322cda2f2c9b43d721
MD5 58b99717bab6d4b110e9eaf4c7a4aa2d
SHA1 eefa13357ee9d2063e5ac1771c134a5c7346469c
SHA512 75ec77a16e85987d0874a1464f9db11f08958cc3c115b2b96c41cfb8fe683d91fb24c95818e68d7acd8be3a6b09a01eb03723d505439fae9ffc6b5d644a7a84e
SSDEEP 49152:P+B+5/eTCkEn7z/PdsouRwnYq0p+DYRqWWTBnDx:NhoEbYqa+DYR6
TLSH
T1CE75AF237985C0B2E9CE02B162BA9BBA8D3DA525072954D3D7D42CA59D301E3373E71F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bugreport.exe

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\bugreport.exe
Size 708KB
SHA256 e01aac9e43a46c3be91fc0880bc74063a972962c2b9b7c5dc1fde6445f833ab6
MD5 8ab26889ecc5713c1b6b2826d3a7ce4f
SHA1 6d45b706db8badc482f881001f64390ce42222e4
SHA512 a20002cfa47b54fe8750bb6272ac40862af603b7748d10d8bf48771556ef02156fb168dd34565ef8649ef1577056b79aa4873a9c9d363ea844cba401b6b918e7
SSDEEP 12288:52BgMy9rRVmJarZhwQpg6/rKVOKVVdqMaQeo:rvwQK6TKVOKVTqMaQeo
TLSH
T1BCF45A727B5BE031E96144F06B7CAA7EB569FE241F2649D763C83B291D788C10A30F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dr.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\dr.dll
Size 328KB
SHA256 bc7543057edd9cf440909b2358c7f509a07d806a2a30f7e965129f4512d97250
MD5 ee339e1280d7f8ff5b370399f7df53f1
SHA1 796558080cdc116c3c814547123257ec63f4a462
SHA512 34f1d542b8a0c58a4a51723f314c45062cdffe8fd226676a4077fe4d12d27ee6a340b7a2df20218a3212d56169eda4c843de24d1ca45e291b658bae9a1f09343
SSDEEP 6144:C7aJbTlbVzoQ4Rnq0nBecKpU4U+ALn8poWlW5Da+WzmZaW8yO:RbTlbVzoQ4Rnq0n8cKpU4ALn89kDa1nr
TLSH
T1D2643A70F766B432E0A709F66C7DA99A713EBE340B6596CFA3D8321D15714C08B30B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libprotobuf_dll64.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\libprotobuf_dll64.dll
Size 2.8MB
SHA256 3568380bdfa8e46327673e104f1116086d261552ebb4a216fb840bf355dacac9
MD5 2b959731970696076d53af4424a718c4
SHA1 2696a9ac8576d5b66d58c38800c7e8bc85efda35
SHA512 63555f21795eb4c05a05b41d521769a5a8452d46cd07b8bff00fba37035ce7633dc2f16e42381903b5ebb16ca794d464d5f8de45cce73e4b43bf0581e829ec6e
SSDEEP 49152:UIhf20yFeijPBpfKVmu8LOJccPth/dPJey0Ib2ouh2zLVJ2jazcIJxWciolStc5q:lZw5OUdwm+uMm
TLSH
T130D51913728E42EBD0A7D27C8986470AD7F5380187829BCF01B59A061A676D6CF7F7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_2.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\msvcp140_2.dll
Size 162KB
SHA256 8aa3ddacd2b2cf998e5b641dda4bfed07f689849521a6794e0db4f9354d3edb5
MD5 3a28743d8c814cf347398ea2544a298f
SHA1 2530dd3f6ce41942e592f926dd30a08d8de3ad81
SHA512 238ed143f46c272377df78e7a1e33a7239bef7013ecab37e3ce93fd24c640ec62648bbd7ff01be05c147aa9576a0baa4e5a0ab978f151ecafb1c33f4eec308bb
SSDEEP 3072:8ZQg1ocb42/lCmyPieky8DbRhn0WoGgvQHwRvf567d3WoeiBGnO1O8O:8Zac8myP/u0h9f56JmpiAO08O
TLSH
T1FDF36CC3A92880A6D09F097FB4105B2F642DFD921BBE46DF2795410BDE38ED38DB2945
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_atomic_wait.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\msvcp140_atomic_wait.dll
Size 50KB
SHA256 bb2981af3a123a95822a55c0bd3c470ba6ed6c0151ffad09717583fc6abfcba0
MD5 792b0131510130442bb66c3a7d12ae90
SHA1 62ddb095d7e07020a69ed5ed704778a92b0be976
SHA512 38de9c71d9e95aa1b2ee31972c8a273afefd2f124de0ce3e6f247b123077db4a374aa32ca9f8b786fea4910119c71f1831af5f4c0273ea93b5e860afdce7e0e3
SSDEEP 384:Aj1lTFwTSloNYcSNXR5cHDIABta/FWFvug0yiT3UN9imfI/NVW0jdTq0Fzenw3GL:mLVT9kNWNLTJwwWDpQJYp0cM8Atu
TLSH
T122334A91EF2441BBDDEE12301526EE2BD97D6AD01FE05AFB1F136B480D927D1A93011A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QQPCCommonMgr.rdb

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\plugins\QMNetMon\QQPCCommonMgr.rdb
Size 9.0MB
SHA256 0a835864e970a207f823df78170cabebf2b2ff4382133132a8b3ab45ef464bf2
MD5 34566e4ef0e363a547bc7bb3ad70252a
SHA1 ad3558994db5f2fa0a0ad91c748e8dc5f99b89e9
SHA512 2e6ef45ffc2fd8a9fa16aead266484effc8576bc1561f32aa7296ba3dd3713c1089fb3d1c1f75a43b44e039891f21442ffb240754ec18fd968fc4c93813232bc
SSDEEP 24576:PbfAazV/brfZWZOk2kECnRk34xaXmjkhZQwJ5nRl:PjpbrfZWZTwPBznRl
TLSH
T1E2A642D947A101EDFE582BE0CA8330E44FC48D557EC205AECEB97D25A7B899E2701E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\plugins\QMNetMon\sqlite.dll
Size 351KB
SHA256 9e314ca7169b0401b0dfc3b07947e5048d302a847664cefba45dea26137f06f4
MD5 73d642b9ea4a6919ce309c658bb5a9e8
SHA1 3ac94c1d5cd86edcda4ebeacde2583483ce9e056
SHA512 292fe674f0ea2e91cd118f398802cb7bc7415fa825e449d7ac1c1026bcb614521ee94c55ad3a9ba2720848d982c00d701b68a6470fb90d8f2b6ec0a2327abc1c
SSDEEP 6144:h2+/FrLtXGoZpgo0R45NUu5m0nR7HfZPrsjC8CXQgksEnYUGOjBoyU9P41tMLSn5:h2+VLal2E0nZRcmEnYOU141t3dwhO+7a
TLSH
T15874BE23D5928037E46310B0525A5E629DFDF6301AB594E7DFE42C899DB04E2A73F393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xGraphic32.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\plugins\QMNetMon\xGraphic32.dll
Size 531KB
SHA256 e782ec69bfbe96cf90852cc49c6417a8eb2257010989511d565d770f7be6239f
MD5 1173208a355034c9d257a352b3db8571
SHA1 3297451248673e1fdecc0a34c567f9ed77cdae75
SHA512 b9f2fcb8b62430ed0e7a9b25e7244979eade7cc700a622f2be012d4f5f1a31f7732ab9c649ded684f8a260500e0feda222c4ec79b18318b5d008c062d898a1fc
SSDEEP 12288:NjwONta6lxr5IlFNxII7x0f2QDDLRITDc5fGA3oxT:Tpzr5IlbxX7x0f2QDDLRBGT
TLSH
T180C46C93C6F3F1D3E0A61DB2937AEAFAA911776541268794CFC00F1DA0783B6A5105B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libprotobuf_dll.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\plugins\SystemAidBox\libprotobuf_dll.dll
Size 2.5MB
SHA256 b29fff0aca3a2025358180a9bb33eeafc2e602bcdf76819c0c0fb12d95057b9a
MD5 5c5c68a7219617e8143eb23efc68d417
SHA1 ef1d8f0fa65431a9ac73d03f7e4e839505741c14
SHA512 6e3fd832e009d0c84e0e60571f05f12a148c76443a09a8da19ace67557bc0265546d0ac6a205e258f2e8c8fe8c87bbd3768b03c2e70215a4898c9a5bba22c474
SSDEEP 49152:qxqgCFez7R60kypspArpvDzi55XJ0dK1kgVTBfgWVIsCQnBZlStc5IEkZV+CBVS9:iqgCCZaszYm+uMJ
TLSH
T153C52932B68BC277E187C2B14CAC571D83AC59048BA547DB52E8AE0A15711C3DF377BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qmudisk64_ev.sys

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\qmudisk64_ev.sys
Size 238KB
SHA256 a1dde9cb69e1202dcb81335fbc14e0cc789d91215e31836e90b144570a983af8
MD5 01403ead1c04879ec74f05a582551353
SHA1 ae27a450136fa72da5cfd1401127c2a760a4db3e
SHA512 d2d4daf12da5aee793ad0507a5465a5f4abe50b8984d546b6ba64fbe90630f43e6a01a28cba773fa6c0c6a1ee9dde6920b8c54456b37f2b487ecfe3a75bca823
SSDEEP 3072:VNZUf/93xOIudVDoomsSeNJlTSyuY4avW4sGO+6cMYd+CEqr0uzpQ/u+AYxl3ZZl:Of/9BOZdyomTeROYKGFYurWJz
TLSH
T1E4346B26E3F61489EAB7C6788956D223FAB378088321C6DB4654C7595F13BF0FA39311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcamp140.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\vcamp140.dll
Size 390KB
SHA256 aaa4364b8fd322f8878d91f8b76319ed71357e2a7e91d0f732d7857d067ceb2d
MD5 f89482c2c8a495993e2117d5d1bdf442
SHA1 fbda41c9a499f9d82e1cf69d06e4c6e16895f0f3
SHA512 121f882af64fd67afa86d0ac1b6b172b1dc9720078a0f6744a5c778911f22e4dd50b0c9d5509307c393dcc1131b3b5eff6d088da8d4c12d309b3facdc46a334a
SSDEEP 6144:sJDx2SAIFYoVXPxZqPzgb4CxEy4BtHYuqiUOA6u6M01kGcWEi:A2NABVf/N1cBNYuQOxu6nHh
TLSH
T132845A21F951C83BD26F0332381DD5EE60A5B6505FB1C1D37BAC972E1EBA9C29630D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vccorlib140.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\vccorlib140.dll
Size 261KB
SHA256 517bd079e0108d150b6f3b42afcc578fc5ca690ee8dd0f638e23eb0df07af8a3
MD5 56c2c3a73f528f95a1b70f68d3704518
SHA1 40d1c3cb0a3d9a35ec580540ea6bae39fa6b8261
SHA512 5bbac3d08a1db6dd249c12b65dc49423ee6d12091d058d608b1eb193c7d11b0ba35c591041b721b35f9fe2cfe40eafd7c4cc17f06509d11dc615a9c34d7a17ee
SSDEEP 3072:c9WZnG3vxHdmJOHpxyBIBaQ0I/Iuljl1mc48MHbhwgSmiSO4:cmqTmJO/BH0IwuljKH8BgSJ4
TLSH
T1C9444A333D9C68B2D5BF5234DA849638426A74908FD1D7C76E58EBCA1DA43C09D30A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcomp140.dll

Path C:\Program Files (x86)\Tencent\QQPCMgr\18.1.30302.212\vcomp140.dll
Size 135KB
SHA256 ae780948e9ca4e6968dc72a2b32d55409b685e4326db735b0679e32512506cb3
MD5 49b855efea2ebe9e104fefa017cc9878
SHA1 29448f4b8d7678ba63a5c8e1fd3585a19bf307bb
SHA512 774429a80c04e35037a8494fdc0944f3dea22bd0610b1534847764e669025c90b1a092ca2c9d3a5f6c065fbb869682b9a5f22fa860657ce3a13934f1e9be2005
SSDEEP 3072:Uyrx4Lf0ZGQ62xfOW6Z34bL/MmPVyL/7aG5fn+EYExc:5GQ+ZaL/i/Wexc
TLSH
T10BD38D11B5C18072E4BF1D3D5F79EA621A7FB9600FF05CEB1B9540AA0A703C16B35A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dr.ini

Path C:\ProgramData\Application Data\Tencent\QQPCMgr\dr.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GuidList.db

Path C:\ProgramData\Tencent\DeskUpdate\GuidList.db
Size 221B
SHA256 1151ba6ff6e12b7db1104fea6ba30c409e9ae4cc25ab517752aa4b187217ed1c
MD5 ee999b43fb4d2eea1962e40e994caabc
SHA1 82e88d04a8c38db83609e77dc086581a123633db
SHA512 d13b5424bf954f3c8be1037d4d45a2e8efccf22a2ba41f0b8c21d97e0199648fc5274e6187da7d3c7f66d05541002c200a4259893cb752e91aa61832b2632f65
TLSH
T12ED022F2C0385B918ECF408A28F0CC28EB8923C3A217B1EE022A095700B08B4BCEE041
MD5 SHA1 SHA512 TLSH

Submit Download

DatabaseInfo.db

Path C:\ProgramData\Tencent\QQPCMgr\DatabaseInfo.db
Size 12KB
SHA256 f481a86548061fbec469f161f9f1e069a1fbdbb490775927c1c348543a861a9e
MD5 b5ebc8e133bde1042d5d1bfc86a96322
SHA1 608c872978e86e4f69e896e65230299321d644e6
SHA512 ef96b7e7db7ab8dbfb3ac62b9d809cb7e3195a91c81c1d78c02a639aa5f8b28aeae9b484799cdcf4823230cdeaf5003c0cdd317739ea06462b10d355e9fcd73a
SSDEEP 96:tTMvP11XayNgvP11iWKKalV9Zy0vi4sZy88Q2KalHKaayNPK:tAvHOvH4vi4XQ
TLSH
T1CC421260B4E67324E91671FA8FC9D16A8B1BB2A8463BC43F305E66D347C7415BB01379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QQPCMgrInstall_20260903105912.Log

Path C:\ProgramData\Tencent\QQPCMgr\QQPCMgrInstall_20260903105912.Log
Size 11KB
SHA256 69f49952faa6f433abcf28065e6b5938668dd406d2d74b6c0f7a8cb075bb854b
MD5 48c3dd6b97596d3c82fd4e9448e8c543
SHA1 c2ab8253f623d3efd9611c91ef66999207453092
SHA512 d0be92ca459508351053173550701eb46d022aacb26c77a472b21b76bef9a61bdea9e50242d38f62ad68bf59cdded68a431d408c894c7bb82a7af982e30f30d4
SSDEEP 192:GUopD2kuI+fZ3xFaBInjyRAhR3337boYXM:SpD29I+fZ3xFaBInmircp
TLSH
T14642192E2FD001A5B9B7DA13E9F744636B377E922235DD0C11C1434D0AB2B89B9527AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QMQuarantine.exe

Path C:\ProgramData\Tencent\QQPCMgr\Quarantine\QMQuarantine.exe
Size 96KB
SHA256 b88195e710a12c5dfdcbff05660717a9f514df3d4da388a11010ae5f779aca6f
MD5 1c6030885b7182de97db5d5ae86cc75e
SHA1 6b8f1ab5e4e4e1c9f9d89398bc5bb7c7b594ca0c
SHA512 829be3040d174f035f32c9a9bc4ad4e6b2cfe336233054cb761d0492db0d1902b2351534f7d073991ead40ef07a57d69d24276abf6dbfb657f75d72e04fcc60a
SSDEEP 1536:tfgLdQAQfcfymNfvpKOfQ8fezxY3s93iuaQF+26hmpcswIF7Jvz:tftffjmN3wQQ82zd3iuaCtNvz
TLSH
T107A3BF527FC86439D82209B1F9669AE5C37AFF304FD544D33340FB6EA630189A91932B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmbDatabaseInfo.db

Path C:\ProgramData\Tencent\QQPCMgr\SmbDatabaseInfo.db
Size 19KB
SHA256 da32a751dfebd8ae26b014c40c1b7e4f3e95ed2ebff7cc25cf24526f257896b7
MD5 892f7f403a028b007f4d3c75a272bb3e
SHA1 e1de0e0008ce64e294b01bc67a72ba94024ad069
SHA512 1ebff1a6a0f87025b4f93ed13c5a588df492daaaf27bc580304b41c20b8eb27f0eaed905d18774dc9b59dda749a90c475113e65009a7134eaaf02bae02d3128d
SSDEEP 96:bV2Y42Yfqu3+/E6ggH63/5NQE48CkyS5NQ6oIkHoRl:B2Y42YfqE4a/52E48Z52fIkul
TLSH
T1DE925E41B1DB3229F916B5BA8FF9D1BA875B3ACD043B812F206D264343CB409EB05779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

riskcount.DB

Path C:\ProgramData\Tencent\QQPCMgr\TAVWfsDB\riskcount.DB
Size 2KB
SHA256 7f3d45aed974a67e82416085006e7c28592d7b8da8182ebbcee77b6f2c61325b
MD5 1d1c0d0ee9fb25b9dc2e7620258a6293
SHA1 3b5187ed8ec3b48b585d3740c37c538c9c7ce4ac
SHA512 6bedef8acd60dd936a6842ca8cc3964b629b405735389933ad5491aef57af3e2521cc264935451bc055cd5819f5dd69d72aa272e49f2cdc0865537bd3a1f4d8b
TLSH
T1924158C0F2C0A216F6B52F751DE4C55B9C137A470935868E90AC992ECAF3E8496B433F
MD5 SHA1 SHA512 TLSH

Submit Download

$$a6884.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a6884.bat
Size 722B
SHA256 9a9dcfea5200fd956784ba443c059d97bc353a27dbfe3c144e7e5b0c3127028f
MD5 2d55b30a22e6fb009694f0259290d6b4
SHA1 48b1b17b1e95d864b3848fbf7c7a2a9fffec24a7
SHA512 bbaf66dd28ff6d75ddabf0b7841058605ad0bd4357cabaf8ffb71a510a3e2b204a6eb2b615a6bb18434ff34ed55afb36e9308f6f7522ea62e170d360fd434216
TLSH
T1A601849792464DE7598C912F0A72B3CFD1B3685936F03F061BA0888CB140589B2DFA93
MD5 SHA1 SHA512 TLSH

Submit Download

081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e.exe.exe
Size 1.2MB
SHA256 d6075c4305733a5a7d968e90168a36d168d23f2134ca5ccba0aede0def4dbea1
MD5 2c2f58637677d128071e981d325b8660
SHA1 6912816d03f1457d8ab32d66c7def822f7efdc32
SHA512 34897c972aa4074551854bade8cb49c3a326c11aa71fbe2b0d04520a52ddb9c0e522272ee69bc7d684b143be5c54909f558d102266637e36797b282aebf4148b
SSDEEP 24576:f/vXd0GFi/eytAEuJ7qxu3qJ9ps1Rg8ZwyBKfPuAhYt2iH/6w2pZPvpf7Qg6aE:Hfd0GFi/pAEE74fe1R3JgfLhYtvCR3X4
TLSH
T1505501253792C077D7E300318A42C7A8627B7ED169EF9D07BBD07E48CA3019EAA35E55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QQPCDownload.dll

Path C:\Users\Admin\AppData\Local\Temp\TencentDownload\~e596b82\QQPCDownload.dll
Size 1.1MB
SHA256 73a934147b27437f91517ed9ed7eb20fb54e222a1bf2047f201ac668455c0f1e
MD5 aa142942435b567595a71eb4eb402579
SHA1 790ed6f6e5016b8873ce1817bcc96024a0e768de
SHA512 e8a9d760bfac910500a56aea8e3849bc3e73c3a0065557dc1da2495d785ba58c428a168a97faebfaa638aa3e285e7141f3937156dc1d26caad1792929dba8708
SSDEEP 24576:AiJF1NnQ82Zl0BFLhwTnJKvYpJenvRv2e9ig:AiJIZl6AnmnJvSg
TLSH
T19A35B0127981C037E3FF023158A9A67711BB7DA10BBA8DCBB3D4AE2D4D306C56A35617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-console-l1-1-0.dll
Size 19KB
SHA256 8f28bbea2ac836fe993c2fccbc7920c6e0fb5cd3fba7956a85273ebe2282fb15
MD5 bcbfcd896e50e591b22e237c903fb523
SHA1 2358537e316afaca3b61ea797b58ff60c1ef99c0
SHA512 1a9812c4fe427e89254df346721cfc93ef52d5547d293a987516b43c21e7baa51ee76f6dacebe87334a67ba54b98633e603b4da21b8264240561e1801e922eeb
SSDEEP 384:ZWEhWoy36q0GftpBjX7WVjDERHRN7P7JZnlrltmA:Zwki1wDEBj1lt
TLSH
T11B9228D68EBC9543EC939DB012E8D9877C3DEBC71D20555521AAF1E928C33E1AB14A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-datetime-l1-1-0.dll
Size 18KB
SHA256 baa6eae9e3742c736327da12c0e2e586e65a0b6d667547c638fd1287886f022e
MD5 aab52e0385a66e157bb440cb5e3cd3db
SHA1 55421c5e58951921843c0944d18e22391bf05c8d
SHA512 4bdbb93d8259ee344ce6a6138cdda2fb19bef280f8aa06daa5640125754a808ee4a68302bdf1bc5a87362b886e826414c0f43643b068a7925966adb9bca0a487
SSDEEP 192:lPWEhWIWvEoOleFuDBks/nGfe4pBjSjvZ/fG8Wm78RFAII1RHnhWgN7aQW3/sVqt:tWEhWSMoq0GftpBjmwxERHRN7jlrltmh
TLSH
T134922AD6CABCD043ED935D7063B8D9477E3CABC72E2085561599F1D828C37D2AB2492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-debug-l1-1-0.dll
Size 18KB
SHA256 d9b96b975a90b0a8c08ffe6d2185b6714d75bd8fd3d8346aff4a069d44960f73
MD5 f97b671fac0baebca98059a9b099c4f9
SHA1 433f4850353d7ec03b3215d77cda5f0874e67439
SHA512 f2c8510f1b166248259781d4c910358bd89fca4d8e39b3963adfd26fa999b4991f08ca966c265ec3f9161d704844a15caf97dddc88fa2ae95cb075245e990063
SSDEEP 384:PWEhW4y36q0GftpBj2mERHRN7F7vlCADZgJ1:f8kidEBFcADZgX
TLSH
T1DF923AD1CBBC9483ED975C3063B8D9873C3CABC61D205A5504AAF5E928833D1EB2492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-errorhandling-l1-1-0.dll
Size 18KB
SHA256 c8fc616e5591d0b77c592059e2fe2cecb54b1219a72d9a92fd09f396fd340cf7
MD5 7c1f03e83bcafe58ff99b3abb9e7de43
SHA1 15e8676f12f7ec0bf102b772839cb0bf8f1b551e
SHA512 e3206b7863795f3d6251ea788caea466fea6dc89678c8623ccbde27286dcdcde9158b3132296912ff06b3bd913f91bcb2ac9f21d0654f6389adc086870e9e0bd
SSDEEP 384:9pcWEhWWy36q0GftpBj9h/1zERHRN7Nowlrltmo:9p6mki3J1zEBdlR
TLSH
T134923AD58BBC9043EC93AD7022E8E9437D3DABC71D2055591599F6E928C33D1EB24A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-file-l1-1-0.dll
Size 22KB
SHA256 c332a484a959a2241c43767f7eff8067855dfaff6ced79f03de154de99269b34
MD5 350e52ba8f75e06b370e7d7b60c97c7f
SHA1 24e81d8178a368b31e906a43ab70cd4912430dab
SHA512 31f7d32895e37aa35e89c5bdcadebb15eab87c30761c02aacac622048f05c91c2d52ded7b2225c2ef75cddcf8c58f714dbb8ebc579d0e58ff308df06c24e4411
SSDEEP 384:NPvVX3WEhWZ5q0GftpBjDOERHRN7iYlgHrIQ9:NPvVXX0ipOEBi9rIE
TLSH
T1FAA22B93C9B8E68BF88B9E3162A5D8437C3893C7082045861799E3ED3CD73C5E76895C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-file-l1-2-0.dll
Size 18KB
SHA256 ad487c96c39271db2c3340bb106fa8f3f2b401b100b3d342813c09fbfbddbd05
MD5 856be91f8f44394cf92be1af50530521
SHA1 6baebcc3dee03fa7dc17500d8540925307cb9beb
SHA512 8ae6f848c1ae7831fa012f87387e6334351545c185329d905ac9108694fab4b073487cba621154062e8fd357d65303938a47ba71b3d1047640bc30d5ca3d2ac1
SSDEEP 384:oWEhWwUMoq0GftpBjaQRk6ERHRN7ZNl28ws8h80u8i:+NairRk6EBZm8r9V8i
TLSH
T15A922AD5CEBC8083ED936C7063E8D9477D3CABC21E20955515AAF5E92CC33D1EA24A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-file-l2-1-0.dll
Size 18KB
SHA256 93b28bff2f9d64a02f8362224ca45bfe4d6bb7fa6f83403ba9adec300dc7904c
MD5 15f59e829f9f2020e9c47a10deee718c
SHA1 365522c1e3a230b19cd4d82d8f0bdc944ac8435e
SHA512 b8fbbf6403aa7db868cb2581ddabfff20c7e1912a4c41107fd91034c54020a344ce8f0fb4ca2f32f20e79486c5fe87177b2744f1ef593ddb5414d2adfd18b971
SSDEEP 384:h3WEhWY5q0GftpBjt9NERHRN7AUASl28ws8h86uR:15ixNEB9m8r9jR
TLSH
T1CE924AD1CABCD183ED939D7063E8E8477D3CA7C31920465A1599F6E82CC33D1EA2492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-handle-l1-1-0.dll
Size 18KB
SHA256 d83d3edef8ddbecf31af7437653e66adeb303947ef3da31a1280a485422e475f
MD5 b801c68f8146904adb86869f5c3477a5
SHA1 ffb860ca10040ecaf5ae4a61a9c11db3e2eeeca6
SHA512 dbb7f1fb13d313da2047bff45ec0300d7e2f66337110fae20217137b9a6784663b42c56b135a4cae21b367d7f1650a9d158a71793bfd1822e527d6310ad6dd2a
SSDEEP 384:iWEhWuy36q0GftpBjRERHRN7lyQlDUyZa:QekijEB0eUyk
TLSH
T139924AD5CE7C8083EDA79D7013A8DA837D3CABC72D1099560196F5E828833D5F728A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-heap-l1-1-0.dll
Size 19KB
SHA256 47adb171040b53b068e2dc259ebc75562dcec8811d68b7c4b0c16a797d7388ba
MD5 db5013d1a02d899314b9518da6d0b2e0
SHA1 3e1e8df8f2f4a2184a50e11da015635a5558b477
SHA512 eaeae30f1427be40614e1818c67648448c0808ace554ce1ab0441b5525673ad1dde7ab4d124858442fe9590048a3bb241b639375d3f89ef7185bd15d4cf0024f
SSDEEP 384:KlCWEhWEC2Jq0GftpBjHePERHRN7mlgHrIQQb:5hLihePEBjrIP
TLSH
T1E6924BD9CEBCC543EDA79D3063E8E9877D3CA7C61920451605A9F1EE18833D1E728A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-interlocked-l1-1-0.dll
Size 19KB
SHA256 fe8c2607e57e6779b6485ae08e658bd7b98d79147946f262d6b3699de9259d43
MD5 86e369bd8455272049bb60a53624aeee
SHA1 b7ff6dc01ab07ca32cf030697fdaf1162112adcf
SHA512 606fd78d1a39996d623f4ce431401a4c91cf2a401bce6d04371bfe3a2b0e701f04167d9f7c897c9b73813544af0a474948ce3e23e7825b273af590b86907b92d
SSDEEP 384:5lYsFGWEhWILMoq0GftpBjmCERHRN7xSelrltm:SIaijEBxS8l
TLSH
T1A29238C6CABC9043E9A75D7013E8D9837D3CABC61D1055150AAAF5EC28C77D6EB24A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-libraryloader-l1-1-0.dll
Size 19KB
SHA256 307ac04192de5a107ee66c9a4bdc16f95cede35ff39f50d811a8d5defe6e044c
MD5 f72de8f45343b9f0135f4d71a3b67fc2
SHA1 67cef9a3bc9891cf41146c25879835ad7b2defbe
SHA512 fdd8900264800117c238757abf62ed5c8883761a1895fcda4bb149534596690871ba3494523df34e4239cb45851a9db85266ff393fddbcb1e1ca3dd049c4475c
SSDEEP 384:avuBL3BWWEhW1Moq0GftpBjztm0ERHRN72tClDUyZ3u:1BL3BMPaiZhEB2OUypu
TLSH
T187924AD5CABC9183ECE74D3052A8E9437C3CA7C71D2099690599E2E82CD33D1EB14E2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-localization-l1-2-0.dll
Size 21KB
SHA256 a6d2196e5c8b17851ea134f1ac02481846f78b0075860cb6eb4f90e0243449e6
MD5 a675093b0d146773b5a2010a0adfd021
SHA1 cfb93918c25c4359788680ccc140381fab1e9358
SHA512 56ad8adf41c7ed0f04ffc371dc7d538127ae245fea8783a4b0af5e92940656e0b41a0bcb88ac263b3d2efcf8396cf196993d882ffe0d74c1094b31f47558d27c
SSDEEP 384:nOMw3zdp3bwjGjue9/0jCRrndb9WEhWZC2Jq0GftpBjHBeERHRN7nhlgHrIQx:nOMwBprwjGjue9/0jCRrndblGLiFgEBe
TLSH
T1D8A23BD5CAB8D247F89F9C30326AD9437C3CA7861C20995502E6FBA938D33D5E764A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-memory-l1-1-0.dll
Size 19KB
SHA256 01eca7b03ce90601768acb131d61875e418197234891fb71a2695aaa2f13857a
MD5 ce7d62974e002ed7736117fce3d25b38
SHA1 4225fbf9f73ffca92c18f04fb650452f80ea0fcf
SHA512 bd151a8d135b540ba573af01e6089e03a6981ef97fb1e6e3465312815787b563d7c205371f0fe06b674e1924b15fedaab239d012615e38b5192bf4d2170dd60b
SSDEEP 384:15WEhWqMoq0GftpBjdtdTTERHRN7Flp/m2O5h1JK:vgaihdPEBxcL+
TLSH
T114925AC4CEBC9443EC939C7063A8DA877C3D9BC32D60845505AAF5E928C33D6EB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-namedpipe-l1-1-0.dll
Size 18KB
SHA256 082cff6fd2437f7208af7ebd56b8961bd16761255c6f1214499e93975301b300
MD5 ebceb63468278a061ce4b95d12d723c5
SHA1 9bd01a59d1986883410f09a1fbc76876edf57332
SHA512 f20f9888441caafb4e23d41e00282fbc37593d0492aec86bf7840c9b1136d070202391b809a70854634a738611017ba85f5c354a9983687277f46032fd2cd91d
SSDEEP 384:zWEhWY5q0GftpBjRO4Z+ERHRN76l28ws8h8BuL:rNiPmEBx8r9oL
TLSH
T1E9923A95CA7CC183ED975D7053E8E9477C3CA7C71D20991611AAF5E928C33D1EA24A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-processenvironment-l1-1-0.dll
Size 19KB
SHA256 a10d248ecd4a326912a390066bac1314715ee3801332f4a9c64b5cff264883b4
MD5 66012263fdc48ac26001f3814bcabf20
SHA1 2839fca8a2eab6eef2be42d06fe903d24fbd4b7d
SHA512 5e3eab7bc734e7c2936ec061ac7702f1feda6bb772bb89e9a17b06dc722db226f9913ca4103c366be303070a879eaac4a41c8568a678347dfd170b69539f4e48
SSDEEP 384:OLWEhW3y36q0GftpBjnT1IGERHRN75T1c3lDUyZKD+j:URkih1IGEBN1cRUybj
TLSH
T178924AC5CABC9143ED975C7012ACE9937C3CA7D71D20855501A6F6E928D33E1EB28A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-processthreads-l1-1-0.dll
Size 20KB
SHA256 93bfe4c4663c0a2807f5cd3be67a8a21dc93c5b097b934c17aa3cb4c4374173c
MD5 08d5b94e8b88fc6aaaa67969b03640e2
SHA1 6bf348389a0a1ecd2a8e64a67d64433e264e0313
SHA512 58d09fbcc4e7c3ca1cb2ec2f9928629c18c0ac3603419e8ba02faa3adec33cb8285d5199785ff2049461ce04f784035c5c0d651b02f58d93e7e677fa9932b849
SSDEEP 384:bTk1JzNcKSIpWEhWbMoq0GftpBjzevERHRN7SHlrltmq5E:2cKSwZaiYvEBGl8
TLSH
T19EA229D5CABCD183F8979C7062A8E9533D3EDBC61D20452105A6F6E93DE73C2D62892C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-processthreads-l1-1-1.dll
Size 19KB
SHA256 85f410b3c539aaa2ac8b5be976af982a8765fea315671badf542c5a0c71d600d
MD5 94015263f243bf376bf138dfb1cb7b46
SHA1 3938fd323dea0686a83daba2da70060b5def2036
SHA512 20f86cab8de07309cc64aece34ffd334ae74a847afedeb48b93848381c3ff721c18270bf0515171c213b9260936960fbdab4f67c3d3211f27b7bac34808f88f1
SSDEEP 384:GDfIexWEhW7y36q0GftpBj+gCERHRN7uBlkETkDX:RehtkiPCEB9ETY
TLSH
T15C923AD5CABC9483ED975D7023A8ED473C3EEBC61D208525059AF2E929C33D1EB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-profile-l1-1-0.dll
Size 18KB
SHA256 8bfe8d485bf8e6bf91833f6cf61e5f054f6edbf5dfb2095967ab3db0759d59a6
MD5 d6f950aede59a00c9ae0affe0b63b6a4
SHA1 abd6bdf43e4f3569474a26a7763327baabf155e0
SHA512 bc37453defe631089159b0f3ae9fe9eaa43465b32aaa88dd31212d0e50da01823395e5875447c9a2e7cc2d2edada1f62c0663b8adf0ba0b72e552715fd787a9d
SSDEEP 384:FuuWEhW85q0GftpBjEAXKBERHRN751olDUyZK:nxiZeEB5AUyI
TLSH
T1438229D5CEBC8083EDE39D7053E8E9837C3CA7D72E20565605A5F5E828833D1AB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 18KB
SHA256 6c14cdc684c2dff9170de29533c521f58c3501eb8cc088de9c9b930eee048c5f
MD5 e2dc3af0989b0f05159851ee4453cebd
SHA1 ec902ec05b855388c9a7c2a336f0de30f817d49b
SHA512 66b7eed319e92b9f87677496e2194388d291a520201c9615c139821981b7615713cf90fbe2479a45610bbaf8dc30a8d5c9ce6eb57a27645f655f4d3eff340fd7
SSDEEP 192:MGVPWEhW04BvEoOleFuDBks/nGfe4pBjSfbWm78RFAII1RHnhWgN7a8WWqnajnrg:MGdWEhW8Moq0GftpBjjERHRN73lrltm/
TLSH
T1238239D5CA7C9083ED935D7063E8D9877D3CABC72D20962614A9F5E928C33D1EB2492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-string-l1-1-0.dll
Size 18KB
SHA256 a03360d7024a4aa1013cc2cca408c1343666c7dae6bff61501d0e80d44cfb759
MD5 1292ae17b93cc2f8504d025fd1b71a01
SHA1 02fd7c6e25bb418738ea393ef7003f770f8691a1
SHA512 10c0b9d8264918522eef08afa51b9d19e365d0664d7da6c6c64cf37627fa60b5603c5a47a5a4963c44922fe5d4fc3f19a549ae216e8bad9e4da3c671cbe67434
SSDEEP 384:3yMvxWEhWdGy36q0GftpBjBfERHRN7h0lp/m2O55H:3yMvhcki/EBec/
TLSH
T1D99219D5DABC9043ECA3ACB053E8E9877C3C97D7192045651199F1E928C33D5E728A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-synch-l1-1-0.dll
Size 20KB
SHA256 139736ebca31050f4ed7339a6979595755df0acce0cf97097cdfc937de8d32e1
MD5 230070639ef8c8833d67782526d9e8fc
SHA1 2ca8951ab202b8f2bf289d9ea08af74695626baf
SHA512 b8daa7c3365bc8bcf7ff76a3002d69e3c39ce0a0c052353317242ada8bad899ad034a1f079f9d75cf0dfbd6e680c2cf77dd37ce231a39217996a3bf89c6a2e47
SSDEEP 384:Pdv3V0dfpkXc0vVa3WEhWI5q0GftpBjKYCERHRN7JElgHrIQK:Pdv3VqpkXc0vVaX9iwjEBJxrIz
TLSH
T123A23B95CAF8A583F89BDD7053E9D9437C3C5BC70D20892614A5F6A93DD33D0AB2882D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-synch-l1-2-0.dll
Size 19KB
SHA256 e295a8633b5eaad0ab47707059bc5dc5da02dbea01b2d3c4bc8a19e466abddf4
MD5 e38bd734e85d06860085772a7ceac43e
SHA1 4c8c141c63462ff5400c8d961d4f05e4bba0f66f
SHA512 8c2ed8659b5e1f9bc871c8697bcf99ba9291a118586929af3cc599454c4edda88b4ccba2f0d824cb8c62c08c9966cbd5ac78f3a475425fdd4c35ada7cc8d7edf
SSDEEP 384:ctZ3gWEhWtMoq0GftpBjjNmERHRN74lgHrIQry:v/ai+EBdrIky
TLSH
T1A7923AE6CBBC9543FD939C7063E5E8877C3C9BC61A10491609AAF1E929D33D1EA14D2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-sysinfo-l1-1-0.dll
Size 19KB
SHA256 460fa4cb795fab56d0949518d1c1d76d48dd55b3f9a02b3db421e79f98a64619
MD5 f69d3b75d2becfc53a29ce3decf62fe7
SHA1 28ad9523af0b3d569f959803cdc01f1dee87cf53
SHA512 f2653f4006ccee2a2e06227e75a95c0a702a625622311f5879a3b689078bfc623606fd7e4dd051f9987c624e922980c4c3a7c4852ce8cfc98fc11aa7115e4ac0
SSDEEP 384:WgPUZWEhWZMoq0GftpBjp1ZERHRN7lNclgHrIQeaM:WgPUZ3ai71ZEB5rI4M
TLSH
T19C9228E2CEBC9142E8979D3063A8D9877D3C97C32920851905A9F6FD29D33D5EB2492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-timezone-l1-1-0.dll
Size 18KB
SHA256 cfcd287ced91a432b1b0f5f30eb4f9bf6409420b3994fb51c87b0b4ca21535b0
MD5 4dab6a8fe6c24b68fb16a3a6b58c1faf
SHA1 fc0a753b747b8d24a1e2ef0c59a43b855c35fe9b
SHA512 69a9fd4134a3e09b9f22f660d8512fa2894684d6dc692d12435a7c4f73b0edabec7427e86d83519b43a544608850085b83cfebe26ffd0ca687f6cf491a5cf902
SSDEEP 384:IWEhW25q0GftpBj+4hekERHRN7tlp/m2O55f:e7ir4kEB5cD
TLSH
T1929218D6CAB88083ED935C7053B8E9877D3CA7D72D20551A049AF6E928C33D6EB1492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-core-util-l1-1-0.dll
Size 18KB
SHA256 a6f1d195bbb68a168a07f95c273e89fe5a5eb02bac3ac76dbeb46ccd7b85ed72
MD5 1d9c2a07188ccfaf5e0f550abd56386a
SHA1 5d24d2af2096b078af3a7af67c7977fdf3d72f07
SHA512 7fa9c78527975c6e5cc42170eb02f5d706a6edc6419484fc81cf0548fc129039337b756d5bdae942f3e5b545ed540559df5c37cb287cd24ebeca95e7464ac670
SSDEEP 384:wWEhW8Moq0GftpBjfVeERHRN7MJulDUyZIE:2OaiJVeEBMJQUyv
TLSH
T1159219D6CABC8483EC935C7053E8DE437D3CABC71E2055561599F5E828833D5EB28A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-crt-conio-l1-1-0.dll
Size 19KB
SHA256 4ab9e0da1f2c4994b2f9c9debd4f543c3ab2404d13666816d7c4c74aa1ab2e2b
MD5 be3a982da0d0fd0b06d08ba4bb75e608
SHA1 ece449270ac8ee8283003a5ce3faa48ed63c0435
SHA512 acdf9ad191075d3c392a8144e0a8ab5afd4fcc5f6a647f697b305cfd70cc646663f769c9c19b04d89e3f62ab5b19109e0c79f32ee8ea52ecc0091a7597e97234
SSDEEP 384:ij0WEhWry36q0GftpBjYERHRN7Cvlp/m2O5p1:oi9kimEBCfcp
TLSH
T189924AD28ABC9543E8939E30A3F8DEC77D3D97D72D206565045AF1A828C33D6EB1492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-crt-convert-l1-1-0.dll
Size 22KB
SHA256 c580b0002cfcfaac2449085b26df4dc13fd92aac7edb580a9133f252534abbe7
MD5 c08072b6f3943d9695fff0be053b7296
SHA1 8f41ca441cc2deb670ffd7ba851956304862f5b5
SHA512 c8cf719ba70919b0dd5c0f8d3010c4c7a2e6c893a3e7f22449c8713e8ab47c65a5784550c58af4604f63806ab33d5e4fd7a518c3034628c1bf0d2c5c6c715cb2
SSDEEP 384:+uyFWEhWly36q0GftpBji0UERHRN75HzlgHrIQX:6XkieEBNErI6
TLSH
T126B20783A6E86F52E99B1B7122FDDAD72D385B82195043B48207E59C38837C1BD67C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-crt-environment-l1-1-0.dll
Size 19KB
SHA256 3c56a518dac09ff5dc34d99a97129051ddc93a1c907cca8274e8d08aa9f77e3c
MD5 e5e1a3ef0c1cf856dca6f71c239bfcde
SHA1 1d66842144767280f835811644980f72dde28edd
SHA512 d885ed122f58026df16668df16cfde5d5cb81b51b9154305c3298cb4d6b1f5241a91a65c332c8d2cbfb8b5ff4faa25d2b085cd43862ede6397aef8521347b20b
SSDEEP 384:XWEhWYMoq0GftpBju6qERHRN7yIjlp/m2O5jA:3WaisbEByKc2
TLSH
T10A923AD58ABC9443ED939D7052F8ED877D3CABC65D10852A056AF5E828C33D1EB2492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-crt-filesystem-l1-1-0.dll
Size 20KB
SHA256 e861fbd1dd21bd09bede9ef4ced4fe32c1dd5e72f9d788cd41b7314290a638c5
MD5 4265854cf7082a0effaca9913ba1b584
SHA1 68ae4cd0f36c3b45da8810c7fe802feefc528396
SHA512 64c233c4922e6bb7982d4866fa20f7542c330b4b3a565720bf3dad97829cf85997f05b9c13656fdb52b93cf889e6450b02efe5a62ce3737f3d30e047313cb19c
SSDEEP 384:Oq6nWm5CdWEhWcMoq0GftpBjHMERHRN7tlp/m2O5tkjg:v6nWm5CFGaiNMEB5cLUg
TLSH
T14EA21A978AE8A943DDA31F7162FCDB8B3F3C9BC2195146254057E1A839C33C1BF25929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-crt-heap-l1-1-0.dll
Size 19KB
SHA256 67a11355b9edc7cf9dd2e1e73ffbe00e00156926af8c93bcc1e254702b9ffa24
MD5 b811b6df1b996ecb5bc65ccb5275e3ce
SHA1 add783af63ed7453abcc0e7789bb424d1f3d5aee
SHA512 b3eb1cee930333fb257c05ef273bf963adf7ace6b3ee172b65db493eafc60e382be3d3330317cadc03e9af1a03d1ae1b68e1a8ee2e88c70d33241e44ddb5b6de
SSDEEP 384:MlWEhW45q0GftpBjEWBERHRN7zWNlp/m2O59Po:MdJi7BEBaZcjA
TLSH
T1CF924CD6CABC9483ED935D7063F8EE8B7D3DA7D66D104526005BF1E828833D1AB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-crt-locale-l1-1-0.dll
Size 19KB
SHA256 54ad6fb80f28a8cd4424424f413c8f22a1cd6a617eb759aba2f7c2e90cbdc4f8
MD5 776384baba12ee60dd9caa8fc65ac017
SHA1 648aa40d1237fe6e9c19a14d543ba9cf3e9105a4
SHA512 96fecb891ee0d951eea77a1f7f587f8bd4bf1ec152340ac005e65ca42db33cca988b32477dfb7f8f2c0852ade748f42be5017182c7a7a02b2633aee6631bb147
SSDEEP 384:TWEhWXMoq0GftpBjxLAYERHRN7lIFAlrltm5:LtaiAYEBual+
TLSH
T111923AC6CABC9443E8935D7056B8EA877D3DABC31D20495A149BF5E828C33D9AB1492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-crt-math-l1-1-0.dll
Size 29KB
SHA256 101427a9f932d4160b3c9be04065d495576ab40a8109d9117a4d33f8b542a30d
MD5 c45a47b83a34843225ecd6dda2114af4
SHA1 3c89bfd1fc20c1dd68fc2aa3eef98b97007d73fe
SHA512 173817ab46a55576ea4e3b540e61d69200335389a9f3366f17b36e6d0ae9963f4b0fef8e62e7dd0776ef3d23f3284b3b5ef9e505d2b67b77f41ae39451b51583
SSDEEP 384:t47isbM4Oe5grykfIgTmLKWEhWd5q0GftpBj81MdERHRN7ZtlgHrIQu:C1Mq5grxfInooidEBErID
TLSH
T1EAD2C68789ECBF63E4CB0B7312F4CBCA6A385BA155E065B5C897A1D834927C43E57908
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-crt-multibyte-l1-1-0.dll
Size 26KB
SHA256 f42cfc5cf9682e31404f262d9954f7e4ba6de35a510ea7d7683097663840cb45
MD5 94d26026d6b10f2cea7b6125813471ba
SHA1 c4463518bbdf7d9019c822cf365455c562661632
SHA512 2de164f89b22c539e2927c266bd2e8c21a0af2dfff338d8dda26e3108318338a296061a72c528d96e75c893867e65144174921bbf4464be32a6ff11cf29fac1c
SSDEEP 384:py+Kr6aLPmIHJI6/CpG3t2G3t4odXLZWEhWTMoq0GftpBjmoqERHRN7Xlrltm4:pZKrZPmIHJI6rtaigEBplz
TLSH
T145C2B46B8EB82A12D58FC7F3B5F6C7C63A384F8115C07375A16795883842BE9BD52D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-crt-private-l1-1-0.dll
Size 72KB
SHA256 705e20df0cf4de0299072b7294ed57302b26ecb76d409ed7ecf2f2fea3d59947
MD5 d7d5dc0cc105ea8cf525862b4567637f
SHA1 fb651705e958a9f2a436013e567624f18eba85f5
SHA512 515472b9604ce7f05ce70f9b3c2b0b84930de956534fb8360cd6d107577adee47e8e85d99bbe4cc143f1a8ce6605f4261f4c85fd445b7e89de3f28c28d42a41a
SSDEEP 1536:ct2b2De5c4bFX2Jy2cvxXWpD9d3334BkZnkPCwaKEBudw:cw2De5c4bFX2Jy2cvxXWpD9d3334BkZ5
TLSH
T1397329DB89E53F22E58FF7B367FB57C91B243A4418806170E9C795AB34853A9BC53A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-crt-process-l1-1-0.dll
Size 19KB
SHA256 5ab5fc3ba961a43d6d100933178121a7d8486b936f5ebc5e276e739f2e1da5b9
MD5 0b21712051d25cc0666f5e6d41b64bb8
SHA1 1d37f8f1facaf3205582608a9de3c3d212ecde0a
SHA512 3605f4902e08c901056071af76e09abf6e95572d69b6b0790f36be1dde7b79c3171df7fec229d51cd508abb0768200c195feb8f424e524c981242b43d80fca11
SSDEEP 384:jK0WEhW7y36q0GftpBjbrVeCERHRN7HG1lp/m2O5Amc:3BkizlEBHucJc
TLSH
T1BE924ADBCBBC9943E9A39D3042F8DA877E3ED7C32C109525445BF0D928833D5AB24928
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-crt-runtime-l1-1-0.dll
Size 23KB
SHA256 d92e0f00c59425e74ed419c158414e2c1e34047d10072dcb9215a5c91b4050e0
MD5 fb2dc78b138f3fe4b7e5b3a3cf9760e4
SHA1 e9a82189ba821544bd63f5af6d78e757dce9a8cb
SHA512 1c0760a0dc6772b090fac8990d3a218f7c1c85d006e901896fcf09d2df34f6220e8101866ae627c9446d2169913b948d4724ff07af4b75cc3513a5dfaf9c9bd0
SSDEEP 384:3b7hrKwWEhWVy36q0GftpBjVERHRN70lCADZgJ1hd:3bNrK27kiXEBtADZgDL
TLSH
T1FEB229838AFC6E53E9876F7222F8DBC72E3997861A1095358457F0E934C33C1BE1A519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-crt-stdio-l1-1-0.dll
Size 24KB
SHA256 4ba617cadc3806532eecd00957b2329ea8472224891228b99da3aacb002b75e9
MD5 125c4539da3d6aee3a2942bced7f06a3
SHA1 7dcb0f9091831e017af66a7a21cc80e71ad8b804
SHA512 bd506a780ea711117b159ccfd167c995861964553f9091fbe386062d1b9bb75d79db8001601130973c57ed26de9bf2b666f61f0e4a247086ec8942e03beb5ff6
SSDEEP 384:HUFVhLWEhWMMoq0GftpBjeCJERHRN7dqlDUyZSIi:0l2ai1JEB+UyE
TLSH
T192B2188789EC6E42D6878B3366F9FBDB6A388783281075798007F4D835C63D9BE17418
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-crt-string-l1-1-0.dll
Size 24KB
SHA256 c6aff750c97c94a594f6cfd6db2998c45e3c0cd9b4f779df1e8e72dc7b606534
MD5 290a004945b199b2aed82959b1623626
SHA1 f19020da6f6b99045b912e45cce1c0e00bdb6efd
SHA512 cce8c4f606508aa90e279472107816337355bff09459db5175b8ae875dcdef26be09a82d498c09c97abdd119a72c1b3d39a1a40d97b6cb94c746217f0d72e1c6
SSDEEP 768:W6S5yguNvZ5VQgx3SbwA71IkFUhaiwEBiwtQ:Wl5yguNvZ5VQgx3SbwA71ILhavEBiwW
TLSH
T19BB2D78786F87F42C98B4BB256F9CBC72D384F46190013359067E5DC38827E2BE6A909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-crt-time-l1-1-0.dll
Size 21KB
SHA256 5baa7efce0f3739812913e1a24d1cd326cd1fb53058719b415c835ecd2840e8a
MD5 dfd30f7dd0c43184de48d97d16cd5b41
SHA1 4462932615fb930deeb610f1354ee505845c7f82
SHA512 54c2101c6b404a5e77534bcb7ca07ba56af3ad7404b262339081e958df1b928eaa76a3542d17331639ed0fb2ca2b92ca714ec543a53c728be0e5130cd064d179
SSDEEP 384:0bWEhWq8y36q0GftpBjcJhERHRN7vD49lgHrIQa:gN7kiMEBvDrrIH
TLSH
T10FA21A838AA8AA47EDD34F7012FCDBDB7F3857C2199065664156E4E836833D4BE2281C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e5a9ef1\library\Win_msvc2015\x86\System\api-ms-win-crt-utility-l1-1-0.dll
Size 19KB
SHA256 d793426ab222bdfc51f136f07663cdf34b31847ee32241e6f3589b3fc1886c22
MD5 156fb885f50d94624ca16289f21c1d66
SHA1 401e0ed9537cb1982dfbce4d869c664c22df5839
SHA512 8b03a50a7192bc35342f1c0e4c1931be8a60b29735d1dd5debe6f37b443cfa9adad5846ca5e2787e19d52cafe8a1f4f872f6858418bc00ad2612436d6f9c49e0
SSDEEP 384:IfhWEhWnMoq0GftpBjbaERHRN7egQ7lp/m2O5/q+:Ifx5aiUEBjQTcw+
TLSH
T10A924BD68EBCA543ED935D7093F8D9873D3C9BC72D208665045AF5E828833D1EB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GlobalMgr.db

Path C:\Users\Admin\AppData\Roaming\Tencent\DeskUpdate\GlobalMgr.db
Size 190B
SHA256 055f9129cb04c41ef9c5a862d12ab6f2a687b5619890964e4a338172c597092e
MD5 852c646eda00263eebd81f384886bc40
SHA1 f8f09f0b4235f6da432fdad9ee7a17520478d0ce
SHA512 16acd5e01c0932956997c3ea3e69c4c90f533873a74c44bb474f262e2ab573293808c86f852fcaa31ce2b4a573c6e451dcf4174015a66332bf27b10ecf618d0d
TLSH
T196C012AB912C5EB34D8D0F47D5A0D0389E4963D2414B9188042531CB14B1A60B5ED0B4
MD5 SHA1 SHA512 TLSH

Submit Download

QMAskAwayConfig.xml

Path C:\Users\Admin\AppData\Roaming\Tencent\QQPCMgr\QMAskAway\QMAskAwayConfig.xml
Size 160B
SHA256 6b3f6a85bfb2c930d3cce4eb65d6b6fa760e44c1714ccea16f1abba87d1fcf93
MD5 44d21a67a415cee4bf5e6d1cd263c8a7
SHA1 41b74bc1c23e6a0041dc7d79e132ffab3b81597f
SHA512 5c5d613af6a29b3a9a45adfee6206006d77b7e882416d71f446f70e99b769eb48ca1be68cba86f7904be32dd0b435bfe6b7415445668b708a6850113327904da
TLSH
T11CC08C2C9248AC72426A483B4F52702DEF2DB0BA08282880C90B6876ADC9100562A8A1
MD5 SHA1 SHA512 TLSH

Submit Download

bc_0WIN0DJ6VL4UY2KW_09.db

Path C:\Users\Admin\AppData\Roaming\Tencent\QQPCMgr\beacon\bc_0WIN0DJ6VL4UY2KW_09.db
Size 12KB
SHA256 00366298d021074beb028a666d1ef753db8d51fc1d703f4d5bda88ee479ebcda
MD5 f94a1e2ff2c72594bfcb7d5b49d9db62
SHA1 3412ea4f8ac2db116e9d67780845062d66a303fe
SHA512 1f7cd7f22dd069ff297914946776c6c6d55c13461e448f1e31ddf27b09632830203c53dfaaa3506de977776b08c5d8752c0d7e9210b2e766f525d801af7b7ccd
SSDEEP 6:l9FZkgZJUVavATSFRxtLum9GAaDsLu8619mVxgFtVMdvUaHqWo:Tzkgy1TSFlyKGhDJ8619sytVqvUcqt
TLSH
T1564261D745280C4BC4886EBB9FB1115A757851C2E5DF1E52D8D00D67CC4534764F27F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 fdcf48bbb5ad7a92517614728e3b167d9da57e45e0c19936bd29f7a54a5a0646
MD5 b1ae65c3ad8b8f9a2d2d479002cf435e
SHA1 77dfb3e8b366b0c20f65fcc9524e5d77abaec64f
SHA512 3b4e045e3190569651448087dd09283c87e5afeddb3a1b416b57552c0f1518b43f956e8264fcfe1ef696af0f5fdc70add63f283b47647df7505b70d2d85a12f0
SSDEEP 768:Ggb1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:RfgLdQAQfcfymN
TLSH
T1D0C2CFB536C8A63ED825087CCED3D791937C1E29496E58AB35E16F3F2230628100FA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1738198120-2966725515-3980530802-1000\_desktop.ini
Size 8B
SHA256 c3d89611fa09592060c9ae109c486c0f6d54b633ec2c444353fd358c30f75fd6
MD5 74b762a03f1481bb1024b54135ea88d9
SHA1 85fb2e99b7f409f56b72c9b3ee8d6990c735db2b
SHA512 bd6116ef4da4e07675625f98c2247b676087baeba3a5d7f6ea0f2525119567cb196c9510a0e076f853a93e21fc4c49e8691deef8263045250c09927c2074becc
MD5 SHA1 SHA512

Submit Download

memory/1000-7994-0x0000000000010000-0x0000000000044000-memory.dmp

Download

memory/1932-8125-0x0000000000010000-0x000000000002D000-memory.dmp

Download

memory/2256-8237-0x0000000000010000-0x000000000002C000-memory.dmp

Download

memory/2828-8306-0x000000000A380000-0x000000000A3D0000-memory.dmp

Download

memory/2828-7956-0x000000006DB30000-0x000000006DB40000-memory.dmp

Download

memory/2828-7984-0x000000006EC70000-0x000000006EC80000-memory.dmp

Download

memory/2828-7983-0x000000006EC70000-0x000000006EC80000-memory.dmp

Download

memory/2828-7982-0x000000006F400000-0x000000006F410000-memory.dmp

Download

memory/2828-8309-0x000000000A810000-0x000000000A8B5000-memory.dmp

Download

memory/2828-8305-0x0000000009760000-0x0000000009A1D000-memory.dmp

Download

memory/2828-8307-0x000000000C4D0000-0x000000000C808000-memory.dmp

Download

memory/2828-8308-0x00000000075B0000-0x0000000007C10000-memory.dmp

Download

memory/2828-8025-0x000000006DEC0000-0x000000006DED0000-memory.dmp

Download

memory/2828-8026-0x000000006D640000-0x000000006D650000-memory.dmp

Download

memory/3036-8222-0x0000000003870000-0x0000000003871000-memory.dmp

Download

memory/3036-8247-0x0000000003890000-0x0000000003891000-memory.dmp

Download

memory/3036-8192-0x0000000001130000-0x0000000001131000-memory.dmp

Download

memory/3036-8128-0x0000000001170000-0x0000000001171000-memory.dmp

Download

memory/3036-8193-0x0000000001190000-0x0000000001191000-memory.dmp

Download

memory/3128-7899-0x000000006EC70000-0x000000006EC80000-memory.dmp

Download

memory/3128-7891-0x000000006DB30000-0x000000006DB40000-memory.dmp

Download

memory/3128-7894-0x000000006DEC0000-0x000000006DED0000-memory.dmp

Download

memory/3128-7898-0x000000006EC70000-0x000000006EC80000-memory.dmp

Download

memory/4076-8239-0x000000006DB30000-0x000000006DB40000-memory.dmp

Download

memory/4296-5280-0x00000244D6CC0000-0x00000244D6D72000-memory.dmp

Download

memory/4296-5276-0x00000244D66A0000-0x00000244D66C2000-memory.dmp

Download

memory/4296-5281-0x00000244D66F0000-0x00000244D66FA000-memory.dmp

Download

memory/4296-5279-0x00000244D66D0000-0x00000244D66EE000-memory.dmp

Download

memory/4880-8124-0x0000000000010000-0x000000000002B000-memory.dmp

Download

memory/4908-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4908-46-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4908-50-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4908-38-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4908-1349-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4908-7106-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4908-31-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4908-5254-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5012-8024-0x000000006DEC0000-0x000000006DED0000-memory.dmp

Download

memory/5072-8288-0x00000000091A0000-0x00000000091F0000-memory.dmp

Download

memory/5072-8282-0x00000000068A0000-0x0000000006B5D000-memory.dmp

Download

memory/5528-7990-0x0000000000010000-0x000000000004E000-memory.dmp

Download

memory/5596-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5596-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5628-8130-0x00007FFA28140000-0x00007FFA28150000-memory.dmp

Download

memory/5628-8273-0x00000197FEC90000-0x00000197FEF60000-memory.dmp

Download