Overview

overview

8

Static

static

3

jaffacakes...ic.exe

windows10-2004-x64

8

jaffacakes...ic.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/10/2026, 23:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  • Size 58KB
  • Sample261013-3alyasvxds
  • SHA256 cd2fca13440bc0fe7467633f4a06c5f53e758260aae7e054c9c9f3f8a6be78f9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarebootkitdefense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Downloads MZ/PE file 2 IoCs
  • Modifies Windows Firewall 2 TTPs 7 IoCs
    defense_evasion
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 9 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 7 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 26 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 2 IoCs
    installer
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 8 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
    1⤵
    • Downloads MZ/PE file
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4124
    • C:\Users\Admin\AppData\Local\Temp\PPTV(pplive)_jinshan_117.exe
      "C:\Users\Admin\AppData\Local\Temp\PPTV(pplive)_jinshan_117.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Writes to the Master Boot Record (MBR)
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4796
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.1.3117\pplugin2.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:2268
      • C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\SkinConverter.exe
        "C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\SkinConverter.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:5968
      • C:\Windows\SysWOW64\Rundll32.exe
        "C:\Windows\SysWOW64\Rundll32.exe" "C:\Windows\SysWOW64\PPTVSvc.dll" RundllCmd -start before
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3920
      • C:\Windows\SysWOW64\Rundll32.exe
        "C:\Windows\SysWOW64\Rundll32.exe" "C:\Windows\SysWOW64\PPTVSvc.dll" RundllCmd -start
        3⤵
        • Server Software Component: Terminal Services DLL
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2796
      • C:\Windows\system32\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\kindling.dll
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:5288
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\SysWOW64\regsvr32.exe" /s C:\Windows\SysWOW64\kindling.dll
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1936
      • C:\Users\Admin\AppData\Local\Temp\nseB35A.tmp\firewall.exe
        "C:\Users\Admin\AppData\Local\Temp\nseB35A.tmp\firewall.exe" /PPTVPATH=C:\Program Files (x86)\PPLive\PPTV /PPTVVERSION=3.3.1.0038 /DELPPTVPATH= /DELPPTVVERSION= /DELCOMMONVERSION=
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1516
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\PPLive.exe" PPLive Enable
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:5964
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\PPLiveU.exe" PPLiveU Enable
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:5716
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\RepairSetup.exe" RepairSetup Enable
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:5468
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\CrashReporter.exe" CrashReporter Enable
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:6016
        • C:\Windows\SYSTEM32\netsh.exe
          netsh firewall add allowedprogram "C:\Windows\system32\PPTVLauncher.exe" PPTVLauncher Enable
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:5908
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" PPLive Enable
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2056
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.1.3117\PluginInstaller.exe" PluginInstaller Enable
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:1288
      • C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe
        "C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" /RegServer
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:4868
      • C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\hwcheck.exe
        "C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\hwcheck.exe" -s -luminanceonly "C:\Users\Admin\AppData\Local\Temp\hwcheck.mp4"
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:616
        • C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe
          "C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" /LoadModule MngModule.dll /T 2 /A http://h.synacast.com/1.html?sa2foJynraWcz9nGo9aentjGp6Gkz9zJpaegntqb1aHNn6zJ0qfPj7mipuye5a+XoKDom/KW7Kno5Zyprb7CsrqusZCzzrzU4tPRiaiWoOydmaSVnqKimqaVnqHoj7uioaGamZaLtq2dn5ysraDkmaaVoKCcmaaLuK2c
          4⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          PID:5516
      • C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\RepairSetup.exe
        "C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\RepairSetup.exe" -codec
        3⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3464
        • C:\Program Files (x86)\PPLive\PPTV\PPLive.exe
          "C:\Program Files (x86)\PPLive\PPTV\PPLive.exe" /LoadModule "C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\components\PPOptions.dll"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2864
      • C:\Program Files (x86)\PPLive\PPTV\PPLive.exe
        "C:\Program Files (x86)\PPLive\PPTV\PPLive.exe"
        3⤵
        • Executes dropped EXE
        • Drops desktop.ini file(s)
        • Writes to the Master Boot Record (MBR)
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4272
        • C:\Program Files (x86)\PPLive\PPTV\PPLive.exe
          "C:\Program Files (x86)\PPLive\PPTV\PPLive.exe" -channel_id=4272.04DA37D0.2048532874 -cachepath="C:\Users\Admin\AppData\Roaming\PPLive\PPTV\cache" /LoadModule components\IEBrowser.dll
          4⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          PID:5804
        • C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\PPLiveU.exe
          "C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\PPLiveU.exe" /LoadModule ProductUpdate.dll /B /P1 1 /P2 9000 /W1 786750
          4⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2072
      • C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe
        "C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" /LoadModule MngModule.dll /T 1 /C forqd926 /F 0 /G 3.3.1.0038 /H 1 /I PPTV(pplive)_jinshan_117 /L 0 /M 0 /N 0 /O 1 /P
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:4256
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\PROGRA~2\PPLive\PPTV\PPLive.exe" pptv://0a2dm6iVo6ihmZzHraegoKaYltOpmZzJraA=
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2564
      • C:\PROGRA~2\PPLive\PPTV\PPLive.exe
        C:\PROGRA~2\PPLive\PPTV\PPLive.exe pptv://0a2dm6iVo6ihmZzHraegoKaYltOpmZzJraA=
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        PID:1288
    • C:\Users\Admin\AppData\Local\Temp\mbox502.exe
      "C:\Users\Admin\AppData\Local\Temp\mbox502.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2352
      • C:\Users\Admin\AppData\Local\Temp\curl.exe
        "C:\Users\Admin\AppData\Local\Temp\curl.exe" -d MiUwOTxTUkM6TVVTSUNfOS4zLjQuMF9BTjB8QUNUOklOU1RBTExfSU5GT3xUWVBFOlN0YXJ0U2V0dXB8VENvdW50OjI0MDgxOTc5Nnx7bWJveDUwMi5leGV9fFU6fE1BQzpFNjU3QUM2REE2ODc+ http://log.kuwo.cn/music.yl -o C:\Users\Admin\AppData\Local\Temp\kuwomsglog.txt
        3⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:4584
      • C:\Users\Admin\AppData\Local\Temp\KwBindApp.exe
        "C:\Users\Admin\AppData\Local\Temp\KwBindApp.exe" /DownCfg /Ver=MUSIC_9.3.4.0_AN0 /Src=mbox502.exe
        3⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5032
        • C:\Users\Admin\AppData\Local\Temp\KWMUSIC\duPlugab.exe
          "C:\Users\Admin\AppData\Local\Temp\KWMUSIC\duPlugab.exe"
          4⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          PID:4824
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /F /IM PPLive.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1852
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /F /IM PPliveU.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5868
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /F /IM PPAP.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5404
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /F /IM Coral.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2584
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /F /IM Maxthon.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4916
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /F /IM KwMusic.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2908
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /F /IM KwService.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5320
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /F /IM IESandBox.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4328
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k PPTVServiceGroup
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:3824
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k PPTVServiceGroup
    1⤵
      PID:1300
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:3076
      • C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe
        "C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" -background
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4732
      • C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe
        "C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" -Embedding
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Writes to the Master Boot Record (MBR)
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4708
      • C:\PROGRA~2\PPLive\PPTV\PPLive.exe
        C:\PROGRA~2\PPLive\PPTV\PPLive.exe
        1⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        PID:5516

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            Windows Command Shell

            1
            T1059.003

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Netsh Helper DLL

            1
            T1546.007

            Pre-OS Boot

            1
            T1542

            Bootkit

            1
            T1542.003

            Server Software Component

            1
            T1505

            Terminal Services DLL

            1
            T1505.005

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            Impair Defenses

            1
            T1562

            Disable or Modify System Firewall

            1
            T1562.004

            Modify Registry

            2
            T1112

            Pre-OS Boot

            1
            T1542

            Bootkit

            1
            T1542.003

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            3
            T1012

            System Information Discovery

            3
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            MngModule.dll
            • Path C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.3117\MngModule.dll
            • Size 557KB
            • SHA256 39d4eda8735566e9a1b76cedf3ca19c616a4c9a36536c1bba3fe0c2b5e5ea142
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            atl100.dll
            • Path C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.3117\player\atl100.dll
            • Size 134KB
            • SHA256 f54fe6535538174c139b1b0cb2ac0753b2e34412153a443482ccae53ffbc4dc6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msvcp100.dll
            • Path C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.3117\player\msvcp100.dll
            • Size 411KB
            • SHA256 d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msvcr100.dll
            • Path C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.3117\player\msvcr100.dll
            • Size 755KB
            • SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PPAP.exe
            • Path C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe
            • Size 245KB
            • SHA256 a24cdaa5a7b852bc68ae94a691f8a4846f3d6aa931766bb7f0be1c7dec019692
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            product.ini
            • Path C:\Program Files (x86)\Common Files\PPLiveNetwork\product.ini
            • Size 209B
            • SHA256 211943bc2b95f3efd1f73c8b3dbc1083e9801fbc82893eb302ed24619f2a3345
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            pplugin2.dll
            • Path C:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.1.3117\pplugin2.dll
            • Size 190KB
            • SHA256 2822c5509fde4f3b63e62db95ec655406d93e90b48529739d80e3a9991eebf48
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PPP.dll
            • Path C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\PPP.dll
            • Size 532KB
            • SHA256 dd62980b35d88cc51351ff7a4482a9ee7330a90cce81d03f889c1e70d0f7e0aa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PPTV .lnk
            • Path C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\PPTV .lnk
            • Size 1KB
            • SHA256 d50388ced3f6796876ee6059daded5bd53123489433da949e43b5fcd190034d3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SkinConverter.exe
            • Path C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\SkinConverter.exe
            • Size 31KB
            • SHA256 e385bc555c62a75e66f72cc4c1bd2c541219e1c95ff636513886482db7157950
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UPDATE.DAT
            • Path C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\UPDATE.DAT
            • Size 402B
            • SHA256 e0a519721e5fe21bccbfc0a8a6e3cf713ede9aa641e47a96125cdc3b01c71e24
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            hwcheck.exe
            • Path C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\hwcheck.exe
            • Size 128KB
            • SHA256 d73fdf1904520e91bdab51d0e7eaa3d48aa49106a07e22fcd5659bbde6c2d935
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AVCVideoDec.ax
            • Path C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\player\AVCVideoDec.ax
            • Size 2.7MB
            • SHA256 15cd4586d7a52d35ca8ac0ae8bd11c7118d159f064a4ab9903c99615d420b421
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CoreAAC.ax
            • Path C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\player\CoreAAC.ax
            • Size 312KB
            • SHA256 04bf38bbd9cb8287582f9a2fb8b06e0ab30f06f676a93f4a56656b576f10e597
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CoreAVC.2.0.0.0.ax
            • Path C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\player\CoreAVC.2.0.0.0.ax
            • Size 265KB
            • SHA256 779768aa0bf2270422e1686547ae622238e7b7cf37ce212a1d75caf8628c1508
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CoreAVC.ax
            • Path C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\player\CoreAVC.ax
            • Size 181KB
            • SHA256 cb8d9d80dcd48d9a9e3d87c847c47125f7201a98fb5abb4bd6c443322071b951
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            HTTP_ASF_SOURCE.ax
            • Path C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\player\HTTP_ASF_SOURCE.ax
            • Size 506KB
            • SHA256 826a37b8b60d5f3c993d883452fd8d16887df27a4b906c063a120108a7492d51
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MP4Splitter.ax
            • Path C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\player\MP4Splitter.ax
            • Size 621KB
            • SHA256 4ab3eaa4795e5afd2de199134decb9c53b8768130080a4cdf271cf3783b327ef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OPlayer.ocx
            • Path C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\player\OPlayer.ocx
            • Size 758KB
            • SHA256 6e7ed563ead4b090efb02d3433b1a62b8031dfa156002ac1c32c814e200070e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSFilter.dll
            • Path C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\player\VSFilter.dll
            • Size 1.1MB
            • SHA256 52167fc5e0078a74d197aeaeed1add6a8eb8ca27e6b8ff1f860795eed7ddbca6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            audioswitcher.ax
            • Path C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\player\audioswitcher.ax
            • Size 429KB
            • SHA256 6145beb89b2f35257b545a3e8d6bcbcc49f63510ef7afd987cd714152c65bc56
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ppcef.dll
            • Path C:\Program Files (x86)\PPLive\PPTV\3.3.1.0038\ppcef.dll
            • Size 15.5MB
            • SHA256 206d93fe65711498e6f97b1e28dd6a1753b78161d163bd64c9e59cd43e8caa3d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PPLive.exe
            • Path C:\Program Files (x86)\PPLive\PPTV\PPLive.exe
            • Size 245KB
            • SHA256 1ce603895526b46abc3dd842609c6b93ef24ef943f1ce919ae5031b5566610d4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bk.jpg
            • Path C:\Program Files (x86)\kuwo\kuwomusic\9.3.4.0_AN0\bin\Skin\serverskin\1\bk.jpg
            • Size 55KB
            • SHA256 d466b247edacb3e3d1607a1393388b10dd59756a1784ade11d290c9453854cb4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            conf.ini
            • Path C:\Program Files (x86)\kuwo\kuwomusic\9.3.4.0_AN0\bin\Skin\serverskin\1\conf.ini
            • Size 92B
            • SHA256 b57d31de9f0c103502f796d041367756b64952ba07b623df10379027a14e97b1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            skinConfig.json
            • Path C:\Program Files (x86)\kuwo\kuwomusic\9.3.4.0_AN0\bin\Skin\serverskin\1\netsong\skinConfig.json
            • Size 120B
            • SHA256 5ee2e916b931a39b2958d2f2d536cdf51fc92974e4adacb77f7f35c5a10dbe15
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            process_uidownload_bk.png
            • Path C:\Program Files (x86)\kuwo\kuwomusic\9.3.4.0_AN0\bin\Skin\serverskin\1\process_uidownload_bk.png
            • Size 213B
            • SHA256 258bc6a7614ee10f1a1c98bae34dfc7b192de966f668bf46329ad1c2aa675231
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            skin.xml
            • Path C:\Program Files (x86)\kuwo\kuwomusic\9.3.4.0_AN0\bin\Skin\serverskin\1\skin.xml
            • Size 123B
            • SHA256 a6bd86b1701aaa874f0afce58409b8390075f99743ce9ab1bd062cba4249de75
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            small.jpg
            • Path C:\Program Files (x86)\kuwo\kuwomusic\9.3.4.0_AN0\bin\Skin\serverskin\1\small.jpg
            • Size 2KB
            • SHA256 ee1a2051ad9280c3796fea88c8648d8f94b8961ad6b028f8009c82cf39d905af
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            PPTVLnkUpdate.s3db
            • Path C:\ProgramData\PPLive\PPTV\Favorites\PPTVLnkUpdate.s3db
            • Size 4KB
            • SHA256 04fdb4e8f79b587857588359d6a41b8a96540e2ba269226e311ac3ad15ffb733
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            7B8944BA8AD0EFDF0E01A43EF62BECD0_9E09401B316D0AA698C9BA9475E519F1
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_9E09401B316D0AA698C9BA9475E519F1
            • Size 5B
            • SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
            • MD5 SHA1 SHA512
            Submit Download

            bind_en-us[1].ini
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MW9UJA6Z\bind_en-us[1].ini
            • Size 88B
            • SHA256 01ec772e0e36b5b5e6f81529c2ca426277fe38981613a16f2b7464eab469c7c4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            BindConfig_tmp.ini
            • Path C:\Users\Admin\AppData\Local\Temp\KWMUSIC\BindConfig_tmp.ini
            • Size 64B
            • SHA256 25e21297d31e915517093c39946f87c6619c68a1a64208a1ae9a690eda06a795
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            duPlugab.exe
            • Path C:\Users\Admin\AppData\Local\Temp\KWMUSIC\duPlugab.exe
            • Size 195KB
            • SHA256 ccb7aa3689ca9267d2a03f228735eb14c0872e8ca9cbb832d2746d95bb7cb957
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PPL10DD.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\PPL10DD.tmp
            • Size 34B
            • SHA256 27c7940a09c9531e89ff567a7909292635afb0f1d598753ad9143b20114cce91
            • MD5 SHA1 SHA512
            Submit Download

            PPL2253.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\PPL2253.tmp
            • Size 177B
            • SHA256 513cfea76a217ba9298366b784f254829e79595921803d2fd22736a5017de094
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            PPTV(pplive)_jinshan_117.exe
            • Path C:\Users\Admin\AppData\Local\Temp\PPTV(pplive)_jinshan_117.exe
            • Size 21.4MB
            • SHA256 ad797653b4454fd3803d83aefe2b5e0c53e7f5a4784f6c17100ccb602881504a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PPTV_Update.ini
            • Path C:\Users\Admin\AppData\Local\Temp\PPTV_Update.ini
            • Size 87B
            • SHA256 571fe1ed5bb4958306cd07e4124e01aeb748bf773caafd824b993a081e118592
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            curl.exe
            • Path C:\Users\Admin\AppData\Local\Temp\curl.exe
            • Size 659KB
            • SHA256 264d69e8a7ca1afcdf4179429d74a9098187c3f8a5e06080d2758682313a42b4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbox502.exe
            • Path C:\Users\Admin\AppData\Local\Temp\mbox502.exe
            • Size 46.4MB
            • SHA256 9f5644bda59b40e9f7b5edd3d9b7cc5d82ccead62741a5d54f6bc7e5881ae22c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            KuWoNsis_new.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseA490.tmp\KuWoNsis_new.dll
            • Size 210KB
            • SHA256 8de23ffb1a441f73f5c9e88f6b171277a58556d5f20cd7797cada56a94d7f749
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            inetc.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseA490.tmp\inetc.dll
            • Size 55KB
            • SHA256 46e26dc2255603778fd046493fae73130963c7fb365ca222105e8ea0328c485f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AsynDownload.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseB35A.tmp\AsynDownload.dll
            • Size 29KB
            • SHA256 ef89ba69fa02c1617005b2cab71981126f926c50fe21fef454de2a91f3b27edd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BindDLL.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseB35A.tmp\BindDLL.dll
            • Size 49KB
            • SHA256 faf33559a59f00ce3017b319710d99d370bba6c851b7010bb7c4c77458e14c3c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CommonFuncDll.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseB35A.tmp\CommonFuncDll.dll
            • Size 201KB
            • SHA256 e1671be1ffdaf848a17d9b3e9909a72a5bde8cc1f920b4362b90130e78f62019
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FindProcDLL.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseB35A.tmp\FindProcDLL.dll
            • Size 25KB
            • SHA256 7addf56d9c08efb13d7c8bb39cf9073cd58495f22aaa04e22c1b43661d67fc0b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GetCommentsInfoDll.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseB35A.tmp\GetCommentsInfoDll.dll
            • Size 53KB
            • SHA256 c5a4a3674b518f7378a900665ac94d39a305f92dccaed5a879c328d6cc308ae7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GetVersion.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseB35A.tmp\GetVersion.dll
            • Size 5KB
            • SHA256 db09adb6e17b6a0b31823802431ff5209018ee8c77a193ac8077e42e5f15fb00
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            InetLoad.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseB35A.tmp\InetLoad.dll
            • Size 22KB
            • SHA256 f317f54d288260cec64801d5ab81cd96ac5afaa9b07ff33747a20c6aadffe0f8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            KillProcDLL.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseB35A.tmp\KillProcDLL.dll
            • Size 25KB
            • SHA256 dc90ebf8ffd5d30fda40b5c7779579ab65d83f80ca9fd3e5ab119efc42aa4902
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PPAddWhite.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseB35A.tmp\PPAddWhite.dll
            • Size 449KB
            • SHA256 ad28878b980abda7dd258bcddc50f3aa8c2a1163b5e3611c8c63d6589b6fa249
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PPBindDAC.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseB35A.tmp\PPBindDAC.dll
            • Size 37KB
            • SHA256 29336c2835802b6090c29d3d4703445466cf30d367ca51c881bcf99bb7d8e5f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PPInstallLog.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseB35A.tmp\PPInstallLog.dll
            • Size 37KB
            • SHA256 c866c99a2a5d049d3394ab8f58b46ee9450eb493bfba4e0c2be34801fa3ac322
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseB35A.tmp\System.dll
            • Size 17KB
            • SHA256 d789f2094807a2fcb168df37f8fe89c7b74c228301eaa1910cd718d667a7028f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cknsis.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseB35A.tmp\cknsis.dll
            • Size 51KB
            • SHA256 58eac56896032ca3babd1093b25be14c1a54ecbec2c7ad0f9ae6b87ffba2a30c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pnsis.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseB35A.tmp\pnsis.dll
            • Size 77KB
            • SHA256 b33f0bbe8dceac3eea4a1bd4ded2af8b34303cabe7029e8d3294ce20d446ea1a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            time.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseB35A.tmp\time.dll
            • Size 10KB
            • SHA256 b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            InstLancher.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsq9ADC.tmp\InstLancher.dll
            • Size 1.7MB
            • SHA256 0344b54b41a362a970e4aefb396befc23c9397205d76917b61174bddb3a515bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            KuWoNsis_new.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsq9ADC.tmp\KuWoNsis_new.dll
            • Size 298KB
            • SHA256 5f901e526effe89e783eb4acfdec0f485a465a98b9069d0b13ffd5e2ed73adfe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            KwMusicNsis.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsq9ADC.tmp\KwMusicNsis.dll
            • Size 419KB
            • SHA256 09fb37e917faea5c966bc3418d1d7e46e3d0b9912cadd56486ba5bb5ac0f7b10
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsq9ADC.tmp\System.dll
            • Size 11KB
            • SHA256 72253837028abed272e5d50a3a6771933e9dd1aad73e90b8db4538aa9c786cbf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsvDC8C.tmp\System.dll
            • Size 14KB
            • SHA256 ce9f8fd595dd6450f2b5d2633d684cf7a247f61875d95bd2eb3c5a441d93e0f8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsExec.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsvDC8C.tmp\nsExec.dll
            • Size 11KB
            • SHA256 02dc4b7b312995b68f1d424590755a4266de42bf7790efc01f6a336deadb31c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PPTV .lnk
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PPTV .lnk
            • Size 1KB
            • SHA256 11182ec14caf0865396fba2fa4fcc468bdf9bae19612ff5d1634d4cadbfc3323
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            PPTV视频.library-ms
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\PPTV视频.library-ms
            • Size 6KB
            • SHA256 043e9447f9abbc2b5a760a1579f2932e10c4a724d3601ad57d2f182e5994276b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ~PTV视频.tmp
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\~PTV视频.tmp
            • Size 6KB
            • SHA256 a300b8088f6dace1e8e0490331fd68a161ca948459cd9ba9146ed3a6fcddaf95
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ~PTV视频.tmp
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\~PTV视频.tmp
            • Size 278B
            • SHA256 fe1d601f037d46cf74126764ace194286b39a1a0af8bbb7b49ba248fca98ec7b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ~PTV视频.tmp
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\~PTV视频.tmp
            • Size 4KB
            • SHA256 2cbe94d8fe1c55c5f029f666f1c369360718de29f7f7f958f1c61eea12facc71
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ~PTV视频.tmp
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\~PTV视频.tmp
            • Size 2KB
            • SHA256 386364a197100d6f6c65cbfbf3fe240a505a4672ccabdb4767004134ae5bc5c7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            PPTVLog.log
            • Path C:\Users\Admin\AppData\Roaming\PPLive\PPTV\PPTVLog.log
            • Size 191B
            • SHA256 d830e36f9311e9b7387b7fc1802e9d36aa36d6a11b4470c70f6b102668e92fd8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            compreg.dat
            • Path C:\Users\Admin\AppData\Roaming\PPLive\PPTV\compreg\3.3.1.0038\compreg.dat
            • Size 7KB
            • SHA256 81a3729ac174affc8223227f2436c11003748eb1913a9e8da9e9551d375004c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            xpti.dat
            • Path C:\Users\Admin\AppData\Roaming\PPLive\PPTV\compreg\3.3.1.0038\xpti.dat
            • Size 276B
            • SHA256 72335f6008ffb3178dd4f27242552807d0f0100dd6f11af35bc6d8c8e5b1d8d6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            PPTVSvc.dll
            • Path C:\Windows\SysWOW64\PPTVSvc.dll
            • Size 493KB
            • SHA256 f8afab633882e35f4f4426520f18761709ade16b464b4e59b09a9513558892bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            kindling.dll
            • Path C:\Windows\SysWOW64\kindling.dll
            • Size 2.2MB
            • SHA256 1c1121d56e4c6bf8ac41c3aa9e6b43e949f080d672fb4a86a3217b07d251a15b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            kindling.dll
            • Path C:\Windows\system32\kindling.dll
            • Size 2.5MB
            • SHA256 6a9c8625674737219a33d683e097129c4f25a2dbd27ba287b2a773f7b241804c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2864-863-0x0000000000B10000-0x0000000000BD0000-memory.dmp
            Download

            memory/4272-900-0x00000000074D0000-0x0000000007566000-memory.dmp
            Download

            memory/4272-860-0x0000000003BF0000-0x0000000003CDE000-memory.dmp
            Download

            memory/4272-981-0x0000000006E70000-0x0000000006F6B000-memory.dmp
            Download

            memory/4272-986-0x0000000006EA0000-0x0000000006F29000-memory.dmp
            Download

            memory/4272-985-0x000000000B010000-0x000000000B193000-memory.dmp
            Download

            memory/4272-980-0x0000000006E70000-0x0000000006F6B000-memory.dmp
            Download

            memory/4272-966-0x0000000070530000-0x0000000070642000-memory.dmp
            Download

            memory/4272-970-0x0000000070530000-0x0000000070642000-memory.dmp
            Download

            memory/4272-972-0x0000000006E70000-0x0000000006EBE000-memory.dmp
            Download

            memory/4272-1062-0x0000000006E70000-0x0000000006F6B000-memory.dmp
            Download

            memory/4272-1061-0x0000000006E70000-0x0000000006F6B000-memory.dmp
            Download

            memory/4272-872-0x0000000004030000-0x00000000040F0000-memory.dmp
            Download

            memory/4272-857-0x0000000002A30000-0x0000000002A4E000-memory.dmp
            Download

            memory/4272-870-0x0000000003E20000-0x0000000003EE9000-memory.dmp
            Download

            memory/4708-861-0x0000000002EA0000-0x0000000002F11000-memory.dmp
            Download

            memory/4708-908-0x000000006FFF0000-0x0000000070000000-memory.dmp
            Download

            memory/4708-901-0x0000000004770000-0x00000000047D8000-memory.dmp
            Download

            memory/4796-237-0x0000000008A00000-0x0000000008A12000-memory.dmp
            Download

            memory/4796-543-0x0000000008C80000-0x0000000008C8C000-memory.dmp
            Download

            memory/4796-56-0x0000000007DC0000-0x0000000007DCE000-memory.dmp
            Download

            memory/4796-506-0x0000000008C80000-0x0000000008C92000-memory.dmp
            Download

            memory/4796-662-0x0000000008E40000-0x0000000008E52000-memory.dmp
            Download

            memory/4796-64-0x0000000007DC0000-0x0000000007DCF000-memory.dmp
            Download

            memory/4796-115-0x0000000008C40000-0x0000000008C52000-memory.dmp
            Download

            memory/5804-951-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-934-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-933-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-932-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-931-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-930-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-929-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-926-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-927-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-923-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-922-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-921-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-919-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-918-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-916-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-915-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-914-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-913-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-924-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-925-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-920-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-917-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-912-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-936-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-935-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-937-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-938-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-939-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-940-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-942-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-941-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-943-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-944-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-945-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-946-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-947-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-948-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-949-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-950-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-958-0x000000006AB00000-0x000000006AB38000-memory.dmp
            Download

            memory/5804-959-0x000000006AB00000-0x000000006AB38000-memory.dmp
            Download

            memory/5804-954-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-955-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download

            memory/5804-928-0x0000000065EC0000-0x000000006619A000-memory.dmp
            Download