Overview

overview

7

Static

static

3

最新版.exe

windows10-2004-x64

7

最新版.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    140s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/10/2026, 04:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    最新版.exe
  • Size 8.1MB
  • Sample261027-e5fg1aav7t
  • SHA256 cb5820004d0a8127b38796cc3dbf938f27b07035ee04f9db22d48144ca0ca7c3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdefense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 25 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    defense_evasiontrojan
  • Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 64 IoCs
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 5 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 3 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\最新版.exe
    "C:\Users\Admin\AppData\Local\Temp\最新版.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Direct Volume Access: Opens a physical disk for reading
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\DiskPartSetup_341572.exe
      "C:\Users\Admin\AppData\Local\Temp\DiskPartSetup_341572.exe" --silent --param-
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Direct Volume Access: Opens a physical disk for reading
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2752
      • C:\Users\Admin\AppData\Roaming\360 Partition Master\LoginServer.exe
        "C:\Users\Admin\AppData\Roaming\360 Partition Master\LoginServer.exe" --sem-server --sem-name="DiskPartSetup_341572.exe" --sem-path="%appdata%360 Partition Master\data"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4504
        • C:\Users\Admin\AppData\Roaming\360 Partition Master\LoginServer.exe
          "C:\Users\Admin\AppData\Roaming\360 Partition Master\LoginServer.exe" --sem-server --sem-name="DiskPartSetup_341572.exe" --sem-path="%appdata%360 Partition Master\data" --lowrun
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4036
    • C:\Users\Admin\AppData\Local\Temp\SudaCaplayerSetup_341572.exe
      "C:\Users\Admin\AppData\Local\Temp\SudaCaplayerSetup_341572.exe" /S --createCaptureShortcut
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1724
      • C:\Program Files (x86)\SudaCaplayer\bin\Converter\ConverterUninst.exe
        "C:\Program Files (x86)\SudaCaplayer\bin\Converter\ConverterUninst.exe" --silent
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:628
        • C:\Users\Admin\AppData\Local\Temp\ConverterUninst.exe
          "C:\Users\Admin\AppData\Local\Temp\ConverterUninst.exe" "C:\Program Files (x86)\SudaCaplayer\bin\Converter\ConverterUninst.exe" --silent
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Writes to the Master Boot Record (MBR)
          • Direct Volume Access: Opens a physical disk for reading
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:4516
      • C:\Program Files (x86)\SudaCaplayer\bin\32bit\CaplayerTray.exe
        "C:\Program Files (x86)\SudaCaplayer\bin\32bit\CaplayerTray.exe" --aiLoginServerPath="C:\Program Files (x86)\SudaCaplayer\bin\AiLoginServer"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3084
      • C:\Program Files (x86)\SudaCaplayer\bin\Converter\Converter.exe
        "C:\Program Files (x86)\SudaCaplayer\bin\Converter\Converter.exe" /S --createCaptureShortcut --firstInstall=1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3740
        • C:\Program Files (x86)\SudaCaplayer\bin\Converter\Converter.exe
          "C:\Program Files (x86)\SudaCaplayer\bin\Converter\Converter.exe" /S --createCaptureShortcut --firstInstall=1 --lowrun
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Writes to the Master Boot Record (MBR)
          • Direct Volume Access: Opens a physical disk for reading
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4580
          • C:\Users\Admin\AppData\Roaming\AiLoginServer\AiLoginServer.exe
            "C:\Users\Admin\AppData\Roaming\AiLoginServer\AiLoginServer.exe" --user_server --icon="C:\Program Files (x86)\SudaCaplayer\bin\Converter\Converter.exe" --icon_index="0" --server_mark="Converter" --ipc=66318 --app_pay_params=&channel=341572&newChannel=341572 --vip_source=suda_vip --client_ver=1.0.0.1151 --sem_path=%appdata%SudaCaplayer\data
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:208
            • C:\Users\Admin\AppData\Roaming\AiLoginServer\AiLoginServer.exe
              "C:\Users\Admin\AppData\Roaming\AiLoginServer\AiLoginServer.exe" --user_server --icon="C:\Program Files (x86)\SudaCaplayer\bin\Converter\Converter.exe" --icon_index="0" --server_mark="Converter" --ipc=66318 --app_pay_params=&channel=341572&newChannel=341572 --vip_source=suda_vip --client_ver=1.0.0.1151 --sem_path=%appdata%SudaCaplayer\data --lowrun
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1820
              • C:\Users\Admin\AppData\Roaming\AiLoginServer\SoftMgr\WebView.exe
                "C:\Users\Admin\AppData\Roaming\AiLoginServer\SoftMgr\WebView.exe" --install-core=se --main-ipc-hWnd=66356 --product=suda
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2204
              • C:\Users\Admin\AppData\Roaming\AiLoginServer\SoftMgr\WebView.exe
                "C:\Users\Admin\AppData\Roaming\AiLoginServer\SoftMgr\WebView.exe" --install-core=se --main-ipc-hWnd=66380 --product=suda
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2540
              • C:\Users\Admin\AppData\Roaming\AiLoginServer\SoftMgr\WebView.exe
                "C:\Users\Admin\AppData\Roaming\AiLoginServer\SoftMgr\WebView.exe" --install-core=se --main-ipc-hWnd=131918 --product=suda
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3308
              • C:\Users\Admin\AppData\Roaming\AiLoginServer\SoftMgr\WebView.exe
                "C:\Users\Admin\AppData\Roaming\AiLoginServer\SoftMgr\WebView.exe" --install-core=se --main-ipc-hWnd=66390 --product=suda
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2376
          • C:\Program Files (x86)\SudaCaplayer\bin\Converter\SoftMgr\WebView.exe
            "C:\Program Files (x86)\SudaCaplayer\bin\Converter\SoftMgr\WebView.exe" --install-core=se --main-ipc-hWnd=66348 --product=Converter
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:212
      • C:\Program Files (x86)\SudaCaplayer\bin\32bit\CaplayerTray.exe
        "C:\Program Files (x86)\SudaCaplayer\bin\32bit\CaplayerTray.exe" /S --createCaptureShortcut --firstInstall=1 --semProxy=SudaCaplayerSetup_341572.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • Direct Volume Access: Opens a physical disk for reading
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3372
        • C:\Users\Admin\AppData\Roaming\AiLoginServer\AiLoginServer.exe
          "C:\Users\Admin\AppData\Roaming\AiLoginServer\AiLoginServer.exe" --sem_server --sem_name="SudaCaplayerSetup_341572.exe" --sem_path="%appdata%SudaCaplayer\data"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2556
          • C:\Users\Admin\AppData\Roaming\AiLoginServer\AiLoginServer.exe
            "C:\Users\Admin\AppData\Roaming\AiLoginServer\AiLoginServer.exe" --sem_server --sem_name="SudaCaplayerSetup_341572.exe" --sem_path="%appdata%SudaCaplayer\data" --lowrun
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2896
    • C:\Users\Admin\AppData\Local\Temp\360DesktopLite_341572.exe
      "C:\Users\Admin\AppData\Local\Temp\360DesktopLite_341572.exe" /S
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1008
      • C:\Users\Admin\AppData\Roaming\DesktopLite\360DesktopService64.exe
        "C:\Users\Admin\AppData\Roaming\DesktopLite\360DesktopService64.exe" /install
        3⤵
        • Executes dropped EXE
        PID:1572
      • C:\Users\Admin\AppData\Roaming\DesktopLite\360DesktopLite.exe
        "C:\Users\Admin\AppData\Roaming\DesktopLite\360DesktopLite.exe" /inst=341572
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3824
        • C:\Users\Admin\AppData\Roaming\DesktopLite\360DesktopLite64.exe
          "C:\Users\Admin\AppData\Roaming\DesktopLite\360DesktopLite64.exe" /lowrun /inst=341572
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies Control Panel
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:3908
    • C:\Users\Admin\AppData\Local\Temp\360FileSetup_ydca_341572.exe
      "C:\Users\Admin\AppData\Local\Temp\360FileSetup_ydca_341572.exe" /S
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1920
      • C:\Windows\SysWOW64\360FileService.exe
        "C:\Windows\system32\360FileService.exe" -install
        3⤵
          PID:4816
        • C:\Windows\system32\regsvr32.exe
          "C:\Windows\Sysnative\regsvr32.exe" -s "C:\Users\Admin\AppData\Roaming\360FileBrowser\360FolderExt64.dll"
          3⤵
            PID:4216
        • C:\Users\Admin\AppData\Local\Temp\360zip_yqlm_341572.exe
          "C:\Users\Admin\AppData\Local\Temp\360zip_yqlm_341572.exe" /S /pid=yqlm "/d="C:\Program Files (x86)\360压缩""
          2⤵
            PID:1604
        • C:\Users\Admin\AppData\Roaming\DesktopLite\360DesktopService64.exe
          "C:\Users\Admin\AppData\Roaming\DesktopLite\360DesktopService64.exe"
          1⤵
          • Executes dropped EXE
          PID:472
        • C:\Users\Admin\AppData\Roaming\DesktopLite\360DesktopLite64.exe
          "C:\Users\Admin\AppData\Roaming\DesktopLite\360DesktopLite64.exe" /auto
          1⤵
            PID:5032
            • C:\Users\Admin\AppData\Roaming\DesktopLite\360DesktopLite64.exe
              "C:\Users\Admin\AppData\Roaming\DesktopLite\360DesktopLite64.exe" /lowrun /auto
              2⤵
                PID:3544
            • C:\Windows\SysWOW64\360FileService.exe
              "C:\Windows\SysWOW64\360FileService.exe"
              1⤵
                PID:3784

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    360AblumViewer.ini
                    • Path C:\Program Files (x86)\360压缩\360zip\360AblumViewer.ini
                    • Size 22KB
                    • SHA256 42debade657490554a4341bb50e4acd0c2462ba2f826f8e6936e9a678b33bcae
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    360ZipExtPackage.msix
                    • Path C:\Program Files (x86)\360压缩\360zip\360ZipExtPackage.msix
                    • Size 32KB
                    • SHA256 be58b0eb21c9a4d575e377bf46d0582f53ef5ce684146d53d34b3cbf1d00ef55
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    360压缩官网.url
                    • Path C:\Program Files (x86)\360压缩\360zip\360压缩官网.url
                    • Size 164B
                    • SHA256 602a8969fd04598c38c25d16c56322a41727213706e4e85124e12544a43f1a00
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Square150x150Logo.scale-100.png
                    • Path C:\Program Files (x86)\360压缩\360zip\Assets\Square150x150Logo.scale-100.png
                    • Size 4KB
                    • SHA256 58d8b9e6c5081324d5d830f24ee01a247b1e46b90b2f54eb597e589df79156d9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Square44x44Logo.altform-lightunplated_targetsize-16.png
                    • Path C:\Program Files (x86)\360压缩\360zip\Assets\Square44x44Logo.altform-lightunplated_targetsize-16.png
                    • Size 526B
                    • SHA256 5d3ddad2d4ad91500eae99370196fcd996ec4f1006a6f2a9c0d30cea6149d991
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Square44x44Logo.altform-lightunplated_targetsize-24.png
                    • Path C:\Program Files (x86)\360压缩\360zip\Assets\Square44x44Logo.altform-lightunplated_targetsize-24.png
                    • Size 908B
                    • SHA256 8db89d221ab2c549884c66dcc16944739c90077241b95c3fb4b00c9c36e63313
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    AiUpdateServer.dll
                    • Path C:\Program Files (x86)\SudaCaplayer\bin\32bit\AiUpdateServer.dll
                    • Size 1.8MB
                    • SHA256 5596b523f03860106c1902c91a5e3916ccfbd2750b2a3d9d92e22bbde1096cdf
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    CaplayerTray.exe
                    • Path C:\Program Files (x86)\SudaCaplayer\bin\32bit\CaplayerTray.exe
                    • Size 1.8MB
                    • SHA256 04ddedd43770c1dc26be7656c30665a332ace44e405f3d9fe79cb3bcc7be3e0a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AiLoginServer.exe
                    • Path C:\Program Files (x86)\SudaCaplayer\bin\AiLoginServer\AiLoginServer.exe
                    • Size 2.1MB
                    • SHA256 3a76b23065f6946816ca663fea2a33f407cecac5cc09fb7aa69037e301ba927c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    360Common.dll
                    • Path C:\Program Files (x86)\SudaCaplayer\bin\Converter\360Common.dll
                    • Size 512KB
                    • SHA256 43308e63718cde96cb2231c432212b43c166fbc0d97213273dc5cdaa8014beec
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    360Util.dll
                    • Path C:\Program Files (x86)\SudaCaplayer\bin\Converter\360Util.dll
                    • Size 664KB
                    • SHA256 8733f13c9161db106b1b547fe8e8e29ae006e9311ec4ca510783720d5331923e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Converter.exe
                    • Path C:\Program Files (x86)\SudaCaplayer\bin\Converter\Converter.exe
                    • Size 2.1MB
                    • SHA256 90c6baf7f5b4cce25c939ffd6cb12ba2469013dc56d25f74dea2c13dbd5ef882
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ConverterUninst.exe
                    • Path C:\Program Files (x86)\SudaCaplayer\bin\Converter\ConverterUninst.exe
                    • Size 909KB
                    • SHA256 fde4cfc2b391a6be61d317fa700b6cf0825f3c5b7ca9b9f556c07bf43281e671
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    DumpUper.exe
                    • Path C:\Program Files (x86)\SudaCaplayer\bin\Converter\DumpUper.exe
                    • Size 426KB
                    • SHA256 4b75b2e50efed918b795a04570dbe220d581da57ce25ce1caaf7c960936e505a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    oc-FR.ini
                    • Path C:\Program Files (x86)\SudaCaplayer\data\obs-plugins\obs-x264\locale\oc-FR.ini
                    • Size 17B
                    • SHA256 d8e9550eef49057d39667cc3ee51032ec34822399777944741a58e3eb55379a1
                    • MD5 SHA1 SHA512
                    Submit Download

                    07CEF2F654E3ED6050FFC9B6EB844250_90887DD7920637A743EF36CB9A88B5D8
                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_90887DD7920637A743EF36CB9A88B5D8
                    • Size 2KB
                    • SHA256 29e37ce151b8cd52984930779ddc1035960c02d807f1855809a46137c7b78dc1
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    E2D993E9BDDFC2D49E19866F11A7E662_3032E849B1F2DD9B37F7433C9BC1D335
                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2D993E9BDDFC2D49E19866F11A7E662_3032E849B1F2DD9B37F7433C9BC1D335
                    • Size 471B
                    • SHA256 7fcd7f9e708847cf457382b441f1acb87b2ac91326e13729c792665ad726e8f5
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    07CEF2F654E3ED6050FFC9B6EB844250_90887DD7920637A743EF36CB9A88B5D8
                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_90887DD7920637A743EF36CB9A88B5D8
                    • Size 488B
                    • SHA256 c5c0d8f99e333193747d570c9f824885eb6a137200fd746f4bcdd53236ed6a2d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    E2D993E9BDDFC2D49E19866F11A7E662_3032E849B1F2DD9B37F7433C9BC1D335
                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2D993E9BDDFC2D49E19866F11A7E662_3032E849B1F2DD9B37F7433C9BC1D335
                    • Size 490B
                    • SHA256 4dca3cd1187938be0e083643b4a5b890e640531d7a9c2e9fbb43638508c9c371
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    360Base.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\DesktopLite\360Base.dll
                    • Size 766KB
                    • SHA256 526945bd0aca803139ea611dd2698a219846ea1f99d442ffd3aac6ae374619d7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    360NetBase.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\DesktopLite\360NetBase.dll
                    • Size 1.4MB
                    • SHA256 f7c51e3c8779b1e3e2d76c5bca4b32094a31dc8ecea66de6fd8d8bdcdae74819
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    7z.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\DesktopLite\7z.dll
                    • Size 2.0MB
                    • SHA256 47d0e0d70c844cb8546fb38a5142f55d83e0b8952815c2c89af4b06dd2102a7a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sites.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\DesktopLite\sites.dll
                    • Size 1.4MB
                    • SHA256 23d2b040f587a2823b2aa35a1de221fa485c78f2ba230a38913ba149a0458b5d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    DiskPartSetup_341572.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\DiskPartSetup_341572.exe
                    • Size 10.7MB
                    • SHA256 7b8f330f1491bf7c4cf1ec12b3bb871963694bd9b19771ecbdd7f6586091b118
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SettingInfo.ini
                    • Path C:\Users\Admin\AppData\Local\Temp\SettingInfo.ini
                    • Size 329B
                    • SHA256 7123accb248889bc91e93ceda164aac6ecadf758f1134ef4a541b0152a36acfe
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    InstallerUtils.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nsiD506.tmp\InstallerUtils.dll
                    • Size 478KB
                    • SHA256 205b27efa1165e612d921fabfd91e6773a3889867653ad16bdfae926c2670894
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    System.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nsiD506.tmp\System.dll
                    • Size 12KB
                    • SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    {CF577794-0805-4f38-92D6-6944F29E7D2B}.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\{CF577794-0805-4f38-92D6-6944F29E7D2B}.tmp
                    • Size 1.8MB
                    • SHA256 513f6c5f595c88822bb8b2bf316c5692a18150dd5b6eae053407a5b292ab4c9d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    360Base.dll
                    • Path C:\Users\Admin\AppData\Roaming\360 Partition Master\360Base.dll
                    • Size 965KB
                    • SHA256 b96a9539e9a77fc0d21131dad0df7b065d297de79010ea7a763618f670206659
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    360NetBase.dll
                    • Path C:\Users\Admin\AppData\Roaming\360 Partition Master\360NetBase.dll
                    • Size 1.4MB
                    • SHA256 401d8529a84f1d80a439be8cd4e869202162458e5afb5e5bac97c4859bfe8eb5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    CrashReport.dll
                    • Path C:\Users\Admin\AppData\Roaming\360 Partition Master\CrashReport.dll
                    • Size 171KB
                    • SHA256 e5126f27a767c2ec225e06bb0352945557127c47d1c2ecce3c7e4ae952d411f7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    DiskMain.exe
                    • Path C:\Users\Admin\AppData\Roaming\360 Partition Master\DiskMain.exe
                    • Size 7.9MB
                    • SHA256 6ac2877b820bdbbd3680c12929002320f723b91abbe623688d9fb5c0fda34b80
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    LoginServer.exe
                    • Path C:\Users\Admin\AppData\Roaming\360 Partition Master\LoginServer.exe
                    • Size 1.9MB
                    • SHA256 629970f04898ce6b2cda3194ac90f23b7aa7eccc47fed7f2557c1e43f4029af1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Uninst.exe
                    • Path C:\Users\Admin\AppData\Roaming\360 Partition Master\Uninst.exe
                    • Size 1.9MB
                    • SHA256 9f06ba38edfb8d8a791f78c0c1573952f76191a449a02f418c5e28000c8e3c52
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Config.ini
                    • Path C:\Users\Admin\AppData\Roaming\360DesktopLite\DTFence\Config.ini
                    • Size 114B
                    • SHA256 ed596e69c4a6b328b5f898157947a9c06a45d7914831666d861712b7e82b19c7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Config.ini
                    • Path C:\Users\Admin\AppData\Roaming\360DesktopLite\DTFence\Config.ini
                    • Size 142B
                    • SHA256 6ce1c39d518ecdd873242a3f3016c69040bbdbd97f8768eae09139635034d04a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Config.ini
                    • Path C:\Users\Admin\AppData\Roaming\360DesktopLite\DTFence\Config.ini
                    • Size 325B
                    • SHA256 cf84c71ccfb80e35008aa5d1f3589f072a05455c1c4e7779b63de675409931cc
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    DTFenceData.dtf.bk
                    • Path C:\Users\Admin\AppData\Roaming\360DesktopLite\DTFence\DTFenceData.dtf.bk
                    • Size 7KB
                    • SHA256 4053c0b221aa8c43b833fe109deb02c0e5e8778c1f08abfccfdc499878b6e2c2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    citytree.dat
                    • Path C:\Users\Admin\AppData\Roaming\360DesktopLite\DTFence\citytree.dat
                    • Size 85KB
                    • SHA256 0aa9e5581a9420472924ab8d4627ee83794b3cad6b371937c9bd45b1163ce87c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    360FileBrowser64.exe
                    • Path C:\Users\Admin\AppData\Roaming\360FileBrowser\360FileBrowser64.exe
                    • Size 2.7MB
                    • SHA256 046e67e9d127a468311255f0218cac07cbba765528e481f65b07b2b110a58dd8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SodaDownloader.exe
                    • Path C:\Users\Admin\AppData\Roaming\360FileBrowser\SodaDownloader.exe
                    • Size 1.4MB
                    • SHA256 06bb07ccaf1b28ab07bf1f71fa3f4f1a8781477b55a16fd39a76484b0450e23f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AiDownloader.exe
                    • Path C:\Users\Admin\AppData\Roaming\AiLoginServer\AiDownloader.exe
                    • Size 1.5MB
                    • SHA256 5c5380d9aef0da67c52ca71f867c21d4336ad6b2dfb0c0e4b06c3b9001ca5628
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WebView.exe
                    • Path C:\Users\Admin\AppData\Roaming\AiLoginServer\SoftMgr\WebView.exe
                    • Size 677KB
                    • SHA256 fac53f9ec9977a67aa459a49be9da5d10790876248cdbb4a09a693ddb4bb8710
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    360Base.dll
                    • Path C:\Users\Admin\AppData\Roaming\CPInstaller\360Base.dll
                    • Size 1.0MB
                    • SHA256 bb3e4d039b6eb41bb9df9918bb46f1ead6e4d3e3b3d87c41f62c75cfd9a0ca19
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    360NetBase.dll
                    • Path C:\Users\Admin\AppData\Roaming\CPInstaller\360NetBase.dll
                    • Size 1.5MB
                    • SHA256 7cc688946ca5af48cb07b21445aef331d5bdd4f00100434454956511e4e9d344
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    360P2SP.dll
                    • Path C:\Users\Admin\AppData\Roaming\CPInstaller\360P2SP.dll
                    • Size 710KB
                    • SHA256 97d64da963d2fc4f159ed425d6f02de82135cacb2040ae6e10cd1ce80b883ebb
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    CPInstaller.ini
                    • Path C:\Users\Admin\AppData\Roaming\CPInstaller\CPInstaller.ini
                    • Size 464B
                    • SHA256 2de76a374e2244fe8b1d52a0a0d5a90a612a315e7285df72c78c7808c312db0a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    checkbox.png
                    • Path C:\Users\Admin\AppData\Roaming\CPInstaller\Common\checkbox.png
                    • Size 609B
                    • SHA256 f30a76bb37065fe76767cb69cf7deae11c0bcec5298685cf9fbe62976f51dd8f
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    360压缩.exe
                    • Path C:\Users\Admin\AppData\Roaming\CPInstaller\DownLoad\360压缩.exe
                    • Size 17.0MB
                    • SHA256 5ccb093b750f727bf6b90729012771e5a5fc1923a1e58656910a80bc67bbeb62
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    360文件夹.exe
                    • Path C:\Users\Admin\AppData\Roaming\CPInstaller\DownLoad\360文件夹.exe
                    • Size 17.2MB
                    • SHA256 148f47df9e649e309315401bd2e85549cc21e800edbe34284023b5b185d352e8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    360桌面助手.exe
                    • Path C:\Users\Admin\AppData\Roaming\CPInstaller\DownLoad\360桌面助手.exe
                    • Size 16.1MB
                    • SHA256 4292b8d226901a8a779e3312e37779b86ca8f46aa67c8a5afed104d12e7732d4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MiniUI.CAB
                    • Path C:\Users\Admin\AppData\Roaming\CPInstaller\MiniUI.CAB
                    • Size 451KB
                    • SHA256 886cfe7c6b0d8304f0d6e664f551116ee9a438fa018e0c68aea18a23398e3736
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MiniUI.dll
                    • Path C:\Users\Admin\AppData\Roaming\CPInstaller\MiniUI.dll
                    • Size 899KB
                    • SHA256 f11ecd6c4d6fa4c9c17d3260fda4b320e77dccbac9113679f06c1f53aadf4a68
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MiniUI.xml
                    • Path C:\Users\Admin\AppData\Roaming\CPInstaller\MiniUI.xml
                    • Size 464B
                    • SHA256 ca05d4161c0503cf03524fe5017dffa2f4d44f08ecd433b2ae2804d8148ca880
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    360DesktopLite.exe
                    • Path C:\Users\Admin\AppData\Roaming\DesktopLite\360DesktopLite.exe
                    • Size 3.4MB
                    • SHA256 90801876ce96c24ef6aafa40ca0e39dee9d864222736b51b4f12c99ad07122fd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    360DesktopService64.exe
                    • Path C:\Users\Admin\AppData\Roaming\DesktopLite\360DesktopService64.exe
                    • Size 197KB
                    • SHA256 9cf5b4ea9fa8f53e59e529f57c7a32b455023db9a7366cd9fcae131cc641d441
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    360NetUL.dll
                    • Path C:\Users\Admin\AppData\Roaming\DesktopLite\360NetUL.dll
                    • Size 239KB
                    • SHA256 e692bb1cabb48bd7652f7fcc17c10f0c421304677128e199347ca54c75340ce5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Uninstall.uiz
                    • Path C:\Users\Admin\AppData\Roaming\DesktopLite\config\newui\themes\default\Uninstall\Uninstall.uiz
                    • Size 595KB
                    • SHA256 211cba4be87cc96c11bb2a8483f79af65a829f558f088d312219e3741e6bfe1d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    {F217C11F-BC59-4948-BA2C-CB244C34ED80}.tmp
                    • Path C:\Users\Admin\AppData\Roaming\{F217C11F-BC59-4948-BA2C-CB244C34ED80}.tmp
                    • Size 371KB
                    • SHA256 af6249e9723e2be7e9c5e01516fe37e15b0f74bb5dd6d459e4c4f5b59606c18c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    桌面助手.lnk
                    • Path C:\Users\Admin\Desktop\桌面助手.lnk
                    • Size 1KB
                    • SHA256 4f18429023ed6d3f23a7443db645e91eb2944af346380a6cdd0cc583c8121afc
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    360FileService.exe
                    • Path C:\Windows\SysWOW64\360FileService.exe
                    • Size 218KB
                    • SHA256 74c7e43b6002f45564bd354c246af0ebc814e15e6c9cf9e93862e5350f4aae85
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/1212-75-0x00000000043E0000-0x00000000043E1000-memory.dmp
                    Download

                    memory/1212-85-0x00000000043E0000-0x00000000043E1000-memory.dmp
                    Download

                    memory/1604-2109-0x000000006FA10000-0x000000006FA20000-memory.dmp
                    Download