Analysis
-
max time kernel
150s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 21:44
Static task
static1
Behavioral task
behavioral1
Sample
5a4910267d536ebda33f150cb26541d6240f9091f7876dbcb5e306f2e1a455a5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5a4910267d536ebda33f150cb26541d6240f9091f7876dbcb5e306f2e1a455a5.exe
Resource
win10v2004-20221111-en
General
-
Target
5a4910267d536ebda33f150cb26541d6240f9091f7876dbcb5e306f2e1a455a5.exe
-
Size
13.5MB
-
MD5
82de2c037ea20081eb8c9d4af793370e
-
SHA1
315ccb188e31d380e6898b27c6cfe14c234cb2fa
-
SHA256
5a4910267d536ebda33f150cb26541d6240f9091f7876dbcb5e306f2e1a455a5
-
SHA512
5f4268f32917dd66bc825be314fa5775e450b90b8cda278e471350cc07649eafda38a22562d1dcf2063387393abc80332d2dcc645994045cac68d5679a495941
-
SSDEEP
393216:5RnaDbX91KXjBO7EFTejMe/r8GEtbF5bPt5M2CsveW:z8bN1m1O4FCMe/wHbPkcvp
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 6 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\{265A8BCB-E9D1-44BA-9FD8-63878A7DA1B0}\Disk1\ISSetup.dll acprotect C:\Users\Admin\AppData\Local\Temp\{265A8BCB-E9D1-44BA-9FD8-63878A7DA1B0}\Disk1\ISSetup.dll acprotect C:\Users\Admin\AppData\Local\Temp\{8DEF7C07-501A-4F02-9264-16E37B72B880}\{C6DB1A2A-DD1A-4947-A0E1-0B305F5180E5}\isrt.dll acprotect C:\Users\Admin\AppData\Local\Temp\{8DEF7C07-501A-4F02-9264-16E37B72B880}\{C6DB1A2A-DD1A-4947-A0E1-0B305F5180E5}\isrt.dll acprotect C:\Users\Admin\AppData\Local\Temp\{8DEF7C07-501A-4F02-9264-16E37B72B880}\{C6DB1A2A-DD1A-4947-A0E1-0B305F5180E5}\_IsRes.dll acprotect C:\Users\Admin\AppData\Local\Temp\{8DEF7C07-501A-4F02-9264-16E37B72B880}\{C6DB1A2A-DD1A-4947-A0E1-0B305F5180E5}\_IsRes.dll acprotect -
Executes dropped EXE 5 IoCs
Processes:
qpgarne.exeqpgaime.exeqpgame.exeqpstars.exeISBEW64.exepid process 3696 qpgarne.exe 3620 qpgaime.exe 4224 qpgame.exe 4316 qpstars.exe 2376 ISBEW64.exe -
Possible privilege escalation attempt 12 IoCs
Processes:
icacls.exetakeown.exetakeown.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exetakeown.exepid process 3348 icacls.exe 364 takeown.exe 4664 takeown.exe 692 takeown.exe 2380 icacls.exe 4572 takeown.exe 4284 icacls.exe 1040 icacls.exe 3708 icacls.exe 2424 icacls.exe 2436 takeown.exe 2108 takeown.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qpgarne.exe upx C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qpgarne.exe upx behavioral2/memory/3696-135-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral2/memory/3696-142-0x0000000000400000-0x0000000000419000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\{265A8BCB-E9D1-44BA-9FD8-63878A7DA1B0}\Disk1\ISSetup.dll upx C:\Users\Admin\AppData\Local\Temp\{265A8BCB-E9D1-44BA-9FD8-63878A7DA1B0}\Disk1\ISSetup.dll upx behavioral2/memory/4316-158-0x0000000002570000-0x0000000002707000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\{8DEF7C07-501A-4F02-9264-16E37B72B880}\{C6DB1A2A-DD1A-4947-A0E1-0B305F5180E5}\isrt.dll upx C:\Users\Admin\AppData\Local\Temp\{8DEF7C07-501A-4F02-9264-16E37B72B880}\{C6DB1A2A-DD1A-4947-A0E1-0B305F5180E5}\isrt.dll upx C:\Users\Admin\AppData\Local\Temp\{8DEF7C07-501A-4F02-9264-16E37B72B880}\{C6DB1A2A-DD1A-4947-A0E1-0B305F5180E5}\_IsRes.dll upx C:\Users\Admin\AppData\Local\Temp\{8DEF7C07-501A-4F02-9264-16E37B72B880}\{C6DB1A2A-DD1A-4947-A0E1-0B305F5180E5}\_IsRes.dll upx behavioral2/memory/4316-170-0x0000000003640000-0x00000000036CE000-memory.dmp upx behavioral2/memory/4316-171-0x0000000003A00000-0x0000000003A49000-memory.dmp upx behavioral2/memory/4316-181-0x0000000002570000-0x0000000002707000-memory.dmp upx behavioral2/memory/4316-208-0x0000000003640000-0x00000000036CE000-memory.dmp upx -
Loads dropped DLL 10 IoCs
Processes:
qpstars.exepid process 4316 qpstars.exe 4316 qpstars.exe 4316 qpstars.exe 4316 qpstars.exe 4316 qpstars.exe 4316 qpstars.exe 4316 qpstars.exe 4316 qpstars.exe 4316 qpstars.exe 4316 qpstars.exe -
Modifies file permissions 1 TTPs 12 IoCs
Processes:
takeown.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exeicacls.exepid process 4572 takeown.exe 2436 takeown.exe 3348 icacls.exe 2108 takeown.exe 1040 icacls.exe 364 takeown.exe 3708 icacls.exe 692 takeown.exe 2424 icacls.exe 4284 icacls.exe 4664 takeown.exe 2380 icacls.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5a4910267d536ebda33f150cb26541d6240f9091f7876dbcb5e306f2e1a455a5.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5a4910267d536ebda33f150cb26541d6240f9091f7876dbcb5e306f2e1a455a5.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5a4910267d536ebda33f150cb26541d6240f9091f7876dbcb5e306f2e1a455a5.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 14 IoCs
Processes:
qpgame.exeqpgaime.exedescription ioc process File opened for modification C:\Windows\SysWOW64\1238A8E.tmp qpgame.exe File opened for modification C:\Windows\SysWOW64\1235C17.tmp qpgame.exe File opened for modification C:\Windows\SysWOW64\1235C18.tmp qpgaime.exe File opened for modification C:\Windows\SysWOW64\1238069.tmp qpgame.exe File opened for modification C:\Windows\SysWOW64\dllcache\iphlpapi.dll qpgaime.exe File created C:\Windows\SysWOW64\dllcache\rasadhlp.dll qpgame.exe File opened for modification C:\Windows\SysWOW64\dllcache\midimap.dll qpgaime.exe File opened for modification C:\Windows\SysWOW64\dllcache\rasadhlp.dll qpgaime.exe File created C:\Windows\SysWOW64\dllcache\midimap.dll qpgame.exe File opened for modification C:\Windows\SysWOW64\1238A8F.tmp qpgaime.exe File created C:\Windows\SysWOW64\dllcache\iphlpapi.dll qpgame.exe File opened for modification C:\Windows\SysWOW64\12380D6.tmp qpgaime.exe File created C:\Windows\SysWOW64\sxload.tmp qpgame.exe File opened for modification C:\Windows\SysWOW64\sxload.tmp qpgaime.exe -
Drops file in Program Files directory 2 IoCs
Processes:
qpgame.exeqpgaime.exedescription ioc process File created C:\Program Files (x86)\Common Files\sxqp.tmp qpgame.exe File opened for modification C:\Program Files (x86)\Common Files\sxqp.tmp qpgaime.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 3076 taskkill.exe 4120 taskkill.exe -
Modifies registry class 24 IoCs
Processes:
qpstars.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B90789A-10ED-4F8A-B537-8AB74FED0023} qpstars.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B90789A-10ED-4F8A-B537-8AB74FED0023}\1.0 qpstars.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B90789A-10ED-4F8A-B537-8AB74FED0023}\1.0\ = "ISENG64Lib" qpstars.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B90789A-10ED-4F8A-B537-8AB74FED0023}\1.0\0\win32\ = "C:\\ProgramData\\InstallShield\\ISEngine12.0\\IsBE.dll" qpstars.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B90789A-10ED-4F8A-B537-8AB74FED0023}\1.0\HELPDIR qpstars.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{101A9FA5-98CB-4AC3-B67C-3DC040C45996}\ProxyStubClsid32 qpstars.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{101A9FA5-98CB-4AC3-B67C-3DC040C45996}\TypeLib qpstars.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{101A9FA5-98CB-4AC3-B67C-3DC040C45996}\TypeLib qpstars.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{101A9FA5-98CB-4AC3-B67C-3DC040C45996}\TypeLib\Version = "1.0" qpstars.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B90789A-10ED-4F8A-B537-8AB74FED0023}\1.0\FLAGS qpstars.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{101A9FA5-98CB-4AC3-B67C-3DC040C45996} qpstars.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{101A9FA5-98CB-4AC3-B67C-3DC040C45996} qpstars.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B90789A-10ED-4F8A-B537-8AB74FED0023}\1.0\FLAGS\ = "0" qpstars.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B90789A-10ED-4F8A-B537-8AB74FED0023}\1.0\0\win32 qpstars.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{101A9FA5-98CB-4AC3-B67C-3DC040C45996}\TypeLib\ = "{7B90789A-10ED-4F8A-B537-8AB74FED0023}" qpstars.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{101A9FA5-98CB-4AC3-B67C-3DC040C45996}\TypeLib\Version = "1.0" qpstars.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{101A9FA5-98CB-4AC3-B67C-3DC040C45996}\TypeLib\ = "{7B90789A-10ED-4F8A-B537-8AB74FED0023}" qpstars.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B90789A-10ED-4F8A-B537-8AB74FED0023}\1.0\0 qpstars.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B90789A-10ED-4F8A-B537-8AB74FED0023}\1.0\HELPDIR\ = "C:\\ProgramData\\InstallShield\\ISEngine12.0" qpstars.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{101A9FA5-98CB-4AC3-B67C-3DC040C45996}\ = "IISBEW64Utils" qpstars.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{101A9FA5-98CB-4AC3-B67C-3DC040C45996}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" qpstars.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{101A9FA5-98CB-4AC3-B67C-3DC040C45996}\ = "IISBEW64Utils" qpstars.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{101A9FA5-98CB-4AC3-B67C-3DC040C45996}\ProxyStubClsid32 qpstars.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{101A9FA5-98CB-4AC3-B67C-3DC040C45996}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" qpstars.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
qpgame.exeqpgaime.exepid process 4224 qpgame.exe 4224 qpgame.exe 3620 qpgaime.exe 3620 qpgaime.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
qpgaime.exeqpgame.exetakeown.exetakeown.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 3620 qpgaime.exe Token: SeDebugPrivilege 4224 qpgame.exe Token: SeTakeOwnershipPrivilege 4572 takeown.exe Token: SeTakeOwnershipPrivilege 2436 takeown.exe Token: SeDebugPrivilege 4120 taskkill.exe Token: SeDebugPrivilege 3076 taskkill.exe -
Suspicious use of FindShellTrayWindow 24 IoCs
Processes:
qpgaime.exeqpgame.exepid process 3620 qpgaime.exe 4224 qpgame.exe 4224 qpgame.exe 3620 qpgaime.exe 4224 qpgame.exe 4224 qpgame.exe 3620 qpgaime.exe 3620 qpgaime.exe 4224 qpgame.exe 3620 qpgaime.exe 3620 qpgaime.exe 4224 qpgame.exe 4224 qpgame.exe 4224 qpgame.exe 3620 qpgaime.exe 3620 qpgaime.exe 4224 qpgame.exe 3620 qpgaime.exe 4224 qpgame.exe 3620 qpgaime.exe 4224 qpgame.exe 3620 qpgaime.exe 4224 qpgame.exe 3620 qpgaime.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5a4910267d536ebda33f150cb26541d6240f9091f7876dbcb5e306f2e1a455a5.exeqpgarne.exeqpgaime.exeqpgame.execmd.execmd.execmd.execmd.exeqpstars.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2480 wrote to memory of 3696 2480 5a4910267d536ebda33f150cb26541d6240f9091f7876dbcb5e306f2e1a455a5.exe qpgarne.exe PID 2480 wrote to memory of 3696 2480 5a4910267d536ebda33f150cb26541d6240f9091f7876dbcb5e306f2e1a455a5.exe qpgarne.exe PID 2480 wrote to memory of 3696 2480 5a4910267d536ebda33f150cb26541d6240f9091f7876dbcb5e306f2e1a455a5.exe qpgarne.exe PID 3696 wrote to memory of 3620 3696 qpgarne.exe qpgaime.exe PID 3696 wrote to memory of 3620 3696 qpgarne.exe qpgaime.exe PID 3696 wrote to memory of 3620 3696 qpgarne.exe qpgaime.exe PID 3696 wrote to memory of 4224 3696 qpgarne.exe qpgame.exe PID 3696 wrote to memory of 4224 3696 qpgarne.exe qpgame.exe PID 3696 wrote to memory of 4224 3696 qpgarne.exe qpgame.exe PID 3620 wrote to memory of 4980 3620 qpgaime.exe cmd.exe PID 3620 wrote to memory of 4980 3620 qpgaime.exe cmd.exe PID 3620 wrote to memory of 4980 3620 qpgaime.exe cmd.exe PID 4224 wrote to memory of 4272 4224 qpgame.exe cmd.exe PID 4224 wrote to memory of 4272 4224 qpgame.exe cmd.exe PID 4224 wrote to memory of 4272 4224 qpgame.exe cmd.exe PID 4980 wrote to memory of 2144 4980 cmd.exe cmd.exe PID 4980 wrote to memory of 2144 4980 cmd.exe cmd.exe PID 4980 wrote to memory of 2144 4980 cmd.exe cmd.exe PID 2480 wrote to memory of 4316 2480 5a4910267d536ebda33f150cb26541d6240f9091f7876dbcb5e306f2e1a455a5.exe qpstars.exe PID 2480 wrote to memory of 4316 2480 5a4910267d536ebda33f150cb26541d6240f9091f7876dbcb5e306f2e1a455a5.exe qpstars.exe PID 2480 wrote to memory of 4316 2480 5a4910267d536ebda33f150cb26541d6240f9091f7876dbcb5e306f2e1a455a5.exe qpstars.exe PID 4272 wrote to memory of 1828 4272 cmd.exe cmd.exe PID 4272 wrote to memory of 1828 4272 cmd.exe cmd.exe PID 4272 wrote to memory of 1828 4272 cmd.exe cmd.exe PID 2144 wrote to memory of 4572 2144 cmd.exe takeown.exe PID 2144 wrote to memory of 4572 2144 cmd.exe takeown.exe PID 2144 wrote to memory of 4572 2144 cmd.exe takeown.exe PID 1828 wrote to memory of 2436 1828 cmd.exe takeown.exe PID 1828 wrote to memory of 2436 1828 cmd.exe takeown.exe PID 1828 wrote to memory of 2436 1828 cmd.exe takeown.exe PID 4272 wrote to memory of 3348 4272 cmd.exe icacls.exe PID 4980 wrote to memory of 4284 4980 cmd.exe icacls.exe PID 4272 wrote to memory of 3348 4272 cmd.exe icacls.exe PID 4272 wrote to memory of 3348 4272 cmd.exe icacls.exe PID 4980 wrote to memory of 4284 4980 cmd.exe icacls.exe PID 4980 wrote to memory of 4284 4980 cmd.exe icacls.exe PID 4316 wrote to memory of 2376 4316 qpstars.exe ISBEW64.exe PID 4316 wrote to memory of 2376 4316 qpstars.exe ISBEW64.exe PID 4224 wrote to memory of 4992 4224 qpgame.exe cmd.exe PID 4224 wrote to memory of 4992 4224 qpgame.exe cmd.exe PID 4224 wrote to memory of 4992 4224 qpgame.exe cmd.exe PID 3620 wrote to memory of 2304 3620 qpgaime.exe cmd.exe PID 3620 wrote to memory of 2304 3620 qpgaime.exe cmd.exe PID 3620 wrote to memory of 2304 3620 qpgaime.exe cmd.exe PID 4992 wrote to memory of 5064 4992 cmd.exe cmd.exe PID 4992 wrote to memory of 5064 4992 cmd.exe cmd.exe PID 4992 wrote to memory of 5064 4992 cmd.exe cmd.exe PID 5064 wrote to memory of 2108 5064 cmd.exe takeown.exe PID 5064 wrote to memory of 2108 5064 cmd.exe takeown.exe PID 5064 wrote to memory of 2108 5064 cmd.exe takeown.exe PID 2304 wrote to memory of 2664 2304 cmd.exe cmd.exe PID 2304 wrote to memory of 2664 2304 cmd.exe cmd.exe PID 2304 wrote to memory of 2664 2304 cmd.exe cmd.exe PID 4992 wrote to memory of 1040 4992 cmd.exe icacls.exe PID 4992 wrote to memory of 1040 4992 cmd.exe icacls.exe PID 4992 wrote to memory of 1040 4992 cmd.exe icacls.exe PID 2664 wrote to memory of 364 2664 cmd.exe takeown.exe PID 2664 wrote to memory of 364 2664 cmd.exe takeown.exe PID 2664 wrote to memory of 364 2664 cmd.exe takeown.exe PID 2304 wrote to memory of 3708 2304 cmd.exe icacls.exe PID 2304 wrote to memory of 3708 2304 cmd.exe icacls.exe PID 2304 wrote to memory of 3708 2304 cmd.exe icacls.exe PID 4224 wrote to memory of 644 4224 qpgame.exe cmd.exe PID 4224 wrote to memory of 644 4224 qpgame.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a4910267d536ebda33f150cb26541d6240f9091f7876dbcb5e306f2e1a455a5.exe"C:\Users\Admin\AppData\Local\Temp\5a4910267d536ebda33f150cb26541d6240f9091f7876dbcb5e306f2e1a455a5.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qpgarne.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qpgarne.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\qpgaime.exe"C:\Users\Admin\AppData\Roaming\qpgaime.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 2.bat4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f "C:\Windows\System32"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32"6⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32" /grant administrators:F5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 2.bat4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f "C:\Windows\System32"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32"6⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32" /grant administrators:F5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 2.bat4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f "C:\Windows\System32"5⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32" /grant administrators:F5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "hall.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 1.bat4⤵
-
C:\Users\Admin\AppData\Roaming\qpgame.exe"C:\Users\Admin\AppData\Roaming\qpgame.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 2.bat4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f "C:\Windows\System32"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32"6⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32" /grant administrators:F5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 2.bat4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f "C:\Windows\System32"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32"6⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32" /grant administrators:F5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 2.bat4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f "C:\Windows\System32"5⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32" /grant administrators:F5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "hall.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 1.bat4⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qpstars.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qpstars.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{8DEF7C07-501A-4F02-9264-16E37B72B880}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{8DEF7C07-501A-4F02-9264-16E37B72B880}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5CC842A8-3322-463B-A2D5-EFDD1EFF16B2}3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32"1⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32"1⤵
- Possible privilege escalation attempt
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\sxqp.tmpFilesize
55KB
MD558ee791c522b4ab2749e716644ff29c3
SHA1be0c1af57af5284f42edfabf1847e6376ed3c67e
SHA25676495990967fd184d0682dc7215f72f78c4cf8301734956bac224ef20d90c733
SHA51267a6caed931fba857d5286116ee38cce53821cb1b30ee7b9f4cfd3ee2ee76e5266406314d394202cc9d7c1831d4b376bc9f8014c0957570cb3cdb06ed84a0ad0
-
C:\ProgramData\InstallShield\ISEngine12.0\IsBE.dllFilesize
52KB
MD59cf7faee57a20bf15a2fc9b423ebc512
SHA112cbf4d0a941bd5a8f847754fdaf4841e7751cce
SHA256d34f26d85bfb94a5f017fdaf58b94ecf9553919d2aa9a9955ff0a2e3d7c11e4a
SHA51244c715be4a98b9ce99c6d926500be3e365f8a08a4d8c85ae9342dc9ce76de29544f14acbf42d69f7f9e40ebdf0c6faa8cb5d4b3fc9d523479b12cf0823678672
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.batFilesize
260B
MD5ebf5cd4412c770fb62a71d468cf525e8
SHA1dad601802c75e477055041072277e55e1146b4b4
SHA25692479588ed04dc0ca1e08c938e8fc7b1f55e0ae69c2e55849959539ed0b71a5a
SHA512e856f628a20bb18ee1e7aaae35efb6b4f4776264cd3bfc09bb197b81dda9167b14ae77615f7b4d0255449462118207f0bc79f8606096fc0423f8dce4da9f8aa4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.batFilesize
260B
MD5ebf5cd4412c770fb62a71d468cf525e8
SHA1dad601802c75e477055041072277e55e1146b4b4
SHA25692479588ed04dc0ca1e08c938e8fc7b1f55e0ae69c2e55849959539ed0b71a5a
SHA512e856f628a20bb18ee1e7aaae35efb6b4f4776264cd3bfc09bb197b81dda9167b14ae77615f7b4d0255449462118207f0bc79f8606096fc0423f8dce4da9f8aa4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.batFilesize
110B
MD512e768a105dc0d143a5f5becdd12167a
SHA18f82f11fc9b8921b1a80eb23b600d243a8756766
SHA2560f909a1c0e0cddb3f99f0a7bac66a86797f25635b15fb25faa0bffcc5e702056
SHA5123ba416aa4d0575fe281b24b1cc7401254ad2c38de37b340a780e8796f34738d48f6a89801596bbfaed009c1fb74255cf0caf49997cf1e679ea6075b02b758c77
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.batFilesize
110B
MD512e768a105dc0d143a5f5becdd12167a
SHA18f82f11fc9b8921b1a80eb23b600d243a8756766
SHA2560f909a1c0e0cddb3f99f0a7bac66a86797f25635b15fb25faa0bffcc5e702056
SHA5123ba416aa4d0575fe281b24b1cc7401254ad2c38de37b340a780e8796f34738d48f6a89801596bbfaed009c1fb74255cf0caf49997cf1e679ea6075b02b758c77
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.batFilesize
110B
MD512e768a105dc0d143a5f5becdd12167a
SHA18f82f11fc9b8921b1a80eb23b600d243a8756766
SHA2560f909a1c0e0cddb3f99f0a7bac66a86797f25635b15fb25faa0bffcc5e702056
SHA5123ba416aa4d0575fe281b24b1cc7401254ad2c38de37b340a780e8796f34738d48f6a89801596bbfaed009c1fb74255cf0caf49997cf1e679ea6075b02b758c77
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.batFilesize
110B
MD512e768a105dc0d143a5f5becdd12167a
SHA18f82f11fc9b8921b1a80eb23b600d243a8756766
SHA2560f909a1c0e0cddb3f99f0a7bac66a86797f25635b15fb25faa0bffcc5e702056
SHA5123ba416aa4d0575fe281b24b1cc7401254ad2c38de37b340a780e8796f34738d48f6a89801596bbfaed009c1fb74255cf0caf49997cf1e679ea6075b02b758c77
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.batFilesize
110B
MD512e768a105dc0d143a5f5becdd12167a
SHA18f82f11fc9b8921b1a80eb23b600d243a8756766
SHA2560f909a1c0e0cddb3f99f0a7bac66a86797f25635b15fb25faa0bffcc5e702056
SHA5123ba416aa4d0575fe281b24b1cc7401254ad2c38de37b340a780e8796f34738d48f6a89801596bbfaed009c1fb74255cf0caf49997cf1e679ea6075b02b758c77
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.batFilesize
110B
MD512e768a105dc0d143a5f5becdd12167a
SHA18f82f11fc9b8921b1a80eb23b600d243a8756766
SHA2560f909a1c0e0cddb3f99f0a7bac66a86797f25635b15fb25faa0bffcc5e702056
SHA5123ba416aa4d0575fe281b24b1cc7401254ad2c38de37b340a780e8796f34738d48f6a89801596bbfaed009c1fb74255cf0caf49997cf1e679ea6075b02b758c77
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qpgarne.exeFilesize
97KB
MD5374aeda833a2fdb958c0df8f457ae115
SHA1cfeb839135b642a2f1b82e28e7f77e245777f85e
SHA2566cbb0e564c277667eaccf1b19d679f274d5c75eecf87b3cc2ac4a07b795f078d
SHA512055f3232ee3ef6ad65ff3fc09ea3b801ae48666d203b2fb79bdb8e7af1d047b8386fddba3237c11dfacc10a1eda07694e40cb67e2001f58390b15b7d9fc40ffc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qpgarne.exeFilesize
97KB
MD5374aeda833a2fdb958c0df8f457ae115
SHA1cfeb839135b642a2f1b82e28e7f77e245777f85e
SHA2566cbb0e564c277667eaccf1b19d679f274d5c75eecf87b3cc2ac4a07b795f078d
SHA512055f3232ee3ef6ad65ff3fc09ea3b801ae48666d203b2fb79bdb8e7af1d047b8386fddba3237c11dfacc10a1eda07694e40cb67e2001f58390b15b7d9fc40ffc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qpstars.exeFilesize
14.5MB
MD5304ad8ada59cf485e15b9853a1194e92
SHA1f654980a4931b2f4582ea248d95eaf002589ca6d
SHA256cbc5afc6ea85869f3bdffcc5a7b3b03cb056601e698debd7a6d49939c0d14d49
SHA512e7b6be2c86adf396b5a138d2f90aa99362dddd037f067e6396fafb8a7cb2ef3794d954c39df6f584b9578ead88f425034d99d1f6f6690341796734534aeebee0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qpstars.exeFilesize
14.5MB
MD5304ad8ada59cf485e15b9853a1194e92
SHA1f654980a4931b2f4582ea248d95eaf002589ca6d
SHA256cbc5afc6ea85869f3bdffcc5a7b3b03cb056601e698debd7a6d49939c0d14d49
SHA512e7b6be2c86adf396b5a138d2f90aa99362dddd037f067e6396fafb8a7cb2ef3794d954c39df6f584b9578ead88f425034d99d1f6f6690341796734534aeebee0
-
C:\Users\Admin\AppData\Local\Temp\{265A8BCB-E9D1-44BA-9FD8-63878A7DA1B0}\Disk1\ISSetup.dllFilesize
539KB
MD5708814a62ba813cea1a94bb77d68195b
SHA139c99a215751832481dc9b2ac2d6dbb17435195d
SHA256999c523b3e43f399966a49f3caeb2a7d8ccb39d5911dfe71fd15a6a0aa2b87fe
SHA512426cd1a12e42212ff541b3bd9c239282d548596487929b17c657056958d71a77fce209c5daa606af4d0eb6c5f74779b6d332997d00e71f6ec80fd18407c57bd3
-
C:\Users\Admin\AppData\Local\Temp\{265A8BCB-E9D1-44BA-9FD8-63878A7DA1B0}\Disk1\ISSetup.dllFilesize
539KB
MD5708814a62ba813cea1a94bb77d68195b
SHA139c99a215751832481dc9b2ac2d6dbb17435195d
SHA256999c523b3e43f399966a49f3caeb2a7d8ccb39d5911dfe71fd15a6a0aa2b87fe
SHA512426cd1a12e42212ff541b3bd9c239282d548596487929b17c657056958d71a77fce209c5daa606af4d0eb6c5f74779b6d332997d00e71f6ec80fd18407c57bd3
-
C:\Users\Admin\AppData\Local\Temp\{265A8BCB-E9D1-44BA-9FD8-63878A7DA1B0}\_Setup.dllFilesize
376KB
MD52985a79020ec96afc2d1c8ab318b866f
SHA101e801eaa82ace4d521c651dadddacfb4fb278d9
SHA256f9a007b9ec4a20fecfc004662028226e11ada038be69eab586c03a903c73fbad
SHA512b496d72a942d3f95a062807fdd7c487d836e2c850ec5422967fbb5fe5bdb467806be24b09fa1ee035494e73ed9725e2fa441ec807d94423e873abef8eae94b55
-
C:\Users\Admin\AppData\Local\Temp\{265A8BCB-E9D1-44BA-9FD8-63878A7DA1B0}\_Setup.dllFilesize
376KB
MD52985a79020ec96afc2d1c8ab318b866f
SHA101e801eaa82ace4d521c651dadddacfb4fb278d9
SHA256f9a007b9ec4a20fecfc004662028226e11ada038be69eab586c03a903c73fbad
SHA512b496d72a942d3f95a062807fdd7c487d836e2c850ec5422967fbb5fe5bdb467806be24b09fa1ee035494e73ed9725e2fa441ec807d94423e873abef8eae94b55
-
C:\Users\Admin\AppData\Local\Temp\{8DEF7C07-501A-4F02-9264-16E37B72B880}\ISBEW64.exeFilesize
68KB
MD54b56c021299344676f123fcb48f53c1e
SHA1cbef3152c477c9176120030b164a4a807b527d8e
SHA2560444971c7c19df0c4e5f8ad75c12ac277638470460eb7747122539960ed5e99f
SHA512097bbc9f0140e9a14e494b6569e38b88ad390d6befa03e75a8c671e2e5fd93ee55ad50994733c957c32c85f2061d6f4d32b4b8257b3b44d5924ca10e940f779a
-
C:\Users\Admin\AppData\Local\Temp\{8DEF7C07-501A-4F02-9264-16E37B72B880}\ISBEW64.exeFilesize
68KB
MD54b56c021299344676f123fcb48f53c1e
SHA1cbef3152c477c9176120030b164a4a807b527d8e
SHA2560444971c7c19df0c4e5f8ad75c12ac277638470460eb7747122539960ed5e99f
SHA512097bbc9f0140e9a14e494b6569e38b88ad390d6befa03e75a8c671e2e5fd93ee55ad50994733c957c32c85f2061d6f4d32b4b8257b3b44d5924ca10e940f779a
-
C:\Users\Admin\AppData\Local\Temp\{8DEF7C07-501A-4F02-9264-16E37B72B880}\{C6DB1A2A-DD1A-4947-A0E1-0B305F5180E5}\_ISUser.dllFilesize
160KB
MD5efa7734e44fb5ea4f7142069727fd7d4
SHA166117a2c5a6c5c2d9773cabb2d7f138344a6511b
SHA25672bf7d6529cbd30b5d532c7792b7e1b048d60bb2d8b59d19a1afd5f8122318ed
SHA512d054ce60e04d8e45bde23c34a16baa3320559c6fb2722b5a87997c2d5043d950a2764dbb0b649fe695886e66ee19638c3ae5fb31941fa54b9aa517521e20d38f
-
C:\Users\Admin\AppData\Local\Temp\{8DEF7C07-501A-4F02-9264-16E37B72B880}\{C6DB1A2A-DD1A-4947-A0E1-0B305F5180E5}\_ISUser.dllFilesize
160KB
MD5efa7734e44fb5ea4f7142069727fd7d4
SHA166117a2c5a6c5c2d9773cabb2d7f138344a6511b
SHA25672bf7d6529cbd30b5d532c7792b7e1b048d60bb2d8b59d19a1afd5f8122318ed
SHA512d054ce60e04d8e45bde23c34a16baa3320559c6fb2722b5a87997c2d5043d950a2764dbb0b649fe695886e66ee19638c3ae5fb31941fa54b9aa517521e20d38f
-
C:\Users\Admin\AppData\Local\Temp\{8DEF7C07-501A-4F02-9264-16E37B72B880}\{C6DB1A2A-DD1A-4947-A0E1-0B305F5180E5}\_IsRes.dllFilesize
82KB
MD572927c6e0d47e9f9f99977834e95e30f
SHA13ce88569ec60b41ad2c9ceea9db88d7af16887ac
SHA256ed4790f99f36678635aefc403e3ff89e7f2b116fbdf3add1bc7c3f4ff914b6fe
SHA512793e0f9b9dda2cda72e43877156b85fcc8f0c436f6b12bc0fdd3cee66eee44d41f92ba3e82b1249866b9db84c8b93254080b05d948f25d25c3b94596707220a4
-
C:\Users\Admin\AppData\Local\Temp\{8DEF7C07-501A-4F02-9264-16E37B72B880}\{C6DB1A2A-DD1A-4947-A0E1-0B305F5180E5}\_IsRes.dllFilesize
82KB
MD572927c6e0d47e9f9f99977834e95e30f
SHA13ce88569ec60b41ad2c9ceea9db88d7af16887ac
SHA256ed4790f99f36678635aefc403e3ff89e7f2b116fbdf3add1bc7c3f4ff914b6fe
SHA512793e0f9b9dda2cda72e43877156b85fcc8f0c436f6b12bc0fdd3cee66eee44d41f92ba3e82b1249866b9db84c8b93254080b05d948f25d25c3b94596707220a4
-
C:\Users\Admin\AppData\Local\Temp\{8DEF7C07-501A-4F02-9264-16E37B72B880}\{C6DB1A2A-DD1A-4947-A0E1-0B305F5180E5}\isrt.dllFilesize
203KB
MD5b35dde51d14f9400e73196693148734e
SHA19410c5268f5558e57d044780d0d5dcc7aa181299
SHA25670fa7f0aa2feb397597b2785a4bfdb2c9cd36e0edb51f4f0dfe6ac086290ac86
SHA5126bb24c8864078c923007c1818bb0a590ebe84e2fbe6f2642dc951b05c42da1c33861f150c4ea8943657259c1c309a69b8cb1817b6a207cb9e577bc3aa8bfa79d
-
C:\Users\Admin\AppData\Local\Temp\{8DEF7C07-501A-4F02-9264-16E37B72B880}\{C6DB1A2A-DD1A-4947-A0E1-0B305F5180E5}\isrt.dllFilesize
203KB
MD5b35dde51d14f9400e73196693148734e
SHA19410c5268f5558e57d044780d0d5dcc7aa181299
SHA25670fa7f0aa2feb397597b2785a4bfdb2c9cd36e0edb51f4f0dfe6ac086290ac86
SHA5126bb24c8864078c923007c1818bb0a590ebe84e2fbe6f2642dc951b05c42da1c33861f150c4ea8943657259c1c309a69b8cb1817b6a207cb9e577bc3aa8bfa79d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-msFilesize
9KB
MD5ad87ae82c52c35a2b0dc62ae8f82fc68
SHA120683859b57620f19a55a462189966a25d5e82c1
SHA256b103050968fc468b04fc40617ecaf4931acf2c1ec7bd0cb5bf7b740160fd8aac
SHA512cbd3ab20ede57e15dbffd3866583ad4a4fc8d6d5687cdd7f3710d8308e7972f0f878861745dc0f9406d5926016beb4cd4374a8302d66e6c0a5b90c85518426d5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-msFilesize
9KB
MD500c3e928461e1cc2eaf36c4de064bba2
SHA1bb2f3d783685d97bc916e03b1f5c28a281c3f91e
SHA25622ec73da378b3ccc8144dd7e042905e1714ffd36ff2d34f86c49d0f017d8ab97
SHA512642e5d24619503b98282bd8059083b48e2e996616ca6a0e5107807ed2221404c4fe0aa8393e0a44f16158633a7f28366cd5915acff061eb0f94460796fb8ce0b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-msFilesize
9KB
MD500c3e928461e1cc2eaf36c4de064bba2
SHA1bb2f3d783685d97bc916e03b1f5c28a281c3f91e
SHA25622ec73da378b3ccc8144dd7e042905e1714ffd36ff2d34f86c49d0f017d8ab97
SHA512642e5d24619503b98282bd8059083b48e2e996616ca6a0e5107807ed2221404c4fe0aa8393e0a44f16158633a7f28366cd5915acff061eb0f94460796fb8ce0b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-msFilesize
9KB
MD554090fd50f0f00e548803e974c3b7b84
SHA1eb47c864becd8ae86ced5fbb1bb5b2006102e7c8
SHA256dd71287de4d756643683d6caf0527cf5451c88196c9428efd8359eff871bad7a
SHA5127b285ab32d71bc84fe867c223a92911ffd792c473c02c133bfe1a29baa89756b019a1946172fc0822d0a44c2d85cc8f28a60b333f0512d7229f194ae071de147
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-msFilesize
9KB
MD554090fd50f0f00e548803e974c3b7b84
SHA1eb47c864becd8ae86ced5fbb1bb5b2006102e7c8
SHA256dd71287de4d756643683d6caf0527cf5451c88196c9428efd8359eff871bad7a
SHA5127b285ab32d71bc84fe867c223a92911ffd792c473c02c133bfe1a29baa89756b019a1946172fc0822d0a44c2d85cc8f28a60b333f0512d7229f194ae071de147
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-msFilesize
9KB
MD554090fd50f0f00e548803e974c3b7b84
SHA1eb47c864becd8ae86ced5fbb1bb5b2006102e7c8
SHA256dd71287de4d756643683d6caf0527cf5451c88196c9428efd8359eff871bad7a
SHA5127b285ab32d71bc84fe867c223a92911ffd792c473c02c133bfe1a29baa89756b019a1946172fc0822d0a44c2d85cc8f28a60b333f0512d7229f194ae071de147
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-msFilesize
9KB
MD554090fd50f0f00e548803e974c3b7b84
SHA1eb47c864becd8ae86ced5fbb1bb5b2006102e7c8
SHA256dd71287de4d756643683d6caf0527cf5451c88196c9428efd8359eff871bad7a
SHA5127b285ab32d71bc84fe867c223a92911ffd792c473c02c133bfe1a29baa89756b019a1946172fc0822d0a44c2d85cc8f28a60b333f0512d7229f194ae071de147
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-msFilesize
9KB
MD53c4d0c03a48ce7376ee8796942fe54f0
SHA1c90cc2f9ad5c732835ea46d2f4541ede9c28b3c2
SHA256b40cc109f3339a537270732b1b0a61d53b60f63def7e524bfb823eb7523606ab
SHA512831bf4994c79995284cecbef76034f246d9f276c65fc5fa502b42e47c32d92a9c39d4b3ac5cb5ddf179ceef247c7a2fd2bd9e5805e93cccd1f1941328eb42d61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-msFilesize
9KB
MD574edf0d152ffcbf572448a9d2bbe9087
SHA1ced61693bcc18465223d636b4c3cb34b319a70e8
SHA2567737bb998c573d7ff9733d74b7b7c1442d3c6b938da7ac6492f5f43411b9596c
SHA512d10506e2b1ab23907cbf84ac8b08db23e9e126ae496efa94fb73529d03d781c3c5d4faa4fc02c8caa57e0e8261f29d9ed636d5f5ecc934fe07d7c781bcb38177
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-msFilesize
9KB
MD574edf0d152ffcbf572448a9d2bbe9087
SHA1ced61693bcc18465223d636b4c3cb34b319a70e8
SHA2567737bb998c573d7ff9733d74b7b7c1442d3c6b938da7ac6492f5f43411b9596c
SHA512d10506e2b1ab23907cbf84ac8b08db23e9e126ae496efa94fb73529d03d781c3c5d4faa4fc02c8caa57e0e8261f29d9ed636d5f5ecc934fe07d7c781bcb38177
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-msFilesize
9KB
MD574edf0d152ffcbf572448a9d2bbe9087
SHA1ced61693bcc18465223d636b4c3cb34b319a70e8
SHA2567737bb998c573d7ff9733d74b7b7c1442d3c6b938da7ac6492f5f43411b9596c
SHA512d10506e2b1ab23907cbf84ac8b08db23e9e126ae496efa94fb73529d03d781c3c5d4faa4fc02c8caa57e0e8261f29d9ed636d5f5ecc934fe07d7c781bcb38177
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-msFilesize
9KB
MD5ac6d6e8ec8c3ea356f6dcbc44baed1c2
SHA12e93def2c8bf582d6808e580d1927ebf3700f82d
SHA25603e0299aa7a7b5442696b54898317c834746a398fef5fefd675dc9e38b4a65b5
SHA51290efd4cada2dac016b2b255b58f7779b5f44220ae6302275a5af0f4bbbd554ca88fb886d3ad8221b9b7128a050d90ce1ff7a998f771f033e2e7f9f033ee887ba
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-msFilesize
9KB
MD5ac6d6e8ec8c3ea356f6dcbc44baed1c2
SHA12e93def2c8bf582d6808e580d1927ebf3700f82d
SHA25603e0299aa7a7b5442696b54898317c834746a398fef5fefd675dc9e38b4a65b5
SHA51290efd4cada2dac016b2b255b58f7779b5f44220ae6302275a5af0f4bbbd554ca88fb886d3ad8221b9b7128a050d90ce1ff7a998f771f033e2e7f9f033ee887ba
-
C:\Users\Admin\AppData\Roaming\qpgaime.exeFilesize
28KB
MD51dffce8d118da3028da6a7f2c6015479
SHA1627e5149dec1c88e5dad73775add734153e79a56
SHA256f062ac7c16a5faae14d49c1fcd40f362690297edc629fb15c75fcccbd7f4ec83
SHA512099475a6b3ff5121998ee9c4f3ef4b4622614409eb4d27d16228346750b667112b27b75141cc9461595925f259e6115f2c49b4840be0ad6799b134c1a1409d83
-
C:\Users\Admin\AppData\Roaming\qpgaime.exeFilesize
28KB
MD51dffce8d118da3028da6a7f2c6015479
SHA1627e5149dec1c88e5dad73775add734153e79a56
SHA256f062ac7c16a5faae14d49c1fcd40f362690297edc629fb15c75fcccbd7f4ec83
SHA512099475a6b3ff5121998ee9c4f3ef4b4622614409eb4d27d16228346750b667112b27b75141cc9461595925f259e6115f2c49b4840be0ad6799b134c1a1409d83
-
C:\Users\Admin\AppData\Roaming\qpgame.exeFilesize
28KB
MD51dffce8d118da3028da6a7f2c6015479
SHA1627e5149dec1c88e5dad73775add734153e79a56
SHA256f062ac7c16a5faae14d49c1fcd40f362690297edc629fb15c75fcccbd7f4ec83
SHA512099475a6b3ff5121998ee9c4f3ef4b4622614409eb4d27d16228346750b667112b27b75141cc9461595925f259e6115f2c49b4840be0ad6799b134c1a1409d83
-
C:\Users\Admin\AppData\Roaming\qpgame.exeFilesize
28KB
MD51dffce8d118da3028da6a7f2c6015479
SHA1627e5149dec1c88e5dad73775add734153e79a56
SHA256f062ac7c16a5faae14d49c1fcd40f362690297edc629fb15c75fcccbd7f4ec83
SHA512099475a6b3ff5121998ee9c4f3ef4b4622614409eb4d27d16228346750b667112b27b75141cc9461595925f259e6115f2c49b4840be0ad6799b134c1a1409d83
-
C:\Windows\SysWOW64\dllcache\iphlpapi.dllFilesize
192KB
MD534153e39b10468c9ae8ec7f68dfbc423
SHA168e2cd47c99122786fb494453380ec8dd24bbf39
SHA2565c2ba6d0d9578b3f18e27710a7b5f65d858c38448b201d29fde9d44ea7bfb9fd
SHA512513bf7c8c8ffddc25b6989c88f1efb3e3079f81ca544cd27c99135f6fabd99578dccc1091e56e144e0436f99ede939565a52ca8f6fe08f3ad8b190d523a97820
-
C:\Windows\SysWOW64\dllcache\iphlpapi.dllFilesize
192KB
MD534153e39b10468c9ae8ec7f68dfbc423
SHA168e2cd47c99122786fb494453380ec8dd24bbf39
SHA2565c2ba6d0d9578b3f18e27710a7b5f65d858c38448b201d29fde9d44ea7bfb9fd
SHA512513bf7c8c8ffddc25b6989c88f1efb3e3079f81ca544cd27c99135f6fabd99578dccc1091e56e144e0436f99ede939565a52ca8f6fe08f3ad8b190d523a97820
-
C:\Windows\SysWOW64\dllcache\midimap.dllFilesize
18KB
MD51168192f4871ffa51129435f37fedbc4
SHA18dbe0e254563d21fb2d2ab2c0400ae2f200b9b2c
SHA2567586ad459835579e71f88bbb9c05e6f9174ff0721d5826eb990b4669655a1033
SHA512528b63d398e571d64adb7200370822cb9335e75a25b7022302aa2518f5acb31975d93b310e78914a97903e52bd7a731599336a0c5acff417201a614bf519a639
-
C:\Windows\SysWOW64\dllcache\rasadhlp.dllFilesize
12KB
MD59936cb0ca376b02afdad243af3d54cfe
SHA19f448a16fbc4b93e2642ab5fbd83d8b1417e37d6
SHA256491bb277e0eeaf2cabdf9d129fce13c485e9b9e0c48a55c399fc869122ad9acf
SHA5127e5a36e184709676578f76502f0f753b8e7031923af01e30985ac1daa3ea4c5bd0dda467036ee91461c9ce0808ea30c701e72a77a9426396b44ebd6e1a7eb478
-
C:\Windows\SysWOW64\dllcache\rasadhlp.dllFilesize
12KB
MD59936cb0ca376b02afdad243af3d54cfe
SHA19f448a16fbc4b93e2642ab5fbd83d8b1417e37d6
SHA256491bb277e0eeaf2cabdf9d129fce13c485e9b9e0c48a55c399fc869122ad9acf
SHA5127e5a36e184709676578f76502f0f753b8e7031923af01e30985ac1daa3ea4c5bd0dda467036ee91461c9ce0808ea30c701e72a77a9426396b44ebd6e1a7eb478
-
C:\Windows\SysWOW64\iphlpapi.dllFilesize
192KB
MD534153e39b10468c9ae8ec7f68dfbc423
SHA168e2cd47c99122786fb494453380ec8dd24bbf39
SHA2565c2ba6d0d9578b3f18e27710a7b5f65d858c38448b201d29fde9d44ea7bfb9fd
SHA512513bf7c8c8ffddc25b6989c88f1efb3e3079f81ca544cd27c99135f6fabd99578dccc1091e56e144e0436f99ede939565a52ca8f6fe08f3ad8b190d523a97820
-
C:\Windows\SysWOW64\midimap.dllFilesize
18KB
MD51168192f4871ffa51129435f37fedbc4
SHA18dbe0e254563d21fb2d2ab2c0400ae2f200b9b2c
SHA2567586ad459835579e71f88bbb9c05e6f9174ff0721d5826eb990b4669655a1033
SHA512528b63d398e571d64adb7200370822cb9335e75a25b7022302aa2518f5acb31975d93b310e78914a97903e52bd7a731599336a0c5acff417201a614bf519a639
-
C:\Windows\SysWOW64\rasadhlp.dllFilesize
12KB
MD59936cb0ca376b02afdad243af3d54cfe
SHA19f448a16fbc4b93e2642ab5fbd83d8b1417e37d6
SHA256491bb277e0eeaf2cabdf9d129fce13c485e9b9e0c48a55c399fc869122ad9acf
SHA5127e5a36e184709676578f76502f0f753b8e7031923af01e30985ac1daa3ea4c5bd0dda467036ee91461c9ce0808ea30c701e72a77a9426396b44ebd6e1a7eb478
-
C:\Windows\SysWOW64\sxload.tmpFilesize
5KB
MD57e82aa06e5669b76006d3daac566835e
SHA11b541f0178a1628c372b770b236e461c76be0ae1
SHA256b1542a8b5f6c5ca93cb515de16c11fd13e020d2c047b9a2f865ef0960c23a3cb
SHA512940169084829f05587968954bebc0472f876eac8c86b4b7c60bb8421fe051ec1115f8b898d9e0f80f7a22d124759c1ec9edc3b0fba67f180e9612262693ad750
-
memory/364-187-0x0000000000000000-mapping.dmp
-
memory/644-195-0x0000000000000000-mapping.dmp
-
memory/692-203-0x0000000000000000-mapping.dmp
-
memory/1040-186-0x0000000000000000-mapping.dmp
-
memory/1660-199-0x0000000000000000-mapping.dmp
-
memory/1672-221-0x0000000000000000-mapping.dmp
-
memory/1828-151-0x0000000000000000-mapping.dmp
-
memory/2108-184-0x0000000000000000-mapping.dmp
-
memory/2144-147-0x0000000000000000-mapping.dmp
-
memory/2304-180-0x0000000000000000-mapping.dmp
-
memory/2376-167-0x0000000000000000-mapping.dmp
-
memory/2380-205-0x0000000000000000-mapping.dmp
-
memory/2424-206-0x0000000000000000-mapping.dmp
-
memory/2436-153-0x0000000000000000-mapping.dmp
-
memory/2664-185-0x0000000000000000-mapping.dmp
-
memory/3076-219-0x0000000000000000-mapping.dmp
-
memory/3348-154-0x0000000000000000-mapping.dmp
-
memory/3620-136-0x0000000000000000-mapping.dmp
-
memory/3696-132-0x0000000000000000-mapping.dmp
-
memory/3696-135-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/3696-142-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/3708-188-0x0000000000000000-mapping.dmp
-
memory/4120-218-0x0000000000000000-mapping.dmp
-
memory/4224-139-0x0000000000000000-mapping.dmp
-
memory/4272-145-0x0000000000000000-mapping.dmp
-
memory/4284-155-0x0000000000000000-mapping.dmp
-
memory/4316-158-0x0000000002570000-0x0000000002707000-memory.dmpFilesize
1.6MB
-
memory/4316-208-0x0000000003640000-0x00000000036CE000-memory.dmpFilesize
568KB
-
memory/4316-170-0x0000000003640000-0x00000000036CE000-memory.dmpFilesize
568KB
-
memory/4316-181-0x0000000002570000-0x0000000002707000-memory.dmpFilesize
1.6MB
-
memory/4316-148-0x0000000000000000-mapping.dmp
-
memory/4316-171-0x0000000003A00000-0x0000000003A49000-memory.dmpFilesize
292KB
-
memory/4424-201-0x0000000000000000-mapping.dmp
-
memory/4480-202-0x0000000000000000-mapping.dmp
-
memory/4572-152-0x0000000000000000-mapping.dmp
-
memory/4664-204-0x0000000000000000-mapping.dmp
-
memory/4936-222-0x0000000000000000-mapping.dmp
-
memory/4980-144-0x0000000000000000-mapping.dmp
-
memory/4992-178-0x0000000000000000-mapping.dmp
-
memory/5064-183-0x0000000000000000-mapping.dmp