d605f22b61ac32bcb41db457e285f39126e328c242c810ba2fa5e451318dc7d6

Resubmissions

21/02/2024, 22:56

240221-2wv8esgd6w

21/02/2024, 22:40

240221-2llagagg569

Analysis

max time kernel
144s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PCMgr_Setup.exe
Size 175.4MB
Sample240221-2llagagg56
SHA256 d605f22b61ac32bcb41db457e285f39126e328c242c810ba2fa5e451318dc7d6
MD5 ece024743c0bb6466f4f4ff250f16a48
SHA1 1211aeb4eacb8ba26c928e68d3dd4f1047c8275e
SHA512 fd3d183ce98423df9a88adacc5f96d20aee94bb06e5b7c49a79339e4f5b3163902e47cc20388251e616c010560a40f72f12b5bcd053303515084ca2ab83fe08c
SSDEEP 3145728:yWKvK3l5TmbEMTEoynflcCrKWi1cfFJAROJIuxSLScF5zPbhtCfsJpt+OHCDr1d:BQaHTDMTKflc1D1cfFmRXuxSjFZPt80m
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

adware bootkit discovery evasion persistence stealer

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	PCMgr_Setup.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\Drivers\TFsFltX64.sys	PCMgr_Setup.exe

Executes dropped EXE 10 IoCs

pid	Process
2508	TestMSVCR.exe
876	QMBluerayInsHlp.exe
888	QQPCRTP.exe
2644	QMPicResize.exe
2428	QMEMGSvc.exe
2212	QMBluerayInsHlpx64.exe
1996	QMPicResize.exe
2596	QMPicResize.exe
1284	QMPicResize.exe
2940	RemNPX.exe

Loads dropped DLL 29 IoCs

pid	Process
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
876	QMBluerayInsHlp.exe
876	QMBluerayInsHlp.exe
888	QQPCRTP.exe
2428	QMEMGSvc.exe
888	QQPCRTP.exe
888	QQPCRTP.exe
2428	QMEMGSvc.exe
2428	QMEMGSvc.exe
2428	QMEMGSvc.exe
888	QQPCRTP.exe
888	QQPCRTP.exe
888	QQPCRTP.exe
2428	QMEMGSvc.exe
2208	PCMgr_Setup.exe
2972	regsvr32.exe
1768	regsvr32.exe
348	regsvr32.exe
2004	regsvr32.exe
1776	regsvr32.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\QMContextScan	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\QMContextScan\ = "{63332668-8CE1-445D-A5EE-25929176714E}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\QMContextScan	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\QMContextScan	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\QMContextScan\ = "{63332668-8CE1-445D-A5EE-25929176714E}"	regsvr32.exe

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}\InprocServer32\ = "C:\\Program Files (x86)\\iOAEnt\\108.3.19160.62000\\TSWebMon64.dat"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\InprocServer32\ = "C:\\Program Files (x86)\\iOAEnt\\108.3.19160.62000\\QMContextScan64.dll"	regsvr32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ QQPCTray = "\"C:\\Program Files (x86)\\iOAEnt\\108.3.19160.62000\\QQPCTray.exe\" /regrun"	PCMgr_Setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}\ = "TSWebMon"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}\NoExplorer = "1"	regsvr32.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	PCMgr_Setup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\tbs\v8_context_snapshot.bin	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\smPen.dat	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMNetProxyHost.exe	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\plugins\QMComplianceCheckPlugin\QMComplianceCheckPlugin.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMScriptHost.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMSkinMgr.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\TsFltMgr_ev.sys	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\StartupLoad.dat	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMTrayPlugin\QMWebFWCtrl\QMWebFWCtrl.rdb	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMTrayPlugin\QMVulPlugin\QMVulPlugin.tpc	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\plugins\TxSysLoginProdr\TxRevertSysLogin.exe	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMPolicyManager.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\tpk\2.0.13712.288\tpktt.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMAssocScanLib2.dat	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\plugins\SysCleanPage\syscleanpage.tpc	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMTrayPlugin\QMPerfCtrl\QMPerfCtrl.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\plugins\DataProtection\TxDevMgmt64.sys	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\Tencent iOA.lnk	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\plugins\QMBluescreenFixer\guanjiafix.img	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\RefuseInjectShell.DAT	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\crc.dat	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\tpk\2.0.13712.288\def\vircmpinfo.def	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMBluerayInsHlp.exe	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMDeviceManager.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMPrivilege.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\qmbsrv.exe	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMContextScan64.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMPrivilege.dat	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\plugins\QMTrojanScan\QMTrojanScan.tpc	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QQPConfig.exe	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMSoftManager.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMTrayPlugin\QMTipsTrayPlugin\QMTipsTrayPlugin.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\txinjx64.sys	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\tpk\2.0.13712.288\update2015.ini	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMDLPConfig.dat	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMHttpsMgr.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\NPEStartup.db	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\qmbinsx64.exe	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMRundll.exe	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\Edr\edrinjclr_x64.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMTraceClearDll.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\diagnosis\LogAudit.json	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\diagnosis\StringBundles.json	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMCusCmd.exe	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QQPCSysOptimize.exe	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\plugins\DataProtection\InjUmon64.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\TAVInterface.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\qmudisk64_ev.sys	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\tbs\qb.pak	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\TSNetNdis5.inf	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\plugins\DataProtection\TxdllUtil64.exe	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMHIPSHeart.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\plugins\QMPerfMonPlugin\QMPerfMonPlugin.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\AntiRK.sys	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QQPConfig.rdb	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMIpc.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\spa_pc_api.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMPatchPlugin.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\plugins\pluginctrl.xml	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\qqpctray.dat	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\TSUrlLib.DAT	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\plugins\TxNGN\TapForWin7Sign.exe	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\msvcr80.dll	PCMgr_Setup.exe
File created	C:\Program Files (x86)\iOAEnt\108.3.19160.62000\plugins\qmedrassistplugin\QMEdrHttpServerPlugin.dll	PCMgr_Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute	PCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\PCMgrRepairIEExtensions	PCMgr_Setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ProtocolExecute\PCMgrRepairIEExtensions\WarnOnOpen = "0"	PCMgr_Setup.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg	PCMgr_Setup.exe
Key created	\REGISTRY\USER\QMCONFIG\QQDoctor\QQDoctor\ComCfg	PCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMCONFIG\QQDoctor\QQDoctor\ComCfg\GameExposure_ShowedDeskTopTip = 7874ea37	PCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMCONFIG\QQDoctor\QQDoctor\ComCfg\GameExposure_ShowSpeedupTabTips = 7b74ea37	PCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMCONFIG\QQDoctor\QQDoctor\ComCfg\QQPCMgrNewUITypeValue = 7974ea37	PCMgr_Setup.exe
Key created	\REGISTRY\USER\QMConfig	PCMgr_Setup.exe
Key created	\REGISTRY\USER\QMCONFIG\QQDoctor	PCMgr_Setup.exe
Key created	\REGISTRY\USER\QMCONFIG\QQDoctor\QQDoctor	PCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMCONFIG\QQDoctor\QQDoctor\ComCfg\defSimpleVersionNetConfig = 7b74ea37	PCMgr_Setup.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMContextScan.QMContextScanMenu\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TSWebSiteMon.CTSWebSiteMon.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{35627C7C-DB28-4772-9A6F-7607FFCBF9FF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3303E77E-EAF6-4840-8208-5D950B2B61E7}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\QMContextScan.DLL\AppID = "{7A30415C-ABEE-4674-B64B-4CA145EEB0CA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}\ = "Ztsm System网页防火墙"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\QMContextScan	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PCMgrRepairIEExtensions\Shell	PCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{35627C7C-DB28-4772-9A6F-7607FFCBF9FF}\1.0\HELPDIR\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\InprocServer32\ = "C:\\Program Files (x86)\\iOAEnt\\108.3.19160.62000\\QMContextScan.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}\VersionIndependentProgID\ = "TSWebSiteMon.CTSWebSiteMon"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMContextScan.QMContextScanMenu\CurVer\ = "QMContextScan.QMContextScanMenu.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\TypeLib\ = "{593BE60A-1C6A-44F9-946D-A5EAB2D53511}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{35627C7C-DB28-4772-9A6F-7607FFCBF9FF}\1.0\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7A30415C-ABEE-4674-B64B-4CA145EEB0CA}\ = "QMContextScan"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\QMContextScan	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3303E77E-EAF6-4840-8208-5D950B2B61E7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\AppID = "{7A30415C-ABEE-4674-B64B-4CA145EEB0CA}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}\InprocServer32\ = "C:\\Program Files (x86)\\iOAEnt\\108.3.19160.62000\\TSWebMon64.dat"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{35627C7C-DB28-4772-9A6F-7607FFCBF9FF}\1.0\ = "TSWebSiteMon 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMContextScan.QMContextScanMenu\CurVer\ = "QMContextScan.QMContextScanMenu.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TSWebSiteMon.CTSWebSiteMon.1\CLSID\ = "{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{35627C7C-DB28-4772-9A6F-7607FFCBF9FF}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3303E77E-EAF6-4840-8208-5D950B2B61E7}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\VersionIndependentProgID\ = "QMContextScan.QMContextScanMenu"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command	PCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{5D7991DD-038B-49D4-8C8B-00119981499C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{5D7991DD-038B-49D4-8C8B-00119981499C}\ = "TSWebSiteMon"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}\TypeLib\ = "{35627C7C-DB28-4772-9A6F-7607FFCBF9FF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\TypeLib\ = "{593BE60A-1C6A-44F9-946D-A5EAB2D53511}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PCMgrRepairIEExtensions\DefaultIcon\ = "C:\\Program Files (x86)\\iOAEnt\\108.3.19160.62000\\QQPCMgr.exe"	PCMgr_Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3303E77E-EAF6-4840-8208-5D950B2B61E7}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\ProgID\ = "QMContextScan.QMContextScanMenu.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMContextScan.QMContextScanMenu	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMContextScan.QMContextScanMenu\ = "QMContextScanMenu Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMContextScan.QMContextScanMenu.1\ = "QMContextScanMenu Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMContextScan.QMContextScanMenu\ = "QMContextScanMenu Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TSWebSiteMon.CTSWebSiteMon\ = "CTSWebSiteMon Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3303E77E-EAF6-4840-8208-5D950B2B61E7}\ = "ICTSWebSiteMon"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMContextScan.QMContextScanMenu\CLSID\ = "{63332668-8CE1-445D-A5EE-25929176714E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\QMContextScan\ = "{63332668-8CE1-445D-A5EE-25929176714E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PCMgrRepairIEExtensions\DefaultIcon	PCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TSWebSiteMon.CTSWebSiteMon\CurVer\ = "TSWebSiteMon.CTSWebSiteMon.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3303E77E-EAF6-4840-8208-5D950B2B61E7}\ = "ICTSWebSiteMon"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{35627C7C-DB28-4772-9A6F-7607FFCBF9FF}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3303E77E-EAF6-4840-8208-5D950B2B61E7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\QMContextScan	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3303E77E-EAF6-4840-8208-5D950B2B61E7}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PCMgrRepairIEExtensions\Shell\Open	PCMgr_Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\QMContextScan\ = "{63332668-8CE1-445D-A5EE-25929176714E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}\AppID = "{5D7991DD-038B-49D4-8C8B-00119981499C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3303E77E-EAF6-4840-8208-5D950B2B61E7}	regsvr32.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	PCMgr_Setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	PCMgr_Setup.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2208	PCMgr_Setup.exe
2328	taskmgr.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
484	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	2208	PCMgr_Setup.exe
Token: SeRestorePrivilege	2208	PCMgr_Setup.exe
Token: SeDebugPrivilege	2208	PCMgr_Setup.exe
Token: SeDebugPrivilege	2328	taskmgr.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2208	PCMgr_Setup.exe
2208	PCMgr_Setup.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe
2328	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2508	2208	PCMgr_Setup.exe	28
PID 2208 wrote to memory of 2508	2208	PCMgr_Setup.exe	28
PID 2208 wrote to memory of 2508	2208	PCMgr_Setup.exe	28
PID 2208 wrote to memory of 2508	2208	PCMgr_Setup.exe	28
PID 2208 wrote to memory of 2308	2208	PCMgr_Setup.exe	29
PID 2208 wrote to memory of 2308	2208	PCMgr_Setup.exe	29
PID 2208 wrote to memory of 2308	2208	PCMgr_Setup.exe	29
PID 2208 wrote to memory of 2308	2208	PCMgr_Setup.exe	29
PID 2208 wrote to memory of 876	2208	PCMgr_Setup.exe	33
PID 2208 wrote to memory of 876	2208	PCMgr_Setup.exe	33
PID 2208 wrote to memory of 876	2208	PCMgr_Setup.exe	33
PID 2208 wrote to memory of 876	2208	PCMgr_Setup.exe	33
PID 2208 wrote to memory of 888	2208	PCMgr_Setup.exe	31
PID 2208 wrote to memory of 888	2208	PCMgr_Setup.exe	31
PID 2208 wrote to memory of 888	2208	PCMgr_Setup.exe	31
PID 2208 wrote to memory of 888	2208	PCMgr_Setup.exe	31
PID 2208 wrote to memory of 2644	2208	PCMgr_Setup.exe	32
PID 2208 wrote to memory of 2644	2208	PCMgr_Setup.exe	32
PID 2208 wrote to memory of 2644	2208	PCMgr_Setup.exe	32
PID 2208 wrote to memory of 2644	2208	PCMgr_Setup.exe	32
PID 2208 wrote to memory of 2428	2208	PCMgr_Setup.exe	38
PID 2208 wrote to memory of 2428	2208	PCMgr_Setup.exe	38
PID 2208 wrote to memory of 2428	2208	PCMgr_Setup.exe	38
PID 2208 wrote to memory of 2428	2208	PCMgr_Setup.exe	38
PID 876 wrote to memory of 2212	876	QMBluerayInsHlp.exe	37
PID 876 wrote to memory of 2212	876	QMBluerayInsHlp.exe	37
PID 876 wrote to memory of 2212	876	QMBluerayInsHlp.exe	37
PID 876 wrote to memory of 2212	876	QMBluerayInsHlp.exe	37
PID 2208 wrote to memory of 1996	2208	PCMgr_Setup.exe	36
PID 2208 wrote to memory of 1996	2208	PCMgr_Setup.exe	36
PID 2208 wrote to memory of 1996	2208	PCMgr_Setup.exe	36
PID 2208 wrote to memory of 1996	2208	PCMgr_Setup.exe	36
PID 2208 wrote to memory of 2596	2208	PCMgr_Setup.exe	35
PID 2208 wrote to memory of 2596	2208	PCMgr_Setup.exe	35
PID 2208 wrote to memory of 2596	2208	PCMgr_Setup.exe	35
PID 2208 wrote to memory of 2596	2208	PCMgr_Setup.exe	35
PID 2208 wrote to memory of 1284	2208	PCMgr_Setup.exe	39
PID 2208 wrote to memory of 1284	2208	PCMgr_Setup.exe	39
PID 2208 wrote to memory of 1284	2208	PCMgr_Setup.exe	39
PID 2208 wrote to memory of 1284	2208	PCMgr_Setup.exe	39
PID 2208 wrote to memory of 2940	2208	PCMgr_Setup.exe	41
PID 2208 wrote to memory of 2940	2208	PCMgr_Setup.exe	41
PID 2208 wrote to memory of 2940	2208	PCMgr_Setup.exe	41
PID 2208 wrote to memory of 2940	2208	PCMgr_Setup.exe	41
PID 2208 wrote to memory of 2972	2208	PCMgr_Setup.exe	42
PID 2208 wrote to memory of 2972	2208	PCMgr_Setup.exe	42
PID 2208 wrote to memory of 2972	2208	PCMgr_Setup.exe	42
PID 2208 wrote to memory of 2972	2208	PCMgr_Setup.exe	42
PID 2208 wrote to memory of 2972	2208	PCMgr_Setup.exe	42
PID 2208 wrote to memory of 2972	2208	PCMgr_Setup.exe	42
PID 2208 wrote to memory of 2972	2208	PCMgr_Setup.exe	42
PID 2208 wrote to memory of 348	2208	PCMgr_Setup.exe	43
PID 2208 wrote to memory of 348	2208	PCMgr_Setup.exe	43
PID 2208 wrote to memory of 348	2208	PCMgr_Setup.exe	43
PID 2208 wrote to memory of 348	2208	PCMgr_Setup.exe	43
PID 2208 wrote to memory of 348	2208	PCMgr_Setup.exe	43
PID 2208 wrote to memory of 348	2208	PCMgr_Setup.exe	43
PID 2208 wrote to memory of 348	2208	PCMgr_Setup.exe	43
PID 2208 wrote to memory of 1768	2208	PCMgr_Setup.exe	44
PID 2208 wrote to memory of 1768	2208	PCMgr_Setup.exe	44
PID 2208 wrote to memory of 1768	2208	PCMgr_Setup.exe	44
PID 2208 wrote to memory of 1768	2208	PCMgr_Setup.exe	44
PID 2208 wrote to memory of 1768	2208	PCMgr_Setup.exe	44
PID 2208 wrote to memory of 1768	2208	PCMgr_Setup.exe	44

C:\Users\Admin\AppData\Local\Temp\PCMgr_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\PCMgr_Setup.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~f7649ad\TestMSVCR.exe
  "C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~f7649ad\TestMSVCR.exe" (null)
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\SysWOW64\cacls.exe
  "cacls" "C:\Program Files (x86)\iOAEnt\108.3.19160.62000" /t /e /c /g SYSTEM:f
  2⤵
  PID:2308
- C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QQPCRTP.exe
  "C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QQPCRTP.exe" -i
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:888
- C:\Program Files (x86)\iOAEnt\108.3.19160.62000\platform\QMPicResize.exe
  "C:\Program Files (x86)\iOAEnt\108.3.19160.62000\platform\QMPicResize.exe" --Type=genico --PathDest="C:\ProgramData\Tencent\DeskUpdate\CustomRes\logoIcon_colour_256.ico" --PathSrc="C:\ProgramData\Tencent\DeskUpdate\CustomRes\logoIcon_colour_1024.png" --Sizes=[16,32,64,128,256]
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMBluerayInsHlp.exe
  "C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMBluerayInsHlp.exe" /install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMBluerayInsHlpx64.exe
    "C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMBluerayInsHlpx64.exe" /install
    3⤵
    - Executes dropped EXE
    PID:2212
- C:\Program Files (x86)\iOAEnt\108.3.19160.62000\platform\QMPicResize.exe
  "C:\Program Files (x86)\iOAEnt\108.3.19160.62000\platform\QMPicResize.exe" --Type=resize --PathDest="C:\ProgramData\Tencent\DeskUpdate\CustomRes\logoIcon_colour_64.png" --PathSrc="C:\ProgramData\Tencent\DeskUpdate\CustomRes\logoIcon_colour_1024.png" --Width=64 --Height=64
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Program Files (x86)\iOAEnt\108.3.19160.62000\platform\QMPicResize.exe
  "C:\Program Files (x86)\iOAEnt\108.3.19160.62000\platform\QMPicResize.exe" --Type=resize --PathDest="C:\ProgramData\Tencent\DeskUpdate\CustomRes\logoIcon_colour_32.png" --PathSrc="C:\ProgramData\Tencent\DeskUpdate\CustomRes\logoIcon_colour_1024.png" --Width=32 --Height=32
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMEMGSvc.exe
  "C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMEMGSvc.exe" -i
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2428
- C:\Program Files (x86)\iOAEnt\108.3.19160.62000\platform\QMPicResize.exe
  "C:\Program Files (x86)\iOAEnt\108.3.19160.62000\platform\QMPicResize.exe" --Type=resize --PathDest="C:\ProgramData\Tencent\DeskUpdate\CustomRes\logoIcon_white_32.png" --PathSrc="C:\ProgramData\Tencent\DeskUpdate\CustomRes\logoIcon_white_128.png" --Width=32 --Height=32
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~f7649ad\RemNPX.exe
  "C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~f7649ad\RemNPX.exe"
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\iOAEnt\108.3.19160.62000\TSWebMon64.dat"
  2⤵
  - Loads dropped DLL
  PID:2972
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Program Files (x86)\iOAEnt\108.3.19160.62000\TSWebMon64.dat"
    3⤵
    - Loads dropped DLL
    - Registers COM server for autorun
    - Installs/modifies Browser Helper Object
    - Modifies registry class
    PID:1776
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMContextScan64.dll"
  2⤵
  - Loads dropped DLL
  PID:348
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMContextScan64.dll"
    3⤵
    - Loads dropped DLL
    - Modifies system executable filetype association
    - Registers COM server for autorun
    - Modifies registry class
    PID:2004
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMContextScan.dll"
  2⤵
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Modifies registry class
  PID:1768

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FilterService.ini

Path C:\Program Files (x86)\iOAEnt\108.3.19160.62000\FilterService.ini
Size 1KB
SHA256 f0acb5b3baa229372cc38cdb349a86f2d129bb0062df7491c55c3534d9489d95
MD5 4635dfe68ebf3d1e4b3bb604ed095e38
SHA1 9871bc4b9e60d85530c4ef272581524b20893251
SHA512 e90af2d502d823184c104614b1625d088f65ae875bf6cbd49d387bd21f3f6a3df66290f8753bd55935b8cef741b5e78a24ee1d937939999bfb8bc2444b41cfe2
MD5 SHA1 SHA512

Submit Download

QMBluerayInsHlp.exe

Path C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMBluerayInsHlp.exe
Size 124KB
SHA256 5f93bc722acb0a0cfce07e5bd21faa835fb9a1108803fe6571d9adcb652fc1d8
MD5 6e9f8b3858543999ef3b13db8445db82
SHA1 a33eca1154f567b1b9be2452aa9cc7e84ddb987a
SHA512 eafa00da74244f7da309db38c08fab9cfafbb6721fe94cd9317bc6a5c64da19994d11786a300acb30a72da1853ea806cd957db2f8260986e2404a6d371432edb
SSDEEP 1536:SZhvroz9/jd7wHYC6uYZh8H9+0EwsWi7Pm7xWz4OV3Li9PoUj3bMe4a81HjT1Opz:G34zv5VbiRoUj3wFt1HjROp3yEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

QMBluerayInsHlpx64.exe

Path C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMBluerayInsHlpx64.exe
Size 160KB
SHA256 c4136551d9baf5f19205555c79f749c9e34ba684d4f35010bbe20b3e6a3d7a41
MD5 47a8b5570797cabdc5f1b43017bf1874
SHA1 c3dfd778618742c605c0aa54e39b544ee818331b
SHA512 914f8c4a7bb8ddcc444048d53230cf1d2360336251577362671f08273029f262020b9fb56d23aa219b6ab84f43f697f467d8ce7a092514d2eb66a0c26ea8d6a9
SSDEEP 3072:gX4mVhRJRZzw8BlDRMIYMmJZ47QOi3t7FiEDXCvxzy7/0cOrewpyhR:gomVhRJRZzBQSQTlWxWr0cOre0UR
MD5 SHA1 SHA512 SSDEEP

Submit Download

QMEMGSvc.exe

Path C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMEMGSvc.exe
Size 388KB
SHA256 02998058b26a115b20a68723a40e0efdea15a74e860f6e330aa8ad4a436e948f
MD5 d653175dfed4b5b6f9c6902a985fee75
SHA1 3a9afac6cb81e504c89b1ffcd45ed985dd42d772
SHA512 f66d9aad82184bf00f7143754e77634d4854e7ba77c8fc689f77f9158878aa875fff355eadf8fd377c9e5bd93d2eb175e48d362f99377e6c0354b2a10220999f
SSDEEP 6144:hqxIkdaO5YByYYF7jwC5XogrluOlbF+SKeKOuD0pm:hqxCBtC3XXHbF+Pe4sm
MD5 SHA1 SHA512 SSDEEP

Submit Download

QMLogEx.ini

Path C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QMLogEx.ini
Size 230B
SHA256 1e6ee4ee197b36f281a71f8ad388e2b20a898a3598c490b15011809bcde41330
MD5 d6e3b7a2a045e1d86096d125350b062b
SHA1 948ffb1f3089bfd7154c664f796489c8de7499f6
SHA512 3986e4077b8da4e163bd30efbd539da013c09560ffbee565a74c9080b11c3c5f40c69570964f3e72fbc0bee452a3ac90a9681f7bb0464d3f925b6843278f6754
MD5 SHA1 SHA512

Submit Download

QQPCRTP.exe

Path C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QQPCRTP.exe
Size 494KB
SHA256 41b9a79414d019cc5617338c8a256206c34e83c562be6346ed4b046d6aabbdd3
MD5 0532db16c9fc441126745eb7b7a8c5ca
SHA1 8c084fd884b8c87230e063e3191f46459dfc2e64
SHA512 3bdbdfe350d0979a4c5f5d835f463897b1a9ce7d243d548aaa73a74617b4300e27d72abe98bf48c4e4c3a058ceea82ed53e7cc4dfb8b18689d17833328cd5110
SSDEEP 12288:OjaMGWs6fpi1oN6ntfTyxszi2MRCla+hSxl2/ZB9:OuMGWsapi71yxmwRCYASx8RB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

QQPCTray.exe

Path C:\Program Files (x86)\iOAEnt\108.3.19160.62000\QQPCTray.exe
Size 481KB
SHA256 e8c6cc21988aba61cd2e7bc8b4a20fc0b5c2e4c30b788809023649d262ca867d
MD5 fa3147cabd1f431248916bb8a957491e
SHA1 fa77e8f678feb94e9e8b02599b72d83a4fd76f7e
SHA512 f06929c8e2b916ee9152fda31c0d08111f233c712926a112795458619d48a173de090b590a3a9f6e5681a9e14a873caf57ecb28156a82ad54e0e4a3ff492d3fd
SSDEEP 3072:mvksMRDnVJtx9URbMUj3EY6OI997a9Cah/Qx5x5XlPNRBy/f:tnVNkkY6OuO9Ca5o5nXl1ny/f
MD5 SHA1 SHA512 SSDEEP

Submit Download

RefuseInjectShell.DAT

Path C:\Program Files (x86)\iOAEnt\108.3.19160.62000\RefuseInjectShell.DAT
Size 3KB
SHA256 1208b23cfb0cd31d579337e830ccd8e23f3e0d87d424da03e806e6a02d18135c
MD5 75f136e332aeced69df33a4e992ff7f4
SHA1 74c46cfb8ae2e63bfaefc5c2d46d21552f0174fe
SHA512 644eaabb6889b4cda563baeb098cbda57b6562807de0f0c48143a45f517921ab55b84f3c7a753f7eeb6977b8c41b6a839b29bf751f124da202ef6c72a6959345
MD5 SHA1 SHA512

Submit Download

QMPicResize.exe

Path C:\Program Files (x86)\iOAEnt\108.3.19160.62000\platform\QMPicResize.exe
Size 1.1MB
SHA256 658b5cc8f2d598e0c4b00b1123da3fbb0dce8da96d176ee10d47183965a36fc6
MD5 c2111d13e13fa305ecf0475484f3edb0
SHA1 83f46fb104240e45ec8219c240174d37c11b9618
SHA512 e83d4ca179dc20b385121ac7265278f5ddeda4a1b0b600b96ac69bf6a6958d361074af5354569510c92684c0774a78ee56a44d70c8d20f35bb2bf4be7eaffc8e
SSDEEP 24576:lguFV9KQxGie4cNRVikv06fhm2/LIGYtrWtycDAW7r7bX/Jq6Fi+a:Mk6MrW7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

QMPicResize.exe

Path C:\Program Files (x86)\iOAEnt\108.3.19160.62000\platform\QMPicResize.exe
Size 2.1MB
SHA256 62bfdec8f34ab1c0c238ce344dfc7ba250cf473567de8cdc2fbe56a8d98c3dcf
MD5 7d13d4a49cbe8120fa868e2e3fd3c843
SHA1 707a8da2cbc3430e6a6eb81438c386bc677bf850
SHA512 819404eadd5d1eef3e84fcda507f2905b550249e19d0c1eeb899bbb6371bfdaae858b77f86223e1c16baf39ad311c8e1335ff57bf7c28001e1c851e069d1cb31
SSDEEP 24576:lguFV9KQxGie4cNRVikv06fhm2/LIGYtrWtycDAW7r7bX/Jq6Fi+7GZkIWq7Go2a:Mk6MrW7KvLe49mYq1gCdrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

logoIcon_colour_1024.png

Path C:\ProgramData\Tencent\DeskUpdate\CustomRes\logoIcon_colour_1024.png
Size 2KB
SHA256 13b905f7a60c2e7ca2d9cd4004eba3c3d2bb876cfd54c7e80bc31e6c8863ba9d
MD5 6b07b8a40fde6fc231f7b3bf69b5359b
SHA1 ab0b3598cac1a95d7e80c629381fb9edbddeb2c4
SHA512 9e33e754f830d793cfe7b1c3a82a7e66025f6dd5fd456017956ac4c8e099816d6a8dbf1a197217bcb806dd6d1e91fafc5cceafa0444d918921d295849def2356
MD5 SHA1 SHA512

Submit Download

logoIcon_white_128.png

Path C:\ProgramData\Tencent\DeskUpdate\CustomRes\logoIcon_white_128.png
Size 2KB
SHA256 5771e6c030d9390cf9168b09d40cd3d918993e13299bba174e34434307b6191b
MD5 58d42de7c7752678f964e3daafe5cc2e
SHA1 a33ca685ac6b30ee4987084e86e1edceb5467917
SHA512 bfb172658608c9cfbfbe5ba621bb443f2e25f0d506de2d360415e5b7a7b1cf1d38d3e69bbd68f4c70ad95d6e854fc045f3f6956f15f93d5525c03c1b18f1380b
MD5 SHA1 SHA512

Submit Download

PreConfig.dat

Path C:\ProgramData\Tencent\DeskUpdate\PreConfig.dat
Size 1.2MB
SHA256 c118cb8c6269674c8e1c241500babe4c4a91639a4b39b4871b2bc76712bd21c2
MD5 a26fcbcf9ffa37ec37bfa2506772dec0
SHA1 e093185581b3e334fcdc56959130c265bac01d0c
SHA512 c807dafbe005487c102ae23d783a0d72f65f99ac5c0ab46cf67dd27d68989d9cde14266fc227ec350e4061f5247967d4873656013f25af5c5a93d88650f515d2
SSDEEP 24576:5Aa1+EQGahyJQ9DUBxHoTv8uI+C7B9iEdrI0mEGx:JVRBQ4pbJJ9Qx
MD5 SHA1 SHA512 SSDEEP

Submit Download

QMNetworkMgr.ini

Path C:\ProgramData\Tencent\DeskUpdate\QMNetworkMgr.ini
Size 1KB
SHA256 7c8d4868e0a337caae242b1b0bb9cf097c92e06129e66b359a0f72b6d90eecf3
MD5 e4aa33c73d4339b70bc8ab57bbf24f69
SHA1 8521e1a4d42ee619ed30360ea74df9aab0482c6b
SHA512 4e7756dd38890847a61b7f2c0d62f38b8e198096b349ff7c281dbdd01d7c0e2993b68c10f920ef9edeef3fa565f894efae60833414c6be39258d3f6e88575b0e
MD5 SHA1 SHA512

Submit Download

QQPCMgrInstall_20240221224132.Log

Path C:\ProgramData\Tencent\QQPCMgr\QQPCMgrInstall_20240221224132.Log
Size 7.7MB
SHA256 f2cfa4d0aa3a77003e54a60a9fee8852608a95de5d4b05c2e08f88dc299e83c1
MD5 bf407aa25acb6fc87b6502c7f27008c9
SHA1 850d60ea04cc0ca7057df7faf67dc22b8b534bdd
SHA512 7e242f0207477a9b5ccc7ceec31cde943d2a64ca4b2c0f8e8f7353afdb08507d3e16dec7ed5235eaf4b844a730f46897c34ad25bf7c831cfa028ae049571ef37
SSDEEP 49152:jO56zZhLEtjWkbuvdLP0g3m1djykbuvdLP0g3m1djOkbuvdLP0g3m1djb:e
MD5 SHA1 SHA512 SSDEEP

Submit Download

QQPCMgrInstall_20240221224132.Log

Path C:\ProgramData\Tencent\QQPCMgr\QQPCMgrInstall_20240221224132.Log
Size 1KB
SHA256 173571f6e08506a3b4529729f6eaf66fca0ec9cf665b5d38018eb90ac16e0670
MD5 8c00bd71dafb841de863ba7d15609f6a
SHA1 a84fe427497b3003832d7496945decf77dd411cd
SHA512 076fe7d8818e6da02eabfadcef4d22b2729427e6c4855fc8857fa99c4bc98b47fd6342c84d2d1ab26df937393fb330873c686b1d7e80028216af1f4f6a64d060
MD5 SHA1 SHA512

Submit Download

QMCommon.dll

Path C:\ProgramData\Tencent\QQPCMgr\Quarantine\QMCommon.dll
Size 932KB
SHA256 b5d21f748ef87f20455a07f628c15bb05751a7e103dc2b8c4ceac7750bee4a4a
MD5 399ec2aad03134d94f3bc57033bc219b
SHA1 5b1dc476fee2ac2fda4f77e8c21561e0c06fa981
SHA512 aaa1b6c886845d00fc12b66bbae2ed32f98e7f01ff0035c02832be864641cdbc1eb710c001b682e8f97317302a9db2632f28226f632b4a95d647ab2a7bc8fda2
SSDEEP 12288:XCTe1kSypGZKP4B/p4ToniVwf4HOVddSQmdwM4ZU0FlDX3am6USAvYTy9fXC82j0:XTHypGZJBeonKcT32dTyhy8CmzQspteu
MD5 SHA1 SHA512 SSDEEP

Submit Download

QMQuarantine.exe

Path C:\ProgramData\Tencent\QQPCMgr\Quarantine\QMQuarantine.exe
Size 464KB
SHA256 efa174f633b5a4300d8831d6b1ddb3e33b514e579a78dd88561f82d6d5680255
MD5 2b91cd47a94636d4f2559d1ad499aaaf
SHA1 9e8c3476afa45cb9886389f967f71a146b6da070
SHA512 591b39b31da14c8dc1437a5711b6b662b6485b2410179e0cbd153393a3ff7b74d704b274462bbb0b40f8e908f0c5f8275b43eede07561d0e2967ef9f81b61fa4
SSDEEP 3072:/6AGcYrmQFV/eL8fxHUVj3E2OO4FfrTbGXs4Vf/px:/IcQAZOOOfra7l/px
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite.dll

Path C:\ProgramData\Tencent\QQPCMgr\sqlite.dll
Size 476KB
SHA256 edbaf842118a1d6a19880e39df693b1fcfe6e932095bd1d244ffa4af8d43cf28
MD5 51d341ae3218c99a9aa725d8b6a094eb
SHA1 bb6f23ecf44750c426c2c9695f74725a75fa61d0
SHA512 642a6b010edb4315b3d6eb1c720ac5e72a85b49c90fda21909b43607cf7efbb9a3a1a024a8b8f0e54cffec9c3e82f420cbf62efe75d84b51ca0d6070e4eee2e0
SSDEEP 12288:gqqlicQw1rnvHu4Q+dGJT9z9OeogdwaqnuXX:gqql/fnvHu4rGJT9pOeoK+uXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

RemNPX.exe

Path C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~f7649ad\RemNPX.exe
Size 39KB
SHA256 f842e1ebeb8787c72ab9edf4dfe5d365ad865798a5f7e2d07d48c1f12771925a
MD5 fcb991d99796bfeac2378fb787b23d03
SHA1 7a3c85c6d7e64b98bf029158a5fa2b40f194749a
SHA512 462e121192ab674b3a7e2411b0a28ca85046dcc8e757cd9fe387809e4520c97abbee62a61a0f2164f429794d46c321e6d32d93ab74445f7ad2f9be6f7d052870
SSDEEP 768:nUsdLspZtH3Whh11gHo7Av+EDknAnvI2c/t8b:NLspZch7Ao7ABw/t8
MD5 SHA1 SHA512 SSDEEP

Submit Download

QMAntiInject.dll

Path \Program Files (x86)\iOAEnt\108.3.19160.62000\QMAntiInject.dll
Size 120KB
SHA256 cb18cf0149895d9aed3fabe16a4b863aff7d408552196cd6fdb7a3f318997c65
MD5 c5a9e7d2009ca550a0ddef68db59adb3
SHA1 22b5bba4cd39e984b623d14533c02f9a9d8de256
SHA512 53ee5d1cd767ed6334c38a92fb711db6eb20ae933e39a6aad259e780dec6a3c44f56b37e77b6f2970adc1cdf421b7819566e989bf3bb6f19f0b4c95686595b0b
SSDEEP 3072:MFEsD5qcYmBPbZoQceXj3dUQ0RARODSA5aDpcu:+Eu5q6BK2LRODhIcu
MD5 SHA1 SHA512 SSDEEP

Submit Download

QMAntiInject.dll

Path \Program Files (x86)\iOAEnt\108.3.19160.62000\QMAntiInject.dll
Size 8KB
SHA256 705461bc64a4d2d8a1fb558ca9c9dc495ad20d1cb7ef510131062505fd2b8ca4
MD5 465ea1555d8cbc23ed882915046276d8
SHA1 b70226840c8f0bc7b25674a3321367d54e22050c
SHA512 faf0c82a4ade272f1b5262508dd1f2db8469a7b59778349a08d8ac3518bdb2509908616ca91e6c7a5255542badc6c54ee7b481d3ee224b285e848c9936df73f0
SSDEEP 96:2wChOqxTTAQZH8F+roDi0jAzUZDRyM9bxOPD:ChOOPcErQ1UDD
MD5 SHA1 SHA512 SSDEEP

Submit Download

QMCommon.dll

Path \Program Files (x86)\iOAEnt\108.3.19160.62000\QMCommon.dll
Size 704KB
SHA256 b332c09c60d991634ff13b74d3dae5ed030cdbd2d30f9f6acd2773256db00ddb
MD5 f7a929f151d0902df7898cb0aea35663
SHA1 7df6ba74fcc7a7a25ad3a7b3841d8f8139752764
SHA512 91a98253740d7040a7510941f2c1cf47aeac43995d3c8fb5179cd8ea07f4c81deb31d9f76e4b56d8c766ae09d096ce465c20aa83852e35a3cdf454014e01aa7a
SSDEEP 12288:XCTe1kSypGZKP4B/p4ToniVwf4HOVddSQmdwM4ZU0FlDX3am6USAvYTy9fXE:XTHypGZJBeonKcT32dTyhU
MD5 SHA1 SHA512 SSDEEP

Submit Download

QMCommon.dll

Path \Program Files (x86)\iOAEnt\108.3.19160.62000\QMCommon.dll
Size 640KB
SHA256 37bf5713fd9597f996663b9cedc3a6b1e68bb1843d1fcda0127343289bcf11fd
MD5 efc3a09aca25ddf1bb43373f0b2b982e
SHA1 a731cb17df0f6de38824f516ad26e3154a6285f2
SHA512 a08aa256996d05bc98f30d3033834651552e24c83025f25f09019a8b71f8f99fedeb3e6910c130bbf152ab72177f0b5db010786ce4f2e4218e43f51d064aa632
SSDEEP 12288:XCTe1kSypGZKP4B/p4ToniVwf4HOVddSQmdwM4ZU0FlDX3am6USAvh:XTHypGZJBeonKcT32A
MD5 SHA1 SHA512 SSDEEP

Submit Download

QMContextScan.dll

Path \Program Files (x86)\iOAEnt\108.3.19160.62000\QMContextScan.dll
Size 156KB
SHA256 c7b34050ef7d3cc1c0e54edb43edf246357b0ad2226b6d780e09736214d912ad
MD5 57b85f017293e81ae565be54bc04a8ea
SHA1 00cd88ad2e1910dfb9c6367d362a4dbc9eb000bb
SHA512 6d607285b59c2948194771ca8058d7f469d1ad15cff75e4a38723eaea857289e323e0aa5e5c68ba8576c780ca843d13301ada0f6647dcc78ead93cfe65c4905a
SSDEEP 3072:DWrmetz7+WlEngUTRHFziXMHrSk2fOgmRFx5XluuBN:id7tEngU5JiXMLF8OgmznXlzz
MD5 SHA1 SHA512 SSDEEP

Submit Download

QMContextScan64.dll

Path \Program Files (x86)\iOAEnt\108.3.19160.62000\QMContextScan64.dll
Size 197KB
SHA256 da3e3393bc1bbf93a486762a0535e9b37e87b0002dec06d0d01bdd18ba5db4d4
MD5 afa70d7256d6c2aa9f556bbde098c322
SHA1 425eab3ab76e254850044876f07c454fc9fe0a83
SHA512 645915703229b70eb848e4d4fae076a4352a8ef0f9f9a19aa256eb698a975fa407c47b2d35d86cc40a7837e5cf27432ab16fd3d468108a9b153ef1dc480e94c1
SSDEEP 3072:vBFVdVZpjGYd1TBrncJ/lLkge5KuJQgrH+Pcmi09vdmNpeVi9xVps9ZeNOlTNCtR:vBRFaSQgrH+0mV4ki9oWOlTNCHnXlB//
MD5 SHA1 SHA512 SSDEEP

Submit Download

RefuseInject.dll

Path \Program Files (x86)\iOAEnt\108.3.19160.62000\RefuseInject.dll
Size 268KB
SHA256 7ef83d45d493fb3cf3846d1b14d75495891719c14ec7e0b624b4a400a13358aa
MD5 0c34f97c973145ae705cccab7ce13d86
SHA1 4af52a09092179f47e6a981d25355cf927b37d78
SHA512 db12760b9825ed6126645873881df09b4bed225c050e19f12518f61f2506315a8a3750e18fc62e370ca748147dd8ff9f19aebe1fc0708ac60c94c7620e7bcaf6
SSDEEP 3072:6n0qckHwpM8/5DRw9QsxQO6aFFKztOGS0Btj3HoMg5bOgR4wOXPxKzbC:6nckHW1hDR03ityOg5bOg6r/AnC
MD5 SHA1 SHA512 SSDEEP

Submit Download

RefuseInject.dll

Path \Program Files (x86)\iOAEnt\108.3.19160.62000\RefuseInject.dll
Size 128KB
SHA256 474f71e2e62cb896a29179060deba553a15a8f5fe6178d8e3b3cf7b89196aa50
MD5 3f733182900f0a82cb1fac1e9265f6a3
SHA1 b4ff1fc21a3afeb450bb954a4752259b59267cfb
SHA512 19640634b188486e8cc6b6b0607677f1c8b8430637a5944bee790bcb8fac9d7171e5e4cf61a54234747ad57dec0ac827a79da95aacf7b48765b1658b364b032d
SSDEEP 1536:6n0eTxcqxHwPBPk35eee5P7ecw9Q8x7FHvdjbQ8Q5Y5QxEwY2aiNHLD9ud+KKzmF:6n0qckHwpM8/5DRw9QsxQO6aFFKztOR
MD5 SHA1 SHA512 SSDEEP

Submit Download

TSWebMon64.dat

Path \Program Files (x86)\iOAEnt\108.3.19160.62000\TSWebMon64.dat
Size 376KB
SHA256 a1d9f97fb6d5b9655a6c97e6fc03249a43c559abb1fcb057c67974ae0679c58c
MD5 f217f4dd7fa2b31e81ff70db617a35c9
SHA1 ad31a2b23da2071bbe8a76cd27f157d51a62b89f
SHA512 f75fce7b34faca6bc78920f1b2acd6a55c218f0fc9135f4e1fc9b6da0ac0c399afbb3e12e56b85fccbb9a2801372fb50f3482c410e97ce8f41fd6a0396424728
SSDEEP 6144:1223ThLSjytepqRmT0U7Uz8/u99i4TBWYAFvTHnO9ZK+E6r:E23qwmT0dA/29i4TYYAdmK+E6r
MD5 SHA1 SHA512 SSDEEP

Submit Download

dr.dll

Path \Program Files (x86)\iOAEnt\108.3.19160.62000\dr.dll
Size 220KB
SHA256 85c3c7362076d08d708f14205331fe5a75d9f0a31ed81628dde1a1563bf1eab8
MD5 e37afc1b480febd42fe712cebdea5cca
SHA1 f95be7bc3cea9add362decf8e4e1d7390c7594e4
SHA512 c6dc22130fdff80e89ba720a9864400ded9ba198c082461179dae8e305a74c411deffff75dc8abda17426d93a7eb7b929b8b2cf7c43ddb72cfda7af4bfd92d22
SSDEEP 3072:aUqCL7cwTo13wEesmjangJKKWg8hzDGZNrRej3YU8r2QiZNUqOAGtIyfs:dqCL7cw8NOxjanjrPa3r63UqOAGtFfs
MD5 SHA1 SHA512 SSDEEP

Submit Download

dr.dll

Path \Program Files (x86)\iOAEnt\108.3.19160.62000\dr.dll
Size 128KB
SHA256 5e4dde794ae65739db723427bb78b0f8665e3de0ef0bcdccb933191f2da5a109
MD5 83175bbc4ea85c2b82c5c344bc4891a1
SHA1 ba1d1e271616a71bfeb1992e3089b0d1972f344f
SHA512 e0a7152bb5155d8fd7dd18e5c9fede0a807ea15634d7354a0127c401c6edef8e8aac0d3e513178c6811a2ea639a50f4341c346776a5713fa103b7485ecef16ba
SSDEEP 1536:H63HFxyrF391qaBQOVYsgD63qnmLmfic/XzCVTo13pUZnzBybqsHsKQjangKPe0b:aUqCL7cwTo13wEesmjangJKKWg8hzDZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

QMPicResize.exe

Path \Program Files (x86)\iOAEnt\108.3.19160.62000\platform\QMPicResize.exe
Size 1.6MB
SHA256 355fba4d8b346aa375152d0bb308c7476001533371d61d078c11ec7b2bb57dcb
MD5 3b63b68784f47f63c34b45ee7f9110b1
SHA1 4caa98c1db53a6242bf14999dc94af735d6c73ab
SHA512 c457f8b746a79d13075007ac0b1f85f1eae5bd1a2604a032520b922444b071619be88df50d4bb94acbe4f3d84a39f8d3144a8772ea23e1631070108b6d5502de
SSDEEP 24576:lguFV9KQxGie4cNRVikv06fhm2/LIGYtrWtycDAW7r7bX/Jq6Fi+7GZkIWq7Go2A:Mk6MrW7KvLe49T
MD5 SHA1 SHA512 SSDEEP

Submit Download

ptrate.dll

Path \Program Files (x86)\iOAEnt\108.3.19160.62000\ptrate.dll
Size 80KB
SHA256 873c78c9bc12430d0c1ea828f66a9f517ccd43f315fbc1990bcffc27a9ec37a6
MD5 e16d8717b7f3fc4d8b5026f39deeac97
SHA1 e66d99c7943dd8ba6fb147a909e04c0e481f0096
SHA512 6d35eff125a510779a77c6ef976740df03ed5e273106d251d33677ae61e596240e43d467e90a8bcb129dd9843491ec2579009f81641922d5e640573eea316b1e
SSDEEP 768:2MF9lSP166TJws85eCICj4hfSwX6lbxbOjlFvdTdw2M6DGjENAMxzB:394P1jwVkCICka8+1OjlFvdT6juxV
MD5 SHA1 SHA512 SSDEEP

Submit Download

zlib.dll

Path \Program Files (x86)\iOAEnt\108.3.19160.62000\zlib.dll
Size 86KB
SHA256 7edcb2f6e382e9f38e061be8fe3d6e60e9a750c3baf29791adf900b5d396d363
MD5 bd6c48ba68daeb86833aa6b850541f2c
SHA1 092aef7aadce020ed99523f043436c9b4e1f088a
SHA512 6eee47c41b670637e33a82cad3baef197e462561d6b1d94467875199683e24a9b7cbbef72c06b37b9a8b04fda03025b3f15bb296b1fb6be0dc6159124fd9f76e
SSDEEP 768:PmRYttV2un5Q8Ec7zzDIytwHOC8rPVAtNe5CRDTzSHnWFnCsDIOlIOenToIf1eKP:ZtfZhwuIveaI6bDIOlIOenToIfkd0
MD5 SHA1 SHA512 SSDEEP

Submit Download

PackageConf.dll

Path \Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~f7649ad\PackageConf.dll
Size 263KB
SHA256 b953e77f456824c4d2676115a16fbc1fec5fd7082abd71b15e7b138efc1d89ce
MD5 b2200029329c9713ead6da9cbd4b5b81
SHA1 a79878005b4ed69ec3f75dc1591923255ba37a6a
SHA512 dd629ede86fccf37653a0dd525f18d03b47455261139d802f1b9a54d8fd02743b748d7fb0008335d6ea948f3e122eca7e6b8bd84213ebfb647e9e089e89df2c7
SSDEEP 6144:lC5XDTHpHf9HNPr6mfoyHWsSBNKrE0hZoUiOKUiwZjFQeHJGQcRBbzzUT:k5DTJHf9HNPemfoybSBNKrE0hZoUiOwi
MD5 SHA1 SHA512 SSDEEP

Submit Download

TestMSVCR.exe

Path \Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~f7649ad\TestMSVCR.exe
Size 16KB
SHA256 3313c7606698e6721f65a8ec84e7e1f95859b39a7e2ca40463164788ab00565d
MD5 4b847825788ec131032f106500638b92
SHA1 b5948921e9d3331eda2906cb664d32ab05564434
SHA512 e1390df49d8c101aa946ec01600ea7a55953ca950011e64c6343d672179ffbe5e1eff98fadc1b38464702e20c7c1e830eb928a1886dbd4ed4c95a57abbd29146
SSDEEP 192:TkBNxPBBaJ1faZzWk+TpMK6pkq/xtxnYe+PjPQu7qrPyIAm+vy6QEr9ZCspE+TMc:TK218otZ6ltxnYPLQjyIANweMvE
MD5 SHA1 SHA512 SSDEEP

Submit Download

dr.dll

Path \Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~f7649ad\dr.dll
Size 421KB
SHA256 7c8fbe194c7267c97bb27b92f5d592aa1716464bbdfac466ae33416b54bb32d7
MD5 e66d3647228022225b49581d61a5c7fc
SHA1 7eb433b0248ac944fde1dc73ed25e862963ec061
SHA512 c0bf9a22da3417e64d216c7cd9a4d8550a36b1af2de069286742dce5840c5a9e7043332694ef5ca7906b60d3548b9c6954cfd7e8d6057ae65e721f842c5c7d64
SSDEEP 6144:9l60JNNkR/Jn2ERRuzqSl7mMwJqcRMcyMAPfdk3Y4i5PuTB0BWnSPqIAOeP:76yW32Yol9wJqcRMcyxd/4AuTOBWSa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/888-1547-0x000000006FFE0000-0x000000006FFF0000-memory.dmp

Download

memory/888-1565-0x0000000077679000-0x000000007767A000-memory.dmp

Download

memory/888-1570-0x0000000077050000-0x00000000770ED000-memory.dmp

Download

memory/888-1563-0x00000000759C0000-0x0000000075AD0000-memory.dmp

Download

memory/888-1620-0x00000000759C0000-0x0000000075AD0000-memory.dmp

Download

memory/888-1612-0x0000000075AF0000-0x0000000075C4C000-memory.dmp

Download

memory/2208-37-0x0000000002340000-0x0000000002341000-memory.dmp

Download

memory/2208-63-0x000000000EF90000-0x000000000EF96000-memory.dmp

Download

memory/2208-1609-0x0000000002340000-0x0000000002341000-memory.dmp

Download

memory/2208-1613-0x000000000EF90000-0x000000000EF96000-memory.dmp

Download

memory/2328-1648-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/2328-1647-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/2428-1538-0x000000006FFF0000-0x0000000070000000-memory.dmp

Download

memory/2508-67-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/2508-66-0x0000000000400000-0x0000000000406000-memory.dmp

Download