gh0strat | 2c12e2073d0b50369b0b10ebbdb8bf8357fbf7cdca3f97b0b84192339b846c25

Resubmissions

19-07-2024 08:22

240719-j929savcmd 6

19-07-2024 08:14

240719-j5fj8a1clk 10

19-07-2024 08:08

240719-j1lknstgpb 6

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
19-07-2024 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gooleo.msi
Size

87.8MB
MD5

e651816dd9240300cf9bd9c565e3b869
SHA1

a4bc6e8f6516f3d549195887d7095b9496ae52f9
SHA256

2c12e2073d0b50369b0b10ebbdb8bf8357fbf7cdca3f97b0b84192339b846c25
SHA512

90646a020b0ea67c912f999690382a44f5649c5f3c2a4a7c060aced6a9a71533b92c04d948db8bafd717dd295ad19bb85a71d73ef86a62613e65053323b108b8
SSDEEP

1572864:MKSA0Q9ilL4UxQUoim6casSZrcBsCWpuFg9O/jAaWFFDp+chVF1luEbtYio0z8+U:MbVQ92TQUooc3Uw2F9HHluEbtpoOKd3

Score

10^/10

gh0strat execution persistence privilege_escalation rat upx

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral4/memory/5792-485-0x00000000051E0000-0x0000000005A4F000-memory.dmp	family_gh0strat
behavioral4/memory/4104-655-0x00000000074C0000-0x0000000007D2F000-memory.dmp	family_gh0strat
behavioral4/memory/4104-681-0x0000000007D30000-0x000000000859F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/memory/3712-367-0x0000000000D90000-0x0000000000E1A000-memory.dmp	upx
behavioral4/memory/5792-380-0x00000000030D0000-0x000000000315A000-memory.dmp	upx
behavioral4/memory/5792-382-0x00000000030D0000-0x000000000315A000-memory.dmp	upx
behavioral4/memory/5792-383-0x0000000003310000-0x0000000003343000-memory.dmp	upx
behavioral4/memory/5792-435-0x0000000004700000-0x0000000004F6F000-memory.dmp	upx
behavioral4/memory/5792-446-0x00000000051E0000-0x0000000005A4F000-memory.dmp	upx
behavioral4/memory/5792-485-0x00000000051E0000-0x0000000005A4F000-memory.dmp	upx
behavioral4/memory/5792-524-0x00000000030D0000-0x000000000315A000-memory.dmp	upx
behavioral4/memory/4104-528-0x0000000002350000-0x0000000002389000-memory.dmp	upx
behavioral4/memory/4104-542-0x0000000002350000-0x0000000002389000-memory.dmp	upx
behavioral4/memory/3616-566-0x0000000003540000-0x00000000035CA000-memory.dmp	upx
behavioral4/memory/3616-598-0x0000000003540000-0x00000000035CA000-memory.dmp	upx
behavioral4/memory/5220-601-0x0000000002780000-0x00000000027B9000-memory.dmp	upx
behavioral4/memory/5220-604-0x0000000002780000-0x00000000027B9000-memory.dmp	upx
behavioral4/memory/4104-621-0x0000000002350000-0x0000000002389000-memory.dmp	upx
behavioral4/memory/4104-627-0x00000000074C0000-0x0000000007D2F000-memory.dmp	upx
behavioral4/memory/4104-628-0x0000000007D30000-0x000000000859F000-memory.dmp	upx
behavioral4/memory/4104-655-0x00000000074C0000-0x0000000007D2F000-memory.dmp	upx
behavioral4/memory/4104-681-0x0000000007D30000-0x000000000859F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	_QQMusicQC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	_QQMusicQC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	TaskLoad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	_QQMusicQC.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	TaskLoad.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	TaskLoad.exe
File opened (read-only)	\??\Y:	TaskLoad.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	TaskLoad.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	TaskLoad.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	TaskLoad.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	TaskLoad.exe
File opened (read-only)	\??\N:	TaskLoad.exe
File opened (read-only)	\??\S:	TaskLoad.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	TaskLoad.exe
File opened (read-only)	\??\V:	TaskLoad.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	TaskLoad.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	TaskLoad.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	TaskLoad.exe
File opened (read-only)	\??\J:	TaskLoad.exe
File opened (read-only)	\??\M:	TaskLoad.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	TaskLoad.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	TaskLoad.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	TaskLoad.exe
File opened (read-only)	\??\Z:	TaskLoad.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	TaskLoad.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defenderr\xflzikgl30\ImageRestoreLib8.dll	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\xflzikgl30\wavelet_3_8.dll	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\xflzikgl30\dll1.dll	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\xflzikgl30\libcef.dll	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\xflzikgl30\xflzikgl30.exe	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\xflzikgl30\WS_Log.dll	MsiExec.exe
File opened for modification	C:\Program Files\Windows Defenderr\xflzikgl30\WS_Log.dll	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\xflzikgl30\FourierTransformLib8.dll	MsiExec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIDCEF.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF359E5AE9D6106880.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF6843183DDA1ED4E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDEE5.tmp	msiexec.exe
File created	C:\Windows\Installer\{13A5BCD1-56BB-4290-90FC-9B59AC6F1C74}\PublicDocumentsFolderappR_1.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{13A5BCD1-56BB-4290-90FC-9B59AC6F1C74}\PublicDocumentsFolderappR_1.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e58db96.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{13A5BCD1-56BB-4290-90FC-9B59AC6F1C74}	msiexec.exe
File created	C:\Windows\Installer\e58db96.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDC13.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDD0F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF285F255E7773EEC6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2D4A8E5351D46C0B.TMP	msiexec.exe

Executes dropped EXE 5 IoCs

pid	Process
3712	xflzikgl30.exe
5792	TaskLoad.exe
4104	_QQMusicQC.exe
3616	TaskLoad.exe
5220	_QQMusicQC.exe

Loads dropped DLL 25 IoCs

pid	Process
4308	MsiExec.exe
4308	MsiExec.exe
4308	MsiExec.exe
4308	MsiExec.exe
4308	MsiExec.exe
4308	MsiExec.exe
4308	MsiExec.exe
1056	MsiExec.exe
1056	MsiExec.exe
1056	MsiExec.exe
3712	xflzikgl30.exe
3712	xflzikgl30.exe
3712	xflzikgl30.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
4104	_QQMusicQC.exe
4104	_QQMusicQC.exe
4104	_QQMusicQC.exe
3616	TaskLoad.exe
3616	TaskLoad.exe
3616	TaskLoad.exe
5220	_QQMusicQC.exe
5220	_QQMusicQC.exe
5220	_QQMusicQC.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1340	Powershell.exe
2992	Powershell.exe
3844	Powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

pid	Process
3308	msiexec.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5208	3712	WerFault.exe	101

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003e6aa7d03c0b469d0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003e6aa7d00000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003e6aa7d0000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3e6aa7d0000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003e6aa7d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TaskLoad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TaskLoad.exe

Kills process with taskkill 37 IoCs

evasion

pid	Process
1532	taskkill.exe
4108	taskkill.exe
1228	taskkill.exe
4076	taskkill.exe
5936	taskkill.exe
2880	taskkill.exe
2304	taskkill.exe
2708	taskkill.exe
3440	taskkill.exe
2872	taskkill.exe
3988	taskkill.exe
5840	taskkill.exe
2224	taskkill.exe
5840	taskkill.exe
5620	taskkill.exe
3112	taskkill.exe
4192	taskkill.exe
3308	taskkill.exe
1388	taskkill.exe
4428	taskkill.exe
2948	taskkill.exe
1532	taskkill.exe
5768	taskkill.exe
1160	taskkill.exe
3128	taskkill.exe
5808	taskkill.exe
4140	taskkill.exe
3992	taskkill.exe
4736	taskkill.exe
2456	taskkill.exe
5156	taskkill.exe
6016	taskkill.exe
3336	taskkill.exe
5372	taskkill.exe
5420	taskkill.exe
4780	taskkill.exe
5628	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	TaskLoad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	Powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	TaskLoad.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000300c2b6ab4d9da01	_QQMusicQC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	TaskLoad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	Powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	Powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	_QQMusicQC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\KeyNamereg = "KeyValue"	_QQMusicQC.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 5d54a9a2c2a0b4429708a0b2badd77c8190100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	_QQMusicQC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	Powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Wskcmqgamuikkc\Host = "23.106.141.194"	TaskLoad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	_QQMusicQC.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	_QQMusicQC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	Powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Wskcmqgamuikkc	TaskLoad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\KeyNamereg = "KeyValue"	TaskLoad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	Powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	TaskLoad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	Powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2700	msiexec.exe
2700	msiexec.exe
3712	xflzikgl30.exe
3712	xflzikgl30.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe
5792	TaskLoad.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3308	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3308	msiexec.exe
Token: SeSecurityPrivilege	2700	msiexec.exe
Token: SeCreateTokenPrivilege	3308	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3308	msiexec.exe
Token: SeLockMemoryPrivilege	3308	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3308	msiexec.exe
Token: SeMachineAccountPrivilege	3308	msiexec.exe
Token: SeTcbPrivilege	3308	msiexec.exe
Token: SeSecurityPrivilege	3308	msiexec.exe
Token: SeTakeOwnershipPrivilege	3308	msiexec.exe
Token: SeLoadDriverPrivilege	3308	msiexec.exe
Token: SeSystemProfilePrivilege	3308	msiexec.exe
Token: SeSystemtimePrivilege	3308	msiexec.exe
Token: SeProfSingleProcessPrivilege	3308	msiexec.exe
Token: SeIncBasePriorityPrivilege	3308	msiexec.exe
Token: SeCreatePagefilePrivilege	3308	msiexec.exe
Token: SeCreatePermanentPrivilege	3308	msiexec.exe
Token: SeBackupPrivilege	3308	msiexec.exe
Token: SeRestorePrivilege	3308	msiexec.exe
Token: SeShutdownPrivilege	3308	msiexec.exe
Token: SeDebugPrivilege	3308	msiexec.exe
Token: SeAuditPrivilege	3308	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3308	msiexec.exe
Token: SeChangeNotifyPrivilege	3308	msiexec.exe
Token: SeRemoteShutdownPrivilege	3308	msiexec.exe
Token: SeUndockPrivilege	3308	msiexec.exe
Token: SeSyncAgentPrivilege	3308	msiexec.exe
Token: SeEnableDelegationPrivilege	3308	msiexec.exe
Token: SeManageVolumePrivilege	3308	msiexec.exe
Token: SeImpersonatePrivilege	3308	msiexec.exe
Token: SeCreateGlobalPrivilege	3308	msiexec.exe
Token: SeCreateTokenPrivilege	3308	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3308	msiexec.exe
Token: SeLockMemoryPrivilege	3308	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3308	msiexec.exe
Token: SeMachineAccountPrivilege	3308	msiexec.exe
Token: SeTcbPrivilege	3308	msiexec.exe
Token: SeSecurityPrivilege	3308	msiexec.exe
Token: SeTakeOwnershipPrivilege	3308	msiexec.exe
Token: SeLoadDriverPrivilege	3308	msiexec.exe
Token: SeSystemProfilePrivilege	3308	msiexec.exe
Token: SeSystemtimePrivilege	3308	msiexec.exe
Token: SeProfSingleProcessPrivilege	3308	msiexec.exe
Token: SeIncBasePriorityPrivilege	3308	msiexec.exe
Token: SeCreatePagefilePrivilege	3308	msiexec.exe
Token: SeCreatePermanentPrivilege	3308	msiexec.exe
Token: SeBackupPrivilege	3308	msiexec.exe
Token: SeRestorePrivilege	3308	msiexec.exe
Token: SeShutdownPrivilege	3308	msiexec.exe
Token: SeDebugPrivilege	3308	msiexec.exe
Token: SeAuditPrivilege	3308	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3308	msiexec.exe
Token: SeChangeNotifyPrivilege	3308	msiexec.exe
Token: SeRemoteShutdownPrivilege	3308	msiexec.exe
Token: SeUndockPrivilege	3308	msiexec.exe
Token: SeSyncAgentPrivilege	3308	msiexec.exe
Token: SeEnableDelegationPrivilege	3308	msiexec.exe
Token: SeManageVolumePrivilege	3308	msiexec.exe
Token: SeImpersonatePrivilege	3308	msiexec.exe
Token: SeCreateGlobalPrivilege	3308	msiexec.exe
Token: SeCreateTokenPrivilege	3308	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3308	msiexec.exe
Token: SeLockMemoryPrivilege	3308	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3308	msiexec.exe
3308	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 4308	2700	msiexec.exe	85
PID 2700 wrote to memory of 4308	2700	msiexec.exe	85
PID 2700 wrote to memory of 4308	2700	msiexec.exe	85
PID 2700 wrote to memory of 1012	2700	msiexec.exe	92
PID 2700 wrote to memory of 1012	2700	msiexec.exe	92
PID 2700 wrote to memory of 1056	2700	msiexec.exe	94
PID 2700 wrote to memory of 1056	2700	msiexec.exe	94
PID 2700 wrote to memory of 1056	2700	msiexec.exe	94
PID 2700 wrote to memory of 2168	2700	msiexec.exe	98
PID 2700 wrote to memory of 2168	2700	msiexec.exe	98
PID 2700 wrote to memory of 2168	2700	msiexec.exe	98
PID 2168 wrote to memory of 3712	2168	MsiExec.exe	101
PID 2168 wrote to memory of 3712	2168	MsiExec.exe	101
PID 2168 wrote to memory of 3712	2168	MsiExec.exe	101
PID 3712 wrote to memory of 5792	3712	xflzikgl30.exe	102
PID 3712 wrote to memory of 5792	3712	xflzikgl30.exe	102
PID 3712 wrote to memory of 5792	3712	xflzikgl30.exe	102
PID 5792 wrote to memory of 1340	5792	TaskLoad.exe	105
PID 5792 wrote to memory of 1340	5792	TaskLoad.exe	105
PID 5792 wrote to memory of 1340	5792	TaskLoad.exe	105
PID 5792 wrote to memory of 4104	5792	TaskLoad.exe	109
PID 5792 wrote to memory of 4104	5792	TaskLoad.exe	109
PID 5792 wrote to memory of 4104	5792	TaskLoad.exe	109
PID 5792 wrote to memory of 3616	5792	TaskLoad.exe	110
PID 5792 wrote to memory of 3616	5792	TaskLoad.exe	110
PID 5792 wrote to memory of 3616	5792	TaskLoad.exe	110
PID 4104 wrote to memory of 5220	4104	_QQMusicQC.exe	111
PID 4104 wrote to memory of 5220	4104	_QQMusicQC.exe	111
PID 4104 wrote to memory of 5220	4104	_QQMusicQC.exe	111
PID 4104 wrote to memory of 4800	4104	_QQMusicQC.exe	112
PID 4104 wrote to memory of 4800	4104	_QQMusicQC.exe	112
PID 4104 wrote to memory of 4800	4104	_QQMusicQC.exe	112
PID 4104 wrote to memory of 5504	4104	_QQMusicQC.exe	113
PID 4104 wrote to memory of 5504	4104	_QQMusicQC.exe	113
PID 4104 wrote to memory of 5504	4104	_QQMusicQC.exe	113
PID 4104 wrote to memory of 4332	4104	_QQMusicQC.exe	114
PID 4104 wrote to memory of 4332	4104	_QQMusicQC.exe	114
PID 4104 wrote to memory of 4332	4104	_QQMusicQC.exe	114
PID 4104 wrote to memory of 2368	4104	_QQMusicQC.exe	115
PID 4104 wrote to memory of 2368	4104	_QQMusicQC.exe	115
PID 4104 wrote to memory of 2368	4104	_QQMusicQC.exe	115
PID 4104 wrote to memory of 5156	4104	_QQMusicQC.exe	116
PID 4104 wrote to memory of 5156	4104	_QQMusicQC.exe	116
PID 4104 wrote to memory of 5156	4104	_QQMusicQC.exe	116
PID 4104 wrote to memory of 2992	4104	_QQMusicQC.exe	118
PID 4104 wrote to memory of 2992	4104	_QQMusicQC.exe	118
PID 4104 wrote to memory of 2992	4104	_QQMusicQC.exe	118
PID 4104 wrote to memory of 3844	4104	_QQMusicQC.exe	120
PID 4104 wrote to memory of 3844	4104	_QQMusicQC.exe	120
PID 4104 wrote to memory of 3844	4104	_QQMusicQC.exe	120
PID 4104 wrote to memory of 4076	4104	_QQMusicQC.exe	122
PID 4104 wrote to memory of 4076	4104	_QQMusicQC.exe	122
PID 4104 wrote to memory of 4076	4104	_QQMusicQC.exe	122
PID 4104 wrote to memory of 5840	4104	_QQMusicQC.exe	124
PID 4104 wrote to memory of 5840	4104	_QQMusicQC.exe	124
PID 4104 wrote to memory of 5840	4104	_QQMusicQC.exe	124
PID 4104 wrote to memory of 1532	4104	_QQMusicQC.exe	126
PID 4104 wrote to memory of 1532	4104	_QQMusicQC.exe	126
PID 4104 wrote to memory of 1532	4104	_QQMusicQC.exe	126
PID 4104 wrote to memory of 1160	4104	_QQMusicQC.exe	128
PID 4104 wrote to memory of 1160	4104	_QQMusicQC.exe	128
PID 4104 wrote to memory of 1160	4104	_QQMusicQC.exe	128
PID 4104 wrote to memory of 3128	4104	_QQMusicQC.exe	130
PID 4104 wrote to memory of 3128	4104	_QQMusicQC.exe	130

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\gooleo.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3308

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2952CC270039E3D28EDB189D12FEE69D C
  2⤵
  - Loads dropped DLL
  PID:4308
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1012
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6F3223AC6352D5F3ABF92DE6601F04E1
  2⤵
  - Loads dropped DLL
  PID:1056
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CB6CBD89FB1365C30EF273B5B3831135 E Global\MSI0000
  2⤵
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Program Files\Windows Defenderr\xflzikgl30\xflzikgl30.exe
    "C:\Program Files\Windows Defenderr\xflzikgl30\xflzikgl30.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\Users\Public\Documents\TaskLoad.exe
      C:\Users\Public\Documents\TaskLoad.exe
      4⤵
      Adds Run key to start application
      Enumerates connected drives
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5792
    - - C:\Windows\SysWOW64\WindowsPowershell\v1.0\Powershell.exe
        
        "C:\Windows\System32\WindowsPowershell\v1.0\Powershell.exe" -Command "Set-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming","C:\Users\Admin\AppData\Local","C:\ProgramData","C:\Users\Public\Documents""
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        
        PID:1340
    - - C:\ProgramData\{23E67U23I87Y-3C7G3C7Y-2E6G3C8U-3W7O2U7C}\_QQMusicQC.exe
        
        "C:\ProgramData\{23E67U23I87Y-3C7G3C7Y-2E6G3C8U-3W7O2U7C}\_QQMusicQC.exe"
        5⤵
        Adds Run key to start application
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:4104
      - C:\ProgramData\{23E67U23I87Y-3C7G3C7Y-2E6G3C8U-3W7O2U7C}\_QQMusicQC.exe
        
        "C:\ProgramData\{23E67U23I87Y-3C7G3C7Y-2E6G3C8U-3W7O2U7C}\_QQMusicQC.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5220
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,32
        6⤵
        Adds Run key to start application
        Modifies data under HKEY_USERS
        
        PID:4800
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,32
        6⤵
        Adds Run key to start application
        Modifies data under HKEY_USERS
        
        PID:5504
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,32
        6⤵
        Adds Run key to start application
        Modifies data under HKEY_USERS
        
        PID:4332
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,32
        6⤵
        Adds Run key to start application
        
        PID:2368
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:5156
      - C:\Windows\SysWOW64\WindowsPowershell\v1.0\Powershell.exe
        
        "C:\Windows\System32\WindowsPowershell\v1.0\Powershell.exe" -Command "Set-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming","C:\Users\Admin\AppData\Local","C:\ProgramData","C:\Users\Public\Documents""
        6⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        
        PID:2992
      - C:\Windows\SysWOW64\WindowsPowershell\v1.0\Powershell.exe
        
        "C:\Windows\System32\WindowsPowershell\v1.0\Powershell.exe" -Command "Set-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming","C:\Users\Admin\AppData\Local","C:\ProgramData","C:\Users\Public\Documents""
        6⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        
        PID:3844
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:4076
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:5840
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:1532
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:1160
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:3128
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:6016
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:5620
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:3112
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:3336
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:5372
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2304
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:3440
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:5936
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:5808
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:4108
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:1388
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:1228
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:4428
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2872
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:3988
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:4192
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2708
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:5420
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:4140
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:3992
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2880
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:4736
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2948
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:3308
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:5840
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:1532
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2224
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:4780
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2456
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:5768
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:5628
    - - C:\Users\Public\Documents\TaskLoad.exe
        
        "C:\Users\Public\Documents\TaskLoad.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3616
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 648
      4⤵
      Program crash
      PID:5208

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3712 -ip 3712
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58db97.rbs

Filesize
52KB

MD5
441744a35409da395ca99fc16bbfc4a1

SHA1
7bd1c87407314700011b7fb12f0691aa968c4457

SHA256
408293b2975bc2353cef8164697832702fbddbefe31702e64348828d304936e4

SHA512
5799dbd55038d322543355b64015f37043d46f0c0391f9fc315053a13d25bf47d0f47e6255dfab194355a3a3938c31d45a0198cba488ade57f44646cc3918976

Download Submit
C:\Config.Msi\e58db98.rbf

Filesize
2KB

MD5
5b64182f38b99f1de80d5544c7dfa1e5

SHA1
6e7301ab9b3871c9d7aaced52cb2d5d34e7a59bd

SHA256
8c878db880bd020567eeacbf6c0c7e4086ddc9ad1e46882712c4ab78bb003acd

SHA512
1084fe9cb15888396201a15efcd126697b6d9866b019722c39a3c560a8d9503b5bf1f97cbd8fd5dd731c9a725380f2d4496eb75340e2820fc817d455b6781e53

Download Submit
C:\ProgramData\1

Filesize
2.0MB

MD5
faf4a129b091a57c3ff694dc721d4f3b

SHA1
7430935f501164b46b99766ed9ab68da0db50c24

SHA256
b1d13ed7409ca47f47d200f6b26d8da6a07e645ef49ddc9a28486f46bb8c41e7

SHA512
0103d9bfa27c809f978a2ac805e5eb59e07f0f0eef8aecf2713d8af1bff0d54fbc24043435cb67f550d5afdd6f0a2bc5c0026b6e920efe2ad21b619bbfbb0583

Download Submit
C:\ProgramData\11

Filesize
84KB

MD5
581e04ca52969a8a5eb97b46f7b85927

SHA1
1bc9f5dcf62a2ee361b3c45cfe008622f9353cbd

SHA256
14b8b4e4cdfd1e6e33aa7d28187ce9fb3507405e75edf1e97fc97a7bc4c4d5cd

SHA512
7185b0dea0fa52f0321e5608af6257e6caa3284a89065377501cbf7f59e5ece328f544922486f792a58f9d0efb09119900c3404469dcef56a3a53f0d484d55b3

Download Submit
C:\ProgramData\11

Filesize
84KB

MD5
97a2b445c8eac7f3b1edd94d67d2e768

SHA1
6c1ec795b0abf5fc8b9e4189f87a425624a28dc5

SHA256
452b3537cc4fc77acd5821ecdd33ae372e460a7b571f708fd91a6258d69c0149

SHA512
3d1eb3d8b1c56ae5b8d5c82380af4544457bc40c9fc6d6fbbdafc8b4f3d53fda2cbddad5aa983a207a708c596da2f00c1c7305093d3b575f6405d8dd064600a5

Download Submit
C:\ProgramData\12

Filesize
92KB

MD5
14f6c81cc6c2c225ca6b44ccb3343d70

SHA1
263108bc9f60251e094a7d4d216637d6c1f97f79

SHA256
f272d65dd3b608bb6a3d16f96a6cc5de00cd8f653c76ee422a6d452e55c67d9c

SHA512
7cacbdafb90cbcbb24365b50734de55432dfae8565d89a126453012a1688b4499ca0979b7ba27e89a116610c168a22219109253d4809195c7c6772cc892e6235

Download Submit
C:\ProgramData\12

Filesize
92KB

MD5
e61e00f904f561ec9e6574ddec3bb65a

SHA1
6458b901d065848b44988bff89b8e7933a43d7fc

SHA256
25bff93e68ed9086a8effd7c79e01fca7d3ab228b158acd57ebf583d0054e364

SHA512
06ee9b0b36de98cceafa938cab3f6523be42a869d4e28ffbb1dcbdcee363eeedbf320923653cc90450d0fb8d14cbaf74768acbe78c7177747f2a637103d043ac

Download Submit
C:\ProgramData\15

Filesize
978KB

MD5
8e945aaf7128bb3db83e51f3c2356637

SHA1
bcc64335efc63cb46e14cc330e105520391e2b00

SHA256
4fcf6394b14e24d830b04209a0ede1dcc911d199740a55d12c8ab8aeabb84073

SHA512
150636eea0cab3e738f5e94ae910d189622fa3221aca1cecc05bf0f5a80f2fab055adeafd99eab7a2a1d3911ff2784cf521a2681e5ddf7737f4363b915b8c2a8

Download Submit
C:\ProgramData\2

Filesize
80KB

MD5
b874ff17621f408640d95b411e573e55

SHA1
9abd7ec752fabc0b2266ca8b80ba8750a235e910

SHA256
3aee565192cd07dde0f38bcde06bad6de492049bcfd2c99e0fcb8cc3fc9b23ac

SHA512
62f81ebd60e134c95612d9dfa5e222a1bdd258d21a33f6ab3e02d7de7bba82b8b5b0177e44592748a3b0e262a18b8c74f50e5e8e6f3772e858843456d9d1469b

Download Submit
C:\ProgramData\4

Filesize
340KB

MD5
7daf9edc6f8f2b2b69bb9367cb99abbd

SHA1
ad05e73f713758350db5f7d6a283f0132a7fd47c

SHA256
2f3c6b44e994efb2f4e8edf5801580df5c74c7984287b62e0602af3c6818e81b

SHA512
dd48bd1a2578239b3820e32cf64fe50181b0e3ac75d8aa881d44424104c1ea251d1f996299f5a651bc58caed40f54c91d318a926e37c17655f592315ac56f16b

Download Submit
C:\ProgramData\YYcecccccdbe.ini

Filesize
56B

MD5
7ce2216b4527ad40a5c9e8b9cfab454b

SHA1
9f2cf1df7eef763bc1194a833f713ade077e35e9

SHA256
149d6fda62fe7fc624d959a8794ff5e6cc1fdbb720d4d2280a810e8067ccfcb0

SHA512
148a2c38c5ea7f229692a57783a70930a97ec4b006048d5cb45accf78e13b7318477b1b3c798d2db6cb194e88e2c9f9c61eaa6cec155d07632e0302be1d8a647

Download Submit
C:\ProgramData\a10

Filesize
36KB

MD5
f0284892937a97caa61afcd3b6ddb6d4

SHA1
f3c308e7e4aaa96919882994cdd21cc9f939cabd

SHA256
2514913f8a6f4671a058304651289b0babe47d81c044212b3140ed1c1b643b09

SHA512
058845e0a9a5892a69f24f3a77086e3f9546493ad40a0e5359aed05cf8882a9f3d7aee0449648d5cb76e51530af3e46af59a9b196cc92318334116c92dde4171

Download Submit
C:\ProgramData\a3

Filesize
14B

MD5
0d59c87827537cdd7727d1f0e4d6cce4

SHA1
6067300c20740cf2899d519382f36c453d9b7fca

SHA256
270a9ca2cc8d07c58e43466e95a8aedc7bde468b7b5c0c37845cad5f0d2ab6d2

SHA512
324aca54d36574f1a3d7ade872bc5d4bca8b6ae78817cefcf6fe74af51e90f67a808757eb3c84d65c2a8c8e0322cad8b30c83f29e0011c374fd114122ae92d7a

Download Submit
C:\ProgramData\a5

Filesize
56B

MD5
6f10d76e583b39191028ab57f8edbed9

SHA1
fbaa6e99f3a88d1e4cd606ca45debed661135c1d

SHA256
847f6e3577892365fadc94648eabdde48b9660590ba109e8387a9cb984aee476

SHA512
17a2f133b321fb9ac992e03da4ada3b3e5f1e507c7656d287ea00efddc50885c9ea9f337dd6b8cd52015060b4f0f4fc7832a7a3603ed5a3b498d8da47916743c

Download Submit
C:\ProgramData\a6

Filesize
200KB

MD5
078c21b8c91b86999427aa349cf5decf

SHA1
b939376eaebcf6994890db24ddcb2380c1925188

SHA256
ed2c6bc3e77a404b8cf61176844ad19c1fdcae19881206631e3f0831a4bd919a

SHA512
a006a36fdcaf4c2403238475163553ba2fe7783fea200f28df46ea980a3907d2b24c854153b45b730195a133fcb28f60c157f33c865ea286ad8c354981cf5885

Download Submit
C:\ProgramData\a7

Filesize
497KB

MD5
c8cf4eb512fadb813f69c3184e4bf44d

SHA1
492576912c7c0a224881ea45035a4a9270cd44f2

SHA256
678b89a2ca82b0b7803e36601bd6216c7687c4102de7071676390f2c252cb1fb

SHA512
006665dcf7cd8ad83f8b5c06c2ec9367ee8caa01c3c1cb9502bd540ac9940d103b84f6620ef8b5aa8e78fbe268994c0d8da5fa7ba550e1c8bd038fd1e43d39dc

Download Submit
C:\ProgramData\a8

Filesize
21KB

MD5
da08e194f9a7045dbb19f6e5d5d7f609

SHA1
7884062382bf1e7911f7e74198ca9fecec159c61

SHA256
9bd52ec7e7750500de33df995fcc7e68ed1da70d125579cf76ae8f787577ef75

SHA512
46720cd0677064b00a9e253953b8b6cd5141a99d0090ff0d7c4a24b830ca621878bcdfec3c56880f940662bd78f408782231bdd3cb370e06dadfee71e3e2b2b0

Download Submit
C:\ProgramData\a9

Filesize
13KB

MD5
37aa892a6f35bcbe9b01f0a424f5d4f6

SHA1
e5d60e43a8e0a4b7371bd736e21b1a59546774af

SHA256
6feeb95115d7d8a51403996fee1ad219a52151662d3a01a2d17cfb77dbd51f3b

SHA512
a5d5ac494cba18bb5b2582310416dc2e146732ba4f2eddab6611393d61ac0ae839bacae0da1e85f0965575e6d6284b1180e2e3adb924f1e19d2d7586d2abbd83

Download Submit
C:\ProgramData\{23E67U23I87Y-3C7G3C7Y-2E6G3C8U-3W7O2U7C}\QQMusic.dll

Filesize
92KB

MD5
3c99d99f288e5a9268f433993d17b235

SHA1
4e35aa2f729d1d1d82a75793a8d68e0ff5f2b180

SHA256
87772b03954d1d77c2667646a7a77d83719b714479df4e436b454192015eddb1

SHA512
239b4d0657c0fc631200a2a27f0f63e15af3823b39c3f14c2ca45e4e92c32ba998b334eee557466a1122e982fa104ce449ae946c4c1734b685c3c671473e6283

Download Submit
C:\ProgramData\{23E67U23I87Y-3C7G3C7Y-2E6G3C8U-3W7O2U7C}\vcruntime140.dll

Filesize
78KB

MD5
1b171f9a428c44acf85f89989007c328

SHA1
6f25a874d6cbf8158cb7c491dcedaa81ceaebbae

SHA256
9d02e952396bdff3abfe5654e07b7a713c84268a225e11ed9a3bf338ed1e424c

SHA512
99a06770eea07f36abc4ae0cecb2ae13c3acb362b38b731c3baed045bf76ea6b61efe4089cd2efac27701e9443388322365bdb039cd388987b24d4a43c973bd1

Download Submit
C:\Users\Admin\AppData\Local\Finkit\ManicTime.xml

Filesize
3KB

MD5
dfe8def4e493eae4ce53296cb2e035ba

SHA1
a68ed8826e8641b2913b2f5af9d0cf4ec0d9f1b1

SHA256
af0b40b517b1fd802f9e19cd6c15fd15be4e9ea259f747a8456253c7329f3792

SHA512
cf8e8176bc9e5f7b5ad7f6b0479e9b1722a5a0463277b134f873bc27fccd01f3f5d8888053ece1118e207c92b622dee1519c25549c82b2624853e44b9d4ed4c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3E2D.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_skfjcok4.m2v.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\_2

Filesize
362KB

MD5
1b6bc40c6c5fbd9032ee3779057efe86

SHA1
9fa7737b2c1d792ee76b587cece5b7831e684b11

SHA256
b163b5e667bcaac3c682940889abd56280983ee2c5936924e1182aa80f867f87

SHA512
295603b80684fee2b646048392398fc3a4f4f58f6fbbcbc1dbe76819bd5a4cc5cdc0f2ed9374334babf23928448fc38b154c115a07646fe278481cb921028703

Download Submit
C:\Users\Admin\AppData\Local\_2.dll

Filesize
344KB

MD5
27bfaff47dce732f5e1bada41b756612

SHA1
33efd88e7ce656e01939b48ad2ff513fa29b9699

SHA256
ab27ae2fa1ee803f1d7269b674a4825ef7f70badfe8b9e7456b2ce6235fe9b56

SHA512
057ce5a8e47a59ec2d98581bb5e6568c2968709c87adcb7aa761cfa0ff07ea1706ca74f4c0fffef0eb92cdfdadf6dafa8664e3c69ed9d94deb423a1b0b6c1da1

Download Submit
C:\Users\Admin\AppData\Roaming\Consys21.png

Filesize
319KB

MD5
059afc1c343329409574a6e7a2952246

SHA1
9a5c2c1e8ef822907a58732d674194e2ae89d52c

SHA256
6cb8d7f52b605312920ef6dd7cc17e72a291d924a967b924ccf81dd118d7f8e4

SHA512
bc847cf20d009a5e7560f040978447817b3c6ca4a94e255c824b0820ab4fbcc1edca818b19d754a5b062236a25966fabb5d52f11abf5cbe5bc5936d9abe8fd06

Download Submit
C:\Users\Admin\AppData\Roaming\apple\Runlnk.lnk

Filesize
854B

MD5
a2bfeb3ba4879bd61b20ac5d9865dc79

SHA1
395aa3a98634ceab03e37d30a7ab84a54623c78f

SHA256
a05185740c597b99fc3768a02a095c97cfc4a52ebe892d9d8b61493959ad1951

SHA512
1016222486c08c28b555473a1276b684dcb1355274722e42d6c3427893167792283b151e3d4687422eec9b9895e3cf2a2a02c547714748b36831eb785ba74133

Download Submit
C:\Users\Admin\AppData\Roaming\chormeui\chomeui.exe

Filesize
1.3MB

MD5
84ba3c0d3d383c2676810494a7b5d4d4

SHA1
51dc4edee8e6d061dddf557861655079bb568308

SHA256
1dce1e3cef651f20cad4f096997407db5b5837b60a52b0abb8ad4c087b6a02e0

SHA512
6246e29c25c45258a2f244cb31991202d1b57e9309521296787b90d1662b3e9dd14d27cdd5557fbab39b66e18bbb63c9bf346091d0bf2dcfc798745ce030d079

Download Submit
C:\Users\Admin\AppData\Roaming\install.ini

Filesize
47B

MD5
c6b92dd6631be4719db3e258fc834151

SHA1
17e2de7b48bb373705e44c50c0e70f435743860e

SHA256
1e170289b158d70bff755b7d4f842833dd139afce297ae581b11a93cc2c52681

SHA512
841d7aae253d7efa8db7e1ce210aa1a4cfc55e251b5905ef08f0a64a68f643558e69f10a7a95bdb0124483056a676d7a2536a32c491169e78f32f7e8819be227

Download Submit
C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe

Filesize
623KB

MD5
d9746c8d55bed7b372ccef704f96ddda

SHA1
61c6b8ba9108fc7617264bb7d58e163457946e5b

SHA256
afbfea15784c32277edf9d4c985d210c5c46baef46db1c6bed2d2a964d2b70fd

SHA512
e00d687bd7cee039c6eddddab2b89e26136f842bda19630de53220f3459a73a4bd2ba0c76267b977e265d7cdf98d21cd94d327fa143477a427ccd0a5fd57910e

Download Submit
C:\Verifier\MSExGYAI

Filesize
108KB

MD5
32c4e9c809fd633ce8e661c003e4cbec

SHA1
1b9b6c7d78bf69397648ef30697366a7d83af487

SHA256
2af34e5ddf1c38783ab319e1320a7f40f526d66c45e910a0f906fab6c2eb7dba

SHA512
dffd43ca0326b4e501ee0586ab795e7196e2f11c3bbf212a367477174c4877b32a1677b5240976c93f45a065df77989f686597bda6a3bc414931617f4729419c

Download Submit
C:\Verifier\OaOAOM

Filesize
96KB

MD5
6103dbe823a015788397731babc5e4ee

SHA1
2cecbdaff319322365fa2b0a87d191e185d73e4a

SHA256
37e0a8caa6c3b65799690bd9f655ede1eb476f00410f6021c14d1138e01aa7b7

SHA512
62d5bf0481a69c7403290b0b37d6a36dd9645a659b7c00e50fc494b2fad99fb06fa2dfb93a9e716271b156f2f3c27bbbe84d4e95a59a8071cfbfa3e44b31ba5d

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
12.8MB

MD5
6faa606f6e097d5c46b07fd0d4aae2a4

SHA1
1f4683f899194e0a02d8c28f1afd12f14a175247

SHA256
58b5a62656fd20f079b56ab930420b4b6f87eab699f60343e319e750c6b01bd4

SHA512
84aebb695fba906c0aa774468baedc6af69714064c4aaac3d6162a2af042c3e05f0da422b166cf0846340fb1a3c415e075b41443d1cb1e5682a9cf545e2ae4a1

Download Submit
\??\Volume{d0a76a3e-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{7991d69a-b197-41b6-b290-a1973565ea49}_OnDiskSnapshotProp

Filesize
6KB

MD5
92f9ba3d7b11710100c168ccedb234a4

SHA1
2dd3df8d8429dcb1ce1f947aa6cf35b10232ed25

SHA256
7b3cc5ad43becc74a20d69624d3c7a759189a8c568e3eef3075dc371762d572c

SHA512
f5e6043e9155ceeb38e8055b880b47ec65efaf89366364493d5bc3f6e22f79ef3d47ae5d2912fb179402086f2635280f9785857d6c225660a7baa736a575e7a6

Download Submit
memory/1340-561-0x0000000007A20000-0x0000000007A2A000-memory.dmp

Filesize
40KB

Download
memory/1340-547-0x0000000007FE0000-0x000000000865A000-memory.dmp

Filesize
6.5MB

Download
memory/1340-563-0x0000000007BB0000-0x0000000007BC1000-memory.dmp

Filesize
68KB

Download
memory/1340-508-0x0000000003180000-0x00000000031B6000-memory.dmp

Filesize
216KB

Download
memory/1340-509-0x0000000005870000-0x0000000005E9A000-memory.dmp

Filesize
6.2MB

Download
memory/1340-510-0x0000000005FF0000-0x0000000006012000-memory.dmp

Filesize
136KB

Download
memory/1340-511-0x0000000006090000-0x00000000060F6000-memory.dmp

Filesize
408KB

Download
memory/1340-512-0x0000000006100000-0x0000000006166000-memory.dmp

Filesize
408KB

Download
memory/1340-562-0x0000000007C30000-0x0000000007CC6000-memory.dmp

Filesize
600KB

Download
memory/1340-521-0x0000000006170000-0x00000000064C7000-memory.dmp

Filesize
3.3MB

Download
memory/1340-522-0x0000000006640000-0x000000000665E000-memory.dmp

Filesize
120KB

Download
memory/1340-605-0x0000000007BF0000-0x0000000007C05000-memory.dmp

Filesize
84KB

Download
memory/1340-523-0x00000000066E0000-0x000000000672C000-memory.dmp

Filesize
304KB

Download
memory/1340-548-0x00000000079A0000-0x00000000079BA000-memory.dmp

Filesize
104KB

Download
memory/1340-531-0x00000000734B0000-0x00000000734FC000-memory.dmp

Filesize
304KB

Download
memory/1340-530-0x0000000007800000-0x0000000007834000-memory.dmp

Filesize
208KB

Download
memory/1340-540-0x0000000007840000-0x000000000785E000-memory.dmp

Filesize
120KB

Download
memory/1340-630-0x0000000007CE0000-0x0000000007CE8000-memory.dmp

Filesize
32KB

Download
memory/1340-543-0x0000000007860000-0x0000000007904000-memory.dmp

Filesize
656KB

Download
memory/1340-597-0x0000000007BE0000-0x0000000007BEE000-memory.dmp

Filesize
56KB

Download
memory/1340-620-0x0000000007CF0000-0x0000000007D0A000-memory.dmp

Filesize
104KB

Download
memory/2992-708-0x00000000734B0000-0x00000000734FC000-memory.dmp

Filesize
304KB

Download
memory/2992-726-0x00000000073C0000-0x00000000073D1000-memory.dmp

Filesize
68KB

Download
memory/3616-598-0x0000000003540000-0x00000000035CA000-memory.dmp

Filesize
552KB

Download
memory/3616-566-0x0000000003540000-0x00000000035CA000-memory.dmp

Filesize
552KB

Download
memory/3712-367-0x0000000000D90000-0x0000000000E1A000-memory.dmp

Filesize
552KB

Download
memory/3844-717-0x00000000734B0000-0x00000000734FC000-memory.dmp

Filesize
304KB

Download
memory/4104-627-0x00000000074C0000-0x0000000007D2F000-memory.dmp

Filesize
8.4MB

Download
memory/4104-628-0x0000000007D30000-0x000000000859F000-memory.dmp

Filesize
8.4MB

Download
memory/4104-528-0x0000000002350000-0x0000000002389000-memory.dmp

Filesize
228KB

Download
memory/4104-681-0x0000000007D30000-0x000000000859F000-memory.dmp

Filesize
8.4MB

Download
memory/4104-655-0x00000000074C0000-0x0000000007D2F000-memory.dmp

Filesize
8.4MB

Download
memory/4104-542-0x0000000002350000-0x0000000002389000-memory.dmp

Filesize
228KB

Download
memory/4104-621-0x0000000002350000-0x0000000002389000-memory.dmp

Filesize
228KB

Download
memory/4104-506-0x00000000022F0000-0x0000000002346000-memory.dmp

Filesize
344KB

Download
memory/5220-546-0x00000000022A0000-0x00000000022F6000-memory.dmp

Filesize
344KB

Download
memory/5220-604-0x0000000002780000-0x00000000027B9000-memory.dmp

Filesize
228KB

Download
memory/5220-601-0x0000000002780000-0x00000000027B9000-memory.dmp

Filesize
228KB

Download
memory/5792-383-0x0000000003310000-0x0000000003343000-memory.dmp

Filesize
204KB

Download
memory/5792-435-0x0000000004700000-0x0000000004F6F000-memory.dmp

Filesize
8.4MB

Download
memory/5792-382-0x00000000030D0000-0x000000000315A000-memory.dmp

Filesize
552KB

Download
memory/5792-380-0x00000000030D0000-0x000000000315A000-memory.dmp

Filesize
552KB

Download
memory/5792-524-0x00000000030D0000-0x000000000315A000-memory.dmp

Filesize
552KB

Download
memory/5792-446-0x00000000051E0000-0x0000000005A4F000-memory.dmp

Filesize
8.4MB

Download
memory/5792-485-0x00000000051E0000-0x0000000005A4F000-memory.dmp

Filesize
8.4MB

Download