7279a86c5d2e4229a197b344ba1de7a8010d92bef391a4a4b0071153e8624e8b

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

quickq-setup.exe
Size

125.5MB
MD5

e87ffa1c871af8d4ff0fc61488069cb7
SHA1

ee853e1eb7a3605f22ebf45257fc5364fb5368ff
SHA256

7279a86c5d2e4229a197b344ba1de7a8010d92bef391a4a4b0071153e8624e8b
SHA512

d7eec65406295f3565d339f5f10102a5fc234647a76e23322eea7672d670a8edebb6192b05d691801bc7a3cadc47a021d2e66373327951ac72c7f7b20026ce61
SSDEEP

3145728:QT7e6GreS1e3aoeAmloP6AxVmsOQq9x/tDkIH1l2uw4Dc:bULzmUBx3sjB9gD4Y

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
264	MSICF37.tmp
2620	win32-quickq.exe
1820	MSID061.tmp
1600	WindowsProgram.exe
10132	Suiqiaa.exe
9712	Suiqiaa.exe

Loads dropped DLL 22 IoCs

pid	Process
2988	MsiExec.exe
2740	MsiExec.exe
2740	MsiExec.exe
2740	MsiExec.exe
2740	MsiExec.exe
2620	win32-quickq.exe
2620	win32-quickq.exe
2620	win32-quickq.exe
2620	win32-quickq.exe
2620	win32-quickq.exe
2620	win32-quickq.exe
2620	win32-quickq.exe
2620	win32-quickq.exe
2620	win32-quickq.exe
2620	win32-quickq.exe
2620	win32-quickq.exe
2620	win32-quickq.exe
2620	win32-quickq.exe
2620	win32-quickq.exe
2620	win32-quickq.exe
2620	win32-quickq.exe
2620	win32-quickq.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	quickq-setup.exe
File opened (read-only)	\??\Q:	quickq-setup.exe
File opened (read-only)	\??\Z:	quickq-setup.exe
File opened (read-only)	\??\M:	quickq-setup.exe
File opened (read-only)	\??\N:	quickq-setup.exe
File opened (read-only)	\??\Q:	WindowsProgram.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	WindowsProgram.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	WindowsProgram.exe
File opened (read-only)	\??\J:	WindowsProgram.exe
File opened (read-only)	\??\V:	WindowsProgram.exe
File opened (read-only)	\??\H:	quickq-setup.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	WindowsProgram.exe
File opened (read-only)	\??\I:	WindowsProgram.exe
File opened (read-only)	\??\A:	quickq-setup.exe
File opened (read-only)	\??\E:	quickq-setup.exe
File opened (read-only)	\??\X:	quickq-setup.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	WindowsProgram.exe
File opened (read-only)	\??\O:	WindowsProgram.exe
File opened (read-only)	\??\R:	WindowsProgram.exe
File opened (read-only)	\??\S:	quickq-setup.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	WindowsProgram.exe
File opened (read-only)	\??\O:	quickq-setup.exe
File opened (read-only)	\??\W:	quickq-setup.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	quickq-setup.exe
File opened (read-only)	\??\J:	quickq-setup.exe
File opened (read-only)	\??\R:	quickq-setup.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	WindowsProgram.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	WindowsProgram.exe
File opened (read-only)	\??\K:	WindowsProgram.exe
File opened (read-only)	\??\Y:	WindowsProgram.exe
File opened (read-only)	\??\Z:	WindowsProgram.exe
File opened (read-only)	\??\L:	quickq-setup.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	quickq-setup.exe
File opened (read-only)	\??\U:	quickq-setup.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 46 IoCs

pid	Process
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
10132	Suiqiaa.exe
1600	WindowsProgram.exe
10132	Suiqiaa.exe
1600	WindowsProgram.exe
10132	Suiqiaa.exe
1600	WindowsProgram.exe
10132	Suiqiaa.exe
1600	WindowsProgram.exe
10132	Suiqiaa.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
9712	Suiqiaa.exe
9712	Suiqiaa.exe
1600	WindowsProgram.exe
9712	Suiqiaa.exe
1600	WindowsProgram.exe
9712	Suiqiaa.exe
1600	WindowsProgram.exe
9712	Suiqiaa.exe
1600	WindowsProgram.exe
9712	Suiqiaa.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Qmqsgi\Suiqiaa.exe	WindowsProgram.exe
File opened for modification	C:\Program Files (x86)\Microsoft Qmqsgi\Suiqiaa.exe	WindowsProgram.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIC988.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC9E7.tmp	msiexec.exe
File created	C:\Windows\Installer\f77c851.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICE4B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICF37.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f77c84e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC939.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f77c851.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID061.tmp	msiexec.exe
File created	C:\Windows\Installer\f77c84e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC89C.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSICF37.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsProgram.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Suiqiaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Suiqiaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSID061.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win32-quickq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	quickq-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WindowsProgram.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WindowsProgram.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
6940	taskkill.exe
7048	taskkill.exe
7108	taskkill.exe
3092	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 34 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5200310000000000e8588468122041707044617461003c0008000400efbee8588468e85884682a000000ec0100000000020000000000000000000000000000004100700070004400610074006100000016000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c00310000000000e858b26d100041646d696e00380008000400efbee8588468e858b26d2a00000031000000000004000000000000000000000000000000410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7400310000000000e85884681100557365727300600008000400efbeee3a851ae85884682a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c003100000000001459727210204c6f63616c00380008000400efbee8588468145972722a000000ff0100000000020000000000000000000000000000004c006f00630061006c00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 5000310000000000145977721020517569636b5100003a0008000400efbe14597272145977722a0000002b20010000000b00000000000000000000000000000051007500690063006b005100000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2844	msiexec.exe
2844	msiexec.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe
1600	WindowsProgram.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2844	msiexec.exe
Token: SeTakeOwnershipPrivilege	2844	msiexec.exe
Token: SeSecurityPrivilege	2844	msiexec.exe
Token: SeCreateTokenPrivilege	808	quickq-setup.exe
Token: SeAssignPrimaryTokenPrivilege	808	quickq-setup.exe
Token: SeLockMemoryPrivilege	808	quickq-setup.exe
Token: SeIncreaseQuotaPrivilege	808	quickq-setup.exe
Token: SeMachineAccountPrivilege	808	quickq-setup.exe
Token: SeTcbPrivilege	808	quickq-setup.exe
Token: SeSecurityPrivilege	808	quickq-setup.exe
Token: SeTakeOwnershipPrivilege	808	quickq-setup.exe
Token: SeLoadDriverPrivilege	808	quickq-setup.exe
Token: SeSystemProfilePrivilege	808	quickq-setup.exe
Token: SeSystemtimePrivilege	808	quickq-setup.exe
Token: SeProfSingleProcessPrivilege	808	quickq-setup.exe
Token: SeIncBasePriorityPrivilege	808	quickq-setup.exe
Token: SeCreatePagefilePrivilege	808	quickq-setup.exe
Token: SeCreatePermanentPrivilege	808	quickq-setup.exe
Token: SeBackupPrivilege	808	quickq-setup.exe
Token: SeRestorePrivilege	808	quickq-setup.exe
Token: SeShutdownPrivilege	808	quickq-setup.exe
Token: SeDebugPrivilege	808	quickq-setup.exe
Token: SeAuditPrivilege	808	quickq-setup.exe
Token: SeSystemEnvironmentPrivilege	808	quickq-setup.exe
Token: SeChangeNotifyPrivilege	808	quickq-setup.exe
Token: SeRemoteShutdownPrivilege	808	quickq-setup.exe
Token: SeUndockPrivilege	808	quickq-setup.exe
Token: SeSyncAgentPrivilege	808	quickq-setup.exe
Token: SeEnableDelegationPrivilege	808	quickq-setup.exe
Token: SeManageVolumePrivilege	808	quickq-setup.exe
Token: SeImpersonatePrivilege	808	quickq-setup.exe
Token: SeCreateGlobalPrivilege	808	quickq-setup.exe
Token: SeCreateTokenPrivilege	808	quickq-setup.exe
Token: SeAssignPrimaryTokenPrivilege	808	quickq-setup.exe
Token: SeLockMemoryPrivilege	808	quickq-setup.exe
Token: SeIncreaseQuotaPrivilege	808	quickq-setup.exe
Token: SeMachineAccountPrivilege	808	quickq-setup.exe
Token: SeTcbPrivilege	808	quickq-setup.exe
Token: SeSecurityPrivilege	808	quickq-setup.exe
Token: SeTakeOwnershipPrivilege	808	quickq-setup.exe
Token: SeLoadDriverPrivilege	808	quickq-setup.exe
Token: SeSystemProfilePrivilege	808	quickq-setup.exe
Token: SeSystemtimePrivilege	808	quickq-setup.exe
Token: SeProfSingleProcessPrivilege	808	quickq-setup.exe
Token: SeIncBasePriorityPrivilege	808	quickq-setup.exe
Token: SeCreatePagefilePrivilege	808	quickq-setup.exe
Token: SeCreatePermanentPrivilege	808	quickq-setup.exe
Token: SeBackupPrivilege	808	quickq-setup.exe
Token: SeRestorePrivilege	808	quickq-setup.exe
Token: SeShutdownPrivilege	808	quickq-setup.exe
Token: SeDebugPrivilege	808	quickq-setup.exe
Token: SeAuditPrivilege	808	quickq-setup.exe
Token: SeSystemEnvironmentPrivilege	808	quickq-setup.exe
Token: SeChangeNotifyPrivilege	808	quickq-setup.exe
Token: SeRemoteShutdownPrivilege	808	quickq-setup.exe
Token: SeUndockPrivilege	808	quickq-setup.exe
Token: SeSyncAgentPrivilege	808	quickq-setup.exe
Token: SeEnableDelegationPrivilege	808	quickq-setup.exe
Token: SeManageVolumePrivilege	808	quickq-setup.exe
Token: SeImpersonatePrivilege	808	quickq-setup.exe
Token: SeCreateGlobalPrivilege	808	quickq-setup.exe
Token: SeCreateTokenPrivilege	808	quickq-setup.exe
Token: SeAssignPrimaryTokenPrivilege	808	quickq-setup.exe
Token: SeLockMemoryPrivilege	808	quickq-setup.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
808	quickq-setup.exe
2876	msiexec.exe
2876	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2988	2844	msiexec.exe	31
PID 2844 wrote to memory of 2988	2844	msiexec.exe	31
PID 2844 wrote to memory of 2988	2844	msiexec.exe	31
PID 2844 wrote to memory of 2988	2844	msiexec.exe	31
PID 2844 wrote to memory of 2988	2844	msiexec.exe	31
PID 2844 wrote to memory of 2988	2844	msiexec.exe	31
PID 2844 wrote to memory of 2988	2844	msiexec.exe	31
PID 808 wrote to memory of 2876	808	quickq-setup.exe	32
PID 808 wrote to memory of 2876	808	quickq-setup.exe	32
PID 808 wrote to memory of 2876	808	quickq-setup.exe	32
PID 808 wrote to memory of 2876	808	quickq-setup.exe	32
PID 808 wrote to memory of 2876	808	quickq-setup.exe	32
PID 808 wrote to memory of 2876	808	quickq-setup.exe	32
PID 808 wrote to memory of 2876	808	quickq-setup.exe	32
PID 2844 wrote to memory of 2740	2844	msiexec.exe	33
PID 2844 wrote to memory of 2740	2844	msiexec.exe	33
PID 2844 wrote to memory of 2740	2844	msiexec.exe	33
PID 2844 wrote to memory of 2740	2844	msiexec.exe	33
PID 2844 wrote to memory of 2740	2844	msiexec.exe	33
PID 2844 wrote to memory of 2740	2844	msiexec.exe	33
PID 2844 wrote to memory of 2740	2844	msiexec.exe	33
PID 2844 wrote to memory of 264	2844	msiexec.exe	34
PID 2844 wrote to memory of 264	2844	msiexec.exe	34
PID 2844 wrote to memory of 264	2844	msiexec.exe	34
PID 2844 wrote to memory of 264	2844	msiexec.exe	34
PID 2844 wrote to memory of 264	2844	msiexec.exe	34
PID 2844 wrote to memory of 264	2844	msiexec.exe	34
PID 2844 wrote to memory of 264	2844	msiexec.exe	34
PID 2844 wrote to memory of 1820	2844	msiexec.exe	36
PID 2844 wrote to memory of 1820	2844	msiexec.exe	36
PID 2844 wrote to memory of 1820	2844	msiexec.exe	36
PID 2844 wrote to memory of 1820	2844	msiexec.exe	36
PID 2844 wrote to memory of 1820	2844	msiexec.exe	36
PID 2844 wrote to memory of 1820	2844	msiexec.exe	36
PID 2844 wrote to memory of 1820	2844	msiexec.exe	36
PID 2620 wrote to memory of 6940	2620	win32-quickq.exe	38
PID 2620 wrote to memory of 6940	2620	win32-quickq.exe	38
PID 2620 wrote to memory of 6940	2620	win32-quickq.exe	38
PID 2620 wrote to memory of 6940	2620	win32-quickq.exe	38
PID 2620 wrote to memory of 7048	2620	win32-quickq.exe	41
PID 2620 wrote to memory of 7048	2620	win32-quickq.exe	41
PID 2620 wrote to memory of 7048	2620	win32-quickq.exe	41
PID 2620 wrote to memory of 7048	2620	win32-quickq.exe	41
PID 2620 wrote to memory of 7108	2620	win32-quickq.exe	43
PID 2620 wrote to memory of 7108	2620	win32-quickq.exe	43
PID 2620 wrote to memory of 7108	2620	win32-quickq.exe	43
PID 2620 wrote to memory of 7108	2620	win32-quickq.exe	43
PID 2620 wrote to memory of 3092	2620	win32-quickq.exe	45
PID 2620 wrote to memory of 3092	2620	win32-quickq.exe	45
PID 2620 wrote to memory of 3092	2620	win32-quickq.exe	45
PID 2620 wrote to memory of 3092	2620	win32-quickq.exe	45
PID 2620 wrote to memory of 7260	2620	win32-quickq.exe	47
PID 2620 wrote to memory of 7260	2620	win32-quickq.exe	47
PID 2620 wrote to memory of 7260	2620	win32-quickq.exe	47
PID 2620 wrote to memory of 7260	2620	win32-quickq.exe	47
PID 2620 wrote to memory of 7304	2620	win32-quickq.exe	49
PID 2620 wrote to memory of 7304	2620	win32-quickq.exe	49
PID 2620 wrote to memory of 7304	2620	win32-quickq.exe	49
PID 2620 wrote to memory of 7304	2620	win32-quickq.exe	49
PID 2620 wrote to memory of 3944	2620	win32-quickq.exe	51
PID 2620 wrote to memory of 3944	2620	win32-quickq.exe	51
PID 2620 wrote to memory of 3944	2620	win32-quickq.exe	51
PID 2620 wrote to memory of 3944	2620	win32-quickq.exe	51
PID 2620 wrote to memory of 1880	2620	win32-quickq.exe	53

C:\Users\Admin\AppData\Local\Temp\quickq-setup.exe
"C:\Users\Admin\AppData\Local\Temp\quickq-setup.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\QuickQ\QuickQ 6.0.137.0\install\quickq-setup.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\quickq-setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1723904051 " AI_EUIMSI=""
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:2876

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7127B629DB5105C0A3DC2447153889B1 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2988
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5646A542D9FC658C97D0B7E93C72F3C1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2740
- C:\Windows\Installer\MSICF37.tmp
  "C:\Windows\Installer\MSICF37.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\win32-quickq.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:264
- C:\Windows\Installer\MSID061.tmp
  "C:\Windows\Installer\MSID061.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\WindowsProgram.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1820

C:\Users\Admin\AppData\Local\Temp\win32-quickq.exe
"C:\Users\Admin\AppData\Local\Temp\win32-quickq.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\SysWOW64\taskkill.exe
  taskkill -F -IM quickq.exe -t
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:6940
- C:\Windows\SysWOW64\taskkill.exe
  taskkill -F -IM quickq-browser.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:7048
- C:\Windows\SysWOW64\taskkill.exe
  taskkill -F -IM typeperf.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:7108
- C:\Windows\SysWOW64\taskkill.exe
  taskkill -F -IM quickqservice-*
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:3092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c copy "C:\Users\Admin\AppData\Local\QuickQ\User Data\Default\cache.dat" "C:\Users\Admin\AppData\Local\QuickQ\cachebak.dat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c copy "C:\Users\Admin\AppData\Local\QuickQ\User Data\Default\cache6.dat" "C:\Users\Admin\AppData\Local\QuickQ\cachebak6.dat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c copy "C:\Users\Admin\AppData\Local\QuickQ\cachebak.dat" "C:\Users\Admin\AppData\Local\QuickQ\User Data\Default\cache.dat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c copy "C:\Users\Admin\AppData\Local\QuickQ\cachebak6.dat" "C:\Users\Admin\AppData\Local\QuickQ\User Data\Default\cache6.dat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1880
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe /select,"C:\Users\Admin\AppData\Local\QuickQ\QuickQ.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1800

C:\Users\Admin\AppData\Local\Temp\WindowsProgram.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsProgram.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1600

C:\Program Files (x86)\Microsoft Qmqsgi\Suiqiaa.exe
"C:\Program Files (x86)\Microsoft Qmqsgi\Suiqiaa.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:10132
- C:\Program Files (x86)\Microsoft Qmqsgi\Suiqiaa.exe
  "C:\Program Files (x86)\Microsoft Qmqsgi\Suiqiaa.exe" Win7
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:9712

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:8248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f77c852.rbs

Filesize
421KB

MD5
f42b2bc8b9be14ffed1f7a4e8c86bd44

SHA1
41c37480db8f6b70b37722d591040a75f19ab626

SHA256
394f2e56ed3029551852add5d38ca3d922fc8f0ebf7845112983df3badf02b66

SHA512
82cc272206dbd4b0cf7cc12b8989766710f5033b378be01d483eaf20d47c8089f89b895920ec059d218014afdedb98ca2bcf36d68a3bad722e91fedfc0be637e

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\QuickQ.exe

Filesize
2.0MB

MD5
ab0e135992a4c0676e8506f2847d5275

SHA1
44b8201033afeddab58fea80f1f662b5914434f2

SHA256
00e28fb333fdd952138c2586ab7d698a039deae52be39b2bb7350b67141b902f

SHA512
243fed0896ac0bd0956905eb66a91ce03f4fb222032244609c6a6ad76b1e2fa6224159cb00ceaab6d23b0b4c6edd8a486749b67a115271ddf6f45fa7d76bb178

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\QuickQ.lnk

Filesize
989B

MD5
9d3ba39a334b750626e3e749fa22fd11

SHA1
746efd965623da4003b2e15e974a655f7fb5b89d

SHA256
2f081ea277e5b5d8f8c86e51591d1a6ea63b3055877d3ddfdb77061ccb10f2b5

SHA512
d805844486ab1c022b2da8519f07ec07d00c1152fcd56f9ca2a161f04c91ed29e1796529b8bcd6c57a2eb7e39106081f3f7459feb71f19352c6cced8fc45587f

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\app.dat

Filesize
866KB

MD5
5f1ea0a8b2f864cf2764297e83bb8e2d

SHA1
91397061d553c1b2eebbbb28b3dbb4ab9402e16b

SHA256
0f8a2d3312c54daed903fb9a4bca2d5cb47cbffd38257b7fab67d8cc51f405c3

SHA512
a9c75d4404d9d47e4acb7273b0d16bf7642e2facd3b5281b60678a95f48603d0587bf749921ed0942313a90ff6d5e1fda05263691677f908f9d355bfb15126ac

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\const.bin

Filesize
43KB

MD5
5b92af71a5ff71c8c6be2d9bdd42d020

SHA1
a9e2ba66e24e1aa15fdff18bcb0e4892fb0c25eb

SHA256
0b3915a4ef7feb7ee6eccc9eb23393b679c37e38c06f5322b443b92360fa1506

SHA512
56c058d95dc4d1a1a7579261419579d32eb9b8ec87031cfa3e6d966f89bcac4a819c755221acbbe883221ba07f8a76faf9756002cd1d57155d92768471ddaccf

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\d3dcompiler_47.dll

Filesize
3.9MB

MD5
ab3be0c427c6e405fad496db1545bd61

SHA1
76012f31db8618624bc8b563698b2669365e49cb

SHA256
827d12e4ed62520b663078bbf26f95dfd106526e66048cf75b5c9612b2fb7ce6

SHA512
d1dc2ec77c770c5da99e688d799f88b1e585f8dcf63e6876e237fe7fce6e23b528e6a5ef94ffc68283c60ae4e465ff19d3fd6f2fae5de4504b5479d68cbc4dba

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\env

Filesize
512B

MD5
01c8a28acb2605e98d94ca2c11975e21

SHA1
4272dc4935ca7f6be6a84eb86d8407cdde3d869d

SHA256
fa1a1c5ad6df1d248a2c5f935cb0aab1ef467d567f4e9be2394218f6aa2181b9

SHA512
258e8912cdc128e38a90c347b18192d16128a4c51951ca3fcf63d998f77104d7ff7a6e0007d8e9d8612cd60d177e21da3e7f720d37afa0c075497e1e87d7f1bd

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\ffmpeg.dll

Filesize
1.7MB

MD5
9568836102a8848029fcb06cf6af3390

SHA1
9e3293110cef748b973fa426e5f1873f1d14382a

SHA256
66c1df7dbccc7e4576897c2ccecaaef79f2584c57a1a6e5a61501dc8b2da9eef

SHA512
af02b935f25a02eb22e2751748d036bd3bd34b8881589f06e600757bd95fbcf7ae3b9dfcd5d555c90e76e1ec591687a64f9aa9c8ee6585f3447cd70dad813ecd

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\icudtl.dat

Filesize
9.9MB

MD5
c6ae43f9d596f3dd0d86fb3e62a5b5de

SHA1
198b3b4abc0f128398d25c66455c531a7af34a6d

SHA256
00f755664926fda5fda14b87af41097f6ea4b20154f90be65d73717580db26ee

SHA512
3c43e2dcdf037726a94319a147a8bc41a4c0fd66e6b18b3c7c95449912bf875382dde5ec0525dcad6a52e8820b0859caf8fa73cb287283334ec8d06eb3227ec4

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\index.binary.bin

Filesize
5KB

MD5
2ad1a6f426b68e71cfd8359f1aa771e5

SHA1
3bf2004e91d43ba1741608ed2417c873f9c94f7e

SHA256
4b1109301bece6167bfcabbd98ee4683f8936546d2ab8ae2a5488d4dc28fc786

SHA512
32c8ed537d34bb3b892eae71fde9f78a8d02367dd8abac655e661756a051bf5e6212c3fd24ae292c9fba0ef7fc02f5ce336126831d9ec465bd8ccb38257c25d8

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\index.css

Filesize
125KB

MD5
fd8a67d4a0bd7163688b3c82367e96f5

SHA1
6fa9cef37a37bf098a258b4cc7630d75536f9666

SHA256
9ddb56c652f1ba61e15dcec8bffd70e6c4ebf4660406b80d97774756be84ccd4

SHA512
e8481046e3a3259d6a88f96fcb5fd61e4e00c4a655d59e667f762bb2cdad98b16be61780c4cd1b87adaeef6f4ae8a993caaefc6351ee14a39d79a646ba4dd57d

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\index.js

Filesize
101B

MD5
44a7318bc95f8550fa2b73f4b7ccc303

SHA1
d7efadb17b6a57a7d6cd5b52b89f85d3f0216007

SHA256
146a1605c9400173a46b7bcad1d64fa5494a326f811698f6880244384cc1ecca

SHA512
d02bcf803c985e2fdb6267dfcc6b5bfd346cd07a85c1a852963ecdfbde8ec5e4177c7463af5b7efaaf772ce41ccca9727201a371034f6df5df2c030f5fb9680d

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\libEGL.dll

Filesize
347KB

MD5
415429eb5286a8df4a4249467bd27c41

SHA1
eed82774e2c66d46457e1cf8e2a2a6bf1020ce2a

SHA256
f3e341673ccf367562c110815a1d90026eaee2b893d137c250a179949f8242e4

SHA512
fb2657afa6428ce70011c463b4beca71936ece865780b66d43dcbc0ab4d07920627ff5bdfb00b1ce5b020b3a20fc14734a57f19d0e6cf2d919705f9b320a6c8e

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\libGLESv2.dll

Filesize
5.4MB

MD5
3559e960f18fc7b0bd06f3234e5cd4d6

SHA1
2ab574f71a3a68ff932b41b13dbec7d486568a4e

SHA256
539e407e9551af55672d79ad724e882878df9fbfb2e8e7fa877abbf2cbcf4cff

SHA512
295cabd0827e0bdfad7dd9c292f13782ede6bad5c48d3bb6567f91297754202a123a8e677b9a52d46a53a01c0666a91e82ee0e4c31be11319a1062179a79e451

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\locales\bg.pak.info

Filesize
742KB

MD5
d611503e029dab3c1262127dff2f899e

SHA1
415ccea2e7e47f294366490fde386d74261f8e33

SHA256
d0b585f25524b300bc67a510bb9674558656656d97a145ea13ae43aad3b7b9a6

SHA512
97df2a88fa4414c2d8f66aecefe166c5044db2576efc39c76446446850702d0d9e0221476c435f8ec44b38eafae49912f7c81fefd194c919d87f7178b9fc3f4c

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\main.js

Filesize
6KB

MD5
a614b704ec66d52145d45f108e97fe3b

SHA1
1e3d7deee5a2c965dc6e91f08ceb4d5c6e9055c1

SHA256
caa2eb303adba236e36513635f27dcb925df3faa1bb7aeed06372cb355432368

SHA512
83aec0789eb15e62d2692e5707e4041806a833bf0ad9f9078e656522b4345ce6907a8339b43109fe0b2da4cd7282be5338720086cd39413ea7a97393f6cfa625

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\node.dll

Filesize
13.7MB

MD5
b36092c862b25f641737657569916abf

SHA1
a248f59edf36625c0cde8fed2372f32af159279d

SHA256
24c883f5c61aeb71e6709a48d96c478214d92d0ba8acb4a59527da191bf1053d

SHA512
29508192191f1996997f13ec921b5205365fedb317ac21ddb59814c0a8b9da65e6a34a5d54a7dfbc9f1b7d53419a0e3ca0ef8db631f06d49ffae260da3da4e5a

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\notification_helper.exe

Filesize
829KB

MD5
f02412897f9fede5ad9b8426bea4ceb4

SHA1
2867508e60bcd0b1e9333755845377cd921770fa

SHA256
d123e505bf5fda510c2ea066d034b7d5adf5fa4e8fe7e8321ecfe5791a24959b

SHA512
1f546e97cadf91d34e2c39d4fe4a4518c7a43b2bc8222b46dbc37759aefc27d500734c47b481c94e784c6eb5967dd7a4b3a09b88e6b3e32ede13f98f015d9e2f

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\nw_100_percent.pak

Filesize
576KB

MD5
7098fa98cefb320e87c7eae3727570dc

SHA1
21e130c4193ab011cf9104ffa6e52d33f31145ea

SHA256
d9c19d2dda16481f711e15d896e7e22ff006eb09791d067f4b661951ac373e82

SHA512
44ae44d3318e4e5a584a0bf6f38111cf52711e71f026d89c88281f31b0a7a1ef0e91f80460e6b69d0c5e3bf10cb5e603c3dcf7c3b3ba23376d00414c0b162318

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\nw_200_percent.pak

Filesize
854KB

MD5
8f8b2b9e971ce6ce4da39a98475f9181

SHA1
310b8ee9226ca8668d89355f83f004af53ed60f0

SHA256
99515b75ba633470061d0d7b7a09daad3147ce69f8bbc524e6717bb4887633d5

SHA512
abccc184d9d436aa86a7ce9922ab43854a1855fdabac230562c112811fce31f067c8860000bc45836c4c03042438a52689453496c16b90e449b9d5a2360bbb88

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\nw_elf.dll

Filesize
805KB

MD5
424830903511a6f273f506f7b55ac03d

SHA1
f4116b24bec44cc5ad0a71024fb3fc73ddd1b1d1

SHA256
e6b43a7242b6197262e479ce2fbb1c58f1a9a45b2b15bc9951d35eb612788734

SHA512
728d19dbca6f0aec814f45580bfb78c8ded3992e645763917ffdccc97e9bf622495b782882420d9001055aa7e463f46a76476092eb122620ff4c869a09104202

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\package.json

Filesize
766B

MD5
4c3931d9351b5cd689b39f538d4d063d

SHA1
81baa100915719654be0f39882240e012aedef0a

SHA256
4808af41260a3852c71f89ef6880f28bb4d98cd5cebbffb96f2347e6583e0a4c

SHA512
fff5fad17fec61a4d36c58036a4c7674d2ce4ff5fcc7e86c90ff662befd4c90e24466158f1827e2e2471f147152e26b0a96a806dc9ed4b4f1a59aa67a7bb7711

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\resource\win32\winproc\4\quickq_winproc.exe

Filesize
23KB

MD5
2955a0fac28d3951ffa5738ba07de7ce

SHA1
30633ca29e79bbecb1e7b074dd2f5783f05c556b

SHA256
01b2e339f7205794e3708cebf66db7bb4940e7ae82497244307ff9561a001986

SHA512
f1dc5387b4862091ff912be801dd146d6c3a1f913a56cd3040a0ddbfcbc516c448d78606b47f609a3b05ff808d5a6ac5ef3aab0fa276bee96d0fd5e7e829b129

Download Submit
C:\Users\Admin\AppData\Local\QuickQ\resource\win32\winproc\4\quickq_winproc_64.exe

Filesize
23KB

MD5
07e5da1aebc7f4d96cd8481f227798dd

SHA1
101e92945a762869f26d2dfd242b3e957f6afedb

SHA256
9db5f4b9ddd00abd44decce002f6a23d5efffe00afddeaf84f5a31611ffc95dd

SHA512
a5bc4206b448d4cc68f6d05768af5589e18e7adfa2a89c283778e6268f37d41815686ec0b22f6387b722eef57c13426fef49cbaeb9b53cd8ff28ebe5fca38993

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC6F7.tmp

Filesize
587KB

MD5
c7fbd5ee98e32a77edf1156db3fca622

SHA1
3e534fc55882e9fb940c9ae81e6f8a92a07125a0

SHA256
e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6

SHA512
8691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsProgram.exe

Filesize
28.2MB

MD5
6b656bd1a2e86cbd5be521b905a1e29d

SHA1
632993bc9ada968b7a20da3e17cf50436e4ab602

SHA256
2baa956744ce166969d41fc319cbce0239446466b313dddbab008b5a8c0f517b

SHA512
11979f38ee399484ca3d4a8fb7d9bc22028e6cbccbf1d31c084c8b8465005934b1b4e5b296f5be53cdbb71bb0d7aa62380ee29f2797f5a4399c273a480e46d54

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseD135.tmp\ioSpecial.ini

Filesize
718B

MD5
a5676c97032afad0bd3c10e6c0fc4d78

SHA1
8391579805e9f27cd3345f0a3dfe400563c4fb77

SHA256
97e2e3d9b8889f1609279b2bbbd3bacb26a7e5c44f9db4260463d734f5fb28e4

SHA512
ff1168ddfb7c99f195253f28a67ed9aeb3a0100b3e5ad19e6d684212b821104e19a31fd8544e81603ad5bdb8ff755b6d75ebb3615de710d459b1dbc498d45425

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseD135.tmp\ioSpecial.ini

Filesize
543B

MD5
a01fbecbe77c79f36200b4cf6b276832

SHA1
61d3ff9f55033d3a39ea743469c5b5e3129c2d69

SHA256
02877f244474a25d9dba3d4cb8dd128c9eb86805131fb14be7719a6660fecb94

SHA512
4ef3a8df36ba02b76c510479d581abd5f9691364e0fe42baa2a93e8d23a6c67c42887df5cc8bc305fbab54d7c441d681465ca3f61c13f96070668624f6e319a2

Download Submit
C:\Users\Admin\AppData\Roaming\QuickQ\QuickQ 6.0.137.0\install\quickq-setup.msi

Filesize
2.2MB

MD5
4c5cd46f6f60cf9978b2d345d2e33038

SHA1
6c3f9fe30b0d274e272e47fa0883296bf9e33edd

SHA256
95be6ca7488f40c73e8a349dfb1ed6ffab997d9867f748680979ff96955769bd

SHA512
0fb54738a25c67c90eed6acf8d986fc1f68776f81d4577c5fb6edc13313b70e963762cc97b039958c9340efe21ea18247bd40abd7551d79adc54484e838cb131

Download Submit
C:\Windows\Installer\MSICF37.tmp

Filesize
419KB

MD5
cac0eaeb267d81cf3fa968ee23a6af9d

SHA1
cf6ae8e44fb4949d5f0b01b110eaba49d39270a2

SHA256
f1dd0dd1e83b28ffa2ed30f46f98e94a4919ec1f4e9d33720354288b77153774

SHA512
8edf9f733dda9000a6e2b70da61912dbc15f74c836d738391ceddcdff20f5b420a678450523cf331aa9bce90217aa92ac6e73d1880ae15c9842ccc7d3296f95b

Download Submit
\Users\Admin\AppData\Local\Temp\nseD135.tmp\InstallOptions.dll

Filesize
14KB

MD5
8d5a5529462a9ba1ac068ee0502578c7

SHA1
875e651e302ce0bfc8893f341cf19171fee25ea5

SHA256
e625dcd0188594b1289891b64debddeb5159aca182b83a12675427b320bf7790

SHA512
101da2c33f47bd85b8934318e0f0b72f820afc928a2a21e2c7823875e3a0e830f7c67f42b4c2f30596eaa073617790c89700c0d95b7949ec617e52800b61d462

Download Submit
\Users\Admin\AppData\Local\Temp\nseD135.tmp\LangDLL.dll

Filesize
5KB

MD5
77ff758c10c66937de6d86c388aa431c

SHA1
14bd5628eaf8a12b55cd38f9560c839cb21ce77a

SHA256
6a033e367714ec0d13fca0589c165bdbf4d1dac459fa7ec7415815223fa3c008

SHA512
319837951be276a179ead69efcd24bd7566061abc7997ea782af50bd4b0d69e5ec1a6e4cdeb2825bafedf87edf03380396b7bcf58682b6a3a824c8dc4b966bda

Download Submit
\Users\Admin\AppData\Local\Temp\nseD135.tmp\System.dll

Filesize
11KB

MD5
b0c77267f13b2f87c084fd86ef51ccfc

SHA1
f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

SHA256
a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

SHA512
f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

Download Submit
\Users\Admin\AppData\Local\Temp\nseD135.tmp\nsExec.dll

Filesize
6KB

MD5
1f49d8af9be9e915d54b2441c4a79adf

SHA1
1ee4f809c693e31f34bc6d8153664a6dc2c3e499

SHA256
b22c8f676dec58be8d25fbad1a37835ffc4029f29aaf79f4dc0337ca73a38782

SHA512
c60827e322e3168a79795ffd4beb0b0039842128255100d6b005d261402d2ff570f3866f441f3d3c063097c71d44bc5ae80d177fa91ef4e46fc8c2d97de27aa4

Download Submit
\Users\Admin\AppData\Local\Temp\nseD135.tmp\nsis7z.dll

Filesize
436KB

MD5
d7778720208a94e2049972fb7a1e0637

SHA1
080d607b10f93c839ec3f07faec3548bb78ac4dc

SHA256
98f425f30e42e85f57e039356e30d929e878fdb551e67abfb9f71c31eeb5d44e

SHA512
98493ea271738ed6ba3a02de774deef267bfa3c16f3736f1a1a3856b9fecc07f0ea8670827e7eb4ed05c907e96425a0c762e7010cb55a09302ca3cfb3fe44b2b

Download Submit
\Windows\Installer\MSIC9E7.tmp

Filesize
709KB

MD5
89136bfd28a2e1ec6b6d841214e1e670

SHA1
4c6aab98925cb556f7bf2dbbc9f7ed0da92ef2ab

SHA256
1a3c0e60aad0a3bb92a6e0b786df93920aed7b0c7ec56ab49f2692102ac5adec

SHA512
22237702745fe11a6f23a943f16a12f23b42fe04d87af6383afeccd854320f3a6961590a76ab6a04f020f9830fb3d9f8b34315ad007a5464dbdba2d543851812

Download Submit
memory/264-50-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/808-0-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1600-960-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-979-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-1003-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-1001-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-999-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-995-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-993-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-991-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-1009-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-1011-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-1013-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-1015-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-1017-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-1019-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-989-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-987-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-985-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-983-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-981-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-1007-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-977-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-975-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-973-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-971-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-969-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-967-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-965-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-961-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-1005-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-997-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-963-0x0000000003E40000-0x0000000003F51000-memory.dmp

Filesize
1.1MB

Download
memory/1600-150-0x00000000764B0000-0x00000000764F7000-memory.dmp

Filesize
284KB

Download
memory/1600-63-0x0000000000400000-0x0000000002041000-memory.dmp

Filesize
28.3MB

Download
memory/1600-27430-0x0000000000400000-0x0000000002041000-memory.dmp

Filesize
28.3MB

Download
memory/1820-58-0x0000000000270000-0x0000000000272000-memory.dmp

Filesize
8KB

Download
memory/9712-27427-0x0000000000400000-0x0000000002041000-memory.dmp

Filesize
28.3MB

Download
memory/10132-18727-0x0000000000400000-0x0000000002041000-memory.dmp

Filesize
28.3MB

Download