Malware Analysis Report

2024-12-08 00:35

Sample ID 241118-dbkdesxbjr
Target QPST.WIN.2.7 Installer-00425.1.zip
SHA256 e29be9c5768052538cd18a6ba5b5ca7371b642ad3692c84e077ab693bcda4f00
Tags
paypal discovery phishing persistence privilege_escalation
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

e29be9c5768052538cd18a6ba5b5ca7371b642ad3692c84e077ab693bcda4f00

Threat Level: Shows suspicious behavior

The file QPST.WIN.2.7 Installer-00425.1.zip was found to be: Shows suspicious behavior.

Malicious Activity Summary

paypal discovery phishing persistence privilege_escalation

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Drops file in System32 directory

Checks system information in the registry

Detected potential entity reuse from brand PAYPAL.

Drops file in Windows directory

Loads dropped DLL

Executes dropped EXE

Drops file in Program Files directory

Enumerates physical storage devices

Browser Information Discovery

Event Triggered Execution: Installer Packages

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of FindShellTrayWindow

Modifies Internet Explorer settings

Checks processor information in registry

Modifies registry class

Suspicious use of SendNotifyMessage

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Checks SCSI registry key(s)

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-18 02:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-18 02:50

Reported

2024-11-18 02:53

Platform

win11-20241007-en

Max time kernel

191s

Max time network

194s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\QPST.WIN.2.7 Installer-00425.1.zip"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A

Detected potential entity reuse from brand PAYPAL.

phishing paypal

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\mfc100.dll C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\msvcr100.dll C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\atl100.dll C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\msvcr100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100u.dll C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100u.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfcm100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfcm100.dll C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\msvcp100.dll C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfcm100u.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\msvcp100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\atl100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfcm100u.dll C:\Windows\System32\msiexec.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\swdl_si_nand_download.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\mdb_saveallregions.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\NPRG6800.hex C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\NPRG6550PB.hex C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\Rleditor.cnt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneMarshal.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\NPRG6250SEC.HEX C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\efs_unlink.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\swdl_nvbackup.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\efs_recursivedir_to_multiple_filesubsystems.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Documents\DeprecatedApps.htm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\sendcommand.vbs C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\aprg6050.hex C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QpstLoggerLib.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTConfig.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\get_com_port_list.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\ServiceProg.cnt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\efs_lstat.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\enab_disab.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\Download.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\APRG6250.HEX C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTConfig.cnt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QCNView.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\swdl_cefs_download.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\SwDownloadDLL.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\aprg6500.hex C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QCNView.CNT C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\get_qpst_port_list.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTProxyComponents.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\CustomAction.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Documents\QFILUserGuide.pdf C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\emmcswdownload.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QMSL_MSVC10R.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\swdl_mi_download.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\efs_error.pm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QualCtrl.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\efs_copy_file.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTools2.ocx C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\settingsManager.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\reset.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib3.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QpstMarshal.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QCNVIEW.HLP C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\NV Decoder.qdf C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\add_remove.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\enumerate.vbs C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib5.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\AtmnServer.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTConfig.hlp C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\RF-NV-MGR.HLP C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\efs_createdirandwrite.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\aprg6200.hex C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\aprg6100.hex C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\nprg6100.hex C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QFIL.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\offline.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServicePS.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneModelLib.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Documents\QTIheader.png C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Documents\QpstUserGuide.pdf C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\efs_isdirempty.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneLib.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\flashprg.hex C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\NPRG6550.hex C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_08891AC1D30A7EE0770E61.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_1ACB3840664F6BC513D3A7.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_26BF785DF4FA95F6903C98.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_C6F01526BC2A9FF352A1A8.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_C6F01526BC2A9FF352A1A8.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_87EA2FA782C3B99C90FAE6.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_25EC5F4DB58CB67A046911.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF7796D46CDAA21FFC.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Windows\SystemTemp\~DF2039C8B5FFABC603.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_853F67D554F05449430E7E.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_9A931C09FD90074E50A930.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_C80B81499D47121037110A.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_8831554A687F32E1C7D6BE.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_87EA2FA782C3B99C90FAE6.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_25EC5F4DB58CB67A046911.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_9A022FD55DB3B13026A97D.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI2D55.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DFF8039D042BFB5BD9.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI312F.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_07A4B5A907F8D58E1C3F51.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_26BF785DF4FA95F6903C98.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DFEB390E99B9ADA925.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_E12D11B048F4219D59E889.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_BE44A30B1D451C1FFD00EB.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_BE44A30B1D451C1FFD00EB.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_07A4B5A907F8D58E1C3F51.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_9A022FD55DB3B13026A97D.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_08891AC1D30A7EE0770E61.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_E12D11B048F4219D59E889.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e582bff.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e582bfd.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_9A931C09FD90074E50A930.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_C80B81499D47121037110A.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_8831554A687F32E1C7D6BE.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI2CA9.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{90BA4578-EE5C-47A3-AB5D-2254708AB111} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_853F67D554F05449430E7E.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e582bfd.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_1ACB3840664F6BC513D3A7.exe C:\Windows\system32\msiexec.exe N/A

Browser Information Discovery

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Qualcomm\QPST\bin\AtmnServer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTConfig.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Qualcomm\QPST\bin\CustomAction.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000097e32746e391c5270000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000097e327460000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090097e32746000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d97e32746000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000097e3274600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\GPU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133763719581009562" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\S-1-5-19 C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57378330-F37D-11d3-B518-0008C7D32C94} C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0187B5B-C522-4624-9E13-82CCB48ACE32}\TypeLib C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModelNvIntfDualCellCDMAB C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModel3300Surf800.1\ = "AtlasModel3300Surf800 Class" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{73E704E4-EED3-11d3-A096-00805F9B0C38}\InprocServer32\ = "C:\\Program Files (x86)\\Qualcomm\\QPST\\bin\\QPSTools.dll" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18C851B9-A3F7-4E94-9030-D9E1407AD2C7}\NumMethods\ = "8" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57378329-F37D-11d3-B518-0008C7D32C94}\TypeLib\ = "{57378320-F37D-11d3-B518-0008C7D32C94}" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{73E704EF-EED3-11D3-A096-00805F9B0C38}\TypeLib\Version = "1.0" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62E36B25-EE0A-11d3-BF96-0008C78F17BD}\VersionIndependentProgID\ = "PhoneModelLib.AtlasModelNvIntfQuadNAM" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7F532469-390B-4A07-A966-DE0518A8C832}\ProxyStubClsid32 C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68378DD3-EC38-11D1-885C-00805F0D391E}\ = "AtlasConfigApp.Application" C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTConfig.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5737831C-F37D-11D3-B518-0008C7D32C94}\ = "IAtlasModelIntfAlerts" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{73E7050D-EED3-11D3-A096-00805F9B0C38}\TypeLib\ = "{73E7050C-EED3-11D3-A096-00805F9B0C38}" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModelNvIntfCST.1\CLSID\ = "{57378341-F37D-11d3-B518-0008C7D32C94}" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModelNvIntfData.1\ = "AtlasModelNvIntfData Class" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{73E704C9-EED3-11D3-A096-00805F9B0C38} C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Qualcomm.AtlasPhoneModStreamingDownload\CurVer C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0C563FA-7784-4C47-A4A5-A5B6BE3625DF}\VersionIndependentProgID C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{73E704EB-EED3-11D3-A096-00805F9B0C38}\ProxyStubClsid32 C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{73E70503-EED3-11D3-A096-00805F9B0C38}\ToolboxBitmap32 C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModelNvIntfFeaturesC.1 C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57378321-F37D-11d3-B518-0008C7D32C94}\VersionIndependentProgID C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{73541FF6-BCB0-4248-A8C2-38D917CA09D7}\ProxyStubClsid32 C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Qualcomm.AtlasModEfs\ = "AtlasModEfs Class" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A1764F81-913D-4B45-AE55-0B833F812B5F}\1.0\0\win32\ = "C:\\Program Files (x86)\\Qualcomm\\QPST\\bin\\QPSTService.exe" C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ehplmn\RLEditor file types C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE56125C-B81B-4D87-855C-9CBF467C2097}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62E36B35-EE0A-11d3-BF96-0008C78F17BD} C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{73E704A2-EED3-11D3-A096-00805F9B0C38}\NumMethods C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{25847B22-4239-41E9-96E5-77F15D21F18A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57378334-F37D-11d3-B518-0008C7D32C94}\TypeLib C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62E36B2D-EE0A-11d3-BF96-0008C78F17BD}\TypeLib C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{42625863-0833-47DD-A3C7-B676AC11F64D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{73E704FC-EED3-11D3-A096-00805F9B0C38}\ProxyStubClsid32 C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{42625863-0833-47DD-A3C7-B676AC11F64D}\ = "IPDCInterfaceList" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93DDCD97-F58B-4F68-ACA8-286725C66CC0}\ = "IAtlasPhone2" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Qualcomm.AtlasPhoneModDisplay.1\ = "AtlasModDisplay Class" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{73E704A0-EED3-11D3-A096-00805F9B0C38}\NumMethods C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneEFS.QcomWinFolder\ = "QcomWinFolder Class" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{FBD5FF1B-0A2B-4D58-B02A-96A1F6F80FC3} C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneEFS.QcomEFSFolder\CLSID\ = "{A138A78D-1DA2-48B1-8F51-1660415D2A8E}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62E36B53-EE0A-11d3-BF96-0008C78F17BD} C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48D9D77A-92F3-11D4-B527-0008C7D32C94}\VersionIndependentProgID\ = "PhoneModelLib.AtlasModel5105Surf800" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{64D611BF-19F4-4F91-BA9A-1753DE431F9E}\ProxyStubClsid32 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModelQCT1200.1\ = "AtlasModelQCT1200 Class" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModelNvIntfAlertsD.1 C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62E36B2A-EE0A-11d3-BF96-0008C78F17BD}\VersionIndependentProgID C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneEFS.QcomEFSFolder\CurVer\ = "PhoneEFS.QcomEFSFolder.1" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D884FF84-2B3D-11D4-B51C-0008C7D32C94}\ProgID C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5BEA5AFB-F058-11D3-B518-0008C7D32C94}\ = "IAtlasModelIntfLdSv" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F55CEA7A-D59D-4158-A8DD-2994D881323E}\NumMethods C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModelNvIntfUserAll\CLSID\ = "{62E36B34-EE0A-11d3-BF96-0008C78F17BD}" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{150DD281-839E-4D9F-B517-F5354F63D5CE}\InprocServer32 C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40D3D365-2C53-11D4-B51C-0008C7D32C94}\ = "IAtlasModelIntfMMedia" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57378326-F37D-11d3-B518-0008C7D32C94}\TypeLib\ = "{57378320-F37D-11d3-B518-0008C7D32C94}" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49A381A8-80E7-48ED-B7F3-9C1918A7123A}\TypeLib\ = "{73E704DE-EED3-11D3-A096-00805F9B0C38}" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62E36B38-EE0A-11d3-BF96-0008C78F17BD}\VersionIndependentProgID\ = "PhonePropLib3.AtlasModelNvIntfBcSms" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF62F20B-DD7B-11D3-B517-0008C7D32C94}\ = "IAtlasModelIntfBcSms" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{73E704A9-EED3-11d3-A096-00805F9B0C38} C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62E36B52-EE0A-11d3-BF96-0008C78F17BD}\InprocServer32 C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{57378320-F37D-11D3-B518-0008C7D32C94}\1.0\ = "PhonePropLib4 1.0 Type Library" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{73E704EB-EED3-11D3-A096-00805F9B0C38}\TypeLib C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModelNvIntfUserAll\ = "AtlasModelNvIntfUserAll Class" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68378DD3-EC38-11D1-885C-00805F0D391E}\ProgID\ = "AtlasConfigApp.Application" C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTConfig.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTConfig.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\System32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\System32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Windows\System32\msiexec.exe N/A
N/A N/A C:\Windows\System32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServer.exe N/A
N/A N/A C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServer.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 904 wrote to memory of 4792 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4792 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4792 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4112 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\srtasks.exe
PID 904 wrote to memory of 4112 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\srtasks.exe
PID 904 wrote to memory of 4836 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4836 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4836 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 884 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 884 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 884 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 2388 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 2388 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 2388 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 1944 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 1944 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 1944 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 3476 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 3476 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 3476 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4632 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4632 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4632 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 3116 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 3116 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 3116 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 2176 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 2176 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 2176 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4436 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4436 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4436 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 128 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 128 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 128 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 2368 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 2368 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 2368 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 1580 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 1580 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 1580 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 2052 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 2052 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 2052 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 3352 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 3352 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 3352 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4256 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4256 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4256 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 3688 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 3688 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 3688 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4524 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4524 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4524 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 2616 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 2616 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 2616 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4776 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4776 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4776 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4768 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 904 wrote to memory of 4768 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\QPST.WIN.2.7 Installer-00425.1.zip"

C:\Windows\System32\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Desktop\QPST.2.7.425.msi"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 2A597034A64EB3F09D56C7823FF47754 C

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding A19A14E1A8D8AEFAF587C865C44F0CF1

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 7B0026697E694E5092B1A6FA4F954239 M Global\MSI0000

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneEFS.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneModelLib.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib4.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTProxyComponents.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\ConfigAgentMarshal.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PersistentDevConfigPS.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\ConfigAgentLib.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib5.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\DownloadAgentLib.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTools.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib3.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\QpstMarshal.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\SerialPortLib.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\ServiceProgAgentLib.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\EFSExpCtrl.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib1.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTools2.ocx"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib2.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneLib.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneMarshal.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServicePS.dll"

C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTService.exe

"C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTService.exe" /REGSERVER

C:\Program Files (x86)\Qualcomm\QPST\bin\AtmnServer.exe

"C:\Program Files (x86)\Qualcomm\QPST\bin\AtmnServer.exe" /REGSERVER

C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServer.exe

"C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServer.exe" /REGSERVER

C:\Program Files (x86)\Qualcomm\QPST\bin\CustomAction.exe

"C:\Program Files (x86)\Qualcomm\QPST\bin\CustomAction.exe" /Install

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe" -ServerName:WebExperienceHost.AppXpahb3h9jz84zbzgmz4ndmjv3nas4ah73.mca

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc

C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTConfig.exe

"C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTConfig.exe"

C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServer.exe

"C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServer.exe" -Embedding

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ff904cecc40,0x7ff904cecc4c,0x7ff904cecc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1944,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1928 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1760,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2064 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2208,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2228 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3240 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3156,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3288 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4452,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4496 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4748,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4788 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4952,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4920 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4668,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3664 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5076,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5032 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4784,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4636 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5044,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5080 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5056,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5092 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4908,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4632 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4448,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3700 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5256,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5336 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3428,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5384 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5180,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5108 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5388,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5376 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4456,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5348 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5332,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5124 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5576,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5620 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5020,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5592 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=3276,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5456 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=5384,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3204 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5472,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4576 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=5668,i,10036926594413085754,8965818656219592159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5708 /prefetch:1

Network

Country Destination Domain Proto
GB 2.18.66.177:443 tcp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 browser.pipe.aria.microsoft.com udp
AU 40.79.173.41:443 browser.pipe.aria.microsoft.com tcp
GB 2.18.27.76:443 www.bing.com tcp
GB 2.18.27.76:443 www.bing.com tcp
GB 2.18.27.76:443 www.bing.com tcp
GB 2.18.27.76:443 www.bing.com tcp
GB 2.18.27.76:443 www.bing.com tcp
GB 2.18.27.76:443 www.bing.com tcp
GB 2.18.27.76:443 www.bing.com tcp
GB 23.62.194.163:443 sdx.microsoft.com tcp
GB 51.140.242.104:443 data-edge.smartscreen.microsoft.com tcp
GB 23.62.194.163:443 sdx.microsoft.com tcp
GB 23.62.194.163:443 sdx.microsoft.com tcp
GB 23.62.194.163:443 sdx.microsoft.com tcp
GB 23.62.194.163:443 sdx.microsoft.com tcp
GB 23.62.194.163:443 sdx.microsoft.com tcp
GB 51.140.242.104:443 data-edge.smartscreen.microsoft.com tcp
GB 51.140.242.104:443 data-edge.smartscreen.microsoft.com tcp
GB 51.140.242.104:443 data-edge.smartscreen.microsoft.com tcp
US 204.79.197.200:443 bing.com tcp
US 150.171.22.254:443 ln-ring.msedge.net tcp
BR 191.232.215.149:443 1241709e8777b40ebe6f8fd4d8e69fdc.azr.footprintdns.com tcp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com udp
N/A 224.0.0.251:5353 udp
GB 142.250.178.14:443 clients2.google.com tcp
GB 216.58.201.97:443 clients2.googleusercontent.com tcp
GB 172.217.169.74:443 content-autofill.googleapis.com tcp
US 3.33.139.32:443 paypall.com tcp
US 3.33.139.32:443 paypall.com tcp
US 3.33.139.32:443 paypall.com tcp
US 3.33.139.32:80 paypall.com tcp
US 3.33.139.32:80 paypall.com tcp
US 151.101.193.21:443 c.paypal.com tcp
US 204.79.197.200:443 bing.com tcp
US 204.79.197.200:443 bing.com tcp
GB 2.18.27.76:443 www.bing.com tcp
GB 2.18.27.76:443 www.bing.com udp
GB 2.18.27.82:443 www.bing.com tcp
GB 2.18.27.82:443 www.bing.com tcp
GB 2.18.27.82:443 www.bing.com tcp
GB 2.18.27.82:443 www.bing.com udp
GB 2.18.27.86:443 assets.msn.com tcp
GB 2.18.27.86:443 assets.msn.com udp
US 152.199.21.175:443 aadcdn.msftauth.net tcp
IE 13.74.129.1:443 c.msn.com tcp
GB 2.18.27.86:443 assets.msn.com udp
US 204.79.197.237:443 c.bing.com tcp
US 20.189.173.27:443 browser.events.data.msn.com tcp
US 20.189.173.27:443 browser.events.data.msn.com tcp
GB 2.19.252.154:443 img-s-msn-com.akamaized.net tcp
GB 2.19.252.154:443 img-s-msn-com.akamaized.net tcp
GB 2.19.252.154:443 img-s-msn-com.akamaized.net tcp
GB 2.19.252.154:443 img-s-msn-com.akamaized.net tcp
GB 2.19.252.154:443 img-s-msn-com.akamaized.net tcp
GB 2.19.252.154:443 img-s-msn-com.akamaized.net tcp
US 20.189.173.27:443 browser.events.data.msn.com tcp
US 151.101.193.21:443 c.paypal.com tcp
US 13.107.246.64:443 3pcookiecheck.azureedge.net tcp
US 13.107.5.80:443 services.bingapis.com tcp
SE 192.229.221.25:443 c6.paypal.com tcp
SE 192.229.221.25:443 c6.paypal.com tcp
SE 192.229.221.25:443 c6.paypal.com tcp
SE 192.229.221.25:443 c6.paypal.com tcp
SE 192.229.221.25:443 c6.paypal.com tcp
SE 192.229.221.25:443 c6.paypal.com tcp
SE 192.229.221.25:443 c6.paypal.com tcp
SE 192.229.221.25:443 c6.paypal.com tcp
SE 192.229.221.25:443 c6.paypal.com tcp
SE 192.229.221.25:443 c6.paypal.com tcp
SE 192.229.221.25:443 c6.paypal.com tcp
US 34.149.66.134:443 browser-intake-us5-datadoghq.com tcp
US 34.149.66.134:443 browser-intake-us5-datadoghq.com udp
US 151.101.131.1:443 t.paypal.com tcp
US 151.101.131.1:443 t.paypal.com tcp
US 34.149.66.134:443 browser-intake-us5-datadoghq.com udp
GB 172.217.169.74:443 content-autofill.googleapis.com tcp
GB 172.217.16.228:443 www.google.com tcp
FR 3.162.38.80:443 ddbm2.paypal.com tcp
US 151.101.67.1:443 paypalobjects.com tcp
SE 192.229.221.25:443 c6.paypal.com tcp
GB 172.217.169.74:443 content-autofill.googleapis.com udp
FR 3.162.38.80:443 ddbm2.paypal.com tcp
US 192.55.233.1:443 tcp
US 151.101.1.21:443 c.paypal.com tcp
US 192.55.233.1:443 tcp
US 151.101.1.21:443 c.paypal.com tcp
US 8.8.8.8:53 1.67.101.151.in-addr.arpa udp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
GB 34.147.177.40:443 lhr.stats.paypal.com tcp
GB 34.147.177.40:443 lhr.stats.paypal.com tcp
DE 142.250.185.227:443 beacons.gcp.gvt2.com tcp
US 192.55.233.1:443 tcp
GB 34.147.177.40:443 lhr.stats.paypal.com tcp
GB 34.147.177.40:443 lhr.stats.paypal.com tcp
US 192.55.233.1:443 tcp
GB 34.147.177.40:443 lhr.stats.paypal.com tcp
GB 34.147.177.40:443 lhr.stats.paypal.com tcp

Files

C:\Users\Admin\Desktop\QPST.2.7.425.msi

MD5 22de8c14c311b0765fb2456fd1b69963
SHA1 8ea5b404dbb35cf45d34f2d7e46b258eb1b92829
SHA256 64a76a6ccc9f2623f8a12be8c2ae04b409144df06ca9a64845d3a1355c1609a2
SHA512 89659f530abb0a149e002afaa98270435b2ea0b1fcc89edc7e1837f6f8ff312aa6847b2b1856ad8cce48334621a261395f6b9391ff1bf7262d1c137a8ae5baf1

C:\Users\Admin\AppData\Local\Temp\MSIC294.tmp

MD5 5494165b1384faeefdd3d5133df92f5a
SHA1 b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256 ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512 ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613

C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\AtmnServer.tlb

MD5 7d6bf27cba1635f6dea129e5adfacff7
SHA1 9ca3dcd526beb964ff573201c994ce6a48552649
SHA256 831ed8c571925b6ae8620a4520f89ba8925c00857bab420f0e938483e77965e4
SHA512 d6244175f2327ac10697b97f699a049f8509fc618496803ea59a577a871d4d30195d8b469c7264e6ca1c3b7605c6fec980b0f9bf316cc263b0284f6be229ec35

C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\QPSTProxyComponents.tlb

MD5 b29a98782bf2197b6872aec6ece4c433
SHA1 ef85109c2a8f510d04d828c7e4276733d2db77b3
SHA256 7509caec5e8b69a7d44f5ad8a0ed51ba7a1a4029e7828739ad404913ddb3d69f
SHA512 59d7ee4c2bf6e50f2493324750455ce7d8d3aa67253afae8e63dbe535a9d0658fdfcb39042356adf3750454345521b821fe99a2133a3a53a01b476b499da1095

C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneEFS.dll

MD5 264692d4274dc027c241a023caadfa6a
SHA1 6e0f1452a1176d7273274523a9edface2a00fbe7
SHA256 5c1cd59b0af22c82aea823ad435f32d72112b0a564b6174f6197574936fecec0
SHA512 013f296ffbb2779312cf6d26e35a72b73acf54dc0e7d15fbea8cc671405fd2c0ad266fb63c346af1ef72712136a252b0d53282fbf115e7fabff3809296481773

C:\Windows\SysWOW64\msvcp100.dll

MD5 bc83108b18756547013ed443b8cdb31b
SHA1 79bcaad3714433e01c7f153b05b781f8d7cb318d
SHA256 b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
SHA512 6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011

C:\Windows\SysWOW64\msvcr100.dll

MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneModelLib.dll

MD5 e3a1852b1b50005dd2e037dc0dad66a4
SHA1 f552d3a7b5db4de9172995294833b45d7ab4a81b
SHA256 08562c5c85d676fc523a1bacaa5e461a279fc5b448e17a276b5abdaa20f3982b
SHA512 55e1d47ed7a7455413317e10afdc3fe52983acdfadb2ceacfaaef2b0a879ebdfd6374a6a7e9bccd43102db071cc041ffc1c990e0002a13cdd87ec17552b2469c

C:\Windows\SysWOW64\mfc100.dll

MD5 493fc0f59054a6f4f3775655fb55295c
SHA1 2afe4f5eb626fb5c5aa5bb6c2bc61c88e37cf42f
SHA256 cac58c98f7e587ba1b2a4f41874764b59bdf6cb684a4a44aee93f91b3b9a019b
SHA512 9da41078a65a6b8c731388ccf4ce2a988705305f29f0841039b96cd2649f82e8ea219f082de184826e39f0edaa4a1d9aff2e60ebb8d27771222d0c7cb165598d

C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib4.dll

MD5 64e971360b1ebf39d46b5aba8eca4aaf
SHA1 47cbb1e1799b57666523b69e76ea7ecb214d892f
SHA256 57c7d9d44a98866403df9e93167ffdfd51904a14968988e6ce4ba6e1e2a3eb92
SHA512 56e35f051413a6b0e84cbce926537a5c2651c47ae58c06fdbfb7eebe163fb60f2bf4c5b9db198980d2f0853b6a5563af203125e0025fbdcf31adfbc9ed5ce36d

C:\Windows\SysWOW64\atl100.dll

MD5 c85670ab64068f8080998aeba6c5019c
SHA1 ef762c375486594f6604f39311d32442156ac8bb
SHA256 87d88235f69c062e5b759f91253abaf7bd055937dd119bd26858237f812d3ded
SHA512 870a27585f72e444fa9a2b46ab53ed420932952be8a3c4ddd0d831d72be0ac1b44992cf757de76d0cd667cd5b6150e9eb96ac2a8e7161a22c7d557946a12e5c6

C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTProxyComponents.dll

MD5 77f8d0db9413c266c34574dc1a0d0cd0
SHA1 81fe6e3e5308c6076841a7b151689eda3a4fda95
SHA256 575d2448bc762eaaea59b786b339a8268b6eaf56180a13501fff765baf6497b1
SHA512 1b610d5923fab879229b8f9369afbfabd15a1ca40af0373ce306c20cba9362d89bf23b1a900fc7e30115503160e86827c0c130b03993bf05335ccb85f09f1761

C:\Program Files (x86)\Qualcomm\QPST\bin\QpstLoggerLib.dll

MD5 628b8b4befd5467753f1556e62c45cdc
SHA1 9f12fe498b1c2c2d6b30837a3c8609921a75f261
SHA256 2c1bc119a02efacdad6777873536a45cb54882971f035e185b732dabd7908dbf
SHA512 3f4049091270e4c8ee0d6ca9b2a1a40f06c1d47c82af9407cbbac6412bb7e2890d640efb85147ef761c99fa3b63000194dddd404d4103962970edf39867c4e40

C:\Program Files (x86)\Qualcomm\QPST\bin\xerces-c_3_1.dll

MD5 ba59630308d149c2f1563ad286c49f6b
SHA1 69d43cd7f6ed6dd2873a7068cf349243ef7c7ac9
SHA256 0f7917d4b7308668a4c63b3cd1603b94c9fe944c0f93ea9810df2121fc8ea01d
SHA512 1a393775f31920dc3aac42904ece2c8a263db3ce6734418e0557cec981db03e9b8cc4928bd90d85f91267300d49d3de75e2e3eb8d3802fb01b935d455b4a3bb7

C:\Program Files (x86)\Qualcomm\QPST\bin\ConfigAgentMarshal.dll

MD5 eb0b9f5217daf53e3dd8cef312089a33
SHA1 4b39b2417ca0a32e9efbf62bfb993995073d1f4a
SHA256 cf256a0435ef01eb3df6e94eaa758f8a156266157d4113b0f55b7606ac30844e
SHA512 7be85fb353ecd6dc200f8bcbc417fc990687f5e6db23b52dcda30b0756bedf57442c4ea0979562c94b77ebdd0cd242dbbd3dafb2ea36c275ad815b192d22f2d4

C:\Program Files (x86)\Qualcomm\QPST\bin\PersistentDevConfigPS.dll

MD5 cf89407cf93ddaaa04b5418a1141f7c9
SHA1 18ffe62dab167a34a2315940a5c8a00b5df4f6c1
SHA256 4c44e7966fc347e13573f942f6c0b92a3f0efa2346ebfb25e20f77b19240f1e0
SHA512 95b706dbd72dcef9bb7e912a6b6531be5451b7ba89ef620748a0e26d1ff62610305921d20fca2f84cdf554c92558520d501fab066241f6a3e8b8bf0145f9d767

C:\Program Files (x86)\Qualcomm\QPST\bin\ConfigAgentLib.dll

MD5 a8d8af9da0e2678d3c8749837ac877a6
SHA1 7d3c15322e5fa07efef6299a30976cae9a2a217d
SHA256 f440c7f4e8328971e77900a41cc6c3c13a435998f759e5a1d34d86232348965d
SHA512 eb5f5f1ef54cd871216fd59509f9c2220f5b8f443e49995a789ab4d8919b4f38613eefdb2574148d84380e33af44e3d0e83217101912b5244df739a90df57262

C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib5.dll

MD5 f961e614768f50254b05e4a3dbe974ef
SHA1 de9bd5a312eca9368942f89964b169596b46dd2b
SHA256 e0b1e1ded51241829aa9c4ca47ece4d2fbf38fa1404f8766b4b8ec7884039347
SHA512 da59310fdb43c2c6129ed43f9687e9d65e09b917e1aa4ae947533a50ebe0b22cfc798ff26c269f0128c3565d006a5c8acadde53cdbf2d90a9663935579c657ea

C:\Program Files (x86)\Qualcomm\QPST\bin\DownloadAgentLib.dll

MD5 fb13abdf8b3e3d39d7bd256a458e6f52
SHA1 1a32a2bb3b8c8486705a7c6080aed389b9914ef0
SHA256 e82b7e175250599f0e71e881991c4cb7dd3189ddf2cb2a213540f0ac103a24c3
SHA512 2f21283c8146459d2f6e106f90fd9d49315e5cbbcf3fa88a6c8316f006ccb35c1362380ab6fbe0a134c33b0199c3886a7c0853fe54af09c1e78a2dc1d2df9297

C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTools.dll

MD5 bc7b742885c5001b756f36af92da5c0a
SHA1 0ede0d6b34608290241d2a0c143a6aa0ec0f2be1
SHA256 b88a0b532708773f72fe4b872e008805070cd294684929b45363a586cb2e26b6
SHA512 ac70792bb599009286dfe2c53fe6dc05c7582f68fee4c35aae7ae33e5c5ce127b3b7ff742967f79ee1bcd2ae3cf7d52fa9618d51f545456459a24dd475cf7be8

C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib3.dll

MD5 85e386a099a25f67a2be469a0f65354f
SHA1 bb687f5390d512171353e3a4f6ef60ec8eeeaece
SHA256 5242f118efe154f2b257fc94db397886cf87fa8c3a6fb7629714b1b5d634577a
SHA512 57ca70cadcfe3c0494fbaa362b66ce4b091fe220dd868a46057ddd512a1035d077f76c507c0a8561e9f310deafe09026a690567d660dbbaa88112231c403dc01

C:\Config.Msi\e582bfe.rbs

MD5 bfe0a6ecd95658aa49d31e8ec2358731
SHA1 99be2f884efabcb89df19bfb20064613c0762a3f
SHA256 6e8dd7b9379c3c13366169d95364b11b6426aa2bb5588d0546d8b2b2d2324518
SHA512 70e82a9d623ea53b9f8a04033036d7af0c9707c1f372c0a1837c06fb804f1ccd95cc6653cd417ea4bf1b4d670990ff9fa6c68b9369b155a1b83e2664f3aa5dd7

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\3285d719-558d-4ae0-a35f-fe7deebd88da.down_data

MD5 5683c0028832cae4ef93ca39c8ac5029
SHA1 248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256 855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512 aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

memory/3704-431-0x0000021276200000-0x0000021276300000-memory.dmp

memory/3704-545-0x0000021276FF0000-0x0000021277010000-memory.dmp

memory/3704-707-0x00000212787E0000-0x00000212788E0000-memory.dmp

C:\ProgramData\Qualcomm\QPST\DriverData.config

MD5 469ac8d10ddcaa5b6d977105b64b904e
SHA1 f9f0644e5a7e9ddbf6b84ba48af221367f79d367
SHA256 87ba99abf9a525bac7eee31e6465e30527bef9dc164425335e54f710d07d93f8
SHA512 768901b5b0f409360ff5bc8f92b5672face74479b08d1250538f8c18bab36fce42b05139fe9f8cfa8d7000c3945c27a6417bd442de0f40ec8e71fc3eddaecbab

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

MD5 5d82c3e0c2ad0f8e98a88d30ee87e950
SHA1 294e86891918d1a12f416c74e2afc381427e52ef
SHA256 d33d1b60de0c3c6f0b1c89afa538b0cedc80af1ca245e8a79fa9db20049fece1
SHA512 7a025275f08bf3f6355761832aa7572eb11096712b7b4b7bf0f99aaa432c65978727ae6a61d42bcb865c66fc5d4f7604eb8c357ffc50d27e7198c4836323c715

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Temp\scoped_dir2436_1719010858\23c1b109-14f7-4a00-aa77-0cc2cdb35f48.tmp

MD5 da75bb05d10acc967eecaac040d3d733
SHA1 95c08e067df713af8992db113f7e9aec84f17181
SHA256 33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2
SHA512 56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

C:\Users\Admin\AppData\Local\Temp\scoped_dir2436_1719010858\CRX_INSTALL\_locales\en_CA\messages.json

MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 921d2a52e04d34756c64b831b94118bb
SHA1 bc1b62956da64adf30aa2cd7844971d783d01b6f
SHA256 aaaa00b6ac7e5245b0b419d9899a2a8d39158b0a767d166b383b4c92e382d733
SHA512 27f6fb264d6ba23de3994e0066a96bdedd4466cbaba7d52ec8cd50525867d62d9efad42e58bee61d98ad6af11d0929807733b792e9efc39308cc203dde279e8f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

MD5 e579aca9a74ae76669750d8879e16bf3
SHA1 0b8f462b46ec2b2dbaa728bea79d611411bae752
SHA256 6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf
SHA512 df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 f3d008e60a8bea9160c167f733593d47
SHA1 eace8aa8f9669de366f1930fa0450bbe7e06582f
SHA256 0fcd5dc9b8510535c87bca1d65eb6ab123bda09fdcdd9eedc7206b1908969f8c
SHA512 c2c57a5efe19629bf594d7b5f40733ceef404287415e39bbec3dcf65e4807003e3bce2229ad8c40e64c98789a13a60511586638ee32db2717355ec7617481097

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 c6bf7cce5588fe5085f895610e371220
SHA1 73b7c9daf726a0b74b13426bedd574a47e55f561
SHA256 dd9cf778d82278dadd86631a4167e7d2cc5fcde159a8a6a0e8a003022b27d21d
SHA512 cda03082eac776ae880c595fe31dae2f4c8bb2efe2fa477b11724c059a11bbfc3bc215baee54dd40cf79e7f07f6ef7b7aff56abfacde4041fba13da3ffacaa2d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 96ba0321a0bc957a4bd9202bee303ca3
SHA1 a3ee56941b3c51acee9ab91465268feb5b99723c
SHA256 9de6e99e8ce2cb35eb5ff14ccc2e7f31b58fcd0651c3633934e4e51c778ed7cc
SHA512 7a68150c5acc1a1221cd75e5b085e87dec8fc9f6b2a7558703ca3da785f500f720544127e547ab4a87a3bee20c9c120d55f4c8abf99582a7c41d7d1e8f1989ed

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 4ee2dcbee2518883f25dd6a6609e1bf5
SHA1 259c42c31767b4c87a49255f0e822c94d0923a41
SHA256 16067e5e02e914f4c672747891f92c26b6d8acfbf262fcc1d9941776e397538e
SHA512 3a44dd72bb59d6d27616ee47846fdd49257d108f0524f18a89da1ecc7d1c358403a110999721c0aca4983e84cbe893b88c3eb19acf6ef4c2355c318a5e61328b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 8efb299cb5cd314ab4a57d4fd26484ab
SHA1 96122216ca9e2ebcfe253d55e91956e34c2ece94
SHA256 c2ec3a328c2e699dd8342d749bd34c119b43512a77b9db18ce2f262f83adb1a7
SHA512 0b5c91b79a3810b7ffe55716972d31a14cf5a8984dffc850b33284413bac9acd60423b38fd568c51a130d70a433a09efa18da0594075b2b49af192e3fb25ef2a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 2c3f9639825856a268ecfa6e06c7e4a8
SHA1 67839127814a26b1bc650e9218dfd3a2d44134fa
SHA256 9d8120802a85b1b9033bf078c8f68b5d3fd2090029ceb1eacd7d7fe6aaac81f2
SHA512 8d964519314118de3770b3135adef0035f912488b63b2c4e7c92ef343f82967422964daa3b1ce63e7667a83d21286be73bb615dfe9bf809500bc458f1a7eb2f2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 403122af8102d78922d90b6e751d85eb
SHA1 b3e54456f39ab203d36b246f1391f5be03b30316
SHA256 19b35d157bc71a7ddf3835dfc2fcc8e72e791ab473fff2deefb4081bbe21d256
SHA512 146db53ae8d7e693681b5ea581628cc2d0c58f36a910630504bf84f75d615fae9fdc45966dab323ef633b43f80cb86749c08cf8759d211b7fe43d108022e6cc0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 669c14a910efc9fede10bd743d6295ff
SHA1 e926a4468b8d37d69bc840ce86d3822ef07b36ed
SHA256 7624238686cae2d164e5e4353fc2e26e17c638ce3dc8a1ab30edde8226b629b1
SHA512 de9d4e85bac4489dfddc2eed61e805993a22f5d6ec70a84540d3ee3dc05fa3e2236d8461cc8d85a63f100bc39969d0259837e55dd519e4614b9503842ef1ff24

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 39aa4aecef6a539bc317fac3ab18cd6e
SHA1 ee0b260686a8961f0ac5036bd06a14d3ea42dbd3
SHA256 732d3304feaaea91a7fbce943c622a9ac1b2af2a129d84a918a020078c607e9f
SHA512 f18e587b367eeefefb051be5db7cafc978dff0bad045f8840ab6ad5ac390de119a5b5f55e09cfe9de69f0b160b1a5c1a3a58a53177ce160b0a21bb79d12f6b55

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004a

MD5 503766d5e5838b4fcadf8c3f72e43605
SHA1 6c8b2fa17150d77929b7dc183d8363f12ff81f59
SHA256 c53b8a39416067f4d70c21be02ca9c84724b1c525d34e7910482b64d8e301cf9
SHA512 5ead599ae1410a5c0e09ee73d0fdf8e8a75864ab6ce12f0777b2938fd54df62993767249f5121af97aa629d8f7c5eae182214b6f67117476e1e2b9a72f34e0b4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 9b3c2132c460acf98dda213e186a25b9
SHA1 c2edd11beb1c3c9866a69774f55fc08ee44ddcaa
SHA256 2c32f6cb7c228500acc454924b0005ebd562bcbd42cc8d4eee9a681df4bc8f3a
SHA512 3eddc871f2125444a0a2cc8dfe0c64f8ef27cf787f4b59bbbee0115563610f3172e9dd7c91e07c3ba947a27dca32adb103242e1504782b76f320a822aff13783

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 c84b97888a7a139166f96c436f8b5a04
SHA1 446089b2e649296425ab3e07ec8dfec00ffefe2b
SHA256 cd2b8b0a0d8bb8f8213702b646869ac2962b9f12210eaef3934113c8c8fea430
SHA512 d02e605f1271cf6851ba4862e08d840dd961e0e24ba5fbbc41015b43476ce8c0de7d98fb5b163a8ab2824d3459090db75d7d2f442b153e0491148d36b47ca801

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 ba43379e41365e9a782f4f9aba96abdb
SHA1 0f24c9c43ddd4c29b69c3cb24437e616641fa92c
SHA256 9b18eaadc043f19494f1f69d192cca900ec2e1434e176cdaba9fbce6e067a848
SHA512 a9a6aa518a159affe2f2d470701f88d98cb2f5c3fba6801458640397b90aefca6a995bec39303a4885ed928776139ec48079d4b91721d439b7e225f75f7b220c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 53adb23ff15c610ff24ec80cb369d3aa
SHA1 99fe3835f1ed6bf5c4efb61db193613c462093ae
SHA256 e02a4c3a31124a81b9e0823314a58d1e9b00c4b759f26a8d1f82523b60464597
SHA512 eee01e6988a62449eae1d6e7848509dfd671b482395499809b4dfbd27752d8b2ec3feb5ef8214227bc34d58d44be05f3de715a295d750f8fb462f4385d43a9e9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 1cd527a4c0676eaf310d1a1ae7ebb124
SHA1 da04e9bd809fceeffc065dcfcf62eaedf23b0fc5
SHA256 7828b41cbe5dc4d390128b285fa63c5fb6d302cb263e27f2db1409b7834cfb3e
SHA512 0c4a31f6dd3569219182988de59d971e18086acde640744519b73527c1a06f2270ccf1a594c303ca45fd61d0ed5cb7ff27919370484c31c83b9ac836ad907883

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000048

MD5 2930155f79f63d1194edd131d324f8c7
SHA1 b66b1c619914cfc659528c9217bdeee11e2682cd
SHA256 4ba101929958b68fc13f769522f6f45a78c0d2b90875f4789202c826af0dcf73
SHA512 bd598f603e3526f0529064cfb7bb1e67d6e6c24607fb66585a8c64236503eb80fdca48e1290a15b6bc92d8030fede31120ecdc46d232c3e76202e0816f7ee330

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.paypal.com_0.indexeddb.leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0d3da71adcce023336e8fc687fd76722
SHA1 69106e8ab8836515839194bb716a6cf5606b9933
SHA256 187e36372879c30bbf0cd4112049581959a58a3dfe7171e68cc0cc3bb99a96da
SHA512 22924130acb7d8405134bd01c3a93889551feca3828da5acdffe82a20e0d963ce595d82e23415f28240ff395518938e149f47355af6729cdfb0cbaa5855ab014

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 3375235d3b5e0e7ca2eead98405849f9
SHA1 c5bc56f1e56748b2d07a6456c2886763abde3b60
SHA256 5d454bb9d5d58303df853cd77aced5b17f6a827004ee9b66ddf744c792f8d46e
SHA512 f25ad4ff7cee2d3e4aeee3356380e2ab1a5a77f160e05ea7b121d1d961fa34c58d81006e15409d64d39b99f1948464201e93f37e94dadf1d0aaad2a6c7b3c843

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 8cc55abbe1f7788c723358e4d967aec2
SHA1 8a0bc07b1e28b6e3b88c24b0a17dada9e847c33a
SHA256 7607474614006d7e117f859d9faca7b765c715bd38bbcb41c8d7419ee9026ab8
SHA512 585715aabd24ca86bc6cce4a77c3cc531370ddbe10496bba50f70b3ce1d42ef2d1327b1a615ed2b778fa5c9a1759df9b08f9c82b2529acbf1239139955d613d7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 07304b490dad154c400110c43ea8757f
SHA1 ee2d8639d440d1babfbd9ab0084ae666fbd31410
SHA256 decbc1bafd33decc044c5479ee8ebbc4a1a57a693404d0f8218e73911213df1b
SHA512 592a44945e0444d95d9c7a6817b19b49761b7521025e6c9ed36e9d4029922c0fa1411258f7a98d352f46a773538eaa8b28a047352d0f814db0be4f9ac5ae0991

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 8d255f91278363223334d3de1c6236db
SHA1 4d5059f64637028fddf7e6fbfda916ab3390927b
SHA256 7d76990f4e38b133a3a75fdbf5ab3ce9bbe8fa30c8ef19305bf99962f4f6f6e2
SHA512 50582a7c30d3cc3b3b35cb2d195d2b879a7a3dcdc025152e11f95a80d87bc9a1d1c37f0ee99d11844c406066bd0c886f2b2f8193d839eaab49e77097a2910db7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.paypal.com_0.indexeddb.leveldb\MANIFEST-000001

MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 d29e3fcfcbf75229c3f4069a9eaf305c
SHA1 65a04ae781022574767a19a80f408c69548e29a6
SHA256 239a06245abaa04f2ded7f328f00649cf7ba6b81550385aab45735e4997c94a8
SHA512 c928fb215970c9863340556a847af7654c5dd30731b3eb2ff54da5c0d852c72c24f1942b9801f83ec72defe963db8d30dc2970444db143aa334d6bbdad15a98c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 85e7e6871773970b6c1371d24d4a8667
SHA1 39753cd1dd5d7756de59f499f72148fee31e17cb
SHA256 549cab6e512e992352c1955b86580d671f10f46c8bdc7dedfd35b774166049d1
SHA512 48fef1123bf5b7b7d036a58fa80ac6d2e171fe8d36b9e30d82dc8c8350145e4380e1734a537e056cd38f0e042217cc9d1e1411be17d79514b96faafde5e231ce

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 a41e2fbed33f9ec5dd7fe7b5c71fd1e4
SHA1 46b7ce3cef744f82ee31695819252db1c1f27c36
SHA256 dfb2a3fe125e514e15a6f211659a4b2b65cf5788792279260ab10fe6af7f5bdb
SHA512 eeb7ff3542ef44793a51e13720fc28fb2c738c224301618b54a6b6289299b2c1747dfdde5d3d62d5af65bbfd94545c30610cd86d8eb9d63400433695b5a21667

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

MD5 60876282d78323d1aa5a1237e479c0be
SHA1 6c846552211e3b76d909dfaa67631b802d4ad842
SHA256 0adb80a48332a4f6296cceb705b4e480f949aa2de56d9beb049284160de915a9
SHA512 6ca9bc1f5df4caabdd502ff4c3bc4d67d7efd362afbe17e8cc7412d274f6cd13a17e82e8fdab52a3cbe7e0e4695bbd75245dec3d91486a228301ce53327d375f

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

MD5 a16d8f244497b149dd1babf5bbbcb00f
SHA1 c2e1d72c6256409e97153bea615de6ca19cdf5da
SHA256 d5e057a6850c6782670bc63a4ab78bc7d7077004352bc608ec1ec5b3f52bb382
SHA512 eac6f4d828ee9ef90793b27a1525a608e47b94e3e128cbf6556ef6543349e31c2151b105b88926e81bcd3f96dac69d30b52e0b2b090c5a3d38ad7b52949941d2

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-18 02:50

Reported

2024-11-18 02:53

Platform

win11-20241023-en

Max time kernel

90s

Max time network

99s

Command Line

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\QPST.2.7.425.msi

Signatures

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\mfcm100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\atl100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100u.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfcm100u.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\msvcr100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfcm100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100u.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfcm100u.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\msvcr100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\msvcp100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\msvcp100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\atl100.dll C:\Windows\system32\msiexec.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\efs_error.pm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QualCtrl.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\SerialPortLib.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\efs_removetree.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\EFSExplorer.hlp C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\swdl_DownloadBySettings.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QFIL.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\CustomAction.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\NPRG6800.hex C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\swdl_si_nor_download.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\NPRG6250SEC.HEX C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\ServiceProg.cnt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\NPRG6550.hex C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\enumerate.vbs C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\aprg6000.hex C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\APRG6275.hex C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\efs_isdirempty.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\armprg.hex C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\Download.cnt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\swdl_si_nand_download.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\RfNvConfig.ini C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib1.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\aprg6200.hex C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServicePS.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\sahara_tests.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QpstMarshal.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QpstLoggerLib.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTDevMgmt.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\DMProxyWin.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib2.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\aprg6100.hex C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\RF-NV-MGR.HLP C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\NPRG6275.hex C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\efs_lstat.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\ServiceProgAgentLib.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneLib.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Documents\License.rtf C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\ConfigAgentMarshal.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Documents\QpstUserGuide.pdf C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\swdl_nvrestore.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\efs_copy_pc_to_different_filesubsystems.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTProxyComponents.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\EFSExpCtrl.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\NPRG6550PB.hex C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\get_com_port_list.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\efs_rename.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\AtmnServer.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\enumerate.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\RLEditor.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\APRG6800.hex C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\ServiceProg.hlp C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QCNView.CNT C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\swdl_DownloadBySettings.vbs C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTConfig.cnt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\Rleditor.hlp C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\provisioning.vbs C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\Download.hlp C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\EFSExplorer.cnt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Documents\DeprecatedApps.htm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\bin\WLEditor.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\efs_read_link.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\copy_phone_to_pc.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\swdl_otp_download.pl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\efs_statfs.pl C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_E12D11B048F4219D59E889.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_07A4B5A907F8D58E1C3F51.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_C80B81499D47121037110A.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_8831554A687F32E1C7D6BE.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_9A022FD55DB3B13026A97D.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_08891AC1D30A7EE0770E61.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI4E7A.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DFC325F4AE6A2964EB.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_07A4B5A907F8D58E1C3F51.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI52D0.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF9BD5597EC79AF68E.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI4D40.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{90BA4578-EE5C-47A3-AB5D-2254708AB111} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_C6F01526BC2A9FF352A1A8.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF85EFAF1204EB87A9.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DFB5AFA4C92BD632D3.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_9A931C09FD90074E50A930.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_87EA2FA782C3B99C90FAE6.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_08891AC1D30A7EE0770E61.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_87EA2FA782C3B99C90FAE6.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_9A022FD55DB3B13026A97D.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_26BF785DF4FA95F6903C98.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_9A931C09FD90074E50A930.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_25EC5F4DB58CB67A046911.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e584c66.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e584c66.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_853F67D554F05449430E7E.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_1ACB3840664F6BC513D3A7.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_C6F01526BC2A9FF352A1A8.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_C80B81499D47121037110A.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_25EC5F4DB58CB67A046911.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_8831554A687F32E1C7D6BE.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_E12D11B048F4219D59E889.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_BE44A30B1D451C1FFD00EB.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_853F67D554F05449430E7E.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_1ACB3840664F6BC513D3A7.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_26BF785DF4FA95F6903C98.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{90BA4578-EE5C-47A3-AB5D-2254708AB111}\_BE44A30B1D451C1FFD00EB.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e584c68.msi C:\Windows\system32\msiexec.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A

Event Triggered Execution: Installer Packages

persistence privilege_escalation
Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Qualcomm\QPST\bin\AtmnServer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Qualcomm\QPST\bin\CustomAction.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000ffe3df86b77af750000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800000ffe3df80000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809000ffe3df8000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d0ffe3df8000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000ffe3df800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6DE491A-3804-41EB-B60A-996AEBD4328B}\ProxyStubClsid32\ = "{C6DE491A-3804-41EB-B60A-996AEBD4328B}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PhonePropLib5.AtlasModelEfsLteNas\CLSID C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62E36B30-EE0A-11d3-BF96-0008C78F17BD}\ProgID\ = "PhoneModelLib.AtlasModelNvIntfQuadAmps.1" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Qualcomm.AtlasPhoneModStreamingDownload.1\ = "AtlasPhoneModStreamingDownload Class" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{459CAFCE-E99A-4B19-9A80-9358D210719C}\TypeLib C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{73E704DF-EED3-11D3-A096-00805F9B0C38}\ = "_IAtlasPhoneListEvents" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62E36B33-EE0A-11d3-BF96-0008C78F17BD}\TypeLib\ = "{62E36B39-EE0A-11d3-BF96-0008C78F17BD}" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{73E7048E-EED3-11D3-A096-00805F9B0C38}\NumMethods C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EB2EB74-F481-11D3-BF93-0008C78F17BD}\TypeLib\Version = "1.0" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ED174A85-2FC8-40CD-89BD-BF7E0E33FBDD}\TypeLib\ = "{21454A49-2D4B-4F4E-A401-0C2614B1266B}" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModelPDQ1900\CurVer C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{73E7047F-EED3-11D3-A096-00805F9B0C38}\ProxyStubClsid32 C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{73E70501-EED3-11D3-A096-00805F9B0C38}\ProxyStubClsid32 C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57378322-F37D-11d3-B518-0008C7D32C94}\TypeLib C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModelNvIntfDisplayC C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QPSTProxyComponents.DownloadSettings.1\ = "DownloadSettings Class" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DB01F482-326D-48FB-8DB1-0FE1AE2A15C5}\ProxyStubClsid32 C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62E36B1B-EE0A-11d3-BF96-0008C78F17BD}\TypeLib\ = "{62E36B1D-EE0A-11d3-BF96-0008C78F17BD}" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4971291-FB72-4CB5-8460-7681617BF81D}\TypeLib\Version = "1.0" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{814C4CA1-2DE3-47D9-8B81-065E3A1B4DFD}\ProxyStubClsid32 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{73E704FB-EED3-11d3-A096-00805F9B0C38}\VersionIndependentProgID C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModelNvIntfFeaturesH C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C26525C-A161-11D5-B53A-0008C7D32C94}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D10690CB-A848-4D69-BC41-67DB6FF399EB}\ProxyStubClsid32 C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModelRfItems C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57378325-F37D-11d3-B518-0008C7D32C94}\InprocServer32\ThreadingModel = "Free" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20C2CC34-6A2D-46D3-A8B0-E996B25BF888}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PhonePropLib3.CAtlasModelNvIntfNAS\ = "CAtlasModelNvIntfNAS Class" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModelQCT6000\CLSID\ = "{62E36B49-EE0A-11d3-BF96-0008C78F17BD}" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36C95030-3D64-417D-9547-4F681833F6F9}\ = "PSFactoryBuffer" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68D22715-0CF6-42A8-A574-C290DA8690B0}\ProxyStubClsid32\ = "{23DE6704-A89C-4B42-92FB-CD13CAD71310}" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{026A172D-A65B-4063-9CF0-8CEE2187259B}\ = "IQSoftwareDownloadSink" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0FDC6092-7D37-44F0-9F3D-641281ECB05E}\ProxyStubClsid32 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{294EF1D9-B73A-4F1D-A334-9C3507CED92A}\ProgID C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{BC600A24-8927-4696-9A41-35187EDDDD19}\ProgID C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62E36B55-EE0A-11d3-BF96-0008C78F17BD} C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57378339-F37D-11d3-B518-0008C7D32C94} C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QPSTProxyComponents.DownloadSettings.1\CLSID C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PhonePropLib5.AtlasModelNvIntfUmtsSms.1 C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AtlasUITools.PortListProps\CurVer\ = "AtlasUITools.PortListProps.1" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43797FC2-49BD-413B-A309-626C475586F7}\Control C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB9F2218-8A4E-4B71-A9C9-DF25A7997D1B}\ = "EventLogging Class" C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BEA5AFE-F058-11d3-B518-0008C7D32C94} C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModel3300SurfTM.1\CLSID\ = "{EE743320-2B7C-11D4-B51C-0008C7D32C94}" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5737832E-F37D-11d3-B518-0008C7D32C94}\ = "AtlasModelNvIntfFeaturesB Class" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57378335-F37D-11d3-B518-0008C7D32C94}\ProgID\ = "PhoneModelLib.AtlasModelNvIntfFeaturesI.1" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModelNvIntfDualSystem\CurVer C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F7AB888-8B55-46B7-A99B-E61BE0BA6214}\LocalServer32\ThreadingModel = "Free" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModelQCT7000.1 C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5737831C-F37D-11D3-B518-0008C7D32C94}\ = "IAtlasModelIntfAlerts" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QPSTProxyComponents.MemoryDebug C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62E36B20-EE0A-11d3-BF96-0008C78F17BD} C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62E36B23-EE0A-11d3-BF96-0008C78F17BD}\InprocServer32\ThreadingModel = "Free" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62E36B44-EE0A-11d3-BF96-0008C78F17BD}\ProgID C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57378328-F37D-11d3-B518-0008C7D32C94}\VersionIndependentProgID C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62E36B24-EE0A-11d3-BF96-0008C78F17BD}\InprocServer32\ThreadingModel = "Free" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModelNvIntfDualCellCDMAB.1\CLSID C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5737831A-F37D-11D3-B518-0008C7D32C94}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModelNvIntfDualBandCDMA\ = "AtlasModelNvIntfDualBandCDMA Class" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{73E704A0-EED3-11D3-A096-00805F9B0C38}\ = "IAtlasModStreamingDownload" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93DDCD97-F58B-4F68-ACA8-286725C66CC0} C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModelNvIntfPhoneBookB.1\ = "AtlasModelNvIntfPhoneBookB Class" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{73E7047C-EED3-11D3-A096-00805F9B0C38}\ProxyStubClsid32 C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PhoneModelLib.AtlasModel6300\CurVer\ = "PhoneModelLib.AtlasModel6300.1" C:\Windows\syswow64\MsiExec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Qualcomm\QPST\bin\AtmnServer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4992 wrote to memory of 4044 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 4044 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 4044 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 4388 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\srtasks.exe
PID 4992 wrote to memory of 4388 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\srtasks.exe
PID 4992 wrote to memory of 368 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 368 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 368 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 1100 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 1100 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 1100 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 2884 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 2884 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 2884 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 788 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 788 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 788 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 1316 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 1316 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 1316 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 2892 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 2892 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 2892 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 5052 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 5052 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 5052 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 1696 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 1696 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 1696 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 776 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 776 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 776 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 228 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 228 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 228 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 2816 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 2816 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 2816 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 3156 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 3156 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 3156 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 1808 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 1808 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 1808 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 4200 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 4200 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 4200 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 684 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 684 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 684 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 4460 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 4460 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 4460 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 1844 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 1844 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 1844 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 4736 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 4736 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 4736 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 3912 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 3912 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 3912 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 4576 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4992 wrote to memory of 4576 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\QPST.2.7.425.msi

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding EB0C2A2E983F11FAA1D03D54F1CD5381 C

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 82C322E55D21954B1616610A97067369

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 16179D88B76F87CE40BD82F30DE01A7A M Global\MSI0000

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneEFS.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneModelLib.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib4.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTProxyComponents.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\ConfigAgentMarshal.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PersistentDevConfigPS.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\ConfigAgentLib.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib5.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\DownloadAgentLib.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTools.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib3.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\QpstMarshal.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\SerialPortLib.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\ServiceProgAgentLib.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\EFSExpCtrl.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib1.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTools2.ocx"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib2.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneLib.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneMarshal.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServicePS.dll"

C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTService.exe

"C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTService.exe" /REGSERVER

C:\Program Files (x86)\Qualcomm\QPST\bin\AtmnServer.exe

"C:\Program Files (x86)\Qualcomm\QPST\bin\AtmnServer.exe" /REGSERVER

C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServer.exe

"C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServer.exe" /REGSERVER

C:\Program Files (x86)\Qualcomm\QPST\bin\CustomAction.exe

"C:\Program Files (x86)\Qualcomm\QPST\bin\CustomAction.exe" /Install

Network

Files

C:\Users\Admin\AppData\Local\Temp\MSIA325.tmp

MD5 5494165b1384faeefdd3d5133df92f5a
SHA1 b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256 ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512 ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613

C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\AtmnServer.tlb

MD5 7d6bf27cba1635f6dea129e5adfacff7
SHA1 9ca3dcd526beb964ff573201c994ce6a48552649
SHA256 831ed8c571925b6ae8620a4520f89ba8925c00857bab420f0e938483e77965e4
SHA512 d6244175f2327ac10697b97f699a049f8509fc618496803ea59a577a871d4d30195d8b469c7264e6ca1c3b7605c6fec980b0f9bf316cc263b0284f6be229ec35

C:\Program Files (x86)\Qualcomm\QPST\Automation Samples\QPSTProxyComponents.tlb

MD5 b29a98782bf2197b6872aec6ece4c433
SHA1 ef85109c2a8f510d04d828c7e4276733d2db77b3
SHA256 7509caec5e8b69a7d44f5ad8a0ed51ba7a1a4029e7828739ad404913ddb3d69f
SHA512 59d7ee4c2bf6e50f2493324750455ce7d8d3aa67253afae8e63dbe535a9d0658fdfcb39042356adf3750454345521b821fe99a2133a3a53a01b476b499da1095

C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneEFS.dll

MD5 264692d4274dc027c241a023caadfa6a
SHA1 6e0f1452a1176d7273274523a9edface2a00fbe7
SHA256 5c1cd59b0af22c82aea823ad435f32d72112b0a564b6174f6197574936fecec0
SHA512 013f296ffbb2779312cf6d26e35a72b73acf54dc0e7d15fbea8cc671405fd2c0ad266fb63c346af1ef72712136a252b0d53282fbf115e7fabff3809296481773

C:\Windows\SysWOW64\msvcp100.dll

MD5 bc83108b18756547013ed443b8cdb31b
SHA1 79bcaad3714433e01c7f153b05b781f8d7cb318d
SHA256 b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
SHA512 6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011

C:\Windows\SysWOW64\msvcr100.dll

MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneModelLib.dll

MD5 e3a1852b1b50005dd2e037dc0dad66a4
SHA1 f552d3a7b5db4de9172995294833b45d7ab4a81b
SHA256 08562c5c85d676fc523a1bacaa5e461a279fc5b448e17a276b5abdaa20f3982b
SHA512 55e1d47ed7a7455413317e10afdc3fe52983acdfadb2ceacfaaef2b0a879ebdfd6374a6a7e9bccd43102db071cc041ffc1c990e0002a13cdd87ec17552b2469c

C:\Windows\SysWOW64\mfc100.dll

MD5 493fc0f59054a6f4f3775655fb55295c
SHA1 2afe4f5eb626fb5c5aa5bb6c2bc61c88e37cf42f
SHA256 cac58c98f7e587ba1b2a4f41874764b59bdf6cb684a4a44aee93f91b3b9a019b
SHA512 9da41078a65a6b8c731388ccf4ce2a988705305f29f0841039b96cd2649f82e8ea219f082de184826e39f0edaa4a1d9aff2e60ebb8d27771222d0c7cb165598d

C:\Windows\SysWOW64\atl100.dll

MD5 c85670ab64068f8080998aeba6c5019c
SHA1 ef762c375486594f6604f39311d32442156ac8bb
SHA256 87d88235f69c062e5b759f91253abaf7bd055937dd119bd26858237f812d3ded
SHA512 870a27585f72e444fa9a2b46ab53ed420932952be8a3c4ddd0d831d72be0ac1b44992cf757de76d0cd667cd5b6150e9eb96ac2a8e7161a22c7d557946a12e5c6

C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib4.dll

MD5 64e971360b1ebf39d46b5aba8eca4aaf
SHA1 47cbb1e1799b57666523b69e76ea7ecb214d892f
SHA256 57c7d9d44a98866403df9e93167ffdfd51904a14968988e6ce4ba6e1e2a3eb92
SHA512 56e35f051413a6b0e84cbce926537a5c2651c47ae58c06fdbfb7eebe163fb60f2bf4c5b9db198980d2f0853b6a5563af203125e0025fbdcf31adfbc9ed5ce36d

C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTProxyComponents.dll

MD5 77f8d0db9413c266c34574dc1a0d0cd0
SHA1 81fe6e3e5308c6076841a7b151689eda3a4fda95
SHA256 575d2448bc762eaaea59b786b339a8268b6eaf56180a13501fff765baf6497b1
SHA512 1b610d5923fab879229b8f9369afbfabd15a1ca40af0373ce306c20cba9362d89bf23b1a900fc7e30115503160e86827c0c130b03993bf05335ccb85f09f1761

C:\Program Files (x86)\Qualcomm\QPST\bin\QpstLoggerLib.dll

MD5 628b8b4befd5467753f1556e62c45cdc
SHA1 9f12fe498b1c2c2d6b30837a3c8609921a75f261
SHA256 2c1bc119a02efacdad6777873536a45cb54882971f035e185b732dabd7908dbf
SHA512 3f4049091270e4c8ee0d6ca9b2a1a40f06c1d47c82af9407cbbac6412bb7e2890d640efb85147ef761c99fa3b63000194dddd404d4103962970edf39867c4e40

C:\Program Files (x86)\Qualcomm\QPST\bin\xerces-c_3_1.dll

MD5 ba59630308d149c2f1563ad286c49f6b
SHA1 69d43cd7f6ed6dd2873a7068cf349243ef7c7ac9
SHA256 0f7917d4b7308668a4c63b3cd1603b94c9fe944c0f93ea9810df2121fc8ea01d
SHA512 1a393775f31920dc3aac42904ece2c8a263db3ce6734418e0557cec981db03e9b8cc4928bd90d85f91267300d49d3de75e2e3eb8d3802fb01b935d455b4a3bb7

C:\Program Files (x86)\Qualcomm\QPST\bin\ConfigAgentMarshal.dll

MD5 eb0b9f5217daf53e3dd8cef312089a33
SHA1 4b39b2417ca0a32e9efbf62bfb993995073d1f4a
SHA256 cf256a0435ef01eb3df6e94eaa758f8a156266157d4113b0f55b7606ac30844e
SHA512 7be85fb353ecd6dc200f8bcbc417fc990687f5e6db23b52dcda30b0756bedf57442c4ea0979562c94b77ebdd0cd242dbbd3dafb2ea36c275ad815b192d22f2d4

C:\Program Files (x86)\Qualcomm\QPST\bin\PersistentDevConfigPS.dll

MD5 cf89407cf93ddaaa04b5418a1141f7c9
SHA1 18ffe62dab167a34a2315940a5c8a00b5df4f6c1
SHA256 4c44e7966fc347e13573f942f6c0b92a3f0efa2346ebfb25e20f77b19240f1e0
SHA512 95b706dbd72dcef9bb7e912a6b6531be5451b7ba89ef620748a0e26d1ff62610305921d20fca2f84cdf554c92558520d501fab066241f6a3e8b8bf0145f9d767

C:\Program Files (x86)\Qualcomm\QPST\bin\ConfigAgentLib.dll

MD5 a8d8af9da0e2678d3c8749837ac877a6
SHA1 7d3c15322e5fa07efef6299a30976cae9a2a217d
SHA256 f440c7f4e8328971e77900a41cc6c3c13a435998f759e5a1d34d86232348965d
SHA512 eb5f5f1ef54cd871216fd59509f9c2220f5b8f443e49995a789ab4d8919b4f38613eefdb2574148d84380e33af44e3d0e83217101912b5244df739a90df57262

C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib5.dll

MD5 f961e614768f50254b05e4a3dbe974ef
SHA1 de9bd5a312eca9368942f89964b169596b46dd2b
SHA256 e0b1e1ded51241829aa9c4ca47ece4d2fbf38fa1404f8766b4b8ec7884039347
SHA512 da59310fdb43c2c6129ed43f9687e9d65e09b917e1aa4ae947533a50ebe0b22cfc798ff26c269f0128c3565d006a5c8acadde53cdbf2d90a9663935579c657ea

C:\Program Files (x86)\Qualcomm\QPST\bin\DownloadAgentLib.dll

MD5 fb13abdf8b3e3d39d7bd256a458e6f52
SHA1 1a32a2bb3b8c8486705a7c6080aed389b9914ef0
SHA256 e82b7e175250599f0e71e881991c4cb7dd3189ddf2cb2a213540f0ac103a24c3
SHA512 2f21283c8146459d2f6e106f90fd9d49315e5cbbcf3fa88a6c8316f006ccb35c1362380ab6fbe0a134c33b0199c3886a7c0853fe54af09c1e78a2dc1d2df9297

C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTools.dll

MD5 bc7b742885c5001b756f36af92da5c0a
SHA1 0ede0d6b34608290241d2a0c143a6aa0ec0f2be1
SHA256 b88a0b532708773f72fe4b872e008805070cd294684929b45363a586cb2e26b6
SHA512 ac70792bb599009286dfe2c53fe6dc05c7582f68fee4c35aae7ae33e5c5ce127b3b7ff742967f79ee1bcd2ae3cf7d52fa9618d51f545456459a24dd475cf7be8

C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib3.dll

MD5 85e386a099a25f67a2be469a0f65354f
SHA1 bb687f5390d512171353e3a4f6ef60ec8eeeaece
SHA256 5242f118efe154f2b257fc94db397886cf87fa8c3a6fb7629714b1b5d634577a
SHA512 57ca70cadcfe3c0494fbaa362b66ce4b091fe220dd868a46057ddd512a1035d077f76c507c0a8561e9f310deafe09026a690567d660dbbaa88112231c403dc01

C:\Config.Msi\e584c67.rbs

MD5 aa99ccbde5c63b02919b15560a6ba050
SHA1 addea3dd48556b42d06e4bd6859759f7e4e8dc2b
SHA256 9d2594dd859e7df35740d70e313bb18a3bc7893df638d32cefcea89897a1de72
SHA512 336255c91691d2fefcf29392bdbc53c82d86d22dd15f9f9c9a00ffd458eb79db7cbc2c79b45ef9ee9a587d09778f122871be9c9d3e17eb73e56387c236ab076a

C:\Windows\Installer\e584c66.msi

MD5 22de8c14c311b0765fb2456fd1b69963
SHA1 8ea5b404dbb35cf45d34f2d7e46b258eb1b92829
SHA256 64a76a6ccc9f2623f8a12be8c2ae04b409144df06ca9a64845d3a1355c1609a2
SHA512 89659f530abb0a149e002afaa98270435b2ea0b1fcc89edc7e1837f6f8ff312aa6847b2b1856ad8cce48334621a261395f6b9391ff1bf7262d1c137a8ae5baf1

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-18 02:50

Reported

2024-11-18 02:54

Platform

win11-20241007-en

Max time kernel

192s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\VSDB381.tmp\vcredist_x86\vcredist_x86.exe N/A
N/A N/A \??\c:\83304339ff1ead971a185ada\Setup.exe N/A

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer \??\c:\83304339ff1ead971a185ada\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName \??\c:\83304339ff1ead971a185ada\Setup.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp \??\c:\83304339ff1ead971a185ada\Setup.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\VSDB381.tmp\vcredist_x86\vcredist_x86.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\83304339ff1ead971a185ada\Setup.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier \??\c:\83304339ff1ead971a185ada\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 \??\c:\83304339ff1ead971a185ada\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision \??\c:\83304339ff1ead971a185ada\Setup.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 \??\c:\83304339ff1ead971a185ada\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz \??\c:\83304339ff1ead971a185ada\Setup.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 \??\c:\83304339ff1ead971a185ada\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString \??\c:\83304339ff1ead971a185ada\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier \??\c:\83304339ff1ead971a185ada\Setup.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS \??\c:\83304339ff1ead971a185ada\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU \??\c:\83304339ff1ead971a185ada\Setup.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A \??\c:\83304339ff1ead971a185ada\Setup.exe N/A
Token: SeBackupPrivilege N/A \??\c:\83304339ff1ead971a185ada\Setup.exe N/A
Token: SeBackupPrivilege N/A \??\c:\83304339ff1ead971a185ada\Setup.exe N/A
Token: SeBackupPrivilege N/A \??\c:\83304339ff1ead971a185ada\Setup.exe N/A
Token: SeBackupPrivilege N/A \??\c:\83304339ff1ead971a185ada\Setup.exe N/A
Token: SeBackupPrivilege N/A \??\c:\83304339ff1ead971a185ada\Setup.exe N/A
Token: SeBackupPrivilege N/A \??\c:\83304339ff1ead971a185ada\Setup.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\VSDB381.tmp\vcredist_x86\vcredist_x86.exe N/A
N/A N/A \??\c:\83304339ff1ead971a185ada\Setup.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\setup.exe

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

C:\Users\Admin\AppData\Local\Temp\VSDB381.tmp\vcredist_x86\vcredist_x86.exe

"C:\Users\Admin\AppData\Local\Temp\VSDB381.tmp\vcredist_x86\vcredist_x86.exe" /q:a

\??\c:\83304339ff1ead971a185ada\Setup.exe

c:\83304339ff1ead971a185ada\Setup.exe /q:a

Network

Country Destination Domain Proto
US 23.192.22.93:80 www.microsoft.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 93.22.192.23.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\VSDB381.tmp\vcredist_x86\vcredist_x86.exe

MD5 1801436936e64598bab5b87b37dc7f87
SHA1 28c54491be70c38c97849c3d8cfbfdd0d3c515cb
SHA256 67313b3d1bc86e83091e8de22981f14968f1a7fb12eb7ad467754c40cd94cc3d
SHA512 0b8f20b0f171f49eb49367f1aafa7101e1575ef055d7007197c21ab8fe8d75a966569444449858c31bd147357d2bf5a5bd623fe6c4dbabdc7d16999b3256ab8c

C:\83304339ff1ead971a185ada\Setup.exe

MD5 2af2c1a78542975b12282aca4300d515
SHA1 3216c853ed82e41dfbeb6ca48855fdcd41478507
SHA256 531eb45798728cb741043b28b8c1a4f75536dc75f92d100f55f9109d2d63f0d7
SHA512 4a70bd4b542f6001e46f827f341676c34af1ea216c50ad981dd04f547cd67f73aaa420fcbed379dc05dab199bf5ba00d899c49ff75da577613209f96226227eb

\??\c:\83304339ff1ead971a185ada\SetupEngine.dll

MD5 63e7901d4fa7ac7766076720272060d0
SHA1 72dec0e4e12255d98ccd49937923c7b5590bbfac
SHA256 a5116ccb17b242713e5645c2374abf5827c0d2752b31553e3540c9123812e952
SHA512 de2e63bc090121484191cbf23194361d761b01c0fd332f35f0dfdfd0b11431b529e5c7f542031a0e7e26f31497d94b8baacfbf1c84c6493e66ac2ab76c11d0a0

\??\c:\83304339ff1ead971a185ada\sqmapi.dll

MD5 3f0363b40376047eff6a9b97d633b750
SHA1 4eaf6650eca5ce931ee771181b04263c536a948b
SHA256 bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c
SHA512 537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8

\??\c:\83304339ff1ead971a185ada\DHTMLHeader.html

MD5 cd131d41791a543cc6f6ed1ea5bd257c
SHA1 f42a2708a0b42a13530d26515274d1fcdbfe8490
SHA256 e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
SHA512 a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

C:\Users\Admin\AppData\Local\Temp\Setup_20241118_025055213.html

MD5 0815a41f71b2049b363dea1c1d05f943
SHA1 1e12986efb019e93cd8363d04510cd2a7694be90
SHA256 a935fb84ffa0eec43b7a6c891b82076c66aac4bc7fb891cb4243837083fff337
SHA512 2b26679cf236a95c082da33e9b896ae1a46c81f6f11d759575a02f55312511be4b1dd8a0fa717a4ca076d64b97d4710effc36446f7013fc43fd8a85deb07305b

\??\c:\83304339ff1ead971a185ada\UiInfo.xml

MD5 4f90fcef3836f5fc49426ad9938a1c60
SHA1 89eba3b81982d5d5c457ffa7a7096284a10de64a
SHA256 66a0299ce7ee12dd9fc2cfead3c3211e59bfb54d6c0627d044d44cef6e70367b
SHA512 4ce2731c1d32d7ca3a4f644f4b3111f06223de96c1e241fcc86f5fe665f4db18c8a241dae4e8a7e278d6afbf91b235a2c3517a40d4d22d9866880e19a7221160

\??\c:\83304339ff1ead971a185ada\ParameterInfo.xml

MD5 13f8768c289476fdd103ff689d73cd2d
SHA1 ddebcecc02c6b1b996423d62d0def8760f031f58
SHA256 4eae293ca91b31aaa206e5a1c655714f0fe84e39f9331cb759d2236cdb915523
SHA512 c72998f30ebff8f4a757248639cf0351d03f5502be475b4cb8f02b09ad800dbbe2f9a82c7d9bde6d7bd748e0ee6e61b86e369192773fe726421a564e793a0139

\??\c:\83304339ff1ead971a185ada\1033\LocalizedData.xml

MD5 d642e322d1e8b739510ca540f8e779f9
SHA1 36279c76d9f34c09ebddc84fd33fcc7d4b9a896c
SHA256 5d90345ff74e177f6da8fb6459c1cfcac080e698215ca75feb130d0d1f2a76b9
SHA512 e1e16ae14bc7cc1608e1a08d3c92b6d0518b5fabd27f2c0eb514c87afc3d6192bf7a793a583afc65f1899f03dc419263b29174456e1ec9ab0f0110e0258e0f0d

\??\c:\83304339ff1ead971a185ada\1028\LocalizedData.xml

MD5 7fc06a77d9aafca9fb19fafa0f919100
SHA1 e565740e7d582cd73f8d3b12de2f4579ff18bb41
SHA256 a27f809211ea1a2d5224cd01101aa3a59bf7853168e45de28a16ef7ed6acd46a
SHA512 466dcc6a5fb015be1619f5725fa62ca46eb0fb428e11f93fd9d82e5df61c3950b3fb62d4db7746cc4a2be199e5e69eaa30b6f3354e0017cfa14d127fad52f8cf

\??\c:\83304339ff1ead971a185ada\1031\LocalizedData.xml

MD5 b83c3803712e61811c438f6e98790369
SHA1 61a0bc59388786ced045acd82621bee8578cae5a
SHA256 2aa6e8d402e44d9ee895b18195f46bf90259de1b6f44efd46a7075b110f2dcd6
SHA512 e020f93e3a082476087e690ad051f1feb210e0915924bb4548cc9f53a7ee2760211890eb6036ce9e5e4a311abc0300e89e25efbbb894c2a621ffbc9d64cc8a38

\??\c:\83304339ff1ead971a185ada\1036\LocalizedData.xml

MD5 e382abc19294f779d2833287242e7bc6
SHA1 1ceae32d6b24a3832f9244f5791382865b668a72
SHA256 43f913ff28d677316f560a0f45221f35f27cfaf5fc5bd645974a82dca589edbf
SHA512 06054c8048cade36a3af54f9a07fd8fa5eb4f3228790996d2abea7ee1ee7eb563d46bd54ff97441f9610e778194082c44e66c5f566c9c50a042aba9eb9cae25e

\??\c:\83304339ff1ead971a185ada\1040\LocalizedData.xml

MD5 0af948fe4142e34092f9dd47a4b8c275
SHA1 b3d6dd5c126280398d9055f90e2c2c26dbae4eaa
SHA256 c4c7c0ddaa6d6a3a1dc260e9c5a24bdfaa98c427c69e8a65427dd7cac0a4b248
SHA512 d97b5fe2553ca78a3019d53e33d2db80c9fa1cf1d8d2501d9ddf0576c7e6ea38dab754fe4712123abf34b97e10b18fb4bbd1c76d3dacb87b4682e501f93423d9

\??\c:\83304339ff1ead971a185ada\1041\LocalizedData.xml

MD5 7fcfbc308b0c42dcbd8365ba62bada05
SHA1 18a0f0e89b36818c94de0ad795cc593d0e3e29a9
SHA256 01e7d24dd8e00b5c333e96d1bb83813e02e96f89aad0c2f28f84551d28abbbe2
SHA512 cd6f912a037e86d9e1982c73f0f8b3c4d5a9a6b5b108a7b89a46e6691e430a7cb55718de9a0c05650bb194c8d4a2e309ad6221d638cfca8e16aa5920881ba649

\??\c:\83304339ff1ead971a185ada\1042\LocalizedData.xml

MD5 71dfd70ae141f1d5c1366cb661b354b2
SHA1 c4b22590e6f6dd5d39e5158b831ae217ce17a776
SHA256 cccda55294aeb4af166a8c0449bca2189ddf5aa9a43d5e939dd3803e61738331
SHA512 5000d62f3de41c3fb0ed8a8e9c37dbf4eb427c4f1e3ad3823d4716c6fe62250bac11b7987a302b8a45d91aabcf332457f7aff7d99f15edeffe540639e9440e8a

\??\c:\83304339ff1ead971a185ada\1049\LocalizedData.xml

MD5 0eeb554d0b9f9fcdb22401e2532e9cd0
SHA1 08799520b72a1ef92ac5b94a33509d1eddf6caf8
SHA256 beef0631c17a4fb1ff0b625c50c6cb6c8ce90a1ae62c5e60e14bf3d915ad509c
SHA512 2180e46a5a2ea1f59c879b729806ca02a232c66660f29c338c1fa7fbee2afa4b13d8777d1f7b63cf831eb42f3e55282d70aa8e53f40616b8a6e4d695c36e313d

\??\c:\83304339ff1ead971a185ada\2052\LocalizedData.xml

MD5 52b1dc12ce4153aa759fb3bbe04d01fc
SHA1 bf21f8591c473d1fce68a9faf1e5942f486f6eba
SHA256 d1735c8cfd8e10ba019d70818c19fa865e7c72f30ab6421a3748408f85fb96c3
SHA512 418903ae9a7baebf73d055e4774ff1917fbaab9ee7ed8c120c34bb10e7303f6dd7b7dae701596d4626387a30ae1b4d329a9af49b8718b360e2ff619c56c19623

\??\c:\83304339ff1ead971a185ada\3082\LocalizedData.xml

MD5 5397a12d466d55d566b4209e0e4f92d3
SHA1 fcffd8961fb487995543fc173521fdf5df6e243b
SHA256 f124d318138ff084b6484deb354cca0f72296e1341bf01169792b3e060c89e89
SHA512 7708f5a2ad3e4c90c4c216600435af87a1557f60caf880a3dd9b5f482e17399af9f0b9de03ff1dbdd210583e0fec5b466e35794ac24d6d37f9bbc094e52fc77b

\??\c:\83304339ff1ead971a185ada\SetupUi.dll

MD5 0d214ced87bf0b55883359160a68dacb
SHA1 a60526505d56d447c6bbde03da980db67062c4c6
SHA256 29cf99d7e67b4c54bafd109577a385387a39301bcdec8ae4ba1a8a0044306713
SHA512 d9004ebd42d4aa7d13343b3746cf454ca1a5144f7b0f437f1a31639cc6bd90c5dd3385612df926bf53c3ef85cfe33756c067cb757fff257d674a10d638fc03c5

\??\c:\83304339ff1ead971a185ada\SetupUi.xsd

MD5 2fadd9e618eff8175f2a6e8b95c0cacc
SHA1 9ab1710a217d15b192188b19467932d947b0a4f8
SHA256 222211e8f512edf97d78bc93e1f271c922d5e91fa899e092b4a096776a704093
SHA512 a3a934a8572ff9208d38cf381649bd83de227c44b735489fd2a9dc5a636ead9bb62459c9460ee53f61f0587a494877cd3a3c2611997be563f3137f8236ffc4ca

\??\c:\83304339ff1ead971a185ada\1033\SetupResources.dll

MD5 0b4e76baf52d580f657f91972196cd91
SHA1 e6ac8f80ab8ade18ac7e834ac6d0536bb483988c
SHA256 74a7767d8893dcc1a745522d5a509561162f95bc9e8bcc3056f37a367dba64a4
SHA512 ed53292c549d09da9118e944a646aa5dc0a6231811eafcda4258c892b218bcf3e0363a2c974868d2d2722155983c5dc8e29bed36d58e566e1695e23ce07fea87

\??\c:\83304339ff1ead971a185ada\Strings.xml

MD5 332adf643747297b9bfa9527eaefe084
SHA1 670f933d778eca39938a515a39106551185205e9
SHA256 e49545feeae22198728ad04236e31e02035af7cc4d68e10cbecffd08669cbeca
SHA512 bea95ce35c4c37b4b2e36cc1e81fc297cc4a8e17b93f10423a02b015ddb593064541b5eb7003560fbeee512ed52869a113a6fb439c1133af01f884a0db0344b0

\??\c:\83304339ff1ead971a185ada\header.bmp

MD5 3ad1a8c3b96993bcdf45244be2c00eef
SHA1 308f98e199f74a43d325115a8e7072d5f2c6202d
SHA256 133b86a4f1c67a159167489fdaeab765bfa1050c23a7ae6d5c517188fb45f94a
SHA512 133442c4a65269f817675adf01adcf622e509aa7ec7583bca8cd9a7eb6018d2aab56066054f75657038efb947cd3b3e5dc4fe7f0863c8b3b1770a8fa4fe2e658

\??\c:\83304339ff1ead971a185ada\graphics\save.ico

MD5 7d62e82d960a938c98da02b1d5201bd5
SHA1 194e96b0440bf8631887e5e9d3cc485f8e90fbf5
SHA256 ae041c8764f56fd89277b34982145d16fc59a4754d261c861b19371c3271c6e5
SHA512 ab06b2605f0c1f6b71ef69563c0c977d06c6ea84d58ef7f2baecba566d6037d1458c2b58e6bfd70ddef47dccbdea6d9c2f2e46dea67ea9e92457f754d7042f67

\??\c:\83304339ff1ead971a185ada\watermark.bmp

MD5 1a5caafacfc8c7766e404d019249cf67
SHA1 35d4878db63059a0f25899f4be00b41f430389bf
SHA256 2e87d5742413254db10f7bd0762b6cdb98ff9c46ca9acddfd9b1c2e5418638f2
SHA512 202c13ded002d234117f08b18ca80d603246e6a166e18ba422e30d394ada7e47153dd3cce9728affe97128fdd797fe6302c74dc6882317e2ba254c8a6db80f46

\??\c:\83304339ff1ead971a185ada\graphics\print.ico

MD5 7e55ddc6d611176e697d01c90a1212cf
SHA1 e2620da05b8e4e2360da579a7be32c1b225deb1b
SHA256 ff542e32330b123486797b410621e19eafb39df3997e14701afa4c22096520ed
SHA512 283d381aa396820b7e15768b20099d67688da1f6315ec9f7938c2fcc3167777502cded0d1beddf015a34cc4e5d045bcb665ffd28ba2fbb6faf50fdd38b31d16e

\??\c:\83304339ff1ead971a185ada\graphics\setup.ico

MD5 3d25d679e0ff0b8c94273dcd8b07049d
SHA1 a517fc5e96bc68a02a44093673ee7e076ad57308
SHA256 288e9ad8f0201e45bc187839f15aca79d6b9f76a7d3c9274c80f5d4a4c219c0f
SHA512 3bde668004ca7e28390862d0ae9903c756c16255bdbb3f7e73a5b093ce6a57a3165d6797b0a643b254493149231aca7f7f03e0af15a0cbe28aff02f0071ec255

\??\c:\83304339ff1ead971a185ada\graphics\SysReqNotMet.ico

MD5 ee2c05cc9d14c29f586d40eb90c610a9
SHA1 e571d82e81bd61b8fe4c9ecd08869a07918ac00b
SHA256 3c9c71950857ddb82baab83ed70c496dee8f20f3bc3216583dc1ddda68aefc73
SHA512 0f38fe9c97f2518186d5147d2c4a786b352fceca234410a94cc9d120974fc4be873e39956e10374da6e8e546aea5689e7fa0beed025687547c430e6ceffabffb

\??\c:\83304339ff1ead971a185ada\graphics\SysReqMet.ico

MD5 661cbd315e9b23ba1ca19edab978f478
SHA1 605685c25d486c89f872296583e1dc2f20465a2b
SHA256 8bfc77c6d0f27f3d0625a884e0714698acc0094a92adcb6de46990735ae8f14d
SHA512 802cc019f07fd3b78fcefdc8404b3beb5d17bfc31bded90d42325a138762cc9f9ebfd1b170ec4bbcccf9b99773bd6c8916f2c799c54b22ff6d5edd9f388a67c6

\??\c:\83304339ff1ead971a185ada\graphics\Rotate1.ico

MD5 26a00597735c5f504cf8b3e7e9a7a4c1
SHA1 d913cb26128d5ca1e1ac3dab782de363c9b89934
SHA256 37026c4ea2182d7908b3cf0cef8a6f72bddca5f1cfbc702f35b569ad689cf0af
SHA512 08cefc5a2b625f261668f70cc9e1536dc4878d332792c751884526e49e7fee1ecfa6fccfddf7be80910393421cc088c0fd0b0c27c7a7eff2ae03719e06022fdf

\??\c:\83304339ff1ead971a185ada\graphics\Rotate8.ico

MD5 d1c53003264dce4effaf462c807e2d96
SHA1 92562ad5876a5d0cb35e2d6736b635cb5f5a91d9
SHA256 5fb03593071a99c7b3803fe8424520b8b548b031d02f2a86e8f5412ac519723c
SHA512 c34f8c05a50dc0de644d1f9d97696cdb0a1961c7c7e412eb3df2fd57bbd34199cf802962ca6a4b5445a317d9c7875e86e8e62f6c1df8cc3415afc0bd26e285bd

\??\c:\83304339ff1ead971a185ada\graphics\Rotate5.ico

MD5 3b4861f93b465d724c60670b64fccfcf
SHA1 c672d63c62e00e24fbb40da96a0cc45b7c5ef7f0
SHA256 7237051d9af5db972a1fecf0b35cd8e9021471740782b0dbf60d3801dc9f5f75
SHA512 2e798b0c9e80f639571525f39c2f50838d5244eeda29b18a1fae6c15d939d5c8cd29f6785d234b54bda843a645d1a95c7339707991a81946b51f7e8d5ed40d2c

\??\c:\83304339ff1ead971a185ada\graphics\Rotate7.ico

MD5 fb4dfebe83f554faf1a5cec033a804d9
SHA1 6c9e509a5d1d1b8d495bbc8f57387e1e7e193333
SHA256 4f46a9896de23a92d2b5f963bcfb3237c3e85da05b8f7660641b3d1d5afaae6f
SHA512 3caeb21177685b9054b64dec997371c4193458ff8607bce67e4fbe72c4af0e6808d344dd0d59d3d0f5ce00e4c2b8a4ffca0f7d9352b0014b9259d76d7f03d404

\??\c:\83304339ff1ead971a185ada\graphics\Rotate6.ico

MD5 70006bf18a39d258012875aefb92a3d1
SHA1 b47788f3f8c5c305982eb1d0e91c675ee02c7beb
SHA256 19abcedf93d790e19fb3379cb3b46371d3cbff48fe7e63f4fdcc2ac23a9943e4
SHA512 97fdbdd6efadbfb08161d8546299952470228a042bd2090cd49896bc31ccb7c73dab8f9de50cdaf6459f7f5c14206af7b90016deeb1220943d61c7324541fe2c

\??\c:\83304339ff1ead971a185ada\graphics\Rotate4.ico

MD5 bb55b5086a9da3097fb216c065d15709
SHA1 1206c708bd08231961f17da3d604a8956addccfe
SHA256 8d82ff7970c9a67da8134686560fe3a6c986a160ced9d1cc1392f2ba75c698ab
SHA512 de9226064680da6696976a4a320e08c41f73d127fbb81bf142048996df6206ddb1c2fe347c483cc8e0e50a00dab33db9261d03f1cd7ca757f5ca7bb84865fca9

\??\c:\83304339ff1ead971a185ada\graphics\Rotate3.ico

MD5 924fd539523541d42dad43290e6c0db5
SHA1 19a161531a2c9dbc443b0f41b97cbde7375b8983
SHA256 02a7fe932029c6fa24d1c7cc06d08a27e84f43a0cbc47b7c43cac59424b3d1f6
SHA512 86a4c5d981370efa20183cc4a52c221467692e91539ac38c8def1cc200140f6f3d9412b6e62faf08ca6668df401d8b842c61b1f3c2a4c4570f3b2cec79c9ee8b

\??\c:\83304339ff1ead971a185ada\graphics\Rotate2.ico

MD5 8419caa81f2377e09b7f2f6218e505ae
SHA1 2cf5ad8c8da4f1a38aab433673f4dddc7ae380e9
SHA256 db89d8a45c369303c04988322b2774d2c7888da5250b4dab2846deef58a7de22
SHA512 74e504d2c3a8e82925110b7cfb45fde8a4e6df53a188e47cf22d664cbb805eba749d2db23456fc43a86e57c810bc3d9166e7c72468fbd736da6a776f8ca015d1

\??\c:\83304339ff1ead971a185ada\vc_red.cab

MD5 c580a38f1a1a7d838076a1b897c37011
SHA1 c689488077d1c21820797707078af826ea676b70
SHA256 71c0acc75eecdf39051819dc7c26503583f6be6c43ab2c320853de15bece9978
SHA512 ea3a62bd312f1ddeebe5e3c7911eb3a73bc3ee184abb7e9b55bc962214f50bbf05d2499caf151d0bd00735e2021fbea9584bf3e868a1d4502b75ec3b62c7ff56

\??\c:\83304339ff1ead971a185ada\vc_red.msi

MD5 3ff9acea77afc124be8454269bb7143f
SHA1 8dd6ecab8576245cd6c8617c24e019325a3b2bdc
SHA256 9ecf3980b29c6aa20067f9f45c64b45ad310a3d83606cd9667895ad35f106e66
SHA512 8d51f692747cfdd59fc839918a34d2b6cbbb510c90dea83ba936b3f5f39ee4cbd48f6bb7e35ed9e0945bf724d682812532191d91c8f3c2adb6ff80a8df89ff7a

\??\c:\83304339ff1ead971a185ada\msp_kb2565063.msp

MD5 9843dc93ea948cddc1f480e53bb80c2f
SHA1 d6ec9db8b8802ec85dd0b793565401b67ad8e5e0
SHA256 7c969fcda6ef09d2eb7bbbc8d81795eb60c9c69ed835fd16538369ad0a6e0f10
SHA512 79008cfdd8ae1ea27675588e7ba8123d08ce14047e5f167b3b5f6fbcdadeb45515bd72e18e59abf632ecbfbb42243fbcbebe4cbe0ed6ba195d0b2ca6d88676f9

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-18 02:50

Reported

2024-11-18 02:54

Platform

win11-20241007-en

Max time kernel

152s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\vcredist_x86\vcredist_x86.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\81448645c532e16a92cd\Setup.exe N/A

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName \??\c:\81448645c532e16a92cd\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer \??\c:\81448645c532e16a92cd\Setup.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\vcredist_x86\vcredist_x86.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\81448645c532e16a92cd\Setup.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier \??\c:\81448645c532e16a92cd\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 \??\c:\81448645c532e16a92cd\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision \??\c:\81448645c532e16a92cd\Setup.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 \??\c:\81448645c532e16a92cd\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz \??\c:\81448645c532e16a92cd\Setup.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 \??\c:\81448645c532e16a92cd\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString \??\c:\81448645c532e16a92cd\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier \??\c:\81448645c532e16a92cd\Setup.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS \??\c:\81448645c532e16a92cd\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU \??\c:\81448645c532e16a92cd\Setup.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A \??\c:\81448645c532e16a92cd\Setup.exe N/A
Token: SeBackupPrivilege N/A \??\c:\81448645c532e16a92cd\Setup.exe N/A
Token: SeBackupPrivilege N/A \??\c:\81448645c532e16a92cd\Setup.exe N/A
Token: SeBackupPrivilege N/A \??\c:\81448645c532e16a92cd\Setup.exe N/A
Token: SeBackupPrivilege N/A \??\c:\81448645c532e16a92cd\Setup.exe N/A
Token: SeBackupPrivilege N/A \??\c:\81448645c532e16a92cd\Setup.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\vcredist_x86\vcredist_x86.exe

"C:\Users\Admin\AppData\Local\Temp\vcredist_x86\vcredist_x86.exe"

\??\c:\81448645c532e16a92cd\Setup.exe

c:\81448645c532e16a92cd\Setup.exe

Network

Files

C:\81448645c532e16a92cd\Setup.exe

MD5 2af2c1a78542975b12282aca4300d515
SHA1 3216c853ed82e41dfbeb6ca48855fdcd41478507
SHA256 531eb45798728cb741043b28b8c1a4f75536dc75f92d100f55f9109d2d63f0d7
SHA512 4a70bd4b542f6001e46f827f341676c34af1ea216c50ad981dd04f547cd67f73aaa420fcbed379dc05dab199bf5ba00d899c49ff75da577613209f96226227eb

\??\c:\81448645c532e16a92cd\SetupEngine.dll

MD5 63e7901d4fa7ac7766076720272060d0
SHA1 72dec0e4e12255d98ccd49937923c7b5590bbfac
SHA256 a5116ccb17b242713e5645c2374abf5827c0d2752b31553e3540c9123812e952
SHA512 de2e63bc090121484191cbf23194361d761b01c0fd332f35f0dfdfd0b11431b529e5c7f542031a0e7e26f31497d94b8baacfbf1c84c6493e66ac2ab76c11d0a0

\??\c:\81448645c532e16a92cd\sqmapi.dll

MD5 3f0363b40376047eff6a9b97d633b750
SHA1 4eaf6650eca5ce931ee771181b04263c536a948b
SHA256 bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c
SHA512 537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8

\??\c:\81448645c532e16a92cd\DHTMLHeader.html

MD5 cd131d41791a543cc6f6ed1ea5bd257c
SHA1 f42a2708a0b42a13530d26515274d1fcdbfe8490
SHA256 e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
SHA512 a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

C:\Users\Admin\AppData\Local\Temp\Setup_20241118_025046258.html

MD5 1b4b6974647d5ad98f90954dbc3790c2
SHA1 9b8328658766610145af50726d55cb7ce5a2e429
SHA256 b8f0e2eae00b56a90e1c4fa03371e0d1e72f2da3deafca60d4dd367da8fdb3f1
SHA512 f964986273ab0e45c145b815694ceccce8950fdb48e332e4c008426737399f1bab3bb8d00ce5e800f47166788934ab278cddcbe8fba1b0c8102736efed7c8a51

\??\c:\81448645c532e16a92cd\UiInfo.xml

MD5 4f90fcef3836f5fc49426ad9938a1c60
SHA1 89eba3b81982d5d5c457ffa7a7096284a10de64a
SHA256 66a0299ce7ee12dd9fc2cfead3c3211e59bfb54d6c0627d044d44cef6e70367b
SHA512 4ce2731c1d32d7ca3a4f644f4b3111f06223de96c1e241fcc86f5fe665f4db18c8a241dae4e8a7e278d6afbf91b235a2c3517a40d4d22d9866880e19a7221160

\??\c:\81448645c532e16a92cd\ParameterInfo.xml

MD5 13f8768c289476fdd103ff689d73cd2d
SHA1 ddebcecc02c6b1b996423d62d0def8760f031f58
SHA256 4eae293ca91b31aaa206e5a1c655714f0fe84e39f9331cb759d2236cdb915523
SHA512 c72998f30ebff8f4a757248639cf0351d03f5502be475b4cb8f02b09ad800dbbe2f9a82c7d9bde6d7bd748e0ee6e61b86e369192773fe726421a564e793a0139

\??\c:\81448645c532e16a92cd\1031\LocalizedData.xml

MD5 b83c3803712e61811c438f6e98790369
SHA1 61a0bc59388786ced045acd82621bee8578cae5a
SHA256 2aa6e8d402e44d9ee895b18195f46bf90259de1b6f44efd46a7075b110f2dcd6
SHA512 e020f93e3a082476087e690ad051f1feb210e0915924bb4548cc9f53a7ee2760211890eb6036ce9e5e4a311abc0300e89e25efbbb894c2a621ffbc9d64cc8a38

\??\c:\81448645c532e16a92cd\1028\LocalizedData.xml

MD5 7fc06a77d9aafca9fb19fafa0f919100
SHA1 e565740e7d582cd73f8d3b12de2f4579ff18bb41
SHA256 a27f809211ea1a2d5224cd01101aa3a59bf7853168e45de28a16ef7ed6acd46a
SHA512 466dcc6a5fb015be1619f5725fa62ca46eb0fb428e11f93fd9d82e5df61c3950b3fb62d4db7746cc4a2be199e5e69eaa30b6f3354e0017cfa14d127fad52f8cf

\??\c:\81448645c532e16a92cd\1033\LocalizedData.xml

MD5 d642e322d1e8b739510ca540f8e779f9
SHA1 36279c76d9f34c09ebddc84fd33fcc7d4b9a896c
SHA256 5d90345ff74e177f6da8fb6459c1cfcac080e698215ca75feb130d0d1f2a76b9
SHA512 e1e16ae14bc7cc1608e1a08d3c92b6d0518b5fabd27f2c0eb514c87afc3d6192bf7a793a583afc65f1899f03dc419263b29174456e1ec9ab0f0110e0258e0f0d

\??\c:\81448645c532e16a92cd\1036\LocalizedData.xml

MD5 e382abc19294f779d2833287242e7bc6
SHA1 1ceae32d6b24a3832f9244f5791382865b668a72
SHA256 43f913ff28d677316f560a0f45221f35f27cfaf5fc5bd645974a82dca589edbf
SHA512 06054c8048cade36a3af54f9a07fd8fa5eb4f3228790996d2abea7ee1ee7eb563d46bd54ff97441f9610e778194082c44e66c5f566c9c50a042aba9eb9cae25e

\??\c:\81448645c532e16a92cd\1040\LocalizedData.xml

MD5 0af948fe4142e34092f9dd47a4b8c275
SHA1 b3d6dd5c126280398d9055f90e2c2c26dbae4eaa
SHA256 c4c7c0ddaa6d6a3a1dc260e9c5a24bdfaa98c427c69e8a65427dd7cac0a4b248
SHA512 d97b5fe2553ca78a3019d53e33d2db80c9fa1cf1d8d2501d9ddf0576c7e6ea38dab754fe4712123abf34b97e10b18fb4bbd1c76d3dacb87b4682e501f93423d9

\??\c:\81448645c532e16a92cd\1041\LocalizedData.xml

MD5 7fcfbc308b0c42dcbd8365ba62bada05
SHA1 18a0f0e89b36818c94de0ad795cc593d0e3e29a9
SHA256 01e7d24dd8e00b5c333e96d1bb83813e02e96f89aad0c2f28f84551d28abbbe2
SHA512 cd6f912a037e86d9e1982c73f0f8b3c4d5a9a6b5b108a7b89a46e6691e430a7cb55718de9a0c05650bb194c8d4a2e309ad6221d638cfca8e16aa5920881ba649

\??\c:\81448645c532e16a92cd\1042\LocalizedData.xml

MD5 71dfd70ae141f1d5c1366cb661b354b2
SHA1 c4b22590e6f6dd5d39e5158b831ae217ce17a776
SHA256 cccda55294aeb4af166a8c0449bca2189ddf5aa9a43d5e939dd3803e61738331
SHA512 5000d62f3de41c3fb0ed8a8e9c37dbf4eb427c4f1e3ad3823d4716c6fe62250bac11b7987a302b8a45d91aabcf332457f7aff7d99f15edeffe540639e9440e8a

\??\c:\81448645c532e16a92cd\1049\LocalizedData.xml

MD5 0eeb554d0b9f9fcdb22401e2532e9cd0
SHA1 08799520b72a1ef92ac5b94a33509d1eddf6caf8
SHA256 beef0631c17a4fb1ff0b625c50c6cb6c8ce90a1ae62c5e60e14bf3d915ad509c
SHA512 2180e46a5a2ea1f59c879b729806ca02a232c66660f29c338c1fa7fbee2afa4b13d8777d1f7b63cf831eb42f3e55282d70aa8e53f40616b8a6e4d695c36e313d

\??\c:\81448645c532e16a92cd\2052\LocalizedData.xml

MD5 52b1dc12ce4153aa759fb3bbe04d01fc
SHA1 bf21f8591c473d1fce68a9faf1e5942f486f6eba
SHA256 d1735c8cfd8e10ba019d70818c19fa865e7c72f30ab6421a3748408f85fb96c3
SHA512 418903ae9a7baebf73d055e4774ff1917fbaab9ee7ed8c120c34bb10e7303f6dd7b7dae701596d4626387a30ae1b4d329a9af49b8718b360e2ff619c56c19623

\??\c:\81448645c532e16a92cd\3082\LocalizedData.xml

MD5 5397a12d466d55d566b4209e0e4f92d3
SHA1 fcffd8961fb487995543fc173521fdf5df6e243b
SHA256 f124d318138ff084b6484deb354cca0f72296e1341bf01169792b3e060c89e89
SHA512 7708f5a2ad3e4c90c4c216600435af87a1557f60caf880a3dd9b5f482e17399af9f0b9de03ff1dbdd210583e0fec5b466e35794ac24d6d37f9bbc094e52fc77b

\??\c:\81448645c532e16a92cd\SetupUi.dll

MD5 0d214ced87bf0b55883359160a68dacb
SHA1 a60526505d56d447c6bbde03da980db67062c4c6
SHA256 29cf99d7e67b4c54bafd109577a385387a39301bcdec8ae4ba1a8a0044306713
SHA512 d9004ebd42d4aa7d13343b3746cf454ca1a5144f7b0f437f1a31639cc6bd90c5dd3385612df926bf53c3ef85cfe33756c067cb757fff257d674a10d638fc03c5

\??\c:\81448645c532e16a92cd\SetupUi.xsd

MD5 2fadd9e618eff8175f2a6e8b95c0cacc
SHA1 9ab1710a217d15b192188b19467932d947b0a4f8
SHA256 222211e8f512edf97d78bc93e1f271c922d5e91fa899e092b4a096776a704093
SHA512 a3a934a8572ff9208d38cf381649bd83de227c44b735489fd2a9dc5a636ead9bb62459c9460ee53f61f0587a494877cd3a3c2611997be563f3137f8236ffc4ca

C:\81448645c532e16a92cd\1033\SetupResources.dll

MD5 0b4e76baf52d580f657f91972196cd91
SHA1 e6ac8f80ab8ade18ac7e834ac6d0536bb483988c
SHA256 74a7767d8893dcc1a745522d5a509561162f95bc9e8bcc3056f37a367dba64a4
SHA512 ed53292c549d09da9118e944a646aa5dc0a6231811eafcda4258c892b218bcf3e0363a2c974868d2d2722155983c5dc8e29bed36d58e566e1695e23ce07fea87

\??\c:\81448645c532e16a92cd\Strings.xml

MD5 332adf643747297b9bfa9527eaefe084
SHA1 670f933d778eca39938a515a39106551185205e9
SHA256 e49545feeae22198728ad04236e31e02035af7cc4d68e10cbecffd08669cbeca
SHA512 bea95ce35c4c37b4b2e36cc1e81fc297cc4a8e17b93f10423a02b015ddb593064541b5eb7003560fbeee512ed52869a113a6fb439c1133af01f884a0db0344b0

\??\c:\81448645c532e16a92cd\graphics\setup.ico

MD5 3d25d679e0ff0b8c94273dcd8b07049d
SHA1 a517fc5e96bc68a02a44093673ee7e076ad57308
SHA256 288e9ad8f0201e45bc187839f15aca79d6b9f76a7d3c9274c80f5d4a4c219c0f
SHA512 3bde668004ca7e28390862d0ae9903c756c16255bdbb3f7e73a5b093ce6a57a3165d6797b0a643b254493149231aca7f7f03e0af15a0cbe28aff02f0071ec255

\??\c:\81448645c532e16a92cd\graphics\save.ico

MD5 7d62e82d960a938c98da02b1d5201bd5
SHA1 194e96b0440bf8631887e5e9d3cc485f8e90fbf5
SHA256 ae041c8764f56fd89277b34982145d16fc59a4754d261c861b19371c3271c6e5
SHA512 ab06b2605f0c1f6b71ef69563c0c977d06c6ea84d58ef7f2baecba566d6037d1458c2b58e6bfd70ddef47dccbdea6d9c2f2e46dea67ea9e92457f754d7042f67

\??\c:\81448645c532e16a92cd\graphics\print.ico

MD5 7e55ddc6d611176e697d01c90a1212cf
SHA1 e2620da05b8e4e2360da579a7be32c1b225deb1b
SHA256 ff542e32330b123486797b410621e19eafb39df3997e14701afa4c22096520ed
SHA512 283d381aa396820b7e15768b20099d67688da1f6315ec9f7938c2fcc3167777502cded0d1beddf015a34cc4e5d045bcb665ffd28ba2fbb6faf50fdd38b31d16e

\??\c:\81448645c532e16a92cd\header.bmp

MD5 3ad1a8c3b96993bcdf45244be2c00eef
SHA1 308f98e199f74a43d325115a8e7072d5f2c6202d
SHA256 133b86a4f1c67a159167489fdaeab765bfa1050c23a7ae6d5c517188fb45f94a
SHA512 133442c4a65269f817675adf01adcf622e509aa7ec7583bca8cd9a7eb6018d2aab56066054f75657038efb947cd3b3e5dc4fe7f0863c8b3b1770a8fa4fe2e658

\??\c:\81448645c532e16a92cd\watermark.bmp

MD5 1a5caafacfc8c7766e404d019249cf67
SHA1 35d4878db63059a0f25899f4be00b41f430389bf
SHA256 2e87d5742413254db10f7bd0762b6cdb98ff9c46ca9acddfd9b1c2e5418638f2
SHA512 202c13ded002d234117f08b18ca80d603246e6a166e18ba422e30d394ada7e47153dd3cce9728affe97128fdd797fe6302c74dc6882317e2ba254c8a6db80f46

memory/2668-107-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

\??\c:\81448645c532e16a92cd\graphics\SysReqMet.ico

MD5 661cbd315e9b23ba1ca19edab978f478
SHA1 605685c25d486c89f872296583e1dc2f20465a2b
SHA256 8bfc77c6d0f27f3d0625a884e0714698acc0094a92adcb6de46990735ae8f14d
SHA512 802cc019f07fd3b78fcefdc8404b3beb5d17bfc31bded90d42325a138762cc9f9ebfd1b170ec4bbcccf9b99773bd6c8916f2c799c54b22ff6d5edd9f388a67c6

\??\c:\81448645c532e16a92cd\graphics\SysReqNotMet.ico

MD5 ee2c05cc9d14c29f586d40eb90c610a9
SHA1 e571d82e81bd61b8fe4c9ecd08869a07918ac00b
SHA256 3c9c71950857ddb82baab83ed70c496dee8f20f3bc3216583dc1ddda68aefc73
SHA512 0f38fe9c97f2518186d5147d2c4a786b352fceca234410a94cc9d120974fc4be873e39956e10374da6e8e546aea5689e7fa0beed025687547c430e6ceffabffb

\??\c:\81448645c532e16a92cd\graphics\Rotate4.ico

MD5 bb55b5086a9da3097fb216c065d15709
SHA1 1206c708bd08231961f17da3d604a8956addccfe
SHA256 8d82ff7970c9a67da8134686560fe3a6c986a160ced9d1cc1392f2ba75c698ab
SHA512 de9226064680da6696976a4a320e08c41f73d127fbb81bf142048996df6206ddb1c2fe347c483cc8e0e50a00dab33db9261d03f1cd7ca757f5ca7bb84865fca9

\??\c:\81448645c532e16a92cd\graphics\Rotate2.ico

MD5 8419caa81f2377e09b7f2f6218e505ae
SHA1 2cf5ad8c8da4f1a38aab433673f4dddc7ae380e9
SHA256 db89d8a45c369303c04988322b2774d2c7888da5250b4dab2846deef58a7de22
SHA512 74e504d2c3a8e82925110b7cfb45fde8a4e6df53a188e47cf22d664cbb805eba749d2db23456fc43a86e57c810bc3d9166e7c72468fbd736da6a776f8ca015d1

\??\c:\81448645c532e16a92cd\graphics\Rotate3.ico

MD5 924fd539523541d42dad43290e6c0db5
SHA1 19a161531a2c9dbc443b0f41b97cbde7375b8983
SHA256 02a7fe932029c6fa24d1c7cc06d08a27e84f43a0cbc47b7c43cac59424b3d1f6
SHA512 86a4c5d981370efa20183cc4a52c221467692e91539ac38c8def1cc200140f6f3d9412b6e62faf08ca6668df401d8b842c61b1f3c2a4c4570f3b2cec79c9ee8b

\??\c:\81448645c532e16a92cd\graphics\Rotate8.ico

MD5 d1c53003264dce4effaf462c807e2d96
SHA1 92562ad5876a5d0cb35e2d6736b635cb5f5a91d9
SHA256 5fb03593071a99c7b3803fe8424520b8b548b031d02f2a86e8f5412ac519723c
SHA512 c34f8c05a50dc0de644d1f9d97696cdb0a1961c7c7e412eb3df2fd57bbd34199cf802962ca6a4b5445a317d9c7875e86e8e62f6c1df8cc3415afc0bd26e285bd

\??\c:\81448645c532e16a92cd\graphics\Rotate7.ico

MD5 fb4dfebe83f554faf1a5cec033a804d9
SHA1 6c9e509a5d1d1b8d495bbc8f57387e1e7e193333
SHA256 4f46a9896de23a92d2b5f963bcfb3237c3e85da05b8f7660641b3d1d5afaae6f
SHA512 3caeb21177685b9054b64dec997371c4193458ff8607bce67e4fbe72c4af0e6808d344dd0d59d3d0f5ce00e4c2b8a4ffca0f7d9352b0014b9259d76d7f03d404

\??\c:\81448645c532e16a92cd\graphics\Rotate6.ico

MD5 70006bf18a39d258012875aefb92a3d1
SHA1 b47788f3f8c5c305982eb1d0e91c675ee02c7beb
SHA256 19abcedf93d790e19fb3379cb3b46371d3cbff48fe7e63f4fdcc2ac23a9943e4
SHA512 97fdbdd6efadbfb08161d8546299952470228a042bd2090cd49896bc31ccb7c73dab8f9de50cdaf6459f7f5c14206af7b90016deeb1220943d61c7324541fe2c

\??\c:\81448645c532e16a92cd\graphics\Rotate5.ico

MD5 3b4861f93b465d724c60670b64fccfcf
SHA1 c672d63c62e00e24fbb40da96a0cc45b7c5ef7f0
SHA256 7237051d9af5db972a1fecf0b35cd8e9021471740782b0dbf60d3801dc9f5f75
SHA512 2e798b0c9e80f639571525f39c2f50838d5244eeda29b18a1fae6c15d939d5c8cd29f6785d234b54bda843a645d1a95c7339707991a81946b51f7e8d5ed40d2c

\??\c:\81448645c532e16a92cd\graphics\Rotate1.ico

MD5 26a00597735c5f504cf8b3e7e9a7a4c1
SHA1 d913cb26128d5ca1e1ac3dab782de363c9b89934
SHA256 37026c4ea2182d7908b3cf0cef8a6f72bddca5f1cfbc702f35b569ad689cf0af
SHA512 08cefc5a2b625f261668f70cc9e1536dc4878d332792c751884526e49e7fee1ecfa6fccfddf7be80910393421cc088c0fd0b0c27c7a7eff2ae03719e06022fdf

\??\c:\81448645c532e16a92cd\vc_red.cab

MD5 c580a38f1a1a7d838076a1b897c37011
SHA1 c689488077d1c21820797707078af826ea676b70
SHA256 71c0acc75eecdf39051819dc7c26503583f6be6c43ab2c320853de15bece9978
SHA512 ea3a62bd312f1ddeebe5e3c7911eb3a73bc3ee184abb7e9b55bc962214f50bbf05d2499caf151d0bd00735e2021fbea9584bf3e868a1d4502b75ec3b62c7ff56

\??\c:\81448645c532e16a92cd\vc_red.msi

MD5 3ff9acea77afc124be8454269bb7143f
SHA1 8dd6ecab8576245cd6c8617c24e019325a3b2bdc
SHA256 9ecf3980b29c6aa20067f9f45c64b45ad310a3d83606cd9667895ad35f106e66
SHA512 8d51f692747cfdd59fc839918a34d2b6cbbb510c90dea83ba936b3f5f39ee4cbd48f6bb7e35ed9e0945bf724d682812532191d91c8f3c2adb6ff80a8df89ff7a

\??\c:\81448645c532e16a92cd\msp_kb2565063.msp

MD5 9843dc93ea948cddc1f480e53bb80c2f
SHA1 d6ec9db8b8802ec85dd0b793565401b67ad8e5e0
SHA256 7c969fcda6ef09d2eb7bbbc8d81795eb60c9c69ed835fd16538369ad0a6e0f10
SHA512 79008cfdd8ae1ea27675588e7ba8123d08ce14047e5f167b3b5f6fbcdadeb45515bd72e18e59abf632ecbfbb42243fbcbebe4cbe0ed6ba195d0b2ca6d88676f9