Malware Analysis Report

2025-04-14 08:02

Sample ID 250319-sq9n7a1rz6
Target abc.msi
SHA256 7da1254753f2520d733f7dc27a5bbd7fca239953154e1eb8abf1c9981ceacc31
Tags
hijackloader collection discovery persistence privilege_escalation spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7da1254753f2520d733f7dc27a5bbd7fca239953154e1eb8abf1c9981ceacc31

Threat Level: Known bad

The file abc.msi was found to be: Known bad.

Malicious Activity Summary

hijackloader collection discovery persistence privilege_escalation spyware stealer

Hijackloader family

Reads WinSCP keys stored on the system

Enumerates connected drives

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Loads dropped DLL

Executes dropped EXE

System Location Discovery: System Language Discovery

Browser Information Discovery

Reads user/profile data of web browsers

Event Triggered Execution: Installer Packages

outlook_office_path

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-19 15:21

Signatures

Hijackloader family

hijackloader

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-19 15:20

Reported

2025-03-19 15:28

Platform

win7-20240903-en

Max time kernel

119s

Max time network

120s

Command Line

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\abc.msi

Signatures

Reads WinSCP keys stored on the system

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Launchdemo_1.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2508 set thread context of 2084 N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe C:\Windows\SysWOW64\ftp.exe
PID 2084 set thread context of 2164 N/A C:\Windows\SysWOW64\ftp.exe C:\Users\Admin\AppData\Local\Temp\Launchdemo_1.exe

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Launchdemo_1.exe N/A

Browser Information Discovery

discovery

Event Triggered Execution: Installer Packages

persistence privilege_escalation
Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A

Reads user/profile data of web browsers

spyware stealer

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ftp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2756 wrote to memory of 2684 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2756 wrote to memory of 2684 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2756 wrote to memory of 2684 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2756 wrote to memory of 2684 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2756 wrote to memory of 2684 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2756 wrote to memory of 2684 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2756 wrote to memory of 2684 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2684 wrote to memory of 3012 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 3012 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 3012 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 3012 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 1028 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 1028 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 1028 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 1028 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 2196 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 2196 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 2196 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 2196 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 2204 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 2204 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 2204 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 2204 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 904 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 904 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 904 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 904 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 868 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 868 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 868 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 868 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 3048 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 3048 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 3048 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 3048 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 2784 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 2784 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 2784 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 2784 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 2856 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 2856 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 2856 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 2856 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 1132 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 1132 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 1132 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 1132 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe
PID 2684 wrote to memory of 768 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe
PID 2684 wrote to memory of 768 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe
PID 2684 wrote to memory of 768 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe
PID 2684 wrote to memory of 768 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe
PID 768 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe
PID 768 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe
PID 768 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe
PID 768 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe
PID 2508 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe C:\Windows\SysWOW64\ftp.exe
PID 2508 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe C:\Windows\SysWOW64\ftp.exe
PID 2508 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe C:\Windows\SysWOW64\ftp.exe
PID 2508 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe C:\Windows\SysWOW64\ftp.exe
PID 2508 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe C:\Windows\SysWOW64\ftp.exe
PID 2084 wrote to memory of 2164 N/A C:\Windows\SysWOW64\ftp.exe C:\Users\Admin\AppData\Local\Temp\Launchdemo_1.exe
PID 2084 wrote to memory of 2164 N/A C:\Windows\SysWOW64\ftp.exe C:\Users\Admin\AppData\Local\Temp\Launchdemo_1.exe
PID 2084 wrote to memory of 2164 N/A C:\Windows\SysWOW64\ftp.exe C:\Users\Admin\AppData\Local\Temp\Launchdemo_1.exe
PID 2084 wrote to memory of 2164 N/A C:\Windows\SysWOW64\ftp.exe C:\Users\Admin\AppData\Local\Temp\Launchdemo_1.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Launchdemo_1.exe N/A

Processes

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\abc.msi

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding AD85B149F8525EC11733B2D0DD22DF81 C

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EFAC5112-40EE-4605-8EA0-149BA976414A}

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A303A8ED-4C46-40EB-A172-AAECC6270A7E}

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{770CAB30-0193-47A8-A638-D4AB985333C6}

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F5D250EA-C18C-4601-9631-1DE9959BFF53}

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6D96ACF8-15F4-4885-B66D-33A1C9AF5D0B}

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3F661410-FD2C-4936-8FBC-015B2D114875}

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{41B825AE-7DC2-4377-A5BF-41769BA8DCF5}

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6E817519-E1D0-4880-9686-58B10C0451BA}

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CE720E48-1A70-401B-BB9F-B36B059C989D}

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{38E3B2C5-808C-46B9-8EEC-901133037BAD}

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe

C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe

C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Users\Admin\AppData\Local\Temp\Launchdemo_1.exe

C:\Users\Admin\AppData\Local\Temp\Launchdemo_1.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 tastedata.shop udp
US 172.67.146.161:443 tastedata.shop tcp

Files

C:\Users\Admin\AppData\Local\Temp\MSI122A.tmp

MD5 a0e940a3d3c1523416675125e3b0c07e
SHA1 2e29eeba6da9a4023bc8071158feee3b0277fd1b
SHA256 b8fa7aa425e4084ea3721780a13d11e08b8d53d1c5414b73f22faeca1bfd314f
SHA512 736ea06824388372aeef1938c6b11e66f4595e0b0589d7b4a87ff4abbabe52e82dff64d916293eab47aa869cf372ced2c66755dd8a8471b2ab0d3a37ba91d0b2

C:\Users\Admin\AppData\Local\Temp\MSI13EF.tmp

MD5 ecb71be9e3f9a02edc1cad3cde1276ed
SHA1 15e9554b2aaf6613f64732352a6b62c3ec999206
SHA256 d549e6a37d39aa08c3a2718691d3c7589dba5f68036ab961d0b076627595dbb8
SHA512 4be026ba0f51cdf93910a535a0a6b22a32877ab13f6b061fb5772c238baf40864d3c9ad2c23b06de31b418941a746c0dcef631013a6a32beab88692d0aeac1d8

\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISBEW64.exe

MD5 40f3a092744e46f3531a40b917cca81e
SHA1 c73f62a44cb3a75933cecf1be73a48d0d623039b
SHA256 561f14cdece85b38617403e1c525ff0b1b752303797894607a4615d0bd66f97f
SHA512 1589b27db29051c772e5ba56953d9f798efbf74d75e0524fa8569df092d28960972779811a7916198d0707d35b1093d3e0dd7669a8179c412cfa7df7120733b2

memory/2684-54-0x0000000010000000-0x0000000010114000-memory.dmp

\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\ISRT.dll

MD5 8af02bf8e358e11caec4f2e7884b43cc
SHA1 16badc6c610eeb08de121ab268093dd36b56bf27
SHA256 58a724d23c63387a2dda27ccfdbc8ca87fd4db671bea8bb636247667f6a5a11e
SHA512 d0228a8cc93ff6647c2f4ba645fa224dc9d114e2adb5b5d01670b6dafc2258b5b1be11629868748e77b346e291974325e8e8e1192042d7c04a35fc727ad4e3fd

\Users\Admin\AppData\Local\Temp\{1CAE894E-7ACB-4241-BB7A-F2B4839EC4A2}\_isres_0x0409.dll

MD5 7de024bc275f9cdeaf66a865e6fd8e58
SHA1 5086e4a26f9b80699ea8d9f2a33cead28a1819c0
SHA256 bd32468ee7e8885323f22eabbff9763a0f6ffef3cc151e0bd0481df5888f4152
SHA512 191c57e22ea13d13806dd390c4039029d40c7532918618d185d8a627aabc3969c7af2e532e3c933bde8f652b4723d951bf712e9ba0cc0d172dde693012f5ef1a

memory/2684-57-0x0000000002E30000-0x0000000002FF7000-memory.dmp

\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe

MD5 597385a4d031b1ce29eb149e109d2056
SHA1 136786b1af5b7ea14f39d917c2854382dc90d48d
SHA256 9ffe2ee8c28ecd306328d61092cca5270c2c6f73b37c75d51c4f83d56bf02f56
SHA512 1fe6a85dc2332bffac5e25dc8a02c5e5ed084954ae50e747951489209a8027f39b3179d9b2912f11a382eeb4c4f309a66fa893db0e5e9e4aeb36d02e8418fe21

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\MSVCP140.dll

MD5 1d8c79f293ca86e8857149fb4efe4452
SHA1 7474e7a5cb9c79c4b99fdf9fb50ef3011bef7e8f
SHA256 c09b126e7d4c1e6efb3ffcda2358252ce37383572c78e56ca97497a7f7c793e4
SHA512 83c4d842d4b07ba5cec559b6cd1c22ab8201941a667e7b173c405d2fc8862f7e5d9703e14bd7a1babd75165c30e1a2c95f9d1648f318340ea5e2b145d54919b1

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\VCRUNTIME140.dll

MD5 b77eeaeaf5f8493189b89852f3a7a712
SHA1 c40cf51c2eadb070a570b969b0525dc3fb684339
SHA256 b7c13f8519340257ba6ae3129afce961f137e394dde3e4e41971b9f912355f5e
SHA512 a09a1b60c9605969a30f99d3f6215d4bf923759b4057ba0a5375559234f17d47555a84268e340ffc9ad07e03d11f40dd1f3fb5da108d11eb7f7933b7d87f2de3

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayerStatistic.dll

MD5 383267627150fb4ae75d7a2b7d19a671
SHA1 cc46021b1331a9756c82501e68b238c454a3d9e9
SHA256 6877d61fa6813a94bb52b798fca5a9cf413a8b7931bed93169bedab22db73e92
SHA512 f2bc1c16919342d5528e3a0b195187366e22a5be268fb74db072f1dbbebd813031136fb568a49316029c05c7a11f4e4437ac6d6e0c7d959eb71da59e364f9c2f

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\Common.dll

MD5 db7f889a32083695ad19c0328f31503f
SHA1 d75d249716fd75623167c8d04ee68d2ab4a47148
SHA256 e3786ceef2b7207512140843702a2782f0c8351c486fda4c89081430c2980f55
SHA512 38bb16ef68e09d6a86b567ebc3c23f07152bbf1e5dadc7b27c6fff6fcfb9250ef23b364ea1171ba891b2dd7f97a740a592962856bcad0807698faabc05ceddfd

\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\zlib.dll

MD5 5953ee89e5c1777f389bc6f571021110
SHA1 ccd673eb9ef3f5dd7d71afd7aeaf1297e198fbcd
SHA256 aedaae71c32fde725c894e68b6cdce302c9564b9fac08656d66e0be883dca93b
SHA512 89d271f9f6092d8cfe88b698f9c6359149c0666e849b1d7df94300535b9df67e46e1212ad33c124970cb42bdfbd101bd2b6e262fdc125ccee70159c0b0d62616

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\MSVCR100.dll

MD5 26b2d9c49e69a59bea22558525f3d643
SHA1 b32a7c2413b6f4652b8822d6b08a581f7b9120b5
SHA256 092b59a6c1c778ecf56ce7219b103b0a547a14fe3bd94abdd7fdc0c894b31e8f
SHA512 d50cbd211d945576e2d8f87391f39dd30744ee6f6c940a2f1768c4e9bb3f6e90b443409414e97ca0957596922ebd4f865cf1f3384cdde96ba585461e80fb0aae

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\libexpat.dll

MD5 e92990c951fdf5adf27348c42ee4fd87
SHA1 cdf27bb4b12e2306e3144cc9355e8a1e4ab2611b
SHA256 d5c80d353fa48fe010f0652cd92c571dacded2f8321c83210a37a633f3ea8172
SHA512 0404b7598ef6db80cfee7df83bca2a16aff825e6a7a05ed11698fa745ddeb1f582306a113055cbe296fc17a9d68ec1a422b641166ba422d070f11d65310dd952

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\tinyxml.dll

MD5 19f1ed1a772ea201af1e986df1e109c1
SHA1 d660df3e089edf616b44812fede39c3d62ad446c
SHA256 7dff6b0e5686076247d1d62854b0475d909056078cbfd44326b94f835bac8870
SHA512 525ea43fd1d85b73ac4404949214f09b1cfc516b7e898749ef7d73a5e209299e2e2d99f52260fbe1c254201b4350d78e5e17060cba13e9a5cc17c3333759ad0b

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\AsyncTask.dll

MD5 8ad07f53e87fcc18d62bd016ae18607d
SHA1 5dc05a1760c0c5530b7026192a103f8b6b71d987
SHA256 10ad2b5cee7cf2be73c8b5e33db376bf51af570e7365f7f8681670f8410f5883
SHA512 23118817c41c3c3123067a3b151939992d2c5548a8e7ddcacf2fef52cdd18e8f308a9ff796d8270a13ab1c383fb89bd97502451b515ef6a3244ba95ea6ae2ee5

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\arkFS.dll

MD5 c3207d5d8b4df7a13b678fca4c34f324
SHA1 0ad8d445eef3e224650fb299e834901d25c50685
SHA256 74ea46fc311a23b0c40d97306abc5cab49ace283052f595d0bc9a80f97ac1a12
SHA512 60033aebe094b04bbdf83ada96c346073746a2973b983a79f2135be601ed37f7e931ab49f80116647eb0f11912b0e8853616f18a2af95a2c747f69729fd5f8cb

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\arkIOStub.dll

MD5 e6f65df00571bfdbea3f32773bb2de8b
SHA1 f2574a80c5f3e047f0c1a48520ae37da62c8b80c
SHA256 7a4b53fb08494c424070e7dfdfe52b801179f930adae374459f074ca6bd99e19
SHA512 0f363869b0d214c80df335f05ef2a8b506bdcdd613a124f21492e7f9ad602dd7881f6ca16bf3ff8b04c45c7d94f361310b7978705f5c75c22826a142dd86c332

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\sqlite.dll

MD5 6b2b8821b446ebd13ea195fc111be8b9
SHA1 e0848937c03c85ff7ed4eba6f5b185f7691b8276
SHA256 16d1c6b627e36b3fa8ce3b69c9a3a9792aa0fc03f71beaaf6808958da7206dc9
SHA512 66b62d1a5994df5bc2d2c9f35f1f3b983ab44949fcdbe50b61638ce94f12d07c486769860ca5cf0a51f69d8967e8e20acd8168cfdbce1ae41a1172b6f03e26e0

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\LIBEAY32.dll

MD5 e709374bfc5d26439a4b626520d2dbbb
SHA1 4f0243611cfece832b086c2ed7ad2675ce11a203
SHA256 7cee2f68fa47f8f1657e9f5238b203b4966bd20cb3b506cb69c5da645a1cffde
SHA512 c0b55df21c615cea386825de0331325fbf2a1f0f78001d16ca30856c383427aec537edacff652e1b4bcc9e2b636b0d14505cedcfd6fa4c66ee3db7e4dfe12ff3

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayerBase.dll

MD5 fd0d21afaa1112d34f2317ffd17431c6
SHA1 eec4b2316a70dd75a6ce87369ac32542d6207503
SHA256 d0fec47c045e08635d0ae5459cae2ce6a4a9f75a38d0aa44c8afd4478c7f9a44
SHA512 6c11b8357bf4dfbb3c4887789434a4055ed9b7408fb6e85594784288df3c72c21a54f78da9d72e56ec89bf82671ae77d83d265f1021d53a557ec1c40435955cc

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\LogManager.DLL

MD5 02dddbe5c5305916b0d09566011d5c50
SHA1 f73b072c0074726f6fc0f2ca8a9b8bdd3881b9f5
SHA256 d25cb56b0090a015e4c759f44766a411203c01c3e76f02e5ad2b257954fd4e5f
SHA512 273d69422bd7095846a8f0cea596066a4c872987dd8ccac4806dac830b16ec02d98e3fa45fdd1f4ee76025d4a338cdc467ba1dde6758107008d735dd85030f20

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayerCommon.DLL

MD5 4913889ebb2912c097887d1e19b257f7
SHA1 df1df63abc1ccfd372b0db117d202ca414cd90a1
SHA256 4e3c712a87bb8e39127f7d113f05f45ad88cee974fe72176118eb0fbdf3d89cd
SHA512 f78247a19d703a7bd3704f1765b2c813903abfa747eca02ff7f23faa2ac3b4c4faa94540e1c77632db4a3f1085b2cbd81cf4ab963e2a80c2ae308024015a5275

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QLCommon.dll

MD5 8f3ffde27110d14e7e691e4f68d6154f
SHA1 cb880924c20523ebfbd14bac45e731d5dfc7ced0
SHA256 6005266d708e7a6a4a3b744a53a533b544f090b1714accb85746fb4c9bde967e
SHA512 300b81e225adc87c7ab475f76009d522ee82aef7a8147c207f7ea9d14a96499d763dffa3fe19f1ed7338cf68bb8b010a2733ac3b1030e17c5b038e252cb46f35

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\libcurl.dll

MD5 9c7232e92a2936844d753239233246cd
SHA1 89ed97229795281b5843686a70a1661b0aecdde7
SHA256 7de31f5ace824ea7dd845b71a6eedb921a04ded24bd4172d21d849879de17129
SHA512 03fc1c4e5a17eca99c76fc899df140e65984da7317d727cbe966a8df7ad83253192a647a55fce57795bdc27231ea1cf03252dd16ff7d5280e129c4a7bab777be

memory/768-118-0x0000000077210000-0x00000000773B9000-memory.dmp

memory/2508-161-0x0000000077210000-0x00000000773B9000-memory.dmp

memory/2084-163-0x0000000077210000-0x00000000773B9000-memory.dmp

memory/2084-166-0x0000000073AC0000-0x0000000073C34000-memory.dmp

memory/2164-170-0x0000000000160000-0x000000000047D000-memory.dmp

memory/2164-171-0x0000000000160000-0x000000000047D000-memory.dmp

memory/2164-174-0x0000000000160000-0x000000000047D000-memory.dmp

memory/2164-175-0x0000000000160000-0x000000000047D000-memory.dmp

memory/2164-176-0x0000000000160000-0x000000000047D000-memory.dmp

memory/2164-184-0x0000000000160000-0x000000000047D000-memory.dmp

memory/2164-185-0x0000000000160000-0x000000000047D000-memory.dmp

memory/2164-191-0x0000000000160000-0x000000000047D000-memory.dmp

memory/2164-192-0x0000000000160000-0x000000000047D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-19 15:20

Reported

2025-03-19 15:28

Platform

win10v2004-20250314-en

Max time kernel

160s

Max time network

214s

Command Line

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\abc.msi

Signatures

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3048 set thread context of 3440 N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe C:\Windows\SysWOW64\ftp.exe
PID 3440 set thread context of 1936 N/A C:\Windows\SysWOW64\ftp.exe C:\Users\Admin\AppData\Local\Temp\Launchdemo_1.exe

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Launchdemo_1.exe N/A

Event Triggered Execution: Installer Packages

persistence privilege_escalation
Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ftp.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2108 wrote to memory of 2808 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2108 wrote to memory of 2808 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2108 wrote to memory of 2808 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2808 wrote to memory of 2884 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 2884 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 1476 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 1476 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 600 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 600 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 1716 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 1716 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 1208 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 1208 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 2224 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 2224 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 556 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 556 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 4100 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 4100 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 3988 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 3988 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 3448 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 3448 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe
PID 2808 wrote to memory of 680 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe
PID 2808 wrote to memory of 680 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe
PID 2808 wrote to memory of 680 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe
PID 680 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe
PID 680 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe
PID 680 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe
PID 3048 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe C:\Windows\SysWOW64\ftp.exe
PID 3048 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe C:\Windows\SysWOW64\ftp.exe
PID 3048 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe C:\Windows\SysWOW64\ftp.exe
PID 3048 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe C:\Windows\SysWOW64\ftp.exe
PID 3440 wrote to memory of 1936 N/A C:\Windows\SysWOW64\ftp.exe C:\Users\Admin\AppData\Local\Temp\Launchdemo_1.exe
PID 3440 wrote to memory of 1936 N/A C:\Windows\SysWOW64\ftp.exe C:\Users\Admin\AppData\Local\Temp\Launchdemo_1.exe

Processes

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\abc.msi

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 9B68D53279C6070F0D02273DBC11BAA5 C

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{23244568-57FA-4F34-9416-05018B45CF4D}

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9BD89B67-12F6-42DC-85AE-6DD10291E304}

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C1AE6AEA-D946-4CD4-B0C6-13CA7FC9D186}

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FD954437-2033-4832-AACA-6F392DFD9EA3}

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1BC8325C-6A6D-46AA-B6BE-DE265395FA94}

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6538DDC9-9410-4FED-8AA3-D2DA6B8D9558}

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{45B06F98-193D-478D-A627-DA73C78D90A8}

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{21F287EF-B8A2-4E23-9270-2FB8950FA734}

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{71F9A95E-C802-47DE-8967-E8BE9ACBF674}

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{798F4FE9-C63B-4246-9897-2476E64E044E}

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayer.exe

C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe

C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Users\Admin\AppData\Local\Temp\Launchdemo_1.exe

C:\Users\Admin\AppData\Local\Temp\Launchdemo_1.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.180.3:80 c.pki.goog tcp
US 8.8.8.8:53 tastedata.shop udp
US 104.21.73.174:443 tastedata.shop tcp

Files

C:\Users\Admin\AppData\Local\Temp\MSI789B.tmp

MD5 a0e940a3d3c1523416675125e3b0c07e
SHA1 2e29eeba6da9a4023bc8071158feee3b0277fd1b
SHA256 b8fa7aa425e4084ea3721780a13d11e08b8d53d1c5414b73f22faeca1bfd314f
SHA512 736ea06824388372aeef1938c6b11e66f4595e0b0589d7b4a87ff4abbabe52e82dff64d916293eab47aa869cf372ced2c66755dd8a8471b2ab0d3a37ba91d0b2

C:\Users\Admin\AppData\Local\Temp\MSI7CA3.tmp

MD5 ecb71be9e3f9a02edc1cad3cde1276ed
SHA1 15e9554b2aaf6613f64732352a6b62c3ec999206
SHA256 d549e6a37d39aa08c3a2718691d3c7589dba5f68036ab961d0b076627595dbb8
SHA512 4be026ba0f51cdf93910a535a0a6b22a32877ab13f6b061fb5772c238baf40864d3c9ad2c23b06de31b418941a746c0dcef631013a6a32beab88692d0aeac1d8

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISBEW64.exe

MD5 40f3a092744e46f3531a40b917cca81e
SHA1 c73f62a44cb3a75933cecf1be73a48d0d623039b
SHA256 561f14cdece85b38617403e1c525ff0b1b752303797894607a4615d0bd66f97f
SHA512 1589b27db29051c772e5ba56953d9f798efbf74d75e0524fa8569df092d28960972779811a7916198d0707d35b1093d3e0dd7669a8179c412cfa7df7120733b2

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\ISRT.dll

MD5 8af02bf8e358e11caec4f2e7884b43cc
SHA1 16badc6c610eeb08de121ab268093dd36b56bf27
SHA256 58a724d23c63387a2dda27ccfdbc8ca87fd4db671bea8bb636247667f6a5a11e
SHA512 d0228a8cc93ff6647c2f4ba645fa224dc9d114e2adb5b5d01670b6dafc2258b5b1be11629868748e77b346e291974325e8e8e1192042d7c04a35fc727ad4e3fd

memory/2808-50-0x0000000010000000-0x0000000010114000-memory.dmp

memory/3048-152-0x00007FFEE79B0000-0x00007FFEE7BA5000-memory.dmp

C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayerStatistic.dll

MD5 383267627150fb4ae75d7a2b7d19a671
SHA1 cc46021b1331a9756c82501e68b238c454a3d9e9
SHA256 6877d61fa6813a94bb52b798fca5a9cf413a8b7931bed93169bedab22db73e92
SHA512 f2bc1c16919342d5528e3a0b195187366e22a5be268fb74db072f1dbbebd813031136fb568a49316029c05c7a11f4e4437ac6d6e0c7d959eb71da59e364f9c2f

C:\Users\Admin\AppData\Roaming\checkFast_beta\MSVCP140.dll

MD5 1d8c79f293ca86e8857149fb4efe4452
SHA1 7474e7a5cb9c79c4b99fdf9fb50ef3011bef7e8f
SHA256 c09b126e7d4c1e6efb3ffcda2358252ce37383572c78e56ca97497a7f7c793e4
SHA512 83c4d842d4b07ba5cec559b6cd1c22ab8201941a667e7b173c405d2fc8862f7e5d9703e14bd7a1babd75165c30e1a2c95f9d1648f318340ea5e2b145d54919b1

C:\Users\Admin\AppData\Roaming\checkFast_beta\QQPlayer.exe

MD5 597385a4d031b1ce29eb149e109d2056
SHA1 136786b1af5b7ea14f39d917c2854382dc90d48d
SHA256 9ffe2ee8c28ecd306328d61092cca5270c2c6f73b37c75d51c4f83d56bf02f56
SHA512 1fe6a85dc2332bffac5e25dc8a02c5e5ed084954ae50e747951489209a8027f39b3179d9b2912f11a382eeb4c4f309a66fa893db0e5e9e4aeb36d02e8418fe21

memory/680-116-0x00007FFEE79B0000-0x00007FFEE7BA5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\cerebrotonia.xls

MD5 47108597e72b9b2abbec640bd108bcd4
SHA1 db5d29711e32ba68e722c0f60ffa6973027341b5
SHA256 92f94b1ccfaca419cbfd8f33974446739aaa544f7d5048897ef38a73561614ee
SHA512 4c6c08d9742a15e3b991d7f49409455adcd2d79c1cfb6e37b70cf1b1f4b8930f18800435a73a33847e2fb54678ca6a7a3d1ccf61490331aa549e7aba6f5df974

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\campo.wav

MD5 9b88e10a397edc32d62c8356c71df06c
SHA1 040918e165aecf193ece364d3215f6b8c63478a4
SHA256 b6135d3d9a66e39ba10cc381d833b0ff5bfb66b29d9a195fcc0fae0e9f145f9d
SHA512 d4d6345f3e793dc637817926d86244bf5fd3c0b0de2a32da67720cbcd8ea321a4b96b0fb92f01414c463ef22c596d07799aa9e153f10df8951f524011b276585

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\sqlite.dll

MD5 6b2b8821b446ebd13ea195fc111be8b9
SHA1 e0848937c03c85ff7ed4eba6f5b185f7691b8276
SHA256 16d1c6b627e36b3fa8ce3b69c9a3a9792aa0fc03f71beaaf6808958da7206dc9
SHA512 66b62d1a5994df5bc2d2c9f35f1f3b983ab44949fcdbe50b61638ce94f12d07c486769860ca5cf0a51f69d8967e8e20acd8168cfdbce1ae41a1172b6f03e26e0

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\arkIOStub.dll

MD5 e6f65df00571bfdbea3f32773bb2de8b
SHA1 f2574a80c5f3e047f0c1a48520ae37da62c8b80c
SHA256 7a4b53fb08494c424070e7dfdfe52b801179f930adae374459f074ca6bd99e19
SHA512 0f363869b0d214c80df335f05ef2a8b506bdcdd613a124f21492e7f9ad602dd7881f6ca16bf3ff8b04c45c7d94f361310b7978705f5c75c22826a142dd86c332

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\msvcr100.dll

MD5 26b2d9c49e69a59bea22558525f3d643
SHA1 b32a7c2413b6f4652b8822d6b08a581f7b9120b5
SHA256 092b59a6c1c778ecf56ce7219b103b0a547a14fe3bd94abdd7fdc0c894b31e8f
SHA512 d50cbd211d945576e2d8f87391f39dd30744ee6f6c940a2f1768c4e9bb3f6e90b443409414e97ca0957596922ebd4f865cf1f3384cdde96ba585461e80fb0aae

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\libeay32.dll

MD5 e709374bfc5d26439a4b626520d2dbbb
SHA1 4f0243611cfece832b086c2ed7ad2675ce11a203
SHA256 7cee2f68fa47f8f1657e9f5238b203b4966bd20cb3b506cb69c5da645a1cffde
SHA512 c0b55df21c615cea386825de0331325fbf2a1f0f78001d16ca30856c383427aec537edacff652e1b4bcc9e2b636b0d14505cedcfd6fa4c66ee3db7e4dfe12ff3

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\arkFS.dll

MD5 c3207d5d8b4df7a13b678fca4c34f324
SHA1 0ad8d445eef3e224650fb299e834901d25c50685
SHA256 74ea46fc311a23b0c40d97306abc5cab49ace283052f595d0bc9a80f97ac1a12
SHA512 60033aebe094b04bbdf83ada96c346073746a2973b983a79f2135be601ed37f7e931ab49f80116647eb0f11912b0e8853616f18a2af95a2c747f69729fd5f8cb

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\AsyncTask.dll

MD5 8ad07f53e87fcc18d62bd016ae18607d
SHA1 5dc05a1760c0c5530b7026192a103f8b6b71d987
SHA256 10ad2b5cee7cf2be73c8b5e33db376bf51af570e7365f7f8681670f8410f5883
SHA512 23118817c41c3c3123067a3b151939992d2c5548a8e7ddcacf2fef52cdd18e8f308a9ff796d8270a13ab1c383fb89bd97502451b515ef6a3244ba95ea6ae2ee5

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\tinyxml.dll

MD5 19f1ed1a772ea201af1e986df1e109c1
SHA1 d660df3e089edf616b44812fede39c3d62ad446c
SHA256 7dff6b0e5686076247d1d62854b0475d909056078cbfd44326b94f835bac8870
SHA512 525ea43fd1d85b73ac4404949214f09b1cfc516b7e898749ef7d73a5e209299e2e2d99f52260fbe1c254201b4350d78e5e17060cba13e9a5cc17c3333759ad0b

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\libexpat.dll

MD5 e92990c951fdf5adf27348c42ee4fd87
SHA1 cdf27bb4b12e2306e3144cc9355e8a1e4ab2611b
SHA256 d5c80d353fa48fe010f0652cd92c571dacded2f8321c83210a37a633f3ea8172
SHA512 0404b7598ef6db80cfee7df83bca2a16aff825e6a7a05ed11698fa745ddeb1f582306a113055cbe296fc17a9d68ec1a422b641166ba422d070f11d65310dd952

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\zlib.dll

MD5 5953ee89e5c1777f389bc6f571021110
SHA1 ccd673eb9ef3f5dd7d71afd7aeaf1297e198fbcd
SHA256 aedaae71c32fde725c894e68b6cdce302c9564b9fac08656d66e0be883dca93b
SHA512 89d271f9f6092d8cfe88b698f9c6359149c0666e849b1d7df94300535b9df67e46e1212ad33c124970cb42bdfbd101bd2b6e262fdc125ccee70159c0b0d62616

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\LIBCURL.dll

MD5 9c7232e92a2936844d753239233246cd
SHA1 89ed97229795281b5843686a70a1661b0aecdde7
SHA256 7de31f5ace824ea7dd845b71a6eedb921a04ded24bd4172d21d849879de17129
SHA512 03fc1c4e5a17eca99c76fc899df140e65984da7317d727cbe966a8df7ad83253192a647a55fce57795bdc27231ea1cf03252dd16ff7d5280e129c4a7bab777be

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\Common.dll

MD5 db7f889a32083695ad19c0328f31503f
SHA1 d75d249716fd75623167c8d04ee68d2ab4a47148
SHA256 e3786ceef2b7207512140843702a2782f0c8351c486fda4c89081430c2980f55
SHA512 38bb16ef68e09d6a86b567ebc3c23f07152bbf1e5dadc7b27c6fff6fcfb9250ef23b364ea1171ba891b2dd7f97a740a592962856bcad0807698faabc05ceddfd

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\libskottie.dll

MD5 5bc516fae65a26280939f630c6ee5109
SHA1 66e1796c9988be26cbe9c11b8adc5db9ac53d625
SHA256 69b0d592715b69d9930a2d98ebf5dc06d61827e3c3226be89b452eb03dac73b5
SHA512 aaa382b5dee11f123d2e0108a26adc432bbbcae2d2ce13995d1bfc0b2a99efa5c4e619723e7c2e93d6d9fccc11b0ea55d55ad0e7705d1ae6351580db7fe56ba6

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QLCommon.dll

MD5 8f3ffde27110d14e7e691e4f68d6154f
SHA1 cb880924c20523ebfbd14bac45e731d5dfc7ced0
SHA256 6005266d708e7a6a4a3b744a53a533b544f090b1714accb85746fb4c9bde967e
SHA512 300b81e225adc87c7ab475f76009d522ee82aef7a8147c207f7ea9d14a96499d763dffa3fe19f1ed7338cf68bb8b010a2733ac3b1030e17c5b038e252cb46f35

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayerCommon.dll

MD5 4913889ebb2912c097887d1e19b257f7
SHA1 df1df63abc1ccfd372b0db117d202ca414cd90a1
SHA256 4e3c712a87bb8e39127f7d113f05f45ad88cee974fe72176118eb0fbdf3d89cd
SHA512 f78247a19d703a7bd3704f1765b2c813903abfa747eca02ff7f23faa2ac3b4c4faa94540e1c77632db4a3f1085b2cbd81cf4ab963e2a80c2ae308024015a5275

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\QQPlayerBase.dll

MD5 fd0d21afaa1112d34f2317ffd17431c6
SHA1 eec4b2316a70dd75a6ce87369ac32542d6207503
SHA256 d0fec47c045e08635d0ae5459cae2ce6a4a9f75a38d0aa44c8afd4478c7f9a44
SHA512 6c11b8357bf4dfbb3c4887789434a4055ed9b7408fb6e85594784288df3c72c21a54f78da9d72e56ec89bf82671ae77d83d265f1021d53a557ec1c40435955cc

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\vcruntime140.dll

MD5 b77eeaeaf5f8493189b89852f3a7a712
SHA1 c40cf51c2eadb070a570b969b0525dc3fb684339
SHA256 b7c13f8519340257ba6ae3129afce961f137e394dde3e4e41971b9f912355f5e
SHA512 a09a1b60c9605969a30f99d3f6215d4bf923759b4057ba0a5375559234f17d47555a84268e340ffc9ad07e03d11f40dd1f3fb5da108d11eb7f7933b7d87f2de3

C:\Users\Admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\LogManager.dll

MD5 02dddbe5c5305916b0d09566011d5c50
SHA1 f73b072c0074726f6fc0f2ca8a9b8bdd3881b9f5
SHA256 d25cb56b0090a015e4c759f44766a411203c01c3e76f02e5ad2b257954fd4e5f
SHA512 273d69422bd7095846a8f0cea596066a4c872987dd8ccac4806dac830b16ec02d98e3fa45fdd1f4ee76025d4a338cdc467ba1dde6758107008d735dd85030f20

C:\Users\Admin\AppData\Local\Temp\{9CB21083-8598-4556-99F7-E8D6404101F8}\_isres_0x0409.dll

MD5 7de024bc275f9cdeaf66a865e6fd8e58
SHA1 5086e4a26f9b80699ea8d9f2a33cead28a1819c0
SHA256 bd32468ee7e8885323f22eabbff9763a0f6ffef3cc151e0bd0481df5888f4152
SHA512 191c57e22ea13d13806dd390c4039029d40c7532918618d185d8a627aabc3969c7af2e532e3c933bde8f652b4723d951bf712e9ba0cc0d172dde693012f5ef1a

memory/2808-55-0x00000000031E0000-0x00000000033A7000-memory.dmp

memory/3440-164-0x00007FFEE79B0000-0x00007FFEE7BA5000-memory.dmp

memory/3440-167-0x0000000073E30000-0x0000000073FAB000-memory.dmp

memory/1936-171-0x00007FF6CDAC0000-0x00007FF6CDDDD000-memory.dmp

memory/1936-172-0x00007FF6CDAC0000-0x00007FF6CDDDD000-memory.dmp

memory/1936-173-0x00007FF6CDAC0000-0x00007FF6CDDDD000-memory.dmp

memory/1936-174-0x00007FF6CDAC0000-0x00007FF6CDDDD000-memory.dmp

memory/1936-175-0x00007FF6CDAC0000-0x00007FF6CDDDD000-memory.dmp

memory/1936-183-0x00007FF6CDAC0000-0x00007FF6CDDDD000-memory.dmp

memory/1936-184-0x00007FF6CDAC0000-0x00007FF6CDDDD000-memory.dmp

memory/1936-190-0x00007FF6CDAC0000-0x00007FF6CDDDD000-memory.dmp

memory/1936-199-0x00007FF6CDAC0000-0x00007FF6CDDDD000-memory.dmp