sectoprat | 039a96ae63d12777c79f84242b1b6687c557ff5aa063f8de414ab9d5c9ff9d04

Resubmissions

07/04/2025, 12:25

250407-pl3tas1qx3 10

07/04/2025, 12:22

250407-pjyfssyxfy 10

Analysis

max time kernel
130s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2025, 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

msi (2).msi
Size

21.2MB
MD5

1d670753e89d61c11933975a5909676a
SHA1

42f0862ddb4ce57c6eb9a56e4c8f9422d6a3fb65
SHA256

039a96ae63d12777c79f84242b1b6687c557ff5aa063f8de414ab9d5c9ff9d04
SHA512

352270c93ab1430839b09fddc962f2c46e5791bfa9fece31bacbb9453ca6f1d9fb03eeb4566774cb1c37d00cc5f185f70d506f50720b024e6526070d0856883e
SSDEEP

393216:D+SX8B1Ph7xmLySZGqM/RrIKo9MGRJ7S4Ul0:D+NPh7xMo/RQRr

Score

10^/10

sectoprat credential_access discovery rat spyware stealer trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/3148-303-0x0000000000900000-0x00000000009CC000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Uses browser remote debugging 2 TTPs 12 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
760	chrome.exe
5424	chrome.exe
5412	msedge.exe
1800	msedge.exe
6068	chrome.exe
2848	chrome.exe
5768	msedge.exe
1396	msedge.exe
3296	msedge.exe
4432	msedge.exe
2456	chrome.exe
3252	chrome.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4940 set thread context of 3956	4940	QQPlayerShareFile.exe	104
PID 3956 set thread context of 3148	3956	cmd.exe	115

Executes dropped EXE 12 IoCs

pid	Process
2476	ISBEW64.exe
2584	ISBEW64.exe
4124	ISBEW64.exe
4952	ISBEW64.exe
4848	ISBEW64.exe
2512	ISBEW64.exe
4404	ISBEW64.exe
2564	ISBEW64.exe
2988	ISBEW64.exe
4476	ISBEW64.exe
3652	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe

Loads dropped DLL 64 IoCs

pid	Process
2004	MsiExec.exe
2004	MsiExec.exe
2004	MsiExec.exe
2004	MsiExec.exe
2004	MsiExec.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
3652	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QQPlayerShareFile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QQPlayerShareFile.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
3652	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
4940	QQPlayerShareFile.exe
3956	cmd.exe
3956	cmd.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe
2456	chrome.exe
2456	chrome.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe
3148	MSBuild.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4940	QQPlayerShareFile.exe
3956	cmd.exe
3956	cmd.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4656	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4656	msiexec.exe
Token: SeSecurityPrivilege	6132	msiexec.exe
Token: SeCreateTokenPrivilege	4656	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4656	msiexec.exe
Token: SeLockMemoryPrivilege	4656	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4656	msiexec.exe
Token: SeMachineAccountPrivilege	4656	msiexec.exe
Token: SeTcbPrivilege	4656	msiexec.exe
Token: SeSecurityPrivilege	4656	msiexec.exe
Token: SeTakeOwnershipPrivilege	4656	msiexec.exe
Token: SeLoadDriverPrivilege	4656	msiexec.exe
Token: SeSystemProfilePrivilege	4656	msiexec.exe
Token: SeSystemtimePrivilege	4656	msiexec.exe
Token: SeProfSingleProcessPrivilege	4656	msiexec.exe
Token: SeIncBasePriorityPrivilege	4656	msiexec.exe
Token: SeCreatePagefilePrivilege	4656	msiexec.exe
Token: SeCreatePermanentPrivilege	4656	msiexec.exe
Token: SeBackupPrivilege	4656	msiexec.exe
Token: SeRestorePrivilege	4656	msiexec.exe
Token: SeShutdownPrivilege	4656	msiexec.exe
Token: SeDebugPrivilege	4656	msiexec.exe
Token: SeAuditPrivilege	4656	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4656	msiexec.exe
Token: SeChangeNotifyPrivilege	4656	msiexec.exe
Token: SeRemoteShutdownPrivilege	4656	msiexec.exe
Token: SeUndockPrivilege	4656	msiexec.exe
Token: SeSyncAgentPrivilege	4656	msiexec.exe
Token: SeEnableDelegationPrivilege	4656	msiexec.exe
Token: SeManageVolumePrivilege	4656	msiexec.exe
Token: SeImpersonatePrivilege	4656	msiexec.exe
Token: SeCreateGlobalPrivilege	4656	msiexec.exe
Token: SeCreateTokenPrivilege	4656	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4656	msiexec.exe
Token: SeLockMemoryPrivilege	4656	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4656	msiexec.exe
Token: SeMachineAccountPrivilege	4656	msiexec.exe
Token: SeTcbPrivilege	4656	msiexec.exe
Token: SeSecurityPrivilege	4656	msiexec.exe
Token: SeTakeOwnershipPrivilege	4656	msiexec.exe
Token: SeLoadDriverPrivilege	4656	msiexec.exe
Token: SeSystemProfilePrivilege	4656	msiexec.exe
Token: SeSystemtimePrivilege	4656	msiexec.exe
Token: SeProfSingleProcessPrivilege	4656	msiexec.exe
Token: SeIncBasePriorityPrivilege	4656	msiexec.exe
Token: SeCreatePagefilePrivilege	4656	msiexec.exe
Token: SeCreatePermanentPrivilege	4656	msiexec.exe
Token: SeBackupPrivilege	4656	msiexec.exe
Token: SeRestorePrivilege	4656	msiexec.exe
Token: SeShutdownPrivilege	4656	msiexec.exe
Token: SeDebugPrivilege	4656	msiexec.exe
Token: SeAuditPrivilege	4656	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4656	msiexec.exe
Token: SeChangeNotifyPrivilege	4656	msiexec.exe
Token: SeRemoteShutdownPrivilege	4656	msiexec.exe
Token: SeUndockPrivilege	4656	msiexec.exe
Token: SeSyncAgentPrivilege	4656	msiexec.exe
Token: SeEnableDelegationPrivilege	4656	msiexec.exe
Token: SeManageVolumePrivilege	4656	msiexec.exe
Token: SeImpersonatePrivilege	4656	msiexec.exe
Token: SeCreateGlobalPrivilege	4656	msiexec.exe
Token: SeCreateTokenPrivilege	4656	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4656	msiexec.exe
Token: SeLockMemoryPrivilege	4656	msiexec.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
4656	msiexec.exe
4656	msiexec.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
5412	msedge.exe
5412	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3148	MSBuild.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6132 wrote to memory of 2004	6132	msiexec.exe	88
PID 6132 wrote to memory of 2004	6132	msiexec.exe	88
PID 6132 wrote to memory of 2004	6132	msiexec.exe	88
PID 2004 wrote to memory of 2476	2004	MsiExec.exe	92
PID 2004 wrote to memory of 2476	2004	MsiExec.exe	92
PID 2004 wrote to memory of 2584	2004	MsiExec.exe	93
PID 2004 wrote to memory of 2584	2004	MsiExec.exe	93
PID 2004 wrote to memory of 4124	2004	MsiExec.exe	94
PID 2004 wrote to memory of 4124	2004	MsiExec.exe	94
PID 2004 wrote to memory of 4952	2004	MsiExec.exe	95
PID 2004 wrote to memory of 4952	2004	MsiExec.exe	95
PID 2004 wrote to memory of 4848	2004	MsiExec.exe	96
PID 2004 wrote to memory of 4848	2004	MsiExec.exe	96
PID 2004 wrote to memory of 2512	2004	MsiExec.exe	97
PID 2004 wrote to memory of 2512	2004	MsiExec.exe	97
PID 2004 wrote to memory of 4404	2004	MsiExec.exe	98
PID 2004 wrote to memory of 4404	2004	MsiExec.exe	98
PID 2004 wrote to memory of 2564	2004	MsiExec.exe	99
PID 2004 wrote to memory of 2564	2004	MsiExec.exe	99
PID 2004 wrote to memory of 2988	2004	MsiExec.exe	100
PID 2004 wrote to memory of 2988	2004	MsiExec.exe	100
PID 2004 wrote to memory of 4476	2004	MsiExec.exe	101
PID 2004 wrote to memory of 4476	2004	MsiExec.exe	101
PID 2004 wrote to memory of 3652	2004	MsiExec.exe	102
PID 2004 wrote to memory of 3652	2004	MsiExec.exe	102
PID 2004 wrote to memory of 3652	2004	MsiExec.exe	102
PID 3652 wrote to memory of 4940	3652	QQPlayerShareFile.exe	103
PID 3652 wrote to memory of 4940	3652	QQPlayerShareFile.exe	103
PID 3652 wrote to memory of 4940	3652	QQPlayerShareFile.exe	103
PID 4940 wrote to memory of 3956	4940	QQPlayerShareFile.exe	104
PID 4940 wrote to memory of 3956	4940	QQPlayerShareFile.exe	104
PID 4940 wrote to memory of 3956	4940	QQPlayerShareFile.exe	104
PID 4940 wrote to memory of 3956	4940	QQPlayerShareFile.exe	104
PID 3956 wrote to memory of 3148	3956	cmd.exe	115
PID 3956 wrote to memory of 3148	3956	cmd.exe	115
PID 3956 wrote to memory of 3148	3956	cmd.exe	115
PID 3956 wrote to memory of 3148	3956	cmd.exe	115
PID 3956 wrote to memory of 3148	3956	cmd.exe	115
PID 3148 wrote to memory of 2456	3148	MSBuild.exe	124
PID 3148 wrote to memory of 2456	3148	MSBuild.exe	124
PID 2456 wrote to memory of 4660	2456	chrome.exe	125
PID 2456 wrote to memory of 4660	2456	chrome.exe	125
PID 2456 wrote to memory of 316	2456	chrome.exe	126
PID 2456 wrote to memory of 316	2456	chrome.exe	126
PID 2456 wrote to memory of 1456	2456	chrome.exe	127
PID 2456 wrote to memory of 1456	2456	chrome.exe	127
PID 2456 wrote to memory of 316	2456	chrome.exe	126
PID 2456 wrote to memory of 316	2456	chrome.exe	126
PID 2456 wrote to memory of 316	2456	chrome.exe	126
PID 2456 wrote to memory of 316	2456	chrome.exe	126
PID 2456 wrote to memory of 316	2456	chrome.exe	126
PID 2456 wrote to memory of 316	2456	chrome.exe	126
PID 2456 wrote to memory of 316	2456	chrome.exe	126
PID 2456 wrote to memory of 316	2456	chrome.exe	126
PID 2456 wrote to memory of 316	2456	chrome.exe	126
PID 2456 wrote to memory of 316	2456	chrome.exe	126
PID 2456 wrote to memory of 316	2456	chrome.exe	126
PID 2456 wrote to memory of 316	2456	chrome.exe	126
PID 2456 wrote to memory of 316	2456	chrome.exe	126
PID 2456 wrote to memory of 316	2456	chrome.exe	126
PID 2456 wrote to memory of 316	2456	chrome.exe	126
PID 2456 wrote to memory of 316	2456	chrome.exe	126
PID 2456 wrote to memory of 316	2456	chrome.exe	126
PID 2456 wrote to memory of 316	2456	chrome.exe	126

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\msi (2).msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4656

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6132
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F561FC0BBFCC1FE354E1F1B7BDD279DA C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F353EC6D-BA7D-4B2F-B228-856E46154CF3}
    3⤵
    - Executes dropped EXE
    PID:2476
- - C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8C438A09-02CC-426C-93A8-72686F7D067C}
    3⤵
    - Executes dropped EXE
    PID:2584
- - C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E209F33F-0FCC-453C-854F-D873B6F96E7D}
    3⤵
    - Executes dropped EXE
    PID:4124
- - C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C653AED2-A293-4EAD-882C-9D8DFC2D47AB}
    3⤵
    - Executes dropped EXE
    PID:4952
- - C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1F2A4BBE-185F-44D4-943A-AAD396308FEE}
    3⤵
    - Executes dropped EXE
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8391C4C5-0413-4947-B88C-BDAD82F8EE37}
    3⤵
    - Executes dropped EXE
    PID:2512
- - C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{004365FB-150E-4A53-B9FE-60400B72683D}
    3⤵
    - Executes dropped EXE
    PID:4404
- - C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CDB4012B-009C-45CB-BE7D-7E0926479580}
    3⤵
    - Executes dropped EXE
    PID:2564
- - C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{460F74DA-3548-4DFB-A87B-A0C9ECE767C6}
    3⤵
    - Executes dropped EXE
    PID:2988
- - C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FB4DA85B-3DD9-4174-ACBE-4E905F435D8B}
    3⤵
    - Executes dropped EXE
    PID:4476
- - C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\QQPlayerShareFile.exe
    C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\QQPlayerShareFile.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Users\Admin\AppData\Roaming\manageFirefoxTok_5\QQPlayerShareFile.exe
      C:\Users\Admin\AppData\Roaming\manageFirefoxTok_5\QQPlayerShareFile.exe
      4⤵
      Suspicious use of SetThreadContext
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4940
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:3956
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=8855 --profile-directory="Default"
        7⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffb97c4dcf8,0x7ffb97c4dd04,0x7ffb97c4dd10
        8⤵
        
        PID:4660
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1988,i,1541564708528639240,2095377790722781950,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1984 /prefetch:2
        8⤵
        
        PID:316
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2024,i,1541564708528639240,2095377790722781950,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2148 /prefetch:3
        8⤵
        
        PID:1456
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2432,i,1541564708528639240,2095377790722781950,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2600 /prefetch:8
        8⤵
        
        PID:3936
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=8855 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3288,i,1541564708528639240,2095377790722781950,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3304 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:760
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=8855 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3324,i,1541564708528639240,2095377790722781950,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3344 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:3252
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=8855 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4320,i,1541564708528639240,2095377790722781950,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4376 /prefetch:2
        8⤵
        Uses browser remote debugging
        
        PID:6068
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=8855 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4348,i,1541564708528639240,2095377790722781950,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4300 /prefetch:2
        8⤵
        Uses browser remote debugging
        
        PID:5424
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=8855 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4936,i,1541564708528639240,2095377790722781950,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4240 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:2848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9638 --profile-directory="Default"
        7⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:5412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffb940ef208,0x7ffb940ef214,0x7ffb940ef220
        8⤵
        
        PID:2584
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2224,i,13334276952924565204,14278350081724321637,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
        8⤵
        
        PID:3964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1988,i,13334276952924565204,14278350081724321637,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
        8⤵
        
        PID:3256
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2552,i,13334276952924565204,14278350081724321637,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
        8⤵
        
        PID:612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9638 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3524,i,13334276952924565204,14278350081724321637,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:5768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9638 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3548,i,13334276952924565204,14278350081724321637,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:1800
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9638 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4272,i,13334276952924565204,14278350081724321637,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:4432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9638 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4288,i,13334276952924565204,14278350081724321637,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:2
        8⤵
        Uses browser remote debugging
        
        PID:1396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9638 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4772,i,13334276952924565204,14278350081724321637,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:2
        8⤵
        Uses browser remote debugging
        
        PID:3296
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5432,i,13334276952924565204,14278350081724321637,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:8
        8⤵
        
        PID:5328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5372,i,13334276952924565204,14278350081724321637,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
        8⤵
        
        PID:5868

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1852

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
659557017266e5d98227681a1cc6620b

SHA1
0985b84ff09a498f13ee1b38105606f12d94eee3

SHA256
414c529837f25c9a46786a54a66f3e739d82b22cb66cdb08544233ad82f02342

SHA512
a3c97dc237b50c059d85270fc1947ba8c6b41786c7718caaa9ae07d7b3f349b4034a5f444f2b6da3c19942be41adf7e97481fe4690cfda918277f227fa26fb57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
eec55fe349980566b1dbf1d409d28c3e

SHA1
654ce4b550defea0851f12e8ff81ae9298bb3f60

SHA256
2e81ea3d7ddfc0274f3955d5131143c481e63f2529514c5295873b393d508efe

SHA512
58e02658d08732b5f36e868331a483b5fde15475a6c5f704a19c97d920399c3f7d41a8fa163c66683bf403598f8f48f0cf9fa468f9783fcabd9136a55cec0059

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
5a7e1750438748bd333b79a94ca69b2a

SHA1
94fd1be56969e269ce195ba29c3d464d356d6556

SHA256
6d7a64a318c25c643323d5cf1c0c80ccf2f2433e7d74b722fca90468f8f9b914

SHA512
842509c0f495ee24d152ab3f7867183d7cd64b01b5a9305405682abbbff3aa18a8ad7d97ee039393fdd1766fc17ad2df1caf711dc4db8dc7b9df608ffc0fdc7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b6a380d4-5862-40a9-a645-ceea7f421bc5\index-dir\the-real-index

Filesize
1KB

MD5
92844bee65899f98903feaaf0880894b

SHA1
10d15ace9e74c013706d8db6226ab6c45a801d78

SHA256
cf1c86c1cb855fd023cbf585acaa16d39c379e28f46d0efb4b1d6a1fc8205e5a

SHA512
8677adbede8ea1e4583edbcea55983c28875e557fd714db1ba6d93dd30618f8a1663e31a00f385ba17508238422c3d5148c0219ae40487d44463edc0b940f473

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b6a380d4-5862-40a9-a645-ceea7f421bc5\index-dir\the-real-index~RFe58b13a.TMP

Filesize
1KB

MD5
45073460f2fe54df91d8b0eb2307c34b

SHA1
7190a0078d3e9c3f0c2c35b303d602ee2f2698cb

SHA256
4aac9073e66d19eb88b75d495a2fd572112494445e4a62423da907aaac36a77d

SHA512
437e8abeef21cb058e99d5fc394b233ebb484d4c2ce50d0adbbfdcd41dd2f6ad93b1ec816bd27562ff046cac3aa200629175816f48d9722b8257b92274d14e3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
6a2acdb699cb380a37e518ea9827ccea

SHA1
da30711d938941320c2e67fa8fbf2802e880d5c5

SHA256
fadf1e30dc6a307135aa79590f3eff3200a964f7445823c6a075f7a4d716765f

SHA512
49850dfe0879f78b3707387fd09180636cb84927b5ea0abc125083faae2415b3643f828196a3b12515b68f03efc1f92c9208486a4b60e85051e057719ec830e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
8992cb937ba785e09f528fe4e3ad5b73

SHA1
d2a1238122c8aa1c8127e3b0cec3bc5e2819a8d8

SHA256
d57ba36f2358d4be823feb423812f065c572e9d3867bcbb926e953c7c010aad0

SHA512
83e91769ff927d6a68e259d621327faecf3281fa16ef325ade956bdb927104aea5cf172a0683bb13c8d7b65125d9f9fdf95d66559a79b9e3032166117fe8d83c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8F7E.tmp

Filesize
171KB

MD5
a0e940a3d3c1523416675125e3b0c07e

SHA1
2e29eeba6da9a4023bc8071158feee3b0277fd1b

SHA256
b8fa7aa425e4084ea3721780a13d11e08b8d53d1c5414b73f22faeca1bfd314f

SHA512
736ea06824388372aeef1938c6b11e66f4595e0b0589d7b4a87ff4abbabe52e82dff64d916293eab47aa869cf372ced2c66755dd8a8471b2ab0d3a37ba91d0b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9319.tmp

Filesize
2.5MB

MD5
4edc6d1eca1439bc17287a1fee6de231

SHA1
75ff6902918d52f35b6c979b9063d87d7945eecc

SHA256
63ecfcb2b8e359616c108e840b22fb8dfd7d0be2d03a0be68b9f0e2c4021729b

SHA512
42806323d9becae869bef0edac460e19355d61c56c50a30ca8435e67f7f0001b2b0553de5a2644d2461bb37b749fc9e76ecf34d19955a06b7f2e6b122527c200

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\AsyncTask.dll

Filesize
76KB

MD5
8ad07f53e87fcc18d62bd016ae18607d

SHA1
5dc05a1760c0c5530b7026192a103f8b6b71d987

SHA256
10ad2b5cee7cf2be73c8b5e33db376bf51af570e7365f7f8681670f8410f5883

SHA512
23118817c41c3c3123067a3b151939992d2c5548a8e7ddcacf2fef52cdd18e8f308a9ff796d8270a13ab1c383fb89bd97502451b515ef6a3244ba95ea6ae2ee5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\Common.dll

Filesize
1.7MB

MD5
db7f889a32083695ad19c0328f31503f

SHA1
d75d249716fd75623167c8d04ee68d2ab4a47148

SHA256
e3786ceef2b7207512140843702a2782f0c8351c486fda4c89081430c2980f55

SHA512
38bb16ef68e09d6a86b567ebc3c23f07152bbf1e5dadc7b27c6fff6fcfb9250ef23b364ea1171ba891b2dd7f97a740a592962856bcad0807698faabc05ceddfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\GF.dll

Filesize
4.1MB

MD5
5bf5766fe289788172eb10922e307d34

SHA1
5ab3a9c2f3c7f7838d471ab08cf6105214d4e398

SHA256
f26ba7f1efefdc477ea985b2fe1c8f1c2ca9584c4f98ea8543ec361ba4b93e6c

SHA512
237866b896008efd349b1011d37629e701c1623afa402ae88c753d3b568118e3bc43a5b092acdb90b51d8af0c5315fe72e75f4e2ab95b74398fd7ee70a1aaaa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\LogManager.dll

Filesize
611KB

MD5
c12fd4f6b63bb2101b0cbf1d025409e7

SHA1
6fa7d5cac8c392578b1cd482b325b4ec54171d94

SHA256
e9e34c898f456f364d6dac18815c4df96e728a3c08bea94c048bc7ef6664803b

SHA512
97226e19912d597739e56bddf69c9d57cf0517c54765531a2fd3ed8db3712ce33abe7ca26103993de2f7762c22276e2bbec4244b9b93a5d40421f9c100bd042a

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\LogUpload.dll

Filesize
144KB

MD5
a06e82578ded2e7cc6b9fa632afeddb8

SHA1
78a780d86be437691d0374aa889b08e0bac1f6fd

SHA256
967ef6e7ddb4629e781eb159aaed4c1c45e529caa82cab0db0a564042c316e7d

SHA512
b5d5750b3bb7f7d5b7a722be2d42b17d674d250cb74a296934bd66fdac30609c2a1da22c99643ab2a15ca7bd85d6b623da05d7241e30e3437f549439fe99231f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\QLCommon.dll

Filesize
755KB

MD5
8f3ffde27110d14e7e691e4f68d6154f

SHA1
cb880924c20523ebfbd14bac45e731d5dfc7ced0

SHA256
6005266d708e7a6a4a3b744a53a533b544f090b1714accb85746fb4c9bde967e

SHA512
300b81e225adc87c7ab475f76009d522ee82aef7a8147c207f7ea9d14a96499d763dffa3fe19f1ed7338cf68bb8b010a2733ac3b1030e17c5b038e252cb46f35

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\QQPlayerBase.dll

Filesize
88KB

MD5
fd0d21afaa1112d34f2317ffd17431c6

SHA1
eec4b2316a70dd75a6ce87369ac32542d6207503

SHA256
d0fec47c045e08635d0ae5459cae2ce6a4a9f75a38d0aa44c8afd4478c7f9a44

SHA512
6c11b8357bf4dfbb3c4887789434a4055ed9b7408fb6e85594784288df3c72c21a54f78da9d72e56ec89bf82671ae77d83d265f1021d53a557ec1c40435955cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\QQPlayerCommon.DLL

Filesize
132KB

MD5
4913889ebb2912c097887d1e19b257f7

SHA1
df1df63abc1ccfd372b0db117d202ca414cd90a1

SHA256
4e3c712a87bb8e39127f7d113f05f45ad88cee974fe72176118eb0fbdf3d89cd

SHA512
f78247a19d703a7bd3704f1765b2c813903abfa747eca02ff7f23faa2ac3b4c4faa94540e1c77632db4a3f1085b2cbd81cf4ab963e2a80c2ae308024015a5275

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\QQPlayerCore.dll

Filesize
84KB

MD5
372406b863686ce1928aa27622bc3e8b

SHA1
acbffffb5f36b0d33977001fac52d0a2309160e8

SHA256
0a19b3e74e6b61aae5aa95b030c8dc0d69b998e84b76fe0158b19789628749bc

SHA512
64b72f0eac456ab6ffd568f5eea42a680ab9482470dc4d79c272528671496b0437952a4dcc75f89a560b539c59f1d5b7dc2c4b778d213fda9a6cb164300245fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\QQPlayerService.dll

Filesize
383KB

MD5
3eaf12845c1f48ce1bd2766dcf1fe4d7

SHA1
27d88692f4541c1cc21d34fbc653278cf292c27c

SHA256
aaf26c61fd2cc037000ef1d01e111af583607000f470f53ab53f3a8befb238e1

SHA512
04dfaf86ce70da687671c5cb79a3ad53b3788abae3405b20400e1510c6bbf4b71b346ca3a6031342fc8809b193cd5a6d09c15c5402649adc950480e75f94343f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\QQPlayerShareFile.exe

Filesize
690KB

MD5
87145df108044cebf58cadce231bc82f

SHA1
42574bbf3a4922e8c89da685cf7a51100b9d7464

SHA256
3c5ef21065ce78141738202ee7f678f8b1fe666d49b7639ff82f95eda73cdd2b

SHA512
e1396249d1d8770fef3746d79796f40915581922018d0176069095b43fa1f3bdf500bf55c940048f8080bf4a3e8a9c24ee553c45447c1510915350d8a759ce96

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\QQPlayerStatistic.dll

Filesize
416KB

MD5
383267627150fb4ae75d7a2b7d19a671

SHA1
cc46021b1331a9756c82501e68b238c454a3d9e9

SHA256
6877d61fa6813a94bb52b798fca5a9cf413a8b7931bed93169bedab22db73e92

SHA512
f2bc1c16919342d5528e3a0b195187366e22a5be268fb74db072f1dbbebd813031136fb568a49316029c05c7a11f4e4437ac6d6e0c7d959eb71da59e364f9c2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\arkFS.dll

Filesize
65KB

MD5
c3207d5d8b4df7a13b678fca4c34f324

SHA1
0ad8d445eef3e224650fb299e834901d25c50685

SHA256
74ea46fc311a23b0c40d97306abc5cab49ace283052f595d0bc9a80f97ac1a12

SHA512
60033aebe094b04bbdf83ada96c346073746a2973b983a79f2135be601ed37f7e931ab49f80116647eb0f11912b0e8853616f18a2af95a2c747f69729fd5f8cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\arkIOStub.dll

Filesize
25KB

MD5
e6f65df00571bfdbea3f32773bb2de8b

SHA1
f2574a80c5f3e047f0c1a48520ae37da62c8b80c

SHA256
7a4b53fb08494c424070e7dfdfe52b801179f930adae374459f074ca6bd99e19

SHA512
0f363869b0d214c80df335f05ef2a8b506bdcdd613a124f21492e7f9ad602dd7881f6ca16bf3ff8b04c45c7d94f361310b7978705f5c75c22826a142dd86c332

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\libcurl.dll

Filesize
2.1MB

MD5
9c7232e92a2936844d753239233246cd

SHA1
89ed97229795281b5843686a70a1661b0aecdde7

SHA256
7de31f5ace824ea7dd845b71a6eedb921a04ded24bd4172d21d849879de17129

SHA512
03fc1c4e5a17eca99c76fc899df140e65984da7317d727cbe966a8df7ad83253192a647a55fce57795bdc27231ea1cf03252dd16ff7d5280e129c4a7bab777be

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\libeay32.dll

Filesize
1.1MB

MD5
e709374bfc5d26439a4b626520d2dbbb

SHA1
4f0243611cfece832b086c2ed7ad2675ce11a203

SHA256
7cee2f68fa47f8f1657e9f5238b203b4966bd20cb3b506cb69c5da645a1cffde

SHA512
c0b55df21c615cea386825de0331325fbf2a1f0f78001d16ca30856c383427aec537edacff652e1b4bcc9e2b636b0d14505cedcfd6fa4c66ee3db7e4dfe12ff3

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\libexpat.dll

Filesize
123KB

MD5
e92990c951fdf5adf27348c42ee4fd87

SHA1
cdf27bb4b12e2306e3144cc9355e8a1e4ab2611b

SHA256
d5c80d353fa48fe010f0652cd92c571dacded2f8321c83210a37a633f3ea8172

SHA512
0404b7598ef6db80cfee7df83bca2a16aff825e6a7a05ed11698fa745ddeb1f582306a113055cbe296fc17a9d68ec1a422b641166ba422d070f11d65310dd952

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\msvcp140.dll

Filesize
429KB

MD5
1d8c79f293ca86e8857149fb4efe4452

SHA1
7474e7a5cb9c79c4b99fdf9fb50ef3011bef7e8f

SHA256
c09b126e7d4c1e6efb3ffcda2358252ce37383572c78e56ca97497a7f7c793e4

SHA512
83c4d842d4b07ba5cec559b6cd1c22ab8201941a667e7b173c405d2fc8862f7e5d9703e14bd7a1babd75165c30e1a2c95f9d1648f318340ea5e2b145d54919b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\msvcr100.dll

Filesize
763KB

MD5
26b2d9c49e69a59bea22558525f3d643

SHA1
b32a7c2413b6f4652b8822d6b08a581f7b9120b5

SHA256
092b59a6c1c778ecf56ce7219b103b0a547a14fe3bd94abdd7fdc0c894b31e8f

SHA512
d50cbd211d945576e2d8f87391f39dd30744ee6f6c940a2f1768c4e9bb3f6e90b443409414e97ca0957596922ebd4f865cf1f3384cdde96ba585461e80fb0aae

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\sqlite.dll

Filesize
560KB

MD5
6b2b8821b446ebd13ea195fc111be8b9

SHA1
e0848937c03c85ff7ed4eba6f5b185f7691b8276

SHA256
16d1c6b627e36b3fa8ce3b69c9a3a9792aa0fc03f71beaaf6808958da7206dc9

SHA512
66b62d1a5994df5bc2d2c9f35f1f3b983ab44949fcdbe50b61638ce94f12d07c486769860ca5cf0a51f69d8967e8e20acd8168cfdbce1ae41a1172b6f03e26e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\tinyxml.dll

Filesize
65KB

MD5
19f1ed1a772ea201af1e986df1e109c1

SHA1
d660df3e089edf616b44812fede39c3d62ad446c

SHA256
7dff6b0e5686076247d1d62854b0475d909056078cbfd44326b94f835bac8870

SHA512
525ea43fd1d85b73ac4404949214f09b1cfc516b7e898749ef7d73a5e209299e2e2d99f52260fbe1c254201b4350d78e5e17060cba13e9a5cc17c3333759ad0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\vcruntime140.dll

Filesize
83KB

MD5
b77eeaeaf5f8493189b89852f3a7a712

SHA1
c40cf51c2eadb070a570b969b0525dc3fb684339

SHA256
b7c13f8519340257ba6ae3129afce961f137e394dde3e4e41971b9f912355f5e

SHA512
a09a1b60c9605969a30f99d3f6215d4bf923759b4057ba0a5375559234f17d47555a84268e340ffc9ad07e03d11f40dd1f3fb5da108d11eb7f7933b7d87f2de3

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FC3614-918B-47E5-8913-4971398713DE}\zlib.dll

Filesize
79KB

MD5
5953ee89e5c1777f389bc6f571021110

SHA1
ccd673eb9ef3f5dd7d71afd7aeaf1297e198fbcd

SHA256
aedaae71c32fde725c894e68b6cdce302c9564b9fac08656d66e0be883dca93b

SHA512
89d271f9f6092d8cfe88b698f9c6359149c0666e849b1d7df94300535b9df67e46e1212ad33c124970cb42bdfbd101bd2b6e262fdc125ccee70159c0b0d62616

Download Submit
C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISBEW64.exe

Filesize
178KB

MD5
40f3a092744e46f3531a40b917cca81e

SHA1
c73f62a44cb3a75933cecf1be73a48d0d623039b

SHA256
561f14cdece85b38617403e1c525ff0b1b752303797894607a4615d0bd66f97f

SHA512
1589b27db29051c772e5ba56953d9f798efbf74d75e0524fa8569df092d28960972779811a7916198d0707d35b1093d3e0dd7669a8179c412cfa7df7120733b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\ISRT.dll

Filesize
426KB

MD5
8af02bf8e358e11caec4f2e7884b43cc

SHA1
16badc6c610eeb08de121ab268093dd36b56bf27

SHA256
58a724d23c63387a2dda27ccfdbc8ca87fd4db671bea8bb636247667f6a5a11e

SHA512
d0228a8cc93ff6647c2f4ba645fa224dc9d114e2adb5b5d01670b6dafc2258b5b1be11629868748e77b346e291974325e8e8e1192042d7c04a35fc727ad4e3fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\{B4C192F2-9172-41D5-8353-537EEECBA551}\_isres_0x0409.dll

Filesize
1.8MB

MD5
7de024bc275f9cdeaf66a865e6fd8e58

SHA1
5086e4a26f9b80699ea8d9f2a33cead28a1819c0

SHA256
bd32468ee7e8885323f22eabbff9763a0f6ffef3cc151e0bd0481df5888f4152

SHA512
191c57e22ea13d13806dd390c4039029d40c7532918618d185d8a627aabc3969c7af2e532e3c933bde8f652b4723d951bf712e9ba0cc0d172dde693012f5ef1a

Download Submit
memory/2004-60-0x0000000010000000-0x0000000010114000-memory.dmp

Filesize
1.1MB

Download
memory/2004-65-0x0000000003180000-0x0000000003347000-memory.dmp

Filesize
1.8MB

Download
memory/3148-307-0x0000000004F60000-0x0000000004FB0000-memory.dmp

Filesize
320KB

Download
memory/3148-306-0x00000000056D0000-0x0000000005C74000-memory.dmp

Filesize
5.6MB

Download
memory/3148-309-0x00000000061B0000-0x00000000066DC000-memory.dmp

Filesize
5.2MB

Download
memory/3148-310-0x0000000005CC0000-0x0000000005CDE000-memory.dmp

Filesize
120KB

Download
memory/3148-311-0x0000000005D70000-0x0000000005DD6000-memory.dmp

Filesize
408KB

Download
memory/3148-317-0x0000000007950000-0x000000000795A000-memory.dmp

Filesize
40KB

Download
memory/3148-320-0x0000000005340000-0x0000000005352000-memory.dmp

Filesize
72KB

Download
memory/3148-321-0x00000000053E0000-0x000000000541C000-memory.dmp

Filesize
240KB

Download
memory/3148-300-0x0000000073510000-0x0000000074764000-memory.dmp

Filesize
18.3MB

Download
memory/3148-308-0x0000000005470000-0x0000000005632000-memory.dmp

Filesize
1.8MB

Download
memory/3148-305-0x00000000050A0000-0x0000000005116000-memory.dmp

Filesize
472KB

Download
memory/3148-304-0x0000000005000000-0x0000000005092000-memory.dmp

Filesize
584KB

Download
memory/3148-303-0x0000000000900000-0x00000000009CC000-memory.dmp

Filesize
816KB

Download
memory/3652-186-0x00007FFBB7730000-0x00007FFBB7925000-memory.dmp

Filesize
2.0MB

Download
memory/3956-298-0x0000000074770000-0x00000000748EB000-memory.dmp

Filesize
1.5MB

Download
memory/3956-296-0x00007FFBB7730000-0x00007FFBB7925000-memory.dmp

Filesize
2.0MB

Download
memory/4940-294-0x00007FFBB7730000-0x00007FFBB7925000-memory.dmp

Filesize
2.0MB

Download