8c61ae1ec613ada2c000f4219e7fe33400c18e5e787c9762674cb45e81a23e3b

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2023, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1.exe
Size

6.4MB
MD5

1633a17d9fe1614e44ed2fd60ccbacdc
SHA1

dd824c5db8f807366826998942d6710ac29121a8
SHA256

a1d2f4f45a1807e61807649d05063aa1d77638e4f6995020c6ac84b48c0bff95
SHA512

e303d1373ea9f7a0d35f6834a937e25c05c8552e55fd8c29de7670c2db4bf17a7af9476925ad3b820062d9b366213d47697db0101c224f87d4accafebb28b118
SSDEEP

196608:ARnXFcNKaCYG6G3nKbZOGymJruTvwGe1Hm:+X6NzM6WneJOvwxJ

Score

9^/10

bootkit evasion persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ncsofts_hr.exe

Executes dropped EXE 1 IoCs

pid	Process
3796	ncsofts_hr.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ncsofts_hr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ncsofts_hr.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	1.exe

Loads dropped DLL 1 IoCs

pid	Process
3796	ncsofts_hr.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ncsofts_hr.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ncsofts_hr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	1.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
3796	ncsofts_hr.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4916	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe
4916	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 3796	4320	1.exe	81
PID 4320 wrote to memory of 3796	4320	1.exe	81
PID 4320 wrote to memory of 4916	4320	1.exe	83
PID 4320 wrote to memory of 4916	4320	1.exe	83
PID 4320 wrote to memory of 4916	4320	1.exe	83
PID 4916 wrote to memory of 4560	4916	AcroRd32.exe	85
PID 4916 wrote to memory of 4560	4916	AcroRd32.exe	85
PID 4916 wrote to memory of 4560	4916	AcroRd32.exe	85
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3720	4560	RdrCEF.exe	88
PID 4560 wrote to memory of 3856	4560	RdrCEF.exe	89
PID 4560 wrote to memory of 3856	4560	RdrCEF.exe	89
PID 4560 wrote to memory of 3856	4560	RdrCEF.exe	89
PID 4560 wrote to memory of 3856	4560	RdrCEF.exe	89
PID 4560 wrote to memory of 3856	4560	RdrCEF.exe	89
PID 4560 wrote to memory of 3856	4560	RdrCEF.exe	89
PID 4560 wrote to memory of 3856	4560	RdrCEF.exe	89
PID 4560 wrote to memory of 3856	4560	RdrCEF.exe	89
PID 4560 wrote to memory of 3856	4560	RdrCEF.exe	89
PID 4560 wrote to memory of 3856	4560	RdrCEF.exe	89
PID 4560 wrote to memory of 3856	4560	RdrCEF.exe	89
PID 4560 wrote to memory of 3856	4560	RdrCEF.exe	89
PID 4560 wrote to memory of 3856	4560	RdrCEF.exe	89
PID 4560 wrote to memory of 3856	4560	RdrCEF.exe	89
PID 4560 wrote to memory of 3856	4560	RdrCEF.exe	89

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4320
- C:\users\public\ncsofts_hr.exe
  "C:\users\public\ncsofts_hr.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  PID:3796
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\users\public\×Ö½ÚÌø¶¯2023ÄêµÚÒ»¼¾¶ÈÔÚÕÐ¸ÚÎ».pdf"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9D539BBA98AD5F7B974DF159E6B2F9D6 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:3720
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1EDF384E075446FDC358CCB7DB5D2117 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1EDF384E075446FDC358CCB7DB5D2117 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DEDEDB4BABCB947ED8DD12C1380BD732 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=73156E14623543424C56F8A050498687 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=73156E14623543424C56F8A050498687 --renderer-client-id=5 --mojo-platform-channel-handle=1800 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:4040
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F27E7DB15104632113DF93DF205492F6 --mojo-platform-channel-handle=2468 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:3108
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BCCD721F146078521C1094B82571F865 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\libmlt-6.dll

Filesize
6.0MB

MD5
0758eea456b6349ca6931d61f99bfc61

SHA1
76524329e6030940f5172b7f165dd385c2c3b3de

SHA256
66583e410c0595a13f7ce086c5ca35ca467c2aa7542194b865c839167155ce6e

SHA512
e50623d5e90ed8e47aafb6e958dbfa14d7f6b85c8bd9057856a2f8561eb33ba7ddb9f71e53f158cddcd1fcc0a4c8a430152889b7ed7b70d8b8da047f40f22e28

Download Submit
C:\Users\Public\ncsofts_hr.exe

Filesize
100KB

MD5
8bcefca8ab5a7c325bd46bb3eb569863

SHA1
f173f394812c623ec4c268df367963f3a3f6e0a2

SHA256
114f8cf2eebf94a4aa20d9fdf1ad3bb95e7827d78684556f4c6004c88d03eb40

SHA512
02ce18517404a2189fdc2cadb5254d783f08760864127ab288fb4eb23dfeaf22e6d6e4aef1a5b6e8bbbec8dd75f370e5d91246f22183864373fc70bfa4b57116

Download Submit
C:\users\public\libmlt-6.dll

Filesize
6.0MB

MD5
0758eea456b6349ca6931d61f99bfc61

SHA1
76524329e6030940f5172b7f165dd385c2c3b3de

SHA256
66583e410c0595a13f7ce086c5ca35ca467c2aa7542194b865c839167155ce6e

SHA512
e50623d5e90ed8e47aafb6e958dbfa14d7f6b85c8bd9057856a2f8561eb33ba7ddb9f71e53f158cddcd1fcc0a4c8a430152889b7ed7b70d8b8da047f40f22e28

Download Submit
C:\users\public\×Ö½ÚÌø¶¯2023ÄêµÚÒ»¼¾¶ÈÔÚÕÐ¸ÚÎ».pdf

Filesize
286KB

MD5
c280eadf6b75c94b77e5ad5c5b914013

SHA1
c42d2112faa42e65e8cefaa702fe07e1a11af81e

SHA256
24d61fa0c3a0a3cab7be888770dc5205acd35ab71406f9572e43eb79cf2cf370

SHA512
88fb4685831df2e881e02ba8912661ffa48820d8e02305d8e447d3a2148ef6bb293fc3072080874999eacda0d3a15a1164a615bbf8b9ef6bfcf5ec276df49e99

Download Submit
memory/3796-137-0x00007FFF24F90000-0x00007FFF25E45000-memory.dmp

Filesize
14.7MB

Download
memory/3796-138-0x00007FFF24F90000-0x00007FFF25E45000-memory.dmp

Filesize
14.7MB

Download
memory/3796-139-0x00007FFF24F90000-0x00007FFF25E45000-memory.dmp

Filesize
14.7MB

Download
memory/3796-140-0x00007FFF24F90000-0x00007FFF25E45000-memory.dmp

Filesize
14.7MB

Download
memory/3796-142-0x0000000002E60000-0x0000000003260000-memory.dmp

Filesize
4.0MB

Download
memory/3796-143-0x00007FFF24F90000-0x00007FFF25E45000-memory.dmp

Filesize
14.7MB

Download