gh0strat | 5be1288b17f208477e60a1a398e42fb718f1767e7f79e2979996c79192e5e775

Analysis

max time kernel
302s
max time network
311s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
27-08-2023 16:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WPS-0A6AB1D6FA31sshortcuts-custom.exe
Size

67.7MB
MD5

c01e7f9022cd6d91aa06881229383f31
SHA1

631b5ba15d4fe42b812436b8f12ee33018219d34
SHA256

5be1288b17f208477e60a1a398e42fb718f1767e7f79e2979996c79192e5e775
SHA512

21a3933e1776676960557cb092cc3bf8bd1037287053767a18b47f04580308a46355f199c1fe97c8b8a813491d58f769040c96d97a2b7a9c6dca397cf91ef45f
SSDEEP

1572864:83Mo59ulmbjAa91+FggUhx2HI+8h1QYkXmj6hbBeCVCqU:83/0QAau1qw88XmOBeuxU

Score

10^/10

gh0strat aspackv2 evasion persistence rat trojan upx

Malware Config

Signatures

Gh0st RAT payload 17 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1780-754-0x0000000002B50000-0x0000000002B6B000-memory.dmp	family_gh0strat
behavioral2/memory/1780-782-0x0000000002B50000-0x0000000002B6B000-memory.dmp	family_gh0strat
behavioral2/memory/1780-815-0x0000000003480000-0x0000000003983000-memory.dmp	family_gh0strat
behavioral2/memory/1780-819-0x0000000003480000-0x0000000003983000-memory.dmp	family_gh0strat
behavioral2/memory/1780-826-0x0000000003B20000-0x0000000004023000-memory.dmp	family_gh0strat
behavioral2/memory/1780-884-0x0000000003B20000-0x0000000004023000-memory.dmp	family_gh0strat
behavioral2/memory/1780-1008-0x00000000068A0000-0x0000000006DA3000-memory.dmp	family_gh0strat
behavioral2/memory/1780-1089-0x00000000068A0000-0x0000000006DA3000-memory.dmp	family_gh0strat
behavioral2/memory/4812-1092-0x0000000005170000-0x0000000005673000-memory.dmp	family_gh0strat
behavioral2/memory/4812-1134-0x0000000005170000-0x0000000005673000-memory.dmp	family_gh0strat
behavioral2/memory/4900-1143-0x0000000002B10000-0x0000000002B2B000-memory.dmp	family_gh0strat
behavioral2/memory/4900-1146-0x0000000002B10000-0x0000000002B2B000-memory.dmp	family_gh0strat
behavioral2/memory/4812-1147-0x0000000005B90000-0x0000000006093000-memory.dmp	family_gh0strat
behavioral2/memory/4900-1211-0x0000000003180000-0x0000000003683000-memory.dmp	family_gh0strat
behavioral2/memory/4900-1269-0x0000000002B10000-0x0000000002B2B000-memory.dmp	family_gh0strat
behavioral2/memory/4812-1271-0x0000000005B90000-0x0000000006093000-memory.dmp	family_gh0strat
behavioral2/memory/4900-1274-0x0000000003180000-0x0000000003683000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

TaskLoad.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TaskLoad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TaskLoad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TaskLoad.exe

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Verifier\QaLRMY	aspack_v212_v242
C:\Verifier\PGExKMSO	aspack_v212_v242

Executes dropped EXE 7 IoCs

Processes:

WsTaskLoad.exeTaskLoad.exeTaskLoad.exeQQMusic.exeQQMusic.exeWallPaper.exeWallPaper.exe

pid process

3292 WsTaskLoad.exe
1780 TaskLoad.exe
3996 TaskLoad.exe
4812 QQMusic.exe
1232 QQMusic.exe
4900 WallPaper.exe
3852 WallPaper.exe

pid	process
3292	WsTaskLoad.exe
1780	TaskLoad.exe
3996	TaskLoad.exe
4812	QQMusic.exe
1232	QQMusic.exe
4900	WallPaper.exe
3852	WallPaper.exe

Loads dropped DLL 64 IoCs

Processes:

WPS-0A6AB1D6FA31sshortcuts-custom.exeMsiExec.exeMsiExec.exeWsTaskLoad.exeTaskLoad.exeTaskLoad.exeQQMusic.exeQQMusic.exeWallPaper.exeWallPaper.exe

pid	process
192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
4744	MsiExec.exe
4744	MsiExec.exe
4744	MsiExec.exe
4744	MsiExec.exe
4744	MsiExec.exe
4280	MsiExec.exe
4280	MsiExec.exe
4280	MsiExec.exe
192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
3292	WsTaskLoad.exe
3292	WsTaskLoad.exe
3292	WsTaskLoad.exe
3292	WsTaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
3996	TaskLoad.exe
3996	TaskLoad.exe
3996	TaskLoad.exe
3996	TaskLoad.exe
4812	QQMusic.exe
4812	QQMusic.exe
4812	QQMusic.exe
4812	QQMusic.exe
4812	QQMusic.exe
4812	QQMusic.exe
4812	QQMusic.exe
4812	QQMusic.exe
4812	QQMusic.exe
4812	QQMusic.exe
4812	QQMusic.exe
4812	QQMusic.exe
4812	QQMusic.exe
1232	QQMusic.exe
1232	QQMusic.exe
1232	QQMusic.exe
1232	QQMusic.exe
1232	QQMusic.exe
1232	QQMusic.exe
1232	QQMusic.exe
1232	QQMusic.exe
1232	QQMusic.exe
1232	QQMusic.exe
1232	QQMusic.exe
1232	QQMusic.exe
1232	QQMusic.exe
4900	WallPaper.exe
4900	WallPaper.exe
4900	WallPaper.exe
4900	WallPaper.exe
4900	WallPaper.exe
4900	WallPaper.exe
4900	WallPaper.exe
4900	WallPaper.exe
4900	WallPaper.exe
4900	WallPaper.exe
4900	WallPaper.exe
4900	WallPaper.exe
4900	WallPaper.exe
3852	WallPaper.exe
3852	WallPaper.exe

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1780-751-0x0000000002B50000-0x0000000002B6B000-memory.dmp	upx
behavioral2/memory/1780-754-0x0000000002B50000-0x0000000002B6B000-memory.dmp	upx
behavioral2/memory/1780-782-0x0000000002B50000-0x0000000002B6B000-memory.dmp	upx
behavioral2/memory/1780-811-0x0000000003480000-0x0000000003983000-memory.dmp	upx
behavioral2/memory/1780-815-0x0000000003480000-0x0000000003983000-memory.dmp	upx
behavioral2/memory/1780-819-0x0000000003480000-0x0000000003983000-memory.dmp	upx
behavioral2/memory/1780-822-0x0000000003B20000-0x0000000004023000-memory.dmp	upx
behavioral2/memory/1780-826-0x0000000003B20000-0x0000000004023000-memory.dmp	upx
behavioral2/memory/1780-884-0x0000000003B20000-0x0000000004023000-memory.dmp	upx
behavioral2/memory/4812-961-0x0000000002550000-0x0000000002589000-memory.dmp	upx
behavioral2/memory/4812-964-0x0000000002550000-0x0000000002589000-memory.dmp	upx
behavioral2/memory/1232-967-0x00000000021B0000-0x00000000021E9000-memory.dmp	upx
behavioral2/memory/1780-1001-0x00000000068A0000-0x0000000006DA3000-memory.dmp	upx
behavioral2/memory/1780-1008-0x00000000068A0000-0x0000000006DA3000-memory.dmp	upx
behavioral2/memory/4812-1056-0x0000000002550000-0x0000000002589000-memory.dmp	upx
behavioral2/memory/4812-1057-0x0000000002550000-0x0000000002589000-memory.dmp	upx
behavioral2/memory/4812-1058-0x0000000002550000-0x0000000002589000-memory.dmp	upx
behavioral2/memory/4812-1060-0x0000000002550000-0x0000000002589000-memory.dmp	upx
behavioral2/memory/4900-1070-0x0000000002AB0000-0x0000000002ADE000-memory.dmp	upx
behavioral2/memory/4900-1073-0x0000000002AB0000-0x0000000002ADE000-memory.dmp	upx
behavioral2/memory/4900-1074-0x0000000002AB0000-0x0000000002ADE000-memory.dmp	upx
behavioral2/memory/1780-1089-0x00000000068A0000-0x0000000006DA3000-memory.dmp	upx
behavioral2/memory/4812-1092-0x0000000005170000-0x0000000005673000-memory.dmp	upx
behavioral2/memory/4812-1134-0x0000000005170000-0x0000000005673000-memory.dmp	upx
behavioral2/memory/3852-1136-0x00000000007E0000-0x000000000080E000-memory.dmp	upx
behavioral2/memory/4900-1143-0x0000000002B10000-0x0000000002B2B000-memory.dmp	upx
behavioral2/memory/4900-1146-0x0000000002B10000-0x0000000002B2B000-memory.dmp	upx
behavioral2/memory/4812-1147-0x0000000005B90000-0x0000000006093000-memory.dmp	upx
behavioral2/memory/4900-1211-0x0000000003180000-0x0000000003683000-memory.dmp	upx
behavioral2/memory/4900-1262-0x0000000002AB0000-0x0000000002ADE000-memory.dmp	upx
behavioral2/memory/4900-1269-0x0000000002B10000-0x0000000002B2B000-memory.dmp	upx
behavioral2/memory/4812-1271-0x0000000005B90000-0x0000000006093000-memory.dmp	upx
behavioral2/memory/4900-1274-0x0000000003180000-0x0000000003683000-memory.dmp	upx

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

rundll32.exerundll32.exeQQMusic.exeTaskLoad.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Windows\CurrentVersion\Run = "yes"	QQMusic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Windows\CurrentVersion\Run = "yes"	TaskLoad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

WPS-0A6AB1D6FA31sshortcuts-custom.exeTaskLoad.exemsiexec.exeWPS-0A6AB1D6FA31sshortcuts-custom.exeWallPaper.exe

description	ioc	process
File opened (read-only)	\??\N:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\G:	TaskLoad.exe
File opened (read-only)	\??\S:	TaskLoad.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\W:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\S:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\N:	TaskLoad.exe
File opened (read-only)	\??\R:	TaskLoad.exe
File opened (read-only)	\??\W:	WallPaper.exe
File opened (read-only)	\??\T:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\H:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\R:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\U:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\M:	WallPaper.exe
File opened (read-only)	\??\T:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\M:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\E:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\L:	TaskLoad.exe
File opened (read-only)	\??\A:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\L:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\O:	WallPaper.exe
File opened (read-only)	\??\P:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\I:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\U:	TaskLoad.exe
File opened (read-only)	\??\Y:	WallPaper.exe
File opened (read-only)	\??\H:	WallPaper.exe
File opened (read-only)	\??\J:	WallPaper.exe
File opened (read-only)	\??\K:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\V:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\X:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\Z:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\Q:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	TaskLoad.exe
File opened (read-only)	\??\Q:	TaskLoad.exe
File opened (read-only)	\??\X:	TaskLoad.exe
File opened (read-only)	\??\Z:	TaskLoad.exe
File opened (read-only)	\??\G:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\W:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\Z:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\Y:	TaskLoad.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	TaskLoad.exe
File opened (read-only)	\??\R:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\T:	WallPaper.exe
File opened (read-only)	\??\U:	WallPaper.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	TaskLoad.exe
File opened (read-only)	\??\L:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\X:	WallPaper.exe
File opened (read-only)	\??\N:	WPS-0A6AB1D6FA31sshortcuts-custom.exe
File opened (read-only)	\??\Z:	WallPaper.exe

Drops file in Windows directory 12 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\{7F0A5FEA-05D4-4164-AC2D-3D5459106702}\WPS_Installer.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF311.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF69D.tmp	msiexec.exe
File created	C:\Windows\Installer\{7F0A5FEA-05D4-4164-AC2D-3D5459106702}\WPS_Installer.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF44A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7F0A5FEA-05D4-4164-AC2D-3D5459106702}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA7.tmp	msiexec.exe
File created	C:\Windows\Installer\e59f0cf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59f0cf.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 4 IoCs

evasion

Processes:

QQMusic.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Control Panel\Desktop	QQMusic.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Control Panel\Desktop\DpiScalingVer = "1018"	QQMusic.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Control Panel\Desktop\Win8DpiScaling = "1"	QQMusic.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Control Panel\Desktop\LogPixels = "96"	QQMusic.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe

Modifies registry class 2 IoCs

Processes:

TaskLoad.exeQQMusic.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	TaskLoad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	QQMusic.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exeWsTaskLoad.exeTaskLoad.exe

pid	process
4012	msiexec.exe
4012	msiexec.exe
3292	WsTaskLoad.exe
3292	WsTaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe
1780	TaskLoad.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exeWPS-0A6AB1D6FA31sshortcuts-custom.exe

description	pid	process
Token: SeSecurityPrivilege	4012	msiexec.exe
Token: SeCreateTokenPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeAssignPrimaryTokenPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeLockMemoryPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeIncreaseQuotaPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeMachineAccountPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeTcbPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeSecurityPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeTakeOwnershipPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeLoadDriverPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeSystemProfilePrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeSystemtimePrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeProfSingleProcessPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeIncBasePriorityPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeCreatePagefilePrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeCreatePermanentPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeBackupPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeRestorePrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeShutdownPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeDebugPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeAuditPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeSystemEnvironmentPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeChangeNotifyPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeRemoteShutdownPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeUndockPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeSyncAgentPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeEnableDelegationPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeManageVolumePrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeImpersonatePrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeCreateGlobalPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeCreateTokenPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeAssignPrimaryTokenPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeLockMemoryPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeIncreaseQuotaPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeMachineAccountPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeTcbPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeSecurityPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeTakeOwnershipPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeLoadDriverPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeSystemProfilePrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeSystemtimePrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeProfSingleProcessPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeIncBasePriorityPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeCreatePagefilePrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeCreatePermanentPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeBackupPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeRestorePrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeShutdownPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeDebugPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeAuditPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeSystemEnvironmentPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeChangeNotifyPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeRemoteShutdownPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeUndockPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeSyncAgentPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeEnableDelegationPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeManageVolumePrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeImpersonatePrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeCreateGlobalPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeCreateTokenPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeAssignPrimaryTokenPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeLockMemoryPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeIncreaseQuotaPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe
Token: SeMachineAccountPrivilege	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WPS-0A6AB1D6FA31sshortcuts-custom.exe

pid process

192 WPS-0A6AB1D6FA31sshortcuts-custom.exe
192 WPS-0A6AB1D6FA31sshortcuts-custom.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

msiexec.exeWPS-0A6AB1D6FA31sshortcuts-custom.exeWsTaskLoad.exeTaskLoad.exeQQMusic.exeWallPaper.exe

description	pid	process	target process
PID 4012 wrote to memory of 4744	4012	msiexec.exe	MsiExec.exe
PID 4012 wrote to memory of 4744	4012	msiexec.exe	MsiExec.exe
PID 4012 wrote to memory of 4744	4012	msiexec.exe	MsiExec.exe
PID 192 wrote to memory of 4704	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe	WPS-0A6AB1D6FA31sshortcuts-custom.exe
PID 192 wrote to memory of 4704	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe	WPS-0A6AB1D6FA31sshortcuts-custom.exe
PID 192 wrote to memory of 4704	192	WPS-0A6AB1D6FA31sshortcuts-custom.exe	WPS-0A6AB1D6FA31sshortcuts-custom.exe
PID 4012 wrote to memory of 4280	4012	msiexec.exe	MsiExec.exe
PID 4012 wrote to memory of 4280	4012	msiexec.exe	MsiExec.exe
PID 4012 wrote to memory of 4280	4012	msiexec.exe	MsiExec.exe
PID 4012 wrote to memory of 3292	4012	msiexec.exe	WsTaskLoad.exe
PID 4012 wrote to memory of 3292	4012	msiexec.exe	WsTaskLoad.exe
PID 4012 wrote to memory of 3292	4012	msiexec.exe	WsTaskLoad.exe
PID 3292 wrote to memory of 1780	3292	WsTaskLoad.exe	TaskLoad.exe
PID 3292 wrote to memory of 1780	3292	WsTaskLoad.exe	TaskLoad.exe
PID 3292 wrote to memory of 1780	3292	WsTaskLoad.exe	TaskLoad.exe
PID 1780 wrote to memory of 3996	1780	TaskLoad.exe	TaskLoad.exe
PID 1780 wrote to memory of 3996	1780	TaskLoad.exe	TaskLoad.exe
PID 1780 wrote to memory of 3996	1780	TaskLoad.exe	TaskLoad.exe
PID 1780 wrote to memory of 4812	1780	TaskLoad.exe	QQMusic.exe
PID 1780 wrote to memory of 4812	1780	TaskLoad.exe	QQMusic.exe
PID 1780 wrote to memory of 4812	1780	TaskLoad.exe	QQMusic.exe
PID 4812 wrote to memory of 1232	4812	QQMusic.exe	QQMusic.exe
PID 4812 wrote to memory of 1232	4812	QQMusic.exe	QQMusic.exe
PID 4812 wrote to memory of 1232	4812	QQMusic.exe	QQMusic.exe
PID 4812 wrote to memory of 4956	4812	QQMusic.exe	rundll32.exe
PID 4812 wrote to memory of 4956	4812	QQMusic.exe	rundll32.exe
PID 4812 wrote to memory of 4956	4812	QQMusic.exe	rundll32.exe
PID 4812 wrote to memory of 4756	4812	QQMusic.exe	rundll32.exe
PID 4812 wrote to memory of 4756	4812	QQMusic.exe	rundll32.exe
PID 4812 wrote to memory of 4756	4812	QQMusic.exe	rundll32.exe
PID 4812 wrote to memory of 4900	4812	QQMusic.exe	WallPaper.exe
PID 4812 wrote to memory of 4900	4812	QQMusic.exe	WallPaper.exe
PID 4812 wrote to memory of 4900	4812	QQMusic.exe	WallPaper.exe
PID 4900 wrote to memory of 3852	4900	WallPaper.exe	WallPaper.exe
PID 4900 wrote to memory of 3852	4900	WallPaper.exe	WallPaper.exe
PID 4900 wrote to memory of 3852	4900	WallPaper.exe	WallPaper.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

TaskLoad.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TaskLoad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TaskLoad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TaskLoad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	TaskLoad.exe

C:\Users\Admin\AppData\Local\Temp\WPS-0A6AB1D6FA31sshortcuts-custom.exe
"C:\Users\Admin\AppData\Local\Temp\WPS-0A6AB1D6FA31sshortcuts-custom.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:192

C:\Users\Admin\AppData\Local\Temp\WPS-0A6AB1D6FA31sshortcuts-custom.exe
"C:\Users\Admin\AppData\Local\Temp\WPS-0A6AB1D6FA31sshortcuts-custom.exe" /i "C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\XXXXXXXXX.msi" AI_EUIMSI=1 APPDIR="C:\Users\Admin\AppData\Roaming\WSP Desktop" SECONDSEQUENCE="1" CLIENTPROCESSID="192" CHAINERUIPROCESSID="192Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" PRIMARYFOLDER="APPDIR" ROOTDRIVE="F:\" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\WPS-0A6AB1D6FA31sshortcuts-custom.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1692912169 " TARGETDIR="F:\" AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\AppData\Local\Temp\WPS-0A6AB1D6FA31sshortcuts-custom.exe" AI_INSTALL="1"
2⤵
- Enumerates connected drives
PID:4704

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4012

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 2F90CA54DD7AA07D80EFCA9E6DA059E7 C
2⤵
- Loads dropped DLL
PID:4744

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A738483329F38724721AC59D828E4515
2⤵
- Loads dropped DLL
PID:4280

C:\Users\Admin\AppData\Roaming\WSP Desktop\WsTaskLoad.exe
"C:\Users\Admin\AppData\Roaming\WSP Desktop\WsTaskLoad.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3292

C:\Users\Public\Documents\TaskLoad.exe
C:\Users\Public\Documents\TaskLoad.exe
3⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1780

C:\Users\Public\Documents\TaskLoad.exe
"C:\Users\Public\Documents\TaskLoad.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3996

C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe
"C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4812

C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe
"C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,32
5⤵
- Adds Run key to start application
PID:4956

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,32
5⤵
- Adds Run key to start application
PID:4756

C:\Users\Public\Documents\RECSLLE.BIN\WallPaper.exe
"C:\Users\Public\Documents\RECSLLE.BIN\WallPaper.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:4900

C:\Users\Public\Documents\RECSLLE.BIN\WallPaper.exe
"C:\Users\Public\Documents\RECSLLE.BIN\WallPaper.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3852

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e59f0d0.rbs

Filesize
54KB

MD5
313c0a6c726b9da988493b59832558d4

SHA1
78d3146e3a7eb476f1113f28bb3a962381635949

SHA256
96cbec760d47d3bfaafe9e884dd5a74863ffa4eaf422efea984917647f7470a5

SHA512
ce864b2513e2741ac1a94d23b50a1ee9968a4a919336a5da3efddd925f7fc059a8507b82f4af9a04adf4f85106358e9072be42e055a96bb6096dc3607d46f75f

Download Submit
C:\ProgramData\vcruntime140.dll

Filesize
78KB

MD5
1b171f9a428c44acf85f89989007c328

SHA1
6f25a874d6cbf8158cb7c491dcedaa81ceaebbae

SHA256
9d02e952396bdff3abfe5654e07b7a713c84268a225e11ed9a3bf338ed1e424c

SHA512
99a06770eea07f36abc4ae0cecb2ae13c3acb362b38b731c3baed045bf76ea6b61efe4089cd2efac27701e9443388322365bdb039cd388987b24d4a43c973bd1

Download Submit
C:\SkySky\_1.dll

Filesize
44KB

MD5
d3aa0ddbe70c03c83718687c7b457f2b

SHA1
f67cd39ec5aec879b604dfe3bc005e173d339749

SHA256
76220671d937a57e8aebd6c1a81d26dc8bbbfa6468c182c5a119fdd5590bb0d1

SHA512
f964c5c284dd90900352b7551a52472d294353739900913ca71e702756eb1af423489a408d9c110353350725c4a894cbcb0bde550fe534e065e53a9f436c8dfa

Download Submit
C:\SkySky\_2

Filesize
118KB

MD5
d9a720694c95a3c56175c9bf84f79118

SHA1
c5b95a42610361a7c27767a85282eb2b9eebdf58

SHA256
e3d13178d51f49b88c7cac365cda3e78525c282660a6d16ab6136de4730c595e

SHA512
53f9e51714089ad00284bc79541cf531028fe12200eb62888d9f13d2f95dde18133b90d58db6460730aee3e93da40301cd82cddf0b04c5186b7daebc7c0d7e2a

Download Submit
C:\SkySky\_2.dll

Filesize
44KB

MD5
93d6e392d4988351d4c3700e45c02ce6

SHA1
bc0bb1f01167e15413c54a52f54b4e9b085403b4

SHA256
74163fabd8f98f96bb64216bcb9ebacbcae7d114df061a141ba1700c714ef544

SHA512
f4a8687789fa3161d18e1a09252aa0894ab14d99414482787251b9213a726105cbd123ecb12efc8ee4483a777bc0297604c52d0e22c1438a0d3182ff26f61c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_192\banner.jpg

Filesize
2KB

MD5
daf14d3480c7aa73a53415ff483b10a1

SHA1
db240a22410ac7536f5c833ca98322cca4180c3d

SHA256
0d2715e6689ea0cccc6cdfad328dab66f61df466fbbaf043cef2d05f9ad420c4

SHA512
7741a04025317179eaf14f7843f313f0e8922fd219c1d45db91e65e58229a1c948fb12120806507162d064b03dd4a45a8380210545a8a61910e622f0b3c736c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_192\dialog.jpg

Filesize
36KB

MD5
abf1076064505dee794fa7aed67252b8

SHA1
358d4e501bb3007feece82a4039cc1050f23fab4

SHA256
fb0d133f05de6aa6a7a3491ae532191a60c438b35d9ff7bfec9e63131f6f0c73

SHA512
9a4680a8d186c1d7550b5e03cbdd095b0c88b2e0249a3af75fa0253d2c9a6f0aa1dd570ecf1a273683a14e6c7b5fb11678be3da439a3bf23eab790372e96e321

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI166.tmp

Filesize
436KB

MD5
5788efa607d26332d6d7f5e6a1f6bd6f

SHA1
e7749843cc3e89bc81649087de4ad44c93d48bc6

SHA256
9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

SHA512
ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1D5.tmp

Filesize
436KB

MD5
5788efa607d26332d6d7f5e6a1f6bd6f

SHA1
e7749843cc3e89bc81649087de4ad44c93d48bc6

SHA256
9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

SHA512
ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3C.tmp

Filesize
436KB

MD5
5788efa607d26332d6d7f5e6a1f6bd6f

SHA1
e7749843cc3e89bc81649087de4ad44c93d48bc6

SHA256
9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

SHA512
ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID9.tmp

Filesize
436KB

MD5
5788efa607d26332d6d7f5e6a1f6bd6f

SHA1
e7749843cc3e89bc81649087de4ad44c93d48bc6

SHA256
9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

SHA512
ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID9.tmp

Filesize
436KB

MD5
5788efa607d26332d6d7f5e6a1f6bd6f

SHA1
e7749843cc3e89bc81649087de4ad44c93d48bc6

SHA256
9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

SHA512
ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFEA4.tmp

Filesize
436KB

MD5
5788efa607d26332d6d7f5e6a1f6bd6f

SHA1
e7749843cc3e89bc81649087de4ad44c93d48bc6

SHA256
9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

SHA512
ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

Download Submit
C:\Users\Admin\AppData\Local\Temp\shiEC89.tmp

Filesize
3.2MB

MD5
032bb369103dac02606fb919f6658f3c

SHA1
60b39428ab3493aab7babf3a1c5f2a951ae853bd

SHA256
daa61c42d53be45c7709a0b0f66a51a0a47ca84eab787e0627f6da255c96ddff

SHA512
0f1fb9bb34e699ee6d4a1dc58f99514fb1df81ad0cf37b3ffe938295a70d832a5702cec3df16d30d400c77014d09228e6d02d3e65d5d6d0f1c5e34f39d55e313

Download Submit
C:\Users\Admin\AppData\Roaming\Consys21.png

Filesize
159KB

MD5
c19e58eeb25b77a90dc1d795183025cc

SHA1
8b78faec5892cead2436b8e77b6a2f49e6149de9

SHA256
8087639cd4f3f39b1fd4779787474ccee3aecb057bc82a9922aa51436b85e44f

SHA512
5d17f1111172616b0cd404339687d62ba158f5a2d92a9d10f2c322cc88b65a5183ee0fc84af092aff51e5b9b8aff8bf6b351516e5684cc4d287dbf0fa78447b6

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\AutoMapper.dll

Filesize
122KB

MD5
4b7cd44e7afc02ad2ef1f987eaef0ae4

SHA1
4321c178ddee0734d12ea927d1bf7c6e73199a51

SHA256
12121851fc077a6e17f939aaec5d06120e95c989d05aeb7c25558330a21068fe

SHA512
2d70cba8d566422b516ca966eaa95e360acfecea78aa1fe9f7736b8683b541e6bbb92f53f07fef7b0f098aa42bdeda2fc83f7ec2a1e5bab751868c953b97363d

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\COMSupport.dll

Filesize
1.5MB

MD5
48b37006f84259bf4b5cfeeb8107a6a9

SHA1
082370428d2c52622fdef91beb2e699e941e4480

SHA256
d6208434c1db28cfb3d5b5132abd4358a39626d1bcd8a837de188d0461b9f7a2

SHA512
4e41d3cc9628fb20184463e994587c63efd42de6648087e08764cf123592b85093aefb867040062c59e8187a5f8f9b2ec6f097564396a20cb565f3255e733c33

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Finkit.ManicTime.Tracker.dll

Filesize
730KB

MD5
8d41f9852d813c6e7a8670ab60327fee

SHA1
08ee0b0e35180a6f728cad4ba29c61010f405a23

SHA256
bd32745adab2ac279aebca66cf78663343b0fa6fcefe514fad4eb9ed34123e7f

SHA512
e90f493b952f522621dbad8c4458e1d0f03d313bce6771cc61f1651b9384b0ea4d0b1915388ba9748027b11f25298033904c0f3e81fc89306456bc3894e9ae77

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Finkit\ManicTime\ManicTime.xml

Filesize
3KB

MD5
dfe8def4e493eae4ce53296cb2e035ba

SHA1
a68ed8826e8641b2913b2f5af9d0cf4ec0d9f1b1

SHA256
af0b40b517b1fd802f9e19cd6c15fd15be4e9ea259f747a8456253c7329f3792

SHA512
cf8e8176bc9e5f7b5ad7f6b0479e9b1722a5a0463277b134f873bc27fccd01f3f5d8888053ece1118e207c92b622dee1519c25549c82b2624853e44b9d4ed4c1

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\IdentityModel.OidcClient.dll

Filesize
63KB

MD5
8e96a512440ea06f260a03dfd976d70f

SHA1
5a824870432f894ceee348ee453c4fc6218e8a08

SHA256
b3c8b66b937047056a2f724c7e5f7c4f49a24d685ff26c5b43e8a7dd824a8507

SHA512
11eb38dccaeddf1bf60b929de683f1b0dd0be422553755a742845a87a0d0262b499d2af912fa17c8b1211fe996ab08e516721a50934e4c379e0b9d7d3e8aef1a

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\IdentityModel.dll

Filesize
152KB

MD5
34bd3646d71b39005877dd0f336edd92

SHA1
0fe0f6bc12eb5a99c308296d976be0e14cf86368

SHA256
3c3e9396d4ac012f329ff503c8b81bf279579f4e7e7e8c0ec0130d78ef936f8c

SHA512
2e59fca3c46ec9429e6a843514e681750789a822724482a1d96f64d68291444236752b12d3d850d5b95a35d32b622073452c0214b3da15350e73ce21bf18bab2

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Interop.UIAutomationClient.dll

Filesize
96KB

MD5
265161a814619c6db5ba1a1227bf46e7

SHA1
19f51036e714ae620832b8673b5839539a0eeae3

SHA256
33f86fb318635c9a1e9e47b1da2bc0d0e0dd5661ec7f15175b49f1f8cfd1462b

SHA512
921045e5bc958a8ef161e37d18a99d5b62dd0bf9675ecc203e72f54e5aa00649c06d52a2dd984036155e3b52970f46a8ce9c20f09f8d6c83774fafed2969a37b

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Irony.dll

Filesize
140KB

MD5
2c4a93981aa2b0f87b5ec152f857a4d2

SHA1
f94da33f34f5ac18dcf64ce0cb75b7432c688300

SHA256
915c9c314ab33b91980358c771a5923f58fba067ba630dcec18c335d9c907cd0

SHA512
fd44a8aab08a9da40dea2d92cb50183591e62e0c137ca33cf96a7a04262526339c85217957f8af87813cf308dce5457a24a3d68d3c40345506ca4380b9020379

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\ManicTime.Client.Tracker.Storage.dll

Filesize
86KB

MD5
903a0f4a344c5dedf3738c047b98df27

SHA1
96c0a48e75c1cc9d9a5eb9f06327cfa929d31858

SHA256
4a1a41276e19b7c002b2797f9cc4a1a88ed06f0d66d6285f3bd4f7429c01e2ed

SHA512
53e4fecca73e32002526f51d43b2f5372df7121ac443777d5448892153c8c3d31f73c6051f5af86611df957329d8733240539a8ec63f99146c7a04a3327a0e6a

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\ManicTime.Client.XmlSerializers.dll

Filesize
94KB

MD5
76a20d82ea4cbbf83776a109aeb060d0

SHA1
68bbcb0e68491453e96d8a6c4cd1800ac4f6b5b1

SHA256
c8e1392bab8b8168187f78957cc57831b02024541d5992fb7f33a74be55f50df

SHA512
12e0c2d728f954b0c55d5b9dd5bd9a11553851ea40c0d73f370df63ff506db8c13a150193bcc54f8e6c945176685ba72d235e8de7814b7181e781c43eae101ee

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\ManicTime.exe

Filesize
62KB

MD5
c8a0d91a249231899a689a5b78fb5f56

SHA1
3ed12276299b04c8fe00c81d5d3537b219e5ba2e

SHA256
96e9e97b88e0bb78dcb1b2d9fd8cc02e61c08b26621e9e9e1ce712ad83cce07c

SHA512
3d5abf84cdd984047eb1f1c7720bb0bfcf189fdba9929ff63c9f5df9ce3df5f7fa9cf6ccae5fbaaade48842c73c744b58c63e42581a8e2794708ff8b926ebbf1

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Microsoft.Data.Sqlite.dll

Filesize
132KB

MD5
603033db1596e175d0c613fcfead9498

SHA1
496fa1a4e1f6ce18440c2d41b1a653b1a36dafa6

SHA256
bf26c8bcbbffefc348117486066b2ec82007104762e4b1f87395688ef2a528a0

SHA512
5c3bd097c7838285ab756c564246a456073aff1b063f5b8b367852e6dea1c03d9dbe0aa42b0d7c84c1081fe71b1e4f7d3b64226b01d3ed23a7ec1c8bbffb75e7

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Microsoft.Extensions.Logging.dll

Filesize
31KB

MD5
b7f13cb30356dbe3e3bf7c01e2d8c7b1

SHA1
712900d638167a85017ab7f99119964d84e0a39f

SHA256
9cb78661a77fbbae56de368f018ac9b06e6a171dab37e49091ac4abc4a3d1126

SHA512
6df9337d590adb72df002cd64005a59f60ba064b2ae2d207559f0b43c9c8978ae75b22115556f0f4e7567b7b7862b99fe069ec92b3c98752623636bea92d1bb5

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Microsoft.Extensions.Options.dll

Filesize
42KB

MD5
d195309528f364dfacd3bae393ea08b8

SHA1
763721aa95eb354fe7cb88ac5eadbf6d854bc5cb

SHA256
123766d210b9793ce76c2779fa87b3c8fe122a526faa6d46841cf7cf6e5495ff

SHA512
332578fc59e8c518a0e45957d20a9a491b7d6d7567c1655c2f2fa5535450d2d9238b7937ba26b1eb271335e0dd605cb64768ac875eb0901692d021acb1e344d1

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Microsoft.IdentityModel.Logging.dll

Filesize
30KB

MD5
86d5a91d68243c23e579a3b8eac41550

SHA1
2ae697ab1c17776204ad8f008319d0c01ac9f8c7

SHA256
9bd601d9de072f0537b03f8aeb32af224d721283c02a27e854960385ee497da4

SHA512
2a09850207247e8bf43604486f1ff580f8855913d5eb195911c38169abed9f18f761a98731c4e2fc021d40b62013dd194fc603e98f6a01ff2b15b57b3f1a79dc

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Microsoft.IdentityModel.Tokens.dll

Filesize
136KB

MD5
209cbf182b7d380ab95f5ad5a094c388

SHA1
06f5753bdc544a96ee1592a622c0cbdd3b6747c8

SHA256
df2849431a7f0390af4bc9f733d5788a08f9798c0094bfb8efd43fe13c901304

SHA512
58213c7dde68ec1d252bcf546c7741d7d631b944ffdf7ca8793435a1666abfc7b1bf4db218a670fe225814ed3f570c9934bc144dc8a2d07c58a5e07d61d8d9dc

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Microsoft.Win32.Registry.dll

Filesize
22KB

MD5
19f29a6b64646c9f8827d1801c0c911d

SHA1
be06e28f44eba5ec35ece10daabaeaffdd27c54d

SHA256
013526957b1c4b9bae4500d1cbeb2db0279173086db40d72716e0af9fe9161a1

SHA512
ef3f61372e43e989dcf66aad4855edd19b7b9703bcc457158db30d68b2f43639ae304161b49eb951ce3f074c261ecfc168dd98b15a6e8919236e14632cff9b26

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.Client.Core\Lib\ClientPlugins.Core.dll

Filesize
34KB

MD5
b7617c1cc8709d153bfa98999fd52142

SHA1
2013f5a34b9c41cd401a2a2240e86f80414bf241

SHA256
1cf721ddfbbc82026851287746ff41c29557c560d2f4fdf9d5f9cdcf4ed7a17a

SHA512
93a9e5f592a69bd40b419ffb274cee2c6cc4c5faa83ebee9935c29c52184fdaa33dafa865bd1572fa41bee46ff0070459317cd70e9b337bca40c76f914ee843e

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.Common.Core\Lib\CommonPlugins.Core.dll

Filesize
18KB

MD5
c36fb96168945d126b91df1022831bff

SHA1
0f297965ed507d5ae7e84387db54d6fddbc11a03

SHA256
8ed4518099a8892891fb3b686d928eb2bad461a70e5f3f128023bab0cc95b88e

SHA512
92d0ab52cb3dc4fb6022a2c11530e38359419e23391a7e9d136d4c4f88708d0bb715dd896bb70e34c0bf526a21595915b3c4bd2adf47b98bdf3d3365153b404b

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.DocumentTracker.Acrobat\PluginIcon.png

Filesize
1KB

MD5
7049a9bea7f237c31661bc48c5d61cf9

SHA1
caef3fa9b2cce81d0bb4b5126c23a71a5a9c6aea

SHA256
0a8829dfa5c01a1d9d8a8c3a16074689c9d02cbb3f7191ccfbda514a30f80a05

SHA512
6bbeff8a48d7cba39f774e0de69935b42243a79adcfb7de2eca52e3c07e9f5ae6d21e7321633014afb709468ffa36cbf62406f1be33be821946ecc71464aa4b1

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.DocumentTracker.AutoCAD\PluginIcon.png

Filesize
1KB

MD5
2b73243394b1c24ee40b91bc4d3bf87a

SHA1
a0056cce1f979f1190d29750aef2850198de1def

SHA256
81cb034723f8b22939be5102680911a4cb939c88b0a0ab82b948d086f674ea3f

SHA512
75ed7837dfb11c962da76e1650e00bf466f3e6a67fa7f26a84cde504a065e9e7ad21ecd22e7611bd6754a00a86e89dde88bf87a1c802d0dc5ed2b04dca9b2901

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.DocumentTracker.CustomTitle\Lib\CustomTitle.txt

Filesize
5KB

MD5
3e3a1e90bdd86718f6891b76dc02ba45

SHA1
5b1eebdefba30115ce88b2bab74637202b12a045

SHA256
7052d7d230af7e382403af39a3c2cc2a0d32c5ba41329f54452874bd95d6a25b

SHA512
c4cfb0cc1698b1421cd42e6a04010680d61f3cdab7db04c98ecc8457ca4da0ad8a0ed863d0038b17bf897fdcf0515517a4256f46726e48b626a3b4a2c5e2dcfb

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.DocumentTracker.CustomTitle\Lib\ExtensionBlocks.dll

Filesize
174KB

MD5
a825426741f09532d132dea4766e979c

SHA1
16b6a064f6cf7f18f605c02321ea70e731bf74b2

SHA256
f55af5713434ca518a5bef41f70fcc392fd9978bf575bb266b5b062f9777ac69

SHA512
112cf54551bac8aab32ef1a542f602a377a33fcfd873ef291de3750a4e9c99de79e4c3079a729c6308d7265b6424768ea0139e197cdaeb1ef37361bb1ce8a9f0

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.DocumentTracker.CustomTitle\Lib\GuidMapping.dll

Filesize
33KB

MD5
179b9d2ddb1935703e94d37e07e23132

SHA1
1f03b687c7eafad647908d881e0387dd76aee2cb

SHA256
3817f70a59f70c36d8f0d0080518c1e6b6d77741d69ab6bdded483ce7199c7ac

SHA512
d923c36a732fadfa99128595e8ffdf4ef15faf89318f59ec43e81d58ce467843e0227c4c2fb1613c4ef45faab3ad76c25b9f8b7a74748f272f434360d3b5dc5b

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.DocumentTracker.CustomTitle\Lib\JumpList.dll

Filesize
52KB

MD5
ec95110d53096aee0e122c8f78bc651c

SHA1
69152f5602ea4bbe646446893b6141cdd3691e29

SHA256
76ad01724b2a135fc86a25d85c10e51a38176468f284ae1d6ef8815b39697139

SHA512
ee0706eb65d5ee7bdd9353c8ed6a96edcfbf1291f48c59de1eb8c344aa94c63ead75634b9cc1ffe20e7a9ce500a8a45d43927d4aceeba14ec2c3711457e943b6

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.DocumentTracker.CustomTitle\Lib\Lnk.dll

Filesize
75KB

MD5
a176ca10e956ecfbdf8a0f93e67484d7

SHA1
dc27c4cff4ba49bb9856ca55cd4030c8504108c4

SHA256
44a84fe04435df567a94153b0f39385fb4ad55c490f752afad64788cd5b801bd

SHA512
8edde1829caac766ddae3d0a1f7dd9decc55af2036ff583f647582d6bb047d05dd70367cb72e32a3cf90a1ac9b477719f2d4cb30700b4832406555bfbe73513f

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.DocumentTracker.CustomTitle\Lib\OleCf.dll

Filesize
14KB

MD5
cfe993e47ad0441cdb1badea59f5f707

SHA1
44cc4c8bd9082c9c403dcf839f5be691c79d2796

SHA256
4bb0bbbaec87facc19ee493da87ed0a5d75964d961acb81d5af9e11e913885da

SHA512
73cc255b9ec7ade529ee10b9495e5566c117aebb640f56f6a15933a523196c7e14d524450d7199dbb8a24baed721729d4199089fd9139c3fc4b9396422cc555f

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.DocumentTracker.Firefox\Lib\UIAComWrapper.dll

Filesize
181KB

MD5
e0066fc59cf8adca01f26b943d15a7cb

SHA1
6ca380019b7ae97aff97a0c04cb1abb041fde0c2

SHA256
34dd032ac0a9b03f72488cf2f6f4e5127c5c137187ee50bf7de8fef530762081

SHA512
f110b375fdb43e7fbbedf353b491a2e88c7265fa554ad453d1ed01c4ebc87014bbab7e4f383489ef62398e5b7ad11b9b2aca08831d9563acd9c65e2aa75ec5db

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.DocumentTracker.InternetExplorer10\Lib\Interop.SHDocVw.dll

Filesize
150KB

MD5
32ad330414d7104f1df583b7665cfa42

SHA1
79dfbef856dd76af96843abfe2a289220958534d

SHA256
b33d9c915e65111b1a1f0818927029b7794497f4a13ba1d3f4d623797dd0d82e

SHA512
d4c049c0693ec6f7bfd9eeaddc78b6a0d51babe3ee907de185c12e1d2896ce2d40fa55be09f4b021def67dd027d0d1b8e1acd25a1feacf66c1812801b73efad2

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.DocumentTracker.InternetExplorer10\PluginIcon.png

Filesize
1KB

MD5
fc88759a580bce4b854194478b240c6d

SHA1
996056c603671848b49fcaa958db466c1585d3f4

SHA256
daaaab9f33162dcad9aff79205983122b9349dd77d61762a469e794b72751d36

SHA512
f02e2463c2711beaabd4ad305d50536f3a912a5f009492f6416207225f88e659833e98839a80aefe3d53deb36e2a2fdcbb10d46ec62dc3a2b71dfee5ab816504

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.DocumentTracker.InternetExplorer\PluginIcon.png

Filesize
2KB

MD5
ca03f1c7261ab2551134e856e389864f

SHA1
2e69757ef89ca433aef58389cc2fd952f8c5b5ba

SHA256
4ebf8a369c5ca38fb19c07879a86a7912f6d334ce77a9701bf0b4d09959a9b5f

SHA512
572e4ba08c89319eca23bd8dfa8e851554a9073463c3ba72d81efc9ec4defed1f409eb35f78a8145d63f51666d9d41592ef7dc23539ca0ff39073b12a551626d

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.DocumentTracker.Opera\Lib\NDde.dll

Filesize
108KB

MD5
c1c7beb5231bb058c1a669a05b8701ca

SHA1
38ed866828314ad9df5ce325b65bbfffe0841bde

SHA256
98ef49a6ed42c420d8d2c93da0bcb1decc91cd0ed83a7ad3595f353be03e1491

SHA512
b48dfef6323f5538807cec4623188298b50cdb5c0bdb911f41726455d22f73d33260677d30ddbedeea441631889db48d6b04856eeb18f4e57922ec790ff4b856

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.DocumentTracker.Opera\PluginIcon.png

Filesize
1KB

MD5
11a61cb737bb57897ee24e3b3e10b716

SHA1
52e8a719814c7b973ab595137c6312ef3316a847

SHA256
8d141f0204ef745075e7f12f65588150bf467460287f1077dc692018a496a7af

SHA512
4afba63dd3ea5fb04647c21ec07f3cb5ce0b7d757f6340e37b63912ba82134545505d02b019624c9179a2ea5683b8fed971bbafbf70265f00e03c6a496888036

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.DocumentTracker.Powerpoint\PluginIcon.png

Filesize
1KB

MD5
c82e32f0450244b1a39cf5712f22d358

SHA1
85d3719d14d4f244f4086bec4b6d7f4674efe52a

SHA256
1fff30d8855580c86a2ad53da75624bb2f78c1ef0e2605834f9c1dc8a353e47f

SHA512
2cd6a6e6562b5fda5c89274d82569ea9eeaf7e16e2a460856ea86da1440552ba0892e041bf1c8f1a00e3d79935a37a5560857014137f1f36579405c7776c57bb

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.DocumentTracker.RobotStructuralAnalysis\PluginIcon.png

Filesize
4KB

MD5
53c7d5619787ffbde53208a73abb34dc

SHA1
bd5e669bf8d88733a8c15832e8b1518662b52bd3

SHA256
f8eac7123f6231e26ae29b70450c3d0549d004978bc0191d99ad584e6f724e5f

SHA512
a1481fcf33c5f822c6b12627c4ad194e48c0ead9ef9004e19c2c9d9b56cc9e26281f689984ec7f6587d18f75d7b61beb96b0983ffc520e87b224c7ec8bdbdd54

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.DocumentTracker.Socket\Lib\Newtonsoft.Json.dll

Filesize
653KB

MD5
1f478e39a4c06ea7c6dce92238f23ec1

SHA1
c1ceafe3fa14e099c9782058cf598686361902fd

SHA256
b9b4e633ea6c728bad5f7cbbef7f8b842f7e10181731dbe5ec3cd995a6f60287

SHA512
a192e7b5b67259128cf7a901e549722903230618c0e10215f802e22fe9362339f8ce5482b729a28fc284670d984b2b79fc4d5f10e37a2e734a61200dbcffe859

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.DocumentTracker.Socket\PluginIcon.png

Filesize
3KB

MD5
38f3669b08448f2f7112ef6ce001d769

SHA1
9896758e7b43293cff2c7ed03c027285a18db522

SHA256
b412a5e761cf6eb5769c889af97c033cdabc03b8f2bfd756252ff725f97d2c9f

SHA512
4b869de8f7deab2fdaf80026a8bca3fcf35d5fe6b0bdd0062f2866f07fd516d791064eb1e6b93e544270fc3df214d98290abfbb2e50195239c72b8fa17040c37

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.Timeline.GoogleCalendar\Lib\Google.Apis.Auth.PlatformServices.dll

Filesize
5KB

MD5
5bf2a88769c3bf129e13007803854143

SHA1
130f9f7297a641f0adc725b15d54c6665690eb49

SHA256
908d19444565a98334c45e209238d9b6bbcb12b5b884edea19beac14a560ec48

SHA512
b370c3b3f1c8426210a1f5c4c49f6ecc990991c19fee305a0f6cd27afc0bc4bdc8bb81359e1ee55d25923ac52b9b6a7735f53861a956642faa584b15772fffe3

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.Timeline.GoogleCalendar\Lib\Google.Apis.Auth.dll

Filesize
111KB

MD5
dd1f0f85f7d30a2757cf0ca6fa500d06

SHA1
2b13e2e93fd1219cedc202825590ff96169bcc8b

SHA256
12eb5a40f89273fccc37978f63e8355f25ee29ab0ce018f2f515bc8c2ee0e29a

SHA512
723cbbd52e8d36f86b6056cd1494463bd467037d425fb26c9ac155dcca3d6951e36fb2abd2d4c62ab1c6f8391dfe410a15793b0336bcb0b8700d7e3cd768e730

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.Timeline.GoogleCalendar\Lib\Google.Apis.Calendar.v3.dll

Filesize
91KB

MD5
150a89108cff558168ba4b873cbe406b

SHA1
bf00feea16f5e5d0a29eabfc318fb1a9687434fc

SHA256
25da74f675dd659b5342b69b613b9c6902c03a11cb2148458b9af4da17bf13cb

SHA512
079e7d3779e276b7356e2574281509a35a17727b02113f3d411b8027e0de13f2665faec1a3d9a62defffd8cddf85cb9230d14db0fb9c713b00ebfbb9c9d09796

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.Timeline.GoogleCalendar\Lib\Google.Apis.Core.dll

Filesize
66KB

MD5
c3040ca8f29ca90c270332d938494af9

SHA1
53946f96c4d5a72760110a94f52badfd4c854227

SHA256
92bb45009d37ae2bcaabcce99d7e86fbe28ed5e2c8085d09323de0e82568c12c

SHA512
bbf863f66b1e2620d150027dc7b87d4097535630a4409a2ab6bbe8ff93387401234ef201cdb875dc0edfcb4bd71e53cf5c62a8ba120dc9801ce2680355988de9

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.Timeline.GoogleCalendar\Lib\Google.Apis.PlatformServices.dll

Filesize
4KB

MD5
873275b5ea9100e9a0256c24476ebc28

SHA1
0455b8de4fede13739bbc3ea3c8e96b9f8d6a508

SHA256
22c6b3114f0357ca66251174c23d44a71be39ad324b9d2880af7eeee7d9b2eb8

SHA512
be4cd3ba72ccb3add2574736befe62378a838815a2ec7584f9914a04e259d63c633718fc29807d95a42e56249f256408a79fabc7c5181742690c0f17675be474

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.Timeline.GoogleCalendar\Lib\Google.Apis.dll

Filesize
73KB

MD5
e98ea5f14448ef05ca1b8ad9d72dae83

SHA1
63d69160c3014d35b54416e32bff53043855baa7

SHA256
a1769c145ea8761b3f9050e8adc412052c422c3eff014f2294777c75a7aa3ad4

SHA512
ed693cf0b8fa817a053f59404a7cd5f05d86e6b4eb823ad099823c8977c3529631429463d296aeaeebf68784ca794b945b7ba0318c8b55d270985404559d4a4d

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\Plugins\Packages\ManicTime.Timeline.WebSource\Lib\ClientPlugins.Timelines.WebSource.dll

Filesize
41KB

MD5
9f57c33e57444af7ce81378b7d9cad32

SHA1
733f1aeb8e322a36b5427300b94039b8153dd909

SHA256
3eba44cb2c72c239fc642fa849fdf73a59b62bc5262b063b15a883a34984babb

SHA512
a9d1b61b0d02bc167a30d4bafaa2f2f3b8640faa14139c07071a8325b0a5c661b2bb26fb734929c066bf109b9dd9f3c0e3488fccd8c02b1566c7dc0282c5bb26

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\PublicDocumentsFolder\COMSupport.dll

Filesize
1.5MB

MD5
48b37006f84259bf4b5cfeeb8107a6a9

SHA1
082370428d2c52622fdef91beb2e699e941e4480

SHA256
d6208434c1db28cfb3d5b5132abd4358a39626d1bcd8a837de188d0461b9f7a2

SHA512
4e41d3cc9628fb20184463e994587c63efd42de6648087e08764cf123592b85093aefb867040062c59e8187a5f8f9b2ec6f097564396a20cb565f3255e733c33

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\PublicDocumentsFolder\tdata\0C4C5B331E3883CBs

Filesize
140B

MD5
b76a827933b2bc861e01f14922153c4d

SHA1
4bdaad89c24e4a1e4c2442948726d8acc3e87924

SHA256
5afcd1bd66f561279e29a26a06bec083fd075ce67035ccc79ac18bc7544f777d

SHA512
82e2a590183c61b9eab93f853a802c6667afb3b22391abfd72caf3df1e2d9483e89885e8a9345ccedd68cb6702ed60db720f25eb167399efd28efdec070d7958

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\XXXXXXXXX.msi

Filesize
1.6MB

MD5
3c932bfa721ad55c547040080bdd2e6d

SHA1
b3492acd56b12b4e7e658b1a5eaa00a022d4f5ad

SHA256
c06b6054b0eb9d35c3a2c28f449da2fa6afb92b27a49232a01e3bcac78a2d3e5

SHA512
fea065720a33bddfdcbee5d8295f20ddc41cf577978884ae06281fbd6039efec9aca3de27c5c6fad025cd6e36c10cea72eae8163a0b59ef381423957de708939

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\9106702\XXXXXXXXX.msi

Filesize
1.6MB

MD5
3c932bfa721ad55c547040080bdd2e6d

SHA1
b3492acd56b12b4e7e658b1a5eaa00a022d4f5ad

SHA256
c06b6054b0eb9d35c3a2c28f449da2fa6afb92b27a49232a01e3bcac78a2d3e5

SHA512
fea065720a33bddfdcbee5d8295f20ddc41cf577978884ae06281fbd6039efec9aca3de27c5c6fad025cd6e36c10cea72eae8163a0b59ef381423957de708939

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\decoder.dll

Filesize
205KB

MD5
31daf181536165ef11461c18d98d04da

SHA1
9310a5837eb30fd3994f644b9913a88f945c4f98

SHA256
0e38b521210b476057892fa2085ee60d1fb79b8c77cceffdaa0e2ef5d63b0f09

SHA512
b10f62e3c1fec62c17ef00234c4f8c6fa1937cf2a3f63a1439fefe1daee3699135486fc303d1dc3b7e75d90048cf65300d3e0ded0b7d336ea08e9c9696ad6131

Download Submit
C:\Users\Admin\AppData\Roaming\WSP Desktop\WsTaskLoad.exe

Filesize
2.0MB

MD5
faf4a129b091a57c3ff694dc721d4f3b

SHA1
7430935f501164b46b99766ed9ab68da0db50c24

SHA256
b1d13ed7409ca47f47d200f6b26d8da6a07e645ef49ddc9a28486f46bb8c41e7

SHA512
0103d9bfa27c809f978a2ac805e5eb59e07f0f0eef8aecf2713d8af1bff0d54fbc24043435cb67f550d5afdd6f0a2bc5c0026b6e920efe2ad21b619bbfbb0583

Download Submit
C:\Users\Admin\AppData\Roaming\apple\Runlnk.lnk

Filesize
930B

MD5
7a4c454547bce440cf0cc17519f94a09

SHA1
b9e8ccc237325acfe9757716b7829272a4583b97

SHA256
30d0dd9d67950840af633ed1401b65fded2623b2a832c23886445b9d77c1ef8b

SHA512
e2fb576f82d13bc044056f9afede6c1a70a9b797701cd11f56820ef3e73c258fca1439aac8bf712584c38491e213ab998b22faa373b36a3b515da350da04929a

Download Submit
C:\Users\Public\Documents\RECSLLE.BIN\_1

Filesize
83KB

MD5
6f12798e2a0ced431388cb13e8d236fc

SHA1
133603eea4d3cb11a79be2a270e9325ecd70857d

SHA256
b6df9f2dd085e96fc1369442e2312c6f47ddd12ab77b103cfabb89bd167cea73

SHA512
044e7a7a76269003ac3c11ee9b08d5f157dabe6d6d3662982ad3fd028b5b025bf59ec69a1397f7597f2a4ef3f23afdd601e07a86b4b06d3a3f6beb14f14cd184

Download Submit
C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe

Filesize
623KB

MD5
d9746c8d55bed7b372ccef704f96ddda

SHA1
61c6b8ba9108fc7617264bb7d58e163457946e5b

SHA256
afbfea15784c32277edf9d4c985d210c5c46baef46db1c6bed2d2a964d2b70fd

SHA512
e00d687bd7cee039c6eddddab2b89e26136f842bda19630de53220f3459a73a4bd2ba0c76267b977e265d7cdf98d21cd94d327fa143477a427ccd0a5fd57910e

Download Submit
C:\Users\Public\Documents\RECSLLE.BIN\system\Test.dll

Filesize
48KB

MD5
a38ba3a961f1363adad79bd246cf8a72

SHA1
215685b1c6ce8376268b23dd67632719ebff38b8

SHA256
c2e584914e4c621c401465598547fc48953d8209978b57ad78c75e36625f0ab2

SHA512
7eaf3bbb8dc0fdcc6b950a1053a0cd08f8e52384dad2b1fac2193dccd7cbef77a358661c57d671e32e65669137f1a62e78a6d234030267fd31513e2771711c1c

Download Submit
C:\Users\Public\Documents\RECSLLE.BIN\system\_3.dll

Filesize
48KB

MD5
6bcbad2eaa5921108fdeb1cfc561fb14

SHA1
e17c6e3338d266a89f5884e64b94abf76bea5bab

SHA256
0dc305824cca9bca3e44110bc0bd102644ec3d8d95bb014839bb00208bb77953

SHA512
a89bbafdedc2a56da8f9495b0883132327b693dba23d9241036fa4665816b20f48f576bfc64f2d9acb26af219c337188179df4031523ca98baf15bcf3cfd4957

Download Submit
C:\Users\Public\Documents\RECSLLE.BIN\system\fntestdll.dll

Filesize
108KB

MD5
4dc3df2173419a275c92f56724b450ff

SHA1
633f9ea02f758c52b39633ae595e962954e2d68b

SHA256
8b7e6d8c7851bff5d8b70016b834262f466ae57011f1449c3efed8a5c3f08704

SHA512
603ad1fd521e678dea0ea9a438c053601f4b0ef34982f883b3ef7e859ca4f7a5d5ed95bb5b1ad86ea57c74f0ff9ed831dcbf3591114ec859ad2df88495e3822a

Download Submit
C:\Verifier\PGExKMSO

Filesize
64KB

MD5
fc9ae1671b31f2b6c4e8c3b766e67053

SHA1
e649a4aeb70dbdea6395485cfb12be0a683bdaaf

SHA256
3ef0769a7dbfe812ce3ae05fc2010d3a153c3a1ed7ea6834fde726d51e8be018

SHA512
a0033ebf6306870ea62213dae329f29e064cdae3e7556a542487d4be309a21ae3e0067cf67a4d4c307113227fa5e640b7f917042f488b1b4fbf938fe25b96716

Download Submit
C:\Verifier\QaLRMY

Filesize
58KB

MD5
d3061f1f67664394011febe9f53664f2

SHA1
b0353a66c1d481cb7c49e2f2037de40fcb6a91dc

SHA256
bbd6380dc9652016eea5163fdfb933add8c3e06a88b627ec66007d19f549d4c8

SHA512
88bf39d51c5701acaa9d4117498df35937b96bed9910c09ed9f6f29eb453a115b4504689bbaddb88fef3dd70ea51ce2b3c05ffe33654cf5aa659a5f88e600777

Download Submit
C:\Windows\Installer\MSIF311.tmp

Filesize
436KB

MD5
5788efa607d26332d6d7f5e6a1f6bd6f

SHA1
e7749843cc3e89bc81649087de4ad44c93d48bc6

SHA256
9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

SHA512
ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

Download Submit
C:\Windows\Installer\MSIF44A.tmp

Filesize
436KB

MD5
5788efa607d26332d6d7f5e6a1f6bd6f

SHA1
e7749843cc3e89bc81649087de4ad44c93d48bc6

SHA256
9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

SHA512
ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

Download Submit
C:\Windows\Installer\MSIF69D.tmp

Filesize
575KB

MD5
8c1a778e0754301c97a660dbf3e8303b

SHA1
f489c45cde796de0d23ee862948f5e50379dee60

SHA256
000b773a448b107cbf3268fea3a0eec388daa71c5f911979c5d21f0cd8d6da54

SHA512
010e76ed659f73cc263ce9b2d2635d775b296c10e53ba133fba6aacde02ed409b19f4c4e2ba6df7730ddc8669c818e99773f25854a1916ccf8acf9e459482fea

Download Submit
\Users\Admin\AppData\Local\Temp\MSI166.tmp

Filesize
436KB

MD5
5788efa607d26332d6d7f5e6a1f6bd6f

SHA1
e7749843cc3e89bc81649087de4ad44c93d48bc6

SHA256
9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

SHA512
ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

Download Submit
\Users\Admin\AppData\Local\Temp\MSI1D5.tmp

Filesize
436KB

MD5
5788efa607d26332d6d7f5e6a1f6bd6f

SHA1
e7749843cc3e89bc81649087de4ad44c93d48bc6

SHA256
9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

SHA512
ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

Download Submit
\Users\Admin\AppData\Local\Temp\MSI3C.tmp

Filesize
436KB

MD5
5788efa607d26332d6d7f5e6a1f6bd6f

SHA1
e7749843cc3e89bc81649087de4ad44c93d48bc6

SHA256
9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

SHA512
ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

Download Submit
\Users\Admin\AppData\Local\Temp\MSID9.tmp

Filesize
436KB

MD5
5788efa607d26332d6d7f5e6a1f6bd6f

SHA1
e7749843cc3e89bc81649087de4ad44c93d48bc6

SHA256
9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

SHA512
ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

Download Submit
\Users\Admin\AppData\Local\Temp\MSIFEA4.tmp

Filesize
436KB

MD5
5788efa607d26332d6d7f5e6a1f6bd6f

SHA1
e7749843cc3e89bc81649087de4ad44c93d48bc6

SHA256
9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

SHA512
ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

Download Submit
\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\decoder.dll

Filesize
205KB

MD5
31daf181536165ef11461c18d98d04da

SHA1
9310a5837eb30fd3994f644b9913a88f945c4f98

SHA256
0e38b521210b476057892fa2085ee60d1fb79b8c77cceffdaa0e2ef5d63b0f09

SHA512
b10f62e3c1fec62c17ef00234c4f8c6fa1937cf2a3f63a1439fefe1daee3699135486fc303d1dc3b7e75d90048cf65300d3e0ded0b7d336ea08e9c9696ad6131

Download Submit
\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\decoder.dll

Filesize
205KB

MD5
31daf181536165ef11461c18d98d04da

SHA1
9310a5837eb30fd3994f644b9913a88f945c4f98

SHA256
0e38b521210b476057892fa2085ee60d1fb79b8c77cceffdaa0e2ef5d63b0f09

SHA512
b10f62e3c1fec62c17ef00234c4f8c6fa1937cf2a3f63a1439fefe1daee3699135486fc303d1dc3b7e75d90048cf65300d3e0ded0b7d336ea08e9c9696ad6131

Download Submit
\Users\Admin\AppData\Roaming\WSP Desktop\WSP Desktop 4.1.0\install\decoder.dll

Filesize
205KB

MD5
31daf181536165ef11461c18d98d04da

SHA1
9310a5837eb30fd3994f644b9913a88f945c4f98

SHA256
0e38b521210b476057892fa2085ee60d1fb79b8c77cceffdaa0e2ef5d63b0f09

SHA512
b10f62e3c1fec62c17ef00234c4f8c6fa1937cf2a3f63a1439fefe1daee3699135486fc303d1dc3b7e75d90048cf65300d3e0ded0b7d336ea08e9c9696ad6131

Download Submit
\Windows\Installer\MSIF311.tmp

Filesize
436KB

MD5
5788efa607d26332d6d7f5e6a1f6bd6f

SHA1
e7749843cc3e89bc81649087de4ad44c93d48bc6

SHA256
9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

SHA512
ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

Download Submit
\Windows\Installer\MSIF44A.tmp

Filesize
436KB

MD5
5788efa607d26332d6d7f5e6a1f6bd6f

SHA1
e7749843cc3e89bc81649087de4ad44c93d48bc6

SHA256
9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

SHA512
ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

Download Submit
\Windows\Installer\MSIF69D.tmp

Filesize
575KB

MD5
8c1a778e0754301c97a660dbf3e8303b

SHA1
f489c45cde796de0d23ee862948f5e50379dee60

SHA256
000b773a448b107cbf3268fea3a0eec388daa71c5f911979c5d21f0cd8d6da54

SHA512
010e76ed659f73cc263ce9b2d2635d775b296c10e53ba133fba6aacde02ed409b19f4c4e2ba6df7730ddc8669c818e99773f25854a1916ccf8acf9e459482fea

Download Submit
memory/1232-967-0x00000000021B0000-0x00000000021E9000-memory.dmp

Filesize
228KB

Download
memory/1232-968-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1780-1001-0x00000000068A0000-0x0000000006DA3000-memory.dmp

Filesize
5.0MB

Download
memory/1780-782-0x0000000002B50000-0x0000000002B6B000-memory.dmp

Filesize
108KB

Download
memory/1780-822-0x0000000003B20000-0x0000000004023000-memory.dmp

Filesize
5.0MB

Download
memory/1780-819-0x0000000003480000-0x0000000003983000-memory.dmp

Filesize
5.0MB

Download
memory/1780-815-0x0000000003480000-0x0000000003983000-memory.dmp

Filesize
5.0MB

Download
memory/1780-884-0x0000000003B20000-0x0000000004023000-memory.dmp

Filesize
5.0MB

Download
memory/1780-746-0x00000000029E0000-0x0000000002AF3000-memory.dmp

Filesize
1.1MB

Download
memory/1780-751-0x0000000002B50000-0x0000000002B6B000-memory.dmp

Filesize
108KB

Download
memory/1780-1008-0x00000000068A0000-0x0000000006DA3000-memory.dmp

Filesize
5.0MB

Download
memory/1780-754-0x0000000002B50000-0x0000000002B6B000-memory.dmp

Filesize
108KB

Download
memory/1780-758-0x0000000000400000-0x000000000060E000-memory.dmp

Filesize
2.1MB

Download
memory/1780-1089-0x00000000068A0000-0x0000000006DA3000-memory.dmp

Filesize
5.0MB

Download
memory/1780-742-0x0000000000A80000-0x0000000000BEC000-memory.dmp

Filesize
1.4MB

Download
memory/1780-743-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/1780-811-0x0000000003480000-0x0000000003983000-memory.dmp

Filesize
5.0MB

Download
memory/1780-826-0x0000000003B20000-0x0000000004023000-memory.dmp

Filesize
5.0MB

Download
memory/3292-745-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/3292-744-0x0000000000400000-0x000000000060E000-memory.dmp

Filesize
2.1MB

Download
memory/3292-737-0x0000000002B30000-0x0000000002C43000-memory.dmp

Filesize
1.1MB

Download
memory/3292-736-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/3292-735-0x0000000000BE0000-0x0000000000D4C000-memory.dmp

Filesize
1.4MB

Download
memory/3852-1136-0x00000000007E0000-0x000000000080E000-memory.dmp

Filesize
184KB

Download
memory/3852-1338-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/3996-948-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/3996-935-0x0000000000BD0000-0x0000000000D3C000-memory.dmp

Filesize
1.4MB

Download
memory/4812-960-0x0000000002040000-0x000000000204D000-memory.dmp

Filesize
52KB

Download
memory/4812-954-0x00000000005E0000-0x00000000005ED000-memory.dmp

Filesize
52KB

Download
memory/4812-1060-0x0000000002550000-0x0000000002589000-memory.dmp

Filesize
228KB

Download
memory/4812-953-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4812-1326-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4812-1271-0x0000000005B90000-0x0000000006093000-memory.dmp

Filesize
5.0MB

Download
memory/4812-952-0x00000000004E0000-0x00000000004FE000-memory.dmp

Filesize
120KB

Download
memory/4812-956-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4812-955-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4812-961-0x0000000002550000-0x0000000002589000-memory.dmp

Filesize
228KB

Download
memory/4812-1058-0x0000000002550000-0x0000000002589000-memory.dmp

Filesize
228KB

Download
memory/4812-1147-0x0000000005B90000-0x0000000006093000-memory.dmp

Filesize
5.0MB

Download
memory/4812-957-0x00000000005F0000-0x00000000005FC000-memory.dmp

Filesize
48KB

Download
memory/4812-958-0x00000000005F0000-0x00000000005FC000-memory.dmp

Filesize
48KB

Download
memory/4812-1057-0x0000000002550000-0x0000000002589000-memory.dmp

Filesize
228KB

Download
memory/4812-1092-0x0000000005170000-0x0000000005673000-memory.dmp

Filesize
5.0MB

Download
memory/4812-1056-0x0000000002550000-0x0000000002589000-memory.dmp

Filesize
228KB

Download
memory/4812-1134-0x0000000005170000-0x0000000005673000-memory.dmp

Filesize
5.0MB

Download
memory/4812-964-0x0000000002550000-0x0000000002589000-memory.dmp

Filesize
228KB

Download
memory/4900-1069-0x0000000000BC0000-0x0000000000BCD000-memory.dmp

Filesize
52KB

Download
memory/4900-1074-0x0000000002AB0000-0x0000000002ADE000-memory.dmp

Filesize
184KB

Download
memory/4900-1073-0x0000000002AB0000-0x0000000002ADE000-memory.dmp

Filesize
184KB

Download
memory/4900-1143-0x0000000002B10000-0x0000000002B2B000-memory.dmp

Filesize
108KB

Download
memory/4900-1146-0x0000000002B10000-0x0000000002B2B000-memory.dmp

Filesize
108KB

Download
memory/4900-1070-0x0000000002AB0000-0x0000000002ADE000-memory.dmp

Filesize
184KB

Download
memory/4900-1067-0x0000000000BA0000-0x0000000000BAC000-memory.dmp

Filesize
48KB

Download
memory/4900-1066-0x0000000000BA0000-0x0000000000BAC000-memory.dmp

Filesize
48KB

Download
memory/4900-1064-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/4900-1211-0x0000000003180000-0x0000000003683000-memory.dmp

Filesize
5.0MB

Download
memory/4900-1065-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/4900-1262-0x0000000002AB0000-0x0000000002ADE000-memory.dmp

Filesize
184KB

Download
memory/4900-1269-0x0000000002B10000-0x0000000002B2B000-memory.dmp

Filesize
108KB

Download
memory/4900-1062-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/4900-1274-0x0000000003180000-0x0000000003683000-memory.dmp

Filesize
5.0MB

Download
memory/4900-1063-0x0000000000B90000-0x0000000000B9D000-memory.dmp

Filesize
52KB

Download
memory/4900-1336-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/4900-1061-0x0000000000B20000-0x0000000000B3E000-memory.dmp

Filesize
120KB

Download