Analysis
- max time kernel
148s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
22/06/2024, 02:28
Static task
static1
Behavioral task
behavioral1
Sample
PPT_WPS-offce_WIN64.msi
Resource
win7-20240611-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
PPT_WPS-offce_WIN64.msi
Resource
win10-20240611-en
windows10-1703-x64
20 signatures
150 seconds
Behavioral task
behavioral3
Sample
PPT_WPS-offce_WIN64.msi
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral4
Sample
PPT_WPS-offce_WIN64.msi
Resource
win11-20240508-en
windows11-21h2-x64
25 signatures
150 seconds
General
- Target PPT_WPS-offce_WIN64.msi
- Size 221.7MB
- Sample240622-cx13maxdpj
- SHA256 d20a66f15530e9d2dbc74567d30a8b839f0b5a68f43387aaf16291802ebd0049
- MD5 53f11fae029ba9f5a52fec5c2bf9e557
- SHA1 0ce4a7c39af2e032a67a6bc79b31f16e847b8905
- SHA512 1005e01c25852f93f57c27542637f950b31cf0b1adf2196a6acd32fa6cde6e194b13de7c92a9f87c1096004f3c8cd78546df3fdbc1d6b8632dfd825c7dbbd62f
- SSDEEP 6291456:oA+yp7dYWsihZpr8/xcdeGgx+nsKlZUqSQHzCDm:Iyb9sifZe1xdKlRVmD
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files\Windows Defenderr\5 msiexec.exe File created C:\Program Files\Windows Defenderr\librdkafka.dll msiexec.exe File created C:\Program Files\Windows Defenderr\1 msiexec.exe File created C:\Program Files\Windows Defenderr\TrackerUI.sys MsiExec.exe File opened for modification C:\Program Files\Windows Defenderr\TrackerUI.sys MsiExec.exe File created C:\Program Files\Windows Defenderr\Phone.exe MsiExec.exe File created C:\Program Files\Windows Defenderr\lop.exe MsiExec.exe File created C:\Program Files\Windows Defenderr\2 msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{3C963879-488B-4A1C-BB5D-DF7EFE72A13D} msiexec.exe File opened for modification C:\Windows\Installer\MSI8D7B.tmp msiexec.exe File created C:\Windows\Installer\e57889d.msi msiexec.exe File created C:\Windows\Installer\e578899.msi msiexec.exe File opened for modification C:\Windows\Installer\e578899.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Executes dropped EXE 4 IoCs
pid Process 4292 lop.exe 1640 Phone.exe 1092 lop.exe 3884 lop.exe - Loads dropped DLL 17 IoCs
pid Process 4292 lop.exe 4292 lop.exe 1092 lop.exe 1092 lop.exe 1092 lop.exe 1092 lop.exe 1092 lop.exe 1092 lop.exe 1092 lop.exe 1092 lop.exe 1092 lop.exe 1092 lop.exe 1092 lop.exe 1092 lop.exe 1092 lop.exe 1092 lop.exe 1092 lop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
pid Process 3772 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c9712a8ab103c3e30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c9712a8a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900c9712a8a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc9712a8a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c9712a8a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsiExec.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1092 lop.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4888 msiexec.exe 4888 msiexec.exe 1640 Phone.exe 1640 Phone.exe 4292 lop.exe 4292 lop.exe 1092 lop.exe 1092 lop.exe 3884 lop.exe 3884 lop.exe 3884 lop.exe 3884 lop.exe 3884 lop.exe 3884 lop.exe 1092 lop.exe 1092 lop.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1092 lop.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3772 msiexec.exe Token: SeIncreaseQuotaPrivilege 3772 msiexec.exe Token: SeSecurityPrivilege 4888 msiexec.exe Token: SeCreateTokenPrivilege 3772 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3772 msiexec.exe Token: SeLockMemoryPrivilege 3772 msiexec.exe Token: SeIncreaseQuotaPrivilege 3772 msiexec.exe Token: SeMachineAccountPrivilege 3772 msiexec.exe Token: SeTcbPrivilege 3772 msiexec.exe Token: SeSecurityPrivilege 3772 msiexec.exe Token: SeTakeOwnershipPrivilege 3772 msiexec.exe Token: SeLoadDriverPrivilege 3772 msiexec.exe Token: SeSystemProfilePrivilege 3772 msiexec.exe Token: SeSystemtimePrivilege 3772 msiexec.exe Token: SeProfSingleProcessPrivilege 3772 msiexec.exe Token: SeIncBasePriorityPrivilege 3772 msiexec.exe Token: SeCreatePagefilePrivilege 3772 msiexec.exe Token: SeCreatePermanentPrivilege 3772 msiexec.exe Token: SeBackupPrivilege 3772 msiexec.exe Token: SeRestorePrivilege 3772 msiexec.exe Token: SeShutdownPrivilege 3772 msiexec.exe Token: SeDebugPrivilege 3772 msiexec.exe Token: SeAuditPrivilege 3772 msiexec.exe Token: SeSystemEnvironmentPrivilege 3772 msiexec.exe Token: SeChangeNotifyPrivilege 3772 msiexec.exe Token: SeRemoteShutdownPrivilege 3772 msiexec.exe Token: SeUndockPrivilege 3772 msiexec.exe Token: SeSyncAgentPrivilege 3772 msiexec.exe Token: SeEnableDelegationPrivilege 3772 msiexec.exe Token: SeManageVolumePrivilege 3772 msiexec.exe Token: SeImpersonatePrivilege 3772 msiexec.exe Token: SeCreateGlobalPrivilege 3772 msiexec.exe Token: SeBackupPrivilege 3700 vssvc.exe Token: SeRestorePrivilege 3700 vssvc.exe Token: SeAuditPrivilege 3700 vssvc.exe Token: SeBackupPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeDebugPrivilege 1640 Phone.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe Token: SeRestorePrivilege 4888 msiexec.exe Token: SeTakeOwnershipPrivilege 4888 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3772 msiexec.exe 3772 msiexec.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1092 lop.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4888 wrote to memory of 1448 4888 msiexec.exe 87 PID 4888 wrote to memory of 1448 4888 msiexec.exe 87 PID 4888 wrote to memory of 3648 4888 msiexec.exe 89 PID 4888 wrote to memory of 3648 4888 msiexec.exe 89 PID 4888 wrote to memory of 3648 4888 msiexec.exe 89 PID 3648 wrote to memory of 4292 3648 MsiExec.exe 90 PID 3648 wrote to memory of 4292 3648 MsiExec.exe 90 PID 3648 wrote to memory of 4292 3648 MsiExec.exe 90 PID 3648 wrote to memory of 1640 3648 MsiExec.exe 91 PID 3648 wrote to memory of 1640 3648 MsiExec.exe 91 PID 3648 wrote to memory of 1640 3648 MsiExec.exe 91 PID 4292 wrote to memory of 1092 4292 lop.exe 92 PID 4292 wrote to memory of 1092 4292 lop.exe 92 PID 4292 wrote to memory of 1092 4292 lop.exe 92 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\PPT_WPS-offce_WIN64.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3772
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1448
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 69617F21C5D6E05872620CB6AEDA19772⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Program Files\Windows Defenderr\lop.exe"C:\Program Files\Windows Defenderr\lop.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\ProgramData\kingsoft\20240622_22944\lop.exe"C:\ProgramData\kingsoft\20240622_22944\lop.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1092
-
-
-
C:\Program Files\Windows Defenderr\Phone.exe"C:\Program Files\Windows Defenderr\Phone.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3700
-
C:\ProgramData\kingsoft\20240622_22944\lop.exe"C:\ProgramData\kingsoft\20240622_22944\lop.exe" -downpower -msgwndname=wpssetup_message_E57A623 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e57a299\1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e57889c.rbs
- Size 8KB
- SHA256 5fdd9592ef979141fc9a4a6b000a1ee348da084e08210006bdb4a4c1fd79e414
- MD5 9b934e0067df69575cb34af53fc802fe
- SHA1 a21a76613620c45b2fc3273e7725ea841aca47bc
- SHA512 a1a45c1ba41c5d9372b5f580a2cacf8f3d3374c27a03198d897b58c59be4a4e00d13bc430ba14e3b0ec00ad9fdd810f3364c80fa05efdabae85164783420620a
- SSDEEP 96:VmNhJf6UJ9Tze2U2g69Un7TC6TlD9Un7TCsjrEF2T2j+TlmODD22AZ75W2d202Xz:4NhJf6KZzy6W7OCVW7Oy/K7l5pwF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Defenderr\1
- Size 483KB
- SHA256 cad9fcfa069fc7de9f5d2b7c66bd5c4ca714777bf5db253418a664e7723026d1
- MD5 778d517a9de9b93f02e92602f1cfcd6c
- SHA1 9e373cbc1e1cf5e1553896485d7c5701a8e89804
- SHA512 05ee9445263ee8312be7947a0b42684564a340f11052f4b2d7aa50681a74d6612675fdac8e973cb4cf84412711d4d087ffd0509e7a91f01b108253930425d5f9
- SSDEEP 12288:ec6DOfrkQNn2a6CdgphtSt2OygymUXUIU0U3YQqLWHcCy:16DOfrkQtChaYJLF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Defenderr\2
- Size 337KB
- SHA256 95763e1a2e24b815c5b370c43664ad36a85a7be0f56ccbadb4d774cf07e539c2
- MD5 7237bb75585824e0bf500d0421dfc36f
- SHA1 68fe5c01c23e0a751825e862691e838c404aec4b
- SHA512 3dc03e8a499dc9bda0598dbdaeeaedaa03dcc78a186d53e68fb06042cb24bbeba7b1183280fdb30d2b0402486b1464bfaa964c45fe4ba3fd07ce94d3c1832e75
- SSDEEP 6144:nhlipL644DIOd5gjMFOM9I5bnblpnBRRZBUkV7KNqAtPmtaU76ysB:264UmOOM9INBpnBRrBUkwq6PO76JB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\kingsoft\20240622_22944\oem.ini
- Size 300B
- SHA256 ac4222cad36842b78351bcdd9bf49450082ee99c9e99305e4c9bf05a34e59fa5
- MD5 7417a71d686d292d1fc8f8c90e954cf8
- SHA1 febfb56b3535e262dd222c9173fdac22981c9f30
- SHA512 c3cd2b48fce2127ce8582507978bda7c4d8ccbf7e79bf5cb1bbf1f2e08c888389225e0436b7a56ccc0cbd5a7362aec446b4c60444d2fd8fcdfb22735fbe6e5f9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nso9BA5.tmp\System.dll
- Size 11KB
- SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
- MD5 0063d48afe5a0cdc02833145667b6641
- SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
- SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
- SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nso9BA5.tmp\v6svc_oem.dll
- Size 192KB
- SHA256 d3378ee739debcaee8c715963403d96bf025db98bfbb55e54635429890db85c6
- MD5 500318167948bdd3ad42a40721e1a72b
- SHA1 24134691693e6d78d6eb0a0c64833c12a0090968
- SHA512 0a2d3b55528cc53cfce5b47158997300c562afd2c7bb5596532b218d3f482380887ee7c204b13d42425dc0c4cc439a7f9ed167f3767bda7b6e205e7e8f454863
- SSDEEP 1536:AanBx8ONbQ/mpe7GRkOp1qRGkmGWBhYGfxSELX/RdsbTh+u9S4A5S4n8GQMKWNwU:XbDG/GXbcRGkmGUNxBHC+VzS4n8NbULJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e57a299\CONTROL\office6\Qt5CoreKso.dll
- Size 5.0MB
- SHA256 07dbecf0fa0d79d2d4237d53e8b905677a977a3cf3c43f251cbddcc032cd6c2d
- MD5 fb71fe7c9c56be049f7f614010c7dc25
- SHA1 9076a7bbd9fdcf91486ccce76c01fc005a2b29c1
- SHA512 d76ea7c2a0a505e53b1cf675b9eca7ef0aff86f4970ab1f7c530244e15bd7095f36ba1d95066cb94b3400680cce6b991951ef4b1fa889d4a2a907d0dc758544d
- SSDEEP 98304:uvFqylfboKUAJV8i9tuCJsv6tWKFdu9C1vKl4rAi1dmXIm:uLlfbo8QCJsv6tWKFdu9C1BpdG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e57a299\CONTROL\office6\Qt5GuiKso.dll
- Size 5.3MB
- SHA256 fe999e848637dcf8f209181baf71c590197af2dbd01b30f976179fd5809bfcd6
- MD5 4f771184e9e3dfb80751cf4a9cdf0d14
- SHA1 7927a937c071762cca02fdff396d70fecdb37f6e
- SHA512 78cb877dc244d4ae504d89ab55b5f6748498db88212e3564777c34f588cb05cee69897c8c4e1ad85f95aa215fe3c581e6456530dbfd76e7dc840398687cf82a5
- SSDEEP 49152:PWfp9sdLcRaG3B2Lx8uftFvOnRyxHllqnJ+HlTupBMOHdUnUaOj61CWcqEO44J+r:2cLx8ufDQRfVpF9OXx1uDvyizh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e57a299\CONTROL\office6\Qt5SvgKso.dll
- Size 359KB
- SHA256 dfbcba58ce097a2fd3a5df4465ddecb13a1cdf5800e3bc4755170aaf25749725
- MD5 27174d74a9c1e244ad65fbf40eea0643
- SHA1 f2f509dff6f61a0e52608ab059fbad12e4ce943e
- SHA512 ff545b15571fba7ec11a33e44785afa48bc468807692a7014dc9dde184896fb9b18377313d965d0be50d3cf310b1bd957bbd1c6ee947ff2145289c4dff69f6f5
- SSDEEP 6144:ABp9iDb/IKLDIM8gQ8o4N5WFlpVMaguLLuw383GqHSg1mg6vIDsYHanwjgSjhmaf:2I/IKLDEgQ/4NIF5ouLLD83GqHSg1mg5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e57a299\CONTROL\office6\Qt5WidgetsKso.dll
- Size 4.4MB
- SHA256 0bfe39d7de0c08f8c60d746167777954575f626d041bc7c3faccaa7ef6ceb2fc
- MD5 21d93f3464ff710dc830d098d5ec11fc
- SHA1 7675af59d6d8d850e48479abac72e1b7a38966e4
- SHA512 6976407f7d06053050de378e28fbbd5715c1e5638e5c00c2b321a2e45844358c1dacf421c8fc39037b65f995b7ce3c1de2b62cd8edcbd7df9c59474ac8a1cc67
- SSDEEP 49152:AfHKfe+Ykmzw/TlUd7tEIkBJAeEI+lHba8vg3ZziQTsfEWoO9ZT9mj:Ve+Xm0/E6jWNT0Zz3TaDBmj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e57a299\CONTROL\office6\Qt5WinExtrasKso.dll
- Size 388KB
- SHA256 e6ee77a78ec2b374acc9757670e4f295948171d300fb2bf2d3e4fa702aa4f844
- MD5 fa36fc9076b51357b49635724f97c240
- SHA1 f00d8f60e24a2223b97b1c601c9239f478b155ad
- SHA512 5bf10ea6bf407dbfddd21f8be63cf52537779e8dd92b3c6f43a414fd779ea4651fde6ec2ded26b6b4b91123ce6000ac67e180845034a03746d7e546ed90d1cbf
- SSDEEP 6144:rihhnuIq8teN0RSud/VYRrHB/2MZ5QvAKfpAl0:G7nuktTRPTYRbZ+Am
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e57a299\CONTROL\office6\kpacketui.dll
- Size 1.5MB
- SHA256 de0ec3555a4764225803f50088971ea77e2499db9be1834efb35ae77d43e6fe3
- MD5 69bef4321e6d5f17e4c5eb97c69e4b09
- SHA1 5b7dba958d57d1e42a50c90d390a909fc3b3d037
- SHA512 52c0d2c44016c1c47e0d86da34dc844f8729df5cd7f769fe4bcdbf479d91b30b88489666f48177485c7e0dda8321a51748d5c7f1fbb08acf89c749fab64cba2f
- SSDEEP 24576:pLUPuDzOZ1g8x9HveHWoxQ1nZKbyMG/PzSzw+RUvH+bYJin9:pLMZ1g8HPl9nIZFR9bYJin9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e57a299\CONTROL\office6\msvcp140.dll
- Size 439KB
- SHA256 02c7259456eac8cbadfb460377ba68e98282400c7a4a9d0bf49b3313ef6d554d
- MD5 5fd0772c30a923159055e87395f96d86
- SHA1 4a20f687c84eb327e3cb7a4a60fe597666607cf3
- SHA512 132a9b969104c0a214bde3f8c6e8f754d116cecdad55224bbea7a40cffd98f4e4de503d83d92cca0aaab9ed51c9efa00ad5caed69a9eda71013598a43b161c3a
- SSDEEP 12288:6Sx/AD6CqIwoIx6/vCLTegs2icgqjNue1ArhUgiW6QR7t5s03Ooc8dHkC2esruN6:zVADBwoIx6kegs2icgqko03Ooc8dHkCW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e57a299\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
- Size 56KB
- SHA256 ab6aa9da2fb9d18729b088dc1f62c1ad3c69e76f81909e3aa2d77534c71175ec
- MD5 afb936b2c29303d29f95c9e524397855
- SHA1 97a700f7913f70736035c57aa223b5062630ba8f
- SHA512 4a07d765b2eeb9409a05b28062633675dfd98589767800a3246daff6c1ee486379c33c48d15ae9d807d70b31ddbf885671e251b823d61ca308268a564ec08fed
- SSDEEP 768:FZH6vUIyCOflbjgQJJvd/05FGTu3naFEQsx4L/X+G9EsheYi2laK8Yi2lax3hUa:baWf7vB05FAuxUP+G9ED7YY7Y43hUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e57a299\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
- Size 35KB
- SHA256 2f58c9bd2798c1b3751ce8cd0496c0809e405b1f23b3017f63ed63f35c072b29
- MD5 6f689338394967ea46bed1bf913dfc65
- SHA1 21c6c707f9d13269c90056b0f3fe6b732f43e231
- SHA512 f07a9330ddba796b645bcb9afdd7b3c0cb1b020df2c6140a57aafe00caca6e264ad3f56a27081b11e4de363d04a91a126ff24f9919e7136dc3a0e75c8477f0ac
- SSDEEP 768:pB3GmzbLjreTgoheYi2laY+Yi2la/3hmKJs:pB393LjiTgn7Ya7Y43hmR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e57a299\CONTROL\office6\qt\plugins\platforms\qwindows.dll
- Size 1.3MB
- SHA256 e57ec14808e775223cff206d176ac182f2e0d45868ab27d4cf4bb0f1a5b7ea8c
- MD5 366e2229d02a37cbf1233687c241e42f
- SHA1 2f77dc481bcf19cde45573ba8a82a27371613561
- SHA512 f4b6909a8e13f8a8dd4185667e91abf9a01f42d59c7f09859e4065cab95a35e0be4e45717c569aceeb596db88615375e6caa1e9eca421621cdcdcee87600d68c
- SSDEEP 24576:TzcYqzyMLkj6lrhpRv76NtNkHOj78gFk17GZoeOOx:HcYqvlv76NtGO9W7sOOx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e57a299\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
- Size 140KB
- SHA256 3f516ee7950d1702bf8ba5cea0d658fe5f19c0c23fdad2a005e6e4a4f28f7688
- MD5 dd329c171807ad7a4f24f872ccbcc7a4
- SHA1 1dcc214310b87c987e6dc081b4dca9c4c56844e3
- SHA512 68613efa2f26c34d90b7bddef6caa2b53f003927f8d03fc0825a8bde525dc43be95b9c4ae02cd2683cbe5b80df29a40f3515cf552f57486f831ba138c8f9ed8c
- SSDEEP 3072:eu8ecahSnIMiHojNXBAiQNMkdjpZo+pq1w7ei/x6iPWfw2ko52Cg1CXlpCKHYn18:euan+j5UOZ2ko5rNXlpCKHYnlSES
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e57a299\CONTROL\office6\ucrtbase.dll
- Size 1.1MB
- SHA256 2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359
- MD5 2040cdcd779bbebad36d36035c675d99
- SHA1 918bc19f55e656f6d6b1e4713604483eb997ea15
- SHA512 83dc3c7e35f0f83e1224505d04cdbaee12b7ea37a2c3367cb4fccc4fff3e5923cf8a79dd513c33a667d8231b1cc6cfb1e33f957d92e195892060a22f53c7532f
- SSDEEP 24576:tCjjeiNFnAp+O+R2l2WDPc/9qHrX0cJ/gAp0ei5mcvIZPoy4aVvFjDp:4jyuRR2l2WD6I/bp0erVL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e57a299\CONTROL\office6\vcruntime140.dll
- Size 81KB
- SHA256 ff9c1123cff493a8f5eacb91115611b6c1c808b30c82af9b6f388c0ef1f6b46d
- MD5 e51018e4985943c51ff91471f8906504
- SHA1 5899aaccdb692dbdffdaa35436c47d17c130cfd0
- SHA512 2fe5ddad2100aeaea35398384a440ba0be169ef429f7e0b69687bc0f8865df41bc93fc80d3a8f0ddd9df54fc2f2d76b1056a1d1962d37432704c818128ffbd74
- SSDEEP 1536:lmGzxv5o1xSEIURDbnZ/dvC5cpnHXCh5cecbvo9J/Z0:lp5o1YEIU9bnZ/A5y3Jecbvo9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e57a299\CONTROL\product.dat
- Size 52KB
- SHA256 fd675d3fb5922605e367d99bab20efd1d9e4b4ad8decf67071035d3a8976e502
- MD5 9b5715bb169c023511b3f5d07bf79602
- SHA1 1264d76ae1d5656316a5dd15d52aaf952ee3d2c5
- SHA512 46dbfc57f9abc2b6a7579cdf77ca42b53011841c60ca2aaeb359abffa47cc2f67544102af4eefbec404051f3c8fc13935272f4b9859a31680dfae24a12e6c3e9
- SSDEEP 1536:1/NG4pQlcq98IufmsW1kxc7clSAAULtyewGcu:1/N/Bqufmp1AxSANtx9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\tempinstall.ini
- Size 363B
- SHA256 90b2af69f94515f67f5c8ba104ab2ac467988da2b1b10ec6286e1a8206ce4093
- MD5 c015cc57557930d4827f975b196f84ab
- SHA1 3ce98dc12c1f588b857a9264035907319a53b995
- SHA512 0f0c0d0da53cae2a2ff91a44f2459dbc796669434ee8b6d5a2f91d27a5035fa75c3badabfecd69a0f1e2d7c2ab8428eb7f8532af21b09517b5e29865745d92ab
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\tempinstall.ini
- Size 409B
- SHA256 7fa5672cb5ed1900b611ef0485165df2702c611445d94150598fa1b3ed7c8037
- MD5 f1b6360b3db7c20534c7259929fe453b
- SHA1 7d28a8aa319aad78427484c56dd56909676ff315
- SHA512 8892854cff4900953e495374a4561853b6062d8e1ce6346ac5a9261b0f68ae970a342ff0dba5c420d04272a7aec802d894cc8b6c5c1eef561506879344122796
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
- Size 27KB
- SHA256 d3a832fbf055bb94ead0f4f687077ec7013c5ac4b49d90f428f58a19ac5b39ed
- MD5 a3b0711e52cd7bce11537ef07f7e8df6
- SHA1 5022fbeec8a22659b46a670837fdb9e3f2fd64a0
- SHA512 1b7556ee6e24a48287686aee4413d5ccdd0cd47203bf8807c0440752fb64c1a11b966393b34381bd3d707627dbf8d47f960e24143a647eb7511c56c56cde62e0
- SSDEEP 96:YUHgAiCLqkSsWYPmhdnjNTMWkWqn/P5Lx3fDEdxXk2B9OZw3wAdqQwtDDUmY/WA6:Y/vsZ8NTMWK2qXs7yH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
- Size 28KB
- SHA256 819705a7605819c090fcdce7fa6b49ee78686a278bb513295445884d9c9f3d3b
- MD5 ff1d5e091132f09643a7216f3a8a4b73
- SHA1 699299b47876f5076e26580fad100ccd136e1597
- SHA512 ccda808423965466b5a2bdb340a1919f48aa5bdfc59ef37d9a3726b801fc65bb5cf5046a346b99605a8be2f2d7252b670c9e67a44c8e80715c1ba78997e3bd04
- SSDEEP 96:YUHgAiCLqkSsWYPmhdnjNTMWkWqn/P5Lx3fDEdxXk2B9OZw3wAdqQwtDDUmY/WAM:Y/vsZ8NTMWK2qXs7yIC1mQ3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
- Size 45KB
- SHA256 c756c31328c1a377e9ad2b5bdf95ab30ae96704ad0932e71d87a6d04d1648d55
- MD5 34fe3019e159cae4253dec4a66e0d21e
- SHA1 9fc7547bc41324bebcb550ca221b8771b033dff2
- SHA512 b03502faad457a6ed7bd69c4bbe9da1c7c8e79604fdabd03f5c6b767fb6838f35f9fcd4c98be1c2108ae67f7f57ffff4e842be56c6d014d7311c2a1940237167
- SSDEEP 192:Y/vsZ8NTMWK2qXs7yIC1mQIscAaucHme1E0LKhPgM1Sl3FCR4ma652RWDYBN:B8NT8Xs7wU
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 23.7MB
- SHA256 bd937964ace5ba65b806fca359c0535b0f2670e704f04e3908f7b43cef64523f
- MD5 64efa891fdb0747dfa62e645dda0ba2c
- SHA1 f63240db0bf2edad6bbf16c2fbd28d16f2a12637
- SHA512 b493d2ddba6f3d98dfaa3c9f4f5c2b44f297a7f5bec221612f68911efb4c383ec517ba34bc9fedc90758f4cc550316effeb698a631fc15ce81750c72a0765a8e
- SSDEEP 24576:vSqm41xtdoO/vvTLE3X+gnm3UUIZlQqqDzHtZMQW6W6bWkbW4BF4rqXSA:f
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{8a2a71c9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{7809bb28-430a-42cd-8c41-1dceadacf03b}_OnDiskSnapshotProp
- Size 6KB
- SHA256 18d4afb417b878b177e1cc827724d705652c6fa553ad15f9be17fad121883806
- MD5 31896a588f18b4298f70c61ecfecf57a
- SHA1 1f55b33341344a7e9ac59e7ff64d4f43ab2add1b
- SHA512 e3696b822539015e45ca660e2ae88948d4a54420bbb6e000f4c77847d47b3c0c699c9b4dac6a8de8fcc24a7d45c99e8d7eb2f72caf57267b8d47a9bf6fcc9f42
- SSDEEP 96:FaiHaO0bec4HsDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:N90bNb++1Vm
- MD5 SHA1 SHA512 SSDEEP