gh0strat | d20a66f15530e9d2dbc74567d30a8b839f0b5a68f43387aaf16291802ebd0049

Analysis

max time kernel
150s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
22/06/2024, 02:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PPT_WPS-offce_WIN64.msi
Size 221.7MB
Sample240622-cx13maxdpj
SHA256 d20a66f15530e9d2dbc74567d30a8b839f0b5a68f43387aaf16291802ebd0049
MD5 53f11fae029ba9f5a52fec5c2bf9e557
SHA1 0ce4a7c39af2e032a67a6bc79b31f16e847b8905
SHA512 1005e01c25852f93f57c27542637f950b31cf0b1adf2196a6acd32fa6cde6e194b13de7c92a9f87c1096004f3c8cd78546df3fdbc1d6b8632dfd825c7dbbd62f
SSDEEP 6291456:oA+yp7dYWsihZpr8/xcdeGgx+nsKlZUqSQHzCDm:Iyb9sifZe1xdKlRVmD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat purplefox persistence privilege_escalation rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral4/memory/1880-696-0x000000000F7A0000-0x000000000F95A000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral4/memory/1880-696-0x000000000F7A0000-0x000000000F95A000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\Phone = "C:\\ProgramData\\{86D30F4C-E8A3-4d3c-BA14-55xv70w5199F}\\{7D96DA5E-275D-470a-9FE2-33xvD0w588DD}\\Phone.exe"	{6DD3220A-FFDB-47f5-A616-D4xv7Bw5C911}.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defenderr\Phone.exe	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\lop.exe	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\2	msiexec.exe
File created	C:\Program Files\Windows Defenderr\5	msiexec.exe
File created	C:\Program Files\Windows Defenderr\librdkafka.dll	msiexec.exe
File created	C:\Program Files\Windows Defenderr\1	msiexec.exe
File created	C:\Program Files\Windows Defenderr\TrackerUI.sys	MsiExec.exe
File opened for modification	C:\Program Files\Windows Defenderr\TrackerUI.sys	MsiExec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e577a74.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2744D079FE0CD576.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF9DFB8C05A94D2AF.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1FEC76DDDB8A67EE.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3C963879-488B-4A1C-BB5D-DF7EFE72A13D}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF5AB146E23F316B6.TMP	msiexec.exe
File created	C:\Windows\Installer\e577a70.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e577a70.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI809A.tmp	msiexec.exe

Executes dropped EXE 7 IoCs

pid	Process
3824	lop.exe
4156	Phone.exe
2732	lop.exe
912	lop.exe
132	{6DD3220A-FFDB-47f5-A616-D4xv7Bw5C911}.exe
3744	Phone.exe
1880	Phone.exe

Loads dropped DLL 19 IoCs

pid	Process
3824	lop.exe
3824	lop.exe
2732	lop.exe
2732	lop.exe
2732	lop.exe
2732	lop.exe
2732	lop.exe
2732	lop.exe
2732	lop.exe
2732	lop.exe
2732	lop.exe
2732	lop.exe
2732	lop.exe
2732	lop.exe
2732	lop.exe
2732	lop.exe
2732	lop.exe
2732	lop.exe
2732	lop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

pid	Process
2376	msiexec.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3596	4156	WerFault.exe	86

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d96f655da10588100000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d96f655d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900d96f655d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd96f655d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d96f655d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery

T1057

pid	Process
5004	tasklist.exe
1552	tasklist.exe
4640	tasklist.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings	Phone.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\EditFlags = "1719023387"	{6DD3220A-FFDB-47f5-A616-D4xv7Bw5C911}.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
4276	PING.EXE
3972	PING.EXE
3496	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2732	lop.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1780	msiexec.exe
1780	msiexec.exe
4156	Phone.exe
4156	Phone.exe
3824	lop.exe
3824	lop.exe
2732	lop.exe
2732	lop.exe
912	lop.exe
912	lop.exe
912	lop.exe
912	lop.exe
912	lop.exe
912	lop.exe
2732	lop.exe
2732	lop.exe
1880	Phone.exe
1880	Phone.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2732	lop.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2376	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2376	msiexec.exe
Token: SeSecurityPrivilege	1780	msiexec.exe
Token: SeCreateTokenPrivilege	2376	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2376	msiexec.exe
Token: SeLockMemoryPrivilege	2376	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2376	msiexec.exe
Token: SeMachineAccountPrivilege	2376	msiexec.exe
Token: SeTcbPrivilege	2376	msiexec.exe
Token: SeSecurityPrivilege	2376	msiexec.exe
Token: SeTakeOwnershipPrivilege	2376	msiexec.exe
Token: SeLoadDriverPrivilege	2376	msiexec.exe
Token: SeSystemProfilePrivilege	2376	msiexec.exe
Token: SeSystemtimePrivilege	2376	msiexec.exe
Token: SeProfSingleProcessPrivilege	2376	msiexec.exe
Token: SeIncBasePriorityPrivilege	2376	msiexec.exe
Token: SeCreatePagefilePrivilege	2376	msiexec.exe
Token: SeCreatePermanentPrivilege	2376	msiexec.exe
Token: SeBackupPrivilege	2376	msiexec.exe
Token: SeRestorePrivilege	2376	msiexec.exe
Token: SeShutdownPrivilege	2376	msiexec.exe
Token: SeDebugPrivilege	2376	msiexec.exe
Token: SeAuditPrivilege	2376	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2376	msiexec.exe
Token: SeChangeNotifyPrivilege	2376	msiexec.exe
Token: SeRemoteShutdownPrivilege	2376	msiexec.exe
Token: SeUndockPrivilege	2376	msiexec.exe
Token: SeSyncAgentPrivilege	2376	msiexec.exe
Token: SeEnableDelegationPrivilege	2376	msiexec.exe
Token: SeManageVolumePrivilege	2376	msiexec.exe
Token: SeImpersonatePrivilege	2376	msiexec.exe
Token: SeCreateGlobalPrivilege	2376	msiexec.exe
Token: SeBackupPrivilege	1656	vssvc.exe
Token: SeRestorePrivilege	1656	vssvc.exe
Token: SeAuditPrivilege	1656	vssvc.exe
Token: SeBackupPrivilege	1780	msiexec.exe
Token: SeRestorePrivilege	1780	msiexec.exe
Token: SeRestorePrivilege	1780	msiexec.exe
Token: SeTakeOwnershipPrivilege	1780	msiexec.exe
Token: SeBackupPrivilege	4716	srtasks.exe
Token: SeRestorePrivilege	4716	srtasks.exe
Token: SeSecurityPrivilege	4716	srtasks.exe
Token: SeTakeOwnershipPrivilege	4716	srtasks.exe
Token: SeBackupPrivilege	4716	srtasks.exe
Token: SeRestorePrivilege	4716	srtasks.exe
Token: SeSecurityPrivilege	4716	srtasks.exe
Token: SeTakeOwnershipPrivilege	4716	srtasks.exe
Token: SeRestorePrivilege	1780	msiexec.exe
Token: SeTakeOwnershipPrivilege	1780	msiexec.exe
Token: SeRestorePrivilege	1780	msiexec.exe
Token: SeTakeOwnershipPrivilege	1780	msiexec.exe
Token: SeDebugPrivilege	4156	Phone.exe
Token: SeRestorePrivilege	1780	msiexec.exe
Token: SeTakeOwnershipPrivilege	1780	msiexec.exe
Token: SeRestorePrivilege	1780	msiexec.exe
Token: SeTakeOwnershipPrivilege	1780	msiexec.exe
Token: SeRestorePrivilege	1780	msiexec.exe
Token: SeTakeOwnershipPrivilege	1780	msiexec.exe
Token: SeRestorePrivilege	1780	msiexec.exe
Token: SeTakeOwnershipPrivilege	1780	msiexec.exe
Token: SeRestorePrivilege	1780	msiexec.exe
Token: SeTakeOwnershipPrivilege	1780	msiexec.exe
Token: SeRestorePrivilege	1780	msiexec.exe
Token: SeTakeOwnershipPrivilege	1780	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2376	msiexec.exe
2376	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2732	lop.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 4716	1780	msiexec.exe	82
PID 1780 wrote to memory of 4716	1780	msiexec.exe	82
PID 1780 wrote to memory of 1672	1780	msiexec.exe	84
PID 1780 wrote to memory of 1672	1780	msiexec.exe	84
PID 1780 wrote to memory of 1672	1780	msiexec.exe	84
PID 1672 wrote to memory of 3824	1672	MsiExec.exe	85
PID 1672 wrote to memory of 3824	1672	MsiExec.exe	85
PID 1672 wrote to memory of 3824	1672	MsiExec.exe	85
PID 1672 wrote to memory of 4156	1672	MsiExec.exe	86
PID 1672 wrote to memory of 4156	1672	MsiExec.exe	86
PID 1672 wrote to memory of 4156	1672	MsiExec.exe	86
PID 3824 wrote to memory of 2732	3824	lop.exe	87
PID 3824 wrote to memory of 2732	3824	lop.exe	87
PID 3824 wrote to memory of 2732	3824	lop.exe	87
PID 1880 wrote to memory of 2960	1880	Phone.exe	96
PID 1880 wrote to memory of 2960	1880	Phone.exe	96
PID 1880 wrote to memory of 2960	1880	Phone.exe	96
PID 2960 wrote to memory of 1552	2960	cmd.exe	98
PID 2960 wrote to memory of 1552	2960	cmd.exe	98
PID 2960 wrote to memory of 1552	2960	cmd.exe	98
PID 2960 wrote to memory of 4152	2960	cmd.exe	99
PID 2960 wrote to memory of 4152	2960	cmd.exe	99
PID 2960 wrote to memory of 4152	2960	cmd.exe	99
PID 2960 wrote to memory of 4276	2960	cmd.exe	101
PID 2960 wrote to memory of 4276	2960	cmd.exe	101
PID 2960 wrote to memory of 4276	2960	cmd.exe	101
PID 2960 wrote to memory of 4640	2960	cmd.exe	102
PID 2960 wrote to memory of 4640	2960	cmd.exe	102
PID 2960 wrote to memory of 4640	2960	cmd.exe	102
PID 2960 wrote to memory of 4652	2960	cmd.exe	103
PID 2960 wrote to memory of 4652	2960	cmd.exe	103
PID 2960 wrote to memory of 4652	2960	cmd.exe	103
PID 2960 wrote to memory of 3972	2960	cmd.exe	104
PID 2960 wrote to memory of 3972	2960	cmd.exe	104
PID 2960 wrote to memory of 3972	2960	cmd.exe	104
PID 2960 wrote to memory of 5004	2960	cmd.exe	105
PID 2960 wrote to memory of 5004	2960	cmd.exe	105
PID 2960 wrote to memory of 5004	2960	cmd.exe	105
PID 2960 wrote to memory of 4164	2960	cmd.exe	106
PID 2960 wrote to memory of 4164	2960	cmd.exe	106
PID 2960 wrote to memory of 4164	2960	cmd.exe	106
PID 2960 wrote to memory of 3496	2960	cmd.exe	107
PID 2960 wrote to memory of 3496	2960	cmd.exe	107
PID 2960 wrote to memory of 3496	2960	cmd.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\PPT_WPS-offce_WIN64.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2376

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4716
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AA0F7F32518E6AD857E53709D465617A
  2⤵
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Program Files\Windows Defenderr\lop.exe
    "C:\Program Files\Windows Defenderr\lop.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3824
  - - C:\ProgramData\kingsoft\20240622_22937\lop.exe
      "C:\ProgramData\kingsoft\20240622_22937\lop.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:2732
- - C:\Program Files\Windows Defenderr\Phone.exe
    "C:\Program Files\Windows Defenderr\Phone.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4156
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 1204
      4⤵
      Program crash
      PID:3596

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\ProgramData\kingsoft\20240622_22937\lop.exe
"C:\ProgramData\kingsoft\20240622_22937\lop.exe" -downpower -msgwndname=wpssetup_message_E579A1D -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e579664\
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:912

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1904

C:\ProgramData\{86D30F4C-E8A3-4d3c-BA14-55xv70w5199F}\{6DD3220A-FFDB-47f5-A616-D4xv7Bw5C911}.exe
"C:\ProgramData\{86D30F4C-E8A3-4d3c-BA14-55xv70w5199F}\{6DD3220A-FFDB-47f5-A616-D4xv7Bw5C911}.exe" /s "C:\ProgramData\{86D30F4C-E8A3-4d3c-BA14-55xv70w5199F}\{BBE4BFBD-9FB4-4f40-BDB2-28xv21w523DD}"
1⤵
- Adds Run key to start application
- Executes dropped EXE
- Modifies registry class
PID:132

C:\ProgramData\{86D30F4C-E8A3-4d3c-BA14-55xv70w5199F}\{7D96DA5E-275D-470a-9FE2-33xvD0w588DD}\Phone.exe
C:\ProgramData\{86D30F4C-E8A3-4d3c-BA14-55xv70w5199F}\{7D96DA5E-275D-470a-9FE2-33xvD0w588DD}\Phone.exe
1⤵
- Executes dropped EXE
PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4156 -ip 4156
1⤵
PID:2908

C:\ProgramData\{86D30F4C-E8A3-4d3c-BA14-55xv70w5199F}\{7D96DA5E-275D-470a-9FE2-33xvD0w588DD}\Phone.exe
C:\ProgramData\{86D30F4C-E8A3-4d3c-BA14-55xv70w5199F}\{7D96DA5E-275D-470a-9FE2-33xvD0w588DD}\Phone.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\{9B848970-CCDC-4ed4-BB41-A9xv65w57148}.cmd" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /fi "PID eq 1880"
    3⤵
    - Enumerates processes with tasklist
    PID:1552
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i "1880"
    3⤵
    PID:4152
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 20 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4276
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /fi "PID eq 1880"
    3⤵
    - Enumerates processes with tasklist
    PID:4640
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i "1880"
    3⤵
    PID:4652
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 20 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3972
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /fi "PID eq 1880"
    3⤵
    - Enumerates processes with tasklist
    PID:5004
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i "1880"
    3⤵
    PID:4164
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 20 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e577a73.rbs

Path C:\Config.Msi\e577a73.rbs
Size 8KB
SHA256 79a9a6f69df936ffdd7ffa21510f47b951b26f18a5e022006c640aa0f611164f
MD5 29161ec50579b8e2e8fe3506d5b77eaa
SHA1 817162300260d7bfe3e788a75226a639df45735c
SHA512 343bda4cb0cb600321357da0a9f13ad1e680a3990f5b53cec02888fea4d07214a13f8a6a79a446d96e580682d31a72f9e2accac46d3bd02617523d4eda8fce36
SSDEEP 96:pmIRJf6UJ9TDmPHPg69Un7TC6TlD9Un7TCsjrEwPePj+TlmctDNPAZ75LPoPpPX1:EIRJf6KZD16W7OCVW7Oyhli7v5pSf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Program Files\Windows Defenderr\1
Size 483KB
SHA256 cad9fcfa069fc7de9f5d2b7c66bd5c4ca714777bf5db253418a664e7723026d1
MD5 778d517a9de9b93f02e92602f1cfcd6c
SHA1 9e373cbc1e1cf5e1553896485d7c5701a8e89804
SHA512 05ee9445263ee8312be7947a0b42684564a340f11052f4b2d7aa50681a74d6612675fdac8e973cb4cf84412711d4d087ffd0509e7a91f01b108253930425d5f9
SSDEEP 12288:ec6DOfrkQNn2a6CdgphtSt2OygymUXUIU0U3YQqLWHcCy:16DOfrkQtChaYJLF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Program Files\Windows Defenderr\2
Size 337KB
SHA256 95763e1a2e24b815c5b370c43664ad36a85a7be0f56ccbadb4d774cf07e539c2
MD5 7237bb75585824e0bf500d0421dfc36f
SHA1 68fe5c01c23e0a751825e862691e838c404aec4b
SHA512 3dc03e8a499dc9bda0598dbdaeeaedaa03dcc78a186d53e68fb06042cb24bbeba7b1183280fdb30d2b0402486b1464bfaa964c45fe4ba3fd07ce94d3c1832e75
SSDEEP 6144:nhlipL644DIOd5gjMFOM9I5bnblpnBRRZBUkV7KNqAtPmtaU76ysB:264UmOOM9INBpnBRrBUkwq6PO76JB
MD5 SHA1 SHA512 SSDEEP

Submit Download

oem.ini

Path C:\ProgramData\kingsoft\20240622_22937\oem.ini
Size 300B
SHA256 ac4222cad36842b78351bcdd9bf49450082ee99c9e99305e4c9bf05a34e59fa5
MD5 7417a71d686d292d1fc8f8c90e954cf8
SHA1 febfb56b3535e262dd222c9173fdac22981c9f30
SHA512 c3cd2b48fce2127ce8582507978bda7c4d8ccbf7e79bf5cb1bbf1f2e08c888389225e0436b7a56ccc0cbd5a7362aec446b4c60444d2fd8fcdfb22735fbe6e5f9
MD5 SHA1 SHA512

Submit Download

RegWorkshop.ini

Path C:\ProgramData\{86D30F4C-E8A3-4d3c-BA14-55xv70w5199F}\RegWorkshop.ini
Size 1KB
SHA256 a9510ed4f90246fecd78e5cd9e47d9d382c34b7b6493d116a3d355144dfc6cc4
MD5 38db71e26955b25f88381a49771382f9
SHA1 93f89681aafae4c7fd055b869df6657d9a465268
SHA512 7fbb50c8b859a0ccf914006828d8e964acb5d020a629bb6fa06a17b5088c3ead6b13ec32d2d45603caa38ebc2ca2d778108d5f1d1233fc8adb73782895efe765
MD5 SHA1 SHA512

Submit Download

RegWorkshop.ini

Path C:\ProgramData\{86D30F4C-E8A3-4d3c-BA14-55xv70w5199F}\RegWorkshop.ini
Size 2KB
SHA256 02af5cb061fd8075e9475c45ab20e86cf2bb4ca9511ddad348645ed5183b9fc7
MD5 ff0c7c2667dff4f3ed588f40d047c642
SHA1 1162c83bd0bb0d81b7ab7f616cb012b790aa4adf
SHA512 539b1d443232758b6c60a287f2a40200e6e3ba7353f11f18e29ba265c9569a4610e4a80910f79660368a916576ab9c486efa248bf3257e522ef5bfb3d42ef3c3
MD5 SHA1 SHA512

Submit Download

{6DD3220A-FFDB-47f5-A616-D4xv7Bw5C911}.exe

Path C:\ProgramData\{86D30F4C-E8A3-4d3c-BA14-55xv70w5199F}\{6DD3220A-FFDB-47f5-A616-D4xv7Bw5C911}.exe
Size 1.0MB
SHA256 27c8bd76150ddda5b09d6db11f67269cee2eecac345df67f93aab3e3aaabde7c
MD5 217dc98e219a340cb09915244c992a52
SHA1 a04f101ca7180955d62e4a1aaeccdcca489209da
SHA512 dddc15992533c8c13000163c7dd59b20e2fbdedbf611338c04f6f9209ec1a95d1f93aaeeae2778890214d333320978f5d2554348722ea6c8489320f0ef1c4c85
SSDEEP 24576:bIyF/qfrA6aT976FsnYp91GNaAX4Ab6AlewmQ6BZNeZ:zF/4rq6FsnYpmNaAX4AlewmbNeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

{BBE4BFBD-9FB4-4f40-BDB2-28xv21w523DD}

Path C:\ProgramData\{86D30F4C-E8A3-4d3c-BA14-55xv70w5199F}\{BBE4BFBD-9FB4-4f40-BDB2-28xv21w523DD}
Size 429B
SHA256 39a4247e0150888b66e3a469f6e8578b57a469ca7e1c6108a4c39503c822091e
MD5 68a4800386866e58dde817ed8a78d2db
SHA1 bd39c9f1cb0dcc00a9518ea5f396623d8e79c8a9
SHA512 f641c9d6c60c5b534ed44aea5e744ab6bfc5c9b5c7b1d98d830a5816a5d1ae0d935928ab21c4b13771964b546b3c965bcaea2e6f1073e4062267b68b4f676ff8
MD5 SHA1 SHA512

Submit Download

{9B848970-CCDC-4ed4-BB41-A9xv65w57148}.cmd

Path C:\ProgramData\{9B848970-CCDC-4ed4-BB41-A9xv65w57148}.cmd
Size 437B
SHA256 061356f1be8b64476763644f497fdfd69e42d188caac535282cf6e9508267298
MD5 28825a806acff706d707946a9c74340c
SHA1 9f33653672b0aba2f82787c64e9843088e28eafd
SHA512 454ea19e7c8d0a74271e99663fd1b96676862ce84145ffc7e3d2fea6a8a110637e5ba212a74e056bb9196e89ba9d755125c799b845b4cfee89f52591a34a228b
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy8EE3.tmp\System.dll
Size 11KB
SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
MD5 0063d48afe5a0cdc02833145667b6641
SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

v6svc_oem.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy8EE3.tmp\v6svc_oem.dll
Size 192KB
SHA256 d3378ee739debcaee8c715963403d96bf025db98bfbb55e54635429890db85c6
MD5 500318167948bdd3ad42a40721e1a72b
SHA1 24134691693e6d78d6eb0a0c64833c12a0090968
SHA512 0a2d3b55528cc53cfce5b47158997300c562afd2c7bb5596532b218d3f482380887ee7c204b13d42425dc0c4cc439a7f9ed167f3767bda7b6e205e7e8f454863
SSDEEP 1536:AanBx8ONbQ/mpe7GRkOp1qRGkmGWBhYGfxSELX/RdsbTh+u9S4A5S4n8GQMKWNwU:XbDG/GXbcRGkmGUNxBHC+VzS4n8NbULJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5CoreKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e579664\CONTROL\office6\Qt5CoreKso.dll
Size 5.0MB
SHA256 07dbecf0fa0d79d2d4237d53e8b905677a977a3cf3c43f251cbddcc032cd6c2d
MD5 fb71fe7c9c56be049f7f614010c7dc25
SHA1 9076a7bbd9fdcf91486ccce76c01fc005a2b29c1
SHA512 d76ea7c2a0a505e53b1cf675b9eca7ef0aff86f4970ab1f7c530244e15bd7095f36ba1d95066cb94b3400680cce6b991951ef4b1fa889d4a2a907d0dc758544d
SSDEEP 98304:uvFqylfboKUAJV8i9tuCJsv6tWKFdu9C1vKl4rAi1dmXIm:uLlfbo8QCJsv6tWKFdu9C1BpdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5GuiKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e579664\CONTROL\office6\Qt5GuiKso.dll
Size 5.3MB
SHA256 fe999e848637dcf8f209181baf71c590197af2dbd01b30f976179fd5809bfcd6
MD5 4f771184e9e3dfb80751cf4a9cdf0d14
SHA1 7927a937c071762cca02fdff396d70fecdb37f6e
SHA512 78cb877dc244d4ae504d89ab55b5f6748498db88212e3564777c34f588cb05cee69897c8c4e1ad85f95aa215fe3c581e6456530dbfd76e7dc840398687cf82a5
SSDEEP 49152:PWfp9sdLcRaG3B2Lx8uftFvOnRyxHllqnJ+HlTupBMOHdUnUaOj61CWcqEO44J+r:2cLx8ufDQRfVpF9OXx1uDvyizh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5SvgKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e579664\CONTROL\office6\Qt5SvgKso.dll
Size 359KB
SHA256 dfbcba58ce097a2fd3a5df4465ddecb13a1cdf5800e3bc4755170aaf25749725
MD5 27174d74a9c1e244ad65fbf40eea0643
SHA1 f2f509dff6f61a0e52608ab059fbad12e4ce943e
SHA512 ff545b15571fba7ec11a33e44785afa48bc468807692a7014dc9dde184896fb9b18377313d965d0be50d3cf310b1bd957bbd1c6ee947ff2145289c4dff69f6f5
SSDEEP 6144:ABp9iDb/IKLDIM8gQ8o4N5WFlpVMaguLLuw383GqHSg1mg6vIDsYHanwjgSjhmaf:2I/IKLDEgQ/4NIF5ouLLD83GqHSg1mg5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5WidgetsKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e579664\CONTROL\office6\Qt5WidgetsKso.dll
Size 4.4MB
SHA256 0bfe39d7de0c08f8c60d746167777954575f626d041bc7c3faccaa7ef6ceb2fc
MD5 21d93f3464ff710dc830d098d5ec11fc
SHA1 7675af59d6d8d850e48479abac72e1b7a38966e4
SHA512 6976407f7d06053050de378e28fbbd5715c1e5638e5c00c2b321a2e45844358c1dacf421c8fc39037b65f995b7ce3c1de2b62cd8edcbd7df9c59474ac8a1cc67
SSDEEP 49152:AfHKfe+Ykmzw/TlUd7tEIkBJAeEI+lHba8vg3ZziQTsfEWoO9ZT9mj:Ve+Xm0/E6jWNT0Zz3TaDBmj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5WinExtrasKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e579664\CONTROL\office6\Qt5WinExtrasKso.dll
Size 388KB
SHA256 e6ee77a78ec2b374acc9757670e4f295948171d300fb2bf2d3e4fa702aa4f844
MD5 fa36fc9076b51357b49635724f97c240
SHA1 f00d8f60e24a2223b97b1c601c9239f478b155ad
SHA512 5bf10ea6bf407dbfddd21f8be63cf52537779e8dd92b3c6f43a414fd779ea4651fde6ec2ded26b6b4b91123ce6000ac67e180845034a03746d7e546ed90d1cbf
SSDEEP 6144:rihhnuIq8teN0RSud/VYRrHB/2MZ5QvAKfpAl0:G7nuktTRPTYRbZ+Am
MD5 SHA1 SHA512 SSDEEP

Submit Download

kpacketui.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e579664\CONTROL\office6\kpacketui.dll
Size 1.5MB
SHA256 de0ec3555a4764225803f50088971ea77e2499db9be1834efb35ae77d43e6fe3
MD5 69bef4321e6d5f17e4c5eb97c69e4b09
SHA1 5b7dba958d57d1e42a50c90d390a909fc3b3d037
SHA512 52c0d2c44016c1c47e0d86da34dc844f8729df5cd7f769fe4bcdbf479d91b30b88489666f48177485c7e0dda8321a51748d5c7f1fbb08acf89c749fab64cba2f
SSDEEP 24576:pLUPuDzOZ1g8x9HveHWoxQ1nZKbyMG/PzSzw+RUvH+bYJin9:pLMZ1g8HPl9nIZFR9bYJin9
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e579664\CONTROL\office6\msvcp140.dll
Size 439KB
SHA256 02c7259456eac8cbadfb460377ba68e98282400c7a4a9d0bf49b3313ef6d554d
MD5 5fd0772c30a923159055e87395f96d86
SHA1 4a20f687c84eb327e3cb7a4a60fe597666607cf3
SHA512 132a9b969104c0a214bde3f8c6e8f754d116cecdad55224bbea7a40cffd98f4e4de503d83d92cca0aaab9ed51c9efa00ad5caed69a9eda71013598a43b161c3a
SSDEEP 12288:6Sx/AD6CqIwoIx6/vCLTegs2icgqjNue1ArhUgiW6QR7t5s03Ooc8dHkC2esruN6:zVADBwoIx6kegs2icgqko03Ooc8dHkCW
MD5 SHA1 SHA512 SSDEEP

Submit Download

qsvgicon.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e579664\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
Size 56KB
SHA256 ab6aa9da2fb9d18729b088dc1f62c1ad3c69e76f81909e3aa2d77534c71175ec
MD5 afb936b2c29303d29f95c9e524397855
SHA1 97a700f7913f70736035c57aa223b5062630ba8f
SHA512 4a07d765b2eeb9409a05b28062633675dfd98589767800a3246daff6c1ee486379c33c48d15ae9d807d70b31ddbf885671e251b823d61ca308268a564ec08fed
SSDEEP 768:FZH6vUIyCOflbjgQJJvd/05FGTu3naFEQsx4L/X+G9EsheYi2laK8Yi2lax3hUa:baWf7vB05FAuxUP+G9ED7YY7Y43hUa
MD5 SHA1 SHA512 SSDEEP

Submit Download

qsvg.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e579664\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
Size 35KB
SHA256 2f58c9bd2798c1b3751ce8cd0496c0809e405b1f23b3017f63ed63f35c072b29
MD5 6f689338394967ea46bed1bf913dfc65
SHA1 21c6c707f9d13269c90056b0f3fe6b732f43e231
SHA512 f07a9330ddba796b645bcb9afdd7b3c0cb1b020df2c6140a57aafe00caca6e264ad3f56a27081b11e4de363d04a91a126ff24f9919e7136dc3a0e75c8477f0ac
SSDEEP 768:pB3GmzbLjreTgoheYi2laY+Yi2la/3hmKJs:pB393LjiTgn7Ya7Y43hmR
MD5 SHA1 SHA512 SSDEEP

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e579664\CONTROL\office6\qt\plugins\platforms\qwindows.dll
Size 1.3MB
SHA256 e57ec14808e775223cff206d176ac182f2e0d45868ab27d4cf4bb0f1a5b7ea8c
MD5 366e2229d02a37cbf1233687c241e42f
SHA1 2f77dc481bcf19cde45573ba8a82a27371613561
SHA512 f4b6909a8e13f8a8dd4185667e91abf9a01f42d59c7f09859e4065cab95a35e0be4e45717c569aceeb596db88615375e6caa1e9eca421621cdcdcee87600d68c
SSDEEP 24576:TzcYqzyMLkj6lrhpRv76NtNkHOj78gFk17GZoeOOx:HcYqvlv76NtGO9W7sOOx
MD5 SHA1 SHA512 SSDEEP

Submit Download

qwindowsvistastyle.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e579664\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
Size 140KB
SHA256 3f516ee7950d1702bf8ba5cea0d658fe5f19c0c23fdad2a005e6e4a4f28f7688
MD5 dd329c171807ad7a4f24f872ccbcc7a4
SHA1 1dcc214310b87c987e6dc081b4dca9c4c56844e3
SHA512 68613efa2f26c34d90b7bddef6caa2b53f003927f8d03fc0825a8bde525dc43be95b9c4ae02cd2683cbe5b80df29a40f3515cf552f57486f831ba138c8f9ed8c
SSDEEP 3072:eu8ecahSnIMiHojNXBAiQNMkdjpZo+pq1w7ei/x6iPWfw2ko52Cg1CXlpCKHYn18:euan+j5UOZ2ko5rNXlpCKHYnlSES
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e579664\CONTROL\office6\ucrtbase.dll
Size 1.1MB
SHA256 2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359
MD5 2040cdcd779bbebad36d36035c675d99
SHA1 918bc19f55e656f6d6b1e4713604483eb997ea15
SHA512 83dc3c7e35f0f83e1224505d04cdbaee12b7ea37a2c3367cb4fccc4fff3e5923cf8a79dd513c33a667d8231b1cc6cfb1e33f957d92e195892060a22f53c7532f
SSDEEP 24576:tCjjeiNFnAp+O+R2l2WDPc/9qHrX0cJ/gAp0ei5mcvIZPoy4aVvFjDp:4jyuRR2l2WD6I/bp0erVL
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e579664\CONTROL\office6\vcruntime140.dll
Size 81KB
SHA256 ff9c1123cff493a8f5eacb91115611b6c1c808b30c82af9b6f388c0ef1f6b46d
MD5 e51018e4985943c51ff91471f8906504
SHA1 5899aaccdb692dbdffdaa35436c47d17c130cfd0
SHA512 2fe5ddad2100aeaea35398384a440ba0be169ef429f7e0b69687bc0f8865df41bc93fc80d3a8f0ddd9df54fc2f2d76b1056a1d1962d37432704c818128ffbd74
SSDEEP 1536:lmGzxv5o1xSEIURDbnZ/dvC5cpnHXCh5cecbvo9J/Z0:lp5o1YEIU9bnZ/A5y3Jecbvo9
MD5 SHA1 SHA512 SSDEEP

Submit Download

product.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e579664\CONTROL\product.dat
Size 52KB
SHA256 fd675d3fb5922605e367d99bab20efd1d9e4b4ad8decf67071035d3a8976e502
MD5 9b5715bb169c023511b3f5d07bf79602
SHA1 1264d76ae1d5656316a5dd15d52aaf952ee3d2c5
SHA512 46dbfc57f9abc2b6a7579cdf77ca42b53011841c60ca2aaeb359abffa47cc2f67544102af4eefbec404051f3c8fc13935272f4b9859a31680dfae24a12e6c3e9
SSDEEP 1536:1/NG4pQlcq98IufmsW1kxc7clSAAULtyewGcu:1/N/Bqufmp1AxSANtx9
MD5 SHA1 SHA512 SSDEEP

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 363B
SHA256 90b2af69f94515f67f5c8ba104ab2ac467988da2b1b10ec6286e1a8206ce4093
MD5 c015cc57557930d4827f975b196f84ab
SHA1 3ce98dc12c1f588b857a9264035907319a53b995
SHA512 0f0c0d0da53cae2a2ff91a44f2459dbc796669434ee8b6d5a2f91d27a5035fa75c3badabfecd69a0f1e2d7c2ab8428eb7f8532af21b09517b5e29865745d92ab
MD5 SHA1 SHA512

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 409B
SHA256 7fa5672cb5ed1900b611ef0485165df2702c611445d94150598fa1b3ed7c8037
MD5 f1b6360b3db7c20534c7259929fe453b
SHA1 7d28a8aa319aad78427484c56dd56909676ff315
SHA512 8892854cff4900953e495374a4561853b6062d8e1ce6346ac5a9261b0f68ae970a342ff0dba5c420d04272a7aec802d894cc8b6c5c1eef561506879344122796
MD5 SHA1 SHA512

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 27KB
SHA256 219ff362aba8285d17f43e85f88a803704e5043868c3ecc2c4d56ff56dbd03e2
MD5 aa8a030e54bda41a64ebdcf0edc9fe4a
SHA1 736352f21378a6f106442b6e2ea3f3a172142745
SHA512 b964bd73f71174f14cc041bddfc83de8949e83567aa1a78f21bce75e18baa6a87bebfd654d871c567628b05010e34e97c24abfa2e61865ac0cc01644e161133b
SSDEEP 384:ZKN8TCArsXjYcUHCQqOlBlBl5kbWh1c83HUYb6HzslS2Se2i/s7jZd1UEzqY4uPs:G3gow6tvE
MD5 SHA1 SHA512 SSDEEP

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 28KB
SHA256 365d91b011e96639ed15d5eec395841e3fd7545fcf90606aaa728f6e917d6204
MD5 33ca0b3aa17932f22f3c67bc770537ba
SHA1 6fc2815c92891fc69dc1a895781c5f9446b1e1cf
SHA512 67c17b04063e70d09e35ae03427c4c6ef4b549e78b49879788c0390f5c9e2ec81522ce2c3fcaa361c40471c93ba6e7baa1ec95f0cbad15a97dca507890d6e7ba
SSDEEP 384:ZKN8TCArsXjYcUHCQqOlBlBl5kbWh1c83HUYb6HzslS2Se2i/s7jZd1UEzqY4uPV:G3gow6tv9
MD5 SHA1 SHA512 SSDEEP

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 45KB
SHA256 235a97a4a66034b7ab5de953c4a3dec738208dc561cb0119dfcad31c8dd4dc20
MD5 d8282bdbb0fb575a456f0af79119d44f
SHA1 d09000261f7ac83760ce141255f427595cf5abda
SHA512 46f1f27db561aa7a69116d88925fd643b3bab07384ad48b3745e0893317ad0992b419c6de20da98a5cd8485d9da33e479d7e004c0936d0b692f691b59ab291e8
SSDEEP 384:ZKN8TCArsXjYcUHCQqOlBlBl5kbWh1c83HUYb6HzslS2Se2i/s7jZd1UEzqY4uPz:G3gow6tvhh
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 12.8MB
SHA256 fec1fa28d9cbdb71ff7c4e81e55224406f0c3d04fd95e757fc4169977f00bd20
MD5 64e5017495568af06658748ce5524a25
SHA1 dae9d83f469d26350f4d767e2d42ec4f1e6386c4
SHA512 8e167f3007f6ffeefb64400cf5f59cc9ff2dd0ff74ace815bdc604bffe6092c5bb8b2fda87a0003537244bf47275bd025c043d2b33d19f94cc2c31e126995d59
SSDEEP 12288:N0l1UbaH9QlO/bLnYAcn80mKj41K/5pj1q4nEb/mGnhkmkjMdHyXgMHvR7D6N2B2:OIadoO/vR1K/TZxqaZtr7xKHzRqbRy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{b4ba7c7f-adca-4687-ae91-4d052a1544ee}_OnDiskSnapshotProp

Path \??\Volume{5d656fd9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b4ba7c7f-adca-4687-ae91-4d052a1544ee}_OnDiskSnapshotProp
Size 6KB
SHA256 dbcccca25b36d04b624ca8c1bdd4d3385cf5819860b2933753fe2ec749feec38
MD5 32d8645969d56b88d51dbe10825b4a8b
SHA1 88232f2821813bf709559d580c45e2ff4f656532
SHA512 8fab8590b56ccb80961f68ad43b55abb6fa0e789572bf18e3752e816719515c95e4b1c0777f7c122ff37a2944dd705de5fac032e83dca3e97371f1f4965d49af
SSDEEP 96:F7N2vDcpADD84LTHzbOHXOHBlBRQL8Sc9XE56tOSVQpu:XCb++2Vm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1880-696-0x000000000F7A0000-0x000000000F95A000-memory.dmp

Download

memory/1880-697-0x00000000004B0000-0x0000000000537000-memory.dmp

Download

memory/3744-685-0x00000000004B0000-0x0000000000537000-memory.dmp

Download

memory/4156-680-0x0000000000BE0000-0x0000000000C67000-memory.dmp

Download

memory/4156-686-0x0000000000BE0000-0x0000000000C67000-memory.dmp

Download