3f90720904fd29379e4dbc9c60eebae08cbaae5a362795eacf75f5e7b5016e89

Analysis

max time kernel
117s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-11-2024 15:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f90720904fd29379e4dbc9c60eebae08cbaae5a362795eacf75f5e7b5016e89.msi
Size

242.2MB
MD5

e2233f04bb29e57211adcb23e445297d
SHA1

0c8d7bc39e08c2f4fc6d7875acc26632f59f8934
SHA256

3f90720904fd29379e4dbc9c60eebae08cbaae5a362795eacf75f5e7b5016e89
SHA512

94fda256ffa2f5465801d6d25d0d275b91a96db0128f7a04fb29ea5806fbf68a88365b0b56e28fbc02ade39fadee6acee25dba0aafa496a3681b44042754c815
SSDEEP

6291456:OAstz7u+q1tSqUAwMoa22c04tV+Jvw9DdD:OAiz7Xq1JHwMDLcduvmDZ

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2448	powershell.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\UpgradeValiantSupervisor\ZhObbZwOavDN	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
File created	C:\Program Files\UpgradeValiantSupervisor\AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe	msiexec.exe
File created	C:\Program Files\UpgradeValiantSupervisor\eMXWLILrxGGOkXCTgbWzVTUtCdmolA	msiexec.exe
File created	C:\Program Files\UpgradeValiantSupervisor\QtrVrzdIjlZB.xml	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
File created	C:\Program Files\UpgradeValiantSupervisor\ZhObbZwOavDN	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
File opened for modification	C:\Program Files\UpgradeValiantSupervisor\2_ZhObbZwOavDN.exe	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
File opened for modification	C:\Program Files\UpgradeValiantSupervisor\QtrVrzdIjlZB.exe	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
File opened for modification	C:\Program Files\UpgradeValiantSupervisor\ZhObbZwOavDN.exe	MsiExec.exe
File created	C:\Program Files\UpgradeValiantSupervisor\CwoagEUfzqidYrUlDxnIjWecaRQtHM	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
File opened for modification	C:\Program Files\UpgradeValiantSupervisor\CwoagEUfzqidYrUlDxnIjWecaRQtHM	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
File opened for modification	C:\Program Files\UpgradeValiantSupervisor\QtrVrzdIjlZB.xml	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
File created	C:\Program Files\UpgradeValiantSupervisor\2_ZhObbZwOavDN.exe	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
File created	C:\Program Files\UpgradeValiantSupervisor\ZhObbZwOavDN.exe	MsiExec.exe
File created	C:\Program Files\UpgradeValiantSupervisor\valibclang2d.dll	msiexec.exe
File created	C:\Program Files\UpgradeValiantSupervisor\WPS_Setup_18608.exe	msiexec.exe
File created	C:\Program Files\UpgradeValiantSupervisor\QtrVrzdIjlZB.exe	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
File created	C:\Program Files\UpgradeValiantSupervisor\ZhObbZwOavDN.vbs	ZhObbZwOavDN.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f773a81.msi	msiexec.exe
File created	C:\Windows\Installer\f773a82.ipi	msiexec.exe
File created	C:\Windows\Installer\f773a84.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\f773a81.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C16.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f773a82.ipi	msiexec.exe

Executes dropped EXE 6 IoCs

pid	Process
536	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
2240	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
284	ZhObbZwOavDN.exe
824	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1980	WPS_Setup_18608.exe

Loads dropped DLL 34 IoCs

pid	Process
824	WPS_Setup_18608.exe
824	WPS_Setup_18608.exe
824	WPS_Setup_18608.exe
824	WPS_Setup_18608.exe
824	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2792	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WPS_Setup_18608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZhObbZwOavDN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WPS_Setup_18608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WPS_Setup_18608.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2948	cmd.exe
2672	PING.EXE

Modifies data under HKEY_USERS 63 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\kingsoft\Office\6.0\Common\reportAllInfoToDataWarehouse = "0"	WPS_Setup_18608.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	WPS_Setup_18608.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = e0f4f853ba32db01	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\kingsoft\Office\6.0\Common\FirstInstallTime = "2024-11-09 15:16:28"	WPS_Setup_18608.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\kingsoft\Office\6.0\Common\errorReport = "https://dpr.wps.cn/errorReport/up"	WPS_Setup_18608.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E	WPS_Setup_18608.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\kingsoft	WPS_Setup_18608.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\kingsoft\Office\6.0\Common\disableGlobalInfoCollect = "0"	WPS_Setup_18608.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\kingsoft\Office	WPS_Setup_18608.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\kingsoft\Office\6.0\Common	WPS_Setup_18608.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\kingsoft\Office\6.0\Common\FirstInstall = "1"	WPS_Setup_18608.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\kingsoft\Office\6.0\Common	WPS_Setup_18608.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\kingsoft\Office\6.0	WPS_Setup_18608.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	WPS_Setup_18608.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common	WPS_Setup_18608.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@"%windir%\System32\ie4uinit.exe",-732 = "Finds and displays information and Web sites on the Internet."	WPS_Setup_18608.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145EE0522D8997F44B15E192AFFD3205	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145EE0522D8997F44B15E192AFFD3205\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145EE0522D8997F44B15E192AFFD3205\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145EE0522D8997F44B15E192AFFD3205\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145EE0522D8997F44B15E192AFFD3205\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145EE0522D8997F44B15E192AFFD3205\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145EE0522D8997F44B15E192AFFD3205\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1D9EBB1191311C943A4DE906ED230A9E\145EE0522D8997F44B15E192AFFD3205	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145EE0522D8997F44B15E192AFFD3205\SourceList\PackageName = "3f90720904fd29379e4dbc9c60eebae08cbaae5a362795eacf75f5e7b5016e89.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145EE0522D8997F44B15E192AFFD3205\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145EE0522D8997F44B15E192AFFD3205\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145EE0522D8997F44B15E192AFFD3205\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\145EE0522D8997F44B15E192AFFD3205	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145EE0522D8997F44B15E192AFFD3205\Version = "50462726"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145EE0522D8997F44B15E192AFFD3205\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145EE0522D8997F44B15E192AFFD3205\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145EE0522D8997F44B15E192AFFD3205\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1D9EBB1191311C943A4DE906ED230A9E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\145EE0522D8997F44B15E192AFFD3205\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145EE0522D8997F44B15E192AFFD3205\ProductName = "UpgradeValiantSupervisor"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145EE0522D8997F44B15E192AFFD3205\PackageCode = "B82DA7CCC14140F40945A52BCAAF15F6"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145EE0522D8997F44B15E192AFFD3205\Language = "1033"	msiexec.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2672	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1596	WPS_Setup_18608.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs

pid	Process
536	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
2240	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
2680	msiexec.exe
2680	msiexec.exe
2448	powershell.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
284	ZhObbZwOavDN.exe
824	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1980	WPS_Setup_18608.exe
1980	WPS_Setup_18608.exe
1980	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe
1596	WPS_Setup_18608.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1596	WPS_Setup_18608.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2792	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2792	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeSecurityPrivilege	2680	msiexec.exe
Token: SeCreateTokenPrivilege	2792	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2792	msiexec.exe
Token: SeLockMemoryPrivilege	2792	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2792	msiexec.exe
Token: SeMachineAccountPrivilege	2792	msiexec.exe
Token: SeTcbPrivilege	2792	msiexec.exe
Token: SeSecurityPrivilege	2792	msiexec.exe
Token: SeTakeOwnershipPrivilege	2792	msiexec.exe
Token: SeLoadDriverPrivilege	2792	msiexec.exe
Token: SeSystemProfilePrivilege	2792	msiexec.exe
Token: SeSystemtimePrivilege	2792	msiexec.exe
Token: SeProfSingleProcessPrivilege	2792	msiexec.exe
Token: SeIncBasePriorityPrivilege	2792	msiexec.exe
Token: SeCreatePagefilePrivilege	2792	msiexec.exe
Token: SeCreatePermanentPrivilege	2792	msiexec.exe
Token: SeBackupPrivilege	2792	msiexec.exe
Token: SeRestorePrivilege	2792	msiexec.exe
Token: SeShutdownPrivilege	2792	msiexec.exe
Token: SeDebugPrivilege	2792	msiexec.exe
Token: SeAuditPrivilege	2792	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2792	msiexec.exe
Token: SeChangeNotifyPrivilege	2792	msiexec.exe
Token: SeRemoteShutdownPrivilege	2792	msiexec.exe
Token: SeUndockPrivilege	2792	msiexec.exe
Token: SeSyncAgentPrivilege	2792	msiexec.exe
Token: SeEnableDelegationPrivilege	2792	msiexec.exe
Token: SeManageVolumePrivilege	2792	msiexec.exe
Token: SeImpersonatePrivilege	2792	msiexec.exe
Token: SeCreateGlobalPrivilege	2792	msiexec.exe
Token: SeBackupPrivilege	648	vssvc.exe
Token: SeRestorePrivilege	648	vssvc.exe
Token: SeAuditPrivilege	648	vssvc.exe
Token: SeBackupPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2268	DrvInst.exe
Token: SeRestorePrivilege	2268	DrvInst.exe
Token: SeRestorePrivilege	2268	DrvInst.exe
Token: SeRestorePrivilege	2268	DrvInst.exe
Token: SeRestorePrivilege	2268	DrvInst.exe
Token: SeRestorePrivilege	2268	DrvInst.exe
Token: SeRestorePrivilege	2268	DrvInst.exe
Token: SeLoadDriverPrivilege	2268	DrvInst.exe
Token: SeLoadDriverPrivilege	2268	DrvInst.exe
Token: SeLoadDriverPrivilege	2268	DrvInst.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeRestorePrivilege	536	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
Token: 35	536	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
Token: SeSecurityPrivilege	536	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
Token: SeSecurityPrivilege	536	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
Token: SeRestorePrivilege	2240	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
Token: 35	2240	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
Token: SeSecurityPrivilege	2240	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
Token: SeSecurityPrivilege	2240	AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2792	msiexec.exe
2792	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1596	WPS_Setup_18608.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2916	2680	msiexec.exe	35
PID 2680 wrote to memory of 2916	2680	msiexec.exe	35
PID 2680 wrote to memory of 2916	2680	msiexec.exe	35
PID 2680 wrote to memory of 2916	2680	msiexec.exe	35
PID 2680 wrote to memory of 2916	2680	msiexec.exe	35
PID 2916 wrote to memory of 2448	2916	MsiExec.exe	37
PID 2916 wrote to memory of 2448	2916	MsiExec.exe	37
PID 2916 wrote to memory of 2448	2916	MsiExec.exe	37
PID 2916 wrote to memory of 2948	2916	MsiExec.exe	39
PID 2916 wrote to memory of 2948	2916	MsiExec.exe	39
PID 2916 wrote to memory of 2948	2916	MsiExec.exe	39
PID 2948 wrote to memory of 536	2948	cmd.exe	41
PID 2948 wrote to memory of 536	2948	cmd.exe	41
PID 2948 wrote to memory of 536	2948	cmd.exe	41
PID 2948 wrote to memory of 536	2948	cmd.exe	41
PID 2948 wrote to memory of 2672	2948	cmd.exe	43
PID 2948 wrote to memory of 2672	2948	cmd.exe	43
PID 2948 wrote to memory of 2672	2948	cmd.exe	43
PID 2948 wrote to memory of 2240	2948	cmd.exe	44
PID 2948 wrote to memory of 2240	2948	cmd.exe	44
PID 2948 wrote to memory of 2240	2948	cmd.exe	44
PID 2948 wrote to memory of 2240	2948	cmd.exe	44
PID 2916 wrote to memory of 284	2916	MsiExec.exe	46
PID 2916 wrote to memory of 284	2916	MsiExec.exe	46
PID 2916 wrote to memory of 284	2916	MsiExec.exe	46
PID 2916 wrote to memory of 284	2916	MsiExec.exe	46
PID 2916 wrote to memory of 824	2916	MsiExec.exe	48
PID 2916 wrote to memory of 824	2916	MsiExec.exe	48
PID 2916 wrote to memory of 824	2916	MsiExec.exe	48
PID 2916 wrote to memory of 824	2916	MsiExec.exe	48
PID 2916 wrote to memory of 824	2916	MsiExec.exe	48
PID 2916 wrote to memory of 824	2916	MsiExec.exe	48
PID 2916 wrote to memory of 824	2916	MsiExec.exe	48
PID 824 wrote to memory of 1596	824	WPS_Setup_18608.exe	49
PID 824 wrote to memory of 1596	824	WPS_Setup_18608.exe	49
PID 824 wrote to memory of 1596	824	WPS_Setup_18608.exe	49
PID 824 wrote to memory of 1596	824	WPS_Setup_18608.exe	49
PID 824 wrote to memory of 1596	824	WPS_Setup_18608.exe	49
PID 824 wrote to memory of 1596	824	WPS_Setup_18608.exe	49
PID 824 wrote to memory of 1596	824	WPS_Setup_18608.exe	49

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\3f90720904fd29379e4dbc9c60eebae08cbaae5a362795eacf75f5e7b5016e89.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2792

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 1CDB24BAE1BAA112CEA033CF0FD700D4 M Global\MSI0000
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\UpgradeValiantSupervisor'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2448
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /min "" "C:\Program Files\UpgradeValiantSupervisor\AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe" x "C:\Program Files\UpgradeValiantSupervisor\eMXWLILrxGGOkXCTgbWzVTUtCdmolA" -o"C:\Program Files\UpgradeValiantSupervisor\" -p"62184CO}~f.47YT<!lh}" -y & ping 127.0.0.1 -n 2 & start /min "" "C:\Program Files\UpgradeValiantSupervisor\AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe" x "C:\Program Files\UpgradeValiantSupervisor\CwoagEUfzqidYrUlDxnIjWecaRQtHM" -x!1_ZhObbZwOavDN.exe -o"C:\Program Files\UpgradeValiantSupervisor\" -p"38270f^{za@XtXR]~>yV" -y
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Program Files\UpgradeValiantSupervisor\AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
      "C:\Program Files\UpgradeValiantSupervisor\AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe" x "C:\Program Files\UpgradeValiantSupervisor\eMXWLILrxGGOkXCTgbWzVTUtCdmolA" -o"C:\Program Files\UpgradeValiantSupervisor\" -p"62184CO}~f.47YT<!lh}" -y
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      Suspicious use of AdjustPrivilegeToken
      PID:536
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2672
  - - C:\Program Files\UpgradeValiantSupervisor\AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe
      "C:\Program Files\UpgradeValiantSupervisor\AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe" x "C:\Program Files\UpgradeValiantSupervisor\CwoagEUfzqidYrUlDxnIjWecaRQtHM" -x!1_ZhObbZwOavDN.exe -o"C:\Program Files\UpgradeValiantSupervisor\" -p"38270f^{za@XtXR]~>yV" -y
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      Suspicious use of AdjustPrivilegeToken
      PID:2240
- - C:\Program Files\UpgradeValiantSupervisor\ZhObbZwOavDN.exe
    "C:\Program Files\UpgradeValiantSupervisor\ZhObbZwOavDN.exe" -number 174 -file file3 -mode mode3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:284
- - C:\Program Files\UpgradeValiantSupervisor\WPS_Setup_18608.exe
    "C:\Program Files\UpgradeValiantSupervisor\WPS_Setup_18608.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\ProgramData\kingsoft\20241109_151626\WPS_Setup_18608.exe
      "C:\ProgramData\kingsoft\20241109_151626\WPS_Setup_18608.exe" /ThemeIndex=#ThemeIndex#
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:1596

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:648

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000494" "00000000000005D0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2268

C:\ProgramData\kingsoft\20241109_151626\WPS_Setup_18608.exe
"C:\ProgramData\kingsoft\20241109_151626\WPS_Setup_18608.exe" -downpower -ThemeIndex="#ThemeIndex#" -msgwndname=wpssetup_message_F776307 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~f776143\ -msgsmname=Global\_wpssetup_message_sm_63C
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f773a83.rbs

Filesize
7KB

MD5
71d8be7b00fd44579b90a5586fe188f3

SHA1
2ff6c8400570df3ec619ff55baeca094e746febd

SHA256
6c34e97c1739dac26426508b2a7d21cb28c9ff4d82641a3a32330d6b1490123b

SHA512
24acab843af3253fb467323dcdadf85b151cfc8a82aedc988b59fd37ef683b152d924d25f53a78187fa5521d47bf15651a1c32a5f9af01aae2fb389c6cd2391e

Download Submit
C:\Program Files\UpgradeValiantSupervisor\2_ZhObbZwOavDN.exe

Filesize
2.1MB

MD5
2a9aa3a122ff15917a565ba28e77c533

SHA1
698ba5909e1633fbd640e80c1804097a3d356628

SHA256
7dc4adf24defbc98d5bbaa7a89d30dc87dfc7a0eb8606acaf73fb845f272ccd9

SHA512
a3f6d10bc6f5652699f080a35e3af8794b315c70eb307f52a0e869d3de3f0a6302f421ce10aba34ec9fb6d2dc5a6f2460b8c97c403e75692e73f18d4b9870263

Download Submit
C:\Program Files\UpgradeValiantSupervisor\AeZAmwDgQIXFTBXseuNJUPJUrTJJnY.exe

Filesize
577KB

MD5
c31c4b04558396c6fabab64dcf366534

SHA1
fa836d92edc577d6a17ded47641ba1938589b09a

SHA256
9d182f421381429fd77598feb609fefb54dcaef722ddbf5aa611b68a706c10d3

SHA512
814dcbc1d43bc037dadc2f3f67856dd790b15fc1b0c50fa74a169c8cc02cdc79d44f1f10e200ef662eee20cd6b5ca646ec4e77673e3fe3cb7dfb7649243f6e99

Download Submit
C:\Program Files\UpgradeValiantSupervisor\CwoagEUfzqidYrUlDxnIjWecaRQtHM

Filesize
1.5MB

MD5
41ab81df154e4f54008a2e216401f786

SHA1
14613bf8c48abe36a36250dca5fb253a48d83c08

SHA256
b8e68b32feda6f330e89d4ed821d8728025b7551b43fa046d5f0290d18db36d6

SHA512
03c588680febafa125e36f62902659fe2e8c0675537ed030bb8d20b656b38ab819e8068d8ad7e072cc37fee53c1cd4c4de86543f9c5823edb57dc3cb251fe620

Download Submit
C:\Program Files\UpgradeValiantSupervisor\eMXWLILrxGGOkXCTgbWzVTUtCdmolA

Filesize
1.5MB

MD5
34ecffea0fb7a73fa15061a76756264f

SHA1
4d76f4abab888a0f08ba305f2d327721d2ebb96c

SHA256
84273e3685085ee399948323a9104d533c05c5f4b32ec6291fcc7437ff7aca08

SHA512
8f24ea1a9af3f8a215adbf93ead85da44fb185dd3f45c2e000ed60374c680ce988fd784063615a362b3ca606a20b716c2917dc8c694b0a3ca9b00dfdb7ccbd13

Download Submit
C:\ProgramData\kingsoft\20241109_151626\oem.ini

Filesize
1KB

MD5
920068869d99afbee8244a2be1e667dd

SHA1
4fb5d143480d258cb4afa9d009b303a08fc9122b

SHA256
53b4432efa05bb55dec931a4641e32a6dccae3fb4730bf66bab2fe58df904d2f

SHA512
466623f31264a788fbf83589f8d5601ba1797d9df21da04fca5a13ff25678ddc3291d3086fedfbf5829a1eed93a67759af704c51c38c3378202c34e242eae8da

Download Submit
C:\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\product.dat

Filesize
95KB

MD5
bb7426885c5f57b6b9405fdc7a94cc65

SHA1
0a58a34a41cbea358fd57d278e9b15e669cc28e6

SHA256
f32133a910d0ab4b64bb7bc33fd5894e1afeb048b83b09336d8b02cd4c7ae118

SHA512
3e8d20fc055b9ebbb49439adc69878e2b1c9a11f45400e7155874c031f950e3dc6ece86998366345c85ee98ac091ac319eb2175fd0100e300b9e856d06ef891d

Download Submit
C:\Users\Admin\AppData\Local\tempinstall.ini

Filesize
382B

MD5
6a5eea749583001de63b993fc66496ba

SHA1
fd41691ec4751e85be89917d46454f8533800b4e

SHA256
bca613688e735ccd1fae7164550bd8ae90862028cd0bf31534c149ea0d7c9f60

SHA512
6a5b9b863bf139c87b5734d6e8310c7231a1015d8eceb15f76ccf7676d36f9107fd5d817a6f04ed47c3ee45be409073c837beee3c079abde5bc38233c98b9712

Download Submit
C:\Users\Admin\AppData\Local\tempinstall.ini

Filesize
428B

MD5
5e1b68b67986b1588301c0135f19fc7c

SHA1
957ea47285f7d903cce7530ee34852435de5b5b4

SHA256
23456d8ce681d1a5a31bf06262e088f4feb8d0e8fdc1d37afa4aa02830ffacdc

SHA512
268ec437c5971552dacca1e9ef6850543614d5a7f05ac34b41bf05f73e97e4c694d59e4f0618a57660ffad4f2faee653b4c0c824f97a6e9fddc48d22c52739af

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log

Filesize
7KB

MD5
b96ed33dea901b042fab663b04fa9e1d

SHA1
605fceafbd21579d793163432194593e4f47ab02

SHA256
cc7ecdd390ec173502fa02267e3f639bec4543c816f9edafdc1cc5a8bf27ebbc

SHA512
d0430f982eb44cd4c05a92f2493a92dda0f50123c5de656dab1e39d4bd5aeb0f95dfe546cb74e9ed8e89e19a139fa09ca04254f25b677e0767b408b53225d1bd

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log

Filesize
9KB

MD5
80a73f44a96a502976a4d6633bcf6ccc

SHA1
ed60f69e5644dd19b7553a9617c15d658ecad92a

SHA256
16de10afdfbdd8731543a5041fe3e30f69b354e489b16d55c76a111c11089b43

SHA512
bce98332fdebea2f5910c39f68ebdca4f9b4d89c36bc2741f929597298ebe407106e58ef7a56fc6fe44cfe677829fa829028309b70d589b81c792941ef031265

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log

Filesize
26KB

MD5
4eb4b9a49b9c595d29bf5173c0a3924d

SHA1
bb2886cb354319d0bd1d999b2e90be9e522062b2

SHA256
db883391ba3983174259f170085ff0566c45c1b8cb4b7c09e233d02769151ddf

SHA512
a971f4f95910fdf0b4595ae61de25ac5c2e8742c4d9ab1799b85501aff9c7e22e19dd1fe3d6be9acdc105dc5db4f5bf49e8fbc467d5629523cef927bc4d4f009

Download Submit
\Users\Admin\AppData\Local\Temp\nso5D0F.tmp\AccessControl.dll

Filesize
13KB

MD5
28c87a09fdb49060aa4ab558a2832109

SHA1
9213a24964cd479eac91d01ad54190f9c11d0c75

SHA256
933cadcd3a463484bbb3c45077afda0edbb539dfbe988efad79a88cae63bf95f

SHA512
413b3afe5a3b139a199f2a6954edc055eee3b312c3dffd568cfdbe1f740f07a7c27fbf7b2a0b6e3c3dd6ee358ce96cc1ca821883f055bf63ddebda854384700d

Download Submit
\Users\Admin\AppData\Local\Temp\nso5D0F.tmp\System.dll

Filesize
11KB

MD5
0063d48afe5a0cdc02833145667b6641

SHA1
e7eb614805d183ecb1127c62decb1a6be1b4f7a8

SHA256
ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

SHA512
71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

Download Submit
\Users\Admin\AppData\Local\Temp\nso5D0F.tmp\v6svc_oem.dll

Filesize
192KB

MD5
500318167948bdd3ad42a40721e1a72b

SHA1
24134691693e6d78d6eb0a0c64833c12a0090968

SHA256
d3378ee739debcaee8c715963403d96bf025db98bfbb55e54635429890db85c6

SHA512
0a2d3b55528cc53cfce5b47158997300c562afd2c7bb5596532b218d3f482380887ee7c204b13d42425dc0c4cc439a7f9ed167f3767bda7b6e205e7e8f454863

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\Qt5CoreKso.dll

Filesize
5.0MB

MD5
e847288468d4daadcb8f5a8bb152e923

SHA1
574f7b2d1def9d79c4257c4268246fb399041bf6

SHA256
dc450ada7d31c9df923803e687c87dda9b9bec5e3f0efef6a30206872c9559a5

SHA512
b0c939485c7ab200837f8f4eb1da305644457825611a6d829cb6f789e486ef69ef4716f152e487b599f85cddaeb53808e71e3e016b4f7b4c4a71a2506586e133

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\Qt5GuiKso.dll

Filesize
5.3MB

MD5
c79bc97c4dc3a9f6beff0d18a0916b15

SHA1
3cb0b6ae6fd034ee24511c8ecd91c16d73d2b76a

SHA256
0c490173ab692710614f42dde8cf643aec26ff4636dc25d778d1444fe90368ea

SHA512
df1475695972a4c17401a4552e43eb249a99c77c3292c42d48a64964bcd10534fa006ab09124acb197b0b27283042afd0e9163953f824507ca2279c04a82d147

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\Qt5SvgKso.dll

Filesize
392KB

MD5
d7207f0e20b9ec71399fb9914ffb8278

SHA1
e862601902fb95f2cd2b79370dc0547cf382ccd5

SHA256
6b47184545802c689971608dea86a2e7925b21714db800afd56a5eb40398dcc0

SHA512
59afd7add23f80bbe0d3df5be60226b1a80133439b2b6f217a67db1911d3adaba6b360b29f4debf6ed9574619521dc3677248185ad9cc6870488565309f1a3e8

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\Qt5WidgetsKso.dll

Filesize
4.5MB

MD5
e680d10a2632b3bcc9e87790b11c9fc5

SHA1
c97b51036952a79e7173e672f59492487902952a

SHA256
ec89fe25ce694fa68c80aab24cef732c0d9d102b35f38b946cdcce517b5ad329

SHA512
cb6284236c3259bbacc2f90cb6ac059ef9da9d03277df21ac0ec69eb0132271a346477e9305875d4723f6f3327d04fd5f5bb26a9b39d8e8b7c94fea57a83dceb

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\Qt5WinExtrasKso.dll

Filesize
217KB

MD5
4df516604e20d8defb35aaf0fb16a2b5

SHA1
6b34b3fcb1da882e6adbd78f1aa38bfc4710a098

SHA256
4c7efb65779f1b988bfc12623e042338061bd123a89b8171c7db7ace7d416628

SHA512
cd7d4b005f1ff7fbdfbb15da4ffe5513fcb741b2088fa42560f45b6fe4f3dd97efb78c7a2ec49b0ce8a0dc4a5fe237f4ffc68ea6c8b6a048718876656fb5282d

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\api-ms-win-core-file-l1-2-0.dll

Filesize
11KB

MD5
cd3cec3d65ae62fdf044f720245f29c0

SHA1
c4643779a0f0f377323503f2db8d2e4d74c738ca

SHA256
676a6da661e0c02e72bea510f5a48cae71fdc4da0b1b089c24bff87651ec0141

SHA512
aca1029497c5a9d26ee09810639278eb17b8fd11b15c9017c8b578fced29cef56f172750c4cc2b0d1ebf8683d29e15de52a6951fb23d78712e31ddcb41776b0f

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\api-ms-win-core-file-l2-1-0.dll

Filesize
10KB

MD5
b181124928d8eb7b6caa0c2c759155cb

SHA1
1aadbbd43eff2df7bab51c6f3bda2eb2623b281a

SHA256
24ea638dfa9f40e2f395e26e36d308db2ab25ed1baa5c796ac2c560ad4c89d77

SHA512
2a43bf4d50d47924374cde689be24799c4e1c132c0bc981f5109952d3322e91dd5a9352b53bb55ca79a6ea92e2c387e87c064b9d8c8f519b77fff973d752dc8f

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\api-ms-win-core-localization-l1-2-0.dll

Filesize
13KB

MD5
21519f4d5f1fea53532a0b152910ef8b

SHA1
7833ac2c20263c8be42f67151f9234eb8e4a5515

SHA256
5fbd69186f414d1d99ac61c9c15a57390ff21fe995e5c01f1c4e14510b6fb9b1

SHA512
97211fad4aae2f6a6b783107938f0635c302445e74fc34a26aa386864509919c3f084e80579d2502105d9256aab9f57ea16137c43344b1c62f64e5bc1125a417

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
11KB

MD5
b5c8334a10b191031769d5de01df9459

SHA1
83a8fcc777c7e8c42fa4c59ee627baf6cbed1969

SHA256
6c27ac0542281649ec8638602fbc24f246424ba550564fc7b290b683f79e712d

SHA512
59e53c515dfa2cd96182ca6539ed0ea2ebb01f5991beb08166d1fc53576aeaafebbb2c5ee0ccbdab60ae45fc6a048fff0b5e1b8c9c26907791d31fb7e75b1f39

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\api-ms-win-core-timezone-l1-1-0.dll

Filesize
11KB

MD5
86421619dad87870e5f3cc0beb1f7963

SHA1
2f0fe3eb94fa90577846d49c03c4fd08ef9d3fb2

SHA256
64eccd818f6ffc13f57a2ec5ca358b401ffbb1ca13b0c523d479ef5ee9eb44ab

SHA512
dbce9904dd5a403a5a69e528ee1179cc5faab1361715a29b1a0de0cd33ad3ae9c9d5620dafb161fda86cb27909d001be8955940fd051077ffe6f3ff82357ad31

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\api-ms-win-crt-convert-l1-1-0.dll

Filesize
14KB

MD5
88f89d0f2bd5748ed1af75889e715e6a

SHA1
8ada489b9ff33530a3fb7161cc07b5b11dfb8909

SHA256
02c78781bf6cc5f22a0ecedc3847bfd20bed4065ac028c386d063dc2318c33cc

SHA512
1f5a00284ca1d6dc6ae2dfce306febfa6d7d71d421583e4ce6890389334c2d98291e98e992b58136f5d1a41590553e3ad42fb362247ae8adf60e33397afbb5df

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\api-ms-win-crt-environment-l1-1-0.dll

Filesize
11KB

MD5
0979785e3ef8137cdd47c797adcb96e3

SHA1
4051c6eb37a4c0dba47b58301e63df76bff347dd

SHA256
d5164aecde4523ffa2dcfd0315b49428ac220013132ad48422a8ea4ca2361257

SHA512
e369bc53babd327f5d1b9833c0b8d6c7e121072ad81d4ba1fb3e2679f161fb6a9fa2fca0df0bac532fd439beb0d754583582d1dbfeccf2d38cc4f3bdca39b52d

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
12KB

MD5
a1b6cebd3d7a8b25b9a9cbc18d03a00c

SHA1
5516de099c49e0e6d1224286c3dc9b4d7985e913

SHA256
162ccf78fa5a4a2ee380f72fbd54d17a73c929a76f6e3659f537fa8f42602362

SHA512
a322fb09e6faaff0daabb4f0284e4e90ccacff27161dbfd77d39a9a93dbf30069b9d86bf15a07fc2006a55af2c35cd8ea544895c93e2e1697c51f2dafad5a9d7

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\api-ms-win-crt-heap-l1-1-0.dll

Filesize
11KB

MD5
a6a9dfb31be2510f6dbfedd476c6d15a

SHA1
cdb6d8bd1fbd1c71d85437cff55ddeb76139dbe7

SHA256
150d32b77b2d7f49c8d4f44b64a90d7a0f9df0874a80fc925daf298b038a8e4c

SHA512
b4f0e8fa148fac8a94e04bf4b44f2a26221d943cc399e7f48745ed46e8b58c52d9126110cdf868ebb723423fb0e304983d24fe6608d3757a43ad741bddb3b7ec

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\api-ms-win-crt-locale-l1-1-0.dll

Filesize
11KB

MD5
50b721a0c945abe3edca6bcee2a70c6c

SHA1
f35b3157818d4a5af3486b5e2e70bb510ac05eff

SHA256
db495c7c4ad2072d09b2d4506b3a50f04487ad8b27d656685ea3fa5d9653a21d

SHA512
ef2f6d28d01a5bad7c494851077d52f22a11514548c287e513f4820c23f90020a0032e2da16cc170ae80897ae45fc82bffc9d18afb2ae1a7b1da6eef56240840

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\api-ms-win-crt-math-l1-1-0.dll

Filesize
21KB

MD5
461d5af3277efb5f000b9df826581b80

SHA1
935b00c88c2065f98746e2b4353d4369216f1812

SHA256
f9ce464b89dd8ea1d5e0b852369fe3a8322b4b9860e5ae401c9a3b797aed17bf

SHA512
229bf31a1de1e84cf238a0dfe0c3a13fee86da94d611fbc8fdb65086dee6a8b1a6ba37c44c5826c3d8cfa120d0fba9e690d31c5b4e73f98c8362b98be1ee9600

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
15KB

MD5
4f06da894ea013a5e18b8b84a9836d5a

SHA1
40cf36e07b738aa8bba58bc5587643326ff412a9

SHA256
876bd768c8605056579dd8962e2fd7cc96306fab5759d904e8a24e46c25bd732

SHA512
1d7c0682d343416e6942547e6a449be4654158d6a70d78ad3c7e8c2b39c296c9406013a3cfe84d1ae8608f19bee1d4f346d26576d7ed56456eea39d5d7200f79

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
16KB

MD5
5765103e1f5412c43295bd752ccaea03

SHA1
6913bf1624599e55680a0292e22c89cab559db81

SHA256
8f7ace43040fa86e972cc74649d3e643d21e4cad6cb86ba78d4c059ed35d95e4

SHA512
5844ac30bc73b7ffba75016abefb8a339e2f2822fc6e1441f33f70b6eb7114f828167dfc34527b0fb5460768c4de7250c655bc56efd8ba03115cd2dd6f6c91c0

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\api-ms-win-crt-string-l1-1-0.dll

Filesize
17KB

MD5
f364190706414020c02cf4d531e0229d

SHA1
5899230b0d7ad96121c3be0df99235ddd8a47dc6

SHA256
a797c0d43a52e7c8205397225ac931638d73b567683f38dd803195da9d34eac2

SHA512
a9c8abbd846ab55942f440e905d1f3864b82257b8daa44c784b1997a060de0c0439ecc25a2193032d4d85191535e9253e435deed23bdf3d3cb48c4209005a02e

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\api-ms-win-crt-time-l1-1-0.dll

Filesize
13KB

MD5
d0b6a2caec62f5477e4e36b991563041

SHA1
8396e1e02dace6ae4dde33b3e432a3581bc38f5d

SHA256
fd44d833ea40d50981b3151535618eb57b5513ed824a9963251d07abff2baedf

SHA512
69bd6df96de99e6ab9c12d8a1024d20a034a7db3e2b62e8be7fdbc838c4e9001d2497b04209e07a5365d00366c794c31ee89b133304e475dde5f92fdb7fcb0bc

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\api-ms-win-crt-utility-l1-1-0.dll

Filesize
11KB

MD5
3dfb82541979a23a9deb5fd4dcfb6b22

SHA1
5da1d02b764917b38fdc34f4b41fb9a599105dd9

SHA256
0cd6d0ff0ff5ecf973f545e98b68ac6038db5494a8990c3b77b8a95b664b6feb

SHA512
f9a20b3d44d39d941fa131c3a1db37614a2f9b2af7260981a0f72c69f82a5326901f70a56b5f7ad65862630fce59b02f650a132ee7ecfe2e4fc80f694483ca82

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\kpacketui.dll

Filesize
1.9MB

MD5
283a731e55f15516cbefe175ced45d26

SHA1
59eb1520c7b7f1ca8faa494426d6c9a64c15e145

SHA256
9fa73aeb2092080fc29f80f3a1287c1740ed4eb85f883c87be385c846b9b47fe

SHA512
7dc7da18fe2376780ccc226ee1caf7eddb38edc4540fab8c2e5a9589dcdea3b8218fb483df2e8b5c5df358e484b161292399340f4e1ea06b71464b05b220643b

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\msvcp140.dll

Filesize
427KB

MD5
db1e9807b717b91ac6df6262141bd99f

SHA1
f55b0a6b2142c210bbfeebf1bac78134acc383b2

SHA256
5a6dfa5e1ffb6c1e7fc76bd121c6c91305e10dd75fc2124f79fee291a9dd9e86

SHA512
f0621977d20989d21ae14b66c1a7a6c752bfd6d7ccc2c4c4ec1c70ba6756e642fb7f9b1c6a94afadd0f8a05d3c377792e4aa4c1a771d833c40a6f46b90cbe7c3

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll

Filesize
61KB

MD5
b2555aac6faa3c776c7963538e3d642c

SHA1
01d7a80ce29872195770b6a76854d4e0e5576325

SHA256
894172fcd20aa7bf493cab6599d04102208810be1b080d0ef8422b047cdb3c3f

SHA512
0571aed245f8d62d387315a27d485b1154a8664e4db96fb54a67eb2c19ccbd547040378240d60d67668867f715da7775bbe86794329b48ae27e6a5f787e63109

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\qt\plugins\imageformats\qsvg.dll

Filesize
41KB

MD5
90b1c6c13aa734636f94ac73d295c87a

SHA1
d5a9ab0696de39719bdb9bb71eb35353a8552525

SHA256
d62301457c3751ccb81d1a069491ef2ead1379b7910bc763f2d17969efea0406

SHA512
94a4a35294cb1ce7cf233fa95825b989fc7553a9ff78e23284aa592874fc01816fd765ecb800c030a6f92eac2ba69b1d2aad11600a2caa2afeda22e2d1b1325d

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\qt\plugins\platforms\qwindows.dll

Filesize
1.3MB

MD5
b6a37f22541908b36755c1b2907f4972

SHA1
1327b11691fe35918cedfaf35b7c3f2c040f07d0

SHA256
915bc4bb230e1a33ddca17faa5d1a5d63b33a1382a425d4c7364301283f9b977

SHA512
bcace988eae77a67a162aea424920d6ca5ca3b83a4047e450380f67dd6966c47d6b98aeb5b9f05f972f7b4ec39e2ba1cb648997efd62fc82087a24563326b6d3

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll

Filesize
145KB

MD5
ce3eb6e3e6d950fb03ed3753baafd6d1

SHA1
cadd8a045a037a9ce10372b0d1a6907f7c9b93d1

SHA256
d470ed8b89ef39e86587825e17a0525253a2245c9be125818229d1ece015165c

SHA512
02b9fc512fb813e1aa9ee51032d0ba4182ab184883022b46f533df119649e8116869e6be6161681f38d79c1949636ba6309786425f2c1ede5b3f7a16e63a8d96

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\ucrtbase.dll

Filesize
1.1MB

MD5
2040cdcd779bbebad36d36035c675d99

SHA1
918bc19f55e656f6d6b1e4713604483eb997ea15

SHA256
2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359

SHA512
83dc3c7e35f0f83e1224505d04cdbaee12b7ea37a2c3367cb4fccc4fff3e5923cf8a79dd513c33a667d8231b1cc6cfb1e33f957d92e195892060a22f53c7532f

Download Submit
\Users\Admin\AppData\Local\Temp\wps\~f776143\CONTROL\office6\vcruntime140.dll

Filesize
75KB

MD5
8fdb26199d64ae926509f5606460f573

SHA1
7d7d8849e7c77af3042a6f54bdf2bb303d7cd678

SHA256
f1fd5f6ec1cfe0cc3b66b5322ac97568bc63b19c1e415b99aad7c69ddbafa33c

SHA512
f56bf11d4259dbf5d4d1f9fc2ad60ff609cddb21278999e9fa55fe5d74552e8a01ddc55cfdc9bf4b09b3e3130a1356142a24a7db8ec5ea19344de617dc9fa99f

Download Submit
memory/284-56-0x000000000A7C0000-0x000000000A7EF000-memory.dmp

Filesize
188KB

Download
memory/1596-185-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2448-17-0x000000001B520000-0x000000001B802000-memory.dmp

Filesize
2.9MB

Download
memory/2448-18-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2916-12-0x0000000000310000-0x0000000000320000-memory.dmp

Filesize
64KB

Download