Analysis

  • max time kernel
    119s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15-11-2024 04:28

General

  • Target

    fd6e356f17c7db639084ea710174ed0c4ca6c43cc701525f855f241653d47e2d.msi

  • Size

    242.2MB

  • MD5

    4393f1aeb2effbba1df28ca5057e2182

  • SHA1

    ca2985c1f08350363b1b62756035b2982b787ab6

  • SHA256

    fd6e356f17c7db639084ea710174ed0c4ca6c43cc701525f855f241653d47e2d

  • SHA512

    3e655488342b8be0038049b8193da42481c4c2a868ca613f311095d656539d35f01c865a7cb44eb7227ca1ae1ad5b63199a6ba84644dd26506ce6256638d5ed7

  • SSDEEP

    6291456:oLKBfaA+iLH02im/1aOUiWuXsiHDqzGw4w:oLWfadiL1B/1/UZucfzT4

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 10 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies data under HKEY_USERS 63 IoCs
  • Modifies registry class 22 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\fd6e356f17c7db639084ea710174ed0c4ca6c43cc701525f855f241653d47e2d.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2488
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding 5CD000DCA4DCF1B7B6A486C0CED903AA M Global\MSI0000
      2⤵
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:112
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\UpgradeValiantSupervisor','C:\Program Files','C:\Program Files'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2844
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start /min "" "C:\Program Files\UpgradeValiantSupervisor\QuKXZsRXURIinRpoBrKGXnAQNKrytv.exe" x "C:\Program Files\UpgradeValiantSupervisor\XKYmrPWFxyBWJVhaoMMkJtrOmLOXqQ" -o"C:\Program Files\UpgradeValiantSupervisor\" -p"216407uRm!g5%as}S}It" -y & ping 127.0.0.1 -n 2 & start /min "" "C:\Program Files\UpgradeValiantSupervisor\QuKXZsRXURIinRpoBrKGXnAQNKrytv.exe" x "C:\Program Files\UpgradeValiantSupervisor\lZUcUGIkCrHpRcYmglgTBsqAioyfvZ" -x!1_ZhObbZwOavDN.exe -x!sss -x!1_VDHzjIgYYVtDUEXESCkEnfwqxTFttd.exe -x!1_ -x!1_ -x!sa -o"C:\Program Files\UpgradeValiantSupervisor\" -p"39895lK3p$:%-WI>c*Z|" -y
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:316
        • C:\Program Files\UpgradeValiantSupervisor\QuKXZsRXURIinRpoBrKGXnAQNKrytv.exe
          "C:\Program Files\UpgradeValiantSupervisor\QuKXZsRXURIinRpoBrKGXnAQNKrytv.exe" x "C:\Program Files\UpgradeValiantSupervisor\XKYmrPWFxyBWJVhaoMMkJtrOmLOXqQ" -o"C:\Program Files\UpgradeValiantSupervisor\" -p"216407uRm!g5%as}S}It" -y
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: CmdExeWriteProcessMemorySpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2500
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1 -n 2
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:1352
        • C:\Program Files\UpgradeValiantSupervisor\QuKXZsRXURIinRpoBrKGXnAQNKrytv.exe
          "C:\Program Files\UpgradeValiantSupervisor\QuKXZsRXURIinRpoBrKGXnAQNKrytv.exe" x "C:\Program Files\UpgradeValiantSupervisor\lZUcUGIkCrHpRcYmglgTBsqAioyfvZ" -x!1_ZhObbZwOavDN.exe -x!sss -x!1_VDHzjIgYYVtDUEXESCkEnfwqxTFttd.exe -x!1_ -x!1_ -x!sa -o"C:\Program Files\UpgradeValiantSupervisor\" -p"39895lK3p$:%-WI>c*Z|" -y
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: CmdExeWriteProcessMemorySpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2172
      • C:\Program Files\UpgradeValiantSupervisor\ZhObbZwOavDN.exe
        "C:\Program Files\UpgradeValiantSupervisor\ZhObbZwOavDN.exe" -number 111 -file file3 -mode mode3
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1296
      • C:\Program Files\UpgradeValiantSupervisor\WPS_Setup_18608.exe
        "C:\Program Files\UpgradeValiantSupervisor\WPS_Setup_18608.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:920
        • C:\ProgramData\kingsoft\20241115_42955\WPS_Setup_18608.exe
          "C:\ProgramData\kingsoft\20241115_42955\WPS_Setup_18608.exe" /ThemeIndex=#ThemeIndex#
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          PID:896
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2792
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005B8" "00000000000003DC"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2600
  • C:\ProgramData\kingsoft\20241115_42955\WPS_Setup_18608.exe
    "C:\ProgramData\kingsoft\20241115_42955\WPS_Setup_18608.exe" -downpower -ThemeIndex="#ThemeIndex#" -msgwndname=wpssetup_message_F77233A -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~f772146\ -msgsmname=Global\_wpssetup_message_sm_380
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2380

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f76f910.rbs

    Filesize

    7KB

    MD5

    303cc1b23ac4874a920859b38987a9d9

    SHA1

    52db100b441d77ae78adb7ed39303bc87cfcf50f

    SHA256

    8cc84343d094b0bb502c60c9d07d07f9ad2c51f34cf23f272deebd3c6abe2150

    SHA512

    452b2e0568287950a91ea96001bf875307f4de851e9733eacc4aec53b180ef7b9e4549e098adcc82399a7151b03949d7b8cca38e27c47aa98f327303ceb5f657

  • C:\Program Files\UpgradeValiantSupervisor\2_ZhObbZwOavDN.exe

    Filesize

    2.1MB

    MD5

    124b1390f39511fa043e99578d4fad57

    SHA1

    9f2e13afe318878167328104b6710ad53f1f168b

    SHA256

    f65559e20b9473aa23450850ac2a0a6d6045a8987236db6ff9b2b3e448e569e9

    SHA512

    eb0d19da7f3e775ca6e36f0c51f7a83116a16b6096dd0c5e42ef23a4cdcf2cea805e928092c2adc6c78138455b2b2fb7f62dfe287ead2fb3ee7dd0e86f16c9ac

  • C:\Program Files\UpgradeValiantSupervisor\QuKXZsRXURIinRpoBrKGXnAQNKrytv.exe

    Filesize

    577KB

    MD5

    c31c4b04558396c6fabab64dcf366534

    SHA1

    fa836d92edc577d6a17ded47641ba1938589b09a

    SHA256

    9d182f421381429fd77598feb609fefb54dcaef722ddbf5aa611b68a706c10d3

    SHA512

    814dcbc1d43bc037dadc2f3f67856dd790b15fc1b0c50fa74a169c8cc02cdc79d44f1f10e200ef662eee20cd6b5ca646ec4e77673e3fe3cb7dfb7649243f6e99

  • C:\Program Files\UpgradeValiantSupervisor\XKYmrPWFxyBWJVhaoMMkJtrOmLOXqQ

    Filesize

    1.5MB

    MD5

    0a73dff245b9dd0ef7135a3ce13c658d

    SHA1

    8776a42095dd0373fbd6fb810ce427ec8259cc66

    SHA256

    f5006ccdb830241f30c9c2cc0fff2aba502369dff0f402db65fb8033a4562fc8

    SHA512

    be1b38507c4090f5a3010c114322c0b039e5606efb35d3295d466e4a8cf88be228645fb3131bf6a51b25cbda8b3e49b88ea2336f01d7bf994dbac6e595e257c1

  • C:\Program Files\UpgradeValiantSupervisor\lZUcUGIkCrHpRcYmglgTBsqAioyfvZ

    Filesize

    1.5MB

    MD5

    a8c7cb63bdb51e60bbbb6ff4474015b1

    SHA1

    250280ba33a0784bc5c00be39f5c297683db0935

    SHA256

    960bc0889a671757fa66e98e5a0d3aa8c3b839b884a88ab4f40ebff3025eb6d8

    SHA512

    e020225fbcfa53cdbe41d55ca5dbfd49b72428ee58bbf2dc769d401c39056af8cdc8bd1ee80da76eed86b4af7a5548e3b113d012f4ae29b97614abceb194db71

  • C:\ProgramData\kingsoft\20241115_42955\oem.ini

    Filesize

    1KB

    MD5

    920068869d99afbee8244a2be1e667dd

    SHA1

    4fb5d143480d258cb4afa9d009b303a08fc9122b

    SHA256

    53b4432efa05bb55dec931a4641e32a6dccae3fb4730bf66bab2fe58df904d2f

    SHA512

    466623f31264a788fbf83589f8d5601ba1797d9df21da04fca5a13ff25678ddc3291d3086fedfbf5829a1eed93a67759af704c51c38c3378202c34e242eae8da

  • C:\Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\product.dat

    Filesize

    95KB

    MD5

    bb7426885c5f57b6b9405fdc7a94cc65

    SHA1

    0a58a34a41cbea358fd57d278e9b15e669cc28e6

    SHA256

    f32133a910d0ab4b64bb7bc33fd5894e1afeb048b83b09336d8b02cd4c7ae118

    SHA512

    3e8d20fc055b9ebbb49439adc69878e2b1c9a11f45400e7155874c031f950e3dc6ece86998366345c85ee98ac091ac319eb2175fd0100e300b9e856d06ef891d

  • C:\Users\Admin\AppData\Local\tempinstall.ini

    Filesize

    382B

    MD5

    6a5eea749583001de63b993fc66496ba

    SHA1

    fd41691ec4751e85be89917d46454f8533800b4e

    SHA256

    bca613688e735ccd1fae7164550bd8ae90862028cd0bf31534c149ea0d7c9f60

    SHA512

    6a5b9b863bf139c87b5734d6e8310c7231a1015d8eceb15f76ccf7676d36f9107fd5d817a6f04ed47c3ee45be409073c837beee3c079abde5bc38233c98b9712

  • C:\Users\Admin\AppData\Local\tempinstall.ini

    Filesize

    428B

    MD5

    5e1b68b67986b1588301c0135f19fc7c

    SHA1

    957ea47285f7d903cce7530ee34852435de5b5b4

    SHA256

    23456d8ce681d1a5a31bf06262e088f4feb8d0e8fdc1d37afa4aa02830ffacdc

    SHA512

    268ec437c5971552dacca1e9ef6850543614d5a7f05ac34b41bf05f73e97e4c694d59e4f0618a57660ffad4f2faee653b4c0c824f97a6e9fddc48d22c52739af

  • C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log

    Filesize

    7KB

    MD5

    7316e7b5df66b16718dbf91db1cb5c27

    SHA1

    2445d5991053efa9d4334d0c2369ce4b46aed449

    SHA256

    e5faf3ce12b5c80fc4d2b8a95cc166a26102d34048c5a68f2de05a3dfc3fff90

    SHA512

    39911d07e44a9931f46822aa6a4ea5074e7f8d7dcfd81fe7a1e0c0566727b54609a197effdad84bdc9eb628f05e3071b0e726f45b534036030f70276f47b6850

  • C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log

    Filesize

    8KB

    MD5

    20d81ac2e37579eebe8fbe769b939afd

    SHA1

    14efdf1989bc224e9fed0b161504579d8d816835

    SHA256

    41ce9ecabf65a7fc7c10a0d9c0271491c16559f469f9742de9b5932bdd3328b3

    SHA512

    cee24cee85cf2470a756511d92a5366c21a98f46937118c65993d382718e3858a98abe8f50ba6fc0f85eb08f13de055cb6ae14f0c7a468a625a7d5d8f04f92d1

  • C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log

    Filesize

    26KB

    MD5

    fea751632b11e70b4e9df92237890e3a

    SHA1

    2294ee26086c08e30a8cad07679d0e2ab722f09c

    SHA256

    6a8a20631b71d62cf7bdee4b4d2bb1e44dca568506ce3bf09dba94979cb827bd

    SHA512

    7e1d9e374cde783584752438398cb7ac436e7cd85393926f2e65af615657698ac32768218b92503302f266de71906c0b05c15ffc95d67c6d77d8797a67612d9d

  • \Users\Admin\AppData\Local\Temp\nsj1DDE.tmp\AccessControl.dll

    Filesize

    13KB

    MD5

    28c87a09fdb49060aa4ab558a2832109

    SHA1

    9213a24964cd479eac91d01ad54190f9c11d0c75

    SHA256

    933cadcd3a463484bbb3c45077afda0edbb539dfbe988efad79a88cae63bf95f

    SHA512

    413b3afe5a3b139a199f2a6954edc055eee3b312c3dffd568cfdbe1f740f07a7c27fbf7b2a0b6e3c3dd6ee358ce96cc1ca821883f055bf63ddebda854384700d

  • \Users\Admin\AppData\Local\Temp\nsj1DDE.tmp\System.dll

    Filesize

    11KB

    MD5

    0063d48afe5a0cdc02833145667b6641

    SHA1

    e7eb614805d183ecb1127c62decb1a6be1b4f7a8

    SHA256

    ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

    SHA512

    71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

  • \Users\Admin\AppData\Local\Temp\nsj1DDE.tmp\v6svc_oem.dll

    Filesize

    192KB

    MD5

    500318167948bdd3ad42a40721e1a72b

    SHA1

    24134691693e6d78d6eb0a0c64833c12a0090968

    SHA256

    d3378ee739debcaee8c715963403d96bf025db98bfbb55e54635429890db85c6

    SHA512

    0a2d3b55528cc53cfce5b47158997300c562afd2c7bb5596532b218d3f482380887ee7c204b13d42425dc0c4cc439a7f9ed167f3767bda7b6e205e7e8f454863

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\Qt5CoreKso.dll

    Filesize

    5.0MB

    MD5

    e847288468d4daadcb8f5a8bb152e923

    SHA1

    574f7b2d1def9d79c4257c4268246fb399041bf6

    SHA256

    dc450ada7d31c9df923803e687c87dda9b9bec5e3f0efef6a30206872c9559a5

    SHA512

    b0c939485c7ab200837f8f4eb1da305644457825611a6d829cb6f789e486ef69ef4716f152e487b599f85cddaeb53808e71e3e016b4f7b4c4a71a2506586e133

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\Qt5GuiKso.dll

    Filesize

    5.3MB

    MD5

    c79bc97c4dc3a9f6beff0d18a0916b15

    SHA1

    3cb0b6ae6fd034ee24511c8ecd91c16d73d2b76a

    SHA256

    0c490173ab692710614f42dde8cf643aec26ff4636dc25d778d1444fe90368ea

    SHA512

    df1475695972a4c17401a4552e43eb249a99c77c3292c42d48a64964bcd10534fa006ab09124acb197b0b27283042afd0e9163953f824507ca2279c04a82d147

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\Qt5SvgKso.dll

    Filesize

    392KB

    MD5

    d7207f0e20b9ec71399fb9914ffb8278

    SHA1

    e862601902fb95f2cd2b79370dc0547cf382ccd5

    SHA256

    6b47184545802c689971608dea86a2e7925b21714db800afd56a5eb40398dcc0

    SHA512

    59afd7add23f80bbe0d3df5be60226b1a80133439b2b6f217a67db1911d3adaba6b360b29f4debf6ed9574619521dc3677248185ad9cc6870488565309f1a3e8

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\Qt5WidgetsKso.dll

    Filesize

    4.5MB

    MD5

    e680d10a2632b3bcc9e87790b11c9fc5

    SHA1

    c97b51036952a79e7173e672f59492487902952a

    SHA256

    ec89fe25ce694fa68c80aab24cef732c0d9d102b35f38b946cdcce517b5ad329

    SHA512

    cb6284236c3259bbacc2f90cb6ac059ef9da9d03277df21ac0ec69eb0132271a346477e9305875d4723f6f3327d04fd5f5bb26a9b39d8e8b7c94fea57a83dceb

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\Qt5WinExtrasKso.dll

    Filesize

    217KB

    MD5

    4df516604e20d8defb35aaf0fb16a2b5

    SHA1

    6b34b3fcb1da882e6adbd78f1aa38bfc4710a098

    SHA256

    4c7efb65779f1b988bfc12623e042338061bd123a89b8171c7db7ace7d416628

    SHA512

    cd7d4b005f1ff7fbdfbb15da4ffe5513fcb741b2088fa42560f45b6fe4f3dd97efb78c7a2ec49b0ce8a0dc4a5fe237f4ffc68ea6c8b6a048718876656fb5282d

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\api-ms-win-core-file-l1-2-0.dll

    Filesize

    11KB

    MD5

    cd3cec3d65ae62fdf044f720245f29c0

    SHA1

    c4643779a0f0f377323503f2db8d2e4d74c738ca

    SHA256

    676a6da661e0c02e72bea510f5a48cae71fdc4da0b1b089c24bff87651ec0141

    SHA512

    aca1029497c5a9d26ee09810639278eb17b8fd11b15c9017c8b578fced29cef56f172750c4cc2b0d1ebf8683d29e15de52a6951fb23d78712e31ddcb41776b0f

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\api-ms-win-core-file-l2-1-0.dll

    Filesize

    10KB

    MD5

    b181124928d8eb7b6caa0c2c759155cb

    SHA1

    1aadbbd43eff2df7bab51c6f3bda2eb2623b281a

    SHA256

    24ea638dfa9f40e2f395e26e36d308db2ab25ed1baa5c796ac2c560ad4c89d77

    SHA512

    2a43bf4d50d47924374cde689be24799c4e1c132c0bc981f5109952d3322e91dd5a9352b53bb55ca79a6ea92e2c387e87c064b9d8c8f519b77fff973d752dc8f

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    13KB

    MD5

    21519f4d5f1fea53532a0b152910ef8b

    SHA1

    7833ac2c20263c8be42f67151f9234eb8e4a5515

    SHA256

    5fbd69186f414d1d99ac61c9c15a57390ff21fe995e5c01f1c4e14510b6fb9b1

    SHA512

    97211fad4aae2f6a6b783107938f0635c302445e74fc34a26aa386864509919c3f084e80579d2502105d9256aab9f57ea16137c43344b1c62f64e5bc1125a417

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    11KB

    MD5

    b5c8334a10b191031769d5de01df9459

    SHA1

    83a8fcc777c7e8c42fa4c59ee627baf6cbed1969

    SHA256

    6c27ac0542281649ec8638602fbc24f246424ba550564fc7b290b683f79e712d

    SHA512

    59e53c515dfa2cd96182ca6539ed0ea2ebb01f5991beb08166d1fc53576aeaafebbb2c5ee0ccbdab60ae45fc6a048fff0b5e1b8c9c26907791d31fb7e75b1f39

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    11KB

    MD5

    86421619dad87870e5f3cc0beb1f7963

    SHA1

    2f0fe3eb94fa90577846d49c03c4fd08ef9d3fb2

    SHA256

    64eccd818f6ffc13f57a2ec5ca358b401ffbb1ca13b0c523d479ef5ee9eb44ab

    SHA512

    dbce9904dd5a403a5a69e528ee1179cc5faab1361715a29b1a0de0cd33ad3ae9c9d5620dafb161fda86cb27909d001be8955940fd051077ffe6f3ff82357ad31

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\api-ms-win-crt-convert-l1-1-0.dll

    Filesize

    14KB

    MD5

    88f89d0f2bd5748ed1af75889e715e6a

    SHA1

    8ada489b9ff33530a3fb7161cc07b5b11dfb8909

    SHA256

    02c78781bf6cc5f22a0ecedc3847bfd20bed4065ac028c386d063dc2318c33cc

    SHA512

    1f5a00284ca1d6dc6ae2dfce306febfa6d7d71d421583e4ce6890389334c2d98291e98e992b58136f5d1a41590553e3ad42fb362247ae8adf60e33397afbb5df

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\api-ms-win-crt-environment-l1-1-0.dll

    Filesize

    11KB

    MD5

    0979785e3ef8137cdd47c797adcb96e3

    SHA1

    4051c6eb37a4c0dba47b58301e63df76bff347dd

    SHA256

    d5164aecde4523ffa2dcfd0315b49428ac220013132ad48422a8ea4ca2361257

    SHA512

    e369bc53babd327f5d1b9833c0b8d6c7e121072ad81d4ba1fb3e2679f161fb6a9fa2fca0df0bac532fd439beb0d754583582d1dbfeccf2d38cc4f3bdca39b52d

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\api-ms-win-crt-filesystem-l1-1-0.dll

    Filesize

    12KB

    MD5

    a1b6cebd3d7a8b25b9a9cbc18d03a00c

    SHA1

    5516de099c49e0e6d1224286c3dc9b4d7985e913

    SHA256

    162ccf78fa5a4a2ee380f72fbd54d17a73c929a76f6e3659f537fa8f42602362

    SHA512

    a322fb09e6faaff0daabb4f0284e4e90ccacff27161dbfd77d39a9a93dbf30069b9d86bf15a07fc2006a55af2c35cd8ea544895c93e2e1697c51f2dafad5a9d7

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\api-ms-win-crt-heap-l1-1-0.dll

    Filesize

    11KB

    MD5

    a6a9dfb31be2510f6dbfedd476c6d15a

    SHA1

    cdb6d8bd1fbd1c71d85437cff55ddeb76139dbe7

    SHA256

    150d32b77b2d7f49c8d4f44b64a90d7a0f9df0874a80fc925daf298b038a8e4c

    SHA512

    b4f0e8fa148fac8a94e04bf4b44f2a26221d943cc399e7f48745ed46e8b58c52d9126110cdf868ebb723423fb0e304983d24fe6608d3757a43ad741bddb3b7ec

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\api-ms-win-crt-locale-l1-1-0.dll

    Filesize

    11KB

    MD5

    50b721a0c945abe3edca6bcee2a70c6c

    SHA1

    f35b3157818d4a5af3486b5e2e70bb510ac05eff

    SHA256

    db495c7c4ad2072d09b2d4506b3a50f04487ad8b27d656685ea3fa5d9653a21d

    SHA512

    ef2f6d28d01a5bad7c494851077d52f22a11514548c287e513f4820c23f90020a0032e2da16cc170ae80897ae45fc82bffc9d18afb2ae1a7b1da6eef56240840

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\api-ms-win-crt-math-l1-1-0.dll

    Filesize

    21KB

    MD5

    461d5af3277efb5f000b9df826581b80

    SHA1

    935b00c88c2065f98746e2b4353d4369216f1812

    SHA256

    f9ce464b89dd8ea1d5e0b852369fe3a8322b4b9860e5ae401c9a3b797aed17bf

    SHA512

    229bf31a1de1e84cf238a0dfe0c3a13fee86da94d611fbc8fdb65086dee6a8b1a6ba37c44c5826c3d8cfa120d0fba9e690d31c5b4e73f98c8362b98be1ee9600

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\api-ms-win-crt-runtime-l1-1-0.dll

    Filesize

    15KB

    MD5

    4f06da894ea013a5e18b8b84a9836d5a

    SHA1

    40cf36e07b738aa8bba58bc5587643326ff412a9

    SHA256

    876bd768c8605056579dd8962e2fd7cc96306fab5759d904e8a24e46c25bd732

    SHA512

    1d7c0682d343416e6942547e6a449be4654158d6a70d78ad3c7e8c2b39c296c9406013a3cfe84d1ae8608f19bee1d4f346d26576d7ed56456eea39d5d7200f79

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\api-ms-win-crt-stdio-l1-1-0.dll

    Filesize

    16KB

    MD5

    5765103e1f5412c43295bd752ccaea03

    SHA1

    6913bf1624599e55680a0292e22c89cab559db81

    SHA256

    8f7ace43040fa86e972cc74649d3e643d21e4cad6cb86ba78d4c059ed35d95e4

    SHA512

    5844ac30bc73b7ffba75016abefb8a339e2f2822fc6e1441f33f70b6eb7114f828167dfc34527b0fb5460768c4de7250c655bc56efd8ba03115cd2dd6f6c91c0

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\api-ms-win-crt-string-l1-1-0.dll

    Filesize

    17KB

    MD5

    f364190706414020c02cf4d531e0229d

    SHA1

    5899230b0d7ad96121c3be0df99235ddd8a47dc6

    SHA256

    a797c0d43a52e7c8205397225ac931638d73b567683f38dd803195da9d34eac2

    SHA512

    a9c8abbd846ab55942f440e905d1f3864b82257b8daa44c784b1997a060de0c0439ecc25a2193032d4d85191535e9253e435deed23bdf3d3cb48c4209005a02e

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\api-ms-win-crt-time-l1-1-0.dll

    Filesize

    13KB

    MD5

    d0b6a2caec62f5477e4e36b991563041

    SHA1

    8396e1e02dace6ae4dde33b3e432a3581bc38f5d

    SHA256

    fd44d833ea40d50981b3151535618eb57b5513ed824a9963251d07abff2baedf

    SHA512

    69bd6df96de99e6ab9c12d8a1024d20a034a7db3e2b62e8be7fdbc838c4e9001d2497b04209e07a5365d00366c794c31ee89b133304e475dde5f92fdb7fcb0bc

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\api-ms-win-crt-utility-l1-1-0.dll

    Filesize

    11KB

    MD5

    3dfb82541979a23a9deb5fd4dcfb6b22

    SHA1

    5da1d02b764917b38fdc34f4b41fb9a599105dd9

    SHA256

    0cd6d0ff0ff5ecf973f545e98b68ac6038db5494a8990c3b77b8a95b664b6feb

    SHA512

    f9a20b3d44d39d941fa131c3a1db37614a2f9b2af7260981a0f72c69f82a5326901f70a56b5f7ad65862630fce59b02f650a132ee7ecfe2e4fc80f694483ca82

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\kpacketui.dll

    Filesize

    1.9MB

    MD5

    283a731e55f15516cbefe175ced45d26

    SHA1

    59eb1520c7b7f1ca8faa494426d6c9a64c15e145

    SHA256

    9fa73aeb2092080fc29f80f3a1287c1740ed4eb85f883c87be385c846b9b47fe

    SHA512

    7dc7da18fe2376780ccc226ee1caf7eddb38edc4540fab8c2e5a9589dcdea3b8218fb483df2e8b5c5df358e484b161292399340f4e1ea06b71464b05b220643b

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\msvcp140.dll

    Filesize

    427KB

    MD5

    db1e9807b717b91ac6df6262141bd99f

    SHA1

    f55b0a6b2142c210bbfeebf1bac78134acc383b2

    SHA256

    5a6dfa5e1ffb6c1e7fc76bd121c6c91305e10dd75fc2124f79fee291a9dd9e86

    SHA512

    f0621977d20989d21ae14b66c1a7a6c752bfd6d7ccc2c4c4ec1c70ba6756e642fb7f9b1c6a94afadd0f8a05d3c377792e4aa4c1a771d833c40a6f46b90cbe7c3

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll

    Filesize

    61KB

    MD5

    b2555aac6faa3c776c7963538e3d642c

    SHA1

    01d7a80ce29872195770b6a76854d4e0e5576325

    SHA256

    894172fcd20aa7bf493cab6599d04102208810be1b080d0ef8422b047cdb3c3f

    SHA512

    0571aed245f8d62d387315a27d485b1154a8664e4db96fb54a67eb2c19ccbd547040378240d60d67668867f715da7775bbe86794329b48ae27e6a5f787e63109

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\qt\plugins\imageformats\qsvg.dll

    Filesize

    41KB

    MD5

    90b1c6c13aa734636f94ac73d295c87a

    SHA1

    d5a9ab0696de39719bdb9bb71eb35353a8552525

    SHA256

    d62301457c3751ccb81d1a069491ef2ead1379b7910bc763f2d17969efea0406

    SHA512

    94a4a35294cb1ce7cf233fa95825b989fc7553a9ff78e23284aa592874fc01816fd765ecb800c030a6f92eac2ba69b1d2aad11600a2caa2afeda22e2d1b1325d

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\qt\plugins\platforms\qwindows.dll

    Filesize

    1.3MB

    MD5

    b6a37f22541908b36755c1b2907f4972

    SHA1

    1327b11691fe35918cedfaf35b7c3f2c040f07d0

    SHA256

    915bc4bb230e1a33ddca17faa5d1a5d63b33a1382a425d4c7364301283f9b977

    SHA512

    bcace988eae77a67a162aea424920d6ca5ca3b83a4047e450380f67dd6966c47d6b98aeb5b9f05f972f7b4ec39e2ba1cb648997efd62fc82087a24563326b6d3

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll

    Filesize

    145KB

    MD5

    ce3eb6e3e6d950fb03ed3753baafd6d1

    SHA1

    cadd8a045a037a9ce10372b0d1a6907f7c9b93d1

    SHA256

    d470ed8b89ef39e86587825e17a0525253a2245c9be125818229d1ece015165c

    SHA512

    02b9fc512fb813e1aa9ee51032d0ba4182ab184883022b46f533df119649e8116869e6be6161681f38d79c1949636ba6309786425f2c1ede5b3f7a16e63a8d96

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\ucrtbase.dll

    Filesize

    1.1MB

    MD5

    2040cdcd779bbebad36d36035c675d99

    SHA1

    918bc19f55e656f6d6b1e4713604483eb997ea15

    SHA256

    2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359

    SHA512

    83dc3c7e35f0f83e1224505d04cdbaee12b7ea37a2c3367cb4fccc4fff3e5923cf8a79dd513c33a667d8231b1cc6cfb1e33f957d92e195892060a22f53c7532f

  • \Users\Admin\AppData\Local\Temp\wps\~f772146\CONTROL\office6\vcruntime140.dll

    Filesize

    75KB

    MD5

    8fdb26199d64ae926509f5606460f573

    SHA1

    7d7d8849e7c77af3042a6f54bdf2bb303d7cd678

    SHA256

    f1fd5f6ec1cfe0cc3b66b5322ac97568bc63b19c1e415b99aad7c69ddbafa33c

    SHA512

    f56bf11d4259dbf5d4d1f9fc2ad60ff609cddb21278999e9fa55fe5d74552e8a01ddc55cfdc9bf4b09b3e3130a1356142a24a7db8ec5ea19344de617dc9fa99f

  • memory/112-12-0x00000000003F0000-0x0000000000400000-memory.dmp

    Filesize

    64KB

  • memory/896-191-0x0000000000270000-0x0000000000272000-memory.dmp

    Filesize

    8KB

  • memory/1296-58-0x00000000007E0000-0x000000000080F000-memory.dmp

    Filesize

    188KB

  • memory/2844-17-0x000000001B4F0000-0x000000001B7D2000-memory.dmp

    Filesize

    2.9MB

  • memory/2844-18-0x00000000027D0000-0x00000000027D8000-memory.dmp

    Filesize

    32KB