c37d5ffed0d3701c794cd3b660a55d42e24ed330585831b5ab0a782bb981a707

Analysis

max time kernel
25s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 7.8MB
Sample260730-v9ygdatekh
SHA256 c37d5ffed0d3701c794cd3b660a55d42e24ed330585831b5ab0a782bb981a707
MD5 5582fff8a24b3ec87f75abfa2272e0d9
SHA1 bdfa339b71646461557ed1833b39175a857b730b
SHA512 64e8278efc8b3c77bcdb23a5a02c60bd8f0995e1633d15497691ace1c43a4582efae13eb2663d7e69338416639246f254e5584a0902c2a8a15f6b3700bd61d25
SSDEEP 98304:pF+FrNL4TlyNLjZ44tko0xdrkGSHKafsHK+23Ww1j4DO8ZQoovaPifAEC/m8qRJ5:j2rN8TINLjZ+7fui5O8saAAEucf
TLSH
T19586AF47A3E801ECD0BBC13C89569613E7B2B85513709BCF16A1867A5F63AF25E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5160	elevation_service.exe
1900	elevation_service.exe
1128	maintenanceservice.exe
1696	OSE.EXE
256	PerceptionSimulationService.exe
3404	perfhost.exe
6116	ReFsDedupSvc.exe
1048	SensorDataService.exe
1516	ssh-agent.exe
4500	AgentService.exe
732	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Unexpected DNS network traffic destination 60 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	223.5.5.5
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	223.5.5.5
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	119.29.29.29
Destination IP	119.29.29.29

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b91cbf1e83806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6888	msedge.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e5fe5cb4a20dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c39b54cc4a20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063c3bbcc4a20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3f80ecd4a20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd7357cd4a20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe

Modifies system certificate store 2 TTPs 40 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\OemEsim	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedDevices	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\FlightRoot	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TestSignRoot	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4292	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4292	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4292	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4292	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4292	2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	4500	AgentService.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: 33	732	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	732	SearchIndexer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 2892	732	SearchIndexer.exe	100
PID 732 wrote to memory of 3252	732	SearchIndexer.exe	101
PID 732 wrote to memory of 3256	732	SearchIndexer.exe	102
PID 732 wrote to memory of 2540	732	SearchIndexer.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4292
- C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
  "C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
  2⤵
  PID:4880
- - C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
    "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService
    3⤵
    PID:6384
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wpsoffice.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wpsoffice.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=klangmanager -dll_name=klangmanager.dll downloadlang en_US
    3⤵
    PID:3020
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\kwinappinstaller.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\kwinappinstaller.exe" -i "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\menuext" wpsappext1 wpsappext2 wpsappext3
    3⤵
    PID:6228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://global.wps.com/activity/web/pc/install-success?activity_flag=aff68d4f3474ee257&page_flag=p6a720ee9e863df96?device_id=90945e0f7749a1836ac8b46b27e05073&app_version=12.1.0.28032&channel=601.1229&platform=windows
  2⤵
  PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7ffd8a80c188,0x7ffd8a80c194,0x7ffd8a80c1a0
    3⤵
    PID:6568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,5269919145227149098,295804754402690439,262144 --field-trial-handle=2784,i,3996118844147094162,5811544643187500335,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:2
    3⤵
    PID:6720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1668,i,13216258702348438132,4500878609068783900,524288 --field-trial-handle=2784,i,3996118844147094162,5811544643187500335,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,7691429426489032137,2059242253807612689,524288 --field-trial-handle=2784,i,3996118844147094162,5811544643187500335,262144 --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:13
    3⤵
    PID:6868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,5331264181261485291,15137857768219120326,2097152 --field-trial-handle=2784,i,3996118844147094162,5811544643187500335,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:6972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,3677041304763418539,5265151924146514957,2097152 --field-trial-handle=2784,i,3996118844147094162,5811544643187500335,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,7571821914913615149,12573883894020074217,2097152 --field-trial-handle=2784,i,3996118844147094162,5811544643187500335,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
    3⤵
    PID:7112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,13388347673950708864,13180760271607446614,2097152 --field-trial-handle=2784,i,3996118844147094162,5811544643187500335,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:9
    3⤵
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,2381532088669416546,1333138385275406326,524288 --field-trial-handle=2784,i,3996118844147094162,5811544643187500335,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
    3⤵
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,8936139320275699650,2216988940526864267,524288 --field-trial-handle=2784,i,3996118844147094162,5811544643187500335,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,15719788764868187404,3015565869732428307,524288 --field-trial-handle=2784,i,3996118844147094162,5811544643187500335,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
    3⤵
    PID:3856
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,14604372849710088689,1169789575637111179,524288 --field-trial-handle=2784,i,3996118844147094162,5811544643187500335,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:14
    3⤵
    PID:7076
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,14604372849710088689,1169789575637111179,524288 --field-trial-handle=2784,i,3996118844147094162,5811544643187500335,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:14
    3⤵
    PID:5908
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe" /prometheus /download_lang_on_start /lang=en_US /from=get_start_with_wps_after_install_onlinesetup
  2⤵
  PID:1600
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wps.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wps.exe" /prometheus /download_lang_on_start /lang=en_US /from=get_start_with_wps_after_install_onlinesetup
    3⤵
    PID:6216
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wpscloudsvr.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wpscloudsvr.exe" /qingbangong /start_from=qingipc /qingbangong /start_from=kstartpage silentautologin
      4⤵
      PID:5608

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1900

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1128

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1696

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:256

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3404

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6116

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1048

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1516

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:732
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2892
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3252
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2540

C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
"C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5A29F0 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\
1⤵
PID:2204
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\wtoolex\wpsupdate.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\wtoolex\wpsupdate.exe" /from:setup
  2⤵
  PID:6804
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\wtoolex\wpsupdate.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\wtoolex\wpsupdate.exe" -createtask
  2⤵
  PID:6648
- C:\Windows\system32\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kdesktopshellext\kdesktopshellext.dll"
  2⤵
  PID:5304
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kdesktopshellext\kdesktopshellext.dll"
    3⤵
    PID:6552

C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
1⤵
PID:6492

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"
1⤵
PID:6444
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wps.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wps.exe"
  2⤵
  PID:6800
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wpscloudsvr.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wpscloudsvr.exe" /qingbangong /start_from=qingipc /qingbangong /start_from=kstartpage silentautologin
    3⤵
    PID:6908
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wps.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wps.exe" Run -Entry=EntryPoint "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28032/office6/addons/kcef/jsapibrowser.dll" --server=browser.a3ba19ec797144349ea5dbc1b742aca1.28032.e3afed0047b08059.high.dpi1.pipe --from=wpsoffice
    3⤵
    PID:2056

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\\ksolaunch.exe"
1⤵
PID:6160
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wps.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wps.exe"
  2⤵
  PID:4612
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wpscloudsvr.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wpscloudsvr.exe" /qingbangong /start_from=qingipc /qingbangong /start_from=kstartpage silentautologin
    3⤵
    PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8da77d2b1a665975ec770a56aa3a52b9bf41d6c8775a1311b0fc89df533a2539
MD5 d626578f7771098793bdcd6d3ade8558
SHA1 bd98021093c669b6d07e24bf364e032ee1f6eb41
SHA512 b5bfe753a5142721e8a1c0dcacb3cfd81bdb13136f75b16cddadb957923067111139e9188508da3534e8484fe3a9f26e399649a371f8f2e46cb9aa66bb8e9707
SSDEEP 49152:wb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnQvj8qr1JzvwZ:a3q6sjBh8qRJTwZ
TLSH
T133D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 b4c62173e018bad263f5355eb705a9869a1b15412ee1df93818e870c5eca031d
MD5 c727531349378dfe07dc1e7f6d3893dd
SHA1 52893f49b49bbedabab4861f026a32f53eec3afa
SHA512 3c9fd69069318b35eba6b589117aae23df5cd848c9573237728d9b28695079b58ae5803d8639fe5a8bf5857c48fd3bf2688123144f41f3e4fa7e9f9332143795
SSDEEP 24576:hXYfDtczAlvwoUQ8qrgohJ/rciJljHQeHP:ktcWvj8qr1JzvwQ
TLSH
T12005F128A7E408F9ED67827CCDA2C411E6737C504760E79B03B499665F332E85E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 a72eb4eb5a54e4d184c491fff065a3cef20422bad7eab6f9f393c3e1ad9cf60e
MD5 145f97a6e7094810fd5785d586c36196
SHA1 ba65d1eb486a75860a7c2048643146b971ca6976
SHA512 b3188b3ee1c16d2e148f822f7869adfeb0b5642923ad1cc40b51c52dd213143b5601efe601b599d8e786ba7645e3b0d32c52fb28a1993b97c12958e49cab15ab
SSDEEP 24576:Z0Le5ji0hmxxrMYvwoUQ8qrgohJ/rciJljHQeHE:ZPji0AjHvj8qr1JzvwL
TLSH
T1CE35AE16F6788731D073C0B9C5D2A69EE97130811B308ACB4296D77C7F676E68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 60a3eeb13d2fc3ac7c6d684752eef33c730137242451b9d44898685c3d12d2e8
MD5 ee5ec7b1bc1d9acfb06ac5ff637a1f3a
SHA1 3cfed1c7dbbe0a607f776d1d63c4d5dcf80fb3d4
SHA512 f360d81fe6c9a593a6d71dc159a9007eca0686326602819293fdec353a791885a8943f091eb7eedc11c0b4064a14ad37c2682cbddd9bbf3ae848efb31c956c77
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWn6q8wyuGvwoUQ8qrgohJ/rciJljHQeHR:v/ezSC6vUzPveHjybvj8qr1JzvwO
TLSH
T1AA756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f0ec6257c90895edd41ca884ac4b8eb6f4261b789eee34a69418e02bb5d50fe6
MD5 eae4382d636b98b2970c025d384846a8
SHA1 ab1f3226489c479de908d7e905b8f7fe46d9a292
SHA512 233a4635407ad4b76405a54bd15cc368f397f577edabc4ca82119c629a4d1711b875a508814e03e8096f52d6bcf81601ab1756a8d0e2531450d54714770346aa
SSDEEP 24576:bVbqPb88hv/l+YxvwoUQ8qrgohJ/rciJljHQeHf:bVO88hXl+evj8qr1JzvwA
TLSH
T193559E66F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 4aca0b977f856e60ccaa4c7808004ffc42a965f97d84a12f57b07bffd41c984d
MD5 dc9823bcf905bb150d26831d1153ab86
SHA1 949cbd3bbe9b650daa7e07dcb2c0dba16cca995c
SHA512 a53dfc3f984b398d2008493c6a9999519e1e9d25590f5c24eaf40e4f7460522ae8f9adba50dbcd245c8a7630daaaaaec728e690ce5f1767aadc972a36bb01a1f
SSDEEP 12288:sLUi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9K:sLUvwoUQ8qrgohJ/rciJljHQeHK
TLSH
T1B0C423858D7C1CA1FFEB8134BEC2E0B475C9BCB068A65A374371BADA99311B1DD05231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 d7a2c28ceab9f1a9eeb141a4156df5eafb57e3bfd5195547756ce5491b744d78
MD5 13d041ff96c555ce0387b2f16a03be2d
SHA1 7b135e9b588b8a9989b4a57a6e03861201e99516
SHA512 c588a36f49ba1fbb525726ea4827cc16e2d34a1174705616d0aa06477e3cf2f46c51f9ebaac24213e9674da86ee2c56b166686c2d3ed759611f72a7d0868a9a5
SSDEEP 12288:WeBNUbTVO86U5i8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9T:WJIU5vwoUQ8qrgohJ/rciJljHQeHT
TLSH
T19A05CF3BEE38FCD2C67A8D785B91C200E7A278704B6293CBD175824EDE235E15E75825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 962f28d1f52504a433db26d913c062b5dd2841a5d141675e9b588daed0d16ceb
MD5 265b5a4a99a4d1702c86b5d35c8c741b
SHA1 f6dfb48a325bc20a7fd2a78f00980ae8c585ec39
SHA512 bf74f15007bb2c148be48fadf47a85d52d6c54efc7527f0782bc84b1f3cbc69771048dfc013d1b8a6a2e53e6d082320e105ba925966e5111668d5174ee5011df
SSDEEP 49152:/CbRquA/m2yL5zLfFiV+XenmE3/zXvj8qr1Jzvwc:Yoq2Vjnmk8qRJTwc
TLSH
T104D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 38e9701b42e62851b1d6dc4435c3f8a90ad0fb139cb63852b901812ba8b1efa7
MD5 2d1b2dacf44dae34be6a97b5abb70788
SHA1 9e8721edf22f46d7633e4c49d48e40c5c3ae1c38
SHA512 38fcadb0fcd897e6a7784f9741a7639554306e3496b2341bd902080dc585c818d6180745c581fcf19d978a96371a5d36d03fd65f381729706a85f3b855583f50
SSDEEP 12288:tmw5HEjsChNVBFgl0WDm+Cmi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoH8:Iwu4OW7vwoUQ8qrgohJ/rciJljHQeHU
TLSH
T13305F14566A81CF9E9A78238CA87D035F7F2BC112A25DB2F1770C65B5F33261AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 15f9b1feeb599343d5d28b8356bed2540574fccb52bb02faa09fc82044e5bb7c
MD5 da01fca8fbb962e11f0eab04cc0ab7aa
SHA1 ec7194c109169a7fea355b1a7a7c16012c57ff6d
SHA512 82ac1052de15368c8b3a2a7ab4ed76ccd17e1138420cd2a139ae077c31234eb066cd254a817dd8a8ec5ee10f17d3c68dc2324e36dff9530ff1ff22e34b32ad12
SSDEEP 49152:gB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl1vj8qr1JzvwC:6u6Jmdxd2dd8qRJTwC
TLSH
T1A0D59D13F1DA01E8D06ED478974A9232F962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 dfa0e7919b5b67cd9239a1e63dfc4740104643e8f3c84b4365fe005076f65c9b
MD5 85d38bc2afe9d7823c30b1f0d6ffe636
SHA1 3056211837393b5e42f5e78275278ed4d44f5d10
SHA512 aa2ea6623fc263dcc0bd651557f00dfaeb032e2c9874f2c40329817c6721b4ebc80655e0e5cfec11647a3fd9a5b78134331323ce9dda18dc77dcf9846fed9559
SSDEEP 24576:nfwvUk9RX6wkyAI0vwoUQ8qrgohJ/rciJljHQeH8:1MnYI0vj8qr1Jzvw7
TLSH
T14335C029EBDC04E5E1B7923C9DA3460AF6B178681B31C6CF125A53AD0E37EE45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3d318d9957cdbb424ca598edbebbdbeaf4a3131f6c44375c14be1c9f68976ca0
MD5 d8740252d1d802ce77e3e4b12756faa4
SHA1 a0335112245b4c3771a6bd6ec7ad74332c260d3a
SHA512 31dfefdd8e7cc8dab31302ba770a6cbb0f1568448ec702871ab124ba001cd143ac7004e771bf56d0b2571eee24c1e3e71ff5b70beeeafda0ad18530053620853
SSDEEP 49152:LYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Fvj8qr1Jzvws:OySzPl8qRJTws
TLSH
T197066C96A16801D5C1B9C1B98F0BCC1BFAB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d8ac96a45cdf76837139c050eede66fc1d8dad8541c8494fa64de9070b2d1d67
MD5 002791b901c48b35cf718404394e1e5d
SHA1 b222473e40b224fa9de94417133d88228dcea712
SHA512 cced81722dc77b0cfcf862bdb07d47907417dc3572a7b8bb35060b1e9700cb5653d069391f563481396285e0c986c9d2fd0a185651e777555c8cfaedeeb50a2b
SSDEEP 24576:a47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYDvwoUQ8qrgohJ/rciJljHQeHY:a47JUQjTirIhCnDHUPfF/1vj8qr1JzvK
TLSH
T13265AE1DA3EC01E5E1BA827885558A5AEA71782D1F31CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 956KB
SHA256 25ea535f2c0d566131f89658c6d69af4ddd0225045c2e18c59671b446bf7306b
MD5 62c338c686b21b16d1036aa6f40d8f06
SHA1 36b3783e825bfa2a768d2b040ad6449e381279c9
SHA512 95255c012ca814ed2bb352fd2889616a76d248587360dec5b67efc25f8e10a515780125f7ee52e9a6d5d94abe41997dd38d90ad11462f0ef764a3eed2ed5c2e9
SSDEEP 6144:oFsBC2naEKyTR9y3RcbPotMxfwZjU3fUkxQlm8nITxKqnnmks1qOc9tcSYuolO/+:oihqXU3f+08KxKqnp9tOxlO/q8+
TLSH
T1CF251810766BD75FC6AD40321E36D6CCA7707D01EE05AB0772C8972FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 325KB
SHA256 589e6032ad3a8f6c8fb2e5273c29cbf750e0337d134f1661c0d2418858f3d23b
MD5 a6d483b79c20978a0bdb5c58a9cb3e7d
SHA1 9291c269668b47afd343638947f81824dd067d53
SHA512 ef21268a05ae2aef9e27439ade63b8b21bbcf7ba2e2159b0dbf2543a98d113302c02d36c936cca22df5b3a42894b422fe636b35ca6048fea3b7479a79c874344
SSDEEP 768:x/lToOlTPBlTz2+EQMzo/Tucy/lToOlTPBlTz2+EQMLotD/TCkMllHllo/lToOlJ:CJCvFXzcXGzuSXoXmfoOug2gt+x
TLSH
T19464B611B724F229C4B68176D871E2DBAB3DF4128F2207423FC51EAACCF61462776B65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 b6370e40beec453b472e64045b4033fc9e4caa08a5916d0908da56399875f33c
MD5 a1a888ceb8f65fc4934aa181bfca5cbf
SHA1 e5681dab2fff23f4d59373d9780bdd9f0e0821c4
SHA512 609c29c07506f3f5c85bc4853b244b0828522f82b1d7d7c73d70a2a044eca5f8d352c8064a9f180dbc3427655194d4e39b4cb8a9328ee85e589111cca07a92c8
TLSH
T135F0D46745F228B11A95449C11F459557878B7CF08838066607808D5EA462A5744F455
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 727B
SHA256 e0365868125950f2397d2d53988206575d6debf622700afd3432cc4d1452b2d1
MD5 aa5d7e2c00414ebef70aee386dd23875
SHA1 1cfb73ce1d83b03a84501fbbe4fbf23f50d79689
SHA512 6c9376662209b390646a4d9e266783bacc5ee1b51c6f5d4b1e32ce1e6446e193e8924709dc9cfd7919493d777dc4baf1fb5417dfb2fbdd15a9b25c0060c22ae9
TLSH
T1100194035024AC8B2751D429AB7AD7656F30876020E943FE242EA0C8E884B32D306904
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 a2e9b12f0ffcc945f012a85aab9f606f8851f1dbcd29be7cc2c7b97dccb98ea5
MD5 edbd0b67f51beb3d42c4b91978df8ff0
SHA1 f850eda261bfb48ce672b5d3f899abc1757382ef
SHA512 098e417eb748dfd8ca5599dba0af3ef54ea2d9b82599d9eaf69c44647b4bedea88b6950c359e50729cdd70895cac3c69515b9af528f4b85ebe4e602babf774b5
TLSH
T1D501150610B49D1034515D85FBF9A3B99E7803DDACC81A5426F914DEA1A9FF75A07D20
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 7ae9584dbf2503bd3ab0928b9b00bc67eeb25f8ab07cf83db9d082b5d72e9abe
MD5 82a6d23adae4882064fd472052f0b1d4
SHA1 98e58792396e8c99230e324a592b5035d56d49d2
SHA512 ada427358d2cd4a757be0c96932b23fae8220ba80315831706b31d97afa6eb1d2c334b28e9a24672f65745b98753dbeecce47c1404c75b02b96685c763a74c8c
TLSH
T136E0263427FF106FF2A09B7803EA91AAAF2AF1027C4556BE1E81556D991BE404CA6C35
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 404B
SHA256 b263c30b26aa7a84c9ae15f006c5fdf23c92c80e4ecfa9ab08af4bb909bcf05e
MD5 002609babe84685f33ac8b9f4c313981
SHA1 76ef8390004d5fdcea1e3250b714a8110a97fe85
SHA512 54b21ca008c0f481cdefe5077d27549194fadd878399fef7acc279fa32329e418d8eead0d6e8cfc67481e035002e5edf13a84eefe17532547d005de3eda336a6
TLSH
T163E0263822F9495EF0F8D47842FB98225D99F10B15858BAD1680232AEA25E408CF27B8
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 8fb1859e693e05a146341c9b8e3eff9d100f127b9458c2818dff1209b3214707
MD5 013c099873f32afb6b9ffbe823e5f830
SHA1 d00661e39a5d48ed825b9e05c81e313fe179df6f
SHA512 027f13b942206606f66237bd946640669c5d11455462ce5083f1cba794e9ab5125c2fc75bc50f9f9ff47cbfb5b62b9a4e6ce5bf289cd161d594c8ee512139ddb
TLSH
T15CE0DF382AEBA52EF0909D7946F9A1761E59F715384897B916A05308BB1AE00AC21FB4
MD5 SHA1 SHA512 TLSH

Submit Download

logo-small.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\StartScreenTile\ksolaunch\logo-small.png
Size 6KB
SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
MD5 8d650fe389e3665607fdbf938c1a1722
SHA1 2e545f9555ff22313e4ce113995d8aa694e5cab8
SHA512 f116621bfecb602d02919eb1ee9d7dc92e82b313b8b54cda42ab48c5e7ec60b02005edcad763fff6b497ca4bc46e83cb0c9a249be791f245bb9c599950fdf015
SSDEEP 192:HSO0z+xgsZ7wNP+agwQznBm2KIvdgoeAtzpZb/D1:yMRoP+z5IIa8hD1
TLSH
T1CCD19EEE6F1CCE4F079D52F7500AC0A9DEA218AA905764D4D68E70B471FE6D120EC5C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\StartScreenTile\ksolaunch\logo.png
Size 12KB
SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
MD5 d58510dca6b659c6e4ba7a454d5b75ce
SHA1 e142de2dda3811a2e8bbbb2eb64d366e8eb9ea3c
SHA512 42409f9976ad08ecf1756d1c2915f3ffd17cdc78e9ff552c0a08bdfa2fda8960e408721bfc9de1a5ed9c9aca3e23b97adb721b3c51b6b3f0ed3ee4a4c780cf88
SSDEEP 192:ySLu8Kp8OtM5IirU31+5AejJ7D+N+QOtHQjrE9aTYpR8XnXrWjvyNTtLJci:NC8o8do1+5D+N+QPE9B2Xn7WrINJP
TLSH
T1BC42C08F68918EB2CE443C39F356115F1FE12A5E7E19A2CF2CE7944A239044ACE1591F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything-KingSoft-Read-Only.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\everythingsearch\everythingbinary\Everything-KingSoft-Read-Only.ini
Size 404B
SHA256 b5980cd1122d2ad4727bc06806e3d2a6598b7d67b6eb3d2732938d08c6deedbb
MD5 6a4653f40acaaa13e2b0f60f067ea93f
SHA1 34981baa55ef31ae6b6d5985fdd02798e3bacde2
SHA512 f286472389e50fa51abe03068cc3e1f9d18b19926d84b66b1df28c157cbc70e8de32a8deb7b4096f462605a2bdd4d76f9863c6ca0872703c60d473a3271778ea
TLSH
T15DE02B99808C4B1C7656E6948D715E4F42E1C79C1B98174CCB0BC241E91950DF63A439
MD5 SHA1 SHA512 TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\karticlewebcloudsummary\mui\dist\run.ini
Size 171B
SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
MD5 b30cb271e143eace0f55ea2e562e1e9f
SHA1 9d97dbf24931cfc114384c3f4dbbae21c9e51be5
SHA512 dc593185fa63b458024c3a913c558e5686806154181dea67eec786ada50595c53bab822833ad1e76c9acdf21be3eba50631391b7e575d7f1f6409ceccf966535
TLSH
T1AAC080D4D0256F97DC31C6B5ED54AF1A7560E700251C1EC3D530DC4E9E9696551C805D
MD5 SHA1 SHA512 TLSH

Submit Download

kcoworkdockpanel.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kcoworkdockpanel\mui\es_MX\kcoworkdockpanel.qm
Size 846B
SHA256 8f0de81b05e2ce8a22432406009084933f0cf410e6efb534aafd71699651120c
MD5 6e815f2b93f16067d08e51cdb69b81e4
SHA1 40630f21ec4e2ce47da271f5e379737bef67fad5
SHA512 7e9586a605815f829a2881ae328d4df3cb9600949767cc5c8fb8186cc2243b08d8cec4bd52cff81c728fdb0c8fd7ce1c9d8e52e9fe4139722e99d4be12c6e482
TLSH
T12F01E9D527FD2F19F3F79BB179E652108F3679082931D16F2145A40D05A15505DD0327
MD5 SHA1 SHA512 TLSH

Submit Download

kcoworkdockpanel.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kcoworkdockpanel\mui\vi_VN\kcoworkdockpanel.qm
Size 839B
SHA256 ad5549bf1c748909f191eba6e08caccfb31dbe1a2ce4bfafcb1e41702f40c95f
MD5 3eabae85edf1db8a54d42509c660862c
SHA1 ea6133582aaf7aaf5330142474dec996e527b461
SHA512 05d619228af227bec2d3b33aab044dcaf79b69633c604f81d6456eb10d4420e48024a9a88cd706fb5c00908565347f5e04302f90bc5211d48d99e2aab2feb7d9
TLSH
T16801E29523BD2F19F3F79BB17AEAA2208F3679082932D16F2145A40D05A29508EE0327
MD5 SHA1 SHA512 TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kpdfcorporateglossary\res\dist\index.html
Size 636B
SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
MD5 72cdeca808b16e794ec5b66bd02246bf
SHA1 e75b6c4e084efc8e60c9e4fbe9e9ae02bfbf4132
SHA512 6562ed498bae7f819caa5ebff9ba373b1bbeae3c92befacbc44a72419e6a3aedeee7fe43347d1bf8c46b9c90c8e515181a6dc50c4ad954a640cf6b2520269ed8
TLSH
T1E5F002EA3C25F055CB911EA43DF2F19E245E3AB29DB9DE942AF4513543C03694D0BF48
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kpdfcorporateglossary\res\dist\index.js
Size 2KB
SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
MD5 67dde682d1968824023dd9773f9ec48b
SHA1 81e0a21a7ba2c05193ecc13672a3f537539e0699
SHA512 86bccae3d66df4dd552c12a42d1ed0d57d6cdb7b904caa1f89c874e506fb76412b2df45e3e5f673837cb72aa18b0ab2c1dfb489b1da37068d83d7ccb25d3d8ea
TLSH
T1FD5173C9F79E702209EAE136583F0006E17735596098A1C8B87ED8F16EB555E7077F38
MD5 SHA1 SHA512 TLSH

Submit Download

errPage.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
Size 7KB
SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
MD5 eb3b05c3a3fdef3b0c5c9020756ebb33
SHA1 27c5773e17f9c05f471ccd22db42015561b4e669
SHA512 9a511c6d0aad855448ae45130d7ed031062bb7e6881e68aa2406c7c122220318379c312bc13876599dd7fe88e2beac296adf5bcdc015ef4e0e3f362e76303ab0
SSDEEP 96:9uMJIMzvOcuq4v+nB1W1QjjaKhwc3Rgjfqqm8bm83:9lTgVv+B1W1Q6ywc3RgjfDm8bm83
TLSH
T141F15211D6925216603393B4DFA25719FB260023A3038A38BFECA2558F75C495B93FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicon.ico

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
Size 4KB
SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
MD5 1ba2ae710d927f13d483fd5d1e548c9b
SHA1 c0605efed936ee2600284e6480521d06fa64f872
SHA512 f933cd352eaba92f509b3863353ddfefadfada26a4152ecdc4727d450bbf35e7b10fb3038fe8db340d5c63d74e608c1560ec84d0f6ffc8ccd940c9e0d7533544
SSDEEP 48:i3H5R5hLOR4kt38PduMoglJrd6qTrp9hweFC0+6Ga:ipHFUs4MLBvuyCda
TLSH
T1EE9175DF61C388D9C1B1977F78C449A14F6FD951BA28351F55CF30622E5D75818C1C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebpromehelp\run.ini
Size 226B
SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
MD5 abc3a6089b0ea76ffc960fbc9b6e66d1
SHA1 50ad0cb201c13799024de56cf45116cf65ff5569
SHA512 ec1e32b7bed882095b23e049a4e1a86acf0bf993e2f691105ffbd99d93ebf28faad4fbdd645ac1eefa74ede575854a3994c7c6d2bacc6f7a09a1991561b1a44b
TLSH
T157D09700C0B5658AC1254C827CA53DC411085B4B27608E02CCF0C34D508EBECE56B08A
MD5 SHA1 SHA512 TLSH

Submit Download

close-secondary.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
Size 216B
SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
MD5 07306930f7d374663bd13e38ea0e92a1
SHA1 12f877e8ab93d874b55d75eef6747615619dad4f
SHA512 4cc0517ed0b9d665df4db93fb3093067e90f64b34f1d41420ed975b4cec64d4cc0aede64092d79c610c04e1ecd9514a9ef48389d5c157b5bcf698fc33670db98
TLSH
T1D8D0223BB3CC8E1CF9224A22F35A713580AF41C3548942E4D8322032E4011CEB93B6E8
MD5 SHA1 SHA512 TLSH

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
Size 334B
SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
MD5 d36fe6147829a72b42e054a5db27d270
SHA1 80779a8eb37d8bb1d5fcc594576f80dbd61fac98
SHA512 94224816f757241b3a6d19788225378ae070fc62b4620e11e10a033e3be5d9cc858cd9e669cc275b1fa82e57094d0df13a6d9868cf00afaa17cf2ec0193acd74
MD5 SHA1 SHA512

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
Size 327B
SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
MD5 18770de3f96bac1e75e588015024fcf8
SHA1 e6254c054edef68f9c27059efd82eeaa69c863b5
SHA512 fcb76291a73d7f2e30f4266ea8f0dfa2d9e203cf9770fb7ffd73cc1994502992fabd0803224c1e1155c1e4b678b5af0e8b3aec114beb1f02299e8885d5a61d0a
MD5 SHA1 SHA512

Submit Download

element-icons.ttf

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
Size 54KB
SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
MD5 732389ded34cb9c52dd88271f1345af9
SHA1 8058fc55ef8432832d0b3033680c73702562de0f
SHA512 e8971ae48f5287d252f5b0a2d0516091bef0d2febf7d01fd7b435e426d106fea251037439ec42c2937e934b66f38e5eb43d00a213cdf334f482f4a06b1817f9c
SSDEEP 1536:qTIRCXXCwinqtuPM16hD2N3SUjbwaST4DCJe:39GEcgD2njb5ST4h
TLSH
T10A433B32436A9BE7F416047F5C1F55830A9F4F22F53DEA8B83A6192514162FD0864BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

element-icons.woff

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
Size 27KB
SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
MD5 535877f50039c0cb49a6196a5b7517cd
SHA1 0000c4e27d38f9f8bbe4e58b5ce2477e589507a7
SHA512 da269b20f13fb5b0bb4628b75ec29e69bb2d36999e94b61a846cb58db679287a13d0aa38cdf64b2893558d183c4cc5df8da770e5a5b2a3288622cd4bd0e1c87b
SSDEEP 768:gOvv6ExpCVxUtrT6w8ClFd80EjPVerMKBaGXjAlEm:Hvv6xVWewtlFdGjPlkFjAlEm
TLSH
T1B9C2E13197213AE9D9824EF876E498FEF1651402290F390E8696ADB3A98D5C73E16831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
Size 107KB
SHA256 907d1f5ee046fae72b52eaf99508ddb6b48d47b803076db0e9a86b0e21a54ba9
MD5 0ad676312c51d1b96bd08f056ab33496
SHA1 270438a06781cb68c376bc18c42437dd5ce262da
SHA512 6a6883f9fa0a1f768bf985340dc6cb4651e5ce691066c9597126ba1fc62b2a45a2eee52a1d8452faec885bbd3358be3fb04a15fbfca0302feaa1adc2c81130c3
SSDEEP 3072:KazzQ51KYGqMkYUl26MeCAAcdl6y7tqWD:mME/euD
TLSH
T15CB31B37214D132D343BDAA2E55D659960C8F61BC00253F9FA247B1DCA837873A7A3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
Size 279KB
SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
MD5 a3964e72421a1ef5fb60c6e17eb5d705
SHA1 5dd9584be5141e884a230c48746e1c88126b0a55
SHA512 4ce4119b7407b460969041809354c4ede587047ee643f2897eb0ecb9627608431f43fed27c54c70bacff3a6694eb32a85b535c7d6397ac22d7d28e260b0a5467
SSDEEP 1536:39eSBQG+dyAUlHj/8D0Q+SPxZztR+LCrwHFfyqHYb3PPV7BYUOf0I79lDxiRSL2Q:3zfZYKVxiW
TLSH
T14054B6229140212E702BDE3DF7C4EA4AE225C6B3C4125BFEF953651DC7C36AA117778A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
Size 380KB
SHA256 fd9dcbe72da3477714bf68b8987db4718e4be32f313d09bfefbd4d78aa051a84
MD5 64ac5333133e48efc94a0f579e10878f
SHA1 ca547d97d85fa913f48aabcbb23a227c6a2e6bad
SHA512 be9be830f1a3149b238b7363cb6aac08281d244825f4c0ebdd69e31daaf05562555a46484af78de442b7deb3ca71b8a8698331e617b433a0f86cf39e2668576f
SSDEEP 6144:qpK457wXrkaY0TbOXsEYlHBBs6Ve5NtXoqIpgznl87A6v0eX4AiDuViQbgQgILTV:x4B0WtYlmiLlTj8QmIqUrNBqq
TLSH
T1DE846C4B758BBB5A1F35B66340DF3C88D01C6EC09812A5C9FABDD9D09144B9A32D63BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
Size 249KB
SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
MD5 6351ea268f992f52e0f4418a7028b91d
SHA1 5bb3cb88465c550a1fd033a079a8b2eba5e071b8
SHA512 44940d07abfdee6403e9400e596ac5e5eb234ba77a1c90c2fe4086878c12f4805c709eb84538071f21d5710d3569d342e7caea10061e2ab2661c5117c5966297
SSDEEP 3072:p+Xy2rHhkiTtcsuaIwK3zqDLW/ix3Iu7doNFBWgz/bwUzxqcG7gLEOhA:phKHhklsi3zpCdoNFBHz/bwAfG7cW
TLSH
T10A44F8CDB2D1B0A517EB61B4813F610BF27B6499B44E80D0E226E5D4BC7998E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
Size 424KB
SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
MD5 cf29fba214e7f43f2ca1b629109d126b
SHA1 d0dda9486528586af6943abe7a3afa319c790f25
SHA512 2ad7e4711f5917b8d13f861d4fb2688e6ce3951da43a89263a2d9743199e173429398ec1a9537b1df25593d3999dd34fb590e2d2a6e7a632ccc44265d93c3bca
SSDEEP 6144:z8KzCOcC0CXWsJvRekr0dgei/zJbBoCF7az2bzNM:zbzCODTWsJvRbw6zJbBfaz2bC
TLSH
T13694198DB2C1B0A517EB60B4913F610BF23B6469B44E80D4F266E5E57C7898E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
Size 10KB
SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
MD5 0f4634d4af8b73f882440c1181697d86
SHA1 748bb9a14c8a6c64fa060ddcb1b4baebfb3f6fd3
SHA512 eeff081cb256a44ff4557dae145c3d277ad936fef58674cb7d2949b6c302c3a746f05495daa6ccabf39c26bacf13c6fee3bab20de4f1d13810be0503787c89d5
SSDEEP 192:cyxPpQcKb2d4U1nE92Ui6OPl20b3G0qE7I2ByobYGeBv+x9qkgYbeO:zzFZr6OddG0q/yTh3UYx
TLSH
T1AC32C887B30483755A90E790F6C76DA5A93ED0EE73A4168A3CEE421812581DEB3E7CC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
Size 13KB
SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
MD5 dd59d31e84434c59c5c3735bd0b0dc3b
SHA1 c34473850d3749aae725856f68a262a0afebee00
SHA512 f3acd51920f945b49dceb56fd2a5a4ff170c4a5770665bef3d888f8497a288dc33bd15f24780cbe9b8ced585fbacb92a8700d1322a6d4acd2b6e5893370822ac
SSDEEP 192:GwSuCUHXDhEblYfhQ9GYSOqUr9b1AARAU0qWo3wYXVMojXiyaH:dCaXDhEK55YmUrLAgkqWo3RVhpQ
TLSH
T140523295F3C50E22B4991749BA03D57BF19558FAFC2CC18D5CF2D236136C9C986928C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
Size 14KB
SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
MD5 5cee0947c1ef6f00e18eb17cf77388af
SHA1 5a27bc625acfb46d2368a9a376d797ecab912a3a
SHA512 1bf91f08d2a2a446ef0e22df40fd09b090fa300f599bacdd5c698aa61a6fef12ad3d3e38299804a016e5a22a82ddfeb6840cdc7a79ea51244942cb22e659331e
SSDEEP 384:HTO1ksU66rAJGO+NedvSGdv+GfBgLj95LKn:zO1ksU66rAJG5NedKGdv+GfyLj2n
TLSH
T11D6230ACC3CD5C69C86183FA090B35C27836ED49FEA5AE7280EDF4202DA19DFD815674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apm-init.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
Size 57B
SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
MD5 b684f2b8022aaa97ede28f9d224c4db5
SHA1 2087206ddbfd6d6d71f843a132b58ed533d87169
SHA512 8d30da66bfdd99dab88c4b9766b692c39ecbc8dd725e9f858c95993d4f2bf46c37891a1f8f4f1eb6fe09bed7008b8df48d2a9b4f10d7caf20f823f121f6ebb40
TLSH
T19F9002E7F0A1707344616959630722AA35D11130017430010900487434A580FCD22F88
MD5 SHA1 SHA512 TLSH

Submit Download

default_ava.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
Size 906B
SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
MD5 c47a5cfed147c402538358294808e68a
SHA1 8aa499336bc4a50a70710735b67fc5da923fc61a
SHA512 a71831abb9393b6c0ad62feb29fefbb192e1706b08ab88dec0a8e6a9cf61b6a7e106454a7e6e518f69425cc91846036e8fe2956ea939625678f17b330860ba1b
TLSH
T15311E309934DC285960AD7B8563C1754347272DF9E1FD55CE7E633012D3C6AF185C27A
MD5 SHA1 SHA512 TLSH

Submit Download

desk-sync.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
Size 1KB
SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
MD5 c17417f321f52624ee0dc60ed76a31b6
SHA1 b64e19a5b03c92a931fa9a1eba899f491e669a1e
SHA512 bf160829598cf0b22ea48a5f7310adfbd26fbc1bbf23ea3cb8d9cebbeb92b5e81b914bd6021cd41df5984ef00698acb1c1151e134c714e0a1be7dcd439c78485
TLSH
T16D21F0ED57EE35C8644CD37028DA6079627B35F43969EF048914A9D1FE4205D499F9C0
MD5 SHA1 SHA512 TLSH

Submit Download

loading.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
Size 1KB
SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
MD5 0620393a949b58f6af37b0accb79e32c
SHA1 0025e4da5ffb8695a8f9731a05b1b89f1a71bf24
SHA512 0d308c758f825d548874cf8b4b8ec20f3685b39c7232246697dd95e5e5f40da7cd21de7ba5faafd0d8a121b5e6b85c5aadc4232e3f0c943535e062ae449ef29e
TLSH
T1333142D111BD0116E11AC365D7FD7AC70B3EB4DB26E558BCB68C250FAB404DB0A9B219
MD5 SHA1 SHA512 TLSH

Submit Download

setup.cfg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\cfgs\setup.cfg
Size 449B
SHA256 45a9cbbacd1a5a9ef690f4b0d8978d908cf12fc423254b3b591b00a7231aa5bd
MD5 656e40598e526d31a49004aea4f1e0ed
SHA1 e8a58d582f70b6f4a331508143c758f241c785ff
SHA512 8ca2432f432482a87cbc6f744416bde09ba69f7a234848ff20d82a02b362b8c48ffd2be45e268a0876298e62dbcd36b620901d9290fa4a87f5abd3a7a95584d4
TLSH
T123F0556A030370741A21431410B914F2A3F601C91117840D656CA88D6B7DC3D86BF13A
MD5 SHA1 SHA512 TLSH

Submit Download

error-net-72.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
Size 1KB
SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
MD5 66726a0fbd424ccb700cecb212a47007
SHA1 9795ae26acf0b942ab6a0cd06f206ba69eda18db
SHA512 30ddd2fa17517792a86bdb03827a0809ed362ab2dbd9a7baf194d1f47348c96e0ca8e64515c1a58d7a1740e85f53a3676b49ff6c699d598a27c234c14672604f
TLSH
T1E031C6CD318AC42FCC61D531F4D534156817D760BF928C74102BC5576E0F68E58C6662
MD5 SHA1 SHA512 TLSH

Submit Download

presetLayout_16.pptx

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
Size 41KB
SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
MD5 f41e909b0284949bdd3bea9393a6ff2f
SHA1 a41497f65f44368ad517f464eb0da4403aa700c0
SHA512 d800b9b807a72d19f17bf5bb923d2489328b2f8801c2146b0c67d3d4cd8c70d5f22decd6581ad14d5584f3895140180c8578ede4fa8df755ca742c18cbb3b67b
SSDEEP 768:lwQ75cI1zETv/7H0vFtZKSZTRomseFVEFqG5IphchDB8h/rW7oELmG1wvcG7GyGK:9qNTn81Romse8Fl5ahcVChjQmG1/sl+Q
TLSH
T114139F61D40A142FC263B3F6E478164F73FEE86248179797ACD51096282F97C2E9D38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpscloudsvr.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wpscloudsvr.exe
Size 1.1MB
SHA256 0f455a3cc797ff1b5f6c947285649203ac4ccc0a1d0f900a0b7e43435d41eeb0
MD5 5b686fedb64b29e878c890ef34dfa01b
SHA1 8b1f461ea08d0fee944e7ac29a54bf28e82a49f8
SHA512 56586eca535569845417398357d099eef6c54ff8621338ef7850b3b7ab5f7c02e53463e54362164ec5f7de8d93cb68d88a4ef94a122cc3fe0e4bc04404176741
SSDEEP 24576:auUcCucCi//7/Q7cYae4IrVbyIAKOpgH7ILn1ZQL2Yw:aBgm8gYv4Irp9HM71ZQy7
TLSH
T1CA355A46A3B902FDE0ABE1798D525901E2B63C0607B05BCF079067771F67AE59E3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpsoffice.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wpsoffice.exe
Size 1.2MB
SHA256 4937dc6011b827af8acf4625d5b8cd3fec1b9f310e78024542830bcc2d5c7b04
MD5 81e2602cd1cf223758792568807cbafe
SHA1 97a4956fb69763de73a6ace52798a4cfcdb88283
SHA512 d8b9769944c73f9e59faef992ff7c59eb439e416ef4eb42008b705d989767bf7b8d076ba035cb9445677b8227c56eacff25becad275d3d9cf7b58de1ba4799f5
SSDEEP 24576:5IvLtL0dk0/TCbr8KLhzcfdPXO+ItzS4hzBPftoT:5Ipwdk0/ebjEdP++Itm41BXt8
TLSH
T15B5519366EAB02ECE3ABD27876525901EDB53C4AC7745ACB02D035763E77AD18E39310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\utility\install.ini
Size 462B
SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
MD5 71e0a7ecd6bd2e91c04a3edf760c45d7
SHA1 e6cf872ce6def16bca98818ba289395580701292
SHA512 282b4c8be6abb97383d7dda8258fbf069fd668f4fad722582567cbc916b5c7da9a39a157a35511210306c19e46ef34c02af17f2af1ec7707bb3d84f3d529c3ca
TLSH
T178F097090C98C66E36282188B0D3C2C0A9ABCE260D0CE410E2D36E1BFC02E0A217E02D
MD5 SHA1 SHA512 TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\utility\install.ini
Size 595B
SHA256 93fe204ece1e96595b15d599995940f2d3eb27a5584c3c67e055d7ddba6a957d
MD5 45ec36b0e902cc58bc36be057d1c5342
SHA1 32df5ddbc9b3c421ccdd0ae0e1a79b98686dff29
SHA512 1e1943112a920d3f55c297d1f64baaf375bdc9cab0aa20cae7fa089ad35ab8fd69a00da0b7e88ddcf79fb50ffb009f8e9cdeaa45989075e58baba187a28880a3
TLSH
T134F0A2041995C66F35263288B4D3C9D167ABCF151D4CA420E2E32E5BFC06D0E157D02E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b434fd55b9dce50f75867570b56fd20c145f824cd3ed8f5ecf135055fa59f58a
MD5 ec1ba09d31cc69848fee7a2c8ee39a45
SHA1 1291cb81e95175c85d61e97be5d2c9cceb017d6f
SHA512 4bd66a8572dfb5470b7e93f67a277501b590dda638b449b8de1cd1a89aa80db2c322afc5a5a50e2ce05d601f675863e1ae6eaaf420abb3c9de82db2c7143a77e
SSDEEP 192:sxRbRsCT/fTsGbpKCA94/nzoA8ppa/g6+WNgL4/EWVI1BD9m6SmGAZIgVzJ:sxRbJT/fTsGdZ8rk/5D/JVKS4X
TLSH
T12942A7566A68993B4CCBD21EBA55BF63D3F95032B1D01E58A7FC8A0C04E66DD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3828081afd8265dbdd3b11ab19ce92969c4105467b3975f48ad7323c4dd85d04
MD5 e6722bad09d948f07312804e2c070e0b
SHA1 b7383e726520d116589882d65a476da37113d77b
SHA512 c6277baec0dba9daf5842aab68e90d3b08d0fc92faa70babdd7c5f3e1cf918eedf2a809a9911d775d512efc97cee308402284f637ebffcc99167d44844bb72d2
SSDEEP 192:sxRcRsCT/fTsFbpKCA94/nzoA8ppa/g6+WNgL4/EWVI1BD9m6SmGAZIgDizJ:sxRcJT/fTsFdZ8rk/5D/JVKS4a
TLSH
T11742A85A6A689D7B4CCBD21EBA55BF63D3F91032B1D01E54A7FC8A0C04E66DD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a7c21ba48e7c269acbe88ddb6317f8eafa4354b6d1b288f4fee1614df224a12b
MD5 e6a7b0f94aa56bf1031ea2325b625ce6
SHA1 ce1e0ac46fd6eaf258031e715100b1ed42c89b53
SHA512 fed7ff0fb2a75d1882eb740908744ea21565383acae0c17955774778061410499ffc8eb14f1bf9c60778032556a9682823232e86a70e9d8bdf1b3b51eafd225f
SSDEEP 768:azfWML7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7c16tropLv5xA:azfWMdE7J0Wg/XfHfu1jaoy6GpLc
TLSH
T14EC2FA7B640CCE7F4F800ADDAD197E9B6D6802CB9698CD9047FE851C02C6BEE52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 98b6d63022736af2c3cb395333afc4a3ddbcd0eebc5ba4cf786f7d6577d559a2
MD5 a088ac09182f10dab5cd3bc00d0d8d3f
SHA1 ed529ef61fe3c8edf9ff9bb4ff3a21c8cedd598c
SHA512 8ee932b93c5fcb8ff7f59508fcb8b40444baaafefb74521a195d970e0f5cb999d1dce4777b6299d39fb6fcba1847d7efacca7bc441a57b84f4f95c8f78117fad
TLSH
T14C51F102333A42903C3D656988F4C53FC2D2F5623019A83BF7AD52618F66E126CFD8D9
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a2ac40e145c63c29b011ca28441ee69003a34f9c203cac4a5e811faad2d03a96
MD5 23218dd9d4cae7250b2d68fd7e37800e
SHA1 55f679ad724dd31a0dc30af97218b951c4a64c71
SHA512 5c331f0f6643eed5d2ad132da29bc3a76c535876e26a028f8ee19b84b07ceaaa6cdaea5c434482912bac89815497b124ff71ee3b0f4093e4ffea13ffbb6f4c19
SSDEEP 768:vZrv+4UNbdF33SHZi0a9rEnjN3Gac1FUs:vZbsb73SiQnjMaDs
TLSH
T11003BE357968CD734CEBE385B5437B937FB412A389C40BA4CAC9AB0D11875E9270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 62006dc1e6be61c29f511a360d9941bfd95aaf14a656a3ee609776c104ad22d1
MD5 0041189ad0b3e066154972bf801eef7b
SHA1 b334265539ee512645013014dea7725cf168ac28
SHA512 e6d3e183d21e660f8f5d9ed0a0f5cd6bf98e839975be9c312e1aa3bb47f4f3121a0e09c4099f228a7693cae707d214069268ecb4b4b06b78c04e7dbc878dc56d
SSDEEP 768:zZrv+4UNbdF33SHZi0aQrEnjN3Gac1FUs:zZbsb73SHQnjMaDs
TLSH
T1CA03BE357968CD734CEBE386B4437B537FB412A389C40BA4CAC9AB0D11875E9270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 dbe64a58336b684de18f165bcb1a704c2bf75e3bd319d059169c78c280d82d56
MD5 c241df7d0fdf913cb69d2fa48e0be5ee
SHA1 c7a31233b716afe8e030a2c8a2634a8a3b2a45e3
SHA512 a5e44170544f95696b4b61eda5c6d0f763da997b2b309bbf2f7a63087578889b64546bdd6385f2c7730a0d5c4fce1ab0e63195508c60df93c969c7d0c9531e5d
SSDEEP 768:rrv+4UNbdS35mi0aNrEnjN3Gac1ZKeVH1SCz:rbsbg3e0QnjMatEH1V
TLSH
T1B403CF3669A89E738CE7E38575837A037FF4525386940BE4CADD6B0D029B5EC130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c85fb494-8711-4ce4-bc86-145aee70ead5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c85fb494-8711-4ce4-bc86-145aee70ead5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

APPX.0f1h5u4t5bbodtz803i0b9ild.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.0f1h5u4t5bbodtz803i0b9ild.tmp
Size 712B
SHA256 a3ca9aae4ba31a89982b18f1b929accb9db7d06a8d786f433ef5ccc667409b1d
MD5 16999ee867612360e46db316fe54ca27
SHA1 50e290a12b234894b2452342926802170d4d1160
SHA512 ee2d4abd25d50db7ecf28fef26e7c2cc82d1cd657521a746e2ed73ed55f63ae772f9daba305ceb4302541c486153fbcf08aca2c8d4a69d066d65f51dc83b73c4
TLSH
T14701F4289318BF3646784FAA0F7DB6403C13815B13170A2A5CC7887648270D11A571D9
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.1e21v4_a_qh5ax2jc94_4726e.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.1e21v4_a_qh5ax2jc94_4726e.tmp
Size 4KB
SHA256 81c968c375f69d9e4666901fd4c14a6ce4b738639ff78488562e2c79f8fb14d8
MD5 a4e510ae4ca446423550859eb3193a92
SHA1 de1f946c7687a9cbc4e427c106e62691a203b67c
SHA512 f835d5adb86ab9feb23517a26a7054a6cfdaead71c3b3e0f2a2dea959376a119e7dad97f1c02bd5ad7d53ea7b1f42e65e9847e2842a290a7d4f6ca807cded707
SSDEEP 96:0AxANmAN4ANGAxAqAGAmvACANANzAFjTpOS/VjHH3HMbgrbF/x4JT9:zeTJzetx/ViGhPVLH3sUrNx4JT9
TLSH
T17B91E14A98E415D092308825A367E251AF0D4FE716CD80DCB9DCDA6D3FC53A791336A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.a12xwrvzqhkhrrigsv9aj01ce.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.a12xwrvzqhkhrrigsv9aj01ce.tmp
Size 10KB
SHA256 275c03a752ffa7c962279b0145bdbe4c179e235f524081b8543642e895d86f0c
MD5 ca8acb32122e67aa237f38fe8118a373
SHA1 319f96c45d57ad749effdb694f55aff333976469
SHA512 da188abf07408bfd22f35bad1f66d8ad320f2e828a8a423baa936a9a8f56049d1427f59fe030631d4ca1bad4dda132a93d9c4e4b623f5da0bb3fdc4d99f78a81
SSDEEP 192:s7hIYiYF8+2Qih7aYxiULc8pq8RuwdmL4pUQrNyQPVg/orj:s7hIYistw7aYJy8RbmL4nNyQPVgQ3
TLSH
T1C7223CA388901C05DE17AD40B8D8A937BEB676996ED1C1D37158C299C7823873FDD2F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.ah_hunyvk94w4qrt0diqmo1og.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.ah_hunyvk94w4qrt0diqmo1og.tmp
Size 4KB
SHA256 9d2f34f1b17536dd689db858d42c85a78cb48ccf24f55fd578699dd1cbd7c930
MD5 2bc82584706945350309746d863da639
SHA1 f0862f788988dce106735e4bb66708aab43a06e0
SHA512 1956c1d910995ee93dbb0977f8bc82c1aaf14bdb7549b34eead6055390d26361321192d6cef4e18fbb1ad5cf6faf44693fadc932ce63595550769c6a50b81a5e
SSDEEP 96:0AxANmAN4ANGAxAqAGAmvACANANzAFFTfOS/VjHH3HSbUrbVj/x4JT9:zeTJzetx/ViGfBVLH3y4rpbx4JT9
TLSH
T1F291F14A98E415D052308825A36BE251AF0D4F9316CD80DCF9DCDA6D3FC53A79133AA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.ipga4ihhuff2iekafjlj8r1ih.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.ipga4ihhuff2iekafjlj8r1ih.tmp
Size 4KB
SHA256 322a6bbe4151c8c0d85b94a20e1566a69e7e19532fe6bb7ee4b5d806daea5366
MD5 9829c378f563249eafe72d677b821374
SHA1 cc15a1a414235d26265ebec559f4673fccf3ea58
SHA512 08f7e7d3c93880f6fde8f0dafefa7c36c247f12a67239fa77c129c5e790b99a33622c24e7c08259d39fa0570c1057308d3650e3e7776602dfd29821853418ff6
SSDEEP 96:0AxANmAN4ANGAxAqAGAmvACANANzAFqTQOS/VjHH3HRburbv/x4JT9:zeTJzetx/ViGcqVLH3xyrjx4JT9
TLSH
T1C991004A98E415D052308825A3B7E251AF0D4FA316CD80DCB9DCDA6D3FC63A795336E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.mbhkfib5ehxddo0rjesyk41f.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.mbhkfib5ehxddo0rjesyk41f.tmp
Size 712B
SHA256 7310eb8c9a5115a236fe0f5b2a40386c478b4a1c8de6c16aa20363d4beaa2659
MD5 4c961876f316a4b5ff5d8c905d7e29c8
SHA1 d26d0304cc7d3ba77edfdb54934466d272475bb3
SHA512 75884549e7bcbfadeb2f7f6293caa6ed782e79b9ea389180c312248361dd8c029f22f47c4b3e65234288b628a753f446d2d8631f0de7e82f90522ec8a0a22c73
TLSH
T13C01FE289318BE2A46784FAA0BBEB9403C02815B23170A6E6CCA897658174A11AA71D9
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.tpx3zfjd6vb3y47esim5xsot.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.tpx3zfjd6vb3y47esim5xsot.tmp
Size 712B
SHA256 c4cbc1fe8ab082b7e179d5d73115ba2580cb1170e38f98ba559c61bbc8bed882
MD5 8cb162c05b7b15b7cdffbbc3b1fffcca
SHA1 5469c3a7fd57409caa9d668a24fe6d901655b472
SHA512 2fecaa7d5021c87582afa83df4e74f82888132b131fa00237f1e867996055da58643b38e573790d338a514e0f088039b788a30d8b619b9257fc2c7a0346f6a80
TLSH
T102012828A318FE35467C4FAA0FBDB5443C13415713171E6E6CC6C875581B1D11A571C9
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.w9jw7ruduibwuwjch9uro1cjc.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.w9jw7ruduibwuwjch9uro1cjc.tmp
Size 10KB
SHA256 b40d28e789ecfc7dd669f7c6f4850de9750c2d9e04c1339f1940a45511b1b809
MD5 d103864a47226a8aac8eba4a370068cf
SHA1 7a6ed70397ddd65448341049da90e5737b04139b
SHA512 45768b42260e4c9e459a3bb54606f5a57d895c544386771aa699ac5a0e0ebac828fd06b7148533c18b3d411fc76c3598fc012af98a40ff94d4078e29ec2fd420
SSDEEP 192:OIYiYF8+2Qih75uX5ULc8pq8RuwdmL4pUQrNyKpUCJYn:OIYistw75uXyy8RbmL4nNyK+CJYn
TLSH
T1552229A388905C05DD17ED10B4D4A93BFEB6729A6AE0C1D37118C6A6C7823873BDD1F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.xw9vd2m3cw7j6jxa87y5ioqeh.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.xw9vd2m3cw7j6jxa87y5ioqeh.tmp
Size 10KB
SHA256 ff76515e3de2646c2f9a29ef3070d5344102a26d1e5cfcf0b4dc9d330cf4b3fc
MD5 893ec8eb5ab9e7dc8c5faec56ddfc421
SHA1 3e543f96d523183645fd8e5ea123d824a4c8cd94
SHA512 8f65e4c9f6722c026f79fc5c469f3ebe2fd17a96dda11f32e4570becb815d3e0230c5daa2685e2169fbe0e5543fb350b047f990bd398423a9b6e037ecf219ce5
SSDEEP 192:zcIYiYF8+2Qih7KibULc8pq8RuwdmL4pUQrNy1uF+:zcIYistw7KBy8RbmL4nNy1uU
TLSH
T103223BE389906C04DD17AD10B4C4A53BBEB2B2992AD0C1D77158D5668B923833BDD2F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5CoreKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\Qt5CoreKso.dll
Size 5.7MB
SHA256 d76ce35aa1a6d2d9ee025bbb2e8743c401039cd4161058dc4f379588057a5b94
MD5 16c3e81f3e45df75d11e28cb07b001c3
SHA1 d4d46eec649ececc72466873d2bb6bbbc4c515c4
SHA512 f7bd1025a66f168f14034726da7bf7369c8c34e53ded56327dbf1ee1a0ef87627910d255487b2ea5ee9e3098a769e367f2e43783b3d7d3aa7223a4300cbda562
SSDEEP 98304:FkAb4j8eO36Z5AKJsv6tWKFdu9C6iPl4rVsca4:Fkg4j8eg6ZZJsv6tWKFdu9C6xVsca4
TLSH
T16C567C47FA964269D8B6C238C9D7C127F673B80247214BDF2258A3496A737F0293F359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5GuiKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\Qt5GuiKso.dll
Size 6.4MB
SHA256 c3a2de3161f7cc03dccd2c375cb10aeda109069c13689c105ba161f39c2a35d4
MD5 569c0bed6125720be6793d7facabb2f0
SHA1 d3ec78f7c465d00544fa2e21b345afb2d60cbb2d
SHA512 755abb42e1c7f1427c55938a611c8e1f8c73c228ae390b4c7f5d252804f06c46e466de30ce948a75670c8e4b7e605339fd41ca346aa2451ece42993259f006df
SSDEEP 49152:8dwe5wpMO4YOd3vBY5atKJmv+X8YXTJTyCIyCjIzjuwIomuyox3GREHckZFUT6YR:Kwe5W4LhPWfr2uyoZGGdBJ4P
TLSH
T11166F886EA556359C972D17987CB042FE1F37C4283524BC36C45AB490E237EA1B7FE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5SvgKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\Qt5SvgKso.dll
Size 503KB
SHA256 bc68fc65d3620fd0e31e625ac359ce68d0c26bc45f68d5ada1e4cb4df9852978
MD5 dd6a72edfaaa9f0db4172ec0ee37e47e
SHA1 3e01006aecaf7f8557805c7495fb8a9309caabb2
SHA512 82877887e307a211d6108dc439f104a602e31edc9647cb67c3e8b7bd45d9862f53497a5c3b4d5023825d02294e46e0ad4f1931b8d080427f506e5d600d57405b
SSDEEP 12288:xYYYJUNY675fyplktpsz/VLEgZ/ABXH9a/vngheZL/XEnEsrnJpaymesGrx1/9kJ:xYYY475feysZMa
TLSH
T105B44993FB520799D526D27CC8978802F273340443A39BDF2A5AEB651F236E1763E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WidgetsKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\Qt5WidgetsKso.dll
Size 5.6MB
SHA256 70eeb2b38bd9e4b17d49e62a1a8c5040a0ba309205224d500a89b20480ff4886
MD5 7a9d9082e35636aab6d53fd9cb43b5bc
SHA1 8c4c36e1d0093b51be7b515064b8c2bd78375a7b
SHA512 2e21462bc80d2615556f3e34df721a549d066ec8a93f1445748c2473807d613b397edf091cb99143b8addccb118f8951203c4ecc19cddc26d047cc39ba567324
SSDEEP 49152:cbXPQj9zA+84QMzrV2gPZUIU2wuxPjYqok/revAgxSkSsODt5fVKnsjBKRI0QdBZ:B7ValZRI0QdBbj8PwtxTMnd4X
TLSH
T113466B47F7A50389C56BD23CCACB8613E2B2780447234BCB6959DB681F637E2197E790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WinExtrasKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\Qt5WinExtrasKso.dll
Size 251KB
SHA256 5f55c44db9c677781b79f5c0527fc5ec81dad8e4fbfac6076a45f1d0d747e24e
MD5 ad3380736b935ae7c3c8a986f3d90adc
SHA1 6530bd9ec891b074029880b02614b56564e0d6c9
SHA512 70eccfa8b101ec12dc5fbbea3cee0d148ae18edb72618f54cad8302d01a9a0d82efb2bbc3b24249502888250d2bb8828f58206486d286fcd3ba772dce7bd28ad
SSDEEP 3072:BF5o5cKUM7YLBwcJf1+6Ws2F0+xvN8093ZWFh:BfpMjxvN808
TLSH
T1F6449684BADD9619F81970B88FCCD199C223BAED8B47425F351EC39F4B619816E139F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-console-l1-1-0.dll
Size 11KB
SHA256 2afbfa1d77969d0f4cee4547870355498d5c1da81d241e09556d0bd1d6230f8c
MD5 919e653868a3d9f0c9865941573025df
SHA1 eff2d4ff97e2b8d7ed0e456cb53b74199118a2e2
SHA512 6aec9d7767eb82ebc893ebd97d499debff8da130817b6bb4bcb5eb5de1b074898f87db4f6c48b50052d4f8a027b3a707cad9d7ed5837a6dd9b53642b8a168932
SSDEEP 192:4nWYhWxWWFYg7VWQ4uWjXUtpwBqnajrmaaGJ:2WYhWvZqlQGJ
TLSH
T186421A838EFC9543F9A66E701B99D9833C3DABD76910905925A8F19C2CC33D1EB0072D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-console-l1-2-0.dll
Size 11KB
SHA256 00942431c2d3193061c7f4dc340e8446bfdbf792a7489f60349299dff689c2f9
MD5 7676560d0e9bc1ee9502d2f920d2892f
SHA1 4a7a7a99900e41ff8a359ca85949acd828ddb068
SHA512 f1e8db9ad44cd1aa991b9ed0e000c58978eb60b3b7d9908b6eb78e8146e9e12590b0014fc4a97bc490ffe378c0bf59a6e02109bfd8a01c3b6d0d653a5b612d15
SSDEEP 192:iTWYhWyWWFYg7VWQ4uWq6Cu87ZqnajgnLSyu:sWYhWi1XHllk2yu
TLSH
T15B423A93CEFC9543F5A6AD704699D9833C3CABCB2910916536A8F19D2CD33D1EB00A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-datetime-l1-1-0.dll
Size 11KB
SHA256 77577f35d3a61217ea70f21398e178f8749455689db52a2b35a85f9b54c79638
MD5 ac51e3459e8fce2a646a6ad4a2e220b9
SHA1 60cf810b7ad8f460d0b8783ce5e5bbcd61c82f1a
SHA512 6239240d4f4fa64fc771370fb25a16269f91a59a81a99a6a021b8f57ca93d6bb3b3fcecc8dede0ef7914652a2c85d84d774f13a4143536a3f986487a776a2eae
SSDEEP 192:5WYhWYWWFYg7VWQ4SWSS/njxceXqnajLJ35H:5WYhW4gjmAlnJpH
TLSH
T1FE322A838BBC4503FEA32EB042A9D9937D3D67D62A10C12A05B5F1682C937D1EB14B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-debug-l1-1-0.dll
Size 11KB
SHA256 45e48320abe6e3c6079f3f6b84636920a367989a88f9ba6847f88c210d972cf1
MD5 b0e0678ddc403effc7cdc69ae6d641fb
SHA1 c1a4ce4ded47740d3518cd1ff9e9ce277d959335
SHA512 2badf761a0614d09a60d0abb6289ebcbfa3bf69425640eb8494571afd569c8695ae20130aac0e1025e8739d76a9bff2efc9b4358b49efe162b2773be9c3e2ad4
SSDEEP 192:4WYhWFsWWFYg7VWQ4eWZzAR/BVrqnajcJH:4WYhWFMJRLlA5
TLSH
T1E9321B828BFC9103F9A7AFB053D9D9933C3DA7C72910916605A9F45D2CD37D1AB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-errorhandling-l1-1-0.dll
Size 11KB
SHA256 accdd7455fb6d02fe298b987ad412e00d0b8e6f5fb10b52826367e7358ae1187
MD5 94788729c9e7b9c888f4e323a27ab548
SHA1 b0ba0c4cf1d8b2b94532aa1880310f28e87756ec
SHA512 ab65495b1d0dd261f2669e04dc18a8da8f837b9ac622fc69fde271ff5e6aa958b1544edd8988f017d3dd83454756812c927a7702b1ed71247e506530a11f21c6
SSDEEP 192:imxD3vEWYhWnWWFYg7VWQ4eWMOwNbDXbBqnaj0qJm8:iIEWYhWFpLbBlwqJm
TLSH
T146321A928BFC8043F9E76E7017A5D9837C3D77D7295081A506A8F1A92C933D1EF11A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-file-l1-1-0.dll
Size 14KB
SHA256 7cb0396229c3da434482a5ef929d3a2c392791712242c9693f06baa78948ef66
MD5 580d9ea2308fc2d2d2054a79ea63227c
SHA1 04b3f21cbba6d59a61cd839ae3192ea111856f65
SHA512 97c1d3f4f9add03f21c6b3517e1d88d1bf9a8733d7bdca1aecba9e238d58ff35780c4d865461cc7cd29e9480b3b3b60864abb664dcdc6f691383d0b281c33369
SSDEEP 192:+AuVYPvVX8rFTsRWYhWyWWFYg7VWQ4eWQBAW+JSdqnajeMoLR9au:TBPvVXLWYhWiBdlaLFAu
TLSH
T1E962E853D9B4F25BF98FAE315192D843683852C7042541C91BD8A7AD3CE73C5E3D8A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-file-l1-2-0.dll
Size 11KB
SHA256 7a3c5167731238cf262f749aa46ab3bfb2ae1b22191b76e28e1d7499d28c24b7
MD5 35bc1f1c6fbccec7eb8819178ef67664
SHA1 bbcad0148ff008e984a75937aaddf1ef6fda5e0c
SHA512 9ab9b5b12215e57af5b3c588ed5003d978071dc591ed18c78c4563381a132edb7b2c508a8b75b4f1ed8823118d23c88eda453cd4b42b9020463416f8f6832a3d
SSDEEP 192:dzWYhW1sWWFYg7VWQ4yWL3sQlmqnajlD4h1N:BWYhW2e6l94h1N
TLSH
T111323B928BBC4143F9D66E7053E8D9877C3DA3DB2E60815905A9F09D2C837D1EB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-file-l2-1-0.dll
Size 11KB
SHA256 349a79fa1572e3538dfbb942610d8c47d03e8a41b98897bc02ec7e897d05237e
MD5 3bf4406de02aa148f460e5d709f4f67d
SHA1 89b28107c39bb216da00507ffd8adb7838d883f6
SHA512 5ff6e8ad602d9e31ac88e06a6fbb54303c57d011c388f46d957aee8cd3b7d7cced8b6bfa821ff347ade62f7359acb1fba9ee181527f349c03d295bdb74efbace
SSDEEP 192:/VyWYhWjAWWFYg7VWQ4eWiuNwzNbDXbBqnaj0q:/VyWYhW8g+LbBlwq
TLSH
T1C5321AC2CBFC9403F9A76E705299D8877C3DA7C7291081690AA8F5AC2C973C0EB51E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-handle-l1-1-0.dll
Size 11KB
SHA256 c78a1217f8dcb157d1a66b80348da48ebdbbedcea1d487fc393191c05aad476d
MD5 bbafa10627af6dfae5ed6e4aeae57b2a
SHA1 3094832b393416f212db9107add80a6e93a37947
SHA512 d5fcba2314ffe7ff6e8b350d65a2cdd99ca95ea36b71b861733bc1ed6b6bb4d85d4b1c4c4de2769fbf90d4100b343c250347d9ed1425f4a6c3fe6a20aed01f17
SSDEEP 192:P9RWYhWEWWFYg7VWQ4eWncTjxceXqnajLJS:LWYhWk3TjmAlnJS
TLSH
T1BC324DC2CBBC8003F9A76E7047A9D9937D3DA3DB2911816A05A9F1692C933C1DB10B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-heap-l1-1-0.dll
Size 11KB
SHA256 2e981ee04f35c0e0b7c58282b70dcc9fc0318f20f900607dae7a0d40b36e80af
MD5 3a4b6b36470bad66621542f6d0d153ab
SHA1 5005454ba8e13bac64189c7a8416ecc1e3834dc6
SHA512 84b00167abe67f6b58341045012723ef4839c1dfc0d8f7242370c4ad9fabbe4feefe73f9c6f7953eae30422e0e743dc62503a0e8f7449e11c5820f2dfca89294
SSDEEP 192:5t6DjZlTIWYhWsWWFYg7VWQ4eW4MtkR/BVrqnajc:5t6Dll0WYhWMqkRLlA
TLSH
T13E422A85CAEC9103F9676EB053D5D9873C3DB7C62510802615A8F19C2C937D1EB25B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-interlocked-l1-1-0.dll
Size 11KB
SHA256 b02324c49dd039fa889b4647331aa9ac65e5adc0cc06b26f9f086e2654ff9f08
MD5 a038716d7bbd490378b26642c0c18e94
SHA1 29cd67219b65339b637a1716a78221915ceb4370
SHA512 43cb12d715dda4dcdb131d99127417a71a16e4491bc2d5723f63a1c6dfabe578553bc9dc8cf8effae4a6be3e65422ec82079396e9a4d766bf91681bdbd7837b1
SSDEEP 192:nWYhWNWWFYg7VWQ4uWtGDlR/BVrqnajcU8:nWYhWLJDlRLlAU8
TLSH
T165321A828AFC5143FAB76E7042E4D9937C3DB7DB261091550AA8F49C2C877D1FB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-libraryloader-l1-1-0.dll
Size 12KB
SHA256 08484ed55e43584068c337281e2c577cf984bb504871b3156de11c7cc1eec38f
MD5 d75144fcb3897425a855a270331e38c9
SHA1 132c9ade61d574aa318e835eb78c4cccddefdea2
SHA512 295a6699529d6b173f686c9bbb412f38d646c66aab329eac4c36713fdd32a3728b9c929f9dcadde562f625fb80bc79026a52772141ad2080a0c9797305adff2e
SSDEEP 192:FvuBL3BBLZWYhWxWWFYg7VWQ4uW4g0jrQYcunYqnajv9Ml:FvuBL3BPWYhWv8jYulhMl
TLSH
T1A3422BC2CBAC9143F5E65E3042A5CC477C3963DB5960C46906ADE1A82CE33C0EB10B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-localization-l1-2-0.dll
Size 13KB
SHA256 059cb23fdcf4d80b92e3da29e9ef4c322edf6fba9a1837978fd983e9bdfc7413
MD5 8acb83d102dabd9a5017a94239a2b0c6
SHA1 9b43a40a7b498e02f96107e1524fe2f4112d36ae
SHA512 b7ecf60e20098ea509b76b1cc308a954a6ede8d836bf709790ce7d4bd1b85b84cf5f3aedf55af225d2d21fbd3065d01aa201dae6c131b8e1e3aa80ed6fc910a4
SSDEEP 384:NOMw3zdp3bwjGzue9/0jCRrndbwNWYhW6WAulh2:NOMwBprwjGzue9/0jCRrndbw5D
TLSH
T1CE520892C6E8D207F85DAD717167D9437C38A6C50822D95603F6FB2428E33C5E79172D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-memory-l1-1-0.dll
Size 11KB
SHA256 dadbd2204b015e81f94c537ac7a36cd39f82d7c366c193062210c7288baa19e3
MD5 808f1cb8f155e871a33d85510a360e9e
SHA1 c6251abff887789f1f4fc6b9d85705788379d149
SHA512 441f36ca196e1c773fadf17a0f64c2bbdc6af22b8756a4a576e6b8469b4267e942571a0ae81f4b2230b8de55702f2e1260e8d0afd5447f2ea52f467f4caa9bc6
SSDEEP 96:qo1aCFEWYhWwp/DEs39DHDs35FrsvYgmr0DD0ADEs3TDL2L4m2grMWaLNpDEs3OC:teWYhWVWWFYg7VWQ4yWwAKZRqnajl6x7
TLSH
T10E424B818BFCD503F5D72E708399CA977C3EA7C66DA0911902A9F1992CD33D1E710A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-namedpipe-l1-1-0.dll
Size 11KB
SHA256 b57e70798af248f91c8c46a3f3b2952effae92ca8ef9640c952467bc6726f363
MD5 cff476bb11cc50c41d8d3bf5183d07ec
SHA1 71e0036364fd49e3e535093e665f15e05a3bde8f
SHA512 7a87e4ee08169e9390d0dfe607e9a220dc7963f9b4c2cdc2f8c33d706e90dc405fbee00ddc4943794fb502d9882b21faae3486bc66b97348121ae665ae58b01c
SSDEEP 192:cWYhWZSWWFYg7VWQ4eWkcc7ZqnajgnLSp:cWYhW84cllk2p
TLSH
T1E7322B61C7AC8143F9AB6E7042D9D9933C3DA7CB2910C16556ADF9A92C837D0E730B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-processenvironment-l1-1-0.dll
Size 12KB
SHA256 aa415db99828f30a396cbd4e53c94096db89756c88a19d8564f0eed0674add43
MD5 f43286b695326fc0c20704f0eebfdea6
SHA1 3e0189d2a1968d7f54e721b1c8949487ef11b871
SHA512 6ead35348477a08f48a9deb94d26da5f4e4683e36f0a46117b078311235c8b9b40c17259c2671a90d1a210f73bf94c9c063404280ac5dd5c7f9971470beaf8b7
SSDEEP 192:qKWYhWbWWFYg7VWQ4eWYoWjxceXqnajLJe:qKWYhWJ4WjmAlnJe
TLSH
T1D14219C2CBBC5003FAD76D7042A9E4A77C3893E72D1080690564FA693C977D1EB94B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-processthreads-l1-1-0.dll
Size 13KB
SHA256 c9a686030e073975009f993485d362cc31c7f79b683def713e667d13e9605a14
MD5 e173f3ab46096482c4361378f6dcb261
SHA1 7922932d87d3e32ce708f071c02fb86d33562530
SHA512 3aafefd8a9d7b0c869d0c49e0c23086115fd550b7dc5c75a5b8a8620ad37f36a4c24d2bf269043d81a7448c351ff56cb518ec4e151960d4f6bd655c38aff547f
SSDEEP 192:AWXk1JzX9cKSIvWYhWLWWFYg7VWQ4SWW0uI7oinEqnajxMyqY:AWXk1JzNcKSIvWYhW5+uOEle6
TLSH
T1A1520AD5C6FC9183F88AAD306685D9533C3AD7C5192A813106E9F2E93DEB3C2D62462D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-processthreads-l1-1-1.dll
Size 11KB
SHA256 25a99bdf8bf4d16077dc30dd9ffef7bb5a2ceaf9afcee7cf52ad408355239d40
MD5 9c9b50b204fcb84265810ef1f3c5d70a
SHA1 0913ab720bd692abcdb18a2609df6a7f85d96db3
SHA512 ea2d22234e587ad9fa255d9f57907cc14327ead917fdede8b0a38516e7c7a08c4172349c8a7479ec55d1976a37e520628006f5c362f6a3ec76ec87978c4469cd
SSDEEP 192:NtxDfIeA6WYhW7WWFYg7VWQ4eWpB5ABzR/BVrqnajcb:NtxDfIeA6WYhWp28RLlA
TLSH
T17A422A929AFC9043F997AEB052D5E9533C3EB7C72621806515B4F16C2CD73C1EB11A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-profile-l1-1-0.dll
Size 10KB
SHA256 42f4e84073cf876bbab9dd42fd87124a4ba10bb0b59d2c3031cb2b2da7140594
MD5 0233f97324aaaa048f705d999244bc71
SHA1 5427d57d0354a103d4bb8b655c31e3189192fc6a
SHA512 8339f3c0d824204b541aecbd5ad0d72b35eaf6717c3f547e0fd945656bcb2d52e9bd645e14893b3f599ed8f2de6d3bcbebf3b23ed43203599af7afa5a4000311
SSDEEP 192:clIHyZ36WYhWulWWFYg7VWQ4yWqeQDbLtsQlmqnajlDC:clIHyZKWYhWKhlbp6l9C
TLSH
T111320992CBFC4043F5A36E7053D8DA837D3DA3DB6A6081190569F4AD1CC77D0AB6492E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 11KB
SHA256 02d987eba4a65509a2df8ed5dd0b1a0578966e624fcf5806614ece88a817499f
MD5 e1ba66696901cf9b456559861f92786e
SHA1 d28266c7ede971dc875360eb1f5ea8571693603e
SHA512 08638a0dd0fb6125f4ab56e35d707655f48ae1aa609004329a0e25c13d2e71cb3edb319726f10b8f6d70a99f1e0848b229a37a9ab5427bfee69cd890edfb89d2
SSDEEP 192:4GeVvXK9WYhW1WWFYg7VWQ4yWj6k50IsQlmqnajlDl:4GeVy9WYhWzVk6l9l
TLSH
T179422B968BBC5003F5A36E70139ACE8B7D3DA7D729A4812604A5F19D1CC33D4FB14A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-string-l1-1-0.dll
Size 11KB
SHA256 9447218cc4ab1a2c012629aaae8d1c8a428a99184b011bcc766792af5891e234
MD5 7a15b909b6b11a3be6458604b2ff6f5e
SHA1 0feb824d22b6beeb97bce58225688cb84ac809c7
SHA512 d01dd566ff906aad2379a46516e6d060855558c3027ce3b991056244a8edd09ce29eacec5ee70ceea326ded7fc2683ae04c87f0e189eba0e1d38c06685b743c9
SSDEEP 192:byMvQWYhW5fWWFYg7VWQ4eWio3gDwcunYqnajv9JS:byMvQWYhW/BXwulhw
TLSH
T17F321B82DBBC9003F9A36E704799ED877C3CABD72910826516A9F1942CD33C0EB14B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-synch-l1-1-0.dll
Size 13KB
SHA256 a31a15bed26232a178ba7ecb8c8aa9487c3287bb7909952fc06ed0d2c795db26
MD5 6c3fcd71a6a1a39eab3e5c2fd72172cd
SHA1 15b55097e54028d1466e46febca1dbb8dbefea4f
SHA512 ef1c14965e5974754cc6a9b94a4fa5107e89966cb2e584ce71bbbdd2d9dc0c0536ccc9d488c06fa828d3627206e7d9cc8065c45c6fb0c9121962ccbecb063d4f
SSDEEP 192:L1dv3V0dfpkXc2MAvVaoKKDWYhWTJWWFYg7VWQ4uWoSUtpwBqnajrmaaGWpmJ:Zdv3V0dfpkXc0vVaeWYhWj/qlQGWpmJ
TLSH
T1A8522A92D7E8A243F56FEE7046CAC5936C3857C74A20C0261195FAAD3DE33D0EB1562E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-synch-l1-2-0.dll
Size 11KB
SHA256 1c72ac404781a9986d8edeb0ee5dd39d2c27ce505683ca3324c0eccd6193610a
MD5 d175430eff058838cee2e334951f6c9c
SHA1 7f17fbdcef12042d215828c1d6675e483a4c62b1
SHA512 6076086082e3e824309ba2c178e95570a34ece6f2339be500b8b0a51f0f316b39a4c8d70898c4d50f89f3f43d65c5ebbec3094a47d91677399802f327287d43b
SSDEEP 192:ztZ3XWYhW3WWFYg7VWQ4eWNnpit7ZqnajgnLSl:ztZ3XWYhWVg+llk2
TLSH
T1DF422AA6CBAC5203F5A79D7047D9D8833C3DA7DA2950816116BDF1693CA33C1E700E2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-sysinfo-l1-1-0.dll
Size 12KB
SHA256 19c78ef5ba470c5b295dddee9244cbd07d0368c5743b02a16d375bfb494d3328
MD5 9d43b5e3c7c529425edf1183511c29e4
SHA1 07ce4b878c25b2d9d1c48c462f1623ae3821fcef
SHA512 c8a1c581c3e465efbc3ff06f4636a749b99358ca899e362ea04b3706ead021c69ae9ea0efc1115eae6bbd9cf6723e22518e9bec21f27ddaafa3cf18b3a0034a7
SSDEEP 192:fKIMFFyWYhW6WWFYg7VWQ4eWoVjxceXqnajLJ4:fcyWYhWKRjmAlnJ4
TLSH
T11E421992DBBC9203F9A76E7052D5D5833D38A7D62511C11906E9F3B83CA33C5DB50A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-timezone-l1-1-0.dll
Size 11KB
SHA256 3d798b9c345a507e142e8dacd7fb6c17528cc1453abfef2ffa9710d2fa9e032c
MD5 43e1ae2e432eb99aa4427bb68f8826bb
SHA1 eee1747b3ade5a9b985467512215caf7e0d4cb9b
SHA512 40ec0482f668bde71aeb4520a0709d3e84f093062bfbd05285e2cc09b19b7492cb96cdd6056281c213ab0560f87bd485ee4d2aeefa0b285d2d005634c1f3af0b
SSDEEP 192:4EWYhWdWWFYg7VWQ4eWvvJ6jxceXqnajLJn:4EWYhWbwYjmAlnJ
TLSH
T1F24228D3CBB88403FDEB6F7047A9D4937D38A7E61920815909E6E4693C973D1EB10A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-core-util-l1-1-0.dll
Size 11KB
SHA256 5eb724c51eecba9ac7b8a53861a1d029bf2e6c62251d00f61ac7e2a5f813aaa3
MD5 735636096b86b761da49ef26a1c7f779
SHA1 e51ffbddbf63dde1b216dccc753ad810e91abc58
SHA512 3d5110f0e5244a58f426fbb72e17444d571141515611e65330ecfeabdcc57ad3a89a1a8b2dc573da6192212fb65c478d335a86678a883a1a1b68ff88ed624659
SSDEEP 192:dZ89WYhWFWWFYg7VWQ4eW5QLyFqnajziMOci:dZ89WYhWDnolniMOP
TLSH
T1FD322B838BFC8403FAA76D304795DD837C3CA7DA266080A519A8F5992CC37D1EB14B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-crt-conio-l1-1-0.dll
Size 12KB
SHA256 b119adad588ebca7f9c88628010d47d68bf6e7dc6050b7e4b787559f131f5ede
MD5 031dc390780ac08f498e82a5604ef1eb
SHA1 cf23d59674286d3dc7a3b10cd8689490f583f15f
SHA512 1468ad9e313e184b5c88ffd79a17c7d458d5603722620b500dba06e5b831037cd1dd198c8ce2721c3260ab376582f5791958763910e77aa718449b6622d023c7
SSDEEP 192:R0WYhWRWWFYg7VWQ4eWLeNxUUtpwBqnajrmaaG:R0WYhWPzjqlQG
TLSH
T1BF42E68396FC5A03F5535F30A7F9DAC37D3A27D72A506069045AF4A838C23D5AB11A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-crt-convert-l1-1-0.dll
Size 15KB
SHA256 6c008be766c44bf968c9e91cddc5b472110beffee3106a99532e68c605c78d44
MD5 285dcd72d73559678cfd3ed39f81ddad
SHA1 df22928e43ea6a9a41c1b2b5bfcab5ba58d2a83a
SHA512 84ef0a843798fd6bd6246e1d40924be42550d3ef239dab6db4d423b142fa8f691c6f0603687901f1c52898554bf4f48d18d3aebd47de935560cde4906798c39a
SSDEEP 192:JM0wd8dc9cydWYhWyWWFYg7VWQ4eW9jTXfH098uXqnajH/VCf:G0wd8xydWYhWi2bXuXlTV2
TLSH
T14362C65366E42F26F69B177221FEC7D72A394781259143B4C217E54C3883781BDA7C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-crt-environment-l1-1-0.dll
Size 11KB
SHA256 aa3e3e99964d7f9b89f288dbe30ff18cbc960ee5add533ec1b8326fe63787aa3
MD5 5cce7a5ed4c2ebaf9243b324f6618c0e
SHA1 fdb5954ee91583a5a4cbb0054fb8b3bf6235eed3
SHA512 fc85a3be23621145b8dc067290bd66416b6b1566001a799975bf99f0f526935e41a2c8861625e7cfb8539ca0621ed9f46343c04b6c41db812f58412be9c8a0de
SSDEEP 192:6KNMWYhW6WWFYg7VWQ4eWSA5lJSdqnajeMh3:6KNMWYhWKiKdlaW
TLSH
T154420A868BBC5543F6976E7047B9E9437D3C67C7291082650569F1582CC73C0FB11A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-crt-filesystem-l1-1-0.dll
Size 13KB
SHA256 974af1f1a38c02869073b4e7ec4b2a47a6ce8339fa62c549da6b20668de6798c
MD5 41fbbb054af69f0141e8fc7480d7f122
SHA1 3613a572b462845d6478a92a94769885da0843af
SHA512 97fb0a19227887d55905c2d622fbf5451921567f145be7855f72909eb3027f48a57d8c4d76e98305121b1b0cc1f5f2667ef6109c59a83ea1b3e266934b2eb33c
SSDEEP 192:CGnWlC0i5ClWYhWwWWFYg7VWQ4eWtOUtpwBqnajrmaaGN4P:9nWm5ClWYhWQ8qlQGN6
TLSH
T1BF52F78387E86E12FAA71F7156EDDBD73E3D2BC2199282658016A45836C33C07F2255E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-crt-heap-l1-1-0.dll
Size 12KB
SHA256 8166321f14d5804ce76f172f290a6f39ce81373257887d9897a6cf3925d47989
MD5 212d58cefb2347bd694b214a27828c83
SHA1 f0e98e2d594054e8a836bd9c6f68c3fe5048f870
SHA512 637c215ed3e781f824ae93a0e04a7b6c0a6b1694d489e9058203630dcfc0b8152f2eb452177ea9fd2872a8a1f29c539f85a2f2824cf50b1d7496fa3febe27dfe
SSDEEP 192:8a9aY17aFBRAWYhWYWWFYg7VWQ4eWbr0tJSUtpwBqnajrmaaG:8ad9WYhW4F/qlQG
TLSH
T117420A938ABC5543F5A36F706AE8DACB3D3E63D67D5080670157F59829833C0AB2162E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-crt-locale-l1-1-0.dll
Size 11KB
SHA256 edc1699e9995f98826df06d2c45beb9e02aa7817bae3e61373096ae7f6fa06e0
MD5 242829c7be4190564becee51c7a43a7e
SHA1 663154c1437acf66480518068fbc756f5cabb72f
SHA512 3529fde428affc3663c5c69baee60367a083841b49583080f0c4c7e72eaa63cabbf8b9da8ccfc473b3c552a0453405a4a68fcd7888d143529d53e5eec9a91a34
SSDEEP 192:+WYhWoWWFYg7VWQ4eWSoV7jjT6iBTqnajbQwr1:+WYhWIiVTTXZl3QC
TLSH
T132422A468BFC5103F6936EB04AECEA837D3EA7C71A1181A50596F5982C833D8EB11A5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-crt-math-l1-1-0.dll
Size 20KB
SHA256 f6a93fe6b57a54aac46229f2ed14a0a979bf60416adb2b2cfc672386ccb2b42e
MD5 fb79420ec05aa715fe76d9b89111f3e2
SHA1 15c6d65837c9979af7ec143e034923884c3b0dbd
SHA512 c40884c80f7921addced37b1bf282bb5cb47608e53d4f4127ef1c6ce7e6bb9a4adc7401389bc8504bf24751c402342693b11cef8d06862677a63159a04da544e
SSDEEP 192:8JIDSM4Oe59rmkUALQe1hgmL44WYhWWWWFYg7VWQ4yWARgKZRqnajl6umA:8JI2M4Oe59Ckb1hgmLhWYhW2v2yRlwQ
TLSH
T14092A74749DCFF63D18F1BB741F08BCE6A385AA665D1B6B4C81B908434A27C47E83949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-crt-multibyte-l1-1-0.dll
Size 19KB
SHA256 5b3e29116383ba48a2f46594402246264b4cb001023237ebbf28e7e9292cdb92
MD5 a5b920f24aea5c2528fe539cd7d20105
SHA1 3fae25b81dc65923c1911649ed19f193adc7bdde
SHA512 f77f83c7fad442a9a915abcbc2af36198a56a1bc93d1423fc22e6016d5cc53e47de712e07c118dd85e72d4750ca450d90fdb6f9544d097afc170aeecc5863158
SSDEEP 384:4SrxLPmIHJI6/CpG3t2G3t4odXLhWYhWfgy6l9ne:4iPmIHJI6vZO
TLSH
T1CE921D6B8EE82E12E28FD7F3B5F6C7C62A350F9105C07375A26785483841EE9BD52E05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-crt-private-l1-1-0.dll
Size 62KB
SHA256 55bc91a549d22b160ae4704485e19dee955c7c2534e7447afb84801ee629639b
MD5 5c2004daf398620211f0ad9781ff4ec2
SHA1 e43dd814e90330880ee75259809eee7b91b4ffa6
SHA512 11edbbc662584bb1dea37d1b23c56426b970d127f290f3be21cd1ba0a80d1f202047abb80d8460d17a7cacf095de90b78a54f7c7ec395043d54b49ffe688df51
SSDEEP 1536:Se6De5c4bFe2JyhcvxXWpD7d3334BkZn+PI5c:Se6De5c4bFe2JyhcvxXWpD7d3334BkZU
TLSH
T1C05307DB49E63F21E18FF7B76BFB17C90B253A4418806274EAC7556B34853A9BC43A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-crt-process-l1-1-0.dll
Size 12KB
SHA256 191f53988c7f02dd888c4fbf7c1d3351570f3b641146fae6d60acdae544771ae
MD5 dd899c6ffecce1dca3e1c3b9ba2c8da2
SHA1 2914b84226f5996161eb3646e62973b1e6c9e596
SHA512 2db47faa025c797d8b9b82de4254ee80e499203de8c6738bd17ddf6a77149020857f95d0b145128681a3084b95c7d14eb678c0a607c58b76137403c80fe8f856
SSDEEP 192:+nqjd7dWYhWDWWFYg7VWQ4yWMJ5HKZRqnajl6b:+nsWYhWxp5HyRlwb
TLSH
T1604209878BF86953E6675F3082F9D7877F3B53C2690082698456F05D3C833D5AB21A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-crt-runtime-l1-1-0.dll
Size 15KB
SHA256 4390c389bbbf9ec7215d12d22723efd77beb4cd83311c75ffe215725ecfd55dc
MD5 883120f9c25633b6c688577d024efd12
SHA1 e4fa6254623a2b4cdea61712cdfa9c91aa905f18
SHA512 f17d3b667cc8002f4b6e6b96b630913fa1cb4083d855db5b7269518f6ff6eebf835544fa3b737f4fc0eb46ccb368778c4ae8b11ebcf9274ce1e5a0ba331a0e2f
SSDEEP 192:maajPrpJhhf4AN5/KixWYhW4XWWFYg7VWQ4eWvppXjxceXqnajLJhrdCq:mlbr7nWYhW41MXjmAlnJhUq
TLSH
T19572D74397FC7F27E5972B7216F9D7D72E3A638226108179C463B0983883781BD5721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-crt-stdio-l1-1-0.dll
Size 17KB
SHA256 6f6f6e857b347f70ecc669b4df73c32e42199b834fe009641d7b41a0b1c210af
MD5 29680d7b1105171116a137450c8bb452
SHA1 492bb8c231aae9d5f5af565abb208a706fb2b130
SHA512 87dcf131e21041b06ed84c3a510fe360048de46f1975155b4b12e4bbf120f2dd0cb74ccd2e8691a39eee0da7f82ad39bc65c81f530fc0572a726f0a6661524f5
SSDEEP 192:WpPLNPjFuWYFxEpahTWYhWHWWFYg7VWQ4eW9M3u57ZqnajgnLSuRCz:W19OFVhTWYhWlBu5llk2
TLSH
T15682C54785EC7F02E29787331AFAEBEA5A31578338007178C117E99836CA3D87E43559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-crt-string-l1-1-0.dll
Size 17KB
SHA256 45e0835b1d3b446fe2c347bd87922c53cfb6dd826499e19a1d977bf4c11b0e4a
MD5 f816666e3fc087cd24828943cb15f260
SHA1 eae814c9c41e3d333f43890ed7dafa3575e4c50e
SHA512 6860abe8ab5220efb88f68b80e6c6e95fe35b4029f46b59bc467e3850fe671bda1c7c1c7b035b287bdfed5daeac879ee481d35330b153ea7ef2532970f62c581
SSDEEP 384:NFvU4x0C5yguNvZ5VQgx3SbwA7yMVIkFGl/WYhW49PBolniMcx:T5yguNvZ5VQgx3SbwA71IkFwNJT
TLSH
T17482C64386F83F02DA8F57B359FAC7C32E385F46254153B5D467A48C38827A2BE67909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-crt-time-l1-1-0.dll
Size 13KB
SHA256 b48310b0837027f756d62c37ea91af988baa403cbcbd01cb26b6fdae21ea96a2
MD5 143a735134cd8c889ec7d7b85298705b
SHA1 906ac1f3a933dd57798ae826bbefa3096c20d424
SHA512 c9abe209508afae2d1776391f73b658c9a25628876724344023e0fc8a790ecb7dbce75fddae267158d08a8237f83336b1d2bd5b5ce0a8eed7dd41cbe0c031d48
SSDEEP 192:qy5NDSWYhWcQWWFYg7VWQ4eWAcSJR/BVrqnajcm2:qU0WYhWcwASJRLlA
TLSH
T1635209439AE86A07FA971B7212FDD7E73F3917C22A8071758166D4983A93390FE1381D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\api-ms-win-crt-utility-l1-1-0.dll
Size 11KB
SHA256 c81c4bba4e5f205359ad145963f6fbd074879047c66569f52b6d66711108e1ed
MD5 6f1a1dfb2761228ccc7d07b8b190054c
SHA1 117d66360c84a0088626e22d8b3b4b685cb70d56
SHA512 480b4f9179d5da56010fa90e1937fe3a232f2f8682596c16eeaed08f57cf8cffeaa506060429501764f695cb6c5b3e56b0037de948c4d0e3933f022a0b4103d2
SSDEEP 192:GI6fHQduPWYhWcWWFYg7VWQ4yWpbdsQlmqnajlDPD:2f5WYhW8Kd6l9L
TLSH
T1F64229838BFC5643F6A72F7083E8DA833D3E67D6696082654065F5993883BD0FB2151E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

concrt140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\concrt140.dll
Size 316KB
SHA256 2405355f0a58067b258f8df33c327e3a3d716eaac5a3a5aebb757842d85bd376
MD5 5fe9a647921ded8a2fad92deb9ec4ab2
SHA1 1ce87fac4c22aae82a81ddb26952c074b744e78d
SHA512 11fe4c0519cb1df73695ce38b5fdea2a563de565116a47ff0032d5a68b8c51fe732ad66738a7167e56d79193c60af9204a7ee0beae8ff8bb75abd0b484c2d764
SSDEEP 6144:jfjSd54rw5k9cZW1Cbfpri5/ww8VRj7nWzg/p8Wcz:DOP4rwK9c0ILqzocz
TLSH
T16C64398A76140CE6F96BE039C553851BE6F2BC416352D3CB0264839E6F637D1E93A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\dbghelp.dll
Size 1.5MB
SHA256 13f0c74845318b52b76e6000564b1a99c37de48422b44ac74d034fa222c65a23
MD5 a5e4b3ff51cf5b7926d9651908feb666
SHA1 4ef5d229709e40f3f84e46c3a28341eadbd1a044
SHA512 0615ff581b648715461349b1622fbc208042fc8c395cb2d271203b25b036f59edb0fc3470065dc15061af1be0fff48981f55bbea7f00c88906e9b470764a86fa
SSDEEP 24576:xU5lL6v/X5lknycQFrQ8gKt/X95WqbQLZopKjMcqpzd1YWLfY:Kni/X5lknDFUCaQLq8
TLSH
T1A975299BF97941F5DCBAC039D662A627F9B13859832497C367908B562F23BF4983D300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kbaseconfigcenter.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\kbaseconfigcenter.dll
Size 1.7MB
SHA256 4f68e1dbfc11e5e276905a49059ea4a454919ca857f8c3b7bfa346626925fbfe
MD5 60f369c20bb1b1b95f9939b32849a282
SHA1 833dcdc719a866790ae50fdfcc8511cf490118ee
SHA512 9de37cfab9752d234b8b286582fb5968ed7d891d5dc656aa57a2c49b771bbb3602981135f701da8fabda3f86a488177f806bd35f0c6899a99dc2ceb06da2de5e
SSDEEP 24576:8WCxihYKV3O4o/J5ADfQvd4PKvX6sFtIY1hIQ9x9Yw9:8WCxihYKQ4o/JiDIV4RbYfIQZYw9
TLSH
T1AE854913A30AC96CD18E6F7427162B5FF678597607308EDBA7A22DD54E272C05732B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kpacketui.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\kpacketui.dll
Size 836KB
SHA256 e0db71f3a34e740fad2e39f52a63272340d3bb719e2f60294bf0520fa3cf6dae
MD5 e74a8762d246b8e1a49eebd418d6f248
SHA1 397235808d3784c5c88de81328c26ce6534e45ef
SHA512 01747ecc5a45fc5c7649388b61581caf84fd1e793c6177c9c9556c356a6329566e153b932ab447515cd572bf52ae715a4cf49d92cf1503eac870377a894cd4f3
SSDEEP 12288:cWgn/cyY1jnMEJxI+jhYmnjxKX6Ll20ovdV9IMX1kOKpW:cWg61jME/jh/jxi6pb6XR
TLSH
T143057C1FAB9903BAE03BD139C597C813E172740203A29BEB9945EE652F773E5493E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\msvcp140_1.dll
Size 35KB
SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
MD5 2a214cb2f0f9473e7765ee3b8db8651e
SHA1 9ce5c3d6c7d94b175f136f552af8771dca6147b3
SHA512 ea9a759babdec5818fa1e430d1cb453cac762cfaa8f934e01d7182100f66cae21527962696f5bd963fcb0fba2c0f38bf4028e75f89e9e599ddee008021646a33
SSDEEP 384:3jJ2J9VQH+qNy09dmFWcS5gW7YZ1gr4iSt+e92xS+R9zWd/I1IHRN7SUl8BR9zTr:d8QH+qNy0PmgogU9v2ci9zeHSn9z3
TLSH
T1C3F25D86F7248442EC674970C699EE837C3DB3D25B50969B17A5F61C0DA33C1FA34A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_2.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\msvcp140_2.dll
Size 273KB
SHA256 3ea06f0ee098b4823cb79599df3780e7f23cce52c19aac31d2a0d47efe33a5e9
MD5 3151333808c2c2339d5f5466df70b7dc
SHA1 e48159bb2127ec812ff679f6fabc41141009f26a
SHA512 8f1daa078e124dc89b51b84baab8d6cc2d77497be23b2ba95ef3fee54d9034e17bf5cd15a4043d025699972cae20f9c46d2e7bef48e4283f3ad9ca6b84fc64d1
SSDEEP 3072:1J51P7emwi1j+XZi7b1dbqtH0h6XV3Q0JPQo07ICl3Sg2xmygdCg2LMeDh5FD799:1JbjwvnQo/iy5L/XxTWrNM
TLSH
T1AD543912B51A2EBFC5D6E8B04939B416FC223A418775C48A57C31C8D9E2BB437FE3529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_atomic_wait.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\msvcp140_atomic_wait.dll
Size 49KB
SHA256 640b2aefced484d0368eea5bdd06addd0658a3a70a49256e560d6923b404a479
MD5 44aec42494531580bca182b0e2fb19c2
SHA1 a85a6a4de6656e5969fa4ab15f2230dfe2839e75
SHA512 d8afb5bbb1394fd14c3ec8ecdd4c02e1c6f23031b15173b1448dfd4915c392bb8512cd41eccb449db19969397a09046d27d54db704c8122ff62c12ff5a89c9d6
SSDEEP 768:ayMsqh8UGchsJr3KbYA5XeDmqw4DYPW9zr0JD0io9z7p1uF:W+UjCKb/5XeCqgazrURgz91G
TLSH
T19C337DDDA7684083E5678634C1A4E517FA7AB7E20710D6EF4352F0890FA37D1AE34B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_codecvt_ids.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\msvcp140_codecvt_ids.dll
Size 31KB
SHA256 f2069a52880ec885ee7f0511186100eb7fada0411a2b4948fafea7735b878a18
MD5 3ece3fb90bfaea8e9a5fb7139ff9cbdc
SHA1 91b19dd0db24a5cbd944eca9c67fad3b53f9c154
SHA512 c059ffd80de25ad10d34064b1e9421666525da67710de0ac445cfc45b8139715dd946f7e90c1e0d719c60e3d5902e3229db4496c87d674c0012c9b4a8c2b2291
SSDEEP 384:p7GVNpd36sRWioEWEw4himRSt+efdDtdQ5R9zpU8NSqHRN7w9ju0R9zlWdo:5GVsfaw4DYd7ds9zmMEu49z0G
TLSH
T19BE27C89DA3C4487EC9B5C7082ACDE477C3D77C60A10569B4392F5181DA33C6EB3866E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
Size 75KB
SHA256 dcf5212ec3fe7746f8b26a504687be3bb29954294b7f448c4940b413fb04c527
MD5 80946fdc71e0211e5e4c54428615ac29
SHA1 2df40528efde1df3b996568df59900832b1ad9e8
SHA512 d842f4d7e956fc96902742a3095753be43d33f60f7d0bee53e95d2342da998d95ca1aac5c56c284a5ae078c923f45effd19b16b9921ef7ed0e13c306d8a34b9b
SSDEEP 768:YXOzQ/DBnTQxkUtwZfVKFkYQJc1EqTwi6NBv9ZpZSac6mWWrDYiDLk5C7toHZtY0:7jf8J6wi6NBV9Sac0+D7bRQt77f
TLSH
T1C9736CA3DB441799E51B8634DAD58A1BE6B2784207A293CF6324E3680F733D2397D3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
Size 46KB
SHA256 524e279aa876ea45ac1205c4f4210c226aded2298d96b4ba46f3e7c4faec499a
MD5 d7957c1bee4a820225202b81e5cef01c
SHA1 de1e1969fe0dff1c7fbaaae9aceb19e68303126d
SHA512 7f7347bc8a1de88638d85af90c12fb6f23e6e963a2a5db8b70ea3ff681c8070622a36ab0b542c49de6834ae04561042217e3e3f2de73b04c4a49211f73a1ef7f
SSDEEP 768:m/6pbQ2EGQ9UXbX8UKaYiDLk5C7blYi77M5ALlt:rQ2TTbX8UKa7bPl77L
TLSH
T16E237B97CF540C09E9279A70B8C58A26F972B8514B92C3CF3294D2694F963C23DBD3D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qskia.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\qt\plugins\platforms\qskia.dll
Size 1.9MB
SHA256 6daafb39daca277e272ba56a115eed0235b45d5d820fa9b315f78005e048e6e6
MD5 d6935f83ac4579a4ad454d9115ba5c3a
SHA1 27e617a82f8b472e017113e0aefa10d2822998e5
SHA512 8dfd760c0627ff40d878b450d72f2d80e0dd4d341f78cfd9ef97ae13c059c6f6292d2ffc8a9bc48234613ad9a78f35865139be584f28c79b0840b448131e1001
SSDEEP 49152:ddsZt1rO+9yWfbVQLR4bC9c4RmZSHpjlW2k82a66kTc5d7:5+kW3yp
TLSH
T137957D43E3B44298C1A7C13D869B9F0BDAB1740543629BDB2260CF59EF237D21A7E791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\qt\plugins\platforms\qwindows.dll
Size 1.6MB
SHA256 8a87eb5fad6e90294115e7b3df56971dd278a48456344b4bf2ea15a3055c56af
MD5 7f388c6765a0b162126462c8c3828dc7
SHA1 c79b5d39b0bd5be4e7d8969ee85b7981ba0767ed
SHA512 1aec90ed4e0b8ba0c64e295adaee2b3331936dc5ca96aba8576b936c4c1df398a31e13df27c691019ab32f826993db676bb5353dd5c5bedbee3615190f909344
SSDEEP 24576:AkGAzEn7Kn2eozTuqTttIrHhbR2gkNVDIsZM1M3aaV+Z:Aozu7Kn2xzTuYarHh9cVWM1Vs
TLSH
T160756B43E3A44398C16BC239C68B9A07E77174050361ABDF25A09F59EF63BE3177A781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsprintersupport.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\qt\plugins\printsupport\windowsprintersupport.dll
Size 88KB
SHA256 ed3b6671e01cce78640e7deaf0be5170511222cb3a24c3ed8d1e2b0f19f9976f
MD5 93ddd3e1a18ba04fe3454796af456378
SHA1 3c6674384e391c75e4c04ea2a04bca61d0f9e170
SHA512 5b15389cc2bef86bc0030ae9fb9ee78d02533c80252ec45cf7d72bd85e5b82b52677ff53ecc3c448c2543d09aac491ef30b049dbc4f6dbe7d7623bf83b0eea60
SSDEEP 1536:PUOvHEs27LT3nOv3sQwd3rduxOPN0sObm9D7bk+L77WA:Pvvks2TOv3K3rmOPN0sObm9D1t
TLSH
T16D934AA3EA64018CD626C135E4D70926F732B81517A293CF6368D74D4F237D23EB939A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
Size 159KB
SHA256 a4c3bb047f8d6d9240d5b020de80ee53585ed5029fec341ce2bab300b615a586
MD5 f10b88b6bec3fb5b9178b991475b432e
SHA1 5be625fa162f3a82a9d59297663b5072e4db0ab4
SHA512 261cf4b1e7ee029c6f3be6dc177137a258f6a44639fb10abf4b33ac0cc051c080efe5627e402328470d6eab0514d8a2f1619d5d418e88090d490ba2c7b8e040d
SSDEEP 3072:eSApjXbrT36b96bavsTHnbNgJUtrbgPwYhEIcI2oj9NQRu:qX6b96bavqHnbNpowYhEIc9Ru
TLSH
T14CF34913F25143DAC527D2B8C19E0512F3B37454436257AF25A6DBB82F533A2BD3EA82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\ucrtbase.dll
Size 987KB
SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
MD5 61eb0ad4c285b60732353a0cb5c9b2ab
SHA1 21a1bea01f6ca7e9828a522c696853706d0a457b
SHA512 44cd871f48b5193abb3b9664dbea8cdad19e72c47b6967c685cf1cc803bc9abb48a8a93009c972ef4936e7f78e3c92110828790aa0a9d26b80e6a523bbcd830d
SSDEEP 24576:xOPJ1g7mT6BNvwTOxNfoYotrz1111111r8SoKxmxvSZX0ypdNLh:xO1aNoaxNfo/+a
TLSH
T18D259E64F75C0AA6C17BE17CC95B550ED972340647608ACF03EA8BB97E2BBE91637310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vccorlib140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\vccorlib140.dll
Size 344KB
SHA256 19839407c3fdbc824e5bce189bf68ddf8097f12ec28b757797ffa0415c144ddd
MD5 0b4d02b22ffe3957db27d9cc6cff6edf
SHA1 bec5a8eed4434222956d9f0f0482f8562d992317
SHA512 9588f6e2c96b2793598cd6335bf10cdd53acd77886a5f703118c77af676da1ec3f393d55a1b1dc28dd33bf69c4c5bc70c615f8d41e1829e473ff9bbc1163ea3c
SSDEEP 6144:PpVeNd1C++IAU1qsxEW5QcT2Xgs4hiWi/GDhmVejWXaV+GpfOqmIzt/mtBGgVa0J:Pp0+Xgs4hiWi/GDhmVejWXabO/IzgtK+
TLSH
T16C74E4277B9C4CC3C931A0794E978309E372694207A1E3CB0691970E5F7B7E8AD3B665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_threads.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\office6\vcruntime140_threads.dll
Size 37KB
SHA256 219915cf20822f34d5e7c1fdd4e21ae7f3396881096c51036225fb8f84b47afa
MD5 e57bb2cda101fda5c72f3af09b035bd6
SHA1 77363f6b41d022dbd34e182a93087fc63a5b08cb
SHA512 cab172e140cc2da4444a0c37a42187c4bd29997aa5522f5cf076d8d40cb0116a9e905162349204415213c75ff34cca98cdcc5a7ee9535a8d28945af726545441
SSDEEP 768:CjJ+AiHEFeLUIHmJ9crFciw4DY0zxOW9zeLCbpiFds9z9:+uHEwLUIHscrFcig0zUizGEpiFdkz9
TLSH
T126037C86D7684487E9EA9870C2B9DA47BD3EBBD20B5041DF4381FA480D633C2EA3571D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\pl_PL\style.xml
Size 3KB
SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
MD5 034f37e6536c1430d55f64168b7e9f05
SHA1 dd08c0ef0d086dfbe59797990a74dab14fc850e2
SHA512 0e1911c882152a4e1059a3ce1880d7fb2aed1e1e36cbd37055de2e2a1333acb2a0233ba2a4d969ccebbef1e77809aa5e78807aa9239545beae8c548c0f8f35c0
TLSH
T1E381CA80A610BD0AC563F51573AB7509762CB36383ECCFC4F0EE2E698753652644B63E
MD5 SHA1 SHA512 TLSH

Submit Download

product.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\product.dat
Size 97KB
SHA256 2e844013324b6d0b45e0f68706c289221de46dcb231c45a52cdbfce80bcac54c
MD5 fae72737598e680d5e8ca1b737714b80
SHA1 40043206cfaa2f8dd7e05becb512c94456dc0bcb
SHA512 60fff6d93e507e9d534f185372d09fc1682e57f718f9369d9f5bf572c6880255672ee5cd44c0d7a79b5b778bca354457761e53730c7b79e7c146e454b582fe9e
SSDEEP 1536:1yKvOpT+qaZnhBgrtZE6JjPHUAvSVxel50kydpgnoz:1ybT+rZhBghu6JjvUAKV00kydmnoz
TLSH
T141A37EFB7E1D6BE49CCE233E5E37281CE5F9482525966448E282E5A5AC1C0B73CD790C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product_new.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\product_new.dat
Size 83KB
SHA256 53a97ea8fd5bde7018db62835a7aaf4ec5689e175224e7cdb18bf070357de113
MD5 b58e647aabdee999ac048482ce15ff98
SHA1 4c8d0c481563b187cf00d1de36ae65ce6b2b7cb5
SHA512 b885fd8be8f72caf0eef8d4439b234035c1e71eefa5b69efe7adba2943de872c0bfce1cf06e06a41e3b8de6f776e07da283f75974171e34e6442176ed79355e0
SSDEEP 1536:I3CcyHhFmk6ebivjsUd1YXpFgnkJWvxh3/hICzQgKBVkeUzEy7n:2GHDW1ITZKkEh5zPKBtc
TLSH
T17E832C18ECE16EAD685052791D376D8227B7DD9160DD30AC4B12AA4CFC3CF887F72A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2442\CONTROL\vi_VN\style.xml
Size 4KB
SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
MD5 394488b30107bcebb84a97ed5d754cee
SHA1 69ebe17f7d577e9bf69c87cff45c3251f0bbc86e
SHA512 24a6bc7debbf7030c1261c69cb4ae7bf3cbb5c7fac315188163c6001e58dfbe2e634925cb767044da7ea0e6d08c709b2ade02f6e43930819e1bef6f7569cad5a
SSDEEP 96:gd6SmSZcFe9gSs8TcySCSi58VS5eQJ/gQkgQ0/Mw8CclQgYzdr/PwiCSeDeR3ciw:gdAh8Ax
TLSH
T13FA17780A610BD0AC563A51977AB7909B62C736383ECCFC4F0EE3E658753692644B63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 387B
SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
MD5 c38481658f9149eba0b9b8fcbcb16708
SHA1 f16a40af74c0a04a331f7833251e3958d033d4da
SHA512 8f98d62f88442b8ef94aa10074e35aa8d9494f3c76ce8b143ca0bf7fa0d917f3175212fbcd6e7b0597fd0ec0e1b2827f157135512fb01c88218d36e2f7dd73ce
TLSH
T1D4E09B1BA8D1B0ABDEB302E988979D54BAC03D9A066D23147762540D3D32918FB41D65
MD5 SHA1 SHA512 TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 433B
SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
MD5 a9519168ca6299588edf9bd39c10828a
SHA1 9f0635e39d50d15af39f5e2c52ad240a428b5636
SHA512 0607eb1f5598320961fbd8ef75beeb1b6dc1af3cae7eeb5ba352f3e2a2edb25e1d9e68fb46c24e4299957352c0c906314c889c2d1092437eccc1d1a0485f3557
TLSH
T194E0540FA891B0679D7302F488E39C007AC03E96055D1210773144093C32A14FB81D69
MD5 SHA1 SHA512 TLSH

Submit Download

3326287273.values

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cache\3326287273.values
Size 88KB
SHA256 f097799332807ff0630db2172358ee4a10664fc86fb9240f6602158e3f6e0a0d
MD5 614a620e24a33c1914638cf93bcac321
SHA1 cf97af56ba03c07192a5b20269fc637aef6e207b
SHA512 4b7c118134c55de6e70d29fbd2d5d63e0e5e3a9a4279164154c40492dc996cbc3acb1d851d63c792bab8d9712e284d2036f6a4609a6b0c9268177f3babfb7bbb
SSDEEP 1536:4tJz1ysd7txitg7tJz1ysd7txitgqus+0:o3ZFtUg3ZFtUrus+0
TLSH
T15C933AD227E61E2CF5B60F3E673666A05977EAC95E01B20D0231D41B0E2AE50CCF4B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e2c18164ccef1cf945648e9bd5c1991.svg

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\configs\appicon\8e2c18164ccef1cf945648e9bd5c1991.svg
Size 2KB
SHA256 49e0bba54191a9790aeb884dbd27508a9b17826fa39ed66907c9d0e39d9e3fcc
MD5 5fe01a988b73ccc23842bbe289c58688
SHA1 ca2425767b9182c00f03ae95703edd67c6ff0a92
SHA512 981d3f4e24bbf0ed8eb77b9c8d2dcf9d8c87f5456f87ba43be7342752d67df68dfdbf72151e84a5355f4ecb790bbfc2509d60065677f5d7febb9822aca461529
TLSH
T174411FF6D694F1C0B006BF74F1277439E06F787E3FCA8E958140EE95E9241A28D44C82
MD5 SHA1 SHA512 TLSH

Submit Download

aac1856207f372d91bf9c10d624d5905.svg

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\configs\appicon\aac1856207f372d91bf9c10d624d5905.svg
Size 1KB
SHA256 4529ebee10e0179dedc42d85dbd28e79d26bc6c056c3fc2961f12c126720c5bc
MD5 9ea616d7b9b407bc0bdbc6496733a396
SHA1 9e88ac8f360249844b8fe1b93c99d0731c60a082
SHA512 aebcc19c61ea1e44e4af18a539e3c89a088bace411499e707b20d466c2f95a2f7b9037b430b761a5ccd39337d789750cbd5b2fe78d0ec346c27ced0577857e09
TLSH
T1523110F612F826D5C95D83B3BAE638BB352A3AFC67128EC11B546F94DD510751708CC1
MD5 SHA1 SHA512 TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 897B
SHA256 4312a300a57bf3e3532870e3a58e8ae665061b2edf93bb358363d1856fd25f48
MD5 2e373e545a1f2bf7a0a033228ac3f783
SHA1 4252ecf8dcc19f08928f11d27b67f00677c3e646
SHA512 49f35674034a67b216070dda1fec067063837722b444d2d2717ff9629ace287f8468181898131b881583b8e698261b83242a4e91e26840a84b3e14e8b47a98ea
TLSH
T12C113A11129690470B7F058891B2DAAB31FFDEF006DDBA35BF3249B7089D984952DC54
MD5 SHA1 SHA512 TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 10KB
SHA256 5c3fcea1027c6f677319b21627d308bfcfc2aa6f7886aafde597aba7329848c4
MD5 e0269eaa076b9569da5ce34b25365fb3
SHA1 86d87b5779ad1ef02bf4005ccda2d6e947d4c53b
SHA512 55b30704d0fbf082922d6d54545c49cefd68a73b4b3e64f848d58358d81f0f010eecf7dd3d49538872b5daffd84d651327fe45d7fa529e276fbb695260d11768
SSDEEP 192:ZSIdNHNH1m8QNPOBPeGFLqiSDrpIWnSwvzqY7FvmDgh/2wOXL29jrVmm9XlP:ZS48Rw0/t
TLSH
T10432BD67456F419E0B7F0A7853E2CD4A35FAEDD82B89A5903F33CEA24BCF460416E914
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 11KB
SHA256 83552e68c0492cacd8678ec2f71c675c4877c512b385e55e0791d88f5f29a1ee
MD5 99d4620e4566352ad0d6081d6987b4db
SHA1 d26ee60b9754bb4cd217e939a81a51fdbc230b22
SHA512 d36f53072fe22419216fcfea2b8c9f4753fd55d21bc6798b0eec2743f78dcc4c3978c9872755fab22f916f3a63a8f37c69bb8dfd08d34d74f9721830a4a6d146
SSDEEP 192:ZSIdNHNH1m8QNPOBPeGFLqiSDrpIWnSwvzqY7FvmDgh/2wOXL29jrVmm9XlZdL+:ZS48Rw0/ro
TLSH
T1A632BD67416F419E0BBF0A7853E2CE4A35FAEDD82749A4903F33CEA24BCF460416E954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 27KB
SHA256 db0d30dfd2435ca650a8a5431ae1dbfce09c2dac1ffaf1109fb3b3f55aa0174c
MD5 b6ba220e14607fe80aba5b8e7ca6ec2d
SHA1 2a6d621c3c10516ecd313f2510ba7ceb24e68d07
SHA512 f4db765bdbdff0b6cb6f1a82d1af99fc8a528738854d84fa7f22def65fc8056b4d09c246b13c061f39b2e85d0d8aef9777cd5412907d5a4ce511177f7ab55e41
SSDEEP 192:ZSIdNHNH1m8QNPOBPeGFLqiSDrpIWnSwvzqY7FvmDgh/2wOXL29jrVmm9XlZdLS1:ZS48Rw0/rM4GYSR7
TLSH
T10FD28A52113E81460BEF6BA092B6CE1E31EB5E7D375D79413F3389A249DE98081FDE48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 61KB
SHA256 a2423973cf79f7f9c191b6049cbcc21e8f46eadee80f59f8d2390f6f29ee719d
MD5 ff7d204215a08b7ea6c780cb482a1973
SHA1 b003a2545400ddb879ebe9d77dd1f2ce56e5ad0a
SHA512 181749b2c495a03635bc044fe3fd14df2fb3748e8e5579b6fa5e001df4083a05d4a51136cae7034359a402f9c9aecb0909346b3e02de99b91048a1d43a186107
SSDEEP 192:ZSIdNHNH1m8QNPOBPeGFLqiSDrpIWnSwvzqY7FvmDgh/2wOXL29jrVmm9XlZdLS7:ZS48Rw0/rM4GYSRA1XDYD6U4smjvd4L
TLSH
T13853DB530A2A80631BBF97E042A3CE5F35FB996D27587D003F7748B2499E84189FED58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcsdk_dpv3.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
Size 42KB
SHA256 5d40d583d9a8dec5cb757359aa15716ef5a1adb8b164ba07388e69b3b0f54f42
MD5 895581a706ce0e1a1a4073a188302071
SHA1 9e665f6a410d47166a8c79caebb70535d4872aeb
SHA512 5f46b0401fd60b01ceeda4a10a1a333f93ab4ea13998ada2f6afd958125134a943ced8e74625d0ca82fc2a219d4d46264b67fdea1d8d83cf714388353134a986
SSDEEP 768:6swwa8RbbFZhDq9SYBaMdCMwWE0ETEO5p6Db+qPsqA3:Cr4bbDhDq9SYBVEFFYU
TLSH
T14B130196B7F91558F6F72F6569B968948C3A7DD22C09E4EC01602C8E0932F90EDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 146b7846bc44b51d99ef1c572968a8402ab6873fab20a8c2840d291fd8bddb73
MD5 159d3db4bd6d1928ee569c09133bed06
SHA1 46947e60cecb9092c2075ab11b55fe63055a96c9
SHA512 dddd47ff2967bd3d20808040492bfede879291b5cc48b2e79b078322c6e5379511467a1855e2a6e4d2c3c715312655426ecf49d38b910dd6f79547428b60b530
SSDEEP 12288:yF74i8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9C:u4vwoUQ8qrgohJ/rciJljHQeHC
TLSH
T155D423808ABC1D61FDFAC2746AC2E030758DBCB02B6152F7A275B6DA9A315F19D35331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 566466b8126c67dcaceb3c2c5694e43f7a0be7c73ea87f70f412cda7542ad5e3
MD5 608884652fb42519ad9000de7c105e10
SHA1 3055f0305a27787b7ef187e5c3f3e7f83dae3a72
SHA512 ab9705a1a70cd8b6347408410162bc70a0b65e7514dd101bf6cc7db9c586dd83c7856097dd79163411228ae00eebff37367ff8857d90a66c09f05d82c7750977
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bYGvwoUQ8qrgohJ/rciJljHQeH2:Xgb4mBIBhGFDvj8qr1JzvwR
TLSH
T15E65AE1E22EC02F5E0FAD2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 6e8af394bbf529c4f6d2d4afa4676d7eb6b0caca8450816e429a1da2964b78f5
MD5 bb49ad63d90042d52d9dd3e437243e60
SHA1 f5f990716f66c867008799a411a294d7396cc3a4
SHA512 f5488f3da5c866dda96eb8dd861f420416c633a4f368cdc04874a3d7a3c13982a24649b78c324c1918a2637b530a16daaec34c45fd4ef035ffdc89c6f75f752e
SSDEEP 24576:LG88u8FpJqH1bzria7/mTvwoUQ8qrgohJ/rciJljHQeHn:K7ZFPqVea7/evj8qr1Jzvwo
TLSH
T13535F16566E501F1D47BD1388A824663F6B2B8201364EFEF07A88B551F336E54F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 98b956b22e01b87bfa0c296a3207dbea34ea8abfbb1c366d70f536b5d2dc70d2
MD5 0b618b606e741d7bcbf8aef240678bf2
SHA1 6b4cbf75b6267bd33d3e9b0cd87fef86f76f5d3d
SHA512 484f17be4be9b7c46d149833afc1fe554ac10089d28f59633341841f9d622a52bde7b35aaf85f0ab6b051f717f0c1f03cc733b7384fde424b8a9b0caa5c5906c
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/vj8qr1JzvwW:UG05lO43ba8qRJTwW
TLSH
T15BD5BF6A62EC11F9D1BBC17CDAC6460BEBB23825033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3330e290cf4fab3b32b0071c6c547fbd1b7db910b72f9e9f7a06496d6c53c956
MD5 c188930f5e9bc1f099eaa1c40dc02b34
SHA1 2edf5084ee9cf040d510e9c94da1713dc14b9dc6
SHA512 85a82114ce282ea175e2b64fe92274e867916571f89edf275210f32d8c65eba7709db1b18ee832d8f99476f9818616428dc4ebf586a072fefb9cd6861951a065
SSDEEP 24576:/fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnFvwoUQ8qrgohJ/rciJljHQeHH:Ha5POZ3BJt2pasx2+mHvj8qr1Jzvwk
TLSH
T16165AE5EA6FC01D5D5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 10589dedcaea92086facb2b4dc4275db0e920285c6a6abd16907a4451d09bea7
MD5 3fa7c7d786847ce262cee6c565480f3e
SHA1 64b812bc44df353617402caf971f28c1c443818c
SHA512 30a9456d4628fe804ccc4e1d3e9fa70ad0bad2e7cc9f47f9a46efbe8b09b9d76690b3f82d1d628a7952b02e7a2cd00462aef036a816d1ba3c7fbf0dcdb4dde90
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FkbvwoUQ8qrgohJ/rciJljHQeHq:TNc/zEOVHF+vj8qr1Jzvwd
TLSH
T181858B1623E901E4F5BBE1BE89679546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 59fd881b7ca3521f2f687d4f4c5a3025340f074a8ac95c3a66e2d672ff1d3b8a
MD5 33911e933ce82c9eb1b59443f5308980
SHA1 96de4711454fda54bf2991dd0a946e94302f35c6
SHA512 19e52191ae69064be14baffd8da24eee37ee29469f1ee247c1f24d4b38f4ebf921b7bee2e86fb6c05cbbf99785806581c915caaa9b6aac4f82ab04d5b742698e
SSDEEP 24576:NTkNvNnaFeYhJNtmZBmpvwoUQ8qrgohJ/rciJljHQeHV:NTMwBtOmpvj8qr1JzvwW
TLSH
T18E55AF6EAAB806E4D1FEC6B4DD238512E6727861173253CB5390C13F4E279D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 493aed873522ce9ca978c4fcf2efac425e6f541d3dbd52f85156fdcaf372b890
MD5 a7384b546a0251ab1f29946ccc543133
SHA1 0b2b3dad341435bb937954f1c0760565fc13cc71
SHA512 b16452bba3422fbbd0e20b3c59da492a1a30cb63c1175debd125ffc9059e3368ba912727ed0dbbf13c67d8be1c81e5ffe16b330232911e42620e46cb0317560f
SSDEEP 24576:pPUr+NQvvwoUQ8qrgohJ/rciJljHQeHY:pJQvvj8qr1Jzvw7
TLSH
T1DD05E11E66AC1CE5F67AD17C89828219F771B861171292DF02E1917E4F339E8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 a562ad517d8f0fb874bb8d303997e5c27ab0b61ab17938c7a1f6c47a4bbda064
MD5 3115e9fa4866f72a6c1b2c2a747d6f1e
SHA1 5a58520548057e5d33af6cbcb3d52bc0e563988a
SHA512 97900e8cb16aeda68f6a8f0e98034d5052c0b4fec85de1c79ceacf7892fda7ca52e3d68b5f4c45e57c02d6a45d5a22a029c1363ad5608daee5c4da9be0dd96a7
SSDEEP 24576:ZD3FHshBIYQgA8vwoUQ8qrgohJ/rciJljHQeHa:ZDVHeBIAA8vj8qr1Jzvwt
TLSH
T15B25E17DEAAC04E4E57BC1BCDA538506E7B138A8033256DB02D491BA5F27EE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-71-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/256-278-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/256-74-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/256-65-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/732-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/732-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/732-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/732-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1048-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1048-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1048-101-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1048-312-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1048-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1048-107-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1128-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1128-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1128-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1128-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1128-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1516-120-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1516-311-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1516-114-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1516-112-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1600-10019-0x0000000140000000-0x0000000140152000-memory.dmp

Download

memory/1600-9996-0x0000000140000000-0x0000000140152000-memory.dmp

Download

memory/1696-253-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1696-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1696-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1696-54-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1900-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1900-10133-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1900-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1900-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1900-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1900-10132-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3020-9511-0x00007FFD6C860000-0x00007FFD6C870000-memory.dmp

Download

memory/3020-9508-0x00007FFD6C860000-0x00007FFD6C870000-memory.dmp

Download

memory/3020-9513-0x00007FFD6C860000-0x00007FFD6C870000-memory.dmp

Download

memory/3020-9512-0x00007FFD6C860000-0x00007FFD6C870000-memory.dmp

Download

memory/3020-9506-0x00007FFD6C860000-0x00007FFD6C870000-memory.dmp

Download

memory/3020-9586-0x00007FFD87120000-0x00007FFD87D90000-memory.dmp

Download

memory/3020-9509-0x00007FFD6C860000-0x00007FFD6C870000-memory.dmp

Download

memory/3020-9514-0x00007FFD6C860000-0x00007FFD6C870000-memory.dmp

Download

memory/3020-9581-0x00007FFD883A0000-0x00007FFD8892E000-memory.dmp

Download

memory/3020-9505-0x00007FFD6C860000-0x00007FFD6C870000-memory.dmp

Download

memory/3020-9510-0x00007FFD6C860000-0x00007FFD6C870000-memory.dmp

Download

memory/3020-9507-0x00007FFD6C860000-0x00007FFD6C870000-memory.dmp

Download

memory/3404-78-0x00000000007F0000-0x0000000000856000-memory.dmp

Download

memory/3404-83-0x00000000007F0000-0x0000000000856000-memory.dmp

Download

memory/3404-290-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3404-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4292-0-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4292-8-0x0000000140000000-0x00000001407DA000-memory.dmp

Download

memory/4292-10043-0x0000000140000000-0x00000001407DA000-memory.dmp

Download

memory/4292-73-0x0000000140000000-0x00000001407DA000-memory.dmp

Download

memory/4292-10022-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4292-6-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4500-125-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4500-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4500-131-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4500-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4500-136-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4880-9972-0x00007FFD8A6E0000-0x00007FFD8A75D000-memory.dmp

Download

memory/4880-9975-0x00007FFDA2380000-0x00007FFDA238C000-memory.dmp

Download

memory/4880-4145-0x000002133FD10000-0x000002134029E000-memory.dmp

Download

memory/4880-836-0x000002133FD10000-0x000002134029E000-memory.dmp

Download

memory/4880-803-0x000002133FD10000-0x000002134029E000-memory.dmp

Download

memory/4880-9970-0x00007FFD8A760000-0x00007FFD8A831000-memory.dmp

Download

memory/4880-9974-0x00007FFD8A090000-0x00007FFD8A119000-memory.dmp

Download

memory/4880-9973-0x00007FFD954C0000-0x00007FFD954DE000-memory.dmp

Download

memory/4880-9971-0x00007FFD8DEB0000-0x00007FFD8DEEF000-memory.dmp

Download

memory/4880-9969-0x00007FFD8C260000-0x00007FFD8C35A000-memory.dmp

Download

memory/4880-9980-0x000002133FD10000-0x000002134029E000-memory.dmp

Download

memory/4880-9976-0x00007FFD89A20000-0x00007FFD8A08E000-memory.dmp

Download

memory/4880-9991-0x00007FFD9ED70000-0x00007FFD9ED7C000-memory.dmp

Download

memory/4880-9990-0x00007FFD94E30000-0x00007FFD94E43000-memory.dmp

Download

memory/4880-9989-0x00007FFD93910000-0x00007FFD93939000-memory.dmp

Download

memory/5160-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5160-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5160-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5160-20-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/6116-88-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/6116-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6116-326-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/6116-94-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/6116-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6116-295-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6160-9751-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6160-9896-0x0000000140000000-0x0000000140152000-memory.dmp

Download

memory/6160-9745-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6160-9808-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6160-9744-0x0000000140000000-0x0000000140152000-memory.dmp

Download

memory/6228-9587-0x0000000000480000-0x0000000000488000-memory.dmp

Download

memory/6228-9600-0x0000000004E40000-0x0000000004E66000-memory.dmp

Download

memory/6228-9599-0x0000000002940000-0x000000000294A000-memory.dmp

Download

memory/6444-9602-0x0000000140000000-0x0000000140152000-memory.dmp

Download

memory/6444-9724-0x0000000140000000-0x0000000140152000-memory.dmp

Download

memory/6444-9722-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/6444-9609-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/6800-9965-0x00007FFD855D0000-0x00007FFD85715000-memory.dmp

Download

memory/6800-9734-0x00007FFD6BC70000-0x00007FFD6BC80000-memory.dmp

Download

memory/6800-9966-0x00007FFD883A0000-0x00007FFD8892E000-memory.dmp

Download

memory/6800-9961-0x00007FFD85720000-0x00007FFD8618D000-memory.dmp

Download

memory/6800-9964-0x00007FFD87120000-0x00007FFD87D90000-memory.dmp

Download