afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575

Analysis

max time kernel
55s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 06:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Size 5.7MB
Sample261001-hm3rcssdkb
SHA256 afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575
MD5 938ad42d4b582e5a6b5ec1a1991ed7f0
SHA1 508608426997371b28ba51a23ac4e3d9c47809cf
SHA512 4f8f4ac13c08d59f2184e3f89ae037337dea0a08a3e498bc76df3126aae8d6d68d9f56bab0902754f7fa8bf6e73d3e90e1b2a118683ffbcb6b8c3706098637ea
SSDEEP 98304:atSuMOINjO91x364DT+Tx4NVMFb/55PU/yOv0xTQWj:ZMJtM9/5Rwb0RQk
TLSH
T13756C001BB85C5F1E5D201B0597AAB7A983DBE28573088C7A7D11D2A88312D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1216	elevation_service.exe
2944	elevation_service.exe
5524	maintenanceservice.exe
5932	OSE.EXE
120	PerceptionSimulationService.exe
3552	perfhost.exe
2508	ReFsDedupSvc.exe
2968	SensorDataService.exe
1664	ssh-agent.exe
2940	AgentService.exe
2976	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
	\??\T:\	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
	\??\W:\	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\Q:\	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
	\??\D:\	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
	\??\Z:\	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
	\??\P:\	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
	\??\G:\	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
	\??\R:\	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
	\??\X:\	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
	\??\M:\	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
	\??\O:\	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
	\??\J:\	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
	\??\U:\	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
	\??\V:\	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
	\??\K:\	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
	\??\F:\	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
	\??\I:\	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
	\??\L:\	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\N:\	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1964	ksomisc.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\system32\locator.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\System32\alg.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\System32\msdtc.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\system32\AgentService.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ffc26edd31e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\system32\vssvc.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\system32\wbengine.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\system32\msiexec.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\System32\vds.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaws.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002cdd7a867151dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000720486867151dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe

Modifies system certificate store 2 TTPs 40 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\TestSignRoot	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\TrustedDevices	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\FlightRoot	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\OemEsim	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4292	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
4292	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
4292	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
4292	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4292	afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
Token: SeAssignPrimaryTokenPrivilege	2940	AgentService.exe
Token: 33	2976	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeBackupPrivilege	2508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2508	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2508	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2508	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2508	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2508	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 6032	2976	SearchIndexer.exe	101
PID 2976 wrote to memory of 4196	2976	SearchIndexer.exe	102
PID 2976 wrote to memory of 5912	2976	SearchIndexer.exe	104
PID 2976 wrote to memory of 1868	2976	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe
"C:\Users\Admin\AppData\Local\Temp\afd7ff664bdd5be918eeac6f954e750ee56ea0db6b6e814d6a60d333ce807575.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4292
- C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1304.exe
  "C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1304.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
  2⤵
  PID:5580
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -checkInstallEnvironment
    3⤵
    PID:6088
- - C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
    "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService
    3⤵
    PID:5948
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -addFirewallRule
    3⤵
    PID:3304
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpsoffice.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpsoffice.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=klangmanager -dll_name=klangmanager.dll downloadlang en_US
    3⤵
    PID:2540
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regmtfont
    3⤵
    PID:4548
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\\office6\ksomisc.exe" -setappcap
    3⤵
    PID:3796
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -sendinstalldyn 5
    3⤵
    PID:3544
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regPreviewHandler wps.exe et.exe wpp.exe
    3⤵
    PID:3284

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:1216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2944

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5524

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5932

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:120

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3552

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2968

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1664

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2940

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6032
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4196
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5912
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1868

C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1304.exe
"C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1304.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5A29B1 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\
1⤵
PID:464
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -setlng en_US
  2⤵
  PID:1456
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -getonlineparam 00601.00001304 -forceperusermode
  2⤵
  PID:360
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -getabtest -forceperusermode
  2⤵
  PID:4712
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -fixoldversionassostatus
  2⤵
  PID:2776
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -setservers
  2⤵
  PID:2640
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -register
  2⤵
  PID:5400
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
    3⤵
    PID:6016
  - - C:\Windows\SysWOW64\regsvr32.exe
      /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
      4⤵
      PID:4120
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
    3⤵
    PID:3316
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regprogid true
  2⤵
  PID:1944
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -assowordexcelpowerpnt 1 1 1 -source=1
  2⤵
  PID:4756
- - C:\Windows\System32\openwith.exe
    "C:\Windows\System32\openwith.exe"
    3⤵
    PID:4872
- - C:\Windows\System32\openwith.exe
    "C:\Windows\System32\openwith.exe"
    3⤵
    PID:4344
- - C:\Windows\System32\openwith.exe
    "C:\Windows\System32\openwith.exe"
    3⤵
    PID:5724
- - C:\Windows\System32\openwith.exe
    "C:\Windows\System32\openwith.exe"
    3⤵
    PID:4708
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -compatiblemso -source=1
  2⤵
  PID:5336
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -checkcompatiblemso
  2⤵
  PID:6068
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -saveas_mso
  2⤵
  PID:3000
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -distsrc 00601.00001304
  2⤵
  PID:5804
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode -source=1
  2⤵
  - Network Service Discovery
  PID:1964
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -addcontextmenushellnew
  2⤵
  PID:3196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2316

C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
1⤵
PID:1344

C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
1⤵
PID:1820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c002a654562bb5ac3fc9488b1c98a4841a997e4f585cec53cd15ed25fad47e1f
MD5 8988287a2dfc5e1086b774cbc68f3338
SHA1 61eb0af3e1b134c90ba19b18149be906dd79af4e
SHA512 973c4a98d885f572192fac3ef30f2e5326026c0fe44c60a3e1cbbb54fc518221e41af4d842c01d8c4b49529d560a5070a03cb19054b8c2811ea9c7de0367b917
SSDEEP 49152:Zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnl95MdTAcQQfjP+:v3q6HjBU0xTQWj
TLSH
T1C0D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 92602de35353a57eada0c3e626dfb0999776c7b12d498262f5e204d9a2665188
MD5 859c1b21d4462facb8a0bec15b4f9100
SHA1 8e24b575714269f92dc9fc28d3d7c6f51f87532e
SHA512 f46a5f2393189946b10bf7bbc9103d8b384c41baa0073fad22472b40ce6c500be0cead62f60db76f6508e190ee128cd6c1c65e4d8747a96b3e67f6753ffa4eea
SSDEEP 24576:gXYfDtczAwN94AMdTEvcQFuOjOP95Xdt5c:Xtcv95MdTAcQQfjP+
TLSH
T17165F12877D908F9ED678278CCA18115EA337C514B60E78B03E48A6A0F337D49E7EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 99b9f614d3973dd5a971d10ee7f01109d16d5accf2c5a1c8c1803a4bc96249f1
MD5 9ed108db682347e45f137117ea055714
SHA1 5905ef834a286825a812e9cf0ef2f144fba28603
SHA512 3f511c5462080229d088169e46b6b3759a139d2d466aef0959900b5df0524c8b4433a077d2468a80e7754631c61f0c2ea97aa27b353cb6f2d2e553fbbf44f86c
SSDEEP 12288:4mw5HEjsChNVBFgl0WDm+CJqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJs:1wuoOWSN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T14F65F14637990CF9E9A786388597C136FBB2BC022A21D71F17A0C65F5F37361AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2488c401fa3f138a5d6357068be70ce6a1a0a402f6253193e88255b3a8438b29
MD5 eba1edd326a514e6b3c46bed3fa403ce
SHA1 777fa571fd1b9e4bc45f7dabe890e7f8434a47b1
SHA512 0d5389378ed96426d4389e6a0f298ee6b3598613e111ba97b6aade7ddccd1fe3b93260e0b80687c5d19fb5e41d2afa843c7af1d73667251810e0bc07390a7e68
SSDEEP 49152:WB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glQ95MdTAcQQfjP+:ku6JmVxd2dQ0xTQWj
TLSH
T103D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 0fe0b556ac801358420f96816313c8c5c25bde027cfc509e7db40057b46fbdde
MD5 a09223efce7a3aa325fc7abc49151fa2
SHA1 1370cc9428d1e51ced40e013e54392ff2af48537
SHA512 d41e5c6c131d83efe93aad3b23443a119abb47062ba1dee95d2b68a73ceeaf34e4af68b84acef99e7785209c7ad587be45c88ace872f68fac049e73f11cb1579
TLSH
T153F0DCE215B7843A2F0AAC0817F9EC3120B5E80F05D1882B303D4CD18B92156EE0B805
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 727B
SHA256 f4236e1793914f4f162b3b93d914861a62d06f1770b471aafd50a2dfe1b41b8a
MD5 ef16f8f3f438e604193679785d07ae97
SHA1 e68bd424e5d3446ffc13e7a9609e4c3052f8a667
SHA512 ec4c9b1aa3300c2b5afadb2ced42b06c174bc932c033a61216e65f59e2dd670290e60ff9b82454fef5525d10663c7856c282a764a80bf4346f42360890c8124e
TLSH
T1480194425EB49A02772647B83FFE5AA0BFB604385542F6CB822B6144E309B72331C71A
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 abfbfbc723ff25914997f9ad5b2cef01b259573d93648869322de8a3008b00bc
MD5 3180de1680d1de539127c715d96a3c5a
SHA1 a98b6bca54d03e0bbf811a0685aac49ac4e77a6f
SHA512 7430fb60abd91978456881e24b4ae42b107c896f5e438e800d61e3f71456ad061df667194b0d32798fb18675e40d7c9e2511a7c2a1c6080ad5198a01bad8de6c
TLSH
T12C01650097BD549478000D11C6FE9998F42BA08911C14296B2761CDA1290A1EFFA5016
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 828726835eb82dbec768e27492cbdbba948aa8f76c29b83df6ac1f9fc293f5c7
MD5 f97a05594d7d92cca9f0c8f16346f863
SHA1 373e31a27371acfe2ce6f6dbe9e29e51b38ecb2c
SHA512 96fe2681de833195e527fa50738eeb10a5555f4c6411d316d799459d7d713edde59d9dd3099c2ccfd0651b99340ba9b716f500c1e25140f569e9265d154e6bce
TLSH
T1D8E0203037FE502EF1A0577443D591F5AF25F1167C4896BD1D91156D5A0ED105CA7C31
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 404B
SHA256 7835d33c15ea2543b2aca61191e910518ed9d10944d634443486820ce8a26515
MD5 83b3b7b405adee8d9af98464159975d4
SHA1 db7ca699c9361d04c6e935322df091d306db72b2
SHA512 2279499a0239db95561eded503dd5c333d97af881b7e8054f5e54e3f84e9fe453b654054a2caa982addd6923a2e75369d7f1137996fe27b3fb82e7015734f97e
TLSH
T158E0C63821F8089EF0F4D03843E6A8210C99F20B060083A91240334AAB25E408CB3235
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 22a327e552cc0ebb572d6b5dd1e63c94387cec1bbd7bb0538a135eba2665605b
MD5 0175d05fa7c2456e7f88f452db44c3db
SHA1 248dfc0eba3724bf4f9e734cb8c41f92411eaa9a
SHA512 2e7e0396ed0516be74571772068aaa067315d74a4bcf901710f6b372c5ef3c7df71d7fd21ef9e03da6f5c5421969b776650c6e13be2be51a288614cc43103e2c
TLSH
T155E0682C66EFA10EF0608C3142F5E0751D88E205180087B906C14309BF0AE005D219F8
MD5 SHA1 SHA512 TLSH

Submit Download

Qt5NetworkKso.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\Qt5NetworkKso.dll
Size 1.4MB
SHA256 e800493d5f4a4d0d0bce523c4228fc28507db20f6940c741bc49000e7575f227
MD5 c48d5a1dff1b7f57223af19938d47102
SHA1 5fc962e2cc6f586c08e931ac98f58057f4132ee5
SHA512 1179fc8d04174dbe10771e05216fa002c39a81a8856103a8bf25601dfb2d55ae38b05d0f043fd688a09556f2ffb3581a351f84fd21915deca3be8de3d590faa5
SSDEEP 24576:2kbqCgnInomjARXqFrdpEGcqHnwg0i16+6VQAactJ:pNgnOo2q1Gc4wKI+6V1P
TLSH
T190655A53F7554399D62AD134CA8BC902F272740083A75BEF2669DB192F737E2263E381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo-small.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\StartScreenTile\ksolaunch\logo-small.png
Size 6KB
SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
MD5 8d650fe389e3665607fdbf938c1a1722
SHA1 2e545f9555ff22313e4ce113995d8aa694e5cab8
SHA512 f116621bfecb602d02919eb1ee9d7dc92e82b313b8b54cda42ab48c5e7ec60b02005edcad763fff6b497ca4bc46e83cb0c9a249be791f245bb9c599950fdf015
SSDEEP 192:HSO0z+xgsZ7wNP+agwQznBm2KIvdgoeAtzpZb/D1:yMRoP+z5IIa8hD1
TLSH
T1CCD19EEE6F1CCE4F079D52F7500AC0A9DEA218AA905764D4D68E70B471FE6D120EC5C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\StartScreenTile\ksolaunch\logo.png
Size 12KB
SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
MD5 d58510dca6b659c6e4ba7a454d5b75ce
SHA1 e142de2dda3811a2e8bbbb2eb64d366e8eb9ea3c
SHA512 42409f9976ad08ecf1756d1c2915f3ffd17cdc78e9ff552c0a08bdfa2fda8960e408721bfc9de1a5ed9c9aca3e23b97adb721b3c51b6b3f0ed3ee4a4c780cf88
SSDEEP 192:ySLu8Kp8OtM5IirU31+5AejJ7D+N+QOtHQjrE9aTYpR8XnXrWjvyNTtLJci:NC8o8do1+5D+N+QPE9B2Xn7WrINJP
TLSH
T1BC42C08F68918EB2CE443C39F356115F1FE12A5E7E19A2CF2CE7944A239044ACE1591F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything-KingSoft-Read-Only.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\everythingsearch\everythingbinary\Everything-KingSoft-Read-Only.ini
Size 404B
SHA256 b5980cd1122d2ad4727bc06806e3d2a6598b7d67b6eb3d2732938d08c6deedbb
MD5 6a4653f40acaaa13e2b0f60f067ea93f
SHA1 34981baa55ef31ae6b6d5985fdd02798e3bacde2
SHA512 f286472389e50fa51abe03068cc3e1f9d18b19926d84b66b1df28c157cbc70e8de32a8deb7b4096f462605a2bdd4d76f9863c6ca0872703c60d473a3271778ea
TLSH
T15DE02B99808C4B1C7656E6948D715E4F42E1C79C1B98174CCB0BC241E91950DF63A439
MD5 SHA1 SHA512 TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\karticlewebcloudsummary\mui\dist\run.ini
Size 171B
SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
MD5 b30cb271e143eace0f55ea2e562e1e9f
SHA1 9d97dbf24931cfc114384c3f4dbbae21c9e51be5
SHA512 dc593185fa63b458024c3a913c558e5686806154181dea67eec786ada50595c53bab822833ad1e76c9acdf21be3eba50631391b7e575d7f1f6409ceccf966535
TLSH
T1AAC080D4D0256F97DC31C6B5ED54AF1A7560E700251C1EC3D530DC4E9E9696551C805D
MD5 SHA1 SHA512 TLSH

Submit Download

kcoworkdockpanel.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kcoworkdockpanel\mui\es_MX\kcoworkdockpanel.qm
Size 846B
SHA256 8f0de81b05e2ce8a22432406009084933f0cf410e6efb534aafd71699651120c
MD5 6e815f2b93f16067d08e51cdb69b81e4
SHA1 40630f21ec4e2ce47da271f5e379737bef67fad5
SHA512 7e9586a605815f829a2881ae328d4df3cb9600949767cc5c8fb8186cc2243b08d8cec4bd52cff81c728fdb0c8fd7ce1c9d8e52e9fe4139722e99d4be12c6e482
TLSH
T12F01E9D527FD2F19F3F79BB179E652108F3679082931D16F2145A40D05A15505DD0327
MD5 SHA1 SHA512 TLSH

Submit Download

kcoworkdockpanel.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kcoworkdockpanel\mui\vi_VN\kcoworkdockpanel.qm
Size 839B
SHA256 ad5549bf1c748909f191eba6e08caccfb31dbe1a2ce4bfafcb1e41702f40c95f
MD5 3eabae85edf1db8a54d42509c660862c
SHA1 ea6133582aaf7aaf5330142474dec996e527b461
SHA512 05d619228af227bec2d3b33aab044dcaf79b69633c604f81d6456eb10d4420e48024a9a88cd706fb5c00908565347f5e04302f90bc5211d48d99e2aab2feb7d9
TLSH
T16801E29523BD2F19F3F79BB17AEAA2208F3679082932D16F2145A40D05A29508EE0327
MD5 SHA1 SHA512 TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kpdfcorporateglossary\res\dist\index.html
Size 636B
SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
MD5 72cdeca808b16e794ec5b66bd02246bf
SHA1 e75b6c4e084efc8e60c9e4fbe9e9ae02bfbf4132
SHA512 6562ed498bae7f819caa5ebff9ba373b1bbeae3c92befacbc44a72419e6a3aedeee7fe43347d1bf8c46b9c90c8e515181a6dc50c4ad954a640cf6b2520269ed8
TLSH
T1E5F002EA3C25F055CB911EA43DF2F19E245E3AB29DB9DE942AF4513543C03694D0BF48
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kpdfcorporateglossary\res\dist\index.js
Size 2KB
SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
MD5 67dde682d1968824023dd9773f9ec48b
SHA1 81e0a21a7ba2c05193ecc13672a3f537539e0699
SHA512 86bccae3d66df4dd552c12a42d1ed0d57d6cdb7b904caa1f89c874e506fb76412b2df45e3e5f673837cb72aa18b0ab2c1dfb489b1da37068d83d7ccb25d3d8ea
TLSH
T1FD5173C9F79E702209EAE136583F0006E17735596098A1C8B87ED8F16EB555E7077F38
MD5 SHA1 SHA512 TLSH

Submit Download

errPage.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
Size 7KB
SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
MD5 eb3b05c3a3fdef3b0c5c9020756ebb33
SHA1 27c5773e17f9c05f471ccd22db42015561b4e669
SHA512 9a511c6d0aad855448ae45130d7ed031062bb7e6881e68aa2406c7c122220318379c312bc13876599dd7fe88e2beac296adf5bcdc015ef4e0e3f362e76303ab0
SSDEEP 96:9uMJIMzvOcuq4v+nB1W1QjjaKhwc3Rgjfqqm8bm83:9lTgVv+B1W1Q6ywc3RgjfDm8bm83
TLSH
T141F15211D6925216603393B4DFA25719FB260023A3038A38BFECA2558F75C495B93FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicon.ico

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
Size 4KB
SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
MD5 1ba2ae710d927f13d483fd5d1e548c9b
SHA1 c0605efed936ee2600284e6480521d06fa64f872
SHA512 f933cd352eaba92f509b3863353ddfefadfada26a4152ecdc4727d450bbf35e7b10fb3038fe8db340d5c63d74e608c1560ec84d0f6ffc8ccd940c9e0d7533544
SSDEEP 48:i3H5R5hLOR4kt38PduMoglJrd6qTrp9hweFC0+6Ga:ipHFUs4MLBvuyCda
TLSH
T1EE9175DF61C388D9C1B1977F78C449A14F6FD951BA28351F55CF30622E5D75818C1C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kwebpromehelp\run.ini
Size 226B
SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
MD5 abc3a6089b0ea76ffc960fbc9b6e66d1
SHA1 50ad0cb201c13799024de56cf45116cf65ff5569
SHA512 ec1e32b7bed882095b23e049a4e1a86acf0bf993e2f691105ffbd99d93ebf28faad4fbdd645ac1eefa74ede575854a3994c7c6d2bacc6f7a09a1991561b1a44b
TLSH
T157D09700C0B5658AC1254C827CA53DC411085B4B27608E02CCF0C34D508EBECE56B08A
MD5 SHA1 SHA512 TLSH

Submit Download

close-secondary.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
Size 216B
SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
MD5 07306930f7d374663bd13e38ea0e92a1
SHA1 12f877e8ab93d874b55d75eef6747615619dad4f
SHA512 4cc0517ed0b9d665df4db93fb3093067e90f64b34f1d41420ed975b4cec64d4cc0aede64092d79c610c04e1ecd9514a9ef48389d5c157b5bcf698fc33670db98
TLSH
T1D8D0223BB3CC8E1CF9224A22F35A713580AF41C3548942E4D8322032E4011CEB93B6E8
MD5 SHA1 SHA512 TLSH

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
Size 334B
SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
MD5 d36fe6147829a72b42e054a5db27d270
SHA1 80779a8eb37d8bb1d5fcc594576f80dbd61fac98
SHA512 94224816f757241b3a6d19788225378ae070fc62b4620e11e10a033e3be5d9cc858cd9e669cc275b1fa82e57094d0df13a6d9868cf00afaa17cf2ec0193acd74
MD5 SHA1 SHA512

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
Size 327B
SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
MD5 18770de3f96bac1e75e588015024fcf8
SHA1 e6254c054edef68f9c27059efd82eeaa69c863b5
SHA512 fcb76291a73d7f2e30f4266ea8f0dfa2d9e203cf9770fb7ffd73cc1994502992fabd0803224c1e1155c1e4b678b5af0e8b3aec114beb1f02299e8885d5a61d0a
MD5 SHA1 SHA512

Submit Download

element-icons.ttf

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
Size 54KB
SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
MD5 732389ded34cb9c52dd88271f1345af9
SHA1 8058fc55ef8432832d0b3033680c73702562de0f
SHA512 e8971ae48f5287d252f5b0a2d0516091bef0d2febf7d01fd7b435e426d106fea251037439ec42c2937e934b66f38e5eb43d00a213cdf334f482f4a06b1817f9c
SSDEEP 1536:qTIRCXXCwinqtuPM16hD2N3SUjbwaST4DCJe:39GEcgD2njb5ST4h
TLSH
T10A433B32436A9BE7F416047F5C1F55830A9F4F22F53DEA8B83A6192514162FD0864BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

element-icons.woff

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
Size 27KB
SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
MD5 535877f50039c0cb49a6196a5b7517cd
SHA1 0000c4e27d38f9f8bbe4e58b5ce2477e589507a7
SHA512 da269b20f13fb5b0bb4628b75ec29e69bb2d36999e94b61a846cb58db679287a13d0aa38cdf64b2893558d183c4cc5df8da770e5a5b2a3288622cd4bd0e1c87b
SSDEEP 768:gOvv6ExpCVxUtrT6w8ClFd80EjPVerMKBaGXjAlEm:Hvv6xVWewtlFdGjPlkFjAlEm
TLSH
T1B9C2E13197213AE9D9824EF876E498FEF1651402290F390E8696ADB3A98D5C73E16831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
Size 107KB
SHA256 907d1f5ee046fae72b52eaf99508ddb6b48d47b803076db0e9a86b0e21a54ba9
MD5 0ad676312c51d1b96bd08f056ab33496
SHA1 270438a06781cb68c376bc18c42437dd5ce262da
SHA512 6a6883f9fa0a1f768bf985340dc6cb4651e5ce691066c9597126ba1fc62b2a45a2eee52a1d8452faec885bbd3358be3fb04a15fbfca0302feaa1adc2c81130c3
SSDEEP 3072:KazzQ51KYGqMkYUl26MeCAAcdl6y7tqWD:mME/euD
TLSH
T15CB31B37214D132D343BDAA2E55D659960C8F61BC00253F9FA247B1DCA837873A7A3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
Size 279KB
SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
MD5 a3964e72421a1ef5fb60c6e17eb5d705
SHA1 5dd9584be5141e884a230c48746e1c88126b0a55
SHA512 4ce4119b7407b460969041809354c4ede587047ee643f2897eb0ecb9627608431f43fed27c54c70bacff3a6694eb32a85b535c7d6397ac22d7d28e260b0a5467
SSDEEP 1536:39eSBQG+dyAUlHj/8D0Q+SPxZztR+LCrwHFfyqHYb3PPV7BYUOf0I79lDxiRSL2Q:3zfZYKVxiW
TLSH
T14054B6229140212E702BDE3DF7C4EA4AE225C6B3C4125BFEF953651DC7C36AA117778A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
Size 380KB
SHA256 fd9dcbe72da3477714bf68b8987db4718e4be32f313d09bfefbd4d78aa051a84
MD5 64ac5333133e48efc94a0f579e10878f
SHA1 ca547d97d85fa913f48aabcbb23a227c6a2e6bad
SHA512 be9be830f1a3149b238b7363cb6aac08281d244825f4c0ebdd69e31daaf05562555a46484af78de442b7deb3ca71b8a8698331e617b433a0f86cf39e2668576f
SSDEEP 6144:qpK457wXrkaY0TbOXsEYlHBBs6Ve5NtXoqIpgznl87A6v0eX4AiDuViQbgQgILTV:x4B0WtYlmiLlTj8QmIqUrNBqq
TLSH
T1DE846C4B758BBB5A1F35B66340DF3C88D01C6EC09812A5C9FABDD9D09144B9A32D63BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
Size 249KB
SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
MD5 6351ea268f992f52e0f4418a7028b91d
SHA1 5bb3cb88465c550a1fd033a079a8b2eba5e071b8
SHA512 44940d07abfdee6403e9400e596ac5e5eb234ba77a1c90c2fe4086878c12f4805c709eb84538071f21d5710d3569d342e7caea10061e2ab2661c5117c5966297
SSDEEP 3072:p+Xy2rHhkiTtcsuaIwK3zqDLW/ix3Iu7doNFBWgz/bwUzxqcG7gLEOhA:phKHhklsi3zpCdoNFBHz/bwAfG7cW
TLSH
T10A44F8CDB2D1B0A517EB61B4813F610BF27B6499B44E80D0E226E5D4BC7998E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
Size 424KB
SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
MD5 cf29fba214e7f43f2ca1b629109d126b
SHA1 d0dda9486528586af6943abe7a3afa319c790f25
SHA512 2ad7e4711f5917b8d13f861d4fb2688e6ce3951da43a89263a2d9743199e173429398ec1a9537b1df25593d3999dd34fb590e2d2a6e7a632ccc44265d93c3bca
SSDEEP 6144:z8KzCOcC0CXWsJvRekr0dgei/zJbBoCF7az2bzNM:zbzCODTWsJvRbw6zJbBfaz2bC
TLSH
T13694198DB2C1B0A517EB60B4913F610BF23B6469B44E80D4F266E5E57C7898E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
Size 10KB
SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
MD5 0f4634d4af8b73f882440c1181697d86
SHA1 748bb9a14c8a6c64fa060ddcb1b4baebfb3f6fd3
SHA512 eeff081cb256a44ff4557dae145c3d277ad936fef58674cb7d2949b6c302c3a746f05495daa6ccabf39c26bacf13c6fee3bab20de4f1d13810be0503787c89d5
SSDEEP 192:cyxPpQcKb2d4U1nE92Ui6OPl20b3G0qE7I2ByobYGeBv+x9qkgYbeO:zzFZr6OddG0q/yTh3UYx
TLSH
T1AC32C887B30483755A90E790F6C76DA5A93ED0EE73A4168A3CEE421812581DEB3E7CC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
Size 13KB
SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
MD5 dd59d31e84434c59c5c3735bd0b0dc3b
SHA1 c34473850d3749aae725856f68a262a0afebee00
SHA512 f3acd51920f945b49dceb56fd2a5a4ff170c4a5770665bef3d888f8497a288dc33bd15f24780cbe9b8ced585fbacb92a8700d1322a6d4acd2b6e5893370822ac
SSDEEP 192:GwSuCUHXDhEblYfhQ9GYSOqUr9b1AARAU0qWo3wYXVMojXiyaH:dCaXDhEK55YmUrLAgkqWo3RVhpQ
TLSH
T140523295F3C50E22B4991749BA03D57BF19558FAFC2CC18D5CF2D236136C9C986928C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
Size 14KB
SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
MD5 5cee0947c1ef6f00e18eb17cf77388af
SHA1 5a27bc625acfb46d2368a9a376d797ecab912a3a
SHA512 1bf91f08d2a2a446ef0e22df40fd09b090fa300f599bacdd5c698aa61a6fef12ad3d3e38299804a016e5a22a82ddfeb6840cdc7a79ea51244942cb22e659331e
SSDEEP 384:HTO1ksU66rAJGO+NedvSGdv+GfBgLj95LKn:zO1ksU66rAJG5NedKGdv+GfyLj2n
TLSH
T11D6230ACC3CD5C69C86183FA090B35C27836ED49FEA5AE7280EDF4202DA19DFD815674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apm-init.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
Size 57B
SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
MD5 b684f2b8022aaa97ede28f9d224c4db5
SHA1 2087206ddbfd6d6d71f843a132b58ed533d87169
SHA512 8d30da66bfdd99dab88c4b9766b692c39ecbc8dd725e9f858c95993d4f2bf46c37891a1f8f4f1eb6fe09bed7008b8df48d2a9b4f10d7caf20f823f121f6ebb40
TLSH
T19F9002E7F0A1707344616959630722AA35D11130017430010900487434A580FCD22F88
MD5 SHA1 SHA512 TLSH

Submit Download

default_ava.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
Size 906B
SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
MD5 c47a5cfed147c402538358294808e68a
SHA1 8aa499336bc4a50a70710735b67fc5da923fc61a
SHA512 a71831abb9393b6c0ad62feb29fefbb192e1706b08ab88dec0a8e6a9cf61b6a7e106454a7e6e518f69425cc91846036e8fe2956ea939625678f17b330860ba1b
TLSH
T15311E309934DC285960AD7B8563C1754347272DF9E1FD55CE7E633012D3C6AF185C27A
MD5 SHA1 SHA512 TLSH

Submit Download

desk-sync.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
Size 1KB
SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
MD5 c17417f321f52624ee0dc60ed76a31b6
SHA1 b64e19a5b03c92a931fa9a1eba899f491e669a1e
SHA512 bf160829598cf0b22ea48a5f7310adfbd26fbc1bbf23ea3cb8d9cebbeb92b5e81b914bd6021cd41df5984ef00698acb1c1151e134c714e0a1be7dcd439c78485
TLSH
T16D21F0ED57EE35C8644CD37028DA6079627B35F43969EF048914A9D1FE4205D499F9C0
MD5 SHA1 SHA512 TLSH

Submit Download

loading.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
Size 1KB
SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
MD5 0620393a949b58f6af37b0accb79e32c
SHA1 0025e4da5ffb8695a8f9731a05b1b89f1a71bf24
SHA512 0d308c758f825d548874cf8b4b8ec20f3685b39c7232246697dd95e5e5f40da7cd21de7ba5faafd0d8a121b5e6b85c5aadc4232e3f0c943535e062ae449ef29e
TLSH
T1333142D111BD0116E11AC365D7FD7AC70B3EB4DB26E558BCB68C250FAB404DB0A9B219
MD5 SHA1 SHA512 TLSH

Submit Download

setup.cfg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\cfgs\setup.cfg
Size 449B
SHA256 81b8cc8d1affd6d91a8ffec9810868a1200e4c4d9586383c7a89d4c4755b0e7b
MD5 f937b461d307be2aeb5b2a2d1470efdd
SHA1 146dd26c540b9a2a0b05aabb6a46f44c8f5756b9
SHA512 ee93ee2ebf2a0097df6225e8310d758c20d37fea3e8de97860cb8004fae8846a05f48c04a58d1be068b1e31d7a38493c48ed9b16a5953b5f0615a5b6f95c243a
TLSH
T14DF0556A0303B0751E61930014BA14F2A3F702C9101B840D6568A88D6B7D83D96BF13A
MD5 SHA1 SHA512 TLSH

Submit Download

kdesign.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kdesign.dll
Size 1.3MB
SHA256 ffcf491a7a575ef1a9a34bd74348ba724ac0a7bdd386c0c33f4c6c0c4584e9c6
MD5 0661682c4d4d11b8dab260a393d9d0df
SHA1 1d550a19fef05e96881217330d9cb721d3f08b1a
SHA512 d8880d9055d7f5168919bed73995d5c3907835ea5be9ec4138dff107188a1a0f13715a4f9c9378ad1cc1923d5a03384533155bac9a0a5d1f3e40d9d927e5f247
SSDEEP 24576:9ad+LLBqr9f6uZKIZ2yzqBsbUfT+vXWP9ZbD:woLLU9f6uZDFzSsbkOGP/D
TLSH
T1B2555C1BEB5643A6C0EAD236C9CB4515E1F2B842C1A38317759EEF293F633225D5E381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krt.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\krt.dll
Size 1.3MB
SHA256 147a0720be09be772ee513e958849d73f8dede61e077c9cd13b27f3e353b2c8a
MD5 245649a913ad26c33bea9d1c373da54a
SHA1 3da509261cdb5cf373cba2e421626c5ad36f36d8
SHA512 3c9b4cc436edaa6c62a2517dc8b95264bb629862b923e093c356a3cb7359ad3faf3c0a60fd6b78651fe87d1c55b853ab102b95db9ad770afc981107a8beeb895
SSDEEP 24576:4Ujsa/M4CJImdtunCsfCk4WIIeVMXn8QcO5a68S/23J:fjs34/meKbWIIe88QcO5L8S/23J
TLSH
T1DD558E1BF76943A8E2BAD17CCA4B4906E2F1780143619BEB16A05B2E6F377D14B7D340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kshell.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kshell.dll
Size 27.1MB
SHA256 010bbd735adc686c5fa2a5575d8fff97056c8f7d4c3739be994e22f43ecfde55
MD5 6c0f62c41a15e981d541d423801ff0e1
SHA1 efd57198279d12b4b880c0e2663901b96cbb843e
SHA512 f325efd1b4a8929679c5c22b0ec70fb0b0dec1cb690e9ad240c5008341518b2602bd4c473948047ea93fd7ed689da37651cf3f378fcf21c1ba84da3bf29a565f
SSDEEP 196608:Q13A8lKRuJJ3pgbn8B98pfCXucdM8b4A2V9A:qtlK0/3pgb8B9Nhb4AW9A
TLSH
T133575A5FB6A942A7D165D138CA574906DBB138018312E7EF1169EFAAEF333E0583F640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksolite.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksolite.dll
Size 11.6MB
SHA256 bab2dd2ec926b20337f6bbb8d8f8455696c83d34c881bff8e650336281610f42
MD5 38968d6db33b8e4a9db658fe249e5a93
SHA1 901e3b5d26eb32d0520718dfd1c22c5bb266ba73
SHA512 4f8a7e562eed15650a5c6ad9e68a3d5dc086c36a606b69352ab39d1bdcacd3e729143e02867aab9cd3d244d93214440a60ce8e460bf07adc4ffb2b245e267848
SSDEEP 49152:Mhrc34y4R2QspEwNBBY2R2OvT/KXPLQ+qrJJuZhmSyif1LKig1Npngmzscx1HO41:x9f4LWBHMO1r0LSSsiG/bS047IuBVI
TLSH
T114C67C9FB7AA03E9D16AC138CE9B8902F1717442832197DB22599F791F333E1297E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksomisc.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
Size 3.7MB
SHA256 a1839da0804ad31b5e262afc44f77617b0c710b9de7550e5d0039c65f8541e15
MD5 fb4d6e0358badf9205f1d90cd2449312
SHA1 e7ae07235fa1b8994dd6ff3a935c930be533cdba
SHA512 4f8682fb0dabfb75ddbb81eb73ab5d167c81c5acdb9d5be685a6ad7af46d667bbaf5415c09234c0da5cf8c5d65299904a9d7272e27b155b6a0db239db646e0a5
SSDEEP 49152:fBh/6nZ+48AYsFpavN3mCNQJFNIvOL5IfnqJPqpP/j5BzJ0nkgNp+ejE6UiorgNs:aZ+40b2lFWNg3DKg6
TLSH
T1DA067C5BA2E603ECE176D238CB965903F2B638054731AADB11509E750F77BF14EBAB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-kso-1_1-x64.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\libcrypto-kso-1_1-x64.dll
Size 3.4MB
SHA256 09d8cfa187a21c7172736889c41b47d87955c27721939e7c4e0d9bc24a1d8783
MD5 53b7a908a1ac6aad4f24bae1ca3cf524
SHA1 b034c2efd3e334958ece27bcf835b5cf299ac07e
SHA512 fb3a73d68bee1ff3932ef58667514a345e9c4727b360f47da4003c7231354ae3fcb92e9dea7580d8b6f4de3dc476089b380778d2926867edca0281750f73aced
SSDEEP 49152:DOVwASOXFIU6idBGtlqXWq7TsRQuXk0AkOGYYNEhvla9+LEcJQNPn/zsqocj1CPu:6C+Zsu0h9gEx1/zs+1CPwDv3uFHUB
TLSH
T11AF58D5AA7A80184E5BAC13CC55B4737E3F2B95A17B09BCF18A1C1780F23BD66A3D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

error-net-72.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
Size 1KB
SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
MD5 66726a0fbd424ccb700cecb212a47007
SHA1 9795ae26acf0b942ab6a0cd06f206ba69eda18db
SHA512 30ddd2fa17517792a86bdb03827a0809ed362ab2dbd9a7baf194d1f47348c96e0ca8e64515c1a58d7a1740e85f53a3676b49ff6c699d598a27c234c14672604f
TLSH
T1E031C6CD318AC42FCC61D531F4D534156817D760BF928C74102BC5576E0F68E58C6662
MD5 SHA1 SHA512 TLSH

Submit Download

presetLayout_16.pptx

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
Size 41KB
SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
MD5 f41e909b0284949bdd3bea9393a6ff2f
SHA1 a41497f65f44368ad517f464eb0da4403aa700c0
SHA512 d800b9b807a72d19f17bf5bb923d2489328b2f8801c2146b0c67d3d4cd8c70d5f22decd6581ad14d5584f3895140180c8578ede4fa8df755ca742c18cbb3b67b
SSDEEP 768:lwQ75cI1zETv/7H0vFtZKSZTRomseFVEFqG5IphchDB8h/rW7oELmG1wvcG7GyGK:9qNTn81Romse8Fl5ahcVChjQmG1/sl+Q
TLSH
T114139F61D40A142FC263B3F6E478164F73FEE86248179797ACD51096282F97C2E9D38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpscloudsvr.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscloudsvr.exe
Size 1.1MB
SHA256 5d2b4a3bedf86b4c58fcdbca99481f83d1dec309923c26794c1b4d9f8761d470
MD5 6de670809dfec697a1d81bc95e2f1f88
SHA1 5cb938fb5bd11b9362ccfb79ff90617347b63c48
SHA512 bb1e2f2900efbc49d6740fec7200ae791b363e2d9f557d3598e633228d494b04cfbc42e5f2be64c2bef151425ab98036cd15761c8c0983c7b84b2358d49c59ad
SSDEEP 24576:H8nt81URGMadAm1IY5FnzhXKMvPuhBy/RZLZ/2g5e:HEv8h1IYn9u/IZL0n
TLSH
T16C355B4AA2B903FDE0BBD1798D525901E2B63C4607705BCF079027771F6BAE59E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpsoffice.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpsoffice.exe
Size 1.2MB
SHA256 79654a15c88175633251bac8348fdd2181d017d3ecb2bb102e6b979f76a43b05
MD5 264a5b1f0e03c3df23a95323799be7af
SHA1 0bf4d939b2f4859516e1b2425bfad0850c156315
SHA512 c3755ec20d9419fdbc1cb74c39c2a3b509750b4009a78fd8cc06fd51477b1adc6bd25c2a9044ccfcb16a148e0818d922728d2cc57a1d884c00895dbd019296d8
SSDEEP 24576:8U11+u1i0WQTg/3U1pUbiDgahMmILyxl18a8B3WsBQ:8gF1nfak8biDgzmIL+1sBmz
TLSH
T1535519366EAB02ECD3ABD27876525901EEB53C4AC7345ACB02D035763E77AD18E39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\utility\install.ini
Size 462B
SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
MD5 71e0a7ecd6bd2e91c04a3edf760c45d7
SHA1 e6cf872ce6def16bca98818ba289395580701292
SHA512 282b4c8be6abb97383d7dda8258fbf069fd668f4fad722582567cbc916b5c7da9a39a157a35511210306c19e46ef34c02af17f2af1ec7707bb3d84f3d529c3ca
TLSH
T178F097090C98C66E36282188B0D3C2C0A9ABCE260D0CE410E2D36E1BFC02E0A217E02D
MD5 SHA1 SHA512 TLSH

Submit Download

Qt5CoreKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\CONTROL\office6\Qt5CoreKso.dll
Size 5.7MB
SHA256 cc232fce14f26b48e69205eadbd75d9c480c328dbe64b5ca72b9e5b0711bebc1
MD5 4e5fc0eeffc8d896821a5eac25e3efc1
SHA1 ff34a8082ce57c7bcdd262bac64a75ba172d9025
SHA512 2f6fa4419b644e1a91c810cb95397876163146d678a43fa9180000eedd1f7fd65d569ba4ec5e5756887e792d5dfa432368a5f97c3c39db7d68ca2965ee215849
SSDEEP 98304:Gk8b4Ur34vRrxAzJsv6tWKFdu9Cuijl4rjscak:Gkk4Ur3KRrsJsv6tWKFdu9CuFjscak
TLSH
T1A8567C47FA964269D8B6C238C9D7C127F673B80247214BCF2258A3496A777F0293F359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5GuiKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\CONTROL\office6\Qt5GuiKso.dll
Size 6.4MB
SHA256 0b577ba30dcced8f1d2ea41e21dc26095c372559999a31f92a0a7ab40cc3dec3
MD5 0412f9130425124c3e78e02afdb824b6
SHA1 a292d9f002f35bcae6fecdb16c0b2c73c2b397d0
SHA512 6cc66c82838b33f9bbbbd9ca81177b381bc2e6de13ff7769c5806dd37ad9d6d2b8817c6c42cfd8b99551f58518941bc2012688f12d2c5e4169621f1b3576f513
SSDEEP 49152:64U5Sj1tbrol2fO0hvF8qZijURpWPY5zKcjh3ZdvSfVk/OiMS8yNTIoCinHCBF8w:lU50LJPEhFzAyinHi8Iw5KIjFC
TLSH
T11C66F886EA556359C972D17987CB042FE1F37C4283524BC36D05AB490E237EA1B7FE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5SvgKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\CONTROL\office6\Qt5SvgKso.dll
Size 503KB
SHA256 e879d108fc57815f07dbebf4a94114ab46d41ae1058aae7368ef0f575c7f7b5e
MD5 62627c3e5079202b7df7630715782dac
SHA1 16520812abfc6e7122edc56d696ad20501ab6e6d
SHA512 06f38f8cf42007f85dadb31295648b171bea6efe9842dc5542c37cb2ba20774b27054bda77172ac93a29582f82a671b88be0e50f19423a5f20bbfe209ce09ad4
SSDEEP 12288:9YYYJUNY675fyplktpscRVLEgZ/ABXH9a/vngheZL/XEnEsrnJpaymesGrx1/9k2:9YYY475feysAMZ
TLSH
T1F2B44993FB520798D526D27CC8978806F273340443A39BDF2A5AEB651F236E1763E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WidgetsKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\CONTROL\office6\Qt5WidgetsKso.dll
Size 5.6MB
SHA256 558f41cd447c3e2a25f3823ca5bc9f06142044acb05e6877486d9ad1c85ffc60
MD5 e9057c32520d6dea52d843a3b57e363d
SHA1 cc1560fb2dbc1f0aa729684815c8b1b86f920619
SHA512 5cc69a8d19601bb1b70ec2712e632cfb2fce7c73b7ddcdc79c31b9d353ed7d28c41d43f01d95bd5cca71d6f05cc6473ef2f57393cf37dc0aea35a2e52b4b8c89
SSDEEP 49152:FI0BMMlWiL+bXRedujCAmA8Nv7QURjY9v2RrWuyzgaWt87S15Gc7sRujL71aeeA2:Nln9AK2CjL71aeeA/VytCsJ4SRQQ
TLSH
T1AD466C47FBA50389C16BD13CCACB8513E2B2780447634BCB6969DB691F637E2197E780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WinExtrasKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\CONTROL\office6\Qt5WinExtrasKso.dll
Size 251KB
SHA256 8d4e3c1a0e767477432e276cd064e74cb13fbc4114ecf59dd1df3918089ac42d
MD5 f87a8bec3aee9aeef384117af515e7fd
SHA1 3cea1c99b366e2fa91397f1c8dc1561c07a0d4fe
SHA512 3fdbca6d0a8d34ad136ffb8aa4575d3261792f732755a316b62578721fd80084799daf4b28c555e7ea7c5dfa329f96c98612805ea14f6807c5dead803e3cbd93
SSDEEP 3072:OF5o5cKUM7YLBwcJf1+6Ws2G0+xvN80Zcl2:OfpMWxvN8a
TLSH
T1E3449684B6DD9619F809B0B88FCCD199C223BAED8B47425F351EC39F4B619816E139F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kpacketui.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\CONTROL\office6\kpacketui.dll
Size 870KB
SHA256 9b8b1ffaf8e441f6c7da585141da83eb2ae063d07fcae103843b2f72099171fd
MD5 a504037daac67ccdcf81ef60ac000050
SHA1 6b00e649f10ff3bc4201101dc044b9b287bdcae5
SHA512 f8f5a7e96e5a2505c8dcc28a4f3997660a8962a4c3bebb18484bfe77f9908289f814528f83efc872566a80ad24c870b7fb92ee69866b9a56c34a5e8edd12d91a
SSDEEP 12288:W8gvLWQhG7weQDo043HVoIXP1O66oy9TcPuwg1ZkE9F:W8gvLWl7uDxmHVHXYpFJcjO
TLSH
T100155B0FABA503B9E43AD17AC9C78813E072780643A64BEB5985EE753F733F15939250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\CONTROL\office6\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
Size 75KB
SHA256 4038b28981414c886b556c8e11e4045d4a8dcacd1ee762941c4c189129b7fa96
MD5 d8f45ea53c3d85fd7b747f61e9bbb3f5
SHA1 dc67e10e52ffc8f2da7bf3e99bec97cc9f49abd2
SHA512 671868f4a8d9635e2f22a64470b2d98cf4192596369993b7c92093d0cc16609ca965acda67d89f81551ff31472c995df21f150e1d5e8277cbdb9861d773877ba
SSDEEP 768:mXOzQ/DBnTQxkUtwZfVKFkYQJc10qTwr6NBv9ZpZSac6mWWriYiDLk5C7uHYyYit:pjf8Jewr6NBV9Sac0+i7beYy77zN
TLSH
T180736B93DB841699E51A8634CAD58A27E6B27842079293CF6728E3680F733D2397D3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
Size 46KB
SHA256 f89f816cc55e3219b33787ff34921e5848c4a1625497e30825e1d9cfafb98285
MD5 c74ca8abac13936f56264ecc9729edbf
SHA1 c0a5b5b058f9a00d965dfb711b7d4a688042a5f8
SHA512 381424130d76319f50211d0afe831b29cfaddb094bd939647f24e62a6da734a6081d9b5c96df306860b38a49f787b0d3c9aa1ef20527887e544d03fdf6cc2bbe
SSDEEP 768:K/6pbQ2EGQ9eLbX8UK5YiDLk5C7kXR6UYi77p5ALepY:vQ2T1bX8UK57boR6U770
TLSH
T170237B97CF240809E9279B70B4C58A26F972B8515B9283CF3194D2694F963C23DBD3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qskia.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\CONTROL\office6\qt\plugins\platforms\qskia.dll
Size 1.9MB
SHA256 fb9bbb486da8b22248f5235fed71455913b3a237701c43847910034697b75ae9
MD5 53fe4fc91784195701052ccbb5387f7d
SHA1 5558a394f17e646ec9c339df2fd2ec4b49fb134d
SHA512 655cdd2337d547752b5b096cf55bb31191621d9121cec8ee772a7ca490417a0b40478edd2aa65b0a5d093ea8fb9f76b41df4c3991c56bee9f4359c6b10008c35
SSDEEP 49152:zzM/0VBq/JvWW/VQBNYbI6YzexqaHLMmQN7k82a66kTc2Hh2:4/xW/m0
TLSH
T153957D43E3B44298C2A7C13D869B9F0BE6B1740543629BDB2261CF59EF237D21A7E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\CONTROL\office6\qt\plugins\platforms\qwindows.dll
Size 1.6MB
SHA256 b0f0847499ecaa2d88cf6675acf0b000ac619a2cc6ecfb6bc31da796d3e76e5f
MD5 9477a15f22f28a43f8e5c96ae0e12d01
SHA1 efa713bfbbf8bb18803fc580f12bc90429a06bb1
SHA512 bd0bf2104c8737330d17903a1b0761c2e17347b96e2703987a778035aace5a7d290d02ff69ac609b509c0b68ffdf7d64089e2d86e8e5ca06f4dcf4e370ccf400
SSDEEP 24576:PkGAzEn7Kn2eozTuqTttIrHhbR2gkNVDosZZ1MFaaVH:Pozu7Kn2xzTuYarHh9cVRMbVH
TLSH
T183756B43E3A44398C16BC239C68B9A07E77174050361ABDF25A09F59EF63BE3177A781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
Size 159KB
SHA256 cf4257b456d0954611ee0d3937aedbb696a367fda2e12aa81e9db8bdce2a974a
MD5 434dde614096fe3d3526613712f1c6bf
SHA1 691c105d651afe39b8d7ea655c54cd5c49a33cfc
SHA512 2eba00e48795410fb6e24c3ecb1ef636d56d6e2a93e7f917aa5b955a97a24c7eb5bc262cf39fd9cf98038130df01eee6e7668f9354c16506ce3a492dab3958ff
SSDEEP 3072:TSApjXbrT36b96bavsTHnbNgJURjbgSWYhEIcI2oj0Nx:7X6b96bavqHnbNpRWYhEIcn
TLSH
T1EDF33913F65143DAC527D2B8C18A0512F3B37444436257AF25A6DBB82F533A2BD7EAC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\CONTROL\office6\ucrtbase.dll
Size 987KB
SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
MD5 61eb0ad4c285b60732353a0cb5c9b2ab
SHA1 21a1bea01f6ca7e9828a522c696853706d0a457b
SHA512 44cd871f48b5193abb3b9664dbea8cdad19e72c47b6967c685cf1cc803bc9abb48a8a93009c972ef4936e7f78e3c92110828790aa0a9d26b80e6a523bbcd830d
SSDEEP 24576:xOPJ1g7mT6BNvwTOxNfoYotrz1111111r8SoKxmxvSZX0ypdNLh:xO1aNoaxNfo/+a
TLSH
T18D259E64F75C0AA6C17BE17CC95B550ED972340647608ACF03EA8BB97E2BBE91637310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\CONTROL\office6\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\CONTROL\office6\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\CONTROL\pl_PL\style.xml
Size 3KB
SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
MD5 034f37e6536c1430d55f64168b7e9f05
SHA1 dd08c0ef0d086dfbe59797990a74dab14fc850e2
SHA512 0e1911c882152a4e1059a3ce1880d7fb2aed1e1e36cbd37055de2e2a1333acb2a0233ba2a4d969ccebbef1e77809aa5e78807aa9239545beae8c548c0f8f35c0
TLSH
T1E381CA80A610BD0AC563F51573AB7509762CB36383ECCFC4F0EE2E698753652644B63E
MD5 SHA1 SHA512 TLSH

Submit Download

product.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\CONTROL\product.dat
Size 97KB
SHA256 2e844013324b6d0b45e0f68706c289221de46dcb231c45a52cdbfce80bcac54c
MD5 fae72737598e680d5e8ca1b737714b80
SHA1 40043206cfaa2f8dd7e05becb512c94456dc0bcb
SHA512 60fff6d93e507e9d534f185372d09fc1682e57f718f9369d9f5bf572c6880255672ee5cd44c0d7a79b5b778bca354457761e53730c7b79e7c146e454b582fe9e
SSDEEP 1536:1yKvOpT+qaZnhBgrtZE6JjPHUAvSVxel50kydpgnoz:1ybT+rZhBghu6JjvUAKV00kydmnoz
TLSH
T141A37EFB7E1D6BE49CCE233E5E37281CE5F9482525966448E282E5A5AC1C0B73CD790C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product_new.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\CONTROL\product_new.dat
Size 85KB
SHA256 91f7b5037c07e9e6f555e6ca8a1ab34674cce9726f90186364e6d6f89b64a10a
MD5 8cc80027576ea7e10d9274727fce083d
SHA1 ddb16e0fd455ddd8a675aa836533f7e8970079a5
SHA512 35cb8396e9b41d4f90048a89d22a336648a8b05fe2a198894933b07c15d0096feac243bb71a18b6f910a42804b48c19d6773b07722801b1bf6f54e75a30bd4b4
SSDEEP 1536:I3CcyHhFmpUeHipzjsrp4DYDp3Ak3W7th3/h1CCQgKBXskeUzEy74n:2GHDJvIrP19kh5EyKBc9n
TLSH
T1A7832C19DCD16EAD685052791D376C8227B7DDA1A0DD30AC4B12AA4CFC3CF887F72A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2387\CONTROL\vi_VN\style.xml
Size 4KB
SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
MD5 394488b30107bcebb84a97ed5d754cee
SHA1 69ebe17f7d577e9bf69c87cff45c3251f0bbc86e
SHA512 24a6bc7debbf7030c1261c69cb4ae7bf3cbb5c7fac315188163c6001e58dfbe2e634925cb767044da7ea0e6d08c709b2ade02f6e43930819e1bef6f7569cad5a
SSDEEP 96:gd6SmSZcFe9gSs8TcySCSi58VS5eQJ/gQkgQ0/Mw8CclQgYzdr/PwiCSeDeR3ciw:gdAh8Ax
TLSH
T13FA17780A610BD0AC563A51977AB7909B62C736383ECCFC4F0EE3E658753692644B63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 387B
SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
MD5 c38481658f9149eba0b9b8fcbcb16708
SHA1 f16a40af74c0a04a331f7833251e3958d033d4da
SHA512 8f98d62f88442b8ef94aa10074e35aa8d9494f3c76ce8b143ca0bf7fa0d917f3175212fbcd6e7b0597fd0ec0e1b2827f157135512fb01c88218d36e2f7dd73ce
TLSH
T1D4E09B1BA8D1B0ABDEB302E988979D54BAC03D9A066D23147762540D3D32918FB41D65
MD5 SHA1 SHA512 TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 433B
SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
MD5 a9519168ca6299588edf9bd39c10828a
SHA1 9f0635e39d50d15af39f5e2c52ad240a428b5636
SHA512 0607eb1f5598320961fbd8ef75beeb1b6dc1af3cae7eeb5ba352f3e2a2edb25e1d9e68fb46c24e4299957352c0c906314c889c2d1092437eccc1d1a0485f3557
TLSH
T194E0540FA891B0679D7302F488E39C007AC03E96055D1210773144093C32A14FB81D69
MD5 SHA1 SHA512 TLSH

Submit Download

ksomisc_2026_10_01.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_10_01.log
Size 3KB
SHA256 9b87438b733bcc27ff9892c00cfe34286185254d4d9a391eb45bf7e2df3a467a
MD5 e3fa3e3aadd17f7a2d0f2cf4591ec166
SHA1 b3c3fa6730b231c208dfc1e76269b7b36e35e550
SHA512 d9a8bc3d4e5e035c4fd5be42167981bf7ebf82b3bf6c167e41e4bac4695db87c429fc179ac6e9ad3f24defb7f6e1ef34b85133bc02e4eb07bfa36f8556a532b5
TLSH
T13761A2657AF94104F3F74F86ACFA44A34E76BC82AC20D84A1954330E48B6F91EC7173A
MD5 SHA1 SHA512 TLSH

Submit Download

ksomisc_2026_10_01.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_10_01.log
Size 5KB
SHA256 f031dd839f991bd2ac1fb44a49ee15a988d09e9c72bae1c5fd7ef27e7e2a4135
MD5 179b09e33203d2c88803d1fdcaaf05cd
SHA1 49b8ecd459af9513b5bdcdd103aef2ade90d0d7b
SHA512 01afb73a16db58adf69a830b037382dc44514590d13ca1e5777a08a1a6a09a0983009650bc9ba1a37ed91b7d1795be462a5ec86a88d2d2831f9d931052d6340d
SSDEEP 96:+P6qYo8siWqYH6si+HxYH6vvsi+H4YH6si+HcYHVN8si+HancpsiW7K99siolnPV:oRYDsaWuavvWdaWBn8Ws4hgdRYUiV3RE
TLSH
T1CEC172657AF94145F3F74F86ACFA44634E7ABC82AC30DC4A1955230948B6E90ED7073A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 897B
SHA256 781f76e0d06d91469e3e2bbae5f2ae71a46262a4a1ede967ab69972e6b705902
MD5 dd8e36b7bc1d6a643e55d66a812b963a
SHA1 4b19578c15312b707eeed965f8a8eac114d08b5f
SHA512 79c49c8cce964928b5ae05f58c8437f036aa037b769eb8882ace5f9e26cc7ca750782eee539ad716df774d0b79641df5b954c36036fa46f7da1206b8b306f26c
TLSH
T1CE110A530096C01542EE478AD23AEE64705F5AB34C5C177C7FA8C3862CCCD5A9D1EC55
MD5 SHA1 SHA512 TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 10KB
SHA256 3880d1c2d2a35af4f237c0fc6625d9beae5e0290a62cac5fca4990f3e824ae38
MD5 c37c7c0d8f067e34f79573a5053f8917
SHA1 ada73b61c5a540f9b4864f589e403a2104d2222c
SHA512 272687d77a99e0525248cef23c5fe12114bcd3b769ca2937214bb006eacf0c1fe225d108c7c09513252d81c2bd8bf0309528da98dbc54fe0968d4bed01d05cb7
SSDEEP 192:RV6yQSL9JaY2BQDbSzqXq8ceRLAvYwEHgkiI7rBA+9/FmaekCT/:DFyWm7
TLSH
T17E22BAA7449E811C07FE4B7993A2DD0839BA69EA6F4022943FB6DFD75ECF020415F918
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 10KB
SHA256 fd065ed740538db85e19441c8572583d294571c2d9493adc7dfb0aac454b2cfc
MD5 c6b051ec8dda859bd5a9e2748a918403
SHA1 b31a9b1db756e2a8b16812c7221439ba37d26193
SHA512 b417892d49daac4f3a1a4a6cc03470780cf5ca77056ce7b63c2836111fb0c75ae105eb35382784235aa95d8ba236c5ce3600a322ed4a5879c32596f25a87f66a
SSDEEP 192:RV6yQSL9JaY2BQDbSzqXq8ceRLAvYwEHgkiI7rBA+9/FmaekCTPUAlz:DFyWmbBz
TLSH
T1D132DEA7045E811807FE0B6993A2DD0835BE69EA6F4022983FB7CFD75ECE421455F918
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 27KB
SHA256 3419d864fa0b8fbb9b2e68c21bb803ba287741bd19dd5b50d77f69f92adacc1e
MD5 23a37feee973d31c1c4741dae018094b
SHA1 eb3b3e8f971df6a6432fd4c3d53c482c0662806c
SHA512 74fae63acbf0e0f96e12183aee9b25bb29a978b29516edfe04e2cc0fdc7e15ba0221cf9413b71ba628f9833a3d3a633d3d47c297e7a9b0d0535b4c0738759d7e
SSDEEP 192:RV6yQSL9JaY2BQDbSzqXq8ceRLAvYwEHgkiI7rBA+9/FmaekCTPUAlkqyUVF8Xn3:DFyWmbBKlZlT
TLSH
T197C259970129C00006EE97D283B5CD1D30AF667AAF4822553FF6DBE65E9EE11C6ECD18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 60KB
SHA256 3e2ad9d282f91676f5f5854915b390d640147e3cba84d5753aec9c6e4e9cad48
MD5 a8aaedca7f93a222d9f22eee411c9ddc
SHA1 8142a30cce670a5466f4345556a419f00ef2ba1a
SHA512 68888215d1649c5660579d1a3d5feeb4d534d1b1f6114d2339d3e6ed4baa2a884608672d7728302845bc94e57393ead4af6efd129b2a5cf9e4d44d06410ae30e
SSDEEP 192:RV6yQSL9JaY2BQDbSzqXq8ceRLAvYwEHgkiI7rBA+9/FmaekCTPUAlkqyUVF8XnA:DFyWmbBKlZl4oKd9RaZlABuI8Ha6a
TLSH
T1A053E2970C19C01057FEC7C182A6CE09306FA57A6E181B693FFBD6D26E8D9028DEDD58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 67KB
SHA256 36b4c941c72e75ef4e151a703713c01fcb799e974b6dc971d741ef0c11457461
MD5 833ce28c0d4bcf56f7415b89ed219c81
SHA1 9b32d708c9d1fe6c9da803ba4b5c65213ffd7adf
SHA512 6de6c3ce35c38a05e5852228bf25aa05b59abcf31cf595405aed4a02eb31ba521909f9c79c50b4167162e383bfd0722aea136cdd725e797444eec65136c11118
SSDEEP 192:RV6yQSL9JaY2BQDbSzqXq8ceRLAvYwEHgkiI7rBA+9/FmaekCTPUAlkqyUVF8Xn+:DFyWmbBKlZl4oKd9RaZlABuI8Ha6Bxa9
TLSH
T1EB63EE970829C01052EEC7C18276CE09306FA57B6E182B6D3FFBD6D26E8D9018DEDD59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdbx.dat

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-x64\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat
Size 64KB
SHA256 ef54b4d918f3c585af518fd4849d78ab431691ae11e0e3a2a8dc4859b22c74b6
MD5 5ea0d1c53bd10bca0dca653f43c1a9ab
SHA1 a16d35b20268d5468cc0673bfbe0021e6d7fbf13
SHA512 fe9624ecd3024dffe72e40a34acf001cba865602fb50ffccdf2142d773963d4cb4153cb679cbd30a22603275c08df3eb16d621748bb31fd8390756f5a050c8e5
SSDEEP 192:S2MzhFhgSOLZ350/hgSOLZv506cSiW5xsFu2DCUw3XfVOm6StJnMv7Jrs:GjO/jEO/XSSiB9wcNSnqJ
TLSH
T136538D9CE1D59FBCE9E916BCA41A8D2BB7F70B85D30A1F0A3416230578436BC71D088E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdbx.dat

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-x64\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat
Size 64KB
SHA256 d61875ebc8ba810df1d30012dc592443958f70d590deff7da9adc24785e77697
MD5 34d233253ba6361f11647fa3168dcd19
SHA1 a11902761ba6d8ed2a10ad06fda001d7d7b48c71
SHA512 9bd8f0781b4cfa1ed3eccf7efdebd4a294d22d554038d626282b7bbcaf95dd73afdbd07b132062c405278d2eb1341a879f20bb2f49100e95361be3f1b7be210a
SSDEEP 24:VC1lldwXv1ll1xR1llwAJNUQsaIManXAJNUX:sldW3lRlFuQsrMyEuX
TLSH
T1835380629A49CBA6D8D5827C9D77C1F223628CC4AB4357C3316D730A1DB32A879E164C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcsdk_dpv3.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
Size 46KB
SHA256 67104840c095176b88f649f306093a11eeb7922923435dce251eccd4c56b8611
MD5 914c155024b75a6a69e80f97d12e833c
SHA1 e58724e257166ba3d85046d49718db191bd653d9
SHA512 f4230400f2a2699040af6378ded3b26c0c802f2fbaa218f1b12e86bbadd8e35a522b9015184151cbc1babe0c8b6cc98b5c624840bd74a5233eb5342f232ab668
SSDEEP 768:6Wwwa8RbbFZhDq9SYBaMdCMwWE0ECPl2ltOLeUeDb+MPsqAN:kr4bbDhDq9SYBVEF4KK
TLSH
T10A230196B7FA1558F6F72F6569B968944C3A7DD22C09E4EC01602C8E0932F90EDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcsdk_dpv3.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
Size 46KB
SHA256 e764146da97acf889b30ca9093684fcb5dfd77c75b02421d307af562ebefcb39
MD5 088e738b6003395148cbefc19f1a6a7d
SHA1 ce8d570b0b6a9879df915e88c7b039c8716e57f5
SHA512 1cee7ff522aa1c6fb94169aaa03984ac218c70511dd1d2e6597b7cc2e8cd8dfb30e329300f53eb1772b72cc3f10a1dc496bdaade0267ba086f309988c07f641f
SSDEEP 768:6VGwwa8RbbFZhDq9SYBaMdCMwWE0ECPl2ltOLeUeDb+MPsqAp:6r4bbDhDq9SYBVEF4K+
TLSH
T14F230196B7FA1558F6F71F6569B968944C3A7DD22C09E4EC01602C8E0932F90EDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 312faefdc5ad84045a8b0cb7c36c20a67f9daed571c8b31c36b40ae3ad2c67ae
MD5 9c53a98405278ebe76629f2fc8c885d8
SHA1 1f80c56573420e08ac84ca336d069f7e9b15f825
SHA512 75ddb0328fe4050d8745f19477ab3a55d38e6e65a3b7ea68e12190757ff49f02321a06ddca93bff53d9e8182a2d0826248fc172c74dc94a7f33ceb5f3fb301cc
SSDEEP 12288:I073qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:F3N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1D14523253F8DD56AF5B616B048E8C1386D0F7F658F0191CFA7824AAE99349C1DEF102E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6f36fd7e840bd7bf555dae79623a96c94419fbacaada2d64a7a0cdadb678e0b0
MD5 bef21c802167cb536bf20be094b2ca28
SHA1 e775a4ca20146e4e05806b3e888b63032408ad9f
SHA512 45f00f4e5a5324d68942b5dacee9d8a356b5026698dd3bb2790dc4bb62da4cdb83609f1a8fe5857abd6cd2a988a0b5261df5359541f4d4fe30156b60a8366f97
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYpN94AMdTEvcQFuOjOP95Xdt5c:Sgb4mBIBhGFa95MdTAcQQfjP+
TLSH
T152659E1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1251426D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9d1f30604cee985354ac625742b9c3be9a9f477d07c7fee533ffc241acf12286
MD5 1d2eeb84e623cc354cb37ba231138d19
SHA1 03d0ffd3b516e07a77a1d8abac17041a8ce58cf8
SHA512 6ea8c790f6088d8aa76373cd62cdd1ce48b86c3fffd68b66e55089eebb3da0b3349f8bb06d86b3e96c97d105ffe4a05b78813c44786f07a5ad19f38849824d60
SSDEEP 24576:AG88u8FpJqH1bzria7/mKN94AMdTEvcQFuOjOP95Xdt5c:T7ZFPqVea7/H95MdTAcQQfjP+
TLSH
T1C085016577E501F1D47BD13889864663FAB2B8210360EFDF07A88B551F23AE14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8d45e2ded69c3aebf36b2750ae990b8119c1fd1b3d6640c879a132f691c74c23
MD5 664c8d2259e2398279ddac02295b1a1d
SHA1 95782138f641bd94631bdd16c28a31ee1afa0bdf
SHA512 85ff7de9c6fec14aa5c88cae7ccafc1cfa024854aeceaff1e987260d01a69e820a07993cafdff0484fd68f32ecc5be2083c7dc311efa5398dbf2111e182f7cea
SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj+95MdTAcQQfjP+:cG05lO43b50xTQWj
TLSH
T1EBD5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c22afacb637291d0083b27c2757f5314a1470128a3e2d00ad768e0bf1d85ce3a
MD5 bfeac4a65835c48fd043a1141446dd4b
SHA1 d52da2f9f64502f5c3c75feb5ee65354f6a028cd
SHA512 7acf9cfd2996cc182edfc9ca1c17c5a90f3676477672dbe608e6453fa45740330df117608703d5f393cc1c5d5c2ff93386d57a9b71668c3feac1f7eb6bd3527c
SSDEEP 24576:7fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnQN94AMdTEvcQFuOjOP95Xdt5c:ja5POZ3+Jt2pasx2+m295MdTAcQQfjP+
TLSH
T1D565AF5EA6EC01D5D5B9D17DC583861AF5B1342253319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cf34761b386eaef0165c1f54ab80426585c16d69d01716035b79b99fbfedbc9b
MD5 88ab18478d173a12e17b14d81abe19e9
SHA1 ebd11e94fa102f91af4d59f45bb049c5f36bfd1f
SHA512 efb10337afc01e78bc4e95499470397c22cb97156a04de96a9a2d2a74e4a6a8e5953747587d0bd66c51ecb52dc85bb53ec5e58e3e4359b5c439d57e0af17fd2f
SSDEEP 24576:2NcwHdjbyQ4nLC18lb/EOjowL7FkyN94AMdTEvcQFuOjOP95Xdt5c:2Nc/zEOVHFn95MdTAcQQfjP+
TLSH
T1CD857B2623E901E4F1BBE1BE89779546FA71786517308ACF0291851F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 4132166435c20860f4e79ef2525cb1c1b97139786e12bcd9a86c0bf1a5018387
MD5 ba3a551e27b9923d0ee6cafb3de57002
SHA1 2cda042a007eab5922c6970c3320092b81f9dfa7
SHA512 8faa191dfd25d2e57c4609fb427682328ff19ad2c6f48468fc8441e8c66028afe151dd7d90d19bfb2224443ebcb1db341df168ccad36a130a744f4fd43c73b1f
SSDEEP 24576:iPUr+NQmN94AMdTEvcQFuOjOP95Xdt5c:iJQu95MdTAcQQfjP+
TLSH
T18065E12F36DD18E5F676A17C89858219F772B8620712D2CF02E1817E4F27ED4BD39A24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-77-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/120-76-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/120-70-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/120-279-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/360-9758-0x00007FFA62C30000-0x00007FFA62D75000-memory.dmp

Download

memory/360-9755-0x00007FF65D810000-0x00007FF65DBD7000-memory.dmp

Download

memory/360-9757-0x00007FFA62D80000-0x00007FFA63924000-memory.dmp

Download

memory/360-9759-0x00007FFA62330000-0x00007FFA628BE000-memory.dmp

Download

memory/1216-84-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1216-23-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1216-13-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1216-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1456-9723-0x00007FF65D810000-0x00007FF65DBD7000-memory.dmp

Download

memory/1456-9732-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/1456-9740-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/1456-9728-0x00007FFA5CBB0000-0x00007FFA5E995000-memory.dmp

Download

memory/1456-9727-0x00007FFA5C120000-0x00007FFA5CBA6000-memory.dmp

Download

memory/1456-9724-0x00007FFA62D80000-0x00007FFA63924000-memory.dmp

Download

memory/1456-9731-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/1456-9725-0x00007FFA62C30000-0x00007FFA62D75000-memory.dmp

Download

memory/1456-9726-0x00007FFA62330000-0x00007FFA628BE000-memory.dmp

Download

memory/1456-9739-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/1456-9733-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/1456-9734-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/1456-9735-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/1456-9736-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/1456-9737-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/1456-9729-0x00007FFA63A90000-0x00007FFA655D5000-memory.dmp

Download

memory/1456-9738-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/1664-116-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1664-117-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1664-110-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1664-309-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1820-9950-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1820-10272-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2508-92-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2508-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2508-85-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2508-281-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2508-290-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2940-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2940-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2940-133-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2940-122-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2940-128-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2944-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2944-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2944-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2944-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2944-138-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2968-267-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2968-265-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2968-104-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2968-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2968-98-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2976-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2976-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2976-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2976-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3552-289-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3552-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4292-68-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4292-5-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4292-8-0x0000000000E30000-0x0000000000E97000-memory.dmp

Download

memory/4292-1-0x0000000000E30000-0x0000000000E97000-memory.dmp

Download

memory/5524-55-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5524-49-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/5524-42-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5524-43-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/5524-53-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/5580-794-0x00007FFA66B60000-0x00007FFA670EE000-memory.dmp

Download

memory/5932-58-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/5932-64-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/5932-57-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5932-275-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6088-9702-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/6088-9698-0x00007FFA4B4A0000-0x00007FFA4B4B0000-memory.dmp

Download

memory/6088-9703-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/6088-9705-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/6088-9701-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/6088-9700-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/6088-9699-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/6088-9706-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/6088-9708-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/6088-9704-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/6088-9695-0x00007FFA5C120000-0x00007FFA5DF05000-memory.dmp

Download

memory/6088-9696-0x00007FF65D810000-0x00007FF65DBD7000-memory.dmp

Download

memory/6088-9694-0x00007FFA5DF10000-0x00007FFA5E996000-memory.dmp

Download

memory/6088-9707-0x00007FFA49B20000-0x00007FFA49B30000-memory.dmp

Download

memory/6088-9693-0x00007FFA64410000-0x00007FFA64FB4000-memory.dmp

Download

memory/6088-9691-0x00007FFA65330000-0x00007FFA65475000-memory.dmp

Download

memory/6088-9692-0x00007FFA63E80000-0x00007FFA6440E000-memory.dmp

Download

memory/6088-9697-0x00007FFA61CC0000-0x00007FFA63805000-memory.dmp

Download