dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0

Analysis

max time kernel
37s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Size 5.7MB
Sample261001-jgb7wsxxaz
SHA256 dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0
MD5 03f494a57ee38952f5703ae15ff71788
SHA1 f73dbaa804f50dfac4afe7c627cf9564c7c45719
SHA512 4cdd0efe42038c7ef8b5b5f63271bccacc50cc52b389e199881ccbb5e1e038804f1d42dd7d0875935856d3c7a5fa8f7149f157602377568eff168f6f14370665
SSDEEP 98304:/tSuMOINjO91x364DT+Tx4NVMFb/55PU/yO0q0xTQWj:cMJtM9/5Rwd0RQk
TLSH
T18656C001BB85C5F1E5D201B0597AAB7A983DBE28573088C7A7D11D2A88312D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence ransomware spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
788	alg.exe
3992	DiagnosticsHub.StandardCollector.Service.exe
3824	fxssvc.exe
4976	elevation_service.exe
548	elevation_service.exe
2784	maintenanceservice.exe
6044	msdtc.exe
6068	OSE.EXE
3368	PerceptionSimulationService.exe
4340	perfhost.exe
5236	locator.exe
3104	SensorDataService.exe
4352	snmptrap.exe
5980	spectrum.exe
4536	ssh-agent.exe
3076	TieringEngineService.exe
1588	AgentService.exe
1196	vds.exe
1076	vssvc.exe
5732	wbengine.exe
3132	WmiApSrv.exe
5708	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Unexpected DNS network traffic destination 36 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	119.29.29.29
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	223.6.6.6
Destination IP	223.5.5.5

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\E:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\H:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\I:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\J:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\K:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\R:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\S:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\T:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\F:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\L:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\P:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\Q:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\X:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\Y:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\Z:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\N:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\O:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\D:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\G:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\M:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\V:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\W:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
\??\U:\	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
10852	ksomisc.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\System32\vds.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a9f253034bb6346b.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\System32\msdtc.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\system32\AgentService.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\system32\vssvc.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\system32\wbengine.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\System32\alg.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\system32\dllhost.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\system32\spectrum.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\system32\msiexec.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\java.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Modifies system certificate store 2 TTPs 36 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CRLs	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CRLs	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CTLs	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\SystemCertificates\Homegroup Machine Certificates	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\Homegroup Machine Certificates\CRLs	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\SystemCertificates\TrustedDevices	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\SystemCertificates\TestSignRoot	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\Homegroup Machine Certificates\CTLs	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\SystemCertificates\FlightRoot	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\Homegroup Machine Certificates\Certificates	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\Certificates	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1724	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
1724	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
1724	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
1724	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1724	dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
Token: SeAuditPrivilege	3824	fxssvc.exe
Token: SeRestorePrivilege	3076	TieringEngineService.exe
Token: SeManageVolumePrivilege	3076	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1588	AgentService.exe
Token: SeBackupPrivilege	1076	vssvc.exe
Token: SeRestorePrivilege	1076	vssvc.exe
Token: SeAuditPrivilege	1076	vssvc.exe
Token: SeBackupPrivilege	5732	wbengine.exe
Token: SeRestorePrivilege	5732	wbengine.exe
Token: SeSecurityPrivilege	5732	wbengine.exe
Token: 33	5708	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5708 wrote to memory of 4296	5708	SearchIndexer.exe	113
PID 5708 wrote to memory of 6036	5708	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe
"C:\Users\Admin\AppData\Local\Temp\dddcb283d8d52153dde178d94cdf11a6480ffd39ccf4dc5ae255a28d8d6052e0.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1724
- C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1304.exe
  "C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1304.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
  2⤵
  PID:748
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -checkInstallEnvironment
    3⤵
    PID:15572
- - C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
    "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService
    3⤵
    PID:14396
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -addFirewallRule
    3⤵
    PID:14312
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpsoffice.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpsoffice.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=klangmanager -dll_name=klangmanager.dll downloadlang en_US
    3⤵
    PID:13804
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regmtfont
    3⤵
    PID:11404
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\\office6\ksomisc.exe" -setappcap
    3⤵
    PID:11964
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -sendinstalldyn 5
    3⤵
    PID:10868
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regPreviewHandler wps.exe et.exe wpp.exe
    3⤵
    PID:10820
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\\office6\ksomisc.exe" -registerqingshellext 1
    3⤵
    PID:10144
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingshellext64.dll"
      4⤵
      PID:10352
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regkwpsshellext admin
    3⤵
    PID:10620
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kwpsshellext64.dll"
      4⤵
      PID:8836
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regqingdriveshellext_install
    3⤵
    PID:6672
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*install "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
      4⤵
      PID:6840
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*thumbnail "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
      4⤵
      PID:6924
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*drivebho "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
      4⤵
      PID:6956
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
      4⤵
      PID:6992
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
      4⤵
      PID:7044
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*onlinefile "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
      4⤵
      PID:7496
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regpdfwspv
    3⤵
    PID:6240
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\pdfwspv\pdfwspv.dll"
      4⤵
      PID:3728
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\pdfwspv\pdfwspv.dll"
      4⤵
      PID:6424
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\pdfwspv\pdfwspv.dll"
      4⤵
      PID:3784
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\\office6\ksomisc.exe" -setappcap
    3⤵
    PID:8044
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\\office6\ksomisc.exe" -assoepub -source=1
    3⤵
    PID:4624
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -clearmso2pdfplugins
    3⤵
    PID:2068
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -uninstalldatarecover
    3⤵
    PID:11212
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -collectmsoinfo 5
    3⤵
    PID:6928
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\\office6\ksomisc.exe" -assopic_whitelist -type=setup
    3⤵
    PID:6956

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:788

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3992

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1920

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3824

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:548

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2784

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:6044

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6068

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3368

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4340

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5236

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3104

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4352

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5980

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4536

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5760

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1588

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1196

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5732

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3132

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5708
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4296
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  PID:6036

C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1304.exe
"C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1304.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E59A09B -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\
1⤵
PID:1716
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -setlng en_US
  2⤵
  PID:15412
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -getonlineparam 00601.00001304 -forceperusermode
  2⤵
  PID:15220
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -getabtest -forceperusermode
  2⤵
  PID:14952
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -fixoldversionassostatus
  2⤵
  PID:14716
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -setservers
  2⤵
  PID:13984
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -register
  2⤵
  PID:13780
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
    3⤵
    PID:13340
  - - C:\Windows\SysWOW64\regsvr32.exe
      /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
      4⤵
      PID:7332
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
    3⤵
    PID:10628
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regprogid true
  2⤵
  PID:12200
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -assowordexcelpowerpnt 1 1 1 -source=1
  2⤵
  PID:12384
- - C:\Windows\System32\openwith.exe
    "C:\Windows\System32\openwith.exe"
    3⤵
    PID:12828
- - C:\Windows\System32\openwith.exe
    "C:\Windows\System32\openwith.exe"
    3⤵
    PID:12848
- - C:\Windows\System32\openwith.exe
    "C:\Windows\System32\openwith.exe"
    3⤵
    PID:12868
- - C:\Windows\System32\openwith.exe
    "C:\Windows\System32\openwith.exe"
    3⤵
    PID:12892
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -compatiblemso -source=1
  2⤵
  PID:13028
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -checkcompatiblemso
  2⤵
  PID:5932
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -saveas_mso
  2⤵
  PID:4172
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -distsrc 00601.00001304
  2⤵
  PID:11076
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode -source=1
  2⤵
  - Network Service Discovery
  PID:10852
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk" 5386
    3⤵
    PID:10056
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -addcontextmenushellnew
  2⤵
  PID:10808
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regvascontextmenushellnew
  2⤵
  PID:9860
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\wtoolex\wpsupdate.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\wtoolex\wpsupdate.exe" /from:setup
  2⤵
  PID:8780
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -collectfileassoinfo -module=1;2;4;8 -daily -source=1
    3⤵
    PID:8596
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\wtoolex\wpsupdate.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\wtoolex\wpsupdate.exe" -createtask
  2⤵
  PID:8764
- C:\Windows\system32\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kdesktopshellext\kdesktopshellext.dll"
  2⤵
  PID:8680
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kdesktopshellext\kdesktopshellext.dll"
    3⤵
    PID:8656
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regyunpanfornew -forceperusermode
  2⤵
  PID:8536
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
    3⤵
    PID:11496
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:overlayicon "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
    3⤵
    PID:8248
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
    3⤵
    PID:8216
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
    3⤵
    PID:6744
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -setup_assopdf -source=1
  2⤵
  PID:7184
- - C:\Windows\System32\openwith.exe
    "C:\Windows\System32\openwith.exe"
    3⤵
    PID:7864
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -assofdf -source=1
  2⤵
  PID:6408
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -externaltask create -forceperusermode
  2⤵
  PID:396
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe" Run "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\ktaskschdtool\ktaskschdtool.dll" /task=wpsexternal /createtask
    3⤵
    PID:16372
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe" CheckService
      4⤵
      PID:14344
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe" Run -User=Admin -Entry=EntryPoint "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6/addons/ktaskschdtool/ktaskschdtool.dll" /user=Admin /task=wpsexternal /cleantask /pid=16372 /prv
      4⤵
      PID:14000
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -createsubmodulelink desktop prometheus -source=1
  2⤵
  PID:4748
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -createsubmodulelink startmenu prometheus -source=1
  2⤵
  PID:3312
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -assoofd -source=1
  2⤵
  PID:2540
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -assoopg -source=1
  2⤵
  PID:10748
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regcadfileasso
  2⤵
  PID:13328
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regemailfileasso
  2⤵
  PID:13520
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regarchivefileasso
  2⤵
  PID:14800
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regmarkdownfileasso
  2⤵
  PID:14092
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -installbrowserextensionhost
  2⤵
  PID:12172
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regvideoeditsetupfileasso
  2⤵
  PID:12396
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regemmxfileasso
  2⤵
  PID:7760
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regeddxfileasso
  2⤵
  PID:12884
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regposfileasso
  2⤵
  PID:13140
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regxmindfileasso
  2⤵
  PID:11308
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regvsdfileasso
  2⤵
  PID:176
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -repair3rdlink
  2⤵
  PID:11196
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -createexternstartmenu "WPS Office"
  2⤵
  PID:10908
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -rebuildicon
  2⤵
  PID:10960
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -addJsapiCert
  2⤵
  PID:9052
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -updateskiaconfig
  2⤵
  PID:9980
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -createsubmodulelink desktop pdf -source=1
  2⤵
  PID:6948
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -createsubmodulelink startmenu pdf -source=1
  2⤵
  PID:8952

C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
1⤵
PID:14016

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"
1⤵
PID:11520
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe"
  2⤵
  PID:11548

C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
1⤵
PID:7484

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscloudsvr.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscloudsvr.exe"
1⤵
PID:7360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 05bb90cbc4abb4bcd8411a526054461149bb59a912a66681828217e99b29e58a
MD5 43fb210642db78d078381135760a0854
SHA1 780acd302a0073a61ae56681a347551202f75615
SHA512 b4dedf5fd1da475161ab92e2948e975486a3d2184b0afdc037811fcf364862606d4ba0329e0b54eefce8aa7714a721d17d971aaa9b7821ccfa6ea8c284f0f96e
SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxne95MdTAcQQfjP+:K3q6HjBj0xTQWj
TLSH
T12DD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e141bafc203f109f7853255a9162f2b1b534b3b5e5c7f0ccff0043a5963b142a
MD5 ad0de34b5d3a110deb38ef4af6b7161b
SHA1 6eff7a94ef87988ea10f43dbadf6ea098e139086
SHA512 7408aa817fb7fed54244340bbadae2a8184e3f9127c9e64e74b13f07e9bc434507cceb97f5beb124a221b1601eaf9af1985c79f4ec240399b4eef83ee6ec53f5
SSDEEP 24576:1XYfDtczAxN94AMdTEvcQFuOjOP95Xdt5c:gtcg95MdTAcQQfjP+
TLSH
T1BA65F12877D508F9ED678278CCA18115EA33BC514760E78B03E48A6A1F337D49E7EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 15ba8ceaa77674bce12458c24dc1b07494a409ea8a5941e3c5557ced1461f653
MD5 5945f85d5ce3717d2e7497124d418fd5
SHA1 2cde906020f6329c899a06436e6b3f7809a463c9
SHA512 6e086f55f782916625159ef51fee0583569fe9f6d33428dd6b9aa04115c75ba7acdaa6cf9f5148340ffda0842b2c8f7e7f921a1c4f0101c9b4090039e8df9fee
SSDEEP 12288:+mw5HEjsChNVBFgl0WDm+CgqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJs:XwuoOWTN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T17F65F14937990CF9E9A786388597C136FBB2BC022A21D71F17A0C65F5F37361AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7a1fad064f345d15f80d8b6142492d4b5c24e59d72652112f72a1eca7dd3567c
MD5 e8e00ad554de673339df039fc4ce72a9
SHA1 3013d09e11aacdde1b26882a63d3c89598f37446
SHA512 4a5899f9887c7aaa57c40fa45f76bbd1158bdf5b3431d2528ebe108b34faa36875b19a9542e599d6f0f4fb0d0339726a9304d34dc04234e97420dbcc513d19ac
SSDEEP 49152:9B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glH95MdTAcQQfjP+:ju6JmVxd2dH0xTQWj
TLSH
T1E8D59D13F1DA01E8D06ED478974A9233E962BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 0fe0b556ac801358420f96816313c8c5c25bde027cfc509e7db40057b46fbdde
MD5 a09223efce7a3aa325fc7abc49151fa2
SHA1 1370cc9428d1e51ced40e013e54392ff2af48537
SHA512 d41e5c6c131d83efe93aad3b23443a119abb47062ba1dee95d2b68a73ceeaf34e4af68b84acef99e7785209c7ad587be45c88ace872f68fac049e73f11cb1579
TLSH
T153F0DCE215B7843A2F0AAC0817F9EC3120B5E80F05D1882B303D4CD18B92156EE0B805
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 727B
SHA256 f4236e1793914f4f162b3b93d914861a62d06f1770b471aafd50a2dfe1b41b8a
MD5 ef16f8f3f438e604193679785d07ae97
SHA1 e68bd424e5d3446ffc13e7a9609e4c3052f8a667
SHA512 ec4c9b1aa3300c2b5afadb2ced42b06c174bc932c033a61216e65f59e2dd670290e60ff9b82454fef5525d10663c7856c282a764a80bf4346f42360890c8124e
TLSH
T1480194425EB49A02772647B83FFE5AA0BFB604385542F6CB822B6144E309B72331C71A
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 abfbfbc723ff25914997f9ad5b2cef01b259573d93648869322de8a3008b00bc
MD5 3180de1680d1de539127c715d96a3c5a
SHA1 a98b6bca54d03e0bbf811a0685aac49ac4e77a6f
SHA512 7430fb60abd91978456881e24b4ae42b107c896f5e438e800d61e3f71456ad061df667194b0d32798fb18675e40d7c9e2511a7c2a1c6080ad5198a01bad8de6c
TLSH
T12C01650097BD549478000D11C6FE9998F42BA08911C14296B2761CDA1290A1EFFA5016
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 63d3e8a0c5ac2a0cb7a3537449a219240b51280b2ccfb1a3c3963e4637d209f2
MD5 4d241735d9b34236b2f7d30398d94d50
SHA1 0b47fb3a7bb86a60a354757fbbfab6c2f0d131e4
SHA512 8ab6ec6bbf830aa1c79c5b2556464cf7606871f2e6445a4c40259d269e78dc898eb646ede7dc92bf6d4826d4609e178ef3fe0753370a9ad5cc1b9adfaed4c543
TLSH
T19EE0203027FE501EF17057B803D991E5AF29F1123C5996BE1D91156D5A0FD005C56C31
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 404B
SHA256 2a01427057fc03429384e752c6bc123accee83e28be4d5515756152e19114a6a
MD5 e9bfaaba6ba183871195a4710c7db9a9
SHA1 17a0fec270919a9f06630951a239cd48f37f366c
SHA512 c8fac0484667a1c836f8762fa06514ffc68bcc7de1e065578ac9a1dd62a639f2940fddd6338fde9f656f2f929ff2aba8554eae566a99247aac3886445bbf705c
TLSH
T17EE0263821F9099EF0F4E47847EB98214D99F21B054687AA1654735AEB25F408CB7635
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 4638e12e2c4f5d0b3a8c1cd540fcb4ea086af7e0b39092a3935e6d8a5abab084
MD5 5f4f844294981a4f536e3eeea99fcf3b
SHA1 193c807ca5200c70f647c7b341d47123891a3da0
SHA512 3ea4cf40f476a576ace914d3e39c3a87d3791e50dca395654655083840846e626909328f17f1998a3e90bf53daf501e050ed6d4d9e424e68b40d8be0373dfaec
TLSH
T122E0682C62EFB10EF0A08C7142E5A0750D48F701180087B906C2030CAB0AE005D209F8
MD5 SHA1 SHA512 TLSH

Submit Download

Qt5NetworkKso.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\Qt5NetworkKso.dll
Size 1.4MB
SHA256 e800493d5f4a4d0d0bce523c4228fc28507db20f6940c741bc49000e7575f227
MD5 c48d5a1dff1b7f57223af19938d47102
SHA1 5fc962e2cc6f586c08e931ac98f58057f4132ee5
SHA512 1179fc8d04174dbe10771e05216fa002c39a81a8856103a8bf25601dfb2d55ae38b05d0f043fd688a09556f2ffb3581a351f84fd21915deca3be8de3d590faa5
SSDEEP 24576:2kbqCgnInomjARXqFrdpEGcqHnwg0i16+6VQAactJ:pNgnOo2q1Gc4wKI+6V1P
TLSH
T190655A53F7554399D62AD134CA8BC902F272740083A75BEF2669DB192F737E2263E381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything-KingSoft-wpsdesktop.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\everythingsearch\everythingbinary\Everything-KingSoft-wpsdesktop.ini
Size 104B
SHA256 60791d7a764fa47434e3c25ae6a20703d4f7b3540496da9028e2fc0e5b073f3a
MD5 d9d0b698e8bd1c6d3a1438052880ff7e
SHA1 f4736b7d86e8f4e5bf9797f0ed03f2b355debe0a
SHA512 54400671266c74800568c28f91d4b494f2f588673d9429ed0b5191db27f1fab442152065e0a57c7480d923651b4d3560c0d1b914c54331630605d44047249680
TLSH
T10DB012D587D5C460F3834171DF5601390B0015B88F8C1B3E070B001752A991CF730C15
MD5 SHA1 SHA512 TLSH

Submit Download

Everything-KingSoft.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\everythingsearch\everythingbinary\Everything-KingSoft.ini
Size 404B
SHA256 b5980cd1122d2ad4727bc06806e3d2a6598b7d67b6eb3d2732938d08c6deedbb
MD5 6a4653f40acaaa13e2b0f60f067ea93f
SHA1 34981baa55ef31ae6b6d5985fdd02798e3bacde2
SHA512 f286472389e50fa51abe03068cc3e1f9d18b19926d84b66b1df28c157cbc70e8de32a8deb7b4096f462605a2bdd4d76f9863c6ca0872703c60d473a3271778ea
TLSH
T15DE02B99808C4B1C7656E6948D715E4F42E1C79C1B98174CCB0BC241E91950DF63A439
MD5 SHA1 SHA512 TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\karticlewebcloudsummary\mui\dist\run.ini
Size 171B
SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
MD5 b30cb271e143eace0f55ea2e562e1e9f
SHA1 9d97dbf24931cfc114384c3f4dbbae21c9e51be5
SHA512 dc593185fa63b458024c3a913c558e5686806154181dea67eec786ada50595c53bab822833ad1e76c9acdf21be3eba50631391b7e575d7f1f6409ceccf966535
TLSH
T1AAC080D4D0256F97DC31C6B5ED54AF1A7560E700251C1EC3D530DC4E9E9696551C805D
MD5 SHA1 SHA512 TLSH

Submit Download

kcoworkdockpanel.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kcoworkdockpanel\mui\es_MX\kcoworkdockpanel.qm
Size 846B
SHA256 8f0de81b05e2ce8a22432406009084933f0cf410e6efb534aafd71699651120c
MD5 6e815f2b93f16067d08e51cdb69b81e4
SHA1 40630f21ec4e2ce47da271f5e379737bef67fad5
SHA512 7e9586a605815f829a2881ae328d4df3cb9600949767cc5c8fb8186cc2243b08d8cec4bd52cff81c728fdb0c8fd7ce1c9d8e52e9fe4139722e99d4be12c6e482
TLSH
T12F01E9D527FD2F19F3F79BB179E652108F3679082931D16F2145A40D05A15505DD0327
MD5 SHA1 SHA512 TLSH

Submit Download

kcoworkdockpanel.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kcoworkdockpanel\mui\vi_VN\kcoworkdockpanel.qm
Size 839B
SHA256 ad5549bf1c748909f191eba6e08caccfb31dbe1a2ce4bfafcb1e41702f40c95f
MD5 3eabae85edf1db8a54d42509c660862c
SHA1 ea6133582aaf7aaf5330142474dec996e527b461
SHA512 05d619228af227bec2d3b33aab044dcaf79b69633c604f81d6456eb10d4420e48024a9a88cd706fb5c00908565347f5e04302f90bc5211d48d99e2aab2feb7d9
TLSH
T16801E29523BD2F19F3F79BB17AEAA2208F3679082932D16F2145A40D05A29508EE0327
MD5 SHA1 SHA512 TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kpdfcorporateglossary\res\dist\index.html
Size 636B
SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
MD5 72cdeca808b16e794ec5b66bd02246bf
SHA1 e75b6c4e084efc8e60c9e4fbe9e9ae02bfbf4132
SHA512 6562ed498bae7f819caa5ebff9ba373b1bbeae3c92befacbc44a72419e6a3aedeee7fe43347d1bf8c46b9c90c8e515181a6dc50c4ad954a640cf6b2520269ed8
TLSH
T1E5F002EA3C25F055CB911EA43DF2F19E245E3AB29DB9DE942AF4513543C03694D0BF48
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kpdfcorporateglossary\res\dist\index.js
Size 2KB
SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
MD5 67dde682d1968824023dd9773f9ec48b
SHA1 81e0a21a7ba2c05193ecc13672a3f537539e0699
SHA512 86bccae3d66df4dd552c12a42d1ed0d57d6cdb7b904caa1f89c874e506fb76412b2df45e3e5f673837cb72aa18b0ab2c1dfb489b1da37068d83d7ccb25d3d8ea
TLSH
T1FD5173C9F79E702209EAE136583F0006E17735596098A1C8B87ED8F16EB555E7077F38
MD5 SHA1 SHA512 TLSH

Submit Download

logo-small.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kskincenter\ksolaunch\normal\logo-small.png
Size 6KB
SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
MD5 8d650fe389e3665607fdbf938c1a1722
SHA1 2e545f9555ff22313e4ce113995d8aa694e5cab8
SHA512 f116621bfecb602d02919eb1ee9d7dc92e82b313b8b54cda42ab48c5e7ec60b02005edcad763fff6b497ca4bc46e83cb0c9a249be791f245bb9c599950fdf015
SSDEEP 192:HSO0z+xgsZ7wNP+agwQznBm2KIvdgoeAtzpZb/D1:yMRoP+z5IIa8hD1
TLSH
T1CCD19EEE6F1CCE4F079D52F7500AC0A9DEA218AA905764D4D68E70B471FE6D120EC5C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kskincenter\ksolaunch\normal\logo.png
Size 12KB
SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
MD5 d58510dca6b659c6e4ba7a454d5b75ce
SHA1 e142de2dda3811a2e8bbbb2eb64d366e8eb9ea3c
SHA512 42409f9976ad08ecf1756d1c2915f3ffd17cdc78e9ff552c0a08bdfa2fda8960e408721bfc9de1a5ed9c9aca3e23b97adb721b3c51b6b3f0ed3ee4a4c780cf88
SSDEEP 192:ySLu8Kp8OtM5IirU31+5AejJ7D+N+QOtHQjrE9aTYpR8XnXrWjvyNTtLJci:NC8o8do1+5D+N+QPE9B2Xn7WrINJP
TLSH
T1BC42C08F68918EB2CE443C39F356115F1FE12A5E7E19A2CF2CE7944A239044ACE1591F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

errPage.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
Size 7KB
SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
MD5 eb3b05c3a3fdef3b0c5c9020756ebb33
SHA1 27c5773e17f9c05f471ccd22db42015561b4e669
SHA512 9a511c6d0aad855448ae45130d7ed031062bb7e6881e68aa2406c7c122220318379c312bc13876599dd7fe88e2beac296adf5bcdc015ef4e0e3f362e76303ab0
SSDEEP 96:9uMJIMzvOcuq4v+nB1W1QjjaKhwc3Rgjfqqm8bm83:9lTgVv+B1W1Q6ywc3RgjfDm8bm83
TLSH
T141F15211D6925216603393B4DFA25719FB260023A3038A38BFECA2558F75C495B93FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicon.ico

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
Size 4KB
SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
MD5 1ba2ae710d927f13d483fd5d1e548c9b
SHA1 c0605efed936ee2600284e6480521d06fa64f872
SHA512 f933cd352eaba92f509b3863353ddfefadfada26a4152ecdc4727d450bbf35e7b10fb3038fe8db340d5c63d74e608c1560ec84d0f6ffc8ccd940c9e0d7533544
SSDEEP 48:i3H5R5hLOR4kt38PduMoglJrd6qTrp9hweFC0+6Ga:ipHFUs4MLBvuyCda
TLSH
T1EE9175DF61C388D9C1B1977F78C449A14F6FD951BA28351F55CF30622E5D75818C1C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kwebpromehelp\run.ini
Size 226B
SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
MD5 abc3a6089b0ea76ffc960fbc9b6e66d1
SHA1 50ad0cb201c13799024de56cf45116cf65ff5569
SHA512 ec1e32b7bed882095b23e049a4e1a86acf0bf993e2f691105ffbd99d93ebf28faad4fbdd645ac1eefa74ede575854a3994c7c6d2bacc6f7a09a1991561b1a44b
TLSH
T157D09700C0B5658AC1254C827CA53DC411085B4B27608E02CCF0C34D508EBECE56B08A
MD5 SHA1 SHA512 TLSH

Submit Download

close-secondary.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
Size 216B
SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
MD5 07306930f7d374663bd13e38ea0e92a1
SHA1 12f877e8ab93d874b55d75eef6747615619dad4f
SHA512 4cc0517ed0b9d665df4db93fb3093067e90f64b34f1d41420ed975b4cec64d4cc0aede64092d79c610c04e1ecd9514a9ef48389d5c157b5bcf698fc33670db98
TLSH
T1D8D0223BB3CC8E1CF9224A22F35A713580AF41C3548942E4D8322032E4011CEB93B6E8
MD5 SHA1 SHA512 TLSH

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
Size 334B
SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
MD5 d36fe6147829a72b42e054a5db27d270
SHA1 80779a8eb37d8bb1d5fcc594576f80dbd61fac98
SHA512 94224816f757241b3a6d19788225378ae070fc62b4620e11e10a033e3be5d9cc858cd9e669cc275b1fa82e57094d0df13a6d9868cf00afaa17cf2ec0193acd74
MD5 SHA1 SHA512

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
Size 327B
SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
MD5 18770de3f96bac1e75e588015024fcf8
SHA1 e6254c054edef68f9c27059efd82eeaa69c863b5
SHA512 fcb76291a73d7f2e30f4266ea8f0dfa2d9e203cf9770fb7ffd73cc1994502992fabd0803224c1e1155c1e4b678b5af0e8b3aec114beb1f02299e8885d5a61d0a
MD5 SHA1 SHA512

Submit Download

element-icons.ttf

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
Size 54KB
SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
MD5 732389ded34cb9c52dd88271f1345af9
SHA1 8058fc55ef8432832d0b3033680c73702562de0f
SHA512 e8971ae48f5287d252f5b0a2d0516091bef0d2febf7d01fd7b435e426d106fea251037439ec42c2937e934b66f38e5eb43d00a213cdf334f482f4a06b1817f9c
SSDEEP 1536:qTIRCXXCwinqtuPM16hD2N3SUjbwaST4DCJe:39GEcgD2njb5ST4h
TLSH
T10A433B32436A9BE7F416047F5C1F55830A9F4F22F53DEA8B83A6192514162FD0864BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

element-icons.woff

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
Size 27KB
SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
MD5 535877f50039c0cb49a6196a5b7517cd
SHA1 0000c4e27d38f9f8bbe4e58b5ce2477e589507a7
SHA512 da269b20f13fb5b0bb4628b75ec29e69bb2d36999e94b61a846cb58db679287a13d0aa38cdf64b2893558d183c4cc5df8da770e5a5b2a3288622cd4bd0e1c87b
SSDEEP 768:gOvv6ExpCVxUtrT6w8ClFd80EjPVerMKBaGXjAlEm:Hvv6xVWewtlFdGjPlkFjAlEm
TLSH
T1B9C2E13197213AE9D9824EF876E498FEF1651402290F390E8696ADB3A98D5C73E16831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
Size 107KB
SHA256 907d1f5ee046fae72b52eaf99508ddb6b48d47b803076db0e9a86b0e21a54ba9
MD5 0ad676312c51d1b96bd08f056ab33496
SHA1 270438a06781cb68c376bc18c42437dd5ce262da
SHA512 6a6883f9fa0a1f768bf985340dc6cb4651e5ce691066c9597126ba1fc62b2a45a2eee52a1d8452faec885bbd3358be3fb04a15fbfca0302feaa1adc2c81130c3
SSDEEP 3072:KazzQ51KYGqMkYUl26MeCAAcdl6y7tqWD:mME/euD
TLSH
T15CB31B37214D132D343BDAA2E55D659960C8F61BC00253F9FA247B1DCA837873A7A3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
Size 279KB
SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
MD5 a3964e72421a1ef5fb60c6e17eb5d705
SHA1 5dd9584be5141e884a230c48746e1c88126b0a55
SHA512 4ce4119b7407b460969041809354c4ede587047ee643f2897eb0ecb9627608431f43fed27c54c70bacff3a6694eb32a85b535c7d6397ac22d7d28e260b0a5467
SSDEEP 1536:39eSBQG+dyAUlHj/8D0Q+SPxZztR+LCrwHFfyqHYb3PPV7BYUOf0I79lDxiRSL2Q:3zfZYKVxiW
TLSH
T14054B6229140212E702BDE3DF7C4EA4AE225C6B3C4125BFEF953651DC7C36AA117778A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
Size 380KB
SHA256 fd9dcbe72da3477714bf68b8987db4718e4be32f313d09bfefbd4d78aa051a84
MD5 64ac5333133e48efc94a0f579e10878f
SHA1 ca547d97d85fa913f48aabcbb23a227c6a2e6bad
SHA512 be9be830f1a3149b238b7363cb6aac08281d244825f4c0ebdd69e31daaf05562555a46484af78de442b7deb3ca71b8a8698331e617b433a0f86cf39e2668576f
SSDEEP 6144:qpK457wXrkaY0TbOXsEYlHBBs6Ve5NtXoqIpgznl87A6v0eX4AiDuViQbgQgILTV:x4B0WtYlmiLlTj8QmIqUrNBqq
TLSH
T1DE846C4B758BBB5A1F35B66340DF3C88D01C6EC09812A5C9FABDD9D09144B9A32D63BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
Size 249KB
SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
MD5 6351ea268f992f52e0f4418a7028b91d
SHA1 5bb3cb88465c550a1fd033a079a8b2eba5e071b8
SHA512 44940d07abfdee6403e9400e596ac5e5eb234ba77a1c90c2fe4086878c12f4805c709eb84538071f21d5710d3569d342e7caea10061e2ab2661c5117c5966297
SSDEEP 3072:p+Xy2rHhkiTtcsuaIwK3zqDLW/ix3Iu7doNFBWgz/bwUzxqcG7gLEOhA:phKHhklsi3zpCdoNFBHz/bwAfG7cW
TLSH
T10A44F8CDB2D1B0A517EB61B4813F610BF27B6499B44E80D0E226E5D4BC7998E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
Size 424KB
SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
MD5 cf29fba214e7f43f2ca1b629109d126b
SHA1 d0dda9486528586af6943abe7a3afa319c790f25
SHA512 2ad7e4711f5917b8d13f861d4fb2688e6ce3951da43a89263a2d9743199e173429398ec1a9537b1df25593d3999dd34fb590e2d2a6e7a632ccc44265d93c3bca
SSDEEP 6144:z8KzCOcC0CXWsJvRekr0dgei/zJbBoCF7az2bzNM:zbzCODTWsJvRbw6zJbBfaz2bC
TLSH
T13694198DB2C1B0A517EB60B4913F610BF23B6469B44E80D4F266E5E57C7898E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
Size 10KB
SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
MD5 0f4634d4af8b73f882440c1181697d86
SHA1 748bb9a14c8a6c64fa060ddcb1b4baebfb3f6fd3
SHA512 eeff081cb256a44ff4557dae145c3d277ad936fef58674cb7d2949b6c302c3a746f05495daa6ccabf39c26bacf13c6fee3bab20de4f1d13810be0503787c89d5
SSDEEP 192:cyxPpQcKb2d4U1nE92Ui6OPl20b3G0qE7I2ByobYGeBv+x9qkgYbeO:zzFZr6OddG0q/yTh3UYx
TLSH
T1AC32C887B30483755A90E790F6C76DA5A93ED0EE73A4168A3CEE421812581DEB3E7CC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
Size 13KB
SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
MD5 dd59d31e84434c59c5c3735bd0b0dc3b
SHA1 c34473850d3749aae725856f68a262a0afebee00
SHA512 f3acd51920f945b49dceb56fd2a5a4ff170c4a5770665bef3d888f8497a288dc33bd15f24780cbe9b8ced585fbacb92a8700d1322a6d4acd2b6e5893370822ac
SSDEEP 192:GwSuCUHXDhEblYfhQ9GYSOqUr9b1AARAU0qWo3wYXVMojXiyaH:dCaXDhEK55YmUrLAgkqWo3RVhpQ
TLSH
T140523295F3C50E22B4991749BA03D57BF19558FAFC2CC18D5CF2D236136C9C986928C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
Size 14KB
SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
MD5 5cee0947c1ef6f00e18eb17cf77388af
SHA1 5a27bc625acfb46d2368a9a376d797ecab912a3a
SHA512 1bf91f08d2a2a446ef0e22df40fd09b090fa300f599bacdd5c698aa61a6fef12ad3d3e38299804a016e5a22a82ddfeb6840cdc7a79ea51244942cb22e659331e
SSDEEP 384:HTO1ksU66rAJGO+NedvSGdv+GfBgLj95LKn:zO1ksU66rAJG5NedKGdv+GfyLj2n
TLSH
T11D6230ACC3CD5C69C86183FA090B35C27836ED49FEA5AE7280EDF4202DA19DFD815674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apm-init.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
Size 57B
SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
MD5 b684f2b8022aaa97ede28f9d224c4db5
SHA1 2087206ddbfd6d6d71f843a132b58ed533d87169
SHA512 8d30da66bfdd99dab88c4b9766b692c39ecbc8dd725e9f858c95993d4f2bf46c37891a1f8f4f1eb6fe09bed7008b8df48d2a9b4f10d7caf20f823f121f6ebb40
TLSH
T19F9002E7F0A1707344616959630722AA35D11130017430010900487434A580FCD22F88
MD5 SHA1 SHA512 TLSH

Submit Download

default_ava.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
Size 906B
SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
MD5 c47a5cfed147c402538358294808e68a
SHA1 8aa499336bc4a50a70710735b67fc5da923fc61a
SHA512 a71831abb9393b6c0ad62feb29fefbb192e1706b08ab88dec0a8e6a9cf61b6a7e106454a7e6e518f69425cc91846036e8fe2956ea939625678f17b330860ba1b
TLSH
T15311E309934DC285960AD7B8563C1754347272DF9E1FD55CE7E633012D3C6AF185C27A
MD5 SHA1 SHA512 TLSH

Submit Download

desk-sync.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
Size 1KB
SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
MD5 c17417f321f52624ee0dc60ed76a31b6
SHA1 b64e19a5b03c92a931fa9a1eba899f491e669a1e
SHA512 bf160829598cf0b22ea48a5f7310adfbd26fbc1bbf23ea3cb8d9cebbeb92b5e81b914bd6021cd41df5984ef00698acb1c1151e134c714e0a1be7dcd439c78485
TLSH
T16D21F0ED57EE35C8644CD37028DA6079627B35F43969EF048914A9D1FE4205D499F9C0
MD5 SHA1 SHA512 TLSH

Submit Download

loading.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
Size 1KB
SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
MD5 0620393a949b58f6af37b0accb79e32c
SHA1 0025e4da5ffb8695a8f9731a05b1b89f1a71bf24
SHA512 0d308c758f825d548874cf8b4b8ec20f3685b39c7232246697dd95e5e5f40da7cd21de7ba5faafd0d8a121b5e6b85c5aadc4232e3f0c943535e062ae449ef29e
TLSH
T1333142D111BD0116E11AC365D7FD7AC70B3EB4DB26E558BCB68C250FAB404DB0A9B219
MD5 SHA1 SHA512 TLSH

Submit Download

setup.cfg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\cfgs\setup.cfg
Size 449B
SHA256 81b8cc8d1affd6d91a8ffec9810868a1200e4c4d9586383c7a89d4c4755b0e7b
MD5 f937b461d307be2aeb5b2a2d1470efdd
SHA1 146dd26c540b9a2a0b05aabb6a46f44c8f5756b9
SHA512 ee93ee2ebf2a0097df6225e8310d758c20d37fea3e8de97860cb8004fae8846a05f48c04a58d1be068b1e31d7a38493c48ed9b16a5953b5f0615a5b6f95c243a
TLSH
T14DF0556A0303B0751E61930014BA14F2A3F702C9101B840D6568A88D6B7D83D96BF13A
MD5 SHA1 SHA512 TLSH

Submit Download

ksomisc.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
Size 3.7MB
SHA256 a1839da0804ad31b5e262afc44f77617b0c710b9de7550e5d0039c65f8541e15
MD5 fb4d6e0358badf9205f1d90cd2449312
SHA1 e7ae07235fa1b8994dd6ff3a935c930be533cdba
SHA512 4f8682fb0dabfb75ddbb81eb73ab5d167c81c5acdb9d5be685a6ad7af46d667bbaf5415c09234c0da5cf8c5d65299904a9d7272e27b155b6a0db239db646e0a5
SSDEEP 49152:fBh/6nZ+48AYsFpavN3mCNQJFNIvOL5IfnqJPqpP/j5BzJ0nkgNp+ejE6UiorgNs:aZ+40b2lFWNg3DKg6
TLSH
T1DA067C5BA2E603ECE176D238CB965903F2B638054731AADB11509E750F77BF14EBAB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

error-net-72.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
Size 1KB
SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
MD5 66726a0fbd424ccb700cecb212a47007
SHA1 9795ae26acf0b942ab6a0cd06f206ba69eda18db
SHA512 30ddd2fa17517792a86bdb03827a0809ed362ab2dbd9a7baf194d1f47348c96e0ca8e64515c1a58d7a1740e85f53a3676b49ff6c699d598a27c234c14672604f
TLSH
T1E031C6CD318AC42FCC61D531F4D534156817D760BF928C74102BC5576E0F68E58C6662
MD5 SHA1 SHA512 TLSH

Submit Download

presetLayout_16.pptx

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
Size 41KB
SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
MD5 f41e909b0284949bdd3bea9393a6ff2f
SHA1 a41497f65f44368ad517f464eb0da4403aa700c0
SHA512 d800b9b807a72d19f17bf5bb923d2489328b2f8801c2146b0c67d3d4cd8c70d5f22decd6581ad14d5584f3895140180c8578ede4fa8df755ca742c18cbb3b67b
SSDEEP 768:lwQ75cI1zETv/7H0vFtZKSZTRomseFVEFqG5IphchDB8h/rW7oELmG1wvcG7GyGK:9qNTn81Romse8Fl5ahcVChjQmG1/sl+Q
TLSH
T114139F61D40A142FC263B3F6E478164F73FEE86248179797ACD51096282F97C2E9D38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qingnse.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse.dll
Size 16.5MB
SHA256 cb02773b6291ae8cc4002fe021e5d0833c9f2a1a45ca9c208e00e55da27143a4
MD5 8264dfddf1444d84d96514b887024052
SHA1 27262ccf3f593b9fb656b2559aea9e8227805aab
SHA512 ca0523f1a879145ca478667fef907e86db0abfda6e0f9ddeb4b8f8d6d3aa033f2d64ec365b7c8c1c7b8dd6ea605502189abb1209ce9c89a6843d144909b7dd7d
SSDEEP 98304:DTyj7RVLmcc1KMgr7mDp2l5/tREyJVDOMgKFRYRhu1eZPjcDUqpcreOqRwp/DbeJ:6jVVLmL1Kd7PtRtVixSwcwtptpa
TLSH
T1C8073A0235F1C1A4D40652736A90B6A6A8AC9D26877658CFF34C3E2A1F70ECE573BF15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qingnse64.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll
Size 17.8MB
SHA256 c628432cfa1ffccc717333b1e520cb591aa74478474d9eb3cc80e218f2b4f13d
MD5 1e5cddb0a2bf1b0ff36f0a5638ccdda7
SHA1 3fd12f08c8c3b4eefd0a8aebd72be98d0f54ca1f
SHA512 61b8558112914b6068509dea535e2c9b88c5f3edaf6d5913b4514322bf05aba341d403bb9b36fdd925e25f997eb77f8fe2f6e25fba4dfa2bdc636631e0cbe634
SSDEEP 98304:1Zeu+DlpmeaEtJe18x7sZTQtXHSdO2uvAuHGqRwp/Dbee0:1Z2HmeaCJKhZTQgGGtpm
TLSH
T1CE17284661F441ACD457E136AA526552EAB9BC07433258CF734C3A2B0FB2F998B7FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qingshellext.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingshellext.dll
Size 732KB
SHA256 b355b7629c697225ba5c1b5e5b48af7f311fe9de6aa3c583bc7963e7ca322126
MD5 c6054cded16ccdf5e314411140d4d775
SHA1 f0e15dfe62dca2b5a878a1440ea4ee8e7ce35d00
SHA512 c73c1857fed05772881294f65ac2683458ad0493199e7b96185a3b757b0ec409e51199d079c9fc3de3d47af6fc5c47996f85518b88ee530f637d1ceb5b1d1934
SSDEEP 12288:QmDDSjEZ8CVD+udLF+A0xrMBprUzXLAySdv1YgmWlsVRY4iVqRN:RDWp4+A0xrQdfySV+a4iED
TLSH
T1A4F48D507643C131E46D41B1493CAFBAB97EAD690F7147CBA7D82B2A0D301D22F36E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qingshellext64.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingshellext64.dll
Size 847KB
SHA256 6754552582c153b6ad931f9b9956683ce0af2d8c574d0efe920515dda7a5a4c3
MD5 08fda2b500eb061cd4bf57f5d89eb7ec
SHA1 bbbb9c85febf5a4c3c63190277e9306d282d2177
SHA512 9fed238e29642c4f1874c959245a1e71fcdfdcf40c2ded07f8b71665396eca3219d79fb0652f9ed7fb5d17244d7c336b23a550d057f31cace6d309c1d67b73ef
SSDEEP 12288:8hM2o9FW5hCZVQYb8/EM6En7WYgeWYg955/155/LzNcs23J8MpLNgo9nHOtoHqDf:8hHk4HXEM6En8DgJ8MAVWqDX4in
TLSH
T170058D0666A901BCE0BBD13989579A01F7F27C060770ABDF13A0166E2F777E15A3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qskia.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qt\plugins\platforms\qskia.dll
Size 1.9MB
SHA256 fb9bbb486da8b22248f5235fed71455913b3a237701c43847910034697b75ae9
MD5 53fe4fc91784195701052ccbb5387f7d
SHA1 5558a394f17e646ec9c339df2fd2ec4b49fb134d
SHA512 655cdd2337d547752b5b096cf55bb31191621d9121cec8ee772a7ca490417a0b40478edd2aa65b0a5d093ea8fb9f76b41df4c3991c56bee9f4359c6b10008c35
SSDEEP 49152:zzM/0VBq/JvWW/VQBNYbI6YzexqaHLMmQN7k82a66kTc2Hh2:4/xW/m0
TLSH
T153957D43E3B44298C2A7C13D869B9F0BE6B1740543629BDB2261CF59EF237D21A7E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpscloudsvr.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscloudsvr.exe
Size 1.1MB
SHA256 5d2b4a3bedf86b4c58fcdbca99481f83d1dec309923c26794c1b4d9f8761d470
MD5 6de670809dfec697a1d81bc95e2f1f88
SHA1 5cb938fb5bd11b9362ccfb79ff90617347b63c48
SHA512 bb1e2f2900efbc49d6740fec7200ae791b363e2d9f557d3598e633228d494b04cfbc42e5f2be64c2bef151425ab98036cd15761c8c0983c7b84b2358d49c59ad
SSDEEP 24576:H8nt81URGMadAm1IY5FnzhXKMvPuhBy/RZLZ/2g5e:HEv8h1IYn9u/IZL0n
TLSH
T16C355B4AA2B903FDE0BBD1798D525901E2B63C4607705BCF079027771F6BAE59E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpsoffice.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpsoffice.exe
Size 1.2MB
SHA256 79654a15c88175633251bac8348fdd2181d017d3ecb2bb102e6b979f76a43b05
MD5 264a5b1f0e03c3df23a95323799be7af
SHA1 0bf4d939b2f4859516e1b2425bfad0850c156315
SHA512 c3755ec20d9419fdbc1cb74c39c2a3b509750b4009a78fd8cc06fd51477b1adc6bd25c2a9044ccfcb16a148e0818d922728d2cc57a1d884c00895dbd019296d8
SSDEEP 24576:8U11+u1i0WQTg/3U1pUbiDgahMmILyxl18a8B3WsBQ:8gF1nfak8biDgzmIL+1sBmz
TLSH
T1535519366EAB02ECD3ABD27876525901EEB53C4AC7345ACB02D035763E77AD18E39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\utility\install.ini
Size 626B
SHA256 a099e8a6a9fd4dd3db39c51ce7a47e58ab6a7a73569cbe0fa3a9c17318d52787
MD5 4bd01b66a07ed78bff81f84736456142
SHA1 6044a16cef15624001a390cd4e8636a5b4671440
SHA512 08ef05f9f0f6f62fe07869546c4219c3b125f65dbf0af9cdada079b0e62c067a975f40c271c807c0c681935ddefebcd066989bc011b671f9a118d619580e0206
TLSH
T194F07D084DC5C97E36182188A1E3D5919AEBCF55194C9021E2A76E5BAC47D0A127A02E
MD5 SHA1 SHA512 TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\utility\install.ini
Size 462B
SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
MD5 71e0a7ecd6bd2e91c04a3edf760c45d7
SHA1 e6cf872ce6def16bca98818ba289395580701292
SHA512 282b4c8be6abb97383d7dda8258fbf069fd668f4fad722582567cbc916b5c7da9a39a157a35511210306c19e46ef34c02af17f2af1ec7707bb3d84f3d529c3ca
TLSH
T178F097090C98C66E36282188B0D3C2C0A9ABCE260D0CE410E2D36E1BFC02E0A217E02D
MD5 SHA1 SHA512 TLSH

Submit Download

Qt5CoreKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\Qt5CoreKso.dll
Size 5.7MB
SHA256 cc232fce14f26b48e69205eadbd75d9c480c328dbe64b5ca72b9e5b0711bebc1
MD5 4e5fc0eeffc8d896821a5eac25e3efc1
SHA1 ff34a8082ce57c7bcdd262bac64a75ba172d9025
SHA512 2f6fa4419b644e1a91c810cb95397876163146d678a43fa9180000eedd1f7fd65d569ba4ec5e5756887e792d5dfa432368a5f97c3c39db7d68ca2965ee215849
SSDEEP 98304:Gk8b4Ur34vRrxAzJsv6tWKFdu9Cuijl4rjscak:Gkk4Ur3KRrsJsv6tWKFdu9CuFjscak
TLSH
T1A8567C47FA964269D8B6C238C9D7C127F673B80247214BCF2258A3496A777F0293F359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5GuiKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\Qt5GuiKso.dll
Size 6.4MB
SHA256 0b577ba30dcced8f1d2ea41e21dc26095c372559999a31f92a0a7ab40cc3dec3
MD5 0412f9130425124c3e78e02afdb824b6
SHA1 a292d9f002f35bcae6fecdb16c0b2c73c2b397d0
SHA512 6cc66c82838b33f9bbbbd9ca81177b381bc2e6de13ff7769c5806dd37ad9d6d2b8817c6c42cfd8b99551f58518941bc2012688f12d2c5e4169621f1b3576f513
SSDEEP 49152:64U5Sj1tbrol2fO0hvF8qZijURpWPY5zKcjh3ZdvSfVk/OiMS8yNTIoCinHCBF8w:lU50LJPEhFzAyinHi8Iw5KIjFC
TLSH
T11C66F886EA556359C972D17987CB042FE1F37C4283524BC36D05AB490E237EA1B7FE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5SvgKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\Qt5SvgKso.dll
Size 503KB
SHA256 e879d108fc57815f07dbebf4a94114ab46d41ae1058aae7368ef0f575c7f7b5e
MD5 62627c3e5079202b7df7630715782dac
SHA1 16520812abfc6e7122edc56d696ad20501ab6e6d
SHA512 06f38f8cf42007f85dadb31295648b171bea6efe9842dc5542c37cb2ba20774b27054bda77172ac93a29582f82a671b88be0e50f19423a5f20bbfe209ce09ad4
SSDEEP 12288:9YYYJUNY675fyplktpscRVLEgZ/ABXH9a/vngheZL/XEnEsrnJpaymesGrx1/9k2:9YYY475feysAMZ
TLSH
T1F2B44993FB520798D526D27CC8978806F273340443A39BDF2A5AEB651F236E1763E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WidgetsKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\Qt5WidgetsKso.dll
Size 5.6MB
SHA256 558f41cd447c3e2a25f3823ca5bc9f06142044acb05e6877486d9ad1c85ffc60
MD5 e9057c32520d6dea52d843a3b57e363d
SHA1 cc1560fb2dbc1f0aa729684815c8b1b86f920619
SHA512 5cc69a8d19601bb1b70ec2712e632cfb2fce7c73b7ddcdc79c31b9d353ed7d28c41d43f01d95bd5cca71d6f05cc6473ef2f57393cf37dc0aea35a2e52b4b8c89
SSDEEP 49152:FI0BMMlWiL+bXRedujCAmA8Nv7QURjY9v2RrWuyzgaWt87S15Gc7sRujL71aeeA2:Nln9AK2CjL71aeeA/VytCsJ4SRQQ
TLSH
T1AD466C47FBA50389C16BD13CCACB8513E2B2780447634BCB6969DB691F637E2197E780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WinExtrasKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\Qt5WinExtrasKso.dll
Size 251KB
SHA256 8d4e3c1a0e767477432e276cd064e74cb13fbc4114ecf59dd1df3918089ac42d
MD5 f87a8bec3aee9aeef384117af515e7fd
SHA1 3cea1c99b366e2fa91397f1c8dc1561c07a0d4fe
SHA512 3fdbca6d0a8d34ad136ffb8aa4575d3261792f732755a316b62578721fd80084799daf4b28c555e7ea7c5dfa329f96c98612805ea14f6807c5dead803e3cbd93
SSDEEP 3072:OF5o5cKUM7YLBwcJf1+6Ws2G0+xvN80Zcl2:OfpMWxvN8a
TLSH
T1E3449684B6DD9619F809B0B88FCCD199C223BAED8B47425F351EC39F4B619816E139F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-console-l1-1-0.dll
Size 11KB
SHA256 2afbfa1d77969d0f4cee4547870355498d5c1da81d241e09556d0bd1d6230f8c
MD5 919e653868a3d9f0c9865941573025df
SHA1 eff2d4ff97e2b8d7ed0e456cb53b74199118a2e2
SHA512 6aec9d7767eb82ebc893ebd97d499debff8da130817b6bb4bcb5eb5de1b074898f87db4f6c48b50052d4f8a027b3a707cad9d7ed5837a6dd9b53642b8a168932
SSDEEP 192:4nWYhWxWWFYg7VWQ4uWjXUtpwBqnajrmaaGJ:2WYhWvZqlQGJ
TLSH
T186421A838EFC9543F9A66E701B99D9833C3DABD76910905925A8F19C2CC33D1EB0072D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-console-l1-2-0.dll
Size 11KB
SHA256 00942431c2d3193061c7f4dc340e8446bfdbf792a7489f60349299dff689c2f9
MD5 7676560d0e9bc1ee9502d2f920d2892f
SHA1 4a7a7a99900e41ff8a359ca85949acd828ddb068
SHA512 f1e8db9ad44cd1aa991b9ed0e000c58978eb60b3b7d9908b6eb78e8146e9e12590b0014fc4a97bc490ffe378c0bf59a6e02109bfd8a01c3b6d0d653a5b612d15
SSDEEP 192:iTWYhWyWWFYg7VWQ4uWq6Cu87ZqnajgnLSyu:sWYhWi1XHllk2yu
TLSH
T15B423A93CEFC9543F5A6AD704699D9833C3CABCB2910916536A8F19D2CD33D1EB00A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-datetime-l1-1-0.dll
Size 11KB
SHA256 77577f35d3a61217ea70f21398e178f8749455689db52a2b35a85f9b54c79638
MD5 ac51e3459e8fce2a646a6ad4a2e220b9
SHA1 60cf810b7ad8f460d0b8783ce5e5bbcd61c82f1a
SHA512 6239240d4f4fa64fc771370fb25a16269f91a59a81a99a6a021b8f57ca93d6bb3b3fcecc8dede0ef7914652a2c85d84d774f13a4143536a3f986487a776a2eae
SSDEEP 192:5WYhWYWWFYg7VWQ4SWSS/njxceXqnajLJ35H:5WYhW4gjmAlnJpH
TLSH
T1FE322A838BBC4503FEA32EB042A9D9937D3D67D62A10C12A05B5F1682C937D1EB14B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-debug-l1-1-0.dll
Size 11KB
SHA256 45e48320abe6e3c6079f3f6b84636920a367989a88f9ba6847f88c210d972cf1
MD5 b0e0678ddc403effc7cdc69ae6d641fb
SHA1 c1a4ce4ded47740d3518cd1ff9e9ce277d959335
SHA512 2badf761a0614d09a60d0abb6289ebcbfa3bf69425640eb8494571afd569c8695ae20130aac0e1025e8739d76a9bff2efc9b4358b49efe162b2773be9c3e2ad4
SSDEEP 192:4WYhWFsWWFYg7VWQ4eWZzAR/BVrqnajcJH:4WYhWFMJRLlA5
TLSH
T1E9321B828BFC9103F9A7AFB053D9D9933C3DA7C72910916605A9F45D2CD37D1AB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-errorhandling-l1-1-0.dll
Size 11KB
SHA256 accdd7455fb6d02fe298b987ad412e00d0b8e6f5fb10b52826367e7358ae1187
MD5 94788729c9e7b9c888f4e323a27ab548
SHA1 b0ba0c4cf1d8b2b94532aa1880310f28e87756ec
SHA512 ab65495b1d0dd261f2669e04dc18a8da8f837b9ac622fc69fde271ff5e6aa958b1544edd8988f017d3dd83454756812c927a7702b1ed71247e506530a11f21c6
SSDEEP 192:imxD3vEWYhWnWWFYg7VWQ4eWMOwNbDXbBqnaj0qJm8:iIEWYhWFpLbBlwqJm
TLSH
T146321A928BFC8043F9E76E7017A5D9837C3D77D7295081A506A8F1A92C933D1EF11A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-file-l1-1-0.dll
Size 14KB
SHA256 7cb0396229c3da434482a5ef929d3a2c392791712242c9693f06baa78948ef66
MD5 580d9ea2308fc2d2d2054a79ea63227c
SHA1 04b3f21cbba6d59a61cd839ae3192ea111856f65
SHA512 97c1d3f4f9add03f21c6b3517e1d88d1bf9a8733d7bdca1aecba9e238d58ff35780c4d865461cc7cd29e9480b3b3b60864abb664dcdc6f691383d0b281c33369
SSDEEP 192:+AuVYPvVX8rFTsRWYhWyWWFYg7VWQ4eWQBAW+JSdqnajeMoLR9au:TBPvVXLWYhWiBdlaLFAu
TLSH
T1E962E853D9B4F25BF98FAE315192D843683852C7042541C91BD8A7AD3CE73C5E3D8A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-file-l1-2-0.dll
Size 11KB
SHA256 7a3c5167731238cf262f749aa46ab3bfb2ae1b22191b76e28e1d7499d28c24b7
MD5 35bc1f1c6fbccec7eb8819178ef67664
SHA1 bbcad0148ff008e984a75937aaddf1ef6fda5e0c
SHA512 9ab9b5b12215e57af5b3c588ed5003d978071dc591ed18c78c4563381a132edb7b2c508a8b75b4f1ed8823118d23c88eda453cd4b42b9020463416f8f6832a3d
SSDEEP 192:dzWYhW1sWWFYg7VWQ4yWL3sQlmqnajlD4h1N:BWYhW2e6l94h1N
TLSH
T111323B928BBC4143F9D66E7053E8D9877C3DA3DB2E60815905A9F09D2C837D1EB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-file-l2-1-0.dll
Size 11KB
SHA256 349a79fa1572e3538dfbb942610d8c47d03e8a41b98897bc02ec7e897d05237e
MD5 3bf4406de02aa148f460e5d709f4f67d
SHA1 89b28107c39bb216da00507ffd8adb7838d883f6
SHA512 5ff6e8ad602d9e31ac88e06a6fbb54303c57d011c388f46d957aee8cd3b7d7cced8b6bfa821ff347ade62f7359acb1fba9ee181527f349c03d295bdb74efbace
SSDEEP 192:/VyWYhWjAWWFYg7VWQ4eWiuNwzNbDXbBqnaj0q:/VyWYhW8g+LbBlwq
TLSH
T1C5321AC2CBFC9403F9A76E705299D8877C3DA7C7291081690AA8F5AC2C973C0EB51E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-handle-l1-1-0.dll
Size 11KB
SHA256 c78a1217f8dcb157d1a66b80348da48ebdbbedcea1d487fc393191c05aad476d
MD5 bbafa10627af6dfae5ed6e4aeae57b2a
SHA1 3094832b393416f212db9107add80a6e93a37947
SHA512 d5fcba2314ffe7ff6e8b350d65a2cdd99ca95ea36b71b861733bc1ed6b6bb4d85d4b1c4c4de2769fbf90d4100b343c250347d9ed1425f4a6c3fe6a20aed01f17
SSDEEP 192:P9RWYhWEWWFYg7VWQ4eWncTjxceXqnajLJS:LWYhWk3TjmAlnJS
TLSH
T1BC324DC2CBBC8003F9A76E7047A9D9937D3DA3DB2911816A05A9F1692C933C1DB10B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-heap-l1-1-0.dll
Size 11KB
SHA256 2e981ee04f35c0e0b7c58282b70dcc9fc0318f20f900607dae7a0d40b36e80af
MD5 3a4b6b36470bad66621542f6d0d153ab
SHA1 5005454ba8e13bac64189c7a8416ecc1e3834dc6
SHA512 84b00167abe67f6b58341045012723ef4839c1dfc0d8f7242370c4ad9fabbe4feefe73f9c6f7953eae30422e0e743dc62503a0e8f7449e11c5820f2dfca89294
SSDEEP 192:5t6DjZlTIWYhWsWWFYg7VWQ4eW4MtkR/BVrqnajc:5t6Dll0WYhWMqkRLlA
TLSH
T13E422A85CAEC9103F9676EB053D5D9873C3DB7C62510802615A8F19C2C937D1EB25B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-interlocked-l1-1-0.dll
Size 11KB
SHA256 b02324c49dd039fa889b4647331aa9ac65e5adc0cc06b26f9f086e2654ff9f08
MD5 a038716d7bbd490378b26642c0c18e94
SHA1 29cd67219b65339b637a1716a78221915ceb4370
SHA512 43cb12d715dda4dcdb131d99127417a71a16e4491bc2d5723f63a1c6dfabe578553bc9dc8cf8effae4a6be3e65422ec82079396e9a4d766bf91681bdbd7837b1
SSDEEP 192:nWYhWNWWFYg7VWQ4uWtGDlR/BVrqnajcU8:nWYhWLJDlRLlAU8
TLSH
T165321A828AFC5143FAB76E7042E4D9937C3DB7DB261091550AA8F49C2C877D1FB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-libraryloader-l1-1-0.dll
Size 12KB
SHA256 08484ed55e43584068c337281e2c577cf984bb504871b3156de11c7cc1eec38f
MD5 d75144fcb3897425a855a270331e38c9
SHA1 132c9ade61d574aa318e835eb78c4cccddefdea2
SHA512 295a6699529d6b173f686c9bbb412f38d646c66aab329eac4c36713fdd32a3728b9c929f9dcadde562f625fb80bc79026a52772141ad2080a0c9797305adff2e
SSDEEP 192:FvuBL3BBLZWYhWxWWFYg7VWQ4uW4g0jrQYcunYqnajv9Ml:FvuBL3BPWYhWv8jYulhMl
TLSH
T1A3422BC2CBAC9143F5E65E3042A5CC477C3963DB5960C46906ADE1A82CE33C0EB10B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-localization-l1-2-0.dll
Size 13KB
SHA256 059cb23fdcf4d80b92e3da29e9ef4c322edf6fba9a1837978fd983e9bdfc7413
MD5 8acb83d102dabd9a5017a94239a2b0c6
SHA1 9b43a40a7b498e02f96107e1524fe2f4112d36ae
SHA512 b7ecf60e20098ea509b76b1cc308a954a6ede8d836bf709790ce7d4bd1b85b84cf5f3aedf55af225d2d21fbd3065d01aa201dae6c131b8e1e3aa80ed6fc910a4
SSDEEP 384:NOMw3zdp3bwjGzue9/0jCRrndbwNWYhW6WAulh2:NOMwBprwjGzue9/0jCRrndbw5D
TLSH
T1CE520892C6E8D207F85DAD717167D9437C38A6C50822D95603F6FB2428E33C5E79172D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-memory-l1-1-0.dll
Size 11KB
SHA256 dadbd2204b015e81f94c537ac7a36cd39f82d7c366c193062210c7288baa19e3
MD5 808f1cb8f155e871a33d85510a360e9e
SHA1 c6251abff887789f1f4fc6b9d85705788379d149
SHA512 441f36ca196e1c773fadf17a0f64c2bbdc6af22b8756a4a576e6b8469b4267e942571a0ae81f4b2230b8de55702f2e1260e8d0afd5447f2ea52f467f4caa9bc6
SSDEEP 96:qo1aCFEWYhWwp/DEs39DHDs35FrsvYgmr0DD0ADEs3TDL2L4m2grMWaLNpDEs3OC:teWYhWVWWFYg7VWQ4yWwAKZRqnajl6x7
TLSH
T10E424B818BFCD503F5D72E708399CA977C3EA7C66DA0911902A9F1992CD33D1E710A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-namedpipe-l1-1-0.dll
Size 11KB
SHA256 b57e70798af248f91c8c46a3f3b2952effae92ca8ef9640c952467bc6726f363
MD5 cff476bb11cc50c41d8d3bf5183d07ec
SHA1 71e0036364fd49e3e535093e665f15e05a3bde8f
SHA512 7a87e4ee08169e9390d0dfe607e9a220dc7963f9b4c2cdc2f8c33d706e90dc405fbee00ddc4943794fb502d9882b21faae3486bc66b97348121ae665ae58b01c
SSDEEP 192:cWYhWZSWWFYg7VWQ4eWkcc7ZqnajgnLSp:cWYhW84cllk2p
TLSH
T1E7322B61C7AC8143F9AB6E7042D9D9933C3DA7CB2910C16556ADF9A92C837D0E730B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-processenvironment-l1-1-0.dll
Size 12KB
SHA256 aa415db99828f30a396cbd4e53c94096db89756c88a19d8564f0eed0674add43
MD5 f43286b695326fc0c20704f0eebfdea6
SHA1 3e0189d2a1968d7f54e721b1c8949487ef11b871
SHA512 6ead35348477a08f48a9deb94d26da5f4e4683e36f0a46117b078311235c8b9b40c17259c2671a90d1a210f73bf94c9c063404280ac5dd5c7f9971470beaf8b7
SSDEEP 192:qKWYhWbWWFYg7VWQ4eWYoWjxceXqnajLJe:qKWYhWJ4WjmAlnJe
TLSH
T1D14219C2CBBC5003FAD76D7042A9E4A77C3893E72D1080690564FA693C977D1EB94B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-processthreads-l1-1-0.dll
Size 13KB
SHA256 c9a686030e073975009f993485d362cc31c7f79b683def713e667d13e9605a14
MD5 e173f3ab46096482c4361378f6dcb261
SHA1 7922932d87d3e32ce708f071c02fb86d33562530
SHA512 3aafefd8a9d7b0c869d0c49e0c23086115fd550b7dc5c75a5b8a8620ad37f36a4c24d2bf269043d81a7448c351ff56cb518ec4e151960d4f6bd655c38aff547f
SSDEEP 192:AWXk1JzX9cKSIvWYhWLWWFYg7VWQ4SWW0uI7oinEqnajxMyqY:AWXk1JzNcKSIvWYhW5+uOEle6
TLSH
T1A1520AD5C6FC9183F88AAD306685D9533C3AD7C5192A813106E9F2E93DEB3C2D62462D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-processthreads-l1-1-1.dll
Size 11KB
SHA256 25a99bdf8bf4d16077dc30dd9ffef7bb5a2ceaf9afcee7cf52ad408355239d40
MD5 9c9b50b204fcb84265810ef1f3c5d70a
SHA1 0913ab720bd692abcdb18a2609df6a7f85d96db3
SHA512 ea2d22234e587ad9fa255d9f57907cc14327ead917fdede8b0a38516e7c7a08c4172349c8a7479ec55d1976a37e520628006f5c362f6a3ec76ec87978c4469cd
SSDEEP 192:NtxDfIeA6WYhW7WWFYg7VWQ4eWpB5ABzR/BVrqnajcb:NtxDfIeA6WYhWp28RLlA
TLSH
T17A422A929AFC9043F997AEB052D5E9533C3EB7C72621806515B4F16C2CD73C1EB11A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-profile-l1-1-0.dll
Size 10KB
SHA256 42f4e84073cf876bbab9dd42fd87124a4ba10bb0b59d2c3031cb2b2da7140594
MD5 0233f97324aaaa048f705d999244bc71
SHA1 5427d57d0354a103d4bb8b655c31e3189192fc6a
SHA512 8339f3c0d824204b541aecbd5ad0d72b35eaf6717c3f547e0fd945656bcb2d52e9bd645e14893b3f599ed8f2de6d3bcbebf3b23ed43203599af7afa5a4000311
SSDEEP 192:clIHyZ36WYhWulWWFYg7VWQ4yWqeQDbLtsQlmqnajlDC:clIHyZKWYhWKhlbp6l9C
TLSH
T111320992CBFC4043F5A36E7053D8DA837D3DA3DB6A6081190569F4AD1CC77D0AB6492E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 11KB
SHA256 02d987eba4a65509a2df8ed5dd0b1a0578966e624fcf5806614ece88a817499f
MD5 e1ba66696901cf9b456559861f92786e
SHA1 d28266c7ede971dc875360eb1f5ea8571693603e
SHA512 08638a0dd0fb6125f4ab56e35d707655f48ae1aa609004329a0e25c13d2e71cb3edb319726f10b8f6d70a99f1e0848b229a37a9ab5427bfee69cd890edfb89d2
SSDEEP 192:4GeVvXK9WYhW1WWFYg7VWQ4yWj6k50IsQlmqnajlDl:4GeVy9WYhWzVk6l9l
TLSH
T179422B968BBC5003F5A36E70139ACE8B7D3DA7D729A4812604A5F19D1CC33D4FB14A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-string-l1-1-0.dll
Size 11KB
SHA256 9447218cc4ab1a2c012629aaae8d1c8a428a99184b011bcc766792af5891e234
MD5 7a15b909b6b11a3be6458604b2ff6f5e
SHA1 0feb824d22b6beeb97bce58225688cb84ac809c7
SHA512 d01dd566ff906aad2379a46516e6d060855558c3027ce3b991056244a8edd09ce29eacec5ee70ceea326ded7fc2683ae04c87f0e189eba0e1d38c06685b743c9
SSDEEP 192:byMvQWYhW5fWWFYg7VWQ4eWio3gDwcunYqnajv9JS:byMvQWYhW/BXwulhw
TLSH
T17F321B82DBBC9003F9A36E704799ED877C3CABD72910826516A9F1942CD33C0EB14B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-synch-l1-1-0.dll
Size 13KB
SHA256 a31a15bed26232a178ba7ecb8c8aa9487c3287bb7909952fc06ed0d2c795db26
MD5 6c3fcd71a6a1a39eab3e5c2fd72172cd
SHA1 15b55097e54028d1466e46febca1dbb8dbefea4f
SHA512 ef1c14965e5974754cc6a9b94a4fa5107e89966cb2e584ce71bbbdd2d9dc0c0536ccc9d488c06fa828d3627206e7d9cc8065c45c6fb0c9121962ccbecb063d4f
SSDEEP 192:L1dv3V0dfpkXc2MAvVaoKKDWYhWTJWWFYg7VWQ4uWoSUtpwBqnajrmaaGWpmJ:Zdv3V0dfpkXc0vVaeWYhWj/qlQGWpmJ
TLSH
T1A8522A92D7E8A243F56FEE7046CAC5936C3857C74A20C0261195FAAD3DE33D0EB1562E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-synch-l1-2-0.dll
Size 11KB
SHA256 1c72ac404781a9986d8edeb0ee5dd39d2c27ce505683ca3324c0eccd6193610a
MD5 d175430eff058838cee2e334951f6c9c
SHA1 7f17fbdcef12042d215828c1d6675e483a4c62b1
SHA512 6076086082e3e824309ba2c178e95570a34ece6f2339be500b8b0a51f0f316b39a4c8d70898c4d50f89f3f43d65c5ebbec3094a47d91677399802f327287d43b
SSDEEP 192:ztZ3XWYhW3WWFYg7VWQ4eWNnpit7ZqnajgnLSl:ztZ3XWYhWVg+llk2
TLSH
T1DF422AA6CBAC5203F5A79D7047D9D8833C3DA7DA2950816116BDF1693CA33C1E700E2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-sysinfo-l1-1-0.dll
Size 12KB
SHA256 19c78ef5ba470c5b295dddee9244cbd07d0368c5743b02a16d375bfb494d3328
MD5 9d43b5e3c7c529425edf1183511c29e4
SHA1 07ce4b878c25b2d9d1c48c462f1623ae3821fcef
SHA512 c8a1c581c3e465efbc3ff06f4636a749b99358ca899e362ea04b3706ead021c69ae9ea0efc1115eae6bbd9cf6723e22518e9bec21f27ddaafa3cf18b3a0034a7
SSDEEP 192:fKIMFFyWYhW6WWFYg7VWQ4eWoVjxceXqnajLJ4:fcyWYhWKRjmAlnJ4
TLSH
T11E421992DBBC9203F9A76E7052D5D5833D38A7D62511C11906E9F3B83CA33C5DB50A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-timezone-l1-1-0.dll
Size 11KB
SHA256 3d798b9c345a507e142e8dacd7fb6c17528cc1453abfef2ffa9710d2fa9e032c
MD5 43e1ae2e432eb99aa4427bb68f8826bb
SHA1 eee1747b3ade5a9b985467512215caf7e0d4cb9b
SHA512 40ec0482f668bde71aeb4520a0709d3e84f093062bfbd05285e2cc09b19b7492cb96cdd6056281c213ab0560f87bd485ee4d2aeefa0b285d2d005634c1f3af0b
SSDEEP 192:4EWYhWdWWFYg7VWQ4eWvvJ6jxceXqnajLJn:4EWYhWbwYjmAlnJ
TLSH
T1F24228D3CBB88403FDEB6F7047A9D4937D38A7E61920815909E6E4693C973D1EB10A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-core-util-l1-1-0.dll
Size 11KB
SHA256 5eb724c51eecba9ac7b8a53861a1d029bf2e6c62251d00f61ac7e2a5f813aaa3
MD5 735636096b86b761da49ef26a1c7f779
SHA1 e51ffbddbf63dde1b216dccc753ad810e91abc58
SHA512 3d5110f0e5244a58f426fbb72e17444d571141515611e65330ecfeabdcc57ad3a89a1a8b2dc573da6192212fb65c478d335a86678a883a1a1b68ff88ed624659
SSDEEP 192:dZ89WYhWFWWFYg7VWQ4eW5QLyFqnajziMOci:dZ89WYhWDnolniMOP
TLSH
T1FD322B838BFC8403FAA76D304795DD837C3CA7DA266080A519A8F5992CC37D1EB14B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-crt-conio-l1-1-0.dll
Size 12KB
SHA256 b119adad588ebca7f9c88628010d47d68bf6e7dc6050b7e4b787559f131f5ede
MD5 031dc390780ac08f498e82a5604ef1eb
SHA1 cf23d59674286d3dc7a3b10cd8689490f583f15f
SHA512 1468ad9e313e184b5c88ffd79a17c7d458d5603722620b500dba06e5b831037cd1dd198c8ce2721c3260ab376582f5791958763910e77aa718449b6622d023c7
SSDEEP 192:R0WYhWRWWFYg7VWQ4eWLeNxUUtpwBqnajrmaaG:R0WYhWPzjqlQG
TLSH
T1BF42E68396FC5A03F5535F30A7F9DAC37D3A27D72A506069045AF4A838C23D5AB11A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-crt-convert-l1-1-0.dll
Size 15KB
SHA256 6c008be766c44bf968c9e91cddc5b472110beffee3106a99532e68c605c78d44
MD5 285dcd72d73559678cfd3ed39f81ddad
SHA1 df22928e43ea6a9a41c1b2b5bfcab5ba58d2a83a
SHA512 84ef0a843798fd6bd6246e1d40924be42550d3ef239dab6db4d423b142fa8f691c6f0603687901f1c52898554bf4f48d18d3aebd47de935560cde4906798c39a
SSDEEP 192:JM0wd8dc9cydWYhWyWWFYg7VWQ4eW9jTXfH098uXqnajH/VCf:G0wd8xydWYhWi2bXuXlTV2
TLSH
T14362C65366E42F26F69B177221FEC7D72A394781259143B4C217E54C3883781BDA7C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-crt-environment-l1-1-0.dll
Size 11KB
SHA256 aa3e3e99964d7f9b89f288dbe30ff18cbc960ee5add533ec1b8326fe63787aa3
MD5 5cce7a5ed4c2ebaf9243b324f6618c0e
SHA1 fdb5954ee91583a5a4cbb0054fb8b3bf6235eed3
SHA512 fc85a3be23621145b8dc067290bd66416b6b1566001a799975bf99f0f526935e41a2c8861625e7cfb8539ca0621ed9f46343c04b6c41db812f58412be9c8a0de
SSDEEP 192:6KNMWYhW6WWFYg7VWQ4eWSA5lJSdqnajeMh3:6KNMWYhWKiKdlaW
TLSH
T154420A868BBC5543F6976E7047B9E9437D3C67C7291082650569F1582CC73C0FB11A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-crt-filesystem-l1-1-0.dll
Size 13KB
SHA256 974af1f1a38c02869073b4e7ec4b2a47a6ce8339fa62c549da6b20668de6798c
MD5 41fbbb054af69f0141e8fc7480d7f122
SHA1 3613a572b462845d6478a92a94769885da0843af
SHA512 97fb0a19227887d55905c2d622fbf5451921567f145be7855f72909eb3027f48a57d8c4d76e98305121b1b0cc1f5f2667ef6109c59a83ea1b3e266934b2eb33c
SSDEEP 192:CGnWlC0i5ClWYhWwWWFYg7VWQ4eWtOUtpwBqnajrmaaGN4P:9nWm5ClWYhWQ8qlQGN6
TLSH
T1BF52F78387E86E12FAA71F7156EDDBD73E3D2BC2199282658016A45836C33C07F2255E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-crt-heap-l1-1-0.dll
Size 12KB
SHA256 8166321f14d5804ce76f172f290a6f39ce81373257887d9897a6cf3925d47989
MD5 212d58cefb2347bd694b214a27828c83
SHA1 f0e98e2d594054e8a836bd9c6f68c3fe5048f870
SHA512 637c215ed3e781f824ae93a0e04a7b6c0a6b1694d489e9058203630dcfc0b8152f2eb452177ea9fd2872a8a1f29c539f85a2f2824cf50b1d7496fa3febe27dfe
SSDEEP 192:8a9aY17aFBRAWYhWYWWFYg7VWQ4eWbr0tJSUtpwBqnajrmaaG:8ad9WYhW4F/qlQG
TLSH
T117420A938ABC5543F5A36F706AE8DACB3D3E63D67D5080670157F59829833C0AB2162E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-crt-locale-l1-1-0.dll
Size 11KB
SHA256 edc1699e9995f98826df06d2c45beb9e02aa7817bae3e61373096ae7f6fa06e0
MD5 242829c7be4190564becee51c7a43a7e
SHA1 663154c1437acf66480518068fbc756f5cabb72f
SHA512 3529fde428affc3663c5c69baee60367a083841b49583080f0c4c7e72eaa63cabbf8b9da8ccfc473b3c552a0453405a4a68fcd7888d143529d53e5eec9a91a34
SSDEEP 192:+WYhWoWWFYg7VWQ4eWSoV7jjT6iBTqnajbQwr1:+WYhWIiVTTXZl3QC
TLSH
T132422A468BFC5103F6936EB04AECEA837D3EA7C71A1181A50596F5982C833D8EB11A5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-crt-math-l1-1-0.dll
Size 20KB
SHA256 f6a93fe6b57a54aac46229f2ed14a0a979bf60416adb2b2cfc672386ccb2b42e
MD5 fb79420ec05aa715fe76d9b89111f3e2
SHA1 15c6d65837c9979af7ec143e034923884c3b0dbd
SHA512 c40884c80f7921addced37b1bf282bb5cb47608e53d4f4127ef1c6ce7e6bb9a4adc7401389bc8504bf24751c402342693b11cef8d06862677a63159a04da544e
SSDEEP 192:8JIDSM4Oe59rmkUALQe1hgmL44WYhWWWWFYg7VWQ4yWARgKZRqnajl6umA:8JI2M4Oe59Ckb1hgmLhWYhW2v2yRlwQ
TLSH
T14092A74749DCFF63D18F1BB741F08BCE6A385AA665D1B6B4C81B908434A27C47E83949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-crt-multibyte-l1-1-0.dll
Size 19KB
SHA256 5b3e29116383ba48a2f46594402246264b4cb001023237ebbf28e7e9292cdb92
MD5 a5b920f24aea5c2528fe539cd7d20105
SHA1 3fae25b81dc65923c1911649ed19f193adc7bdde
SHA512 f77f83c7fad442a9a915abcbc2af36198a56a1bc93d1423fc22e6016d5cc53e47de712e07c118dd85e72d4750ca450d90fdb6f9544d097afc170aeecc5863158
SSDEEP 384:4SrxLPmIHJI6/CpG3t2G3t4odXLhWYhWfgy6l9ne:4iPmIHJI6vZO
TLSH
T1CE921D6B8EE82E12E28FD7F3B5F6C7C62A350F9105C07375A26785483841EE9BD52E05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-crt-private-l1-1-0.dll
Size 62KB
SHA256 55bc91a549d22b160ae4704485e19dee955c7c2534e7447afb84801ee629639b
MD5 5c2004daf398620211f0ad9781ff4ec2
SHA1 e43dd814e90330880ee75259809eee7b91b4ffa6
SHA512 11edbbc662584bb1dea37d1b23c56426b970d127f290f3be21cd1ba0a80d1f202047abb80d8460d17a7cacf095de90b78a54f7c7ec395043d54b49ffe688df51
SSDEEP 1536:Se6De5c4bFe2JyhcvxXWpD7d3334BkZn+PI5c:Se6De5c4bFe2JyhcvxXWpD7d3334BkZU
TLSH
T1C05307DB49E63F21E18FF7B76BFB17C90B253A4418806274EAC7556B34853A9BC43A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-crt-process-l1-1-0.dll
Size 12KB
SHA256 191f53988c7f02dd888c4fbf7c1d3351570f3b641146fae6d60acdae544771ae
MD5 dd899c6ffecce1dca3e1c3b9ba2c8da2
SHA1 2914b84226f5996161eb3646e62973b1e6c9e596
SHA512 2db47faa025c797d8b9b82de4254ee80e499203de8c6738bd17ddf6a77149020857f95d0b145128681a3084b95c7d14eb678c0a607c58b76137403c80fe8f856
SSDEEP 192:+nqjd7dWYhWDWWFYg7VWQ4yWMJ5HKZRqnajl6b:+nsWYhWxp5HyRlwb
TLSH
T1604209878BF86953E6675F3082F9D7877F3B53C2690082698456F05D3C833D5AB21A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-crt-runtime-l1-1-0.dll
Size 15KB
SHA256 4390c389bbbf9ec7215d12d22723efd77beb4cd83311c75ffe215725ecfd55dc
MD5 883120f9c25633b6c688577d024efd12
SHA1 e4fa6254623a2b4cdea61712cdfa9c91aa905f18
SHA512 f17d3b667cc8002f4b6e6b96b630913fa1cb4083d855db5b7269518f6ff6eebf835544fa3b737f4fc0eb46ccb368778c4ae8b11ebcf9274ce1e5a0ba331a0e2f
SSDEEP 192:maajPrpJhhf4AN5/KixWYhW4XWWFYg7VWQ4eWvppXjxceXqnajLJhrdCq:mlbr7nWYhW41MXjmAlnJhUq
TLSH
T19572D74397FC7F27E5972B7216F9D7D72E3A638226108179C463B0983883781BD5721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-crt-stdio-l1-1-0.dll
Size 17KB
SHA256 6f6f6e857b347f70ecc669b4df73c32e42199b834fe009641d7b41a0b1c210af
MD5 29680d7b1105171116a137450c8bb452
SHA1 492bb8c231aae9d5f5af565abb208a706fb2b130
SHA512 87dcf131e21041b06ed84c3a510fe360048de46f1975155b4b12e4bbf120f2dd0cb74ccd2e8691a39eee0da7f82ad39bc65c81f530fc0572a726f0a6661524f5
SSDEEP 192:WpPLNPjFuWYFxEpahTWYhWHWWFYg7VWQ4eW9M3u57ZqnajgnLSuRCz:W19OFVhTWYhWlBu5llk2
TLSH
T15682C54785EC7F02E29787331AFAEBEA5A31578338007178C117E99836CA3D87E43559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-crt-string-l1-1-0.dll
Size 17KB
SHA256 45e0835b1d3b446fe2c347bd87922c53cfb6dd826499e19a1d977bf4c11b0e4a
MD5 f816666e3fc087cd24828943cb15f260
SHA1 eae814c9c41e3d333f43890ed7dafa3575e4c50e
SHA512 6860abe8ab5220efb88f68b80e6c6e95fe35b4029f46b59bc467e3850fe671bda1c7c1c7b035b287bdfed5daeac879ee481d35330b153ea7ef2532970f62c581
SSDEEP 384:NFvU4x0C5yguNvZ5VQgx3SbwA7yMVIkFGl/WYhW49PBolniMcx:T5yguNvZ5VQgx3SbwA71IkFwNJT
TLSH
T17482C64386F83F02DA8F57B359FAC7C32E385F46254153B5D467A48C38827A2BE67909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-crt-time-l1-1-0.dll
Size 13KB
SHA256 b48310b0837027f756d62c37ea91af988baa403cbcbd01cb26b6fdae21ea96a2
MD5 143a735134cd8c889ec7d7b85298705b
SHA1 906ac1f3a933dd57798ae826bbefa3096c20d424
SHA512 c9abe209508afae2d1776391f73b658c9a25628876724344023e0fc8a790ecb7dbce75fddae267158d08a8237f83336b1d2bd5b5ce0a8eed7dd41cbe0c031d48
SSDEEP 192:qy5NDSWYhWcQWWFYg7VWQ4eWAcSJR/BVrqnajcm2:qU0WYhWcwASJRLlA
TLSH
T1635209439AE86A07FA971B7212FDD7E73F3917C22A8071758166D4983A93390FE1381D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\api-ms-win-crt-utility-l1-1-0.dll
Size 11KB
SHA256 c81c4bba4e5f205359ad145963f6fbd074879047c66569f52b6d66711108e1ed
MD5 6f1a1dfb2761228ccc7d07b8b190054c
SHA1 117d66360c84a0088626e22d8b3b4b685cb70d56
SHA512 480b4f9179d5da56010fa90e1937fe3a232f2f8682596c16eeaed08f57cf8cffeaa506060429501764f695cb6c5b3e56b0037de948c4d0e3933f022a0b4103d2
SSDEEP 192:GI6fHQduPWYhWcWWFYg7VWQ4yWpbdsQlmqnajlDPD:2f5WYhW8Kd6l9L
TLSH
T1F64229838BFC5643F6A72F7083E8DA833D3E67D6696082654065F5993883BD0FB2151E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

concrt140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\concrt140.dll
Size 316KB
SHA256 2405355f0a58067b258f8df33c327e3a3d716eaac5a3a5aebb757842d85bd376
MD5 5fe9a647921ded8a2fad92deb9ec4ab2
SHA1 1ce87fac4c22aae82a81ddb26952c074b744e78d
SHA512 11fe4c0519cb1df73695ce38b5fdea2a563de565116a47ff0032d5a68b8c51fe732ad66738a7167e56d79193c60af9204a7ee0beae8ff8bb75abd0b484c2d764
SSDEEP 6144:jfjSd54rw5k9cZW1Cbfpri5/ww8VRj7nWzg/p8Wcz:DOP4rwK9c0ILqzocz
TLSH
T16C64398A76140CE6F96BE039C553851BE6F2BC416352D3CB0264839E6F637D1E93A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\dbghelp.dll
Size 1.5MB
SHA256 13f0c74845318b52b76e6000564b1a99c37de48422b44ac74d034fa222c65a23
MD5 a5e4b3ff51cf5b7926d9651908feb666
SHA1 4ef5d229709e40f3f84e46c3a28341eadbd1a044
SHA512 0615ff581b648715461349b1622fbc208042fc8c395cb2d271203b25b036f59edb0fc3470065dc15061af1be0fff48981f55bbea7f00c88906e9b470764a86fa
SSDEEP 24576:xU5lL6v/X5lknycQFrQ8gKt/X95WqbQLZopKjMcqpzd1YWLfY:Kni/X5lknDFUCaQLq8
TLSH
T1A975299BF97941F5DCBAC039D662A627F9B13859832497C367908B562F23BF4983D300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kbaseconfigcenter.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\kbaseconfigcenter.dll
Size 1.7MB
SHA256 38eeb8a0600cffbdbc37ba2970f73613245f4812dd09e2a2826672f11d17689a
MD5 2c932cc118c733399281859ef54a3296
SHA1 7f391129f0b237e5f33a9630c2171e127616c45d
SHA512 38086a210f5eec7d3b1608d8a931360a9f0c2853aa28c43bf3f464525d32477205438f67b6b90d1cdc70d08703c9059736c487bd36f66dd624aee29c8ade749b
SSDEEP 24576:L4SxbeDjYuitJ0yTfcv0eKJSMyXf2WfFVW4DTkgiHQM:L4SxiDjKtey4v0evvJW4+HQM
TLSH
T1F4854A13A30AC86CD18E6F3436142A7E767958760776AEDBA7D42C954E273C09732F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kpacketui.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\kpacketui.dll
Size 870KB
SHA256 9b8b1ffaf8e441f6c7da585141da83eb2ae063d07fcae103843b2f72099171fd
MD5 a504037daac67ccdcf81ef60ac000050
SHA1 6b00e649f10ff3bc4201101dc044b9b287bdcae5
SHA512 f8f5a7e96e5a2505c8dcc28a4f3997660a8962a4c3bebb18484bfe77f9908289f814528f83efc872566a80ad24c870b7fb92ee69866b9a56c34a5e8edd12d91a
SSDEEP 12288:W8gvLWQhG7weQDo043HVoIXP1O66oy9TcPuwg1ZkE9F:W8gvLWl7uDxmHVHXYpFJcjO
TLSH
T100155B0FABA503B9E43AD17AC9C78813E072780643A64BEB5985EE753F733F15939250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\msvcp140_1.dll
Size 35KB
SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
MD5 2a214cb2f0f9473e7765ee3b8db8651e
SHA1 9ce5c3d6c7d94b175f136f552af8771dca6147b3
SHA512 ea9a759babdec5818fa1e430d1cb453cac762cfaa8f934e01d7182100f66cae21527962696f5bd963fcb0fba2c0f38bf4028e75f89e9e599ddee008021646a33
SSDEEP 384:3jJ2J9VQH+qNy09dmFWcS5gW7YZ1gr4iSt+e92xS+R9zWd/I1IHRN7SUl8BR9zTr:d8QH+qNy0PmgogU9v2ci9zeHSn9z3
TLSH
T1C3F25D86F7248442EC674970C699EE837C3DB3D25B50969B17A5F61C0DA33C1FA34A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_2.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\msvcp140_2.dll
Size 273KB
SHA256 3ea06f0ee098b4823cb79599df3780e7f23cce52c19aac31d2a0d47efe33a5e9
MD5 3151333808c2c2339d5f5466df70b7dc
SHA1 e48159bb2127ec812ff679f6fabc41141009f26a
SHA512 8f1daa078e124dc89b51b84baab8d6cc2d77497be23b2ba95ef3fee54d9034e17bf5cd15a4043d025699972cae20f9c46d2e7bef48e4283f3ad9ca6b84fc64d1
SSDEEP 3072:1J51P7emwi1j+XZi7b1dbqtH0h6XV3Q0JPQo07ICl3Sg2xmygdCg2LMeDh5FD799:1JbjwvnQo/iy5L/XxTWrNM
TLSH
T1AD543912B51A2EBFC5D6E8B04939B416FC223A418775C48A57C31C8D9E2BB437FE3529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_atomic_wait.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\msvcp140_atomic_wait.dll
Size 49KB
SHA256 640b2aefced484d0368eea5bdd06addd0658a3a70a49256e560d6923b404a479
MD5 44aec42494531580bca182b0e2fb19c2
SHA1 a85a6a4de6656e5969fa4ab15f2230dfe2839e75
SHA512 d8afb5bbb1394fd14c3ec8ecdd4c02e1c6f23031b15173b1448dfd4915c392bb8512cd41eccb449db19969397a09046d27d54db704c8122ff62c12ff5a89c9d6
SSDEEP 768:ayMsqh8UGchsJr3KbYA5XeDmqw4DYPW9zr0JD0io9z7p1uF:W+UjCKb/5XeCqgazrURgz91G
TLSH
T19C337DDDA7684083E5678634C1A4E517FA7AB7E20710D6EF4352F0890FA37D1AE34B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_codecvt_ids.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\msvcp140_codecvt_ids.dll
Size 31KB
SHA256 f2069a52880ec885ee7f0511186100eb7fada0411a2b4948fafea7735b878a18
MD5 3ece3fb90bfaea8e9a5fb7139ff9cbdc
SHA1 91b19dd0db24a5cbd944eca9c67fad3b53f9c154
SHA512 c059ffd80de25ad10d34064b1e9421666525da67710de0ac445cfc45b8139715dd946f7e90c1e0d719c60e3d5902e3229db4496c87d674c0012c9b4a8c2b2291
SSDEEP 384:p7GVNpd36sRWioEWEw4himRSt+efdDtdQ5R9zpU8NSqHRN7w9ju0R9zlWdo:5GVsfaw4DYd7ds9zmMEu49z0G
TLSH
T19BE27C89DA3C4487EC9B5C7082ACDE477C3D77C60A10569B4392F5181DA33C6EB3866E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
Size 75KB
SHA256 4038b28981414c886b556c8e11e4045d4a8dcacd1ee762941c4c189129b7fa96
MD5 d8f45ea53c3d85fd7b747f61e9bbb3f5
SHA1 dc67e10e52ffc8f2da7bf3e99bec97cc9f49abd2
SHA512 671868f4a8d9635e2f22a64470b2d98cf4192596369993b7c92093d0cc16609ca965acda67d89f81551ff31472c995df21f150e1d5e8277cbdb9861d773877ba
SSDEEP 768:mXOzQ/DBnTQxkUtwZfVKFkYQJc10qTwr6NBv9ZpZSac6mWWriYiDLk5C7uHYyYit:pjf8Jewr6NBV9Sac0+i7beYy77zN
TLSH
T180736B93DB841699E51A8634CAD58A27E6B27842079293CF6728E3680F733D2397D3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
Size 46KB
SHA256 f89f816cc55e3219b33787ff34921e5848c4a1625497e30825e1d9cfafb98285
MD5 c74ca8abac13936f56264ecc9729edbf
SHA1 c0a5b5b058f9a00d965dfb711b7d4a688042a5f8
SHA512 381424130d76319f50211d0afe831b29cfaddb094bd939647f24e62a6da734a6081d9b5c96df306860b38a49f787b0d3c9aa1ef20527887e544d03fdf6cc2bbe
SSDEEP 768:K/6pbQ2EGQ9eLbX8UK5YiDLk5C7kXR6UYi77p5ALepY:vQ2T1bX8UK57boR6U770
TLSH
T170237B97CF240809E9279B70B4C58A26F972B8515B9283CF3194D2694F963C23DBD3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\qt\plugins\platforms\qwindows.dll
Size 1.6MB
SHA256 b0f0847499ecaa2d88cf6675acf0b000ac619a2cc6ecfb6bc31da796d3e76e5f
MD5 9477a15f22f28a43f8e5c96ae0e12d01
SHA1 efa713bfbbf8bb18803fc580f12bc90429a06bb1
SHA512 bd0bf2104c8737330d17903a1b0761c2e17347b96e2703987a778035aace5a7d290d02ff69ac609b509c0b68ffdf7d64089e2d86e8e5ca06f4dcf4e370ccf400
SSDEEP 24576:PkGAzEn7Kn2eozTuqTttIrHhbR2gkNVDosZZ1MFaaVH:Pozu7Kn2xzTuYarHh9cVRMbVH
TLSH
T183756B43E3A44398C16BC239C68B9A07E77174050361ABDF25A09F59EF63BE3177A781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsprintersupport.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\qt\plugins\printsupport\windowsprintersupport.dll
Size 88KB
SHA256 1cd1843672079a7599b0987857380f908eb346a25a9a9c7ec297cd8e9479b645
MD5 60dbbf6238ebda4d44b7a2e5b0ea9b11
SHA1 5c023bdbf05f4db5eea104e6845e1c1f0850169f
SHA512 a78230e519b7b3d17861792c1d7b8117ace400844c2105894888d514827bb05017751b20271c25ea1b6f53ef3fe94e6e0d7ed41ffe2db291a5bfe9ebb74dc01a
SSDEEP 1536:MUOvHEs27LT3nOv3sQwd3OzuxOPN0sObm9H7bV77if:Mvvks2TOv3K3OcOPN0sObm9HNqf
TLSH
T117934A93EA64018CD626C139E4D70A26F732B45517A283CF6768D74D0F237D23EB939A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
Size 159KB
SHA256 cf4257b456d0954611ee0d3937aedbb696a367fda2e12aa81e9db8bdce2a974a
MD5 434dde614096fe3d3526613712f1c6bf
SHA1 691c105d651afe39b8d7ea655c54cd5c49a33cfc
SHA512 2eba00e48795410fb6e24c3ecb1ef636d56d6e2a93e7f917aa5b955a97a24c7eb5bc262cf39fd9cf98038130df01eee6e7668f9354c16506ce3a492dab3958ff
SSDEEP 3072:TSApjXbrT36b96bavsTHnbNgJURjbgSWYhEIcI2oj0Nx:7X6b96bavqHnbNpRWYhEIcn
TLSH
T1EDF33913F65143DAC527D2B8C18A0512F3B37444436257AF25A6DBB82F533A2BD7EAC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\ucrtbase.dll
Size 987KB
SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
MD5 61eb0ad4c285b60732353a0cb5c9b2ab
SHA1 21a1bea01f6ca7e9828a522c696853706d0a457b
SHA512 44cd871f48b5193abb3b9664dbea8cdad19e72c47b6967c685cf1cc803bc9abb48a8a93009c972ef4936e7f78e3c92110828790aa0a9d26b80e6a523bbcd830d
SSDEEP 24576:xOPJ1g7mT6BNvwTOxNfoYotrz1111111r8SoKxmxvSZX0ypdNLh:xO1aNoaxNfo/+a
TLSH
T18D259E64F75C0AA6C17BE17CC95B550ED972340647608ACF03EA8BB97E2BBE91637310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vccorlib140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\vccorlib140.dll
Size 344KB
SHA256 19839407c3fdbc824e5bce189bf68ddf8097f12ec28b757797ffa0415c144ddd
MD5 0b4d02b22ffe3957db27d9cc6cff6edf
SHA1 bec5a8eed4434222956d9f0f0482f8562d992317
SHA512 9588f6e2c96b2793598cd6335bf10cdd53acd77886a5f703118c77af676da1ec3f393d55a1b1dc28dd33bf69c4c5bc70c615f8d41e1829e473ff9bbc1163ea3c
SSDEEP 6144:PpVeNd1C++IAU1qsxEW5QcT2Xgs4hiWi/GDhmVejWXaV+GpfOqmIzt/mtBGgVa0J:Pp0+Xgs4hiWi/GDhmVejWXabO/IzgtK+
TLSH
T16C74E4277B9C4CC3C931A0794E978309E372694207A1E3CB0691970E5F7B7E8AD3B665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_threads.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\office6\vcruntime140_threads.dll
Size 37KB
SHA256 219915cf20822f34d5e7c1fdd4e21ae7f3396881096c51036225fb8f84b47afa
MD5 e57bb2cda101fda5c72f3af09b035bd6
SHA1 77363f6b41d022dbd34e182a93087fc63a5b08cb
SHA512 cab172e140cc2da4444a0c37a42187c4bd29997aa5522f5cf076d8d40cb0116a9e905162349204415213c75ff34cca98cdcc5a7ee9535a8d28945af726545441
SSDEEP 768:CjJ+AiHEFeLUIHmJ9crFciw4DY0zxOW9zeLCbpiFds9z9:+uHEwLUIHscrFcig0zUizGEpiFdkz9
TLSH
T126037C86D7684487E9EA9870C2B9DA47BD3EBBD20B5041DF4381FA480D633C2EA3571D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\pl_PL\style.xml
Size 3KB
SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
MD5 034f37e6536c1430d55f64168b7e9f05
SHA1 dd08c0ef0d086dfbe59797990a74dab14fc850e2
SHA512 0e1911c882152a4e1059a3ce1880d7fb2aed1e1e36cbd37055de2e2a1333acb2a0233ba2a4d969ccebbef1e77809aa5e78807aa9239545beae8c548c0f8f35c0
TLSH
T1E381CA80A610BD0AC563F51573AB7509762CB36383ECCFC4F0EE2E698753652644B63E
MD5 SHA1 SHA512 TLSH

Submit Download

product.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\product.dat
Size 97KB
SHA256 2e844013324b6d0b45e0f68706c289221de46dcb231c45a52cdbfce80bcac54c
MD5 fae72737598e680d5e8ca1b737714b80
SHA1 40043206cfaa2f8dd7e05becb512c94456dc0bcb
SHA512 60fff6d93e507e9d534f185372d09fc1682e57f718f9369d9f5bf572c6880255672ee5cd44c0d7a79b5b778bca354457761e53730c7b79e7c146e454b582fe9e
SSDEEP 1536:1yKvOpT+qaZnhBgrtZE6JjPHUAvSVxel50kydpgnoz:1ybT+rZhBghu6JjvUAKV00kydmnoz
TLSH
T141A37EFB7E1D6BE49CCE233E5E37281CE5F9482525966448E282E5A5AC1C0B73CD790C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product_new.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\product_new.dat
Size 85KB
SHA256 91f7b5037c07e9e6f555e6ca8a1ab34674cce9726f90186364e6d6f89b64a10a
MD5 8cc80027576ea7e10d9274727fce083d
SHA1 ddb16e0fd455ddd8a675aa836533f7e8970079a5
SHA512 35cb8396e9b41d4f90048a89d22a336648a8b05fe2a198894933b07c15d0096feac243bb71a18b6f910a42804b48c19d6773b07722801b1bf6f54e75a30bd4b4
SSDEEP 1536:I3CcyHhFmpUeHipzjsrp4DYDp3Ak3W7th3/h1CCQgKBXskeUzEy74n:2GHDJvIrP19kh5EyKBc9n
TLSH
T1A7832C19DCD16EAD685052791D376C8227B7DDA1A0DD30AC4B12AA4CFC3CF887F72A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e599baa\CONTROL\vi_VN\style.xml
Size 4KB
SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
MD5 394488b30107bcebb84a97ed5d754cee
SHA1 69ebe17f7d577e9bf69c87cff45c3251f0bbc86e
SHA512 24a6bc7debbf7030c1261c69cb4ae7bf3cbb5c7fac315188163c6001e58dfbe2e634925cb767044da7ea0e6d08c709b2ade02f6e43930819e1bef6f7569cad5a
SSDEEP 96:gd6SmSZcFe9gSs8TcySCSi58VS5eQJ/gQkgQ0/Mw8CclQgYzdr/PwiCSeDeR3ciw:gdAh8Ax
TLSH
T13FA17780A610BD0AC563A51977AB7909B62C736383ECCFC4F0EE3E658753692644B63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 387B
SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
MD5 c38481658f9149eba0b9b8fcbcb16708
SHA1 f16a40af74c0a04a331f7833251e3958d033d4da
SHA512 8f98d62f88442b8ef94aa10074e35aa8d9494f3c76ce8b143ca0bf7fa0d917f3175212fbcd6e7b0597fd0ec0e1b2827f157135512fb01c88218d36e2f7dd73ce
TLSH
T1D4E09B1BA8D1B0ABDEB302E988979D54BAC03D9A066D23147762540D3D32918FB41D65
MD5 SHA1 SHA512 TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 433B
SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
MD5 a9519168ca6299588edf9bd39c10828a
SHA1 9f0635e39d50d15af39f5e2c52ad240a428b5636
SHA512 0607eb1f5598320961fbd8ef75beeb1b6dc1af3cae7eeb5ba352f3e2a2edb25e1d9e68fb46c24e4299957352c0c906314c889c2d1092437eccc1d1a0485f3557
TLSH
T194E0540FA891B0679D7302F488E39C007AC03E96055D1210773144093C32A14FB81D69
MD5 SHA1 SHA512 TLSH

Submit Download

WPS Office.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\WPS Office.lnk
Size 2KB
SHA256 c2ba75d8d58824cc2a566bd75f33236c6bfd9e3a1c990e87edda72619e3bf9f5
MD5 e510e40af8324d51dea48979e0f18f20
SHA1 90a79731a02f69f52d37e17e2de1a3d534ab2245
SHA512 6821c836e0dd69ef0b89457f8ca2764ed09f060650cf2397e216a45772c87b13021f341d3c14d5c527202c3746f9c3afe37031b626ad8ca00c00d16ea040a820
TLSH
T13E411101E5D61B24E3FF9D35AAF611116A72B821BA22CA5E2151920D1E15E40ED19F2F
MD5 SHA1 SHA512 TLSH

Submit Download

5f495c40c234747f57cbcaf29f2f3725.prog.tmp

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cache\skia\sksl\120\angle\1414_008c\5f495c40c234747f57cbcaf29f2f3725.prog.tmp
Size 15KB
SHA256 e887d1634983494c28ab7bbe537191b5ba83026d93046a122fd25aade0f5d495
MD5 01d87c9fd2312bb780ccddde0ddf4976
SHA1 09523ea0e2d3de55635b7233d54fdb51471b4d08
SHA512 9b8d62b90212eb14b1fccbc654ec0ce0fa130206aa7b59b2442cff7449b10db226f4fc94717594db6954f3c322e6cf468555c6b6cecce7183dd6fc859b0091e1
SSDEEP 192:mExNQuFZumTwa5D6LT+xEngxqJVbCTIvHBerr3XF1qgUEE00ij7ywdFxsDYq/ztR:VNUB6qJVbSn3Iifyk3sE6
TLSH
T1D7620F0677B0C832CD2EB27C4C8386892739EC914DE1936B744C772D0E772AB5A66ED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7842145f676beb1bc8b95262118f7216.prog

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cache\skia\sksl\120\angle\1414_008c\7842145f676beb1bc8b95262118f7216.prog
Size 12KB
SHA256 00de57c36665ce08587820050efdcb4d534e63c2c1cc2f16ffe38137aa554760
MD5 bde511ba5d4fc3bb212238715c2906c7
SHA1 e5a998d40ad06c79579e84f5e08a0f4b69f7ec40
SHA512 1f5db0fd2987f54f4fb20ab455a13ea4392ea1f7bb3d795264261064b02e78490758e21b242f0cb49d7a5c3d1b9d7b686c5e2281e580d2734f4fd0379971dd77
SSDEEP 192:PKIuFZumTwa5D6LT+xEngxqJVbuTB36R3XF1qgUEE01zvzIFxsDYq/z4k5BEE409:3B6qJVbZn3BzvzI3sE6
TLSH
T17F521D057660C822CE1EB27C4CC7868A2739ECD25EE5835B744C771E0E371AB5BA6EC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

onlineconfig.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cfg\onlineconfig.data
Size 137KB
SHA256 d76ba57d4c267bf1ed6e85fccc064925f46a4878221fb94e64084872532ce4e9
MD5 71ca961ec5f1bdc16adb3f5adbca2f7f
SHA1 c7d8bcc9d5e4f55dd732a513ecc96be16816d521
SHA512 710cf5b49821f2be1d97b09b61f540e23bc92eaa1f506f05fabca9eba3e7babb2b1b8588706e93bef004a780724c399f1bb79b71f89258eed5a78b9bfdb0c106
SSDEEP 1536:TBVC2b6QnHlWsSQyQgQxQlgbZf0P3IjZlIWtJtQtKvUWw2yw:tV16clX6g9QIj/f+4H
TLSH
T182D3E91E72B0DC7BD2836E4D7936BD26360875EA28D694D8B99CC4C97FC0A74012BD93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klogindex

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\klogindex
Size 1KB
SHA256 cfa1478c0995bab2787494ca100d7304b352ebf63262fd1cf926d87f66e110ea
MD5 6196e875f6d2892350fb7ab3035ef46a
SHA1 58a345a184e34a828b30e7cde914f953026d7b94
SHA512 046f50c255878b8ca705db7c0ec08ab1675e51a3d0ff8a4e7461e736611bbd8c2163e174fd895d47f04071bf2504483fd22c4d4af4130e5af9114b5cd845b6ac
TLSH
T1F3310543E6AD9185ACC4B410BE5532326F0B7876AF5CA4B57B8C044D338DF9B2C58E75
MD5 SHA1 SHA512 TLSH

Submit Download

ksomisc_2026_10_01.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_10_01.log
Size 3KB
SHA256 5809a8ae310b4ed1f03cd65e72cff8e741d42d572de993a6d177bf4ac3bd6bd1
MD5 8fa0517a0c449108d153455815ff6314
SHA1 3c33673df3dc6520fc6b2ed65fe9f5246ad33a98
SHA512 63d5fb98efa2def77fb30c48e53c6d4305aef51ff7b97ed1920381365b77453af6950a3c7722eaff7aaf438514e69ff09393e0feabe8ae5084670ffaa18cda36
TLSH
T1746164557AF94145F7F74F8AACE654A34E7ABC93AD20CC0A1950234A48B2F91EC30737
MD5 SHA1 SHA512 TLSH

Submit Download

ksomisc_2026_10_01.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_10_01.log
Size 5KB
SHA256 97b381de164c155cf8df14aeae05595dea664a47baa6eb6121c4a0a9a19e2953
MD5 640cb8ddc232a2963c7b7497bf35a49f
SHA1 e571141a39f865bdaf94082e211571a13671edbf
SHA512 6a840453658bf31bd148e797fd302ac8c81d152e8ba04ebdae16e14af8ad3409f00596edb2a6e985211d54414a9ba43f00c4eab063aef92232ef366ff14acaed
SSDEEP 96:5Q6qYo7qsiWlnH6si+HGnH6vvsi+HznH6si+H3nHVN8si+HVgcpsiWg199siolMA:uRYsqaaWYavvW7aWXn8W643gjRY28L3A
TLSH
T123C15E967AF94155F7F74F86A8FA44A74E7ABC93AD30CC0A1950234948B2F90ED30736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 59KB
SHA256 5e59962f0fde14c58d1f841556245bf1ad21eeae387bfe25c2b954b52af2587f
MD5 013d9a4aa497dbe5327c4dc93d9389db
SHA1 b67d6d98adde8d1e538e9fa828213cf70ed82f35
SHA512 76e32b1743d99d90202ccf063ea03d6a40c5728f2f824b2124649e0a34a1aabd4a55f1886e5b55d8b26b5a0a3e3bd7e2ae96e223fd5f13014dbb605362d55073
SSDEEP 192:RFA6gLpFYy2B6TbgzqXqmG89Lq/YokhgEWgtrXywt/VYceWkTAEcxoTpTrL97B42:oKgUnNFB44XKtDPj8BRSbixZ2Qdh
TLSH
T1085302C64E18E03832FE83C142B6CF4664675A7E230C79543F73E692AEEDE0155EDA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 59KB
SHA256 df36cc4bb094d9c36131263b8ccdf31fb67da89846e739931fff79d813765a9a
MD5 8adaf972a567ff1675e38c8654998a0f
SHA1 611c727e0f0e3efa0fdb7c1fde18932c5652048a
SHA512 1c10c3bb8bd75a32b5d345d9115b1db7c5e0eaabb73551780a0dd99c31b370f8cf4067b6eccbeddac826dca011fadb09258ea8dd84f2ad25545339982014a5da
SSDEEP 192:RFA6gLpFYy2B6TbgzqXqmG89Lq/YokhgEWgtrXywt/VYceWkTAEcxoTpTrL97B45:oKgUnNFB44XKtDPj8BRSbixZ2Qd+
TLSH
T1445302C64E18E03832FE83C142B6CF4664675A7E230C79543F73E692AEEDE0155EDA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 10KB
SHA256 53136e86c62e107b9786009115d8d06130ec961bcdfcea3cb61ce67a83923c17
MD5 1252b0dacaf6c3377c1249621cff14b5
SHA1 824834f793775581502fd0ca405c2f9d433bc463
SHA512 a2b00c2340f1d454905d4cff7894d186797f2497bc82d3726977499dfa312c0fcca84672e0dfb7b37749da2a5662f0a8db06dba143becc1078b2b5e7b5561d2d
SSDEEP 192:RFA6gLpFYy2B6TbgzqXqmG89Lq/YokhgEWgtrXywt/VYceWkTAEcxoTpTT:oKgUnt
TLSH
T1BD22E097825E412C17BD0B3963A2CD8529AA2EED378635A03F33DF9B8FEF850515E414
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 11KB
SHA256 cf9bac19abf23a193e47866f2262f57e13b5d03038d7f2632c19889975ad820f
MD5 7db5bcfb35fb80fa1d783fef50f240a3
SHA1 384754a7181cb5fae26da73189cd701a04f026cd
SHA512 7e0dfb3126a42ce15c109458e9e60c251da9a91d4204cf24be3997f1617cb98d218f1919381db4dee33386f9e7ab5ee6a9bc2634a115cf048da7e7c44c0b6828
SSDEEP 192:RFA6gLpFYy2B6TbgzqXqmG89Lq/YokhgEWgtrXywt/VYceWkTAEcxoTpTrL97B4e:oKgUnNFB44X1
TLSH
T1C032EF97C25D912C13BE0B6A63A2CD8635AA2EFD278534A03F33DF9B4FEE850415E514
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 27KB
SHA256 4cf98d6ca61cc7d227a115d3f090233729277d0bc611c05ec226c41240f0198a
MD5 5e12fb173a41d6b820c7158ab4f5fca1
SHA1 93831a81e4e46ebfa0e13d68df8fcea773e46fe1
SHA512 50c48a81ae77952bec9e90d797f330e8cf9d1ae298568b916b71069f63802ad48abcec91f59e9bb3b031365bfa9a58eff8377203af63b3d3512451877627bf66
SSDEEP 192:RFA6gLpFYy2B6TbgzqXqmG89Lq/YokhgEWgtrXywt/VYceWkTAEcxoTpTrL97B4R:oKgUnNFB44XK/
TLSH
T19ED2DC82421DE01922EE5BC292B5CF8B759B177E774861403F32DBA26EDDF4191ECA1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 67KB
SHA256 a1d3bc54a501ac7a904b83a55c56e51fdebde07c19a0bdcdb4fbc700b21ff171
MD5 2cac3e06e445e5dfe9402111d61b1a3c
SHA1 bcea079fe9eeabf65b66396cd6d0f408a75c201c
SHA512 7c3a7475fae0436bff74d5d9fd19e491773c0a85dcd8a0176ed1de315a89479981c0419076b19446bf2d0dcb388b55fae9ba5cea66b819172f6faea4561b3a4c
SSDEEP 192:RFA6gLpFYy2B6TbgzqXqmG89Lq/YokhgEWgtrXywt/VYceWkTAEcxoTpTrL97B4v:oKgUnNFB44XKtDPj8BRSbixZ2QddHKP
TLSH
T1BF63F0824E18E03823FE87C142B6CE8A64675F7E230C75543F73E6929EEDE0155EDA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdbx.dat

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-x64\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat
Size 64KB
SHA256 a44c5e78f42cfc7e7504f7273f91832de0acabd6e9a9a3602cd1c130c6015fd1
MD5 b2fb3265f1b7fbbbd49c577df7364a82
SHA1 a942fa861f82a7c60b9e76a30e135e9b2853f43b
SHA512 c3f15104bd90fcd7da40f3d57b1a2e48389b5bf9f2141461768c49d5b076c00ced208675dcaf0c16595cbf2c508710d55a021756ec919e641db3f60bb7d0e7ab
SSDEEP 192:vhgSOLZ350+hg6OLZ350tMv7Jrs2hgpUw3XfVOm6StJHcSiW5xsFu2DXxMv7Jrsz:vO/jNOnj2qJFOOwcNS8SiBXxqJFO
TLSH
T1C9538D8CE1D5AFBCE9E916B8B45A4E2FB6FB0789A34A0F093402171578435BE319048F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcsdk_dpv3.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
Size 40KB
SHA256 ea547b6f9c7c0a1a0396991ff7a66bf6fdab856a6a8119bedc97d4ce8b42d730
MD5 907ddccdf9aa2b7997f6ac3d9a6ad7cf
SHA1 2e6fe1e55e21e7927e64d7ada159dbf4eb79cf35
SHA512 8c2b8145ba353d561298f97d6949f993663b49b67d0a2b9d289c737aef8e5bd963c43f642363a9dc87c21714ec25886772df1015d6cfeef55534510808f03a44
SSDEEP 768:h6g6/bAFvHDB9SYBazRdBMImkO8N7X82i5DbP4PSmAE:5AbAlHDB9SYBUskO8JeOd
TLSH
T10E131396BBF90558F6F72F6569B968944C7A7DD22C08E4EC01612C8E0932F90EDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcsdk_dpv3.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
Size 46KB
SHA256 67104840c095176b88f649f306093a11eeb7922923435dce251eccd4c56b8611
MD5 914c155024b75a6a69e80f97d12e833c
SHA1 e58724e257166ba3d85046d49718db191bd653d9
SHA512 f4230400f2a2699040af6378ded3b26c0c802f2fbaa218f1b12e86bbadd8e35a522b9015184151cbc1babe0c8b6cc98b5c624840bd74a5233eb5342f232ab668
SSDEEP 768:6Wwwa8RbbFZhDq9SYBaMdCMwWE0ECPl2ltOLeUeDb+MPsqAN:kr4bbDhDq9SYBVEF4KK
TLSH
T10A230196B7FA1558F6F72F6569B968944C3A7DD22C09E4EC01602C8E0932F90EDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kqingaccountsdk_3.1.0.680\download.7z
Size 3.1MB
SHA256 5765b09095aea16df93873d350cc90777c068a600cbc13972f1ca22a1dfef80e
MD5 df3226667665f5acad674ba37f4e9ec2
SHA1 3b2cafaba672b34767fb91c8bc6153c8d55a09c0
SHA512 1eb5dac09524ea54b7a1ef58eac8e326108a96ef4b58a423b538c7cd8295cd26a478e6d3123b505203351f13d7ce3eaee7037155f4544700c316e9176dc237c8
SSDEEP 49152:ah94fjGxxfRHpF13sAdxd7/ypMHaoApBD1LxWAVKAop8uZChtWYCr8s11PqH8auZ:XfjGxftsAN/wMHvqnorUI8s1ptaw
TLSH
T1CDE5337E5783999DEB0E6428C69DF216440732825E3A20F19EFB8DF907D2CD5A6140FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loading.svg

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kqingaccountsdk_3.1.0.680\resource\vippayment\main\img\loading.svg
Size 1KB
SHA256 a3df9710c7e09fd8cffc14bfe45f5a1576deb1846ced44e5050b34caf5527049
MD5 544223e85768fd134633a1af9d5bf536
SHA1 5536a0023ddbfb2ab67e9ad8ca4d38c60f413b9a
SHA512 a5cacba054d41af8efd607074c02f36ab731b5d6bc9ffd3bd7ce6b09a4af09b31e29359eb965728d2a00849467b1af66e16186a0c07b4415b3b423a5ea4f68ca
TLSH
T1142165D433B77469A49483787FEDB807D05558E21B824964FB8D0915FF001A718BE3C4
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 45dccdf8249297e6e7c6497b6dcf86d4f6548026e146b9b47ab346f4f0dfea05
MD5 0da200111381a3f8fa17dd163aeff68b
SHA1 37634c9f285b42307807732db7404c52781e9fdf
SHA512 d8b4f6621b51dd54277bb43e92f5d235b1ecd8eb913cd32731277db9639860f026acc753570a79d9d9e3975a5a3d456f45f4dcd9bdc1abb355b46fb9af57138d
SSDEEP 12288:WGqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:WGN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1244523253F8DD16BF1E65AB058A8C0387D1F7F658F01928FA7824A6E49349D2DDF102E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 3eb06b2a74b093cabf1bd0fa755358bcbb1d03f951db7952e9a3e084b204a61a
MD5 89dc0b0d81f2dd0638a2ad80907bfd66
SHA1 b940f4d5f32d3275a2f77cc3899d2abe0672737f
SHA512 0856c0a2f1f33b744fd70b743462d6fe60af68a94776ecc6a8fdbc264a5ffbf505e00f419cc5496331c7c134072c89caabb7d2229dd6a85aa971e1f6f59f0bcd
SSDEEP 49152:5a0h2GEkuAe73q3pp46zwwQM95MdTAcQQfjP+:5a0hNYG4JwF0xTQWj
TLSH
T1B7859F1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 e64edabca1e1f1364ec04779d73d65b55d92d2e2ea5118f0f06f6645ae8653b5
MD5 7a4608064988d1d5e9ecddbe29f301ef
SHA1 f6e84ec5bf0561fc0f8ca861ce8c06dea472f232
SHA512 d95c36ab5fa8075177e9c679cf08da205e02ed8f7d2db1d99ed4f80838674114b31535ea9cf26805a581f6c0d59bfec76823e6c4dd1721bf581f15a6d6ac7f9b
SSDEEP 12288:VhbHjfX7qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:VhbHjP7N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1C755127D2BDC10E9F1B2A1788995810ADB31BE250B1193DF23D2827E4F3BED18DB5A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 51c5bd8e76dc7860ad00d879a2da0ea0b16866c8b69e4591ce0d726de5d72237
MD5 0b57eca784fc471f58664647af098b6e
SHA1 be09a3ffa190ca9c9952afb3c52116de0f42d200
SHA512 1acd4cead17482c00c5ad3d84442a4e7d5d24cd24bb8d87e7fc3f65fd44f852567be7353d75074fbb6ba8bd3290269aa23f053583ae53895c4481a311d67e6af
SSDEEP 24576:/3YgnJcRTk4yti+R5dpR/TN94AMdTEvcQFuOjOP95Xdt5c:/IgnaTk46ppR/x95MdTAcQQfjP+
TLSH
T1D345BF2DF6B910B9D8AAD136450143B5FB71782D1F209ACB0170C638AF1AEE89E35F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 52ba627bea49c3c07405c931c26600ba685fef8f8ca0d684215e09361e110625
MD5 6d661b593d7168f862fb70be5c914413
SHA1 033aec86cd41984bd477a971182608d2a61f54f8
SHA512 e002fcd981c2db966eca5de063c3f3bf0ec32d3d18e886e2003cb6f9481bc28ad226c1082c95817a04482d2de378bfc5aea6384ddabe0f6f454f5a7c3266e599
SSDEEP 12288:sSqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:sSN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1194523683F8ED1BFF19656B04CE881786C0A6F518F0252CF63964E6E8A349D3D6F106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 b517368eff9c9c0e18b7a20984323242a6de8948181ec206f359994140a4265e
MD5 04762d9d95ce37db205a4c13ac4308f9
SHA1 8c63aa1ef7db2cb7f0607f82b400251f223490a6
SHA512 eda9ce241bbd00d3cb74e4b584e841bd7725a516f84178996d160807879554182df001505159011c8f1834ccb3b08b4e27ecb4226a2a051fd8223374dca751bb
SSDEEP 12288:bOb9A4LWOsvAYFTxqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:kpL3UTxN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T172750155FB9800F9E96B913CC8B68516E672785D0760E7DF03A84B691F237E28E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 cbbaa7403c248542bc17b5a296c5e53fb866e4278ec0d02a3b2d88a937215a8d
MD5 fcafa513fa8425ecc383d638a24ba45c
SHA1 33031c911ad1adb98c60edf7379681066270805e
SHA512 025ab1e1d228afb5063820df16e1b55d3e239b5669fb5407178f47f626664aa74ae8af4742014b2ea84649ed5ea9a3dae561d888ce5c55caf70d0e6c34fa46d4
SSDEEP 12288:hpFtpOdqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:xOdN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T10C5502293BDD10E9E176A1788992820DE772BD620B1253DF03D085BE4F73FE4ACB6561
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7149c7f939b798225e6bcccc79c83d523c316b1a2eb9633c41b29450bd710f08
MD5 134bb2d9c0623429f3573ffe57d542ad
SHA1 07c52ef6195b144ab82cfbd380b1ee0042321420
SHA512 ae9126821a7c920ee7818414e99c5595fda5f3eb90185401c252156cd4202cb6aeed410c6d5c3daae4c24ed422e51018eca2d8c8913aedc306e785883027cca3
SSDEEP 24576:X7NM9YmZqmWMUkPjZM48Mv6bEhsWN94AMdTEvcQFuOjOP95Xdt5c:X7cBWMpPjN8DbEhJ95MdTAcQQfjP+
TLSH
T15F659E2E6BAC81E5D577D13DC9E28205F6B2B4611B318ACF1252833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9d438adf626e11942fc16b3c6852d8bb8d9f718246aad69df2298f05d57a3d86
MD5 8168adeb63f845716e58259315ad0513
SHA1 3c378841b13f77f691d64598919410ffc8934dab
SHA512 3548f2c260c56294d08f72b29cb95ff78cd1b080ec5a1d8f91393d25a27934224ced206668af8cff82bca9d0f3b4bba1ded78708ffdfafe114248dbcb5193c88
SSDEEP 49152:iF2YuHNETovcvNYf8kme95MdTAcQQfjP+:r6tCf8kL0xTQWj
TLSH
T106857E692BED80A4E0BBD27D45B6D246FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 f5f462c29e50bd7ade01e9a8b187473d08ff298d50ba2c657042cb1ad75199fb
MD5 680085f80cb7fab054c2719c988d57fc
SHA1 426caf04a0ea8804e54ddcbda07080591555aa1a
SHA512 748a74da2d31cc119a4adc8377dfe46e0bf6ba350c5700c28ae647c5245af5272b31b0b898bc36799c587fcbe9266f97de4013265a8fee2830fc43d9ae2e8dc7
SSDEEP 24576:6AFs06+Omlf3NXEbToZN94AMdTEvcQFuOjOP95Xdt5c:DFs060lVXus95MdTAcQQfjP+
TLSH
T12865BF2F66EC00D5E07ED17D8997C91AF6B1746307215ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 191204dbc0549726025e393134b3b364788341669a388764c5a406ff129bdd61
MD5 5d3c44606999893ff29e7f0ed0e0f827
SHA1 a47c36fea80023222a1dc93ea410e6edebe99933
SHA512 7dc785fb5a93ed4df9fd5a2f8faa670ffc778ca743feec9d52df95b436ada040461237edb7a237da3c7aa335308ed865a2bba864211348b24efe656f5be89228
SSDEEP 24576:zJnJ5D3WtUN94AMdTEvcQFuOjOP95Xdt5c:zJnJ5DGts95MdTAcQQfjP+
TLSH
T1C875D02DD29810F8E4B7C274819A1755FE72383D2F226ACB24B4D5397F12EE09979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 92e5688d63e70ee252d961d34b42c843aa58de8cec8031f6ca95fb5615e4481a
MD5 9e2cd77b279d5f95a15debca7c4c7e31
SHA1 db17a78ad2cf16a013a0d2c7a6f0adb29d5b3465
SHA512 071f546ba08b974e37cd448b7eef07824d58d232798c54eebd7de65f42b36a8843e4455ed6aaa78ce209f4ae1cc792521ef06b7737d4eb63c1468b7438bb90c6
SSDEEP 49152:co06DIKdwc+eQnSt65aVa95MdTAcQQfjP+:x40xTQWj
TLSH
T109955C15BBEA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 6c8e10c421bfcc89b2df9bba4f2496ce62e34b9b3b7c5469dce9ea820f1b78bb
MD5 e4e5428673cda24ca8fb37e4939a0f2e
SHA1 94b7d9551d72592015cec9042e96bee188f975f3
SHA512 29da0319aea5e35637aba8566c44e6ec0bc400f799297a2072a3a9d093b99453071c33e50c3ddf9918aaf23aca079e6c014d9f18b130c1a614bdbc8d2ad8a514
SSDEEP 12288:lEP3RrgqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:mrgN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T10355126D3F9DA0EAE166917888A08108D772F5715F0223DF13D2C67E8F37AE25E78911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 7d3b69159ef097657ef83208818a6fbc817b70158a956c1f753ef7afb6b3c041
MD5 a4eebdfe3b1fb8fb542affca94bc9dcf
SHA1 fd283c4684d7d4ad68e998fddb990f250c8c6901
SHA512 7a2f67da7a5fd3eb302eed70fc9906a5e4b897dcd67713eb1bb760bee800ee2f7ec7d095865c9422bdfcfdf259d0bdcd04d146ee43f23a20471d07055d249cef
SSDEEP 12288:qjkyrqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:qIyrN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T172551208378C90E9F6B6067489B281A49E35BE205F1193CF52D1EB3E5F36BD1EDB0616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 d2c41208509b7de74f1a01674327fdcc3d2856f9bb0536f8937a32e10009c3f9
MD5 e9ad1a401f5a8ce997eb222b9823b99a
SHA1 49001381d41a2b404b5007656d3ec0ab6b423fc7
SHA512 38531ee3e1d21cb4eb5ba91870a8a9ffe98e3509c5bbebea9233d3b075a8c875b20fdb47c7029dd4eae1f533e2526a0c5a926552eaa9977655c0ee6084c75126
SSDEEP 12288:LFNqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:JNN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T10545232C3F8EA0BEF59605B048B88168AD1A7F615F0161DF13D28E7ECB359C2D6F1459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 5248e7f33a1690f62dc3c44de4f6e912558c80a84c473a3fc3abd7d308539b54
MD5 0ce7e628870dfd83a850a2d7ecc89b0c
SHA1 ecac2661c83fb8358505991aa6e17d1bdc1781a4
SHA512 47c5c7328dce6131155041e8fa0ed6f87ed91bf65e8af6d79d5fa745600b1ff8da637508b3aa2eef67501410ad68f20f9fa77538af70bb69b9ff2005ca2e222b
SSDEEP 24576:QQ9MxZKdcz97w3eN94AMdTEvcQFuOjOP95Xdt5c:QVKX295MdTAcQQfjP+
TLSH
T1CB558C2DABE9059AE177D27594A250C3A633B4311B31D6CF2448D03D4E7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 893778ae1d165df45bc61407721b092f1dd4621731f5ef3f9e5eac73d566c966
MD5 996ad2429e73e3f37eefc82fbfe8572d
SHA1 c8c83dfcb959e11c303531c759693b7d74d6e668
SHA512 d7ce1e316204e4f51e0a5a7bbc87969bd2408fa267173e2b1081971150a44027b2eb57f627147c4b4f1579dfdd234ebcfb64898bde56316bc325bd98e22f39d9
SSDEEP 24576:QyocxApXN94AMdTEvcQFuOjOP95Xdt5c:docxApd95MdTAcQQfjP+
TLSH
T1A065E01F7BAE40A2E176813C88858245EB73B4305F5253CB6691C73E8F37AE9BD74A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 4e88f76890e0b7093cdc8046ecf8d3c7fd82105d1717cbd02f3f4e3975ced248
MD5 2b9a9b37ad7cbd538d9ba92826e67e7a
SHA1 8e175ebd958501a2834ee27a6c048181ab5810aa
SHA512 9a832e880ec227e9c6608f5c2dc5af011ccce53a91f22957062fe1af5ba1da46dfeac1a584fabe7bcf12c2bd5a77f372405daf050ed6a5e40d5ba540fb2d523d
SSDEEP 49152:rWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKd95MdTAcQQfjP+:b0zuNIB0xTQWj
TLSH
T168A57B3DA2AC00A9D8AAC375C54513A5EE71742E3F2055DB01B0C57CBF2AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-189-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/548-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/548-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/548-68-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/788-103-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/788-11-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/788-20-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/788-19-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1076-474-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1076-239-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1076-236-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1076-230-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1196-218-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/1196-224-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/1196-471-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1196-228-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1588-203-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1588-214-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1588-212-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1588-209-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1588-216-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1724-81-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/1724-8-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/1724-5-0x0000000000CA0000-0x0000000000D07000-memory.dmp

Download

memory/1724-0-0x0000000000CA0000-0x0000000000D07000-memory.dmp

Download

memory/2784-77-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/2784-84-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2784-71-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/2784-85-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/3076-198-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3076-468-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3076-199-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3076-192-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3104-152-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3104-150-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3104-144-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3104-432-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3104-267-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3104-433-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3132-476-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3132-254-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/3132-260-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/3132-264-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3368-115-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/3368-124-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3368-238-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3368-121-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/3824-45-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3824-99-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3824-39-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3824-97-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3824-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3992-32-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3992-26-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3992-35-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3992-130-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4340-131-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4340-251-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4352-426-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4352-165-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4352-162-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4536-467-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4536-190-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4536-186-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4536-180-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4976-49-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4976-57-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4976-55-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4976-175-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5236-133-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5236-263-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/5236-139-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5236-142-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/5708-288-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/5708-472-0x000000000D180000-0x000000000D188000-memory.dmp

Download

memory/5708-268-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5708-274-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5708-276-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5708-325-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/5708-304-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/5708-478-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5732-252-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5732-248-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5732-475-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5980-167-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5980-466-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5980-176-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5980-173-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/6036-490-0x0000019897BD0000-0x0000019897BE0000-memory.dmp

Download

memory/6036-488-0x0000019897BD0000-0x0000019897BE0000-memory.dmp

Download

memory/6036-480-0x0000019897BD0000-0x0000019897BE0000-memory.dmp

Download

memory/6036-484-0x0000019897BD0000-0x0000019897BE0000-memory.dmp

Download

memory/6036-481-0x0000019897BD0000-0x0000019897BE0000-memory.dmp

Download

memory/6036-485-0x0000019897BD0000-0x0000019897BE0000-memory.dmp

Download

memory/6036-486-0x0000019897BD0000-0x0000019897BE0000-memory.dmp

Download

memory/6036-487-0x0000019897BD0000-0x0000019897BE0000-memory.dmp

Download

memory/6036-483-0x0000019897BD0000-0x0000019897BE0000-memory.dmp

Download

memory/6036-482-0x0000019897BD0000-0x0000019897BE0000-memory.dmp

Download

memory/6036-479-0x0000019897BD0000-0x0000019897BE0000-memory.dmp

Download

memory/6036-477-0x0000019895450000-0x0000019897327000-memory.dmp

Download

memory/6036-489-0x0000019897BD0000-0x0000019897BE0000-memory.dmp

Download

memory/6036-493-0x0000019897BD0000-0x0000019897BE0000-memory.dmp

Download

memory/6036-492-0x0000019897BD0000-0x0000019897BE0000-memory.dmp

Download

memory/6036-491-0x0000019897BD0000-0x0000019897BE0000-memory.dmp

Download

memory/6044-94-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/6044-211-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/6044-96-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/6068-111-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/6068-227-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6068-105-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/6068-104-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/7360-11908-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/7484-11066-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/7484-11906-0x0000000140000000-0x00000001401AF000-memory.dmp

Download