hxxps://go[.]wps[.]com/a8M4ofQQ8WW2

Analysis

user interaction
yes
max time kernel
88s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-es
resource tags

arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
25/06/2026, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://go.wps.com/a8M4ofQQ8WW2
Sample260625-155msafw2v

Score

8^/10

bootkit defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
70	3964	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
1424	wps_wid.cid-420611363.1782425729.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4464	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe

Loads dropped DLL 17 IoCs

pid	Process
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe

Unexpected DNS network traffic destination 35 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	223.5.5.5
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	119.29.29.29
Destination IP	223.5.5.5
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	223.5.5.5

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5420	ksomisc.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	wps_wid.cid-420611363.1782425729.exe
File opened for modification	\??\PhysicalDrive0	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
File opened for modification	\??\PhysicalDrive0	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wps_wid.cid-420611363.1782425729.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3964	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268993314959667"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Modifies system certificate store 2 TTPs 36 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\Homegroup Machine Certificates\Certificates	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\Homegroup Machine Certificates	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CRLs	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\Homegroup Machine Certificates\CTLs	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\FlightRoot	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\Homegroup Machine Certificates\CRLs	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\TestSignRoot	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CTLs	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CRLs	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\TrustedDevices	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\Certificates	wps_wid.cid-420611363.1782425729.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	wps_wid.cid-420611363.1782425729.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
2260	chrome.exe
2260	chrome.exe
1424	wps_wid.cid-420611363.1782425729.exe
1424	wps_wid.cid-420611363.1782425729.exe
1424	wps_wid.cid-420611363.1782425729.exe
1424	wps_wid.cid-420611363.1782425729.exe
2260	chrome.exe
2260	chrome.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4464	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4464	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4464	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4464	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4464	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4464	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4464	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4464	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4464	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4464	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4464	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4464	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4768	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2388	2260	chrome.exe	86
PID 2260 wrote to memory of 1516	2260	chrome.exe	87
PID 2260 wrote to memory of 1516	2260	chrome.exe	87
PID 2260 wrote to memory of 3964	2260	chrome.exe	88
PID 2260 wrote to memory of 3932	2260	chrome.exe	89
PID 2260 wrote to memory of 3932	2260	chrome.exe	89
PID 2260 wrote to memory of 1572	2260	chrome.exe	91
PID 2260 wrote to memory of 4296	2260	chrome.exe	92
PID 2260 wrote to memory of 1572	2260	chrome.exe	91
PID 2260 wrote to memory of 4296	2260	chrome.exe	92
PID 2260 wrote to memory of 3756	2260	chrome.exe	93
PID 2260 wrote to memory of 3756	2260	chrome.exe	93
PID 2260 wrote to memory of 2052	2260	chrome.exe	98
PID 2260 wrote to memory of 2052	2260	chrome.exe	98
PID 2260 wrote to memory of 2948	2260	chrome.exe	99
PID 2260 wrote to memory of 2948	2260	chrome.exe	99
PID 2260 wrote to memory of 3032	2260	chrome.exe	100
PID 2260 wrote to memory of 1404	2260	chrome.exe	105
PID 2260 wrote to memory of 2528	2260	chrome.exe	111
PID 2260 wrote to memory of 4500	2260	chrome.exe	112
PID 2260 wrote to memory of 3928	2260	chrome.exe	113
PID 2260 wrote to memory of 1424	2260	chrome.exe	116
PID 1424 wrote to memory of 4768	1424	wps_wid.cid-420611363.1782425729.exe	119

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://go.wps.com/a8M4ofQQ8WW2
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9928fc728,0x7ff9928fc734,0x7ff9928fc740
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,10222597363596273563,8604456923708683121,262144 --field-trial-handle=1972,i,3061548508540372959,8904982854335164501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,10515209746792465806,17425418892002290779,524288 --field-trial-handle=1972,i,3061548508540372959,8904982854335164501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,17423753725135935068,7374810837508047637,524288 --field-trial-handle=1972,i,3061548508540372959,8904982854335164501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,484482934296345361,6856272889096131526,2097152 --field-trial-handle=1972,i,3061548508540372959,8904982854335164501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,3091214056191038523,13248437154286366080,2097152 --field-trial-handle=1972,i,3061548508540372959,8904982854335164501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4412,i,7920382563913916605,5189201026384850427,2097152 --field-trial-handle=1972,i,3061548508540372959,8904982854335164501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4416 /prefetch:2
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4820,i,484818970162093620,5173235690259504909,2097152 --field-trial-handle=1972,i,3061548508540372959,8904982854335164501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4904,i,7946056921141198930,9111620413289786700,2097152 --field-trial-handle=1972,i,3061548508540372959,8904982854335164501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,5493077725941963364,2769189778490907166,524288 --field-trial-handle=1972,i,3061548508540372959,8904982854335164501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6172,i,2242577428136543717,1640874263285215172,524288 --field-trial-handle=1972,i,3061548508540372959,8904982854335164501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,6536779049075128198,3325320265879870506,524288 --field-trial-handle=1972,i,3061548508540372959,8904982854335164501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3680,i,13129269419724116918,14830041635724526969,524288 --field-trial-handle=1972,i,3061548508540372959,8904982854335164501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,12520202460951727087,17274503582569031817,524288 --field-trial-handle=1972,i,3061548508540372959,8904982854335164501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:3928
- C:\Users\Admin\Downloads\wps_wid.cid-420611363.1782425729.exe
  "C:\Users\Admin\Downloads\wps_wid.cid-420611363.1782425729.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
    "C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=es_ES -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:4768
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -checkInstallEnvironment
      4⤵
      PID:9208
  - - C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
      "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService
      4⤵
      PID:4344
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -addFirewallRule
      4⤵
      PID:5124
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpsoffice.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpsoffice.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=klangmanager -dll_name=klangmanager.dll downloadlang es_ES
      4⤵
      PID:6852
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -updatelinkIcon 15 repairAppIcon disbalenewlink
        5⤵
        
        PID:8468
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regarchivefileasso
        5⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -unregvascontextmenushellnew unregwpsaicreate -forceperusermode
        5⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regksee -forceperusermode
        5⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -createCustomDestList -forceperusermode
        5⤵
        
        PID:8436
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regmtfont
      4⤵
      PID:4972
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\\office6\ksomisc.exe" -setappcap
      4⤵
      PID:5560
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -sendinstalldyn 5
      4⤵
      PID:6400
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regPreviewHandler wps.exe et.exe wpp.exe
      4⤵
      PID:6300
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\\office6\ksomisc.exe" -registerqingshellext 1
      4⤵
      PID:7692
    - - C:\Windows\system32\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingshellext64.dll"
        5⤵
        
        PID:7368
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regkwpsshellext admin
      4⤵
      PID:7320
    - - C:\Windows\system32\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\kwpsshellext64.dll"
        5⤵
        
        PID:6940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5988,i,4025657317456494847,1153780261498110890,262144 --field-trial-handle=1972,i,3061548508540372959,8904982854335164501,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:5768

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3472

C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe
"C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1255.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="es_ES" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E595683 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:4464
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -setlng es_ES
  2⤵
  PID:6404
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -getonlineparam 00601.00001255 -forceperusermode
  2⤵
  PID:5276
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -getabtest -forceperusermode
  2⤵
  PID:6068
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -fixoldversionassostatus
  2⤵
  PID:5832
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -setservers
  2⤵
  PID:7268
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -register
  2⤵
  PID:6936
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
    3⤵
    PID:7448
  - - C:\Windows\SysWOW64\regsvr32.exe
      /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
      4⤵
      PID:7400
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
    3⤵
    PID:7556
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regprogid true
  2⤵
  PID:7860
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -assowordexcelpowerpnt 1 1 1 -source=1
  2⤵
  PID:8060
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -compatiblemso -source=1
  2⤵
  PID:8516
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -checkcompatiblemso
  2⤵
  PID:8652
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -saveas_mso
  2⤵
  PID:7064
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -distsrc 00601.00001255
  2⤵
  PID:6412
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode -source=1
  2⤵
  - Network Service Discovery
  PID:5420
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk" 5386
    3⤵
    PID:5736
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -addcontextmenushellnew
  2⤵
  PID:6268
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regvascontextmenushellnew
  2⤵
  PID:5660
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\wtoolex\wpsupdate.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\wtoolex\wpsupdate.exe" /from:setup
  2⤵
  PID:6896
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -collectfileassoinfo -module=1;2;4;8 -daily -source=1
    3⤵
    PID:3620
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\wtoolex\wpsupdate.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\wtoolex\wpsupdate.exe" -createtask
  2⤵
  PID:6824
- C:\Windows\system32\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kdesktopshellext\kdesktopshellext.dll"
  2⤵
  PID:6788
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kdesktopshellext\kdesktopshellext.dll"
    3⤵
    PID:6728
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regyunpanfornew -forceperusermode
  2⤵
  PID:6600
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
    3⤵
    PID:5576
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:overlayicon "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
    3⤵
    PID:5540
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
    3⤵
    PID:7868
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
    3⤵
    PID:7720

C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
1⤵
PID:6476

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"
1⤵
PID:1124
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe"
  2⤵
  PID:7236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 43b230edeb0078e6f97dfeb593e9fd44daf6d13f94053c923050a8dcc7a3ea6f
MD5 59aebe45dfcd3309ac6f7e718247b423
SHA1 a7ea32b209731d07db552449d8fdf51be8e5678e
SHA512 bf41daf2df84a0bf16c8b0ac288b3bc4575c55123b3c0c6434fe0a26b74c2014fc271e785e466d323f967cc7ce3c75860f3e216f213e3c772d470724cd504497
TLSH
T10DF0DCA368FA20D2B41698FC49F9093820B05BCF08D60267383E46928DAB16C624E025
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 727B
SHA256 2a4182b0d46873163af0ac69a315ac4ebb3eb265418d6b648586d1fa2f0dae78
MD5 b9f52c0fcd41e69ab09bb8866473b1c9
SHA1 747928e9a3fea32e64f4ae77b89d783fcc7df0e5
SHA512 3acd03ff015a934f73f3ad0937e560b6737965eba683bbe35668b4f8f450a242538a2b38c43c18b4c9e49fa28efe461f571ca5cc0ad53b56d32c46de9b685f91
TLSH
T1C10160064ABC8B8AA8189620733EDDA2B0A00B646E4C836F206E1084E340360BBD226D
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 9896be4f1e4a2de16d0e12b194b2faf9dc4b2185ba74d32b44a7a876e70a78be
MD5 89cdfa636b0e37a914718dd397178ea9
SHA1 191bb3271a0369ec085534e11f8f549033035561
SHA512 43f28a4e36661609b67155aaa38441e2badec64266d6f3ca6faf0c488c3e9fa22f86ba08ca6fd43550eb1b6ff8cf538b17ca1fb64a100813162a0b90439bb93f
TLSH
T14801497356F85580FC316C42EBFE83E1BD5DA2582E9441B82525054650FCF509D52B55
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 d433d28ec3f20fd9f8802f23162d06c660f25c39adc0b5651b8ab2d34aa9d1ef
MD5 8d1d3d720400d4316e392d4ed448f727
SHA1 7f4a9371c0a6148ed3ae37a5c58313ad15fbd599
SHA512 edec912c5703e76f23c7896f606bbdc269a563bdb9a8b56aecc6ca4cc91f0e692c5eb9fe972d20a7d0e2b2cfae9a03a183c4a8096ceeb9f3115636125368d450
TLSH
T18EE0203017FE502FF2F05BB843D9D0D65F35F1126D5556BF1EC1192D5909A004C52C31
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 404B
SHA256 3e9151c9e79f683602bf7a47856396381666b62816f231ba05aa12c8e8100556
MD5 fac42f5a99c772627a60d6d9c177e9b8
SHA1 a94c915723b436607c5b317a2afedb7f92c955c1
SHA512 75b81bb081f60c30ff92b7b75d04a7df3a10ee6d80ce15060852e75619e3078a05ef1fe0036841862b107964d6639197eced6e7d7180d013120994d8c845f7ff
TLSH
T119E0203422FD055EF1F4D47842E69C214D76F1171545C6651590A359AA15F409CF1634
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 0dd2ee00e1e9b039460d5b893e2552bbc62138871d982dce2a2570aa03c4797e
MD5 599bacb68d67f49e0fb8c0e417730443
SHA1 f48191a23d693ae6528ad4a92b9f70e74a999aba
SHA512 bb7f8ceb47c64492755cd2fe2bbfc4115f6739a6989422815621db07aa444138e0558087d9d4bd75df290dd4270f18470f08f4c94a51438074eeae02124c7ab5
TLSH
T115E06F2822EBA41EF590983086E9A1722EC8E311288493B92AC04308FF4AE00AD10AB0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6b33237dd923fff4e24fee0626cc4791f488b745aaaf001bf75b04b47b069422
MD5 c7f7d283ff90c295bdd32eae5e154ab2
SHA1 408bee2ec3309dfc215d5ea3ddf86a4765fd090e
SHA512 94a765a0aadea40c5e4f7b38d7ffae172234eed047eca07bb5c435201a7f701c96ad2c08ea33efe41f357ae56654b814fa6f39cccb4fb97ba329959bb47cdc76
TLSH
T1F0E02B69C8B1DC3B18F90B19A4105745E754139B2B41CD4B7F7DC10C8FB1A364996C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 9d7357f3175e29616bd099078cf488b5818bfc5bd6afa466361d42c780d351ed
MD5 20fd10f83387756281befeb560457e67
SHA1 a6349eec4e8605f857c9ae51c521ae1e541e7a0b
SHA512 be94cdfae3ee8cd938913c77ae055d97d3047a6ee8bf3fee64561ddffc25cce5bc4903ffda526aa4dd0aa43727ad34897ee9ddb6a508c126b3059a0943acc569
TLSH
T1CAE04F147DA7A02DF72D7871F3C15D417377EE150083DFB5914310BA62667E1D35990A
MD5 SHA1 SHA512 TLSH

Submit Download

4257bb3d-887a-4260-8f13-d80730bf7173.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4257bb3d-887a-4260-8f13-d80730bf7173.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 3a5bd83e7e9a4d8f83085ce30131832747f7c412279d8ffe2ed25e61aabdf818
MD5 d65a7db2616f98979315148a5a056e45
SHA1 e43ee0fd9aad201a758d7d36b2f957759e6de331
SHA512 97551a18899ea6c958482c3f9d873da6c6b30b85d0f2af2535dc104c2d2e1f18788493a0033578ba4c584c3fafc67d17a22856eea3d2d64c70d526855682b3ab
SSDEEP 96:D1SNpvigaIaEd7QKR7ZG5yr/BMIS7VazcSZ/v4/:D1SN5igaIaEd7QKR7ZG5yTBMIS7VazcP
TLSH
T136B1FEF7C3E4892D991196F1AA107E1BCE6D0961433C3D9A8CE4AF0B53F19B2D241B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 81dd6100d732cb042242d3e4523605f1d23381fd96d32a1d2f52076bc283e1ac
MD5 aa7ae4ebdf7b5d8b466708216c010352
SHA1 be09609180df68d670584bd921ea40d40a0ab6b7
SHA512 66882bc3bb70e5ebd7bc809b113f15f7ab579d85c85f19ab32e8e714fcc2114fce90399613f19172b781a4d9f7e3d8624e398e6f50b8c6840c37140882d71687
TLSH
T1174146F3C7EC896D890196F8AA192E1FCE790E14536C3C5788E4AE1B53E2871D25158E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cd499a3f567a16de61e3f6df51936bb16c2c60cd04d7fa0b9077685dfe18085c
MD5 f5094daa80155793d116d90d0c4ce305
SHA1 8cc10883cef15d17cf752c637ed07293cbfab15d
SHA512 231a5f08e422e80dbc7899c15a98797c34d17b704356dfc13f0c2c9a2dd1096726b63df8003a9faa2225563851cb485ee2d3b52e4766ebc18f9ddcf5a9b66a89
SSDEEP 192:IRzhxMeGMQRgEv70pAPRp2d6z9+Hsb+WNpBy3s+N2Nv2BQao+0SVyIsnAUge:IRzhvggUXV8w+H2Ba9e
TLSH
T15B42D62AAA242A7BADDFC62AFD617753D7F6102125D02E84E6FCCA1C09D79CC211701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ef44b8c2988736d2c500a13a79721096d1a7a15bafc15d395282c49fe016371a
MD5 fbb3737a3b03eb79cda2470c2af6da66
SHA1 0752edf81f935eb7c155cac0b88e55cf3c1b5451
SHA512 6d8517995ef5caca79de1e27704e8f9adb800c9d14f9ad6e4df2da5fdedb4d24bc037dfb350763c2f6a32fbc0d5a699b6de5e98754951392f0eed31ba05a7395
SSDEEP 192:IRzhxMeGMQRgJv70pAPRp2d6z9+Hsb+WNpBy3s+N2Nv6BQao+0UVyIsnAUgE:IRzhvJgUXV8w+H2xavE
TLSH
T1F152D62AAA242E7BADDFD629FD617753D3F6202125D01E84E6FCCA1C19D79CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 515fc1bd2105bdc52fd6dfa22fe04c91cafa3d4df30ee8a4ed5e1e6c3642b9cd
MD5 052ee4be2e376bb08190c1e9f324b21a
SHA1 9251c08b8d2c3f44f754b19bb30c5c4a71baee12
SHA512 87d64a55c8f05ef934660a6f0a94a3dd183600fe4e29ac7adc8194ed95d3b72fe1ff84aab29552bda8325f5f084af2e238df6cae1455df1d6e210b587224d2b7
SSDEEP 192:IRzhxMeGMQRgfv70pAPRp2d6z9+Hsb+WNny3s+N2oBQao+0SVyIsnAUge:IRzhv3gUXV8wuH21a9e
TLSH
T14542D72AAA242E3BADDFC629FD617753D7F6102125D02E84E6FCCA1C19D79CC212701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 8502bb5995ad194b1275a0611b7e784592a8ac94f46cfdee73cd255adad61dfb
MD5 34710c734e9fe902ff131aef392eee6a
SHA1 3951d82d90ae8e1ac18ed29f2cb232326fd07b65
SHA512 3560628d973fc33511b7dc8e3ea099951324de872085264edede3199e0561d5a3a16b8c040a538c058cfddcc4245c9f9e76ca7f5f66b1ed997ffc6e59d05fe64
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLILc2jIpXODyJ+ErU3MIH1Rxyg:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97py
TLSH
T100720A676C488D7B0F98C6CCD8267B4FADB5024B65E9C86453FA582903D5BCE11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\b98637bb7ae2171a737905d5907291f63b4218a2\27e161aa-188c-4ad9-bdb2-ef02561346db\index-dir\the-real-index
Size 96B
SHA256 1abc3adcff6378ca921dbdedcdf588292af5d53a089ec5f86ff81bba154617fb
MD5 e0048771c0a850a764f7fb5122b97fa1
SHA1 d553c1e41961e07bee7e7da75e08124b0876c98a
SHA512 c33437f51f3475d11f5732e165ad1b25bcf7990d7b94c53ee85d0a2f12a5138673ad84ebac2af7c6ca5afb50a404e71a76299ef39bb269d7ae00eb60c9d78c49
TLSH
T1ADB0029291010043C24597F4B1E308417F380E2243634B8550D648F9FCF1BCDE7D5905
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589110.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\b98637bb7ae2171a737905d5907291f63b4218a2\27e161aa-188c-4ad9-bdb2-ef02561346db\index-dir\the-real-index~RFe589110.TMP
Size 48B
SHA256 399689c41917633e22465e57b204a1f3e70a44f8bcaffa47b1dc00ed74495a6f
MD5 865c0fce86d0466deaf1a409a1c93de4
SHA1 79f60922c4c2593f503471c42a47e05bc7edbcae
SHA512 fd35115002516fb0309da4b85cdb67ce71b9aec3f66bd0db7a01b1120f8ed91668f425c22d57daa547caf0e020b80d7aea1ce66173571289e9438c3087d6348b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\b98637bb7ae2171a737905d5907291f63b4218a2\index.txt
Size 120B
SHA256 a90b2782ae1c5e2ac06e044458dedfa7fe9af956661b2cfcda8d00110ac7b1a1
MD5 2c98eeef2bdd8f38f7990414f1683d9e
SHA1 a86c70cce80111dfa2473dda3edb1df908fba6c0
SHA512 dc3e3bfe329d9319dfaf2bd61329569ca1e77752733588dc1275140278452ba77eaaa45f91bf2a54ccde083b2192ccd363b276326326812e742b793de68e9d60
TLSH
T150B09BEB5705C2101D06C6D85725F2D59B1784D88481D7D4C820657160746211056909
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58913f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\b98637bb7ae2171a737905d5907291f63b4218a2\index.txt~RFe58913f.TMP
Size 126B
SHA256 1e496e7dbdbc8bcc50d7576271ea761daf788bae780d57b1186ed3b97e2abfcc
MD5 f9dc71d299d245633a0a8f897d2927b5
SHA1 bb93d7bd0ac2a3d38af279bc59c1cb43e9a69581
SHA512 933f75e2ba5ca2d513e5cff8111ff12535d6ed0a9afda76395a0c9b9acfc049000dfc8670aa117e5d19489687d36d1ad0b7b50fdb312e9527640a88e165cf207
TLSH
T11DB09B675715C2101E16C5D45731F2D687274CD48441D7D4D821742150747721055909
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 931e0be93616f5199f62ebbee81288d75b1af81b4c3bcff100340cf9e902c9c3
MD5 2dc8862058b87e536decc61b55c77ff8
SHA1 034897c800a59c460ccb03fbaa5329a4f11d2009
SHA512 d7e84bec0dd9febed46941c1687be04721de564bc91e83b64955ef91ac43efe0ee6739dc99dbe150dc5995cd2c9fe4db9b9a17a1555486850690a2ab67981b74
TLSH
T1F5C01205C402E301C01603F9A183A8BC73649F20DA2F178A4AE019379838272821E27D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588e8f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588e8f.TMP
Size 96B
SHA256 e9c5d9884341cd04e15f13484bf53ed52111638354760231a8e9dc3b4d86c973
MD5 18ae88bd6879d41dc6791ee9323ceabd
SHA1 fdf7b60b1acee470bf512afa7f01819b1761e278
SHA512 20a7c09ebf5ae93b3f013be745653fa25d159d1731866da0ab01270372cfc725f40325a39a116b7dbefc5e8a7e982178be6189594c919cc1cf6dc8369818a272
TLSH
T13FB02200C0022322C00203B02CA888C8B020CF20C38B2382A2F00B32CC202A08330C22
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 156KB
SHA256 b5ef38575254790bba9551cc70103cfd7491f6ca6047835c5783574a35262b2b
MD5 0ea941dea74d4fa7fbe555f295f8ce44
SHA1 1ec44e64829ba98acf9148dd23c4eab4775966fd
SHA512 e4f9c979768ab2e086b560e49e6a7dbadfa6fd7cdc925df19fdfbf6b16fc9f134e23259f59f7a5f8eb2bad0fd8ab40182007c89f29b98f5312d9bd81fab3d4c6
SSDEEP 3072:usTgUIamql6DNk8Civqfd7NtZL8cHQRZEQ6Sps3:lbIamqMNk/ivqZ/ZLW3Ex3
TLSH
T1A4F31233FB451E32CE969B7474230FD662F604A9D030C605ABEE67AF79838D1E49295C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 1339f89c14ceccbfae49284d2acc5a9470e527e3e0cb04cb5f5825e6180c01f8
MD5 dc50fc0f2c612a1d06a0d3f83ad09174
SHA1 e7bacfa89cc69f7bd4b87688eb8596313478db06
SHA512 9a442d17fe196fc0ddc62044148df47924eb3747500f4f9f649cbc3a2350f35fe7bcfb79d7129f78d6da81f9bf0d1dd65e3d47e176781e4f341a55e05f959874
SSDEEP 1536:WhLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:+1qfd7NtZL8cHQRZEQ6Sps3
TLSH
T15AC30237ABC21E339E93CB74B9130FD797B644A99034D301AAAD37EB6C83995644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 92d71a2a9659ddcd4a87e250cc1b09fc37b005c71a0cc7def1bd6b5941a8b8e6
MD5 e4f85d54fd045f25c090d1f471dec7cc
SHA1 744e12e177cfb055ca34f7f806b7cb62a1a939fc
SHA512 54ecf1f0b10cf69c3d7ccc7a90fac9a8ffdcf87c4af262f1f6f0c6812a826c703d47aafc4828950403db7ee725ecf069f3ff56d070ac37d91c69ca4cdd185f67
SSDEEP 1536:bZLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:7qfd7NtZL8cHQRZEQ6Sps3
TLSH
T153C30237ABC21F379E92CF64B9130FD667B644A99030D301AAAD37EB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7adb3a0810052ccd150a0b411ae8a6695df151dc59a76af2115e9562d706dfa6
MD5 74d8abe6f1642768127e8988b375a589
SHA1 0a29e04acc0ac5187ffd6b861cedec32dd38bf69
SHA512 568c3a6db7e94cfed5e392c5aba9ce4068f59044aa67050444c09815bf27c4fb4a6d17162b147a86eb97559eb3ec683740dac2cd4c86aec8dcc7aeda05586d42
SSDEEP 1536:HhLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:B1qfd7NtZL8cHQRZEQ6Sps3
TLSH
T14CC30237ABC21F339E93CB74B9130FD797B644A99034D301AAAD37EB6C83991644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 74c4867c000fad89981c986a73a1251d29d4b7721115db1ae3071e453d5ea9db
MD5 417a244d70e4798ec6bbea61f0038ac5
SHA1 bf8c30628e881e4eba5ec0966ef61c2543bfac24
SHA512 496f4d38a3c9e50f3ec4a3e43d734ee302e78f4c6884b5d8cdad6f8bb05344af7996f73c618fb0e38475e99691cce5a9b5d549d2f95ff307cc4f481ef6adba57
SSDEEP 1536:WCGyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:dMqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1BCC30237EBD21E339DD2DF64B5130ED653F604999034D301EEAD77AB6C83591A44249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5NetworkKso.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\Qt5NetworkKso.dll
Size 1.4MB
SHA256 c1c94dd44d134dee803d48c475ce6692aa8e16fe41c9c2f955e784d9695a3919
MD5 a983ef2aed273449cabc6602b90cfcb5
SHA1 01453314a487e6dbb81999d3e28aebe9cf80a18c
SHA512 5922511dffb3e48a7b70d076903a59824846a67b9036da9e8493e3ed9bc70210ff99a9dfbdcfc8cb275886499d4d55b890100334c1f0c4ff7f6e5194349aca42
SSDEEP 24576:QkbqCgnInomjARXqFrdpEGcqHfwg0gN6+6VQHedk:vNgnOo2q1Gc4YI0+6V+z
TLSH
T1FA655A53F7554399D62AD134CA8BC902F672740083A75BEF2669DB192F337E2263E381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything-KingSoft-wpsdesktop.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\everythingsearch\everythingbinary\Everything-KingSoft-wpsdesktop.ini
Size 104B
SHA256 60791d7a764fa47434e3c25ae6a20703d4f7b3540496da9028e2fc0e5b073f3a
MD5 d9d0b698e8bd1c6d3a1438052880ff7e
SHA1 f4736b7d86e8f4e5bf9797f0ed03f2b355debe0a
SHA512 54400671266c74800568c28f91d4b494f2f588673d9429ed0b5191db27f1fab442152065e0a57c7480d923651b4d3560c0d1b914c54331630605d44047249680
TLSH
T10DB012D587D5C460F3834171DF5601390B0015B88F8C1B3E070B001752A991CF730C15
MD5 SHA1 SHA512 TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\ketaidataanalysis\webview\run.ini
Size 171B
SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
MD5 b30cb271e143eace0f55ea2e562e1e9f
SHA1 9d97dbf24931cfc114384c3f4dbbae21c9e51be5
SHA512 dc593185fa63b458024c3a913c558e5686806154181dea67eec786ada50595c53bab822833ad1e76c9acdf21be3eba50631391b7e575d7f1f6409ceccf966535
TLSH
T1AAC080D4D0256F97DC31C6B5ED54AF1A7560E700251C1EC3D530DC4E9E9696551C805D
MD5 SHA1 SHA512 TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kpubaigcbox\res\dist\index.html
Size 636B
SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
MD5 72cdeca808b16e794ec5b66bd02246bf
SHA1 e75b6c4e084efc8e60c9e4fbe9e9ae02bfbf4132
SHA512 6562ed498bae7f819caa5ebff9ba373b1bbeae3c92befacbc44a72419e6a3aedeee7fe43347d1bf8c46b9c90c8e515181a6dc50c4ad954a640cf6b2520269ed8
TLSH
T1E5F002EA3C25F055CB911EA43DF2F19E245E3AB29DB9DE942AF4513543C03694D0BF48
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kpubaigcbox\res\dist\index.js
Size 2KB
SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
MD5 67dde682d1968824023dd9773f9ec48b
SHA1 81e0a21a7ba2c05193ecc13672a3f537539e0699
SHA512 86bccae3d66df4dd552c12a42d1ed0d57d6cdb7b904caa1f89c874e506fb76412b2df45e3e5f673837cb72aa18b0ab2c1dfb489b1da37068d83d7ccb25d3d8ea
TLSH
T1FD5173C9F79E702209EAE136583F0006E17735596098A1C8B87ED8F16EB555E7077F38
MD5 SHA1 SHA512 TLSH

Submit Download

logo-small.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kskincenter\ksolaunch\normal\logo-small.png
Size 6KB
SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
MD5 8d650fe389e3665607fdbf938c1a1722
SHA1 2e545f9555ff22313e4ce113995d8aa694e5cab8
SHA512 f116621bfecb602d02919eb1ee9d7dc92e82b313b8b54cda42ab48c5e7ec60b02005edcad763fff6b497ca4bc46e83cb0c9a249be791f245bb9c599950fdf015
SSDEEP 192:HSO0z+xgsZ7wNP+agwQznBm2KIvdgoeAtzpZb/D1:yMRoP+z5IIa8hD1
TLSH
T1CCD19EEE6F1CCE4F079D52F7500AC0A9DEA218AA905764D4D68E70B471FE6D120EC5C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kskincenter\ksolaunch\normal\logo.png
Size 12KB
SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
MD5 d58510dca6b659c6e4ba7a454d5b75ce
SHA1 e142de2dda3811a2e8bbbb2eb64d366e8eb9ea3c
SHA512 42409f9976ad08ecf1756d1c2915f3ffd17cdc78e9ff552c0a08bdfa2fda8960e408721bfc9de1a5ed9c9aca3e23b97adb721b3c51b6b3f0ed3ee4a4c780cf88
SSDEEP 192:ySLu8Kp8OtM5IirU31+5AejJ7D+N+QOtHQjrE9aTYpR8XnXrWjvyNTtLJci:NC8o8do1+5D+N+QPE9B2Xn7WrINJP
TLSH
T1BC42C08F68918EB2CE443C39F356115F1FE12A5E7E19A2CF2CE7944A239044ACE1591F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

errPage.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
Size 7KB
SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
MD5 eb3b05c3a3fdef3b0c5c9020756ebb33
SHA1 27c5773e17f9c05f471ccd22db42015561b4e669
SHA512 9a511c6d0aad855448ae45130d7ed031062bb7e6881e68aa2406c7c122220318379c312bc13876599dd7fe88e2beac296adf5bcdc015ef4e0e3f362e76303ab0
SSDEEP 96:9uMJIMzvOcuq4v+nB1W1QjjaKhwc3Rgjfqqm8bm83:9lTgVv+B1W1Q6ywc3RgjfDm8bm83
TLSH
T141F15211D6925216603393B4DFA25719FB260023A3038A38BFECA2558F75C495B93FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicon.ico

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
Size 4KB
SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
MD5 1ba2ae710d927f13d483fd5d1e548c9b
SHA1 c0605efed936ee2600284e6480521d06fa64f872
SHA512 f933cd352eaba92f509b3863353ddfefadfada26a4152ecdc4727d450bbf35e7b10fb3038fe8db340d5c63d74e608c1560ec84d0f6ffc8ccd940c9e0d7533544
SSDEEP 48:i3H5R5hLOR4kt38PduMoglJrd6qTrp9hweFC0+6Ga:ipHFUs4MLBvuyCda
TLSH
T1EE9175DF61C388D9C1B1977F78C449A14F6FD951BA28351F55CF30622E5D75818C1C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwebpromehelp\run.ini
Size 226B
SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
MD5 abc3a6089b0ea76ffc960fbc9b6e66d1
SHA1 50ad0cb201c13799024de56cf45116cf65ff5569
SHA512 ec1e32b7bed882095b23e049a4e1a86acf0bf993e2f691105ffbd99d93ebf28faad4fbdd645ac1eefa74ede575854a3994c7c6d2bacc6f7a09a1991561b1a44b
TLSH
T157D09700C0B5658AC1254C827CA53DC411085B4B27608E02CCF0C34D508EBECE56B08A
MD5 SHA1 SHA512 TLSH

Submit Download

close-secondary.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
Size 216B
SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
MD5 07306930f7d374663bd13e38ea0e92a1
SHA1 12f877e8ab93d874b55d75eef6747615619dad4f
SHA512 4cc0517ed0b9d665df4db93fb3093067e90f64b34f1d41420ed975b4cec64d4cc0aede64092d79c610c04e1ecd9514a9ef48389d5c157b5bcf698fc33670db98
TLSH
T1D8D0223BB3CC8E1CF9224A22F35A713580AF41C3548942E4D8322032E4011CEB93B6E8
MD5 SHA1 SHA512 TLSH

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
Size 334B
SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
MD5 d36fe6147829a72b42e054a5db27d270
SHA1 80779a8eb37d8bb1d5fcc594576f80dbd61fac98
SHA512 94224816f757241b3a6d19788225378ae070fc62b4620e11e10a033e3be5d9cc858cd9e669cc275b1fa82e57094d0df13a6d9868cf00afaa17cf2ec0193acd74
MD5 SHA1 SHA512

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
Size 327B
SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
MD5 18770de3f96bac1e75e588015024fcf8
SHA1 e6254c054edef68f9c27059efd82eeaa69c863b5
SHA512 fcb76291a73d7f2e30f4266ea8f0dfa2d9e203cf9770fb7ffd73cc1994502992fabd0803224c1e1155c1e4b678b5af0e8b3aec114beb1f02299e8885d5a61d0a
MD5 SHA1 SHA512

Submit Download

element-icons.ttf

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
Size 54KB
SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
MD5 732389ded34cb9c52dd88271f1345af9
SHA1 8058fc55ef8432832d0b3033680c73702562de0f
SHA512 e8971ae48f5287d252f5b0a2d0516091bef0d2febf7d01fd7b435e426d106fea251037439ec42c2937e934b66f38e5eb43d00a213cdf334f482f4a06b1817f9c
SSDEEP 1536:qTIRCXXCwinqtuPM16hD2N3SUjbwaST4DCJe:39GEcgD2njb5ST4h
TLSH
T10A433B32436A9BE7F416047F5C1F55830A9F4F22F53DEA8B83A6192514162FD0864BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

element-icons.woff

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
Size 27KB
SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
MD5 535877f50039c0cb49a6196a5b7517cd
SHA1 0000c4e27d38f9f8bbe4e58b5ce2477e589507a7
SHA512 da269b20f13fb5b0bb4628b75ec29e69bb2d36999e94b61a846cb58db679287a13d0aa38cdf64b2893558d183c4cc5df8da770e5a5b2a3288622cd4bd0e1c87b
SSDEEP 768:gOvv6ExpCVxUtrT6w8ClFd80EjPVerMKBaGXjAlEm:Hvv6xVWewtlFdGjPlkFjAlEm
TLSH
T1B9C2E13197213AE9D9824EF876E498FEF1651402290F390E8696ADB3A98D5C73E16831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
Size 107KB
SHA256 c9c5602e26393532e59391d5944a578716f3b6cad104ae20ac8caac805e52f86
MD5 d758ec835091abce0528909c5dadfe24
SHA1 07a9ffb19860ece3293780c707bc71f25a6e5d42
SHA512 74d869f2cc25b5a49adea778f52f59c6f4b7f2eca31c511f19250538d241136a6cbefedccb250a3773500bdc6b9caa57ae7cee40c0dc2d8753f2386e2f390cc4
SSDEEP 3072:KazzQ51KYGqMkYUl26MeCsAcdl6y7tqWD:mMQ/euD
TLSH
T13DB31B37214D132D383BDAA2E55D659A60C8F61BC01253F5FA247B1DCA837873A763AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
Size 279KB
SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
MD5 a3964e72421a1ef5fb60c6e17eb5d705
SHA1 5dd9584be5141e884a230c48746e1c88126b0a55
SHA512 4ce4119b7407b460969041809354c4ede587047ee643f2897eb0ecb9627608431f43fed27c54c70bacff3a6694eb32a85b535c7d6397ac22d7d28e260b0a5467
SSDEEP 1536:39eSBQG+dyAUlHj/8D0Q+SPxZztR+LCrwHFfyqHYb3PPV7BYUOf0I79lDxiRSL2Q:3zfZYKVxiW
TLSH
T14054B6229140212E702BDE3DF7C4EA4AE225C6B3C4125BFEF953651DC7C36AA117778A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
Size 380KB
SHA256 f1bd1ffaba49fd0c0040f182231f739000b0e4bc762900ecacab4980f743b203
MD5 bb8a0b01c0ac1190e643c4e9daf4b69e
SHA1 f0286c3ea896a359666be8f10a7519c767afb321
SHA512 da37ebedf1e5365df105b3bfb559d0dc6a75b2896ad29c844c6b987ac5388139fe88414cc6128144f6fa50086564ea67f257eec54941dd43b124be0b8b276573
SSDEEP 6144:5pK457wXrka10TbOXsEYpHBBs6Ve5NtXoqIpgznl87A6v0eX4AiDuViQbgQgILTv:64G0WtYpmiLlTD8QmIqU1NBqq
TLSH
T1E4846C4B758BBB5A1F35B66340DF3C88D01C6EC09812A5C9FABDD9D09144B9A32D63BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
Size 249KB
SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
MD5 6351ea268f992f52e0f4418a7028b91d
SHA1 5bb3cb88465c550a1fd033a079a8b2eba5e071b8
SHA512 44940d07abfdee6403e9400e596ac5e5eb234ba77a1c90c2fe4086878c12f4805c709eb84538071f21d5710d3569d342e7caea10061e2ab2661c5117c5966297
SSDEEP 3072:p+Xy2rHhkiTtcsuaIwK3zqDLW/ix3Iu7doNFBWgz/bwUzxqcG7gLEOhA:phKHhklsi3zpCdoNFBHz/bwAfG7cW
TLSH
T10A44F8CDB2D1B0A517EB61B4813F610BF27B6499B44E80D0E226E5D4BC7998E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
Size 424KB
SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
MD5 cf29fba214e7f43f2ca1b629109d126b
SHA1 d0dda9486528586af6943abe7a3afa319c790f25
SHA512 2ad7e4711f5917b8d13f861d4fb2688e6ce3951da43a89263a2d9743199e173429398ec1a9537b1df25593d3999dd34fb590e2d2a6e7a632ccc44265d93c3bca
SSDEEP 6144:z8KzCOcC0CXWsJvRekr0dgei/zJbBoCF7az2bzNM:zbzCODTWsJvRbw6zJbBfaz2bC
TLSH
T13694198DB2C1B0A517EB60B4913F610BF23B6469B44E80D4F266E5E57C7898E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
Size 10KB
SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
MD5 0f4634d4af8b73f882440c1181697d86
SHA1 748bb9a14c8a6c64fa060ddcb1b4baebfb3f6fd3
SHA512 eeff081cb256a44ff4557dae145c3d277ad936fef58674cb7d2949b6c302c3a746f05495daa6ccabf39c26bacf13c6fee3bab20de4f1d13810be0503787c89d5
SSDEEP 192:cyxPpQcKb2d4U1nE92Ui6OPl20b3G0qE7I2ByobYGeBv+x9qkgYbeO:zzFZr6OddG0q/yTh3UYx
TLSH
T1AC32C887B30483755A90E790F6C76DA5A93ED0EE73A4168A3CEE421812581DEB3E7CC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
Size 13KB
SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
MD5 dd59d31e84434c59c5c3735bd0b0dc3b
SHA1 c34473850d3749aae725856f68a262a0afebee00
SHA512 f3acd51920f945b49dceb56fd2a5a4ff170c4a5770665bef3d888f8497a288dc33bd15f24780cbe9b8ced585fbacb92a8700d1322a6d4acd2b6e5893370822ac
SSDEEP 192:GwSuCUHXDhEblYfhQ9GYSOqUr9b1AARAU0qWo3wYXVMojXiyaH:dCaXDhEK55YmUrLAgkqWo3RVhpQ
TLSH
T140523295F3C50E22B4991749BA03D57BF19558FAFC2CC18D5CF2D236136C9C986928C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
Size 14KB
SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
MD5 5cee0947c1ef6f00e18eb17cf77388af
SHA1 5a27bc625acfb46d2368a9a376d797ecab912a3a
SHA512 1bf91f08d2a2a446ef0e22df40fd09b090fa300f599bacdd5c698aa61a6fef12ad3d3e38299804a016e5a22a82ddfeb6840cdc7a79ea51244942cb22e659331e
SSDEEP 384:HTO1ksU66rAJGO+NedvSGdv+GfBgLj95LKn:zO1ksU66rAJG5NedKGdv+GfyLj2n
TLSH
T11D6230ACC3CD5C69C86183FA090B35C27836ED49FEA5AE7280EDF4202DA19DFD815674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apm-init.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
Size 57B
SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
MD5 b684f2b8022aaa97ede28f9d224c4db5
SHA1 2087206ddbfd6d6d71f843a132b58ed533d87169
SHA512 8d30da66bfdd99dab88c4b9766b692c39ecbc8dd725e9f858c95993d4f2bf46c37891a1f8f4f1eb6fe09bed7008b8df48d2a9b4f10d7caf20f823f121f6ebb40
TLSH
T19F9002E7F0A1707344616959630722AA35D11130017430010900487434A580FCD22F88
MD5 SHA1 SHA512 TLSH

Submit Download

default_ava.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
Size 906B
SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
MD5 c47a5cfed147c402538358294808e68a
SHA1 8aa499336bc4a50a70710735b67fc5da923fc61a
SHA512 a71831abb9393b6c0ad62feb29fefbb192e1706b08ab88dec0a8e6a9cf61b6a7e106454a7e6e518f69425cc91846036e8fe2956ea939625678f17b330860ba1b
TLSH
T15311E309934DC285960AD7B8563C1754347272DF9E1FD55CE7E633012D3C6AF185C27A
MD5 SHA1 SHA512 TLSH

Submit Download

desk-sync.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
Size 1KB
SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
MD5 c17417f321f52624ee0dc60ed76a31b6
SHA1 b64e19a5b03c92a931fa9a1eba899f491e669a1e
SHA512 bf160829598cf0b22ea48a5f7310adfbd26fbc1bbf23ea3cb8d9cebbeb92b5e81b914bd6021cd41df5984ef00698acb1c1151e134c714e0a1be7dcd439c78485
TLSH
T16D21F0ED57EE35C8644CD37028DA6079627B35F43969EF048914A9D1FE4205D499F9C0
MD5 SHA1 SHA512 TLSH

Submit Download

loading.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
Size 1KB
SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
MD5 0620393a949b58f6af37b0accb79e32c
SHA1 0025e4da5ffb8695a8f9731a05b1b89f1a71bf24
SHA512 0d308c758f825d548874cf8b4b8ec20f3685b39c7232246697dd95e5e5f40da7cd21de7ba5faafd0d8a121b5e6b85c5aadc4232e3f0c943535e062ae449ef29e
TLSH
T1333142D111BD0116E11AC365D7FD7AC70B3EB4DB26E558BCB68C250FAB404DB0A9B219
MD5 SHA1 SHA512 TLSH

Submit Download

setup.cfg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\cfgs\setup.cfg
Size 449B
SHA256 490164b0bf6ef4c3b46356ba03c45e39aed582a8ee229eb9a30a55f602535b54
MD5 a50e3135d2d85ddc3b1ffcc28980e778
SHA1 5a2f2c34a9181545de2f74fac8155d0a5cd38531
SHA512 d62c239be1fa3f06a66d2db5463f83f0d64781bfceb7512351ba0440269b260a8862e67e06563900927c92328cac6916038c04e6711da4cd5b227f8375ff93f5
TLSH
T16CF0E56B0713B0755A21931450B915F2B3FB01C8251B844D2569A88D7B7EC3D86BF13A
MD5 SHA1 SHA512 TLSH

Submit Download

kdesign.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\kdesign.dll
Size 1.3MB
SHA256 61151bf1372baf4401859b4f1b7cf256879c896ae381d13add602b9aae87068f
MD5 481a76b84fce01bb59164a5aaff6f0b9
SHA1 f3de975dbeca68360eee993ce5de6f641b8e69c3
SHA512 b1d89bc8584988ec2074d6de6d17fd1d5904aed7e18fcd2e42c8ebc9395efade41b370fc5bef8f226ed4a1069c17516f841632d01c807e0af213484a2f306ff6
SSDEEP 24576:ujO4YdPOyaKYKNisO8SqRpKYSPp3wmRJe:9tPOyatK8JuKYSPpRe
TLSH
T1EA556E4BEB5683A5C0F9D27AC5CB8516E1F2B84181A38317649FEF293F633629C5D780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krt.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\krt.dll
Size 1.3MB
SHA256 573f2ac053ddf0ad023a0ba257d59fe9a37c29f383923c59afad34b8f89122eb
MD5 379a3ada6bbc64224b810cfa73bdee2c
SHA1 8169e2580ab60a4ff092e673879af10593163857
SHA512 e00e6cdee1796ed14d0d98ecd328cd97a53cdae04c525251cbd483988b72367c8e8e88c5d642da6206a092fdf71325b11b7770252ee9a9e61991fc822595fe22
SSDEEP 24576:8aiaomjY5YVrYQU9LENTDqfZI9Rc4Pf/lHL8jfUgKF:3inmUbQUCByZI9Pf/lHL8jfUgI
TLSH
T1B6657E1BEEA943A8E17AD13CC98B4906E2F23802436197EB16A55F5D1F337E24B7D350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksolite.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksolite.dll
Size 12.3MB
SHA256 fb5fee591d3b5c0f7092c72f3ae44ceb3078e2e42bda1d2edad1c1a00fbc19d9
MD5 14fb40c32a68dc22ab56ea1a7e081e29
SHA1 4495b0dc37250eda25cc89f83f537e387d96ef79
SHA512 e864ae33795e7c50f90f3dd06db38ba4fe08ef9101cea10ff5ca10160f24d3d6d3e3b0db2b9570a0656f44766baae0809b3e1547f3142807b2dde38e2361bbd1
SSDEEP 98304:CS9bOuEDuc4TkJx5iQRdhhGxDavCnFRsJ/wUTA9lDx7Qs:C2qV0kJx5bRdUDaKw/wSAjDx5
TLSH
T1D1D68D5FBBA603E9D1A6C138C99B4902F6B17806872197EB25299F791F333E14D7DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksomisc.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
Size 3.7MB
SHA256 3342f9691125a2214c37b2a5b5fcf43ea3320d838bedd5d6343a22788c25644d
MD5 62b99e1e6782787a026069fd3fbb5b21
SHA1 0db5c24c4c5376220624144ec59808563f326e0b
SHA512 c99253924b30389129d24a1cac05d526db30e370d8a8ba1e8dfafab174c5423965484e816944e30984f02b9b802491148157667e7b5fb3a245f3cdf416cdba3d
SSDEEP 49152:0qPmk0JH6yx1l6Nair+mq9mm4yaEPAD0T1pkBSPIU7BmckP0pPFj5+qa0skgNp+Q:r0JxTVb4ylEEpgYg2gZ
TLSH
T176067D5B62FA03ECE1BBC278D6965903E2B2390687315ADB11549E750F337E19E3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-kso-1_1-x64.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\libcrypto-kso-1_1-x64.dll
Size 3.4MB
SHA256 958d72a1aa20d4f090cfdd00ef5f3711cbf7ef6ec7f1768ee4e335e93c3b3092
MD5 699d6cc6b61bf2a37c6c415f1941ade2
SHA1 ed3311cf1d6d50e72cdbc95b0eb492e09a418e91
SHA512 db31c1688db821683190ee8c44ddcfec0ca771ea3400cbf614123518b1ea4962a586b4506aaa9c712942a2f645ba255c60ead066ec2bd6619a64b9f1fd1181e7
SSDEEP 49152:cOVwASOXFIU6idBGtlqXWq7TsRQuXk0AkOGYYNEhvla9+LEcJQNPn/zsqocj1CPh:XC+Zsu0h9gEx1/zs+1CPwDv3uFHUu
TLSH
T1A2F58D5AA7A80184E5BAC13CC55B4737E3F2B95A17B09BCF18A1C1780F23BD66A3D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

error-net-72.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
Size 1KB
SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
MD5 66726a0fbd424ccb700cecb212a47007
SHA1 9795ae26acf0b942ab6a0cd06f206ba69eda18db
SHA512 30ddd2fa17517792a86bdb03827a0809ed362ab2dbd9a7baf194d1f47348c96e0ca8e64515c1a58d7a1740e85f53a3676b49ff6c699d598a27c234c14672604f
TLSH
T1E031C6CD318AC42FCC61D531F4D534156817D760BF928C74102BC5576E0F68E58C6662
MD5 SHA1 SHA512 TLSH

Submit Download

presetLayout_16.pptx

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
Size 41KB
SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
MD5 f41e909b0284949bdd3bea9393a6ff2f
SHA1 a41497f65f44368ad517f464eb0da4403aa700c0
SHA512 d800b9b807a72d19f17bf5bb923d2489328b2f8801c2146b0c67d3d4cd8c70d5f22decd6581ad14d5584f3895140180c8578ede4fa8df755ca742c18cbb3b67b
SSDEEP 768:lwQ75cI1zETv/7H0vFtZKSZTRomseFVEFqG5IphchDB8h/rW7oELmG1wvcG7GyGK:9qNTn81Romse8Fl5ahcVChjQmG1/sl+Q
TLSH
T114139F61D40A142FC263B3F6E478164F73FEE86248179797ACD51096282F97C2E9D38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qingnse.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse.dll
Size 16.6MB
SHA256 e2ea34864f00c788480fbe6f5c2ed4a23490e248cffcaa4d4363dee20e9bf62c
MD5 a7b6223ac46f1009e0d4d2eb71e1c6a5
SHA1 73ab52ece10172589fb46623fe4b4b685a3ab4eb
SHA512 75a8504f318a4fe5747ee0b4b117a2f8f9cc1f55febf79344ed03baaa275be7bcbd8587cdf98e0f481db4407bffc8a48796d9393d6433b6d2a70ab447ba3d88d
SSDEEP 98304:nIjDfnEWtoakYo+XDXW+ZYC/IQIt8wionfkw45QA6aT68kMN/e5gXNfPmijVGqxK:2DPEWtPkqXNINliosVT+RBue
TLSH
T11F073B0125F5C1A4D40A52727AA076E5A8AC9D27877658CFF34C3E2A1F70ECA173BF19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qingnse64.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll
Size 17.9MB
SHA256 0188fb1815da22f39710fb09979692ecf31a7be22ec72839a6586fa79fda25b0
MD5 c03436c9e354ae68cbd5c113fa1af492
SHA1 066acfb14f15d90735bfb9190b2f95f8313e297a
SHA512 34d35eb9a1010703b122bb55e41612b513e6484b24c6ade18c507299d5b71d65bf893843b830d6f43aaa9ff6db11ec84c1c28e0f5e9d6d46b5afd7e3404d295b
SSDEEP 98304:mmKQr139iu6ThNTULDLbUXP7Ll2gDJ0E2CIzaj1kS3UJNGTSJqxIB/DbeeI:mm3NilhNTo/YXPIg1ck1cqERBa
TLSH
T13A17284621F441ACD457E136AA526552EAB9BC07433258CF734C3A2B1FB2F998B7FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qingshellext.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingshellext.dll
Size 732KB
SHA256 e56d56390437fd60644233bdad6ef18212e78d469ff4643b1668d4d1df48567a
MD5 cc71518400244986058e2deaeda1a292
SHA1 b9ddc52ba1a2db1c81db81c601f455ff36834c05
SHA512 9213ec6ce1913349d5a326177e52b78d2e1ca926fd0f9635276f1e744eb53aae2e0404e4d0b1285f669ec72ef6babf9fdced0dfdb6c53dcea724c68da8ea7dcc
SSDEEP 12288:M1kRqGKfuiOnRhMc0Ihylvpr0zXLAcyXvBZoagH4YLgsT8U4iVFmA+:M+1sc0IhyRd/cyZojX4i/Z+
TLSH
T14CF48C607653C172F46D40B1493CAFBAB57EAD690F7147CBA3C82A2A0D345D22F31E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qingshellext64.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingshellext64.dll
Size 847KB
SHA256 7e3ece12280ffc60953cf97d74a616c239052e7d87aab3a5491dd7b2dca228a6
MD5 09b27b9ac3d2dd7dba922c869c001587
SHA1 cf2166626c8c4bac4d704b271d07ee7cc3a399cb
SHA512 b11629b5b2b8ca64d4b7015a146c3495447a05d1731fc3ebd8943e99ffa1f0f619b875c186d47011796ae1ce415579999c93e20300d15853242c4f7c88708b90
SSDEEP 12288:5dHdBtugQsp05JbvcqVkuhsKmBgWYgeWYg955/155/JmIUXi1W2msbNogoHJEUCN:5d9B0g0HcqfhsKmBPFkWW2PBI5CT4iR
TLSH
T13D057B0666AD01BCE0BBD13989579A01F7F27C0607719BDF13A0166A2F77BE15A3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qskia.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qt\plugins\platforms\qskia.dll
Size 1.9MB
SHA256 ed2434466d697329e29941aea13b87bf104679652c7c33bd1b358b6fd623ae67
MD5 e4c5e812619ab113ac309244c200a37c
SHA1 8bdd28a1013215fff4191fe382e00aef938e862b
SHA512 6fa606ab52e8e0b75bc6384208babe90f07271b51dbbc17b72c0e4cff800b51de0a1be37a705e30837534b85abad2b7f75dcfbedb02f7e93096e03142ae245bd
SSDEEP 49152:v0rOoPmNWAG+mr9gb7jxSfL0FHYX52k2ik82a66kTcAjY:6mNWERY
TLSH
T1F1957C43E3B44299C2A7C13D869B8F0BE6B1740543619BDB2690CF59EF237E21A7E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpscloudsvr.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpscloudsvr.exe
Size 1.1MB
SHA256 f5726c54eabfa893b1cebeba9c9b9731715faec9e01d137d705f70150375fdf8
MD5 ffbba1782f20a683a6e1c65e6ed54618
SHA1 fbd85ac9eb4586c48f191b79d9a5f7218cee2691
SHA512 85a50e430508255d1e48a94353ea43b40332b71a0b8b406e78cef5726c808b96b3cfc76bc08305a776994b593351bd85649e3c3ec06750e4c6228ee352719136
SSDEEP 24576:3GkDhWVvkc7xEItMad32IV0cZZl7KyfHGoiZYaYA:3BNHqSa12IVblHGZZYaT
TLSH
T1AF356B4A63B902FDE0ABE1798D525905E2B63C0607B05BCF079067771F7BAE95E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpsoffice.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpsoffice.exe
Size 1.2MB
SHA256 c70e66e699cf1b6a61ee1c77360203cbcd4cb5f401fa390cc8eda7b7c8fa9b6b
MD5 ed12b41dff76f0c341d093ff22fa63cd
SHA1 286246c144a113abd9ff954b3a0e29cd9a08f7b5
SHA512 05d3c3f661d2b02e566efa0c7f58b699750d1b266817c22ee34bad54a5c20cd2c384183bc91b495cae5f5d940ea3cc62c9ad1b156404a554a8fde157581406e1
SSDEEP 24576:LD/tF/gTs5QQeHO5W/P0VBoIhw1yiP6BS9cEf:LZFYTs5QH4AKSIh7iCBXc
TLSH
T185451A366EAB02ECD36BD2787A525901EDB53C4AC7255ACB02D035763E77BE18E39310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\utility\install.ini
Size 499B
SHA256 514656186e18e09dbe3efcf8c38934803b1eca3cdb39847809e51e441bcbcaa1
MD5 0714d37ce4fc179602d83b687b6a6ae7
SHA1 5f1fb78fe8a479016fde988be224613ef2bcecd5
SHA512 668801e71484fb6a4fdc07056133c9885a7568a7889c8048958b4d6df6b0e039e2916ef4764b5e64b2540b1e506f91ad79b19de3c485a1d405cd51418c470295
TLSH
T1A5F0590A0D94C66E35282298B0E3D6C1AAAF8E25194CA410D2D36E17FC03D2E117E05E
MD5 SHA1 SHA512 TLSH

Submit Download

Qt5CoreKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\Qt5CoreKso.dll
Size 5.7MB
SHA256 ae105320fafecbdf6e26a3c2ac51bff164ed60e2c80d7c2a909f7c8abf350d21
MD5 0baefb9d5911265bcf18ac0bcc9064a3
SHA1 d1e47757851abed060119f9268ddb69bfcf1885a
SHA512 714751941292c12a640a9f6e29c4b17ddfa1df2263f89f90a146b86d8e3dae2e142e718212d254097c28ea0926969f95f222fc4138504e43257b332f0129aa57
SSDEEP 98304:hUri4dRGPsSlU3Jsv6tWKFdu9C39iSl4r3IscaL:hUe4dRHS4Jsv6tWKFdu9C39i4scaL
TLSH
T10E567C47FA960269D8B6C238C9D78117F673BC0147224BDF2298A3496A777F0293F359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5GuiKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\Qt5GuiKso.dll
Size 6.4MB
SHA256 62bb5bae4f0cd7cd7776471bf93cb00601badaded78a1d6978b085a38d9a5ac7
MD5 f4a22145f47c27bb6ead2a63413d2019
SHA1 0f236b06941198365616e17866f6192d1ba09a91
SHA512 686340df75da618260e5cd895346ffd1c4e38c9bb25e4462a00047a3c9ac55963ffd85418ccc278157c26b986a02ff918349907c0cd842cd2a18f311c9028a4b
SSDEEP 49152:tfwVgzsWrginPvS/6E4hNk3sbwIbapmRW63/LmkNuMdmboZAi073Wt0LcajSdTNB:9wVgzPUd8vLmTiy31LR8TXyZ2
TLSH
T1BC66F986EA466359C572D17987CB042FE1F37C4683524BC36C45AB490E237EA1B7FE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5SvgKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\Qt5SvgKso.dll
Size 503KB
SHA256 399cd93775185a1a0db67abebd302d8f227e3e17f8e42836a297ba148d4a6ec9
MD5 d6661626aa98972b7ffaa49888bb4a15
SHA1 042520dc91f31bf5d6e22d4020baf4232b887163
SHA512 9c69f5d6f4edf2a67dd97a09abc03074b06fa7f47bf16f83b8d665e64bdfc6ee6fdadb89e09472b8e74418409756cae3245c7cdc434658c67d27b61453f6364f
SSDEEP 12288:2eu0/Bj7pgf5fqNXGPRG8PFNBAVLEgZ/ABXH9a/vngheZB/XEnEsrnJpaymesGrh:2eu0/Yf5fM6RFP9binCn
TLSH
T1DAB44993FB520398D526D27CC8978812F273340443A39BDF6A5AEB651F236E1763E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WidgetsKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\Qt5WidgetsKso.dll
Size 5.6MB
SHA256 44cd4abc65e8c79047182c2f1846cc554acd01836445b3e3ce51483bab103c86
MD5 69e494161123658847a9553c0c19b030
SHA1 11492cf190a1ff6d19c502c085e6ab70ca26dbdf
SHA512 a7f68789fde8a40bd3bc6801fde08cac81fea7626b70b584d640ba1e42c93f9f8fef97dcfd6c683deb9463a73b8c0cc5de97d2459e292d5103d9ce9baee5b702
SSDEEP 49152:A3fqL/IkO1RNxuQ4Njz8MaCr+6CWpTkY9vTRC+WAGwczT9yVx80qi1QGoQXppdcm:0x4rRNTppdcpwj667olQXr
TLSH
T143466C47F7A50389C56BD23CCACB8613E6B2780047234BCB6559DB692F637E2197E780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WinExtrasKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\Qt5WinExtrasKso.dll
Size 251KB
SHA256 ac783be33b205c69a7d77191bc5f4af8aae1ec0e86ac861e1ee2649a06cf0e5a
MD5 9c9a516e1bba629418a607e63b1d152b
SHA1 a7cc7aecf75194ac172167acb1495951fc52fbb1
SHA512 137ac148ed5582c44ab755ab520a6fefff161a26a84aa08c464d6ab701ae10693e535f82df9771ffa2e77b64a279d7ba484b84aeb42c5a23eb0afd307287ff95
SSDEEP 3072:IF5o5cKUM7YLBwcJf1+6Ws2g1+xvN80L92M:IfpM/xvN8M
TLSH
T181449684B6DD9619F819B0B88FCCD199C223BAED8B47425F351EC39F4B619816E139F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-console-l1-1-0.dll
Size 11KB
SHA256 2afbfa1d77969d0f4cee4547870355498d5c1da81d241e09556d0bd1d6230f8c
MD5 919e653868a3d9f0c9865941573025df
SHA1 eff2d4ff97e2b8d7ed0e456cb53b74199118a2e2
SHA512 6aec9d7767eb82ebc893ebd97d499debff8da130817b6bb4bcb5eb5de1b074898f87db4f6c48b50052d4f8a027b3a707cad9d7ed5837a6dd9b53642b8a168932
SSDEEP 192:4nWYhWxWWFYg7VWQ4uWjXUtpwBqnajrmaaGJ:2WYhWvZqlQGJ
TLSH
T186421A838EFC9543F9A66E701B99D9833C3DABD76910905925A8F19C2CC33D1EB0072D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-console-l1-2-0.dll
Size 11KB
SHA256 00942431c2d3193061c7f4dc340e8446bfdbf792a7489f60349299dff689c2f9
MD5 7676560d0e9bc1ee9502d2f920d2892f
SHA1 4a7a7a99900e41ff8a359ca85949acd828ddb068
SHA512 f1e8db9ad44cd1aa991b9ed0e000c58978eb60b3b7d9908b6eb78e8146e9e12590b0014fc4a97bc490ffe378c0bf59a6e02109bfd8a01c3b6d0d653a5b612d15
SSDEEP 192:iTWYhWyWWFYg7VWQ4uWq6Cu87ZqnajgnLSyu:sWYhWi1XHllk2yu
TLSH
T15B423A93CEFC9543F5A6AD704699D9833C3CABCB2910916536A8F19D2CD33D1EB00A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-datetime-l1-1-0.dll
Size 11KB
SHA256 77577f35d3a61217ea70f21398e178f8749455689db52a2b35a85f9b54c79638
MD5 ac51e3459e8fce2a646a6ad4a2e220b9
SHA1 60cf810b7ad8f460d0b8783ce5e5bbcd61c82f1a
SHA512 6239240d4f4fa64fc771370fb25a16269f91a59a81a99a6a021b8f57ca93d6bb3b3fcecc8dede0ef7914652a2c85d84d774f13a4143536a3f986487a776a2eae
SSDEEP 192:5WYhWYWWFYg7VWQ4SWSS/njxceXqnajLJ35H:5WYhW4gjmAlnJpH
TLSH
T1FE322A838BBC4503FEA32EB042A9D9937D3D67D62A10C12A05B5F1682C937D1EB14B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-debug-l1-1-0.dll
Size 11KB
SHA256 45e48320abe6e3c6079f3f6b84636920a367989a88f9ba6847f88c210d972cf1
MD5 b0e0678ddc403effc7cdc69ae6d641fb
SHA1 c1a4ce4ded47740d3518cd1ff9e9ce277d959335
SHA512 2badf761a0614d09a60d0abb6289ebcbfa3bf69425640eb8494571afd569c8695ae20130aac0e1025e8739d76a9bff2efc9b4358b49efe162b2773be9c3e2ad4
SSDEEP 192:4WYhWFsWWFYg7VWQ4eWZzAR/BVrqnajcJH:4WYhWFMJRLlA5
TLSH
T1E9321B828BFC9103F9A7AFB053D9D9933C3DA7C72910916605A9F45D2CD37D1AB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-errorhandling-l1-1-0.dll
Size 11KB
SHA256 accdd7455fb6d02fe298b987ad412e00d0b8e6f5fb10b52826367e7358ae1187
MD5 94788729c9e7b9c888f4e323a27ab548
SHA1 b0ba0c4cf1d8b2b94532aa1880310f28e87756ec
SHA512 ab65495b1d0dd261f2669e04dc18a8da8f837b9ac622fc69fde271ff5e6aa958b1544edd8988f017d3dd83454756812c927a7702b1ed71247e506530a11f21c6
SSDEEP 192:imxD3vEWYhWnWWFYg7VWQ4eWMOwNbDXbBqnaj0qJm8:iIEWYhWFpLbBlwqJm
TLSH
T146321A928BFC8043F9E76E7017A5D9837C3D77D7295081A506A8F1A92C933D1EF11A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-file-l1-1-0.dll
Size 14KB
SHA256 7cb0396229c3da434482a5ef929d3a2c392791712242c9693f06baa78948ef66
MD5 580d9ea2308fc2d2d2054a79ea63227c
SHA1 04b3f21cbba6d59a61cd839ae3192ea111856f65
SHA512 97c1d3f4f9add03f21c6b3517e1d88d1bf9a8733d7bdca1aecba9e238d58ff35780c4d865461cc7cd29e9480b3b3b60864abb664dcdc6f691383d0b281c33369
SSDEEP 192:+AuVYPvVX8rFTsRWYhWyWWFYg7VWQ4eWQBAW+JSdqnajeMoLR9au:TBPvVXLWYhWiBdlaLFAu
TLSH
T1E962E853D9B4F25BF98FAE315192D843683852C7042541C91BD8A7AD3CE73C5E3D8A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-file-l1-2-0.dll
Size 11KB
SHA256 7a3c5167731238cf262f749aa46ab3bfb2ae1b22191b76e28e1d7499d28c24b7
MD5 35bc1f1c6fbccec7eb8819178ef67664
SHA1 bbcad0148ff008e984a75937aaddf1ef6fda5e0c
SHA512 9ab9b5b12215e57af5b3c588ed5003d978071dc591ed18c78c4563381a132edb7b2c508a8b75b4f1ed8823118d23c88eda453cd4b42b9020463416f8f6832a3d
SSDEEP 192:dzWYhW1sWWFYg7VWQ4yWL3sQlmqnajlD4h1N:BWYhW2e6l94h1N
TLSH
T111323B928BBC4143F9D66E7053E8D9877C3DA3DB2E60815905A9F09D2C837D1EB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-file-l2-1-0.dll
Size 11KB
SHA256 349a79fa1572e3538dfbb942610d8c47d03e8a41b98897bc02ec7e897d05237e
MD5 3bf4406de02aa148f460e5d709f4f67d
SHA1 89b28107c39bb216da00507ffd8adb7838d883f6
SHA512 5ff6e8ad602d9e31ac88e06a6fbb54303c57d011c388f46d957aee8cd3b7d7cced8b6bfa821ff347ade62f7359acb1fba9ee181527f349c03d295bdb74efbace
SSDEEP 192:/VyWYhWjAWWFYg7VWQ4eWiuNwzNbDXbBqnaj0q:/VyWYhW8g+LbBlwq
TLSH
T1C5321AC2CBFC9403F9A76E705299D8877C3DA7C7291081690AA8F5AC2C973C0EB51E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-handle-l1-1-0.dll
Size 11KB
SHA256 c78a1217f8dcb157d1a66b80348da48ebdbbedcea1d487fc393191c05aad476d
MD5 bbafa10627af6dfae5ed6e4aeae57b2a
SHA1 3094832b393416f212db9107add80a6e93a37947
SHA512 d5fcba2314ffe7ff6e8b350d65a2cdd99ca95ea36b71b861733bc1ed6b6bb4d85d4b1c4c4de2769fbf90d4100b343c250347d9ed1425f4a6c3fe6a20aed01f17
SSDEEP 192:P9RWYhWEWWFYg7VWQ4eWncTjxceXqnajLJS:LWYhWk3TjmAlnJS
TLSH
T1BC324DC2CBBC8003F9A76E7047A9D9937D3DA3DB2911816A05A9F1692C933C1DB10B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-heap-l1-1-0.dll
Size 11KB
SHA256 2e981ee04f35c0e0b7c58282b70dcc9fc0318f20f900607dae7a0d40b36e80af
MD5 3a4b6b36470bad66621542f6d0d153ab
SHA1 5005454ba8e13bac64189c7a8416ecc1e3834dc6
SHA512 84b00167abe67f6b58341045012723ef4839c1dfc0d8f7242370c4ad9fabbe4feefe73f9c6f7953eae30422e0e743dc62503a0e8f7449e11c5820f2dfca89294
SSDEEP 192:5t6DjZlTIWYhWsWWFYg7VWQ4eW4MtkR/BVrqnajc:5t6Dll0WYhWMqkRLlA
TLSH
T13E422A85CAEC9103F9676EB053D5D9873C3DB7C62510802615A8F19C2C937D1EB25B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-interlocked-l1-1-0.dll
Size 11KB
SHA256 b02324c49dd039fa889b4647331aa9ac65e5adc0cc06b26f9f086e2654ff9f08
MD5 a038716d7bbd490378b26642c0c18e94
SHA1 29cd67219b65339b637a1716a78221915ceb4370
SHA512 43cb12d715dda4dcdb131d99127417a71a16e4491bc2d5723f63a1c6dfabe578553bc9dc8cf8effae4a6be3e65422ec82079396e9a4d766bf91681bdbd7837b1
SSDEEP 192:nWYhWNWWFYg7VWQ4uWtGDlR/BVrqnajcU8:nWYhWLJDlRLlAU8
TLSH
T165321A828AFC5143FAB76E7042E4D9937C3DB7DB261091550AA8F49C2C877D1FB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-libraryloader-l1-1-0.dll
Size 12KB
SHA256 08484ed55e43584068c337281e2c577cf984bb504871b3156de11c7cc1eec38f
MD5 d75144fcb3897425a855a270331e38c9
SHA1 132c9ade61d574aa318e835eb78c4cccddefdea2
SHA512 295a6699529d6b173f686c9bbb412f38d646c66aab329eac4c36713fdd32a3728b9c929f9dcadde562f625fb80bc79026a52772141ad2080a0c9797305adff2e
SSDEEP 192:FvuBL3BBLZWYhWxWWFYg7VWQ4uW4g0jrQYcunYqnajv9Ml:FvuBL3BPWYhWv8jYulhMl
TLSH
T1A3422BC2CBAC9143F5E65E3042A5CC477C3963DB5960C46906ADE1A82CE33C0EB10B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-localization-l1-2-0.dll
Size 13KB
SHA256 059cb23fdcf4d80b92e3da29e9ef4c322edf6fba9a1837978fd983e9bdfc7413
MD5 8acb83d102dabd9a5017a94239a2b0c6
SHA1 9b43a40a7b498e02f96107e1524fe2f4112d36ae
SHA512 b7ecf60e20098ea509b76b1cc308a954a6ede8d836bf709790ce7d4bd1b85b84cf5f3aedf55af225d2d21fbd3065d01aa201dae6c131b8e1e3aa80ed6fc910a4
SSDEEP 384:NOMw3zdp3bwjGzue9/0jCRrndbwNWYhW6WAulh2:NOMwBprwjGzue9/0jCRrndbw5D
TLSH
T1CE520892C6E8D207F85DAD717167D9437C38A6C50822D95603F6FB2428E33C5E79172D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-memory-l1-1-0.dll
Size 11KB
SHA256 dadbd2204b015e81f94c537ac7a36cd39f82d7c366c193062210c7288baa19e3
MD5 808f1cb8f155e871a33d85510a360e9e
SHA1 c6251abff887789f1f4fc6b9d85705788379d149
SHA512 441f36ca196e1c773fadf17a0f64c2bbdc6af22b8756a4a576e6b8469b4267e942571a0ae81f4b2230b8de55702f2e1260e8d0afd5447f2ea52f467f4caa9bc6
SSDEEP 96:qo1aCFEWYhWwp/DEs39DHDs35FrsvYgmr0DD0ADEs3TDL2L4m2grMWaLNpDEs3OC:teWYhWVWWFYg7VWQ4yWwAKZRqnajl6x7
TLSH
T10E424B818BFCD503F5D72E708399CA977C3EA7C66DA0911902A9F1992CD33D1E710A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-namedpipe-l1-1-0.dll
Size 11KB
SHA256 b57e70798af248f91c8c46a3f3b2952effae92ca8ef9640c952467bc6726f363
MD5 cff476bb11cc50c41d8d3bf5183d07ec
SHA1 71e0036364fd49e3e535093e665f15e05a3bde8f
SHA512 7a87e4ee08169e9390d0dfe607e9a220dc7963f9b4c2cdc2f8c33d706e90dc405fbee00ddc4943794fb502d9882b21faae3486bc66b97348121ae665ae58b01c
SSDEEP 192:cWYhWZSWWFYg7VWQ4eWkcc7ZqnajgnLSp:cWYhW84cllk2p
TLSH
T1E7322B61C7AC8143F9AB6E7042D9D9933C3DA7CB2910C16556ADF9A92C837D0E730B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-processenvironment-l1-1-0.dll
Size 12KB
SHA256 aa415db99828f30a396cbd4e53c94096db89756c88a19d8564f0eed0674add43
MD5 f43286b695326fc0c20704f0eebfdea6
SHA1 3e0189d2a1968d7f54e721b1c8949487ef11b871
SHA512 6ead35348477a08f48a9deb94d26da5f4e4683e36f0a46117b078311235c8b9b40c17259c2671a90d1a210f73bf94c9c063404280ac5dd5c7f9971470beaf8b7
SSDEEP 192:qKWYhWbWWFYg7VWQ4eWYoWjxceXqnajLJe:qKWYhWJ4WjmAlnJe
TLSH
T1D14219C2CBBC5003FAD76D7042A9E4A77C3893E72D1080690564FA693C977D1EB94B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-processthreads-l1-1-0.dll
Size 13KB
SHA256 c9a686030e073975009f993485d362cc31c7f79b683def713e667d13e9605a14
MD5 e173f3ab46096482c4361378f6dcb261
SHA1 7922932d87d3e32ce708f071c02fb86d33562530
SHA512 3aafefd8a9d7b0c869d0c49e0c23086115fd550b7dc5c75a5b8a8620ad37f36a4c24d2bf269043d81a7448c351ff56cb518ec4e151960d4f6bd655c38aff547f
SSDEEP 192:AWXk1JzX9cKSIvWYhWLWWFYg7VWQ4SWW0uI7oinEqnajxMyqY:AWXk1JzNcKSIvWYhW5+uOEle6
TLSH
T1A1520AD5C6FC9183F88AAD306685D9533C3AD7C5192A813106E9F2E93DEB3C2D62462D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-processthreads-l1-1-1.dll
Size 11KB
SHA256 25a99bdf8bf4d16077dc30dd9ffef7bb5a2ceaf9afcee7cf52ad408355239d40
MD5 9c9b50b204fcb84265810ef1f3c5d70a
SHA1 0913ab720bd692abcdb18a2609df6a7f85d96db3
SHA512 ea2d22234e587ad9fa255d9f57907cc14327ead917fdede8b0a38516e7c7a08c4172349c8a7479ec55d1976a37e520628006f5c362f6a3ec76ec87978c4469cd
SSDEEP 192:NtxDfIeA6WYhW7WWFYg7VWQ4eWpB5ABzR/BVrqnajcb:NtxDfIeA6WYhWp28RLlA
TLSH
T17A422A929AFC9043F997AEB052D5E9533C3EB7C72621806515B4F16C2CD73C1EB11A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-profile-l1-1-0.dll
Size 10KB
SHA256 42f4e84073cf876bbab9dd42fd87124a4ba10bb0b59d2c3031cb2b2da7140594
MD5 0233f97324aaaa048f705d999244bc71
SHA1 5427d57d0354a103d4bb8b655c31e3189192fc6a
SHA512 8339f3c0d824204b541aecbd5ad0d72b35eaf6717c3f547e0fd945656bcb2d52e9bd645e14893b3f599ed8f2de6d3bcbebf3b23ed43203599af7afa5a4000311
SSDEEP 192:clIHyZ36WYhWulWWFYg7VWQ4yWqeQDbLtsQlmqnajlDC:clIHyZKWYhWKhlbp6l9C
TLSH
T111320992CBFC4043F5A36E7053D8DA837D3DA3DB6A6081190569F4AD1CC77D0AB6492E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 11KB
SHA256 02d987eba4a65509a2df8ed5dd0b1a0578966e624fcf5806614ece88a817499f
MD5 e1ba66696901cf9b456559861f92786e
SHA1 d28266c7ede971dc875360eb1f5ea8571693603e
SHA512 08638a0dd0fb6125f4ab56e35d707655f48ae1aa609004329a0e25c13d2e71cb3edb319726f10b8f6d70a99f1e0848b229a37a9ab5427bfee69cd890edfb89d2
SSDEEP 192:4GeVvXK9WYhW1WWFYg7VWQ4yWj6k50IsQlmqnajlDl:4GeVy9WYhWzVk6l9l
TLSH
T179422B968BBC5003F5A36E70139ACE8B7D3DA7D729A4812604A5F19D1CC33D4FB14A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-string-l1-1-0.dll
Size 11KB
SHA256 9447218cc4ab1a2c012629aaae8d1c8a428a99184b011bcc766792af5891e234
MD5 7a15b909b6b11a3be6458604b2ff6f5e
SHA1 0feb824d22b6beeb97bce58225688cb84ac809c7
SHA512 d01dd566ff906aad2379a46516e6d060855558c3027ce3b991056244a8edd09ce29eacec5ee70ceea326ded7fc2683ae04c87f0e189eba0e1d38c06685b743c9
SSDEEP 192:byMvQWYhW5fWWFYg7VWQ4eWio3gDwcunYqnajv9JS:byMvQWYhW/BXwulhw
TLSH
T17F321B82DBBC9003F9A36E704799ED877C3CABD72910826516A9F1942CD33C0EB14B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-synch-l1-1-0.dll
Size 13KB
SHA256 a31a15bed26232a178ba7ecb8c8aa9487c3287bb7909952fc06ed0d2c795db26
MD5 6c3fcd71a6a1a39eab3e5c2fd72172cd
SHA1 15b55097e54028d1466e46febca1dbb8dbefea4f
SHA512 ef1c14965e5974754cc6a9b94a4fa5107e89966cb2e584ce71bbbdd2d9dc0c0536ccc9d488c06fa828d3627206e7d9cc8065c45c6fb0c9121962ccbecb063d4f
SSDEEP 192:L1dv3V0dfpkXc2MAvVaoKKDWYhWTJWWFYg7VWQ4uWoSUtpwBqnajrmaaGWpmJ:Zdv3V0dfpkXc0vVaeWYhWj/qlQGWpmJ
TLSH
T1A8522A92D7E8A243F56FEE7046CAC5936C3857C74A20C0261195FAAD3DE33D0EB1562E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-synch-l1-2-0.dll
Size 11KB
SHA256 1c72ac404781a9986d8edeb0ee5dd39d2c27ce505683ca3324c0eccd6193610a
MD5 d175430eff058838cee2e334951f6c9c
SHA1 7f17fbdcef12042d215828c1d6675e483a4c62b1
SHA512 6076086082e3e824309ba2c178e95570a34ece6f2339be500b8b0a51f0f316b39a4c8d70898c4d50f89f3f43d65c5ebbec3094a47d91677399802f327287d43b
SSDEEP 192:ztZ3XWYhW3WWFYg7VWQ4eWNnpit7ZqnajgnLSl:ztZ3XWYhWVg+llk2
TLSH
T1DF422AA6CBAC5203F5A79D7047D9D8833C3DA7DA2950816116BDF1693CA33C1E700E2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-sysinfo-l1-1-0.dll
Size 12KB
SHA256 19c78ef5ba470c5b295dddee9244cbd07d0368c5743b02a16d375bfb494d3328
MD5 9d43b5e3c7c529425edf1183511c29e4
SHA1 07ce4b878c25b2d9d1c48c462f1623ae3821fcef
SHA512 c8a1c581c3e465efbc3ff06f4636a749b99358ca899e362ea04b3706ead021c69ae9ea0efc1115eae6bbd9cf6723e22518e9bec21f27ddaafa3cf18b3a0034a7
SSDEEP 192:fKIMFFyWYhW6WWFYg7VWQ4eWoVjxceXqnajLJ4:fcyWYhWKRjmAlnJ4
TLSH
T11E421992DBBC9203F9A76E7052D5D5833D38A7D62511C11906E9F3B83CA33C5DB50A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-timezone-l1-1-0.dll
Size 11KB
SHA256 3d798b9c345a507e142e8dacd7fb6c17528cc1453abfef2ffa9710d2fa9e032c
MD5 43e1ae2e432eb99aa4427bb68f8826bb
SHA1 eee1747b3ade5a9b985467512215caf7e0d4cb9b
SHA512 40ec0482f668bde71aeb4520a0709d3e84f093062bfbd05285e2cc09b19b7492cb96cdd6056281c213ab0560f87bd485ee4d2aeefa0b285d2d005634c1f3af0b
SSDEEP 192:4EWYhWdWWFYg7VWQ4eWvvJ6jxceXqnajLJn:4EWYhWbwYjmAlnJ
TLSH
T1F24228D3CBB88403FDEB6F7047A9D4937D38A7E61920815909E6E4693C973D1EB10A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-core-util-l1-1-0.dll
Size 11KB
SHA256 5eb724c51eecba9ac7b8a53861a1d029bf2e6c62251d00f61ac7e2a5f813aaa3
MD5 735636096b86b761da49ef26a1c7f779
SHA1 e51ffbddbf63dde1b216dccc753ad810e91abc58
SHA512 3d5110f0e5244a58f426fbb72e17444d571141515611e65330ecfeabdcc57ad3a89a1a8b2dc573da6192212fb65c478d335a86678a883a1a1b68ff88ed624659
SSDEEP 192:dZ89WYhWFWWFYg7VWQ4eW5QLyFqnajziMOci:dZ89WYhWDnolniMOP
TLSH
T1FD322B838BFC8403FAA76D304795DD837C3CA7DA266080A519A8F5992CC37D1EB14B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-crt-conio-l1-1-0.dll
Size 12KB
SHA256 b119adad588ebca7f9c88628010d47d68bf6e7dc6050b7e4b787559f131f5ede
MD5 031dc390780ac08f498e82a5604ef1eb
SHA1 cf23d59674286d3dc7a3b10cd8689490f583f15f
SHA512 1468ad9e313e184b5c88ffd79a17c7d458d5603722620b500dba06e5b831037cd1dd198c8ce2721c3260ab376582f5791958763910e77aa718449b6622d023c7
SSDEEP 192:R0WYhWRWWFYg7VWQ4eWLeNxUUtpwBqnajrmaaG:R0WYhWPzjqlQG
TLSH
T1BF42E68396FC5A03F5535F30A7F9DAC37D3A27D72A506069045AF4A838C23D5AB11A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-crt-convert-l1-1-0.dll
Size 15KB
SHA256 6c008be766c44bf968c9e91cddc5b472110beffee3106a99532e68c605c78d44
MD5 285dcd72d73559678cfd3ed39f81ddad
SHA1 df22928e43ea6a9a41c1b2b5bfcab5ba58d2a83a
SHA512 84ef0a843798fd6bd6246e1d40924be42550d3ef239dab6db4d423b142fa8f691c6f0603687901f1c52898554bf4f48d18d3aebd47de935560cde4906798c39a
SSDEEP 192:JM0wd8dc9cydWYhWyWWFYg7VWQ4eW9jTXfH098uXqnajH/VCf:G0wd8xydWYhWi2bXuXlTV2
TLSH
T14362C65366E42F26F69B177221FEC7D72A394781259143B4C217E54C3883781BDA7C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-crt-environment-l1-1-0.dll
Size 11KB
SHA256 aa3e3e99964d7f9b89f288dbe30ff18cbc960ee5add533ec1b8326fe63787aa3
MD5 5cce7a5ed4c2ebaf9243b324f6618c0e
SHA1 fdb5954ee91583a5a4cbb0054fb8b3bf6235eed3
SHA512 fc85a3be23621145b8dc067290bd66416b6b1566001a799975bf99f0f526935e41a2c8861625e7cfb8539ca0621ed9f46343c04b6c41db812f58412be9c8a0de
SSDEEP 192:6KNMWYhW6WWFYg7VWQ4eWSA5lJSdqnajeMh3:6KNMWYhWKiKdlaW
TLSH
T154420A868BBC5543F6976E7047B9E9437D3C67C7291082650569F1582CC73C0FB11A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-crt-filesystem-l1-1-0.dll
Size 13KB
SHA256 974af1f1a38c02869073b4e7ec4b2a47a6ce8339fa62c549da6b20668de6798c
MD5 41fbbb054af69f0141e8fc7480d7f122
SHA1 3613a572b462845d6478a92a94769885da0843af
SHA512 97fb0a19227887d55905c2d622fbf5451921567f145be7855f72909eb3027f48a57d8c4d76e98305121b1b0cc1f5f2667ef6109c59a83ea1b3e266934b2eb33c
SSDEEP 192:CGnWlC0i5ClWYhWwWWFYg7VWQ4eWtOUtpwBqnajrmaaGN4P:9nWm5ClWYhWQ8qlQGN6
TLSH
T1BF52F78387E86E12FAA71F7156EDDBD73E3D2BC2199282658016A45836C33C07F2255E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-crt-heap-l1-1-0.dll
Size 12KB
SHA256 8166321f14d5804ce76f172f290a6f39ce81373257887d9897a6cf3925d47989
MD5 212d58cefb2347bd694b214a27828c83
SHA1 f0e98e2d594054e8a836bd9c6f68c3fe5048f870
SHA512 637c215ed3e781f824ae93a0e04a7b6c0a6b1694d489e9058203630dcfc0b8152f2eb452177ea9fd2872a8a1f29c539f85a2f2824cf50b1d7496fa3febe27dfe
SSDEEP 192:8a9aY17aFBRAWYhWYWWFYg7VWQ4eWbr0tJSUtpwBqnajrmaaG:8ad9WYhW4F/qlQG
TLSH
T117420A938ABC5543F5A36F706AE8DACB3D3E63D67D5080670157F59829833C0AB2162E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-crt-locale-l1-1-0.dll
Size 11KB
SHA256 edc1699e9995f98826df06d2c45beb9e02aa7817bae3e61373096ae7f6fa06e0
MD5 242829c7be4190564becee51c7a43a7e
SHA1 663154c1437acf66480518068fbc756f5cabb72f
SHA512 3529fde428affc3663c5c69baee60367a083841b49583080f0c4c7e72eaa63cabbf8b9da8ccfc473b3c552a0453405a4a68fcd7888d143529d53e5eec9a91a34
SSDEEP 192:+WYhWoWWFYg7VWQ4eWSoV7jjT6iBTqnajbQwr1:+WYhWIiVTTXZl3QC
TLSH
T132422A468BFC5103F6936EB04AECEA837D3EA7C71A1181A50596F5982C833D8EB11A5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-crt-math-l1-1-0.dll
Size 20KB
SHA256 f6a93fe6b57a54aac46229f2ed14a0a979bf60416adb2b2cfc672386ccb2b42e
MD5 fb79420ec05aa715fe76d9b89111f3e2
SHA1 15c6d65837c9979af7ec143e034923884c3b0dbd
SHA512 c40884c80f7921addced37b1bf282bb5cb47608e53d4f4127ef1c6ce7e6bb9a4adc7401389bc8504bf24751c402342693b11cef8d06862677a63159a04da544e
SSDEEP 192:8JIDSM4Oe59rmkUALQe1hgmL44WYhWWWWFYg7VWQ4yWARgKZRqnajl6umA:8JI2M4Oe59Ckb1hgmLhWYhW2v2yRlwQ
TLSH
T14092A74749DCFF63D18F1BB741F08BCE6A385AA665D1B6B4C81B908434A27C47E83949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-crt-multibyte-l1-1-0.dll
Size 19KB
SHA256 5b3e29116383ba48a2f46594402246264b4cb001023237ebbf28e7e9292cdb92
MD5 a5b920f24aea5c2528fe539cd7d20105
SHA1 3fae25b81dc65923c1911649ed19f193adc7bdde
SHA512 f77f83c7fad442a9a915abcbc2af36198a56a1bc93d1423fc22e6016d5cc53e47de712e07c118dd85e72d4750ca450d90fdb6f9544d097afc170aeecc5863158
SSDEEP 384:4SrxLPmIHJI6/CpG3t2G3t4odXLhWYhWfgy6l9ne:4iPmIHJI6vZO
TLSH
T1CE921D6B8EE82E12E28FD7F3B5F6C7C62A350F9105C07375A26785483841EE9BD52E05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-crt-private-l1-1-0.dll
Size 62KB
SHA256 55bc91a549d22b160ae4704485e19dee955c7c2534e7447afb84801ee629639b
MD5 5c2004daf398620211f0ad9781ff4ec2
SHA1 e43dd814e90330880ee75259809eee7b91b4ffa6
SHA512 11edbbc662584bb1dea37d1b23c56426b970d127f290f3be21cd1ba0a80d1f202047abb80d8460d17a7cacf095de90b78a54f7c7ec395043d54b49ffe688df51
SSDEEP 1536:Se6De5c4bFe2JyhcvxXWpD7d3334BkZn+PI5c:Se6De5c4bFe2JyhcvxXWpD7d3334BkZU
TLSH
T1C05307DB49E63F21E18FF7B76BFB17C90B253A4418806274EAC7556B34853A9BC43A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-crt-process-l1-1-0.dll
Size 12KB
SHA256 191f53988c7f02dd888c4fbf7c1d3351570f3b641146fae6d60acdae544771ae
MD5 dd899c6ffecce1dca3e1c3b9ba2c8da2
SHA1 2914b84226f5996161eb3646e62973b1e6c9e596
SHA512 2db47faa025c797d8b9b82de4254ee80e499203de8c6738bd17ddf6a77149020857f95d0b145128681a3084b95c7d14eb678c0a607c58b76137403c80fe8f856
SSDEEP 192:+nqjd7dWYhWDWWFYg7VWQ4yWMJ5HKZRqnajl6b:+nsWYhWxp5HyRlwb
TLSH
T1604209878BF86953E6675F3082F9D7877F3B53C2690082698456F05D3C833D5AB21A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-crt-runtime-l1-1-0.dll
Size 15KB
SHA256 4390c389bbbf9ec7215d12d22723efd77beb4cd83311c75ffe215725ecfd55dc
MD5 883120f9c25633b6c688577d024efd12
SHA1 e4fa6254623a2b4cdea61712cdfa9c91aa905f18
SHA512 f17d3b667cc8002f4b6e6b96b630913fa1cb4083d855db5b7269518f6ff6eebf835544fa3b737f4fc0eb46ccb368778c4ae8b11ebcf9274ce1e5a0ba331a0e2f
SSDEEP 192:maajPrpJhhf4AN5/KixWYhW4XWWFYg7VWQ4eWvppXjxceXqnajLJhrdCq:mlbr7nWYhW41MXjmAlnJhUq
TLSH
T19572D74397FC7F27E5972B7216F9D7D72E3A638226108179C463B0983883781BD5721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-crt-stdio-l1-1-0.dll
Size 17KB
SHA256 6f6f6e857b347f70ecc669b4df73c32e42199b834fe009641d7b41a0b1c210af
MD5 29680d7b1105171116a137450c8bb452
SHA1 492bb8c231aae9d5f5af565abb208a706fb2b130
SHA512 87dcf131e21041b06ed84c3a510fe360048de46f1975155b4b12e4bbf120f2dd0cb74ccd2e8691a39eee0da7f82ad39bc65c81f530fc0572a726f0a6661524f5
SSDEEP 192:WpPLNPjFuWYFxEpahTWYhWHWWFYg7VWQ4eW9M3u57ZqnajgnLSuRCz:W19OFVhTWYhWlBu5llk2
TLSH
T15682C54785EC7F02E29787331AFAEBEA5A31578338007178C117E99836CA3D87E43559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-crt-string-l1-1-0.dll
Size 17KB
SHA256 45e0835b1d3b446fe2c347bd87922c53cfb6dd826499e19a1d977bf4c11b0e4a
MD5 f816666e3fc087cd24828943cb15f260
SHA1 eae814c9c41e3d333f43890ed7dafa3575e4c50e
SHA512 6860abe8ab5220efb88f68b80e6c6e95fe35b4029f46b59bc467e3850fe671bda1c7c1c7b035b287bdfed5daeac879ee481d35330b153ea7ef2532970f62c581
SSDEEP 384:NFvU4x0C5yguNvZ5VQgx3SbwA7yMVIkFGl/WYhW49PBolniMcx:T5yguNvZ5VQgx3SbwA71IkFwNJT
TLSH
T17482C64386F83F02DA8F57B359FAC7C32E385F46254153B5D467A48C38827A2BE67909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-crt-time-l1-1-0.dll
Size 13KB
SHA256 b48310b0837027f756d62c37ea91af988baa403cbcbd01cb26b6fdae21ea96a2
MD5 143a735134cd8c889ec7d7b85298705b
SHA1 906ac1f3a933dd57798ae826bbefa3096c20d424
SHA512 c9abe209508afae2d1776391f73b658c9a25628876724344023e0fc8a790ecb7dbce75fddae267158d08a8237f83336b1d2bd5b5ce0a8eed7dd41cbe0c031d48
SSDEEP 192:qy5NDSWYhWcQWWFYg7VWQ4eWAcSJR/BVrqnajcm2:qU0WYhWcwASJRLlA
TLSH
T1635209439AE86A07FA971B7212FDD7E73F3917C22A8071758166D4983A93390FE1381D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\api-ms-win-crt-utility-l1-1-0.dll
Size 11KB
SHA256 c81c4bba4e5f205359ad145963f6fbd074879047c66569f52b6d66711108e1ed
MD5 6f1a1dfb2761228ccc7d07b8b190054c
SHA1 117d66360c84a0088626e22d8b3b4b685cb70d56
SHA512 480b4f9179d5da56010fa90e1937fe3a232f2f8682596c16eeaed08f57cf8cffeaa506060429501764f695cb6c5b3e56b0037de948c4d0e3933f022a0b4103d2
SSDEEP 192:GI6fHQduPWYhWcWWFYg7VWQ4yWpbdsQlmqnajlDPD:2f5WYhW8Kd6l9L
TLSH
T1F64229838BFC5643F6A72F7083E8DA833D3E67D6696082654065F5993883BD0FB2151E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

concrt140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\concrt140.dll
Size 316KB
SHA256 2405355f0a58067b258f8df33c327e3a3d716eaac5a3a5aebb757842d85bd376
MD5 5fe9a647921ded8a2fad92deb9ec4ab2
SHA1 1ce87fac4c22aae82a81ddb26952c074b744e78d
SHA512 11fe4c0519cb1df73695ce38b5fdea2a563de565116a47ff0032d5a68b8c51fe732ad66738a7167e56d79193c60af9204a7ee0beae8ff8bb75abd0b484c2d764
SSDEEP 6144:jfjSd54rw5k9cZW1Cbfpri5/ww8VRj7nWzg/p8Wcz:DOP4rwK9c0ILqzocz
TLSH
T16C64398A76140CE6F96BE039C553851BE6F2BC416352D3CB0264839E6F637D1E93A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\dbghelp.dll
Size 1.5MB
SHA256 13f0c74845318b52b76e6000564b1a99c37de48422b44ac74d034fa222c65a23
MD5 a5e4b3ff51cf5b7926d9651908feb666
SHA1 4ef5d229709e40f3f84e46c3a28341eadbd1a044
SHA512 0615ff581b648715461349b1622fbc208042fc8c395cb2d271203b25b036f59edb0fc3470065dc15061af1be0fff48981f55bbea7f00c88906e9b470764a86fa
SSDEEP 24576:xU5lL6v/X5lknycQFrQ8gKt/X95WqbQLZopKjMcqpzd1YWLfY:Kni/X5lknDFUCaQLq8
TLSH
T1A975299BF97941F5DCBAC039D662A627F9B13859832497C367908B562F23BF4983D300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kbaseconfigcenter.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\kbaseconfigcenter.dll
Size 1.7MB
SHA256 1058c8e2b906b2f2855d30770604b405e3fd832224350999172d9ff708cd0312
MD5 a3794c8fae8678e109889d7fb0e1419f
SHA1 ae52485fcf24af1206e63f20b831cf9d8f8d4d89
SHA512 6feb04779adbf3aa22ddd0d05ff5f5ade09aac435660c3d7819416c23d27bfdd7584c67ef8e97ce71782c90ceca2a79f71f8ae667467065fb85e6a4b17ba2e83
SSDEEP 24576:3ISq3f5V2G05sfdeHZ0VHXR+mOKqVUdiIpqd13D4A:3ISq3f59EsfdeHYRq2diaEd4A
TLSH
T183854A12A785486CD14F6338661E3B4EA7386876C73086DBA7A02D954E363D1DF31B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kpacketui.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\kpacketui.dll
Size 699KB
SHA256 64037be52e7e91ed511e278834867fd3f5481efd8620f88d94ad6371f021d5e5
MD5 35a99ae392b70b02d7557d2e57c233ba
SHA1 0f69a977b06e60e364edd1ac2d245f30203bfc43
SHA512 f7df83e68503b7ebf1a09a0a950c2bc16661aeec5b9e5f70492a326ceed4a7680099a3dcf5230a3afe0b4cc6eac85a62af0d5a3075512a8c56dbf02f6e9a662f
SSDEEP 12288:fHn2Nqk+g7ufzQAEit2GRqj3b4skvRkTJu:fHn2NojQyojjJu
TLSH
T1E2E45A1FA69103B9E032C17AC6A78803F2327C0543A25BDB6555EB251F73BD91B3EB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\msvcp140_1.dll
Size 35KB
SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
MD5 2a214cb2f0f9473e7765ee3b8db8651e
SHA1 9ce5c3d6c7d94b175f136f552af8771dca6147b3
SHA512 ea9a759babdec5818fa1e430d1cb453cac762cfaa8f934e01d7182100f66cae21527962696f5bd963fcb0fba2c0f38bf4028e75f89e9e599ddee008021646a33
SSDEEP 384:3jJ2J9VQH+qNy09dmFWcS5gW7YZ1gr4iSt+e92xS+R9zWd/I1IHRN7SUl8BR9zTr:d8QH+qNy0PmgogU9v2ci9zeHSn9z3
TLSH
T1C3F25D86F7248442EC674970C699EE837C3DB3D25B50969B17A5F61C0DA33C1FA34A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_2.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\msvcp140_2.dll
Size 273KB
SHA256 3ea06f0ee098b4823cb79599df3780e7f23cce52c19aac31d2a0d47efe33a5e9
MD5 3151333808c2c2339d5f5466df70b7dc
SHA1 e48159bb2127ec812ff679f6fabc41141009f26a
SHA512 8f1daa078e124dc89b51b84baab8d6cc2d77497be23b2ba95ef3fee54d9034e17bf5cd15a4043d025699972cae20f9c46d2e7bef48e4283f3ad9ca6b84fc64d1
SSDEEP 3072:1J51P7emwi1j+XZi7b1dbqtH0h6XV3Q0JPQo07ICl3Sg2xmygdCg2LMeDh5FD799:1JbjwvnQo/iy5L/XxTWrNM
TLSH
T1AD543912B51A2EBFC5D6E8B04939B416FC223A418775C48A57C31C8D9E2BB437FE3529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_atomic_wait.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\msvcp140_atomic_wait.dll
Size 49KB
SHA256 640b2aefced484d0368eea5bdd06addd0658a3a70a49256e560d6923b404a479
MD5 44aec42494531580bca182b0e2fb19c2
SHA1 a85a6a4de6656e5969fa4ab15f2230dfe2839e75
SHA512 d8afb5bbb1394fd14c3ec8ecdd4c02e1c6f23031b15173b1448dfd4915c392bb8512cd41eccb449db19969397a09046d27d54db704c8122ff62c12ff5a89c9d6
SSDEEP 768:ayMsqh8UGchsJr3KbYA5XeDmqw4DYPW9zr0JD0io9z7p1uF:W+UjCKb/5XeCqgazrURgz91G
TLSH
T19C337DDDA7684083E5678634C1A4E517FA7AB7E20710D6EF4352F0890FA37D1AE34B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_codecvt_ids.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\msvcp140_codecvt_ids.dll
Size 31KB
SHA256 f2069a52880ec885ee7f0511186100eb7fada0411a2b4948fafea7735b878a18
MD5 3ece3fb90bfaea8e9a5fb7139ff9cbdc
SHA1 91b19dd0db24a5cbd944eca9c67fad3b53f9c154
SHA512 c059ffd80de25ad10d34064b1e9421666525da67710de0ac445cfc45b8139715dd946f7e90c1e0d719c60e3d5902e3229db4496c87d674c0012c9b4a8c2b2291
SSDEEP 384:p7GVNpd36sRWioEWEw4himRSt+efdDtdQ5R9zpU8NSqHRN7w9ju0R9zlWdo:5GVsfaw4DYd7ds9zmMEu49z0G
TLSH
T19BE27C89DA3C4487EC9B5C7082ACDE477C3D77C60A10569B4392F5181DA33C6EB3866E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
Size 75KB
SHA256 49c19cd06a911fc42ed256d1691243e20dde7596fc9a19ea71a29f261d1f823a
MD5 2a9a0e490ed87340d31c835902f9030d
SHA1 368cfd9a6856e21557d5cfc2539b40d59067d358
SHA512 b683e2314497115521b2c11681cd6f9bebc722ad9ba0e229ce9ba1065a673365e7a4005727bb0d05598d1b0334b2df684b397c25c2e5f57103c215125ed5b3ba
SSDEEP 768:dXOzQ/DBnTQxkUtwZfVKFkYQJc19qTwz6NBvgUZSac6mWWr5YiDLk5C7DHYi777D:wjf8JNwz6NBxSac0+57b377T
TLSH
T1A0736B93DB441799E51B8634DAD58A1BE6B2784207A293CF6328E3680F733D2397D3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
Size 46KB
SHA256 a81f7b0fcde9820fe96471746854a7a1f5100f53adb71da30e6c14fe35f5774d
MD5 3091ad2fae079b46dd38a11f9eb095a9
SHA1 19b9b0a0b44a00c0872fe0e28a7bfdbc2601c4c9
SHA512 2699be0deba1057a8e6b6c68bf9c562d54a7bec17c9032f63c682568604eb2ccddd0d15ecb2d7a821a1cf4212fccb8767dcc6e67a7c104aa5d03ec302dbcd2e0
SSDEEP 768:qnBLz7xcTbdofpkos+DVYiDLk5C7a5IfYi77l5AL1z:qh7xWofpkossV7bWIf77Gz
TLSH
T154235A93CE641809E923DA70B4C54926F972B8514B9283CF21A5D3694F973C23EBD3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\qt\plugins\platforms\qwindows.dll
Size 1.6MB
SHA256 85a5998534e16d1eba7f151395e8e892c16a4c30468236a636e1da213d27e37d
MD5 383f213649e7dca74389bc7717ecab07
SHA1 ab780df56eba236c2892570552e7117810138779
SHA512 9a636ff6713e3288e4cd897144dc68714507b1aed7b922bcc895b71da423dcf78bba3b3c985142acbfd18f367f69f39cbb780ba9bbd90847b9c1004982eb54c0
SSDEEP 24576:yA9T04p4/1MGXCrbBB376YStwHxDCWYkbJ3tYbZsZbpZ6:xT0IycbBxlowHx+eJTbpk
TLSH
T1F2757C43E3A44798C167C239C68B9A0BD77178050362ABDF25A08F59EF63BE3177A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsprintersupport.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\qt\plugins\printsupport\windowsprintersupport.dll
Size 88KB
SHA256 05e0f57496bda14975ead6d7295afe5b9ec8711d6bddaf04f9a71d360460b0fb
MD5 4e187923eb866b703bfb2f30d2203c2e
SHA1 756c49187873a73aa407436fa6f8c8b8eef5eaa6
SHA512 a03a800e97afaa5aee280c3a1dcf242498a486629cdf8509c5bd6b321ce0375ce7b67a7984113985a483e4528380b5db512b6d04e82738226e360407ea32084e
SSDEEP 1536:IUOvHEs27LT3nOv3sQwdAa9vuBOTn+i0bm4SxMi7bF777LC1:Ivvks2TOv3KAa9YOTn+i0bmsipTC
TLSH
T12A934AA3EA65018CD626C135E4E70926F732B41117A283CF6768D74D5F233D23EB939A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
Size 159KB
SHA256 28b753795101ece7c933d4d47130f51f2b7de8635ba154eaa03ebc82f8cc9f78
MD5 2fa56e927d91beb5e6996e60b6311b73
SHA1 67775975e2e2055590c93cfed03958a77d427727
SHA512 7fa1ea01a5477db7e312416f186291fa440dfe75d476be8654ec84845ace6dd9ea13133f693a013ce8e14e24ccae9589ce63cf1a7b088e80422d6d0a78472420
SSDEEP 3072:XSApjXbrT36b96bavsTHnbNgJUcJbgPHsLCncI2ojCZr:XX6b96bavqHnbNpXHsLCnc/
TLSH
T1BAF33913F65143D9C567D2B8C18E0512F3B37444436297AF25A6DBB82F533A2BD3EA82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\ucrtbase.dll
Size 987KB
SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
MD5 61eb0ad4c285b60732353a0cb5c9b2ab
SHA1 21a1bea01f6ca7e9828a522c696853706d0a457b
SHA512 44cd871f48b5193abb3b9664dbea8cdad19e72c47b6967c685cf1cc803bc9abb48a8a93009c972ef4936e7f78e3c92110828790aa0a9d26b80e6a523bbcd830d
SSDEEP 24576:xOPJ1g7mT6BNvwTOxNfoYotrz1111111r8SoKxmxvSZX0ypdNLh:xO1aNoaxNfo/+a
TLSH
T18D259E64F75C0AA6C17BE17CC95B550ED972340647608ACF03EA8BB97E2BBE91637310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vccorlib140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\vccorlib140.dll
Size 344KB
SHA256 19839407c3fdbc824e5bce189bf68ddf8097f12ec28b757797ffa0415c144ddd
MD5 0b4d02b22ffe3957db27d9cc6cff6edf
SHA1 bec5a8eed4434222956d9f0f0482f8562d992317
SHA512 9588f6e2c96b2793598cd6335bf10cdd53acd77886a5f703118c77af676da1ec3f393d55a1b1dc28dd33bf69c4c5bc70c615f8d41e1829e473ff9bbc1163ea3c
SSDEEP 6144:PpVeNd1C++IAU1qsxEW5QcT2Xgs4hiWi/GDhmVejWXaV+GpfOqmIzt/mtBGgVa0J:Pp0+Xgs4hiWi/GDhmVejWXabO/IzgtK+
TLSH
T16C74E4277B9C4CC3C931A0794E978309E372694207A1E3CB0691970E5F7B7E8AD3B665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_threads.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\office6\vcruntime140_threads.dll
Size 37KB
SHA256 219915cf20822f34d5e7c1fdd4e21ae7f3396881096c51036225fb8f84b47afa
MD5 e57bb2cda101fda5c72f3af09b035bd6
SHA1 77363f6b41d022dbd34e182a93087fc63a5b08cb
SHA512 cab172e140cc2da4444a0c37a42187c4bd29997aa5522f5cf076d8d40cb0116a9e905162349204415213c75ff34cca98cdcc5a7ee9535a8d28945af726545441
SSDEEP 768:CjJ+AiHEFeLUIHmJ9crFciw4DY0zxOW9zeLCbpiFds9z9:+uHEwLUIHscrFcig0zUizGEpiFdkz9
TLSH
T126037C86D7684487E9EA9870C2B9DA47BD3EBBD20B5041DF4381FA480D633C2EA3571D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\pl_PL\style.xml
Size 3KB
SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
MD5 034f37e6536c1430d55f64168b7e9f05
SHA1 dd08c0ef0d086dfbe59797990a74dab14fc850e2
SHA512 0e1911c882152a4e1059a3ce1880d7fb2aed1e1e36cbd37055de2e2a1333acb2a0233ba2a4d969ccebbef1e77809aa5e78807aa9239545beae8c548c0f8f35c0
TLSH
T1E381CA80A610BD0AC563F51573AB7509762CB36383ECCFC4F0EE2E698753652644B63E
MD5 SHA1 SHA512 TLSH

Submit Download

product.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\product.dat
Size 79KB
SHA256 864381c3016e55b25aea9ae26d8fffdef73765fd46f4236be41362d6f65a7f3e
MD5 40f76894c78e6663c228b1838980753d
SHA1 1cadeddca59ea127d390303c98af4dc947ccced7
SHA512 918f18e2140efd4e0e34ec6f77b7ec496ec3274d9c60a9a642ad988dc507279cf49f334c0ff70b5de6e33f286552379b26bd06669b82371d79a6bb19b021136f
SSDEEP 1536:1yKppE+qTZTbosBhg4/vS8UeZC0kySpgno6:1yUE+mZJBhF/K8k0kySmno6
TLSH
T19F837DFB7E1E2EE568CF232A5D7B2C2CAAF54D15349B548862C3E558EC1C0B63CD6508
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product_new.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\product_new.dat
Size 72KB
SHA256 8b8908a5a2964c840f954bbfd59679fb684c3bc3aee98332b28d5eda76bd5db7
MD5 dce25ef9e38d176ac64218dc2893eb7a
SHA1 4b98920088e6e12056d2059bc5fb618e26b84e11
SHA512 a95e331e650953fecd10f19dde0a1e1ff5d1fd0a79e2c43f42118f4d783151bd2d4f959a9c6a3e79b9eacf5cf53761545721e1ccb3648ecda596c7fa0ae3ed01
SSDEEP 1536:I3Vrh5eCifWIY/Q2pHggLLw52P/E/nNsB+e/zEy7m:2Vr/UdOAGN0FsBsV
TLSH
T1BA731B19DCE26DBD685056B91D376D8227B7DDD060DD30AC4B12AA0CFC3CF887B62A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59528b\CONTROL\vi_VN\style.xml
Size 4KB
SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
MD5 394488b30107bcebb84a97ed5d754cee
SHA1 69ebe17f7d577e9bf69c87cff45c3251f0bbc86e
SHA512 24a6bc7debbf7030c1261c69cb4ae7bf3cbb5c7fac315188163c6001e58dfbe2e634925cb767044da7ea0e6d08c709b2ade02f6e43930819e1bef6f7569cad5a
SSDEEP 96:gd6SmSZcFe9gSs8TcySCSi58VS5eQJ/gQkgQ0/Mw8CclQgYzdr/PwiCSeDeR3ciw:gdAh8Ax
TLSH
T13FA17780A610BD0AC563A51977AB7909B62C736383ECCFC4F0EE3E658753692644B63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 387B
SHA256 72204e4f61bb796b0618531d35644f66ec68b474c4448705851687915c654fbd
MD5 33d2a9536a37b465529e5f9063f8f456
SHA1 83f0a000ef069208815827bf11dba82c88896b2d
SHA512 4bb2d3ea8df0f67fc3454b9e8f467f6012b7a8d672d975980df921264cbc52a62743a1e72d949ae34b503a5f52a1c07218973961e0c79d230d883f7016f24e74
TLSH
T11CE09B1BE8D1B0ABDEB302F9C897DD54BEC03D9A066D13147762940D3C32918FB41D65
MD5 SHA1 SHA512 TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 433B
SHA256 b7d70693201ccf0e31c73d1262aefee43bc029da7797c250cfbe2cad26b16733
MD5 420de6ff3159c2e3d110364b920e5574
SHA1 c7c4c2c7d3f14c5c4fa99c30af9decd0b0551faf
SHA512 141fad9e8f32217c24bc8eaa9414e9f3735ba6346228c934846df57bc58c03bb19847e76144d4a3193c07d6ce3e6f723628419fd73204d1feda4d88689a344af
TLSH
T153E0540FE891B0679D7302F4C8E39C007AC03E95055D1214373184093C32A14FB81D59
MD5 SHA1 SHA512 TLSH

Submit Download

WPS Office.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\WPS Office.lnk
Size 2KB
SHA256 ddcfa3b2ffe101c662a7f555cb89174c953c530e2d651b10043df691d2826927
MD5 b5ade8cf2d9d11d2b3bc47d4d08868b7
SHA1 0402f23cbeaf1a144f662e14dd9d7a7ad941ea45
SHA512 9dc381ffcd6e1a8b90ed63cbab0c10094dad92a32107cf1592391bde1e0a69ee4c9bcde67df88b8802a87d0c2f28bbca963a40b0072ecc9ad51fb8aecaf20b96
TLSH
T1DC411101D5EA2F28D7FACD35E5F212129972F951FE66969D0000D3092E15E40DD29F3F
MD5 SHA1 SHA512 TLSH

Submit Download

onlineconfig.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cfg\onlineconfig.data
Size 137KB
SHA256 a9898a43833f57640a0175f39d2694fdb313e77246bc999802411d26c5e9868d
MD5 aff70e45c722e33558e7ae72a1a921da
SHA1 9fceae5ff658283d7edde203937f6f819d0b9e0d
SHA512 3be5550c990177cc238fe078fbd6df66f584a17e8959afa67ad611fdf8ba869971e401f4bd84d8a7887a20d1a384716addf7ab8079e8bf56a6760ad722604ac7
SSDEEP 1536:TBVC2b6hnHlWsSQyQgQxQlgbZf0P3IjZlIWtJtQtKvUWwXyw:tV16ZlX6g9QIj/f+BH
TLSH
T1FAD3E91E72B0DC7BD2836E4D7936BD26360875EA28D694D8B99CC4C97FC0A74012BD93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksomisc_2026_06_25.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_06_25.log
Size 5KB
SHA256 1d04ec594337275f12ecf0698948374c23c36b1dc474cb75aad0535cd3eb8bb8
MD5 f9b7ee4a4bae70ba61db823d28c1fd0c
SHA1 37201ff8bd862282e138c9e2fac5e9416eb28210
SHA512 dd13838aaa11165b4be3a497b69d6aa173dbdba674b2dee0d3823d478b4b177331006673ff442edc6414b57cd813e1bf2e589ad6784de5f9c0e4ce2b554a695c
SSDEEP 96:in6qYo2siWDwHGsi+HqwH6uzsi+HXwHGsi+H1ZwHVNAsi+HEqfc1siWny9hsiolX:cRYJrmWDauzWgmW8nAWkEExgXRYkTj33
TLSH
T10FC19E596AF94106F7B3CF4668F614634E76BC93AC30EC0A1891234948B6E94FD3073B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 10KB
SHA256 c7f68c4aa4b4f9dacfe1fd55c1ae0169c16131d886dae65cd72d22f9e0c29319
MD5 67b44cf6cdd07c66f553bbc307baffab
SHA1 67ddd78edc9958fa6e2635b2b9bddbab6e677430
SHA512 c945230e2ea87910fcc9639fa1438da46562691ae9d8ecf37fff866d94efd3875165020412804078e4c62e0564314be33db53e144511c717344c3aa75afdec28
SSDEEP 96:PvhemmNHXZrAXbU+LJPYDD5YvYBYqYw0YRYzRYfdYPYB1YbqQY5YoFYgYEY6Yo+y:R/H7oGqvx+kqXYMMd
TLSH
T1DE327B6F867E41181B7B1BA8D2B18E48379A6ECC23A520443F72DE574BDF82143BF654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 11KB
SHA256 b86a51a6fc4c36e2f9dd5339078bffd50cfdc9f5704b1853c83ff00d978dea77
MD5 8f0f7744e4386217aca9f0ff963dbb8d
SHA1 e7c8f93744f10ffdbff0e2a194f9165874e15081
SHA512 9db7bb0bb79539b4b4e5ac848239db3f4c4caa60955f9bd4b6a0cad418f76479186fdd29daf7948e53125eb404c5ce37fdc5458d60622adc48fc9df9f146077a
SSDEEP 96:PvhemmNHXZrAXbU+LJPYDD5YvYBYqYw0YRYzRYfdYPYB1YbqQY5YoFYgYEY6Yo+B:R/H7oGqvx+kqXYMMXJ/X8n
TLSH
T1F5429F6F867A41181B3B1BA8D2B18E4837DA6ECC23A520443F76CE575BDF82143BF654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 26KB
SHA256 7f7e2098274d0fa026b303cf94ef4d748af0361da8102a76180faa7d6af4ae51
MD5 9d1cfa5eb3b861c4b6b802f151390ed5
SHA1 c5e5d24cc2f9f51770a52606715eebb7f72045b3
SHA512 8b8025ca406c9a01a56d2369ac596fc84286fcbc7ef1a55ce43602760b7111c9348ca5e3b1c4272961312e26b7298318d3d169f5ca9d43493a6ff8206f7c3bed
SSDEEP 192:R/H7oGqvx+kqXYMMXJ/X8qgh/Vbip9XIf4oK80LRJeKtOj0nmdlxs3P7xiiZUmri:FI+kqoPh3IP
TLSH
T1CBC2A1DE457980201AAF57C0D2F6CD1E35CB5B4E279921053FB2CE93579BA1283FEA08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 60KB
SHA256 ef5e6e20078039258678992a52f201372506dea296fee982748b6d72ef86c1fd
MD5 2faa26139d610ea0163da64b345c2d9d
SHA1 8d75cf9a8d1fa34ee09199fab4169530a741f591
SHA512 8b54fd44c21161d5530bedd6f482046c7ef42e60e442cfc6404d7bf9483f3e032d2c69459873394dc56777a4adce96e12be8e70cecb87f9ef69c4db736e975c9
SSDEEP 384:FI+kqoPh3If7Pbsoc9/ZuISKRX2zwzh0DJGTUs:q+kqoPh3IXc/0I7X2zwzh0NGTUs
TLSH
T17453D49F09398020696B97D0C1F28E1D359B4A4D22B835183FF7DC53AA59D138BFFA48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 60KB
SHA256 88facee443989aba96d4128e421e2786d5c27294379b242f2d9422657ae3c7ac
MD5 45e8c83c58c421126df7342c7e5fb1cd
SHA1 2bc6e4d4cd5731a351249fed9eb6cf2d6bb6df4f
SHA512 b56d9707f408b73623934bd27cd822b428bf25b4ad8c10c5eb4a8900344e151326c6e9891a316d2f341cbf98f81f816bfcf22a765ffca9e4c528ac6783d62f2a
SSDEEP 384:FI+kqoPh3If7Pbsoc9/ZuISKRX2zwzh0DN:q+kqoPh3IXc/0I7X2zwzh0B
TLSH
T1DD53D49F09398020696B97D0C1F2CE1D359B4A4D22B825193FF7DC53AA59D138BFFA48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 66KB
SHA256 1df9c5cdb8f847d1bb69d0dcc453c0235efdc258a8b52e80b4ffe7df5bfeac3e
MD5 32f1f670b1f11dbe26fd87529d8ec4f7
SHA1 68d97e762662538b306d5ae5755e3355279cc5f2
SHA512 1d38b9fd58b5a31a298e90dfb3ef8461973963daf99daaefadc64c13fd116ca25760b58ccb7288e1ff0549946a573e8d32b71238665bd2e07dae0b437f1685a5
SSDEEP 384:FI+kqoPh3If7Pbsoc9/ZuISKRX2zwzh0DJGTUZD0Qh:q+kqoPh3IXc/0I7X2zwzh0NGTUZD0Qh
TLSH
T11F63C39F09398020696B57D0C1B28E1D35DB4A4D22B835183FF7DC53AA99D138BFFA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcsdk_dpv3.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
Size 40KB
SHA256 35ccd959a9254ffe41a22d52e14b5ee1d85e34b01626157f509e8a658032505d
MD5 d79e380eeb069aa5ff2b01a6147b10fc
SHA1 86f794db0a18a4d242103ee697873bd5d02318b0
SHA512 6c4d55c36ba08feafd7a2484cbe5823623a4239233c20c4002d690a23af5285eb3d67f23a7f555474e40e1415607942bf56dce88a68ced8f618e09cc3e1213c4
SSDEEP 768:6lwOa8RbbFZhDq9SYBaMdCMwWE0ENY116DbPdPsqAN:lF4bbDhDq9SYBVEFHtK
TLSH
T18D130F96B7FA1558F6F72F6569B968944C3A7DD22C09E4EC01602C8E0932F90EDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcsdk_dpv3.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
Size 34KB
SHA256 e51afa0e0da2c874f591e599920d804614258724945f144d3b6e3e65e725b753
MD5 4f5961a01df580711c9bb9e095092c9f
SHA1 5bc577642fa361cec5a56216880030544288a25b
SHA512 c41b7d7c6ce05d80103099492a10c93f910ad51b19963d9e32216134dd74bb2631c2280fa58f59b848e9a9909ff9114949d82ea18a97740c592af3f46a5bdc37
SSDEEP 768:hYg6/bAFhHDB9SYBazRdBMIRkO8N76lDbPoPJlAE:DAbA7HDB9SYBUHkO8Joe9
TLSH
T111F21496BBF90558F6F72F6569B969944C7ABDD22C08D4EC01602C8E0932F90EDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

konlinegradient.qm

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\addons\konlinegradient\mui\es_ES\konlinegradient.qm
Size 672B
SHA256 9db091ddb5788601534d2a8b67a19cfaea85884e601bdb0c71fda15d2fd89abf
MD5 2fe02c4613395f0ed98b4ed4abbf6bf1
SHA1 ca8177acc4b53b6f1b453879a9ad547bd9ac88c8
SHA512 79d9f77516012cb7dde26889f9f77a657d6722611b0720852ecff7ddb037942f3d2390c32bde973338ba0710ebf8ad2d18ed85dcede086b34d69bc46b7496ff0
TLSH
T1CE01684167EAAD0BF3769BBCE839022C4AEAB8A14835B02F5101584D0BF4504DC24322
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\addons\kstartpage\mui\default\htmlsharefolder\wps-i18n\es-es\index.js
Size 2KB
SHA256 e70c2898b933226d35203217c14150b3e9428343726b129a6aca336bef1a55ac
MD5 0ca21bdc59cfadfd96d05239cd3d0314
SHA1 1cff5dbb01c888bc696bac064e358730e7f1f6ed
SHA512 12b3cacb4b36f47907e85a2c3fe71069818e109f11777506438d0364baeb99c2a5359dfe020a08d17572cd60f773beb2c2241e5965c952ae806ca11b5e2e0177
TLSH
T1DC512193F9885FB4385A0B493A07EAE1E1A23F14220524D4FEACC53D13A4DC9C4EBD6C
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\addons\wpsbox\mui\default\html\cloudsettingsdlg\dist\wps-i18n\es-es\index.js
Size 8KB
SHA256 4921f5227ee54618e7b4a6be24c5608391ad003838820e61940c7bcf7ce966ab
MD5 515b80c2fbe61841c2898a655d78d1c9
SHA1 d77b0cbf5c3f60a1e1575c7f32c97caac772a626
SHA512 411b17c29273cc7be95f9cdb39d73bbed7b18f99effaa64042ccd18b1e3852b6bcd93fa37e0575aed2112c7f77cacb46b54d749a86334fd3f882f1c70a9a70cc
SSDEEP 192:SpkpF8hBjbUpfdE/bkDybzWJ4zSrcozBvLRqP9Yn9FPv:S+38hJUFdE/bsc4BvLRqP9YnPH
TLSH
T1ED02622AB3C01BB274911340BD43EAB7A08829716C4DD5CED9F6C3B911F9ECD85F598A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\addons\wpsbox\mui\default\html\folderselector\dist\wps-i18n\es-es\index.js
Size 4KB
SHA256 37447420401bed9186b8bceb12c872636ea118b11dd45dabe2a0e884e12e7b25
MD5 8957630523b7844a9a60016021e834bc
SHA1 cb549c6b7708546e548428f8cc4e2288628f0067
SHA512 1b5d3d8f2383ec64a82bbf11f0569292ed61d0cc70187dc1e9c012877196028f0e004d3bf74b3a99b172a65601a116d7197232e5752b8e99b31ea011e98abffb
SSDEEP 96:1ZqykXR2bVkzrMexB7aO1BP6EManbkm2mERSYFL9Fovr1mii3:3q4bizwu/oTawSWL9gIiW
TLSH
T108918263EA4C0A3534A50B843A07F9FAF1903A34684BA48B8BFD973D52F5D85C1D7C69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\addons\wpsbox\mui\default\html\syncassistant\wps-i18n\es-es\index.js
Size 23KB
SHA256 82edbc8877cd9ec95c4ee853ab32ba65e7943b9c30795b3aeaff1c2da3400a05
MD5 edba76dce6e0c24e53c50104eb7134c6
SHA1 c311b37673c91237df24fa941369696215154fd3
SHA512 80eafcd5a3bc42111b316c82ffa9406ca79c6bc8d2cd3fc6c1ab6c9ce9196758c492bf9a08d33d559a6dbd8f78be9aec0e091cf14711336b68fa6be8034f489f
SSDEEP 384:PCJ/f/29MrIVrcFOi+VrFPgIsXYgo/S/8r/43I0hCQ61:ahf/2urIVrcFOpVrFPg1XO/m807hw1
TLSH
T10CB2D92DAAC40B3665E01358BE83ED6B618A6A41BC09D15DFEFEC33513ECD8D85F2491
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\addons\wpsbox\mui\default\html\syncfolder\qing\wps-i18n\es-es\index.js
Size 13KB
SHA256 fe3182ace5f1c87fd904fbcc84b8e1fb47c4984def4c71b776c8c8d12bb5884b
MD5 f2e27da7822c90418fb211e5191b322d
SHA1 14afe1fd0da51d38b12192d7c32999c65e10f642
SHA512 319e68515ca0a594102a70a5d86a97e7a402e01cbfa8946acc1c195664fe1a6ec0f56e748a0a27646c738a5725c2594047c7c4083fe563d441935c77d65db17c
SSDEEP 384:fC6QafZeuZhcY6RWRhABu9vAa+jPnW9Ew:fC6QafwQhcY6RWcMaa+jfOEw
TLSH
T1A0524485F38A0E22B8D91B48B903E5BAF19558BAFC2CC18E5DB7D335026DCC941D6C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\addons\yunbox\mui\default\html\sharefolder\wps-i18n\es-es\index.js
Size 6KB
SHA256 bb1bb72bf79bb25f7765b9d24a841a95c547047330d9091264f4daf700fc95a1
MD5 2474d64e6fd0f062894fa77d359ad327
SHA1 3110cd2edccb4e8c6a7368ceaafa824d9d3069f6
SHA512 214e3750276926a9e2faee7c3b66868e653d20e359b76be9bf1cb57177eb5236e34b70de432989216a5787b754ac50e004db474e79c199b6720fd547ff89ad03
SSDEEP 192:F2lNF3kBck3peOTlXcpT3R08XicEOppeY9ggAqUFpiG:F6F3Gb3/XcRR0aicEOpH9ggrGEG
TLSH
T1B0E1446AEACC27B534450B552D03DEE2E1917EA1A54B948476BC863E23B4FCB89D7C0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\download.7z
Size 2.6MB
SHA256 4f1810166e8a0052ac15b150805cbdee0e6732b3b06c3bc31037b7df711035cb
MD5 0e8bc4166d654e338355b968663e21be
SHA1 518daa65403885ffa37e4929cb224aae8627357b
SHA512 54b2047878d39184b68e894dd9c089cf798f264fcfc163f310cb0aff641bfe1b3193ca223610d1a32e35406aefa05c26adc0a8ad2633a776629ea6379d83cc12
SSDEEP 49152:enEbPI4OCbZG3Xxgpv/jf4pDxqqzGbxG1zrz0l98yyNBJvk9aOvGRPp2t:enWwX9HG/r4ptqqSbxe6WBJvBlRAt
TLSH
T1E6D5336E17960412BDB97900D486E4E33FD12AFF579A8C4091ECE8F76289BC4D526C8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addwatermark_buildin_wps.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\resource\watermark\information\user_defined\addwatermark_buildin_wps.doc
Size 9KB
SHA256 43add80bf7f6495384fa15757101998fcef1688702830c538976dbf7a26d229c
MD5 ad591df2deede6c9e91ee34698ae9706
SHA1 8ad7d0506d8f39858f545d34b3f299b98bf58b25
SHA512 2a866d844cb80cea65458b2d51b61f66a21f7e7ef83e157cbafcd7b3c862703e18c9218c78e01dd187e8e416b4d49d9c142d1569084d3b31f25412de930cebfe
SSDEEP 48:r/UVygU1/o1zwAvBH6GgaNj01LTak6mSDnY0wcYYmtJSd:j8BUB6vBaG1h01L1LS4cLUJq
TLSH
T155123F12F390D90BE4A6533598EBC3D03731FD10AE128B4B3194B79E2C332908F52B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cubical.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Business\Cubical.png
Size 5KB
SHA256 77d791e4fd2870f8f0091bd442ba969cbc680f868cc134c5e825a7df4ca5299b
MD5 ca392c6ec41bfe7bae5189fa06629215
SHA1 2773cad6e5b0fdbaa20410d06b53fb4dcb672848
SHA512 e2c090c9cb30600fb2ef0654beb65e7a63b2de141771db8a8719ee4b7cf834464954317b84d60d181f3978391f7982449293a40f75547002262c4b63f191d219
SSDEEP 96:kP7Q1CO4gvg0C8X9GhO9E97xp56eFy7VqfvrbCCdzF78zVXfaXn:kTaveGiOc7xp9yMB9cvYn
TLSH
T12FB1AF47154930BDBD86D3678038563FC3302AE7053DD98B2EABB9442B4CC61C1A6033
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Grid.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Business\Grid.doc
Size 226KB
SHA256 530a8bbf52349373cf5ed80393d91adf9299c488f208b958be35716f6b1bbe26
MD5 71ec3f64c19054fc645709a8667ab2c7
SHA1 5c535aea3539e268f7632ab3314af07f126d2fd3
SHA512 756359bb2c5ab35f763bd46cb5e04d5ca2a732bf2d6f4f14e633ffd9c05e54e578fa3e4fb81730c4ec7fafb290039e2cb0b8c52c9b75cd91f2a4d5b07586cb9c
SSDEEP 3072:VefMzXCD4gZv1n90CEZlnUISd1EaubptFwA1KEvpfJp2gV4ib9+1x/uE9:QIU4/IqTlLvR2gy
TLSH
T19534CF09BF90DB07C09961718CBA43A97278FE8A9E24065F7588737EFE316780F5474A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Grid.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Business\Grid.png
Size 3KB
SHA256 f8e9be64eff30039eaa6cf086200b345c90397e6863c0769dce1cf58626d6648
MD5 bd9b686d4b1918734a89118dc95cb24b
SHA1 aff1801547d93e6cc7a57c7ab55c36a4a79c1102
SHA512 91c165a335b6f6480d0f421e33d79aaba0dba01cc882065ada1956405e9176c3974cb8bebaf4575d2f91138708506fa381d9bd021034e0ccbef47a46bed4b813
TLSH
T187815D65BA2BA1946E069D7F0AC0C1F69B5C3EC229DDF607A0807877383185B6563702
MD5 SHA1 SHA512 TLSH

Submit Download

Natural.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Business\Natural.png
Size 5KB
SHA256 829b554b7395797403b7bd878dd9fdf2d74bde785d689cb7461bd52674b68e62
MD5 9a4e275a8d4b86c7bfc2f704c84422dd
SHA1 b3015bd4bceccc80b055b40c601cd7bcd21e127e
SHA512 7188e1191e3a73dabb49ec651dac990a88c7884f50c9fd0536cf4a4f0f44e2fcfe237c3e133dbb244bda6513b08e8ee0b9ebf201930c2470886d99a27fe4049e
SSDEEP 96:JbVfwnrZ/xnRD6E4MImICm94RWd3P1DOawhzLpqJzE5hq0GnvKt:dyhRLIC1RSAQJQ50BvI
TLSH
T1A3B19E90D206168B07DD28B725EF74D1C088458B6059B8CFCDE586EC715377A1AF7163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newsprint.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Business\Newsprint.doc
Size 49KB
SHA256 2b86490bba9b252e06fd399eea525b6e4f398064dc37d1bbcfb57cc66985e217
MD5 9b6c2cb75d05cad8916c9ee594bbaf14
SHA1 2b09e86bb1ae2a6dfb809d0b7cb7de81c8853e24
SHA512 7652d240ffd44661fb975fdcf9b95aa527e4a6b00969d6db3df7dc6eacf590ae289d323dd2a2836c637fd1d8cc9e44dd409d859e845899d3fdd6b8c94d674bc4
SSDEEP 192:cBMCRLvkkC13GjMGUM3ZTkkJ3TEo9j+ZbRVF9GkGgdAsELVTVy45pnz12rYgi:cmCRLiWjhbhTJ+ZbvOdtxpz1sYN
TLSH
T138331381BF50CB07E06961718EFF4F796668FD57AB005A0F2198B32D7DB62702F66980
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newsprint.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Business\Newsprint.png
Size 1KB
SHA256 701eaff1647cbc8307c348155b64ca235381648fb78bf7dfa2c520fa73739150
MD5 3cd978dc5ca00c00aaac6174d4124bf8
SHA1 43fba177e57bd1dda229ac2da36fc1d619ac4647
SHA512 e359aebdc6abe8d8cff7b5ddf51e129fcc0edbbf5a40e4e186b44eae7e4974e1c985ebbf6ba7a3e6dd5dc2235bb6ab0c1207313606e8ec3f0d1c724883475061
TLSH
T17B413AE2922668CD42B8C610597D828CBA2138B135669E6A29C2C0246262521AD02F87
MD5 SHA1 SHA512 TLSH

Submit Download

Standard.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Business\Standard.doc
Size 77KB
SHA256 91ad6bc495c6e0160c6bd47f11e02b39b69ccd754454f63541a0bc087bff57c0
MD5 aeb846a9f49a550c11ded8a3a19f65e9
SHA1 88211e70d222b82fd95fb81953bd752db3219e4e
SHA512 906d4087030c0dc7fdf52dd74ad8f0a20612c9527884d5604a6e9e0be055183820c15e31df4f93aeadb2ee00ea82483a3e19ecda989c6c643c2f6dc0e6b3b6f8
SSDEEP 768:hM/1w54gOXaQ2kXk6bxdR7teuxJQQMKbIi/BU3AoiE7gqKscs2:he1w5wa/MXRrxJQLKrVg/cF
TLSH
T145734B02FF40D94BE27B9A7544B6475A2A30BE605AB0865F34943B2DFCB92F27E51780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Standard.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Business\Standard.png
Size 2KB
SHA256 c5e2e46ebcb6256822ca7169ebc5c9d149e2e4f4a102fa43657a5443eba5eedb
MD5 1b02384806eeaf9675e438522f28d307
SHA1 ca115f03fa4bcc021bac600b81ab1f5759150443
SHA512 45baa551d96d22c64e25197b9f84c0728addefd96a79d7ae35ac5b912f51ec13e4bc8892c7dbb753ac2cf965599fbd09339ef5e9949f46e312f68f22fd4f639a
TLSH
T11B415CEA63EECD9BBFC440370972E8CB42C6D075181ECC4D1A7FA834C4A610275ABD00
MD5 SHA1 SHA512 TLSH

Submit Download

Austere.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Resume\Austere.doc
Size 39KB
SHA256 5aff7e350fadcc56948fc4beaafe54d0c6f42576641a6d74369695e1b2d5bad7
MD5 19e5db336f4741b51a5a9e9bdb38daea
SHA1 3205793c1e60284a96994c5078f78c96d1ca6e8a
SHA512 b1685f73040cf65acfde8e38296769675dfe7ce1d5addec00810cb6cf01ae4bedbba03c2a0847fb24d67e4c4691bad7cccc349982387a5dedcc91681f36afd34
SSDEEP 384:V6ayhLcRExL1S9n5ZTKjFKMKAKPCfKxU5Z6YCsZLCPbU6PTmaH:Iacga/8n5ZTKZKMKAK6fKxU5ZwCsFrm
TLSH
T1A503FF10FA41CA03D4A9567048EB8B4E3775ED446F658B2F2298F72CFD723B05F5AA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Austere.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Resume\Austere.png
Size 1KB
SHA256 cc17d651cb2d6435999c0d7bd05df9415cdb474d2f7e0fa80657c9c37cc1939a
MD5 da4013440ade85ff2a951f2ce7a4db1f
SHA1 1f7d42419e38f1049bb8d73cf38babf123757191
SHA512 40569bf5b4d90f3bde535f4ef1027fa1978bc741d6a41d957fd7b8b0a2b2431a9edf973fc937d52a08e4dbcf3e01c18c7033b4cd81c5cde5b7061b82dddf0192
TLSH
T16F31F8742136F87A7FCDCA0A129767E8EEC2A83D768D4030C0120E1A9D6F272082970A
MD5 SHA1 SHA512 TLSH

Submit Download

BlackAndWhite.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Resume\BlackAndWhite.png
Size 2KB
SHA256 a5b6d09595051d52f95f1791b74f59e4d274b358830dca923d502e49235f2468
MD5 8c7b9c77e312e96b9e59c298caf833f2
SHA1 c19def4ccc09226d6cc1c573eac3eab3f20729f6
SHA512 43d6630f2c91916e31702816f2e504f66007982671a657d6c46b39ae714e2b6aed0ae4ee234b0aa02b40d5001e90b6a0cfd303e4c5b90227fa9b52d894d52e2f
TLSH
T14C5139CCA06C5FA6D4D44A6FA583F8A1F702CD86D5749BFAE4C2159812EA394081A723
MD5 SHA1 SHA512 TLSH

Submit Download

Design.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Resume\Design.doc
Size 203KB
SHA256 c3661b7a4a13b6729c632a82e00144a5aeccc63785f40745690a5c0ff9dcabd9
MD5 52b20a1aae7b3b365c970f8b15d0e4c1
SHA1 84754d962318f191a42617f22b1c5cded7436673
SHA512 0dbd1ede511f7bbe3278475f4b0c611541877adce5237dcd35e3ad8bb7dc597f740b2a04de91123416afb91587f42fc47f38bc4c3dad2a1bb42e0a429da384e0
SSDEEP 3072:0sQGBJFfH2oaT53OzcHbfL4TVv++b+jQAMvf8hMgI:02PFfH2F53Ozc7f0TlbwQA56
TLSH
T1D614D0362F7D67CA99E37D378256D866A2301F8103573BB2EFB8761C6669C140A3016F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Design.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Resume\Design.png
Size 3KB
SHA256 bb610bada4ed798010d1fd454e7f2d1924f05ed4089c2d8686ab1642e4b1e1a0
MD5 93ae34055c12c0713e2d2510d720d0a4
SHA1 fbccb95601910b2dc5aad6bed438fb6597450d49
SHA512 4c1c13ec07731ea94087a311f63e2f974a1beff514579001fea5a317d4e44c2249647ea7dc6806fac73fa8264f804561b3a8fbbe343c372f6cb1b823613d2bb6
TLSH
T1FE615BAF1904EAB3B68C2717C7A255704159918EB8637E386CA5FE06112D941ED1D70C
MD5 SHA1 SHA512 TLSH

Submit Download

Exposure.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Resume\Exposure.doc
Size 95KB
SHA256 f4d30bfe519d5c45417e378c0e5409397d4a7ab7bbfe1904d149307eb49e9745
MD5 8b4305c4424a44fdaa0ff1ba3d5d0bb8
SHA1 d042b9bc634724d6ec3f2087d7820f5d9a1ad61e
SHA512 e2ff4084e3916b77b1643ecdf10c3afeca11fb1bbfa9342d766af79b867a2c3e337d892c0ea1e68c1bf89d80c6d897439060b6efb55edcf6d4cb958fdeaf9d82
SSDEEP 1536:r2MPjTMPjcVdhaRf9uqpDnryZLBrS+scYxkhlPTkjGQVHO:1U09B4cYslPk
TLSH
T123939C20AB7D4A85D9E32E374626CD619331AF94272333B7BE6C331D6B7DD11492422B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Exposure.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Resume\Exposure.png
Size 6KB
SHA256 63f7e1fe8bb7b64a5dc7dfc2c7a3018202c926b49d29c14b896ae03c63ecd543
MD5 9297cc364a4eaa4c8a3e54bc6d4e7fac
SHA1 1460df0eabb1c973b0564ef96c1f537f37ca1d8f
SHA512 764fddc1c38e981507510d1c3c0b31f053fee09f2af5600576db644ee476efce865d5564f74a5c7d7374cef5db0270e03ebea0e271db8c34a8bec294ee93040d
SSDEEP 192:GCHJ8tFvuFWphqkx4dhJK/ZFOU1bL8yvkF:yusBxIJk8U1b1kF
TLSH
T18DD19EC43FB8C5A8C1861B28523C660DECE4B1EF661594BB3B57412A67134BD1E62E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pattern.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Resume\Pattern.doc
Size 39KB
SHA256 1902bda413c32cb19a1da879b6faeeb5c91898530a54fe0088d12aabd0bf5887
MD5 575ba64ffc8ffd14312725f30792c1d6
SHA1 9553a3351fce3016fc69d70ca7d4f715511053f7
SHA512 ce1a6d6993e9928716d6ad2eae2a0ca80f1450c1999aa7c5f60e97919c752cea2208a4709a722f83629f7936f2025c7c4c90bf0e1d26d29cd70b537c255da24a
SSDEEP 768:YTasGtZ6Hj/BW/rcSPM67GDpkhz5eKQjWV:hPIjZW/rcEMHDehz5eb+
TLSH
T14E035D53E7868D47E07387B4ADBB4A641B71AE08FE26B7FB05003F9F2D715904E94229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pattern.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Resume\Pattern.png
Size 2KB
SHA256 ca6df52de992ec50135187752116004153dfd29d50a860f41eb02ac59af5e202
MD5 23da00cb47c763151c68b48755bc23aa
SHA1 eb19adc3cf14c3db8a90c4a04cb2612159922410
SHA512 f03641968c1619258cb3ffb3ee0923f43caa2f5c4f24bc72f4a76e63b8b9b12e55949388bdfdc03f690a95a8d1c0083fea0d3250e8821bfc50a57732a52a15b7
TLSH
T1E15119DBD8027C9C83C59DAFDD65E5FA3AE686292C45E600153778F911EF3A29205101
MD5 SHA1 SHA512 TLSH

Submit Download

Puzzle.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Resume\Puzzle.doc
Size 113KB
SHA256 81573c20775260d090c561aaf010e5130183373bcb342a6002a6a15ca274515c
MD5 8a8fcb932f9459f15d3afe2fc27bc02a
SHA1 443632eaa096347a6f5cf818cbd64ca7787c1e70
SHA512 bd7314941cfe76ee14c9ec9695888777bae6dd8423c105c2e9b978d5407b90b9642b6cbc8d8a4f454fbafba683bd73705eb175419c62366003ba14e1593625b8
SSDEEP 768:1LJJGJgLSewNZe5wARW7jNHmqM48T3P2gmW3AHglnQLyioB1aS5+aRxDtBMvNpNw:bIeyM5wFNHmb7i+Q7oV5VRCFpr
TLSH
T1B3B37D038D49CB83E12987F8BE574DA92B172F48E4527AFB10612EDF7E315524DCA12D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Puzzle.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Resume\Puzzle.png
Size 3KB
SHA256 011159176ba344a78483a103ff791d0ab2eb376f01eed71184b8f8a5805e1beb
MD5 eeee77ccdc97bdb74fc728fdde8e5025
SHA1 27eed1d3a5a6d555e73f649ffbffd5c4180a6724
SHA512 2738f9dc4ae18528c2e80b85c493515397372b47ffefdb32a9f2d4ddb49a6da2e53fbb7e4d9ff8fbb1d48742eb9b34586ab07b2c0e6143886c36fa7ee61ca064
TLSH
T1CC818DFECA807F7589AF4C65D76E905D210CA360C2C1A20A7412846E233E7BD0C42FF1
MD5 SHA1 SHA512 TLSH

Submit Download

Sailboat.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Resume\Sailboat.png
Size 5KB
SHA256 3580adfe953d2edcb257f9eb23011d0a3e8ca76a0836b0e7f3fe388ae1f6459f
MD5 bef6526306a5c67d8ca73712aabfa349
SHA1 2b229c297acf489f3b3c09489c290e1501d411d5
SHA512 b260ca97b9c8f069214e8df1b88b099f1e7bde2dba5cb4b72c56e41da62bf6fe22e650a89a28c9efe192970608193cc9ccedf226bc5140d0f6c3d112c765d692
SSDEEP 96:YM72juETzOYM6dUs1nmyDJwvf+9EbUHd2NrPkRpTeqb4I0vPdPSNp+2:Y2MzOYvd58H+WUHqGTeq8IqPE
TLSH
T109B19F82D13A133807583F671752E4617B6C97CB4689338C0DE50AABB5343AA175E9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Austere.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Thesis\Austere.doc
Size 29KB
SHA256 f4d7a9b37d67a658830290eadb421af37e1758a2def0f881040354fd04454564
MD5 b098823186539780c635244a044b95b9
SHA1 9d5a0f6b3863f0ead06a888211bdb113f6860756
SHA512 df33fc42126fe83c40d5a0f9ec03f6b32233f0efa3188dc3439722f90fc91c7abdf5c6c48e8721ed1cba71a28a33a71b44dec427daf705201b924649d46666f9
SSDEEP 192:vTCxWJUxLeLSytx/4JSEOFkQL9/g44n42uqsuLT:rCxWJrwJ4kQp/g44n4RqsET
TLSH
T1DED21205FF94CA07E0BAA6308DFA83993764FE989F615B0F3088776E7D722B45E50650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Austere.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Thesis\Austere.png
Size 1KB
SHA256 5ac3077d7c47b4372b78f06c5e3338dee76e89d7cc47dcbce6a4554f07d2356e
MD5 8a852175f0980e350cf634fb837ecb30
SHA1 95e0200790da466999204836f30d6c1358df6ca6
SHA512 4934e8a7a0c57a961fb2e902a13fd4d2b7407161cb7f80d3c7b195904543305a958d0a0afdbab67e86bebe25f2899f7e8e8e5fd0f374aa62d73e17fc02f32d8e
TLSH
T10221E96D453FC8C932F4405F0D64E09945AC41BF657303C7CDD6B9701359E90BA507C2
MD5 SHA1 SHA512 TLSH

Submit Download

General.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Thesis\General.doc
Size 43KB
SHA256 8af1a3e1f3242fca4fc89a5d7a44d3e747836d1bcfe67ac420ff5c5fc7171d30
MD5 50a20e8bb72639ad7e7d8879a1a69614
SHA1 b1acf2a333ddca43e0e698ba88f8e406e84753fd
SHA512 591e58fd3c002f023cccf66265b0c76010be7985bb03adffba60a256c243938110483596bb80baff92b59bd51fa0287331de1b3031e2cb293abe875ae4d3cfaf
SSDEEP 384:+CEy8J8ifyuvLv37eKSKFkKT1K6EKYoUkO6ghoRtr5qroGkOmSbmSTwvigWraaBN:fWt7eKSKCKT1KTKkkdX5AEGkPXdaR
TLSH
T1AF13BE00FA54CB07D06A663089FF8A593774BE486F624B1F3198B7AD7EF13702E59A50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

General.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Thesis\General.png
Size 1KB
SHA256 4d6c6c10d2abb63565957e7cd748825895f87078604622a252fdbe7489b75f4e
MD5 3438d8533dadeb3fdfbec621c6bb4f75
SHA1 44004c1f16ab20279ea7123f78823f57709ee076
SHA512 419704e0b94999ed019134e9a4629571a70dc7e64d526a7f3327e5faab76a499a2f934854a6acaeb890699f69ebba35c0f5ed58e5db9ae56ef5ac09d846ea3b6
TLSH
T16831F9E1B887E06CF4A55D15C1F985E415AB86FAD83C940761772E07843CA7A139D4B8
MD5 SHA1 SHA512 TLSH

Submit Download

Line.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Thesis\Line.doc
Size 32KB
SHA256 c45663784f5d78ca1af72ca943f063bf613631da7a93b82f27efff308e4bb458
MD5 14de453cbf73e348714bb8d214eb9f34
SHA1 5ad440864e4a0606af7df986233d9853e6eb1a0c
SHA512 11e0e72c3b14698b8b6cbed29cd48de2796901bc45f38f1815b768aac7ef0d8a654a6ce3c25a7bc50ddd10995e7d537b5ffad8a6cd79778f6fbe8b623dc9e05b
SSDEEP 384:YCXnNtlf2Ul5grJZrZ9znn44nsngKlNU:59hQn19n44nsnJl
TLSH
T18FE24101FB84CB06E4AAA6308DFB87993774FE88AF514B0F3088723D7D722B45E55A54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Line.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Thesis\Line.png
Size 1KB
SHA256 6421a1676c1a7aadb99fd701d82824ae4a39a05864872d4f26ad3878d75d6950
MD5 57ce01eb4fb52f94ca92741e8e1759aa
SHA1 acf15dac22af23c722cbc6345ccccbd314fdcb1c
SHA512 015ca656627ec06308eebf4ccb18309888f8bcda152e3d4b77878eac64c026bf0870dab8587ec4058f7527353eec2bf561bed30ad25568829350723a64968bce
TLSH
T17731E8E83946BAD14CFD4172C5BEE4E645E406E12CB1A942F1138230D7E991687B5727
MD5 SHA1 SHA512 TLSH

Submit Download

Pinstripe.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Thesis\Pinstripe.doc
Size 42KB
SHA256 f5a12d1751a879ebe329af04dfbe45727df7c2b04bb396eba283e72c29d88ea7
MD5 8e86347f1b43cc9b70e4017d393d6f4f
SHA1 4d8086a1e58a948f5323d60d41efef61adadb110
SHA512 9095b84840aaf3557e727d028f15e4d1802eda91ed9c940b2d7a03ddac3eb3ef56e6333315c0dcb1a89e4d367c83864b9ba3992e4fb2d7bf662d4af296b2cc90
SSDEEP 768:o1PvuIQlIJmSS9/9g7959N9hh3ydyogs444nsgks++:svuIQlIeux44nsgksN
TLSH
T19D13A901FF40CB06D0B9663189EB874A3764FD886F554B2F2198FB2D7EB13B06E95A44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pinstripe.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Thesis\Pinstripe.png
Size 1KB
SHA256 fbaf59f772a2c4e711b394695f500dec572504b8a039ac661ddd44b47400f59b
MD5 cd1c8467651014022c1e95def50e14a4
SHA1 0fb8e2fec81b93821e4a5b82e9b979a241a39a61
SHA512 b5096c8d735e2445df083d5d1c8ecc5eb72884de1367ac6f8a2e187c4d5b68c84a882babffaaa183ea6ca6b80f782e5c89f7d198584af12a459786c6b1e22688
TLSH
T11841F9A2612FDCA5F58DB228B62A532CD78FF08404BDD146EF402DD01ED266121D8254
MD5 SHA1 SHA512 TLSH

Submit Download

Professional.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Thesis\Professional.doc
Size 75KB
SHA256 a4415030cd05065e0f68e62f254f2d4ba2cd6073af0dee5d617290c2bb405278
MD5 2443ee9115b5e8dda743461ddbfadbb9
SHA1 d3a329ea9b3164f3e9b1dcdba26e01aef872f5bf
SHA512 ffd4e808ce2a02c2ad69e7c2184963b07add73bde4afd2e68f2b10d026332a6a3ad653a6aaa912752434e5e748b52143e9cedacfea68b239ab37ba76f66deba2
SSDEEP 768:jZKhYoTyaUucdDCWLdsiY44K72xyY6p1tVztI8Ok0YCmDjyjidC7L9Dg6hr73BmN:jCY+yaUVDCALIQxGrDU3
TLSH
T13C739502FA558A32D1E555B0C9F785A52760AC941FD00A4F3E8CF62D3CBB67CAEF5620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Professional.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\lengthwise\Thesis\Professional.png
Size 1KB
SHA256 5fc271c1d3fc1c338e634d6d32732cfbc477738a6dcd7fe9114f4355766bc363
MD5 0a7a48fa8db10a6500064176461125db
SHA1 eb79fe9cb40f615b316734379d988364859243f3
SHA512 52b273764e0ea2fd8c32db3f7746f01399f6a484e75ef00de01dec91c903e0cc35dbaf750ec29c4f3a64b8f404fb8b776111aac3fa731df07646250b158c43b1
TLSH
T17531F8DCA346A4270BAF4C482FDD0055F4462FA862DB4D391BC3D2D6A904C294470BAB
MD5 SHA1 SHA512 TLSH

Submit Download

Arrow.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\transverse\transverse\Arrow.doc
Size 122KB
SHA256 d5a7d0df9c5e00bc71efec1dcb7efe1706df3353b1ec9160fd9936627edc9484
MD5 9b49e7112afca643818a3d7aaf487a7b
SHA1 98f43fabb0ba05c6a7d056bafa0e903e97fd38e4
SHA512 702cb8fc18379da082891a7179cdafe9a79f60bc3e96558509bf2aa9bd8bd615773d1bed52729e087e2e73bafe2695103ae3e7465c8a3747cc73d4cf945c6f4d
SSDEEP 3072:dwXRo/ketUPgubc9Bvd9wp3uZZpMVOaITeZfA:DketUPdbc9F8p3kZpMVYTetA
TLSH
T12DC3E001A7D58C82F8F7073848B69BA53BB2FE547A37675A740C3A2A7B737805E54312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Arrow.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\transverse\transverse\Arrow.png
Size 5KB
SHA256 0fc571fb779bb490d2a30afef50be921e8b66072c7d5c5c6cd78ed10995c41fe
MD5 e26063c54af077cd30672a3781d672bd
SHA1 f5d7a9e4492586bbdf15b84791252ef33f52fdb1
SHA512 e6240b5b35cfdd76f1411952074bb6d54d1fc0e2c1d58ea9fb4df5ce5b9609946370dfad4ad6181e41c04ce6b1a08e1c27c5433b3e6f3597a219d9a4a5511513
SSDEEP 96:MNKApdVURMz9KxI2BtdX5TBRMNWrxyL7nXpKwSBgg9fpWLOBI6vHUF7IFcM:QKApnGgqtzBRMNZLXpIWgpkOi6v+sR
TLSH
T13BB19E474D09B12C8F1B0F28D2D3A62288CFA8D18CD23B857510F8A13A73CE6A9544C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dots.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\transverse\transverse\Dots.doc
Size 122KB
SHA256 3be14b424a36619c2845cffb4cbc9040561f3680f965b76220572d38eacbc76e
MD5 ab4db8ae3d11d804237a46ee40e5a763
SHA1 f92ede99c3ac12813ac393ce5d55dad166a801b4
SHA512 31b525710bd2220b504cd9c5342be5b33e9e9a78dbb9944a3ce41f7da4d960cbb2284df90deaa6682ebfdc50ce83ec31c94233a50bdce4ae2b769e4ec49de3c5
SSDEEP 3072:xwX+Zy4+XbfRt5l2lwFwZ3Q/VAHN3M9RA:nM1t6hZ4mNcLA
TLSH
T197C36B13FF81DB0ED06912310DFA83993A24FE989B165A4F31887EAE7E715706DD3690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dots.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\transverse\transverse\Dots.png
Size 3KB
SHA256 fc3ecb7e3e0fa701f57d960c7ddf617459fe92039072e3e335fa8d59caee1efe
MD5 05960d5726ac1305a70cbd3fbb005dad
SHA1 27be9a5bf27a26817035d1d00f1f790aa641e96b
SHA512 9fc4819b3083589ce258c3eadc69f6033242dbcfeca1902b75682dbc896bd89fb284f19d67c249ac4712817a5bd262a731b94fc75865832e848a39ae74e35981
TLSH
T15C816E573C595BAF1BE01EDF0DEB5A10DD264255477039168524DC4C1AB1A42B2CD09E
MD5 SHA1 SHA512 TLSH

Submit Download

Line.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\transverse\transverse\Line.doc
Size 120KB
SHA256 1f565f0980bb91be4efef7e3707a802821941a0d85abdd18346b9937fc526a9a
MD5 0e226c96e8559ed1d44fad6bfbc747a0
SHA1 c8879e6d8b5fd79194d983aff074074d0abb0554
SHA512 86f5f3156116cb58e934cd69341d64029aa9b70b51dfb49bfb4ed8530732e116f0055f51489edc872e107ca4d347c0d7911bdbf5af2096633dd223fc054f75d6
SSDEEP 3072:2wXLzckffffffffffffffffHP9Us6Kb3QYdUpaRou0drfe7gu:PffffffffffffffffHPqg8Lsou0pe7gu
TLSH
T174C3D010A7E89941F6F72B3480F5C7207B60FE1EA677A7C7358C360DAB30D909A59306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Line.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\transverse\transverse\Line.png
Size 5KB
SHA256 eddf366dfad7f4ce6e4d0ce34b1a49afaf56b5ecf7dad9c07a2857219e559f89
MD5 37a11d224e0fb8b1cec02e58ac884b19
SHA1 0b5c1ff2c0a0b0ccf3d9233a84b04a2729d05e0f
SHA512 1c8ffd4c8fd7344237634cee8cbe169132b55da175b10ee109e9680f1a4cdc9ec2e4156c52bf985e1ac73619aae6fab1b20c24b75af1af5e9f14275f64e8157f
SSDEEP 96:KQ1k5t4sy+BLDtFxXrDyZJ3NIh87j2IV170zjA984NpaZ7Pzc0tF:30tI+/bApNDCqpaZjzjtF
TLSH
T169B19D084AB3CE673C9D8CA54E67EDD09DF77A2350C51C8CE440CCA220750167D92BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newsprint.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\transverse\transverse\Newsprint.doc
Size 46KB
SHA256 990ce5ff76e387a4049dba1c1151ca81ecd97fce34678bf52fac0b40a9b663ac
MD5 f435647bc5afaaecf0bbb0b829cb104f
SHA1 a8f23979af80a98f93b59cfed65fd4a0a7cf98f8
SHA512 37aec597df168356bfd7157e392dd7d88d8ede3dc331cc2b7e28074582df4fb8ca363399b7e0c79e76e7cf33562381cf64b14bf715b86f3fb995048f4b415e96
SSDEEP 384:uCMZU6iVJKcY8NC47+gcTXiy37kPtph8y6W4zZbDK:JVJKcY8NC47ab7gJ8y6WyND
TLSH
T1A7234511FF548B06E06961718AFB8B6966ACED58BB015F0F2288B31D7E353703F6A950
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newsprint.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\transverse\transverse\Newsprint.png
Size 2KB
SHA256 25d72791fed31ace323a3e5437097020a9cf711134df361e172ee7a7e70f58da
MD5 593f51f22bf140e4507eff646091f55e
SHA1 5ff06a4cffe938babd9424195beca82545560d82
SHA512 b22b449ab43a1bc0530b705a05ee6ccc5f2fbe1292e691930fde753660534244ea2e6140768dbb44fecabb718411694eeeadd14474a567a3e3096991397c6785
TLSH
T12E515BC966DDCC00BF3A122CEE73AA046847597958AAE8C558DF94F880E7D10C901051
MD5 SHA1 SHA512 TLSH

Submit Download

Stacks.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\transverse\transverse\Stacks.doc
Size 37KB
SHA256 4da423419add27d44e147e666a6675dac9dacdef5b6a309d7c77f58f0899a053
MD5 f567c0f73dfe9c528fb90aea80c1efca
SHA1 c1555b288a8783171fd3d2bfe21211172c465be9
SHA512 aa28ef062d83c4b20d44dd3055a7dcd4ef6c6e34041476a46285f00d115e04f8ae29919d94c312770540bd1976a71feb29d71f7d6aaac4f6c81b71cdfd9b8c2d
SSDEEP 384:cCm7/ka9nAr9RWFh6rbbKH35KFKTKrKJYc39qcQdWV+++jAE:KkCAtfKH35KFKTKrKJd3+WV+++j
TLSH
T11503EB06FB40CB02E4AD56718AEB478D2764FD446F454A2F3198F32CBDB23B47E56690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stacks.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\transverse\transverse\Stacks.png
Size 2KB
SHA256 d0009391f11e1848dbde57556b1fcd1f200ced2c072bd85977482354d9504760
MD5 8b105942ef92834a50a44034f2e680c5
SHA1 46c0990afa37e95ac06a326cb8e85f3c651132b4
SHA512 5968f451e1f286f491cab05bb2e4520cb19eb640b0488fa37c3b87e3f2d8cebfdd68b538637feb180a757290fe0ed0a268c9e644c680f2fa2170d81d1f1a7790
TLSH
T1824119F3B5306EB6941A086AF6999FC6F80CCB8F34204633466138302215E5768A6AC9
MD5 SHA1 SHA512 TLSH

Submit Download

Traditional.doc

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\transverse\transverse\Traditional.doc
Size 81KB
SHA256 636892afe20e3946cd3c712499f8da36e22f58741586fbadc5e6db5587ddc78f
MD5 c01a2781aef6b3c6c6a5c67710958fdf
SHA1 f0fe1a972258e5d4f833c2d871e868f6a0ab9328
SHA512 ebe9aac988f1574026d53f683d0d01d0d9ece18757f98b666940ad29d6a98490c84655ff1a8524a2c6053df4ed7b5e6aaf9b9555be9e436acc6538635e206b7b
SSDEEP 1536:+wn2cbpN4YsctSifeJZ8WArlmEHEIdxNB9W7wzzyabzrUOFX1:+wgD+zznbbX
TLSH
T10C832914AA57CE4BC9992331496B8F483732BD48B965CF5B31A5BB1CFD732912E1060B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Traditional.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\templates\coverpage\buildin\transverse\transverse\Traditional.png
Size 2KB
SHA256 72c00ccd1cc38c000833b749dcb4b8f6eeba65827f332629e9b21f79861ceb3b
MD5 1fe400f5cd6eb43c7c9d3a6bc7f71fb7
SHA1 6cf2d4117f8a7d9300caafaa62639038155f0d56
SHA512 b32b11ccf4c43f6726e6876dd4f4ab74bb18f9c8ef86f086c77dcae6978a21972cefc0dc842e244a304645118fe39dfc5d577b751c90efa84ac2af5d1f179dc2
TLSH
T104514CCD6A19CD6B814C417FC623C571D9940DB307744241EA91FEA93DA2A9DC42B2AD
MD5 SHA1 SHA512 TLSH

Submit Download

wpscli.qm

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\klangeses_3.1.0.1827\es_ES\wpscli.qm
Size 554B
SHA256 00591a367772b1a4912e035a2480f410df2f112823b9a0954131ac3aaa7aaeb2
MD5 25db3ea2fbcade799a0bda720d8873e2
SHA1 dff455c864d3f2f9400343b3f89f162551a080d7
SHA512 d82d2b12aa2863ad2980b0ee72e54aed9fea2973e3d8d1b0637719c3699205641b2ba4568c03e7176a2d503684a4e01d0f96f5db3b25658f9d0d2a719258b5a4
TLSH
T163F09E1667F8160EE3B69B70457A05204A367C225A3CD20B6664609D49A4E10DC7CB33
MD5 SHA1 SHA512 TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\pdfwspvreg_3.1.0.6196\download.7z
Size 75KB
SHA256 746d94dea0b9a088a09d3c85d7ca1f07bc082bad29b2cccc2434207337a478bd
MD5 8b1ef247552bff48daacd2fd51e4a705
SHA1 3139883050b51a506039e988e2a3ae1bc42d8d82
SHA512 1428c5c901c6ae6652a67c7a74b77ad9e9380785134b5c01548507012f57c00620085199fa21f549ad55822d86e4edc909bf9e81ff69da9d94ce69edc6ca852f
SSDEEP 1536:bySsmogu0t46AQtXYOYEexuKfrOOy+/XxuSomJMU0RYolbbzd:brvbZt46AQVh59KCa1Srlbbzd
TLSH
T1F073022C16B54FDFFB9594259C62AF62BB3DDE36D289C4F6079018018C8AD7878903E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\upkdcsdk260611_3.1.0.1\download.7z
Size 636KB
SHA256 47cc0fb503b30c8007924cff3ab38dd355f3c1a9882a8959d6dc4d7cc9ce421e
MD5 5f00fc979d3c92de91a039720b4f38aa
SHA1 37c3ee9623f7fbc1dba05b39ed92cbd1a267fc8b
SHA512 59d5529bb0c0be1716cf59b10a9886cf89809df749f594f53069e6ccc3641c9d0377bf90aec2ec57f1c36c847280c2e27f28c15e76a4594c9f5ce65d172651f2
SSDEEP 12288:0nmct+zOWbShRCpB0ZU7NUpYIaVDE/JL7sWahewU6LE9dGAzvi34k8Ghu88mkkW:0nmcwUG7NUKDEGheuLCxzv0LDhnI
TLSH
T113D4239B2A208EA8C13F543E7D6F9ED19615C9FCD3DD176C8E4A172EB2A1174DB30920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wps_wid.cid-420611363.1782425729.exe

Path C:\Users\Admin\Downloads\wps_wid.cid-420611363.1782425729.exe
Size 5.2MB
SHA256 3835e835445dc42859f011641d67669bec1abfbcf56e53f2d4f7e99aac00bef6
MD5 ab725aa877a43a9e5dfe2531f663e14e
SHA1 96d088179ef14ca43838cc8231c13f1bf369f274
SHA512 f08811e8a9389d44f929402bb8ae266a39d1d64d43eee06e4c222a125f16eea917e1724efe7c24dab6beac5e85bda28e4b888b4a23576ebe0e5f33a7f39eca86
SSDEEP 98304:jtSuMOINjO91x364DThTx4NVMFb/55PU/qOc:oMJcM9/5RwA
TLSH
T16F46BF01BB85C5F1E5D201B0597AAB7A983DBE28573088C7A7D11D2A88312D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4768-720-0x00007FF988C90000-0x00007FF98921E000-memory.dmp

Download

memory/5124-8735-0x00007FF98E1C0000-0x00007FF98E304000-memory.dmp

Download

memory/5124-8753-0x00007FF9816B0000-0x00007FF9833B0000-memory.dmp

Download

memory/5124-8734-0x00007FF607BB0000-0x00007FF607F5E000-memory.dmp

Download

memory/5124-8737-0x00007FF986A30000-0x00007FF986FBE000-memory.dmp

Download

memory/5124-8736-0x00007FF986FC0000-0x00007FF987C0E000-memory.dmp

Download

memory/5276-8632-0x00007FF983900000-0x00007FF984319000-memory.dmp

Download

memory/5276-8610-0x00007FF607BB0000-0x00007FF607F5E000-memory.dmp

Download

memory/5276-8613-0x00007FF986A30000-0x00007FF986FBE000-memory.dmp

Download

memory/5276-8611-0x00007FF986FC0000-0x00007FF987C0E000-memory.dmp

Download

memory/5276-8628-0x00007FF9816B0000-0x00007FF9833B0000-memory.dmp

Download

memory/5276-8612-0x00007FF98E1C0000-0x00007FF98E304000-memory.dmp

Download

memory/5276-8631-0x00007FF97FC10000-0x00007FF9816A7000-memory.dmp

Download

memory/5832-8685-0x00007FF986A30000-0x00007FF986FBE000-memory.dmp

Download

memory/5832-8701-0x00007FF9816B0000-0x00007FF9833B0000-memory.dmp

Download

memory/5832-8682-0x00007FF607BB0000-0x00007FF607F5E000-memory.dmp

Download

memory/5832-8684-0x00007FF98E1C0000-0x00007FF98E304000-memory.dmp

Download

memory/5832-8683-0x00007FF986FC0000-0x00007FF987C0E000-memory.dmp

Download

memory/6068-8651-0x00007FF607BB0000-0x00007FF607F5E000-memory.dmp

Download

memory/6068-8681-0x00007FF983900000-0x00007FF984319000-memory.dmp

Download

memory/6068-8680-0x00007FF97FC10000-0x00007FF9816A7000-memory.dmp

Download

memory/6068-8669-0x00007FF9816B0000-0x00007FF9833B0000-memory.dmp

Download

memory/6068-8654-0x00007FF98E1C0000-0x00007FF98E304000-memory.dmp

Download

memory/6068-8653-0x00007FF986A30000-0x00007FF986FBE000-memory.dmp

Download

memory/6068-8652-0x00007FF986FC0000-0x00007FF987C0E000-memory.dmp

Download

memory/6404-8595-0x00007FF9816B0000-0x00007FF9833B0000-memory.dmp

Download

memory/6404-8579-0x00007FF986FC0000-0x00007FF987C0E000-memory.dmp

Download

memory/6404-8577-0x00007FF607BB0000-0x00007FF607F5E000-memory.dmp

Download

memory/6404-8580-0x00007FF986A30000-0x00007FF986FBE000-memory.dmp

Download

memory/6404-8578-0x00007FF98E1C0000-0x00007FF98E304000-memory.dmp

Download

memory/6852-8813-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/6852-8814-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/6852-8816-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/6852-8815-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/7268-8779-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/7268-8775-0x00007FF98DFB0000-0x00007FF98E0F4000-memory.dmp

Download

memory/7268-8774-0x00007FF607BB0000-0x00007FF607F5E000-memory.dmp

Download

memory/7268-8787-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/7268-8786-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/7268-8785-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/7268-8784-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/7268-8783-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/7268-8800-0x0000018B52FE0000-0x0000018B5313A000-memory.dmp

Download

memory/7268-8782-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/7268-8781-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/7268-8780-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/7268-8776-0x00007FF986FC0000-0x00007FF987C0E000-memory.dmp

Download

memory/7268-8778-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/7268-8773-0x00007FF986A30000-0x00007FF986FBE000-memory.dmp

Download

memory/9208-8551-0x00007FF607BB0000-0x00007FF607F5E000-memory.dmp

Download

memory/9208-8557-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/9208-8556-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/9208-8565-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/9208-8552-0x00007FF98E1C0000-0x00007FF98E304000-memory.dmp

Download

memory/9208-8553-0x00007FF986A30000-0x00007FF986FBE000-memory.dmp

Download

memory/9208-8555-0x00007FF96F5D0000-0x00007FF96F5E0000-memory.dmp

Download

memory/9208-8554-0x00007FF986FC0000-0x00007FF987C0E000-memory.dmp

Download

memory/9208-8558-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/9208-8559-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/9208-8560-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/9208-8561-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/9208-8562-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/9208-8563-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download

memory/9208-8564-0x00007FF96DE20000-0x00007FF96DE30000-memory.dmp

Download