hxxps://eu[.]wps[.]com/cms/docs/d/cbnadutte2xd0fuv?sa=601[.]1074&refer=viber

Analysis

user interaction
yes
max time kernel
81s
max time network
201s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/11/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://eu.wps.com/cms/docs/d/cbnadutte2xd0fuv?sa=601.1074&refer=viber
Sample261102-mta25sbs8n

Score

8^/10

bootkit defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
132	4460	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
4980	wps_wid.cid-1719612814.1793616304.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
3276	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe

Loads dropped DLL 17 IoCs

pid	Process
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe

Unexpected DNS network traffic destination 39 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	119.29.29.29
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.6.6.6
Destination IP	119.29.29.29
Destination IP	119.29.29.29

Writes a Windows system DLL name to a user directory 2 TTPs 1 IoCs

A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

defense_evasion

DLL Search Order Hijacking

T1574.001

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\dbghelp.dll	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
12832	ksomisc.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
File opened for modification	\??\PhysicalDrive0	wps_wid.cid-1719612814.1793616304.exe
File opened for modification	\??\PhysicalDrive0	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wps_wid.cid-1719612814.1793616304.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wps_wid.cid-1719612814.1793616304.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wps_wid.cid-1719612814.1793616304.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4460	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-686476835-2493921010-524562731-1000\{DBE9C733-AE83-4F54-B6ED-F5765D72A69D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings	msedge.exe

Modifies system certificate store 2 TTPs 36 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CTLs	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CRLs	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\Homegroup Machine Certificates\Certificates	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\SystemCertificates\Homegroup Machine Certificates	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\SystemCertificates\TrustedDevices	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\Homegroup Machine Certificates\CRLs	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\SystemCertificates\FlightRoot	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\SystemCertificates\TestSignRoot	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CRLs	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\Homegroup Machine Certificates\CTLs	wps_wid.cid-1719612814.1793616304.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\Certificates	wps_wid.cid-1719612814.1793616304.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
4980	wps_wid.cid-1719612814.1793616304.exe
4980	wps_wid.cid-1719612814.1793616304.exe
4980	wps_wid.cid-1719612814.1793616304.exe
4980	wps_wid.cid-1719612814.1793616304.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
3276	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
3276	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
3276	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
3276	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
3276	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
3276	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
3276	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
3276	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
3276	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
3276	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
3276	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
3276	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
Token: SeRestorePrivilege	1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
Token: SeRestorePrivilege	1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
Token: SeRestorePrivilege	1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
Token: SeRestorePrivilege	1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1632	87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 604	4140	msedge.exe	85
PID 4140 wrote to memory of 4460	4140	msedge.exe	87
PID 4140 wrote to memory of 1072	4140	msedge.exe	88
PID 4140 wrote to memory of 1468	4140	msedge.exe	89
PID 4140 wrote to memory of 1072	4140	msedge.exe	88
PID 4140 wrote to memory of 1072	4140	msedge.exe	88
PID 4140 wrote to memory of 1468	4140	msedge.exe	89
PID 4140 wrote to memory of 2184	4140	msedge.exe	90
PID 4140 wrote to memory of 2184	4140	msedge.exe	90
PID 4140 wrote to memory of 4252	4140	msedge.exe	91
PID 4140 wrote to memory of 2184	4140	msedge.exe	90
PID 4140 wrote to memory of 4252	4140	msedge.exe	91
PID 4140 wrote to memory of 4252	4140	msedge.exe	91
PID 4140 wrote to memory of 1940	4140	msedge.exe	92
PID 4140 wrote to memory of 1940	4140	msedge.exe	92
PID 4140 wrote to memory of 1940	4140	msedge.exe	92
PID 4140 wrote to memory of 4472	4140	msedge.exe	93
PID 4140 wrote to memory of 4472	4140	msedge.exe	93
PID 4140 wrote to memory of 4472	4140	msedge.exe	93
PID 4140 wrote to memory of 2348	4140	msedge.exe	97
PID 4140 wrote to memory of 3988	4140	msedge.exe	98
PID 4140 wrote to memory of 2348	4140	msedge.exe	97
PID 4140 wrote to memory of 3988	4140	msedge.exe	98
PID 4140 wrote to memory of 640	4140	msedge.exe	100
PID 4140 wrote to memory of 4944	4140	msedge.exe	105
PID 4140 wrote to memory of 4944	4140	msedge.exe	105
PID 4140 wrote to memory of 4944	4140	msedge.exe	105
PID 4140 wrote to memory of 3720	4140	msedge.exe	107
PID 4140 wrote to memory of 3720	4140	msedge.exe	107
PID 4140 wrote to memory of 3720	4140	msedge.exe	107
PID 4140 wrote to memory of 3604	4140	msedge.exe	108
PID 4140 wrote to memory of 1188	4140	msedge.exe	109
PID 4140 wrote to memory of 3604	4140	msedge.exe	108
PID 4140 wrote to memory of 3604	4140	msedge.exe	108
PID 4140 wrote to memory of 1188	4140	msedge.exe	109
PID 4140 wrote to memory of 2184	4140	msedge.exe	110
PID 4140 wrote to memory of 4844	4140	msedge.exe	111
PID 4140 wrote to memory of 4844	4140	msedge.exe	111
PID 4140 wrote to memory of 1424	4140	msedge.exe	118
PID 4140 wrote to memory of 3236	4140	msedge.exe	119
PID 4140 wrote to memory of 1600	4140	msedge.exe	120
PID 4140 wrote to memory of 4608	4140	msedge.exe	122
PID 4140 wrote to memory of 4608	4140	msedge.exe	122
PID 4980 wrote to memory of 1632	4980	wps_wid.cid-1719612814.1793616304.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://eu.wps.com/cms/docs/d/cbnadutte2xd0fuv?sa=601.1074&refer=viber
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff89462c188,0x7ff89462c194,0x7ff89462c1a0
  2⤵
  PID:604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,14970785505444108129,18267843555080984467,524288 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,3832066600928517180,11025902373104367395,262144 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:2
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,17688750326647482104,6676765300769286168,524288 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,6156040382612222808,1633976960045281871,2097152 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,2101458990259837487,15180474237499122396,2097152 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,7944138140987132446,13696230980879954489,2097152 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,7295225005018707051,7672482391912771054,2097152 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,8330614034717962132,7433898150602427437,524288 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,4349306589242912837,5559385198201485701,524288 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,6270184760603601795,13287339298973260388,524288 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,6270184760603601795,13287339298973260388,524288 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6152,i,3173312767164688890,9093693097396088798,2097152 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4208,i,5082066431242465996,13898782793012678573,2097152 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6540,i,16084100080681689109,12920773843081591101,2097152 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,11372825734415912653,8828409837092843716,524288 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,55993383266440161,13183863948652622219,524288 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,15581202757132486242,9816412099645279298,524288 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,12032444979213345276,14120881874077329321,524288 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,1233081641327194967,16110171306604154339,524288 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,9435262956595208610,2050684336341763042,524288 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,5425695528486427330,11652106355309792912,524288 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6088,i,5286847300100137137,10368880936489045216,262144 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  PID:7732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,546410964995481061,8746239623157885531,524288 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,11365590428253444286,10470644547278723767,524288 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,7536173563124657576,16303641567632840404,524288 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:8
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5732,i,8485474965361325726,7585191364610014703,2097152 --field-trial-handle=2556,i,3483121939780034445,14036677970162367837,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:14276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:868

C:\Users\Admin\Downloads\wps_wid.cid-1719612814.1793616304.exe
"C:\Users\Admin\Downloads\wps_wid.cid-1719612814.1793616304.exe"
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4980
- C:\ProgramData\WPS\Installers\87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
  "C:\ProgramData\WPS\Installers\87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -installMsoAddin -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes a Windows system DLL name to a user directory
  - Writes to the Master Boot Record (MBR)
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1632
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe" -installregister sharedMemory_message_E5A75CD
    3⤵
    PID:12152
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingshellext64.dll"
      4⤵
      PID:13828
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kwpsshellext64.dll"
      4⤵
      PID:14140
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\pdfwspv\pdfwspv.dll"
      4⤵
      PID:8448
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*install "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"
      4⤵
      PID:8624
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\pdfwspv\pdfwspv.dll"
      4⤵
      PID:10736
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*thumbnail "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"
      4⤵
      PID:10744
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*drivebho "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"
      4⤵
      PID:11904
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\pdfwspv\pdfwspv.dll"
      4⤵
      PID:11808
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"
      4⤵
      PID:12448
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"
      4⤵
      PID:2820
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*onlinefile "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"
      4⤵
      PID:4196
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe" -checkInstallEnvironment
    3⤵
    PID:11888
- - C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
    "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService
    3⤵
    PID:12648
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wpsoffice.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wpsoffice.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=klangmanager -dll_name=klangmanager.dll downloadlang en_US
    3⤵
    PID:12780
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe" -sendinstalldyn 5
    3⤵
    PID:12792
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kvprinter\Kvpins64.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kvprinter\Kvpins64.exe" /i "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kvprinter\Kvpins64.inf" /s
    3⤵
    PID:8336
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kvprinter\kvpvbsext.dll",_X86ScriptHostEntry VBScript 845831E9021E49B0BDBCF37337BC5B7F 1 Uninstall /_X64Cast
      4⤵
      PID:11796
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kvprinter\kvpvbsext.dll",_X86ScriptHostEntry VBScript 1647B4C4897D482D99E5663DFB707DA7 1 Install /_X64Cast
      4⤵
      PID:2016
  - - C:\Windows\system32\spool\DRIVERS\x64\3\kvpet.exe
      C:\Windows\system32\spool\DRIVERS\x64\3\kvpet.exe pdf_virtualprinter_install 0x3f4, 0x68
      4⤵
      PID:12960
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\\office6\ksomisc.exe" -defragment
    3⤵
    PID:4320
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe" -unregisterwpsphotoautoasso
    3⤵
    PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://global.wps.com/activity/web/pc/install-success?activity_flag=aff68d4f3474ee257&page_flag=p6a720ee9e863df96?device_id=17a226440f85486c3fb9f918a5363a82&app_version=12.1.0.29162&channel=601.1074&platform=windows
  2⤵
  PID:6184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://global.wps.com/activity/web/pc/install-success?activity_flag=aff68d4f3474ee257&page_flag=p6a720ee9e863df96?device_id=17a226440f85486c3fb9f918a5363a82&app_version=12.1.0.29162&channel=601.1074&platform=windows
    3⤵
    PID:2616
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe" /prometheus /download_lang_on_start /lang=en_US /from=get_start_with_wps_after_install_onlinesetup
  2⤵
  PID:13760
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe" /prometheus /download_lang_on_start /lang=en_US /from=get_start_with_wps_after_install_onlinesetup
    3⤵
    PID:13360
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wpscloudsvr.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wpscloudsvr.exe" /qingbangong /start_from=qingipc /qingbangong /start_from=kstartpage silentautologin
      4⤵
      PID:6364
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe" -getabtest -forceperusermode
        5⤵
        
        PID:8316
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe" Run -Entry=EntryPoint "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6/addons/kcef/jsapibrowser.dll" --server=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --from=wpsoffice
      4⤵
      PID:6608
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\promecefpluginhost.exe
        
        "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=zh-CN --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --mojo-platform-channel-handle=1848 --field-trial-handle=2144,i,5812320931068376447,18256706521011584275,131072 --disable-features=TSFImeSupport /prefetch:2
        5⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\promecefpluginhost.exe
        
        "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=zh-CN --service-sandbox-type=none --no-sandbox --log-severity=disable --lang=zh-CN --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --mojo-platform-channel-handle=2360 --field-trial-handle=2144,i,5812320931068376447,18256706521011584275,131072 --disable-features=TSFImeSupport /prefetch:8
        5⤵
        
        PID:9068
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6608 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=2144,i,5812320931068376447,18256706521011584275,131072 --disable-features=TSFImeSupport /prefetch:1
        5⤵
        
        PID:9372
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6608 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3132 --field-trial-handle=2144,i,5812320931068376447,18256706521011584275,131072 --disable-features=TSFImeSupport /prefetch:1
        5⤵
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6608 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3312 --field-trial-handle=2144,i,5812320931068376447,18256706521011584275,131072 --disable-features=TSFImeSupport /prefetch:1
        5⤵
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6608 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3328 --field-trial-handle=2144,i,5812320931068376447,18256706521011584275,131072 --disable-features=TSFImeSupport /prefetch:1
        5⤵
        
        PID:9440
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6608 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3336 --field-trial-handle=2144,i,5812320931068376447,18256706521011584275,131072 --disable-features=TSFImeSupport /prefetch:1
        5⤵
        
        PID:9452
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6608 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3424 --field-trial-handle=2144,i,5812320931068376447,18256706521011584275,131072 --disable-features=TSFImeSupport /prefetch:1
        5⤵
        
        PID:9484
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6608 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3432 --field-trial-handle=2144,i,5812320931068376447,18256706521011584275,131072 --disable-features=TSFImeSupport /prefetch:1
        5⤵
        
        PID:9496
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6608 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3292 --field-trial-handle=2144,i,5812320931068376447,18256706521011584275,131072 --disable-features=TSFImeSupport /prefetch:1
        5⤵
        
        PID:10536
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6608 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3880 --field-trial-handle=2144,i,5812320931068376447,18256706521011584275,131072 --disable-features=TSFImeSupport /prefetch:1
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6608 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4148 --field-trial-handle=2144,i,5812320931068376447,18256706521011584275,131072 --disable-features=TSFImeSupport /prefetch:1
        5⤵
        
        PID:10280
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6608 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4144 --field-trial-handle=2144,i,5812320931068376447,18256706521011584275,131072 --disable-features=TSFImeSupport /prefetch:1
        5⤵
        
        PID:10260
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6608 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4136 --field-trial-handle=2144,i,5812320931068376447,18256706521011584275,131072 --disable-features=TSFImeSupport /prefetch:1
        5⤵
        
        PID:10392
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6608 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4164 --field-trial-handle=2144,i,5812320931068376447,18256706521011584275,131072 --disable-features=TSFImeSupport /prefetch:1
        5⤵
        
        PID:10376
- C:\ProgramData\tmp\recommend_installer.exe
  "C:\ProgramData\tmp\recommend_installer.exe" --silent --allusers=0 --show-onboarding-overlay --setdefaultbrowser=1
  2⤵
  PID:7984
- - C:\Users\Admin\AppData\Local\Temp\7zS03FD7BDB\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS03FD7BDB\installer.exe --silent --allusers=0 --show-onboarding-overlay --setdefaultbrowser=1 --server-tracking-blob=MTM5OTU2NzRmYzhlZjFkM2FlZGIyOTE4ODUxMDc0NTYyN2Q3ZmRlMmFmMGFiNjRmMGNjMzhkZWU3NzEzM2FlMTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdwcyZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj13cHN0ZXN0Mi9vcGVyYS5leGUiLCJ0aW1lc3RhbXAiOiIxNzkzNjE2NDg0Ljc3NzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJ3cHN0ZXN0Mi9vcGVyYS5leGUiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndwcyJ9LCJ1dWlkIjoiMDU5YjI2MjgtZDVlMi00NzEyLWEzZmQtN2FhYTg1NzI1MTM2In0=
    3⤵
    PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\7zS03FD7BDB\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS03FD7BDB\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.22 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff640674258,0x7ff640674268,0x7ff640674278
      4⤵
      PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\.opera\7c58a1a0-5fe5-495b-b6ef-7fdad6ddbdcf Opera Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\7c58a1a0-5fe5-495b-b6ef-7fdad6ddbdcf Opera Installer Temp\installer.exe" --version
      4⤵
      PID:6792
  - - C:\Users\Admin\AppData\Local\Temp\7zS03FD7BDB\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS03FD7BDB\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=6720 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\7c58a1a0-5fe5-495b-b6ef-7fdad6ddbdcf Opera Installer Temp\opera_package_20261102104806" --session-guid=1800b4ab-3dc2-412b-982e-dc379f49b928 --server-tracking-blob=OGZkYWFlNjU5NDYzYmM2NGU1MzlhMjQzNjQ5ZTFlNDlkNTc5MzkyOTM3NTJjOWMzM2EyNTBmMjVhMDljMWY4ZTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdwcyZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj13cHN0ZXN0Mi9vcGVyYS5leGUiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3OTM2MTY0ODQuNzc3NiIsInV0bSI6eyJjYW1wYWlnbiI6Indwc3Rlc3QyL29wZXJhLmV4ZSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3BzIn0sInV1aWQiOiIwNTliMjYyOC1kNWUyLTQ3MTItYTNmZC03YWFhODU3MjUxMzYifQ== --show-onboarding-overlay --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=DC08000000000000
      4⤵
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\7zS03FD7BDB\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS03FD7BDB\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.22 --initial-client-data=0x2a0,0x2a4,0x2a8,0x270,0x2ac,0x7ff640674258,0x7ff640674268,0x7ff640674278
        5⤵
        
        PID:232

C:\ProgramData\WPS\Installers\87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe
"C:\ProgramData\WPS\Installers\87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1074.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -installMsoAddin -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E59F8CD -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3276
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode -source=1
  2⤵
  - Network Service Discovery
  PID:12832
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk" 5386
    3⤵
    PID:14232
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\wtoolex\wpsupdate.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\wtoolex\wpsupdate.exe" /from:setup
  2⤵
  PID:7500
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe" -collectfileassoinfo -module=1;2;4;8;262144;524288;1048576 -daily -source=1
    3⤵
    PID:13836
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\wtoolex\wpsupdate.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\wtoolex\wpsupdate.exe" -createtask
  2⤵
  PID:7408
- C:\Windows\system32\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\kdesktopshellext\kdesktopshellext.dll"
  2⤵
  PID:13820
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\kdesktopshellext\kdesktopshellext.dll"
    3⤵
    PID:14252
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe" -regyunpanfornew -forceperusermode
  2⤵
  PID:5920
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"
    3⤵
    PID:5292
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:overlayicon "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"
    3⤵
    PID:6220
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"
    3⤵
    PID:6392
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"
    3⤵
    PID:6952

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe" -installregister sharedMemory_message_E5A9B28 -forceperusermode
1⤵
PID:11748
- C:\Windows\system32\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
  2⤵
  PID:14316
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
    3⤵
    PID:7840
- C:\Windows\system32\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
  2⤵
  PID:6168
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe" Run "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\ktaskschdtool\ktaskschdtool.dll" /task=wpsexternal /createtask
  2⤵
  PID:4944
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe" CheckService
    3⤵
    PID:8696
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe" Run -User=Admin -Entry=EntryPoint "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6/addons/ktaskschdtool/ktaskschdtool.dll" /user=Admin /task=wpsexternal /cleantask /pid=4944 /prv
    3⤵
    PID:9024
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kstartscreenpinchecker64.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kstartscreenpinchecker64.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Office.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Docs.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Slides.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Sheets.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk"
  2⤵
  PID:8768
- C:\Windows\System32\openwith.exe
  "C:\Windows\System32\openwith.exe"
  2⤵
  PID:12540
- C:\Windows\System32\openwith.exe
  "C:\Windows\System32\openwith.exe"
  2⤵
  PID:12552
- C:\Windows\System32\openwith.exe
  "C:\Windows\System32\openwith.exe"
  2⤵
  PID:12564
- C:\Windows\System32\openwith.exe
  "C:\Windows\System32\openwith.exe"
  2⤵
  PID:12580
- C:\Windows\System32\openwith.exe
  "C:\Windows\System32\openwith.exe"
  2⤵
  PID:7512
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Office.lnk" 51609
  2⤵
  PID:6044
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk" 51609
  2⤵
  PID:7444
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Docs.lnk" 51609
  2⤵
  PID:12764
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Slides.lnk" 51609
  2⤵
  PID:3600
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Sheets.lnk" 51609
  2⤵
  PID:4648
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk" 51609
  2⤵
  PID:1440
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Docs.lnk" 51606
  2⤵
  PID:7988
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Slides.lnk" 51606
  2⤵
  PID:3824
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Sheets.lnk" 51606
  2⤵
  PID:13884
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk" 51606
  2⤵
  PID:14064

C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
1⤵
PID:7780

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"
1⤵
PID:5476
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe"
  2⤵
  PID:5628

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kvprinter\kvpins64.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kvprinter\Kvpins64.exe"
1⤵
PID:9252

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wpscloudsvr.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wpscloudsvr.exe"
1⤵
PID:1364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Defense Evasion

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

recommend_installer.exe

Path C:\ProgramData\tmp\recommend_installer.exe
Size 3.2MB
SHA256 d8a1f43c2421679072c5dc3e67d987b482f6f88b68ba21eb58862e21da2d4369
MD5 63ad130e1cd306368b30897714100ca2
SHA1 cfd331bff8efbdf39ba7c3406863a730ccde90ec
SHA512 023fae3c58493dcd8fe6694fe06d1fefbf67af47b0d73fe18678db4576212f545d953852316873e10fe7516e7fbefc74056752f5ff7efd6a3ed8aba7689d0f29
SSDEEP 98304:NAh1iO5GGPXNI59rdjXM/Ltn0pO1P3k7oOfE700D:+cG+rLI28falE7JD
TLSH
T1B5F52342B7C0D875C22311325F66EBBD967CBD610F359B8777881A3E9F702829626F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 774203ea9ed53b626aa394ccbd3fe79aea2aa04b0682e81596a382656488252f
MD5 6dfe11c89bcf30daca1952a352ba4508
SHA1 dd58cd8ca0042b33e5b41ecaf3ef0186c36bb76c
SHA512 acb6318cbf073137646410a57d57f193f482d9ad84cb78485b660a378258a013e4d15a975e6ad329123cae61acc472fad19614ea940d0a2f307fa513e1c35af8
TLSH
T1DDF0D433747DB4B65811481C1EBED95021A5B46C06C6C9B6647425C88A9E3E2536611D
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 727B
SHA256 90bee1fdacfcd2dde78c43e6de4a19db4e914318414bcff109876e5899150970
MD5 4fa588cd9525eb430d178d2c4be0b26d
SHA1 ddb6b79576d1b24f027abbdbe2d7567b7d7387db
SHA512 13259b883c338d912081720a40d255ed50b924876a5861875d3b47b17251dcfa220826a27c1a31535784cf77c044636ff836cb66180ea7e9a50eeef44bd35cce
TLSH
T14001609168E82A0FBA228E0CAFBC603273A2812062D4002F267602CCF5987774F32840
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 5ed6e3278d522b55a451b979c6976812b6d4c8fe921b5fed6f8ebb57d5981a71
MD5 c880792578196140ee5130e5d05fe26e
SHA1 a2e4161da82d24031d3e124ac4b4433b7e93174c
SHA512 ed25c284aef43216b3332aacff1d5f3c7c6d575d41813e8fa263e5ef44c49f9a87263d05820ab1056428c75f6e53a2143256e45c8d8b0e92794b8b02ddab86ad
TLSH
T1E901154795E95D9238005813AA589B64FD6EA5CA10D412E6277E619F605D7BD4900144
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 deec519742f1dbdbc68956c4ba4e78460325428338aa4d9d0ec1ede2f121e61b
MD5 41be79867f57ed3a4c5efb56bba8e258
SHA1 91672e81ad7906b73b91fc04342c106698aa6abd
SHA512 3922fa8f85da852e0530b60135f4af767b2144fdcee77d71bff693a51bf81d6bc165844bfc44d689469477a23c8c4408d3afd131788bcaad86d36cfe4689e455
TLSH
T153E0202027FA552FF1E45F7543DA90D6AF29F1062D45577E4D81156D9D0AD004D93D30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 404B
SHA256 3995be7fe28480de8574cacc38e8b4616206d8d9a2fa6a58b6708c1d33d1faf7
MD5 9d7a5a1430407a806c29574bdd50cc70
SHA1 9b8df44a95f2272b339d466f1adb4e3734786d1a
SHA512 2440d231eb8710f0ac7f0ee9b17ee86781b3cdbc611afa8a4d3f5189ca7b7320a351a242df4d2719fe23b141284883c882077e9801c554e3685f1bb42e50d669
TLSH
T135E0C03122F9044EF1F1D03402F698210D89F1160A008269154453AAA625B004CB3374
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 103c11ae36e483abf3851ec4a231f59fe3656367b2d7e41574b9e91d738f698b
MD5 7c66c73d752404d0a6d6988ff5b250ff
SHA1 7eefb0c3a7bd57b5bcbb6e84107713c545fb9c3e
SHA512 37774d8c750470b2197466d8bf5c08b542e59b0a05dc31c3df340e36e5a8964220efc1fa041b4333789c028ede8d369eddb91bbef3ed2a80d0dac784970227cd
TLSH
T1B4E0683856AFA52EF190883442F9A0752D49E205140082B81AC04309B74AF005C21DF0
MD5 SHA1 SHA512 TLSH

Submit Download

Qt5NetworkKso.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\Qt5NetworkKso.dll
Size 1.4MB
SHA256 640b7a888898d56401e0c5a2ce6e983ef48cfaae02904392e3015b2fdb642884
MD5 0dac0bc1d5485cad76a14a93c29bb37d
SHA1 fef12731d92f9a2e007f921fffe144429d3573f5
SHA512 baecc8ff7733649555d8a7942d2cb457799bfa62cf9c7a3dabcc3c221b48d5a5877fc975f8aa7786d4d26d27e15e79f0a34a0eb2c544db31ab9fa026a22bf552
SSDEEP 24576:4kbqCgnInomjARXqFrdpEGcqHnwg0iOG+6VQBacty:HNgnOo2q1Gc4wKj+6Vgc
TLSH
T1D7655A53F7554399D62AD134CA8BC902F272740083A75BEF2669DB192F737E2263E381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything-KingSoft.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\everythingsearch\everythingbinary\Everything-KingSoft.ini
Size 404B
SHA256 b5980cd1122d2ad4727bc06806e3d2a6598b7d67b6eb3d2732938d08c6deedbb
MD5 6a4653f40acaaa13e2b0f60f067ea93f
SHA1 34981baa55ef31ae6b6d5985fdd02798e3bacde2
SHA512 f286472389e50fa51abe03068cc3e1f9d18b19926d84b66b1df28c157cbc70e8de32a8deb7b4096f462605a2bdd4d76f9863c6ca0872703c60d473a3271778ea
TLSH
T15DE02B99808C4B1C7656E6948D715E4F42E1C79C1B98174CCB0BC241E91950DF63A439
MD5 SHA1 SHA512 TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\kappessframework\mui\default\html_unified\run.ini
Size 171B
SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
MD5 b30cb271e143eace0f55ea2e562e1e9f
SHA1 9d97dbf24931cfc114384c3f4dbbae21c9e51be5
SHA512 dc593185fa63b458024c3a913c558e5686806154181dea67eec786ada50595c53bab822833ad1e76c9acdf21be3eba50631391b7e575d7f1f6409ceccf966535
TLSH
T1AAC080D4D0256F97DC31C6B5ED54AF1A7560E700251C1EC3D530DC4E9E9696551C805D
MD5 SHA1 SHA512 TLSH

Submit Download

error-net-72.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\kdocercore\mui\zh_CN\res\web\common\img\error-net-72.png
Size 1KB
SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
MD5 66726a0fbd424ccb700cecb212a47007
SHA1 9795ae26acf0b942ab6a0cd06f206ba69eda18db
SHA512 30ddd2fa17517792a86bdb03827a0809ed362ab2dbd9a7baf194d1f47348c96e0ca8e64515c1a58d7a1740e85f53a3676b49ff6c699d598a27c234c14672604f
TLSH
T1E031C6CD318AC42FCC61D531F4D534156817D760BF928C74102BC5576E0F68E58C6662
MD5 SHA1 SHA512 TLSH

Submit Download

theme_template_download_close.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\kdocercore\mui\zh_CN\res\web\common\img\theme_template_download_close.png
Size 1KB
SHA256 16a8f8609355a2ece290608c88b6275a9177a941a72ba614ad3e61d8b47ddbe6
MD5 e04531d270f67e9fc7982a6dda7b22ba
SHA1 fba7a8d716e80ff2213ffda76ae9dae973e731b3
SHA512 1cb4d61158f303fce074d04e14cd303df21c3ff2f8cafe7f019b0e4cf4280f0e9b823147edc0867541bcefc265c41a20f865e85cdd2c81465f7d1f22f361ccf4
TLSH
T1B311E9706E75BA1AC075CD1791D247ACABA1383009F4E20D6ADE443F11670FC0E3E081
MD5 SHA1 SHA512 TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\kpdfaigcbox\res\dist\index.html
Size 636B
SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
MD5 72cdeca808b16e794ec5b66bd02246bf
SHA1 e75b6c4e084efc8e60c9e4fbe9e9ae02bfbf4132
SHA512 6562ed498bae7f819caa5ebff9ba373b1bbeae3c92befacbc44a72419e6a3aedeee7fe43347d1bf8c46b9c90c8e515181a6dc50c4ad954a640cf6b2520269ed8
TLSH
T1E5F002EA3C25F055CB911EA43DF2F19E245E3AB29DB9DE942AF4513543C03694D0BF48
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\kpdfaigcbox\res\dist\index.js
Size 2KB
SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
MD5 67dde682d1968824023dd9773f9ec48b
SHA1 81e0a21a7ba2c05193ecc13672a3f537539e0699
SHA512 86bccae3d66df4dd552c12a42d1ed0d57d6cdb7b904caa1f89c874e506fb76412b2df45e3e5f673837cb72aa18b0ab2c1dfb489b1da37068d83d7ccb25d3d8ea
TLSH
T1FD5173C9F79E702209EAE136583F0006E17735596098A1C8B87ED8F16EB555E7077F38
MD5 SHA1 SHA512 TLSH

Submit Download

logo-small.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\kskincenter\ksolaunch\normal\logo-small.png
Size 6KB
SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
MD5 8d650fe389e3665607fdbf938c1a1722
SHA1 2e545f9555ff22313e4ce113995d8aa694e5cab8
SHA512 f116621bfecb602d02919eb1ee9d7dc92e82b313b8b54cda42ab48c5e7ec60b02005edcad763fff6b497ca4bc46e83cb0c9a249be791f245bb9c599950fdf015
SSDEEP 192:HSO0z+xgsZ7wNP+agwQznBm2KIvdgoeAtzpZb/D1:yMRoP+z5IIa8hD1
TLSH
T1CCD19EEE6F1CCE4F079D52F7500AC0A9DEA218AA905764D4D68E70B471FE6D120EC5C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\kskincenter\ksolaunch\normal\logo.png
Size 12KB
SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
MD5 d58510dca6b659c6e4ba7a454d5b75ce
SHA1 e142de2dda3811a2e8bbbb2eb64d366e8eb9ea3c
SHA512 42409f9976ad08ecf1756d1c2915f3ffd17cdc78e9ff552c0a08bdfa2fda8960e408721bfc9de1a5ed9c9aca3e23b97adb721b3c51b6b3f0ed3ee4a4c780cf88
SSDEEP 192:ySLu8Kp8OtM5IirU31+5AejJ7D+N+QOtHQjrE9aTYpR8XnXrWjvyNTtLJci:NC8o8do1+5D+N+QPE9B2Xn7WrINJP
TLSH
T1BC42C08F68918EB2CE443C39F356115F1FE12A5E7E19A2CF2CE7944A239044ACE1591F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktaskpanelcopilot.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\ktaskpanelcopilot\mui\zh_TW\ktaskpanelcopilot.qm
Size 327B
SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
MD5 18770de3f96bac1e75e588015024fcf8
SHA1 e6254c054edef68f9c27059efd82eeaa69c863b5
SHA512 fcb76291a73d7f2e30f4266ea8f0dfa2d9e203cf9770fb7ffd73cc1994502992fabd0803224c1e1155c1e4b678b5af0e8b3aec114beb1f02299e8885d5a61d0a
MD5 SHA1 SHA512

Submit Download

IndexPage-c453f6ef.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\ktemplatepage\mui\default\kwebpcerrorpage\assets\IndexPage-c453f6ef.js
Size 144B
SHA256 6dc181d0b8f796944afec08717183a3956b1e2ecdefc6cefca020786c370db84
MD5 53cad8a957cee533e740e6c30d63bb01
SHA1 5a3f1729d259269ab9344606a4d233f699b638ff
SHA512 afabaca552da7923a1d7941b9e292cb525321b6bb24346600195516f5b9a4a13d99d70360aa5910a2ba5d30ed8d6ff1973298ac8e812253b66848136b7b64928
TLSH
T17FC02B6E1CD3C3F200110C8C08070402170A2DF803DA81E0C304533CF1360C2C40E110
MD5 SHA1 SHA512 TLSH

Submit Download

favicon.ico

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\kwebclouddrivesetting\entry\favicon.ico
Size 4KB
SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
MD5 1ba2ae710d927f13d483fd5d1e548c9b
SHA1 c0605efed936ee2600284e6480521d06fa64f872
SHA512 f933cd352eaba92f509b3863353ddfefadfada26a4152ecdc4727d450bbf35e7b10fb3038fe8db340d5c63d74e608c1560ec84d0f6ffc8ccd940c9e0d7533544
SSDEEP 48:i3H5R5hLOR4kt38PduMoglJrd6qTrp9hweFC0+6Ga:ipHFUs4MLBvuyCda
TLSH
T1EE9175DF61C388D9C1B1977F78C449A14F6FD951BA28351F55CF30622E5D75818C1C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\kwebonlinetaskpane\run.ini
Size 226B
SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
MD5 abc3a6089b0ea76ffc960fbc9b6e66d1
SHA1 50ad0cb201c13799024de56cf45116cf65ff5569
SHA512 ec1e32b7bed882095b23e049a4e1a86acf0bf993e2f691105ffbd99d93ebf28faad4fbdd645ac1eefa74ede575854a3994c7c6d2bacc6f7a09a1991561b1a44b
TLSH
T157D09700C0B5658AC1254C827CA53DC411085B4B27608E02CCF0C34D508EBECE56B08A
MD5 SHA1 SHA512 TLSH

Submit Download

harmony_close.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\kweboptioncenter\entry\static\img\harmony_close.svg
Size 216B
SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
MD5 07306930f7d374663bd13e38ea0e92a1
SHA1 12f877e8ab93d874b55d75eef6747615619dad4f
SHA512 4cc0517ed0b9d665df4db93fb3093067e90f64b34f1d41420ed975b4cec64d4cc0aede64092d79c610c04e1ecd9514a9ef48389d5c157b5bcf698fc33670db98
TLSH
T1D8D0223BB3CC8E1CF9224A22F35A713580AF41C3548942E4D8322032E4011CEB93B6E8
MD5 SHA1 SHA512 TLSH

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\kwpsaibasetypo\mui\es_ES\kwpsaibasetypo.qm
Size 334B
SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
MD5 d36fe6147829a72b42e054a5db27d270
SHA1 80779a8eb37d8bb1d5fcc594576f80dbd61fac98
SHA512 94224816f757241b3a6d19788225378ae070fc62b4620e11e10a033e3be5d9cc858cd9e669cc275b1fa82e57094d0df13a6d9868cf00afaa17cf2ec0193acd74
MD5 SHA1 SHA512

Submit Download

fail.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\officespace\mui\zh_CN\resource\usersecurecenter\fail.png
Size 4KB
SHA256 380b4e765b27129c1aad722d99295fb1db5dc91352087b7035b3443ebf150b43
MD5 aa92e4d3e5c0102eaee84a2a9b685e0f
SHA1 64db4b21bb95103f57d2fe698b76a7d087475056
SHA512 057b9a5705d5e70baa7eec977c179b474c28ec4d382b1312a38645c7ad82b0d5e53949192668d03e9c5d91a1c37b17a4f2077ec96f0aa1f532905e3167421260
SSDEEP 96:M/AhBsIJCuW3r80KOpSIpcr52h4y1xSkGI+HqaSbYfuDw:M43sEWr7vSIWr5S4uPaSeJ
TLSH
T123A16B80B9CAED7CD06F557715C8DAC88F0FDA1D078825815EC8C66C4C78C60B6FE5A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ferrPage_timeout.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\qing\mui\zh_CN\res\qingaccount\ferrPage_timeout.html
Size 7KB
SHA256 eb5dc549d839abd9dd7fb725629198959c7e5b0322454cf3c3bac89c57f53ca9
MD5 9b7a36d32ed674b3cb4d247d17b71794
SHA1 e756cff87d95360675b56b9ee4e2dd71bb96a852
SHA512 97520f64605b0f2690a03b1bf42eaae8b3d4b10c0925081ac250ed6bdba190d16368fafa0ec11783dd21177becc4d945acfbb327fdab32ff6350dc3155f58721
SSDEEP 96:9uMJIMzvOcuq4v+nB1W1QjjaKhwc3Rghfbtqm8bm83:9lTgVv+B1W1Q6ywc3RghfbEm8bm83
TLSH
T1D4F15115D69262066033A7B4DFA35719FB661023A3038A38BFDCA2558F75C499B53FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

element-icons.ttf

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\wpsbox\mui\default\html\folderselector\dist\static\fonts\element-icons.ttf
Size 54KB
SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
MD5 732389ded34cb9c52dd88271f1345af9
SHA1 8058fc55ef8432832d0b3033680c73702562de0f
SHA512 e8971ae48f5287d252f5b0a2d0516091bef0d2febf7d01fd7b435e426d106fea251037439ec42c2937e934b66f38e5eb43d00a213cdf334f482f4a06b1817f9c
SSDEEP 1536:qTIRCXXCwinqtuPM16hD2N3SUjbwaST4DCJe:39GEcgD2njb5ST4h
TLSH
T10A433B32436A9BE7F416047F5C1F55830A9F4F22F53DEA8B83A6192514162FD0864BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync-folder.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\wpsbox\mui\default\html\syncassistant\smarter\img\sync-folder.svg
Size 1KB
SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
MD5 c17417f321f52624ee0dc60ed76a31b6
SHA1 b64e19a5b03c92a931fa9a1eba899f491e669a1e
SHA512 bf160829598cf0b22ea48a5f7310adfbd26fbc1bbf23ea3cb8d9cebbeb92b5e81b914bd6021cd41df5984ef00698acb1c1151e134c714e0a1be7dcd439c78485
TLSH
T16D21F0ED57EE35C8644CD37028DA6079627B35F43969EF048914A9D1FE4205D499F9C0
MD5 SHA1 SHA512 TLSH

Submit Download

element-icons.woff

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\wpsbox\mui\default\html\wpsclouddisk\dist\static\fonts\element-icons.woff
Size 27KB
SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
MD5 535877f50039c0cb49a6196a5b7517cd
SHA1 0000c4e27d38f9f8bbe4e58b5ce2477e589507a7
SHA512 da269b20f13fb5b0bb4628b75ec29e69bb2d36999e94b61a846cb58db679287a13d0aa38cdf64b2893558d183c4cc5df8da770e5a5b2a3288622cd4bd0e1c87b
SSDEEP 768:gOvv6ExpCVxUtrT6w8ClFd80EjPVerMKBaGXjAlEm:Hvv6xVWewtlFdGjPlkFjAlEm
TLSH
T1B9C2E13197213AE9D9824EF876E498FEF1651402290F390E8696ADB3A98D5C73E16831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\yunbox\mui\default\html\cloudsettingsdlg\dist\static\css\chunk-vendors.css
Size 945B
SHA256 dcbbe47d67a84ca5330ae6addfc5f541b0888ab06b7555e0f29b3816df8758b3
MD5 5c6387a96512a512eb0da4d53ccab0f2
SHA1 d35c4202a12dd6383a00769d417d2af19a585b13
SHA512 ad8dba8e992e6bec07d2ca8093dd0d0031593bd3ade6c334f38b2e1f9b7dbc59bf285844599fab37cf8444e2e54c5e64283d4d9997dc59d7ca97713015ceaec9
TLSH
T161110266D6B0210DF4BBDC426BA1625A3300C5B358954BACE5183F74C9C726E077075D
MD5 SHA1 SHA512 TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\yunbox\mui\default\html\cloudsettingsdlg\dist\wps-i18n\chunk-vendors.js
Size 314KB
SHA256 5eeb347ded468ab8d168c51adbc559aaa0d5f33d4135b096293bde65499f015b
MD5 93fb24e9a371053b362589ecc937ab8d
SHA1 f2c891a82749f6ee732995f1ef611bdd9505d533
SHA512 1597457ba46e4303f00d9f8e85740afe2b5bd11b9c39e5533977a3b9926fa09bacf720c3639c0132ddf0e4055c46fe4ab4712ca78e16c72d743162903e7cc601
SSDEEP 3072:nmM3Ne7BFfXb+9pZHX0+xPT8N1JcXE+dBCD0K6xV02jQx+MjIWkvfl:nZN+b+RFPT8N1qEdYK6xVzH
TLSH
T1CA64E58DF2D6B0A517E731E4002F620BF2766958B88EC5D1E262E4D5AC7894E513BF3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\yunbox\mui\default\html\cloudsettingsdlg\dist\wps-i18n\en-us\index.js
Size 7KB
SHA256 f54d8fb11b54ed02402f0ea7c39e8e3f051140d828d39bc17957e6a05d72f03c
MD5 3c0df9379006d8cd49923b8567ef8669
SHA1 4b5fe6bac983b0a37e53a44c27d6001f61c41b8d
SHA512 6c36b9caf8121e09dcae2266c1eebdf505a5e2eeb213fcf3d33a2a9702c7b46fe23748e6556b435440dac86b883805980f997bb996a81895ece10d66418c6183
SSDEEP 96:6D7fPkc8tlq4zjJSgT9uuuRVtdztWFbr+BMkSvY7zc2hu4tdlquZIJ4BIQw+NXH+:6D7fotzYgw7lczQ3lz3q6IoIQwaG
TLSH
T1B2E1C82F260582751D6173C2FF0DABE2AA3A705D7351509998E9483C32B259EE2F74F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\yunbox\mui\default\html\cloudsettingsdlg\dist\wps-i18n\es-mx\index.js
Size 9KB
SHA256 6b267516d1b0d7a46d6e679610ac3cf7dab8167390cbd8015fa0907b6752b4e4
MD5 9143a268532d8d6294a1bf8ec84ee658
SHA1 889f52e61eaf79aa1eb15f341dbf7766656a2ad3
SHA512 51ec309ec9a3052f87b06d8bb95f2934a8d9bee8b0dd7f8b2ee0780e5e9103043c7533fbdaaa8003ea0a1804aad244eea946e2e640d86bc57be0b53e19751f04
SSDEEP 192:NpXpWD7pfjdUCpIaxJH0Ui2zVhkkUUgptFnEFqnpZntnsOFr:NJkD7xWCuaxJH0UngpjnEFqnpZntnJJ
TLSH
T19012502AF3C01BB174D21784B946E6BBD0C419617C1DD2CAD9F5C2B911F8DCD8AB298A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\yunbox\mui\default\html\cloudsettingsdlg\dist\wps-i18n\ja-jp\index.js
Size 9KB
SHA256 8f3e93d42df0ada663d904486d895c30607b780ff7e2a135eb878aae1e33d226
MD5 b20289d274faab0e70a72d44bba7d49b
SHA1 f875be38f468260f9f1a588dff586acfa71536b6
SHA512 68f54084260c7f9f0ff69bf124a090e37623d125feba79f4caa01c6da3e3e992674a2916679541f16ef06bd3f53fe4d22185793c2f20d330d74794895996773f
SSDEEP 192:H1qpfa2VJgNZNPisiOBTUXBacOp2VJ1MVAb+Nox/h9ZgL9djOwOqk6UsMN8:HB2QgCBeBacOp2Z5b+ex/3WBdKBqk6UC
TLSH
T1B522303C83CA6A7A9C2542B20C0E75D635259C2AFD63BE3981ADE5742F50DDEE810DF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apm-init.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\yunbox\mui\default\html\settings\apm-init.js
Size 57B
SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
MD5 b684f2b8022aaa97ede28f9d224c4db5
SHA1 2087206ddbfd6d6d71f843a132b58ed533d87169
SHA512 8d30da66bfdd99dab88c4b9766b692c39ecbc8dd725e9f858c95993d4f2bf46c37891a1f8f4f1eb6fe09bed7008b8df48d2a9b4f10d7caf20f823f121f6ebb40
TLSH
T19F9002E7F0A1707344616959630722AA35D11130017430010900487434A580FCD22F88
MD5 SHA1 SHA512 TLSH

Submit Download

default_ava.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\yunbox\mui\default\html\settings\img\default_ava.svg
Size 906B
SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
MD5 c47a5cfed147c402538358294808e68a
SHA1 8aa499336bc4a50a70710735b67fc5da923fc61a
SHA512 a71831abb9393b6c0ad62feb29fefbb192e1706b08ab88dec0a8e6a9cf61b6a7e106454a7e6e518f69425cc91846036e8fe2956ea939625678f17b330860ba1b
TLSH
T15311E309934DC285960AD7B8563C1754347272DF9E1FD55CE7E633012D3C6AF185C27A
MD5 SHA1 SHA512 TLSH

Submit Download

loading.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\yunbox\mui\default\html\settings\img\loading.svg
Size 1KB
SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
MD5 0620393a949b58f6af37b0accb79e32c
SHA1 0025e4da5ffb8695a8f9731a05b1b89f1a71bf24
SHA512 0d308c758f825d548874cf8b4b8ec20f3685b39c7232246697dd95e5e5f40da7cd21de7ba5faafd0d8a121b5e6b85c5aadc4232e3f0c943535e062ae449ef29e
TLSH
T1333142D111BD0116E11AC365D7FD7AC70B3EB4DB26E558BCB68C250FAB404DB0A9B219
MD5 SHA1 SHA512 TLSH

Submit Download

weibo.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\yunbox\mui\default\html\settings\img\weibo.svg
Size 2KB
SHA256 13fe846f5d050decd03d9eef4f40e497995ad8b23e48a2f8eb339f97319f51bf
MD5 817f16b4919cc6a39e2efa836ab8fefa
SHA1 1e43cadbb17f104e50c227e861ef93bf2b1950cc
SHA512 fd333da359ff3c15f5c75c55b953bbef96f10122294bf9d0dfa6b7eb8c56cc487eacd0802f6774b7c8df40d05e7a54f089ab0731dce6044bc2124c27d8c67edb
TLSH
T16D4143FE2195A1D0D407ABA4DC37B452DA4E3CFA6FE853C88141EAA87B746D9CD48C10
MD5 SHA1 SHA512 TLSH

Submit Download

app.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\yunbox\mui\default\html\syncfolder\qing\static\css\app.css
Size 107KB
SHA256 907d1f5ee046fae72b52eaf99508ddb6b48d47b803076db0e9a86b0e21a54ba9
MD5 0ad676312c51d1b96bd08f056ab33496
SHA1 270438a06781cb68c376bc18c42437dd5ce262da
SHA512 6a6883f9fa0a1f768bf985340dc6cb4651e5ce691066c9597126ba1fc62b2a45a2eee52a1d8452faec885bbd3358be3fb04a15fbfca0302feaa1adc2c81130c3
SSDEEP 3072:KazzQ51KYGqMkYUl26MeCAAcdl6y7tqWD:mME/euD
TLSH
T15CB31B37214D132D343BDAA2E55D659960C8F61BC00253F9FA247B1DCA837873A7A3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\yunbox\mui\default\html\syncfolder\qing\static\css\chunk-vendors.css
Size 279KB
SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
MD5 a3964e72421a1ef5fb60c6e17eb5d705
SHA1 5dd9584be5141e884a230c48746e1c88126b0a55
SHA512 4ce4119b7407b460969041809354c4ede587047ee643f2897eb0ecb9627608431f43fed27c54c70bacff3a6694eb32a85b535c7d6397ac22d7d28e260b0a5467
SSDEEP 1536:39eSBQG+dyAUlHj/8D0Q+SPxZztR+LCrwHFfyqHYb3PPV7BYUOf0I79lDxiRSL2Q:3zfZYKVxiW
TLSH
T14054B6229140212E702BDE3DF7C4EA4AE225C6B3C4125BFEF953651DC7C36AA117778A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\yunbox\mui\default\html\syncfolder\qing\static\js\app.js
Size 381KB
SHA256 48c8fa453d26cdfc3a6b6e6ffb3fef1bbd98a59a320f19002afeff8336ae3fe9
MD5 00289cab230efc670c2758b5f42cf478
SHA1 9add3026113f7b69ead6bff9d3c2767db874fdbe
SHA512 09ce5c627f2e0d2a94b71baa3457572685a48a53e06c4bdc9c1edbadfee6b7f0d98a50642451fc01a0dad882fa4a8ef405c32e7e7b53e675d537ed4c2b6f4ae2
SSDEEP 6144:HpK457wXrkaY0TbOXsEYlHBBs6Ve5NtXo4Ipgznl87A6v0eX4AiDuViQbgQgILTm:o4B0WtYl0iLlTj8QmIqU8NBqq
TLSH
T192846C4B758BBB5A1F35B66340DF3C88D01C6EC09812A5C9FABDD9D09144B9A32D63BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\yunbox\mui\default\html\syncfolder\qing\static\js\chunk-vendors.js
Size 249KB
SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
MD5 6351ea268f992f52e0f4418a7028b91d
SHA1 5bb3cb88465c550a1fd033a079a8b2eba5e071b8
SHA512 44940d07abfdee6403e9400e596ac5e5eb234ba77a1c90c2fe4086878c12f4805c709eb84538071f21d5710d3569d342e7caea10061e2ab2661c5117c5966297
SSDEEP 3072:p+Xy2rHhkiTtcsuaIwK3zqDLW/ix3Iu7doNFBWgz/bwUzxqcG7gLEOhA:phKHhklsi3zpCdoNFBHz/bwAfG7cW
TLSH
T10A44F8CDB2D1B0A517EB61B4813F610BF27B6499B44E80D0E226E5D4BC7998E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\yunbox\mui\default\html\syncfolder\qing\wps-i18n\chunk-vendors.js
Size 424KB
SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
MD5 cf29fba214e7f43f2ca1b629109d126b
SHA1 d0dda9486528586af6943abe7a3afa319c790f25
SHA512 2ad7e4711f5917b8d13f861d4fb2688e6ce3951da43a89263a2d9743199e173429398ec1a9537b1df25593d3999dd34fb590e2d2a6e7a632ccc44265d93c3bca
SSDEEP 6144:z8KzCOcC0CXWsJvRekr0dgei/zJbBoCF7az2bzNM:zbzCODTWsJvRbw6zJbBfaz2bC
TLSH
T13694198DB2C1B0A517EB60B4913F610BF23B6469B44E80D4F266E5E57C7898E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\yunbox\mui\default\html\syncfolder\qing\wps-i18n\en-us\index.js
Size 10KB
SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
MD5 0f4634d4af8b73f882440c1181697d86
SHA1 748bb9a14c8a6c64fa060ddcb1b4baebfb3f6fd3
SHA512 eeff081cb256a44ff4557dae145c3d277ad936fef58674cb7d2949b6c302c3a746f05495daa6ccabf39c26bacf13c6fee3bab20de4f1d13810be0503787c89d5
SSDEEP 192:cyxPpQcKb2d4U1nE92Ui6OPl20b3G0qE7I2ByobYGeBv+x9qkgYbeO:zzFZr6OddG0q/yTh3UYx
TLSH
T1AC32C887B30483755A90E790F6C76DA5A93ED0EE73A4168A3CEE421812581DEB3E7CC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\yunbox\mui\default\html\syncfolder\qing\wps-i18n\es-mx\index.js
Size 13KB
SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
MD5 dd59d31e84434c59c5c3735bd0b0dc3b
SHA1 c34473850d3749aae725856f68a262a0afebee00
SHA512 f3acd51920f945b49dceb56fd2a5a4ff170c4a5770665bef3d888f8497a288dc33bd15f24780cbe9b8ced585fbacb92a8700d1322a6d4acd2b6e5893370822ac
SSDEEP 192:GwSuCUHXDhEblYfhQ9GYSOqUr9b1AARAU0qWo3wYXVMojXiyaH:dCaXDhEK55YmUrLAgkqWo3RVhpQ
TLSH
T140523295F3C50E22B4991749BA03D57BF19558FAFC2CC18D5CF2D236136C9C986928C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\yunbox\mui\default\html\syncfolder\qing\wps-i18n\ja-jp\index.js
Size 14KB
SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
MD5 5cee0947c1ef6f00e18eb17cf77388af
SHA1 5a27bc625acfb46d2368a9a376d797ecab912a3a
SHA512 1bf91f08d2a2a446ef0e22df40fd09b090fa300f599bacdd5c698aa61a6fef12ad3d3e38299804a016e5a22a82ddfeb6840cdc7a79ea51244942cb22e659331e
SSDEEP 384:HTO1ksU66rAJGO+NedvSGdv+GfBgLj95LKn:zO1ksU66rAJG5NedKGdv+GfyLj2n
TLSH
T11D6230ACC3CD5C69C86183FA090B35C27836ED49FEA5AE7280EDF4202DA19DFD815674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo_new_1.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\yunbox\mui\default\html\transfer\img\logo_new_1.svg
Size 3KB
SHA256 7745db01242b975e980c02a5b5e21f86c3991842d14399af5b710e7042f6b133
MD5 05d802ce3149af594ca8ed90b552889e
SHA1 88b4b497d0519f690417e136525f040967e219e9
SHA512 0076d34b56672a00af4f4d0151021026076afd1f4f0dadfeaa023135eaa84bd67b6b5376e109884a8a6508b9eab32d90f1d1fe20ef2908ea87a495c198293f91
TLSH
T14D7100A9D70D587BC52AD3ECE6E4C056111F94E279F103BAE268DB0F1871BC7494EB21
MD5 SHA1 SHA512 TLSH

Submit Download

setup.cfg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\cfgs\setup.cfg
Size 449B
SHA256 d29806c2281bb19e1e6791d97049b810b110f7792b06f33ce249b81b367d7ef9
MD5 6fb99063169fea123662657d1ca5a9b2
SHA1 7762ad5bae2023bd7bf5eebbac0ac25b96edad82
SHA512 3780b0d76d1b5d2502e1196ffb814f5cddeef3a57629dc204d0f6b427a80c7b5d8d39c591172d3446f35d4ec25a8264b6abb89265aea52983168f2a107606bbf
TLSH
T149F0556A031370751A21431010B925F2A3FA06C8101B844D2568AC8D6B7D83DC6BF13A
MD5 SHA1 SHA512 TLSH

Submit Download

setup.cfg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\cfgs\setup.cfg
Size 601B
SHA256 3a2e6d19e975a3fe471ead5a90fe20a1f787dabae71109af241d4c3a3a875472
MD5 3b3e3409d81b5be089ca909bba77313f
SHA1 196ff358e1037618c630fec6f66f3bda5ce84295
SHA512 416dae236a50be9e8245f66b07bb8c04b002e9d944410177e0941d1e5b0b526b455aea47bbf643bd75b24db744016bed339db565c61d5419713085fcc081ac28
TLSH
T1D6F04C9E1353F0750E50470514B611E1A3FB09C9100B944DDA6D9C48677D83D87AF236
MD5 SHA1 SHA512 TLSH

Submit Download

verify_hash_text.dat

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\data\verify_hash_text.dat
Size 871KB
SHA256 c51c336a6d5179b2936f18819f3e1069e85f6c6b344370134afd4f7d2034e07f
MD5 2da5b9be6d9586a9dec6f2627acb83ca
SHA1 b00a209f547b0379db00199fa08321f382d13629
SHA512 6d26d88c16bc7b264e798c61ce8cda3fba22a531bc7f0cdf62acbb1da149d3f2277ba1511f5bea423a54f0da4b7f4595546cc70635e193b9f63f95351a672d06
SSDEEP 12288:TUtbOBejIXRd/gIMr1E17ksVAA3+105E5s4YT:TUtKnXRd/gIMr19sVAAohAT
TLSH
T120157273B039E9712D9E7BE4E4470E5D82F24ACE041572066CF78944BDAF14AE1EB60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krt.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\krt.dll
Size 1.3MB
SHA256 2cb19cc853a07603db7d75903521a3fe614c414b4ed7f25dc80c57c8faa63150
MD5 8c9976747f8fe8c883c3878560075881
SHA1 e796ed455ee867a9a0a1b970b6d3d5c4945a7e18
SHA512 2c3e1289ab0f4557b184807b17e30defb83b12a6f36cf0a54f9abec84300293821dfc5eca40486fb34255423c769e523e28ac6c607345e3ec89d42ad5d7b8967
SSDEEP 24576:SibGrh9Ah4PsahfTX7d3C1WIpoPeoa9g4ObVcs8/HZep:nb+9AKPsa5J3YWIpou64Obes8/HZep
TLSH
T1E6558D1BFBA983A8E56BD03CCA474906E2B1380143619BEB16A54B2E2F377D54F7D350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kshell.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kshell.dll
Size 27.3MB
SHA256 df8b947224990d15baa574c90f1b0a1fe52887552657bd94770e2e2ee40ce896
MD5 b21f250792ff5980f3e0502c73b1ded2
SHA1 ceb2b2e3c6d94a22041436343d20ea37d68ed5bc
SHA512 8087bd499c24ce8b47db120ffc26a38ff25c0bb5e6fa39fb6fd773ab65d4f706724094e6f7f946e946af36a1619b583ef777c99c70fff4e0bbeefdd6ccc63332
SSDEEP 196608:m7EgDdeLN2OrOgXyqKm9s3DczmiIul5vpbgO28:9gSN2OrO2vKm9sTwl55gO28
TLSH
T187576C1FB26903A7F166D17CC9578907E7F1B8014361A7DB1152AEAAAF333E12C3E650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksomisc.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe
Size 3.7MB
SHA256 47cb99ba2fd9e8d434aad52c863fccda62d2f8952232d5c39edbe15c325bf022
MD5 cdd5107f671822534a1e33381a5fd31c
SHA1 5e7d8a6c3a90a3a80acda6ef6c4b0bc7a2476a66
SHA512 0ecf05b704812fe14969d13dbb354bb2e8388bc0bccb128f99b373455425ecbd4c381158e777cbdf94cab5473f133cb533cbbc4ac517a98990d033bb6bb2298a
SSDEEP 49152:Gg81NqZyHl8r38bwdsmynOr2gC8RI+QuomfIU9mrLPPpP/jnLb0ZkgNp+e7e//Q6:BZyWPj7NQuorbg5wg+
TLSH
T124066C5B62EA03E8E17BD238CA965903F2B6380547306BEB11508E7A1F777F15E79B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kvpins64.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kvprinter\kvpins64.exe
Size 354KB
SHA256 49ab44c346526b5fe42beec156cb8fc0d6e7d8c4a3ab003e964abb3a28e93b89
MD5 03e7d88ec07ca39003e2262ff7dbca6c
SHA1 50a1b2566d6140a1a059ca83fad55c47509cf120
SHA512 fc7063234ea36e2cd039c49c991c249109a9921d599a443d4db81ba53f918c55c29972cc17097d9952cfe4b3e7b21e2a0d4e9fd512dc4a013be1edda49e66c83
SSDEEP 6144:SwYb7OXvrtiZgNoRoQGOeq1ExqCM4mF5sAOj/dxCrEZDDI:SNeXTtiZRuOU84OSdx7JM
TLSH
T19374AD56B3A81CE9E837C1388D568A06E7B27C510720D7DF1360876AAF736E1AD3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addwatermark_buildin_wps.doc

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\mui\zh_CN\resource\watermark\information\user_defined\addwatermark_buildin_wps.doc
Size 9KB
SHA256 43add80bf7f6495384fa15757101998fcef1688702830c538976dbf7a26d229c
MD5 ad591df2deede6c9e91ee34698ae9706
SHA1 8ad7d0506d8f39858f545d34b3f299b98bf58b25
SHA512 2a866d844cb80cea65458b2d51b61f66a21f7e7ef83e157cbafcd7b3c862703e18c9218c78e01dd187e8e416b4d49d9c142d1569084d3b31f25412de930cebfe
SSDEEP 48:r/UVygU1/o1zwAvBH6GgaNj01LTak6mSDnY0wcYYmtJSd:j8BUB6vBaG1h01L1LS4cLUJq
TLSH
T155123F12F390D90BE4A6533598EBC3D03731FD10AE128B4B3194B79E2C332908F52B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

presetLayout_15.pptx

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_15.pptx
Size 38KB
SHA256 8fa6a9553135ac26a602d5e4d8d72b70137b3781f040f6f17ab5707cb7581fde
MD5 3d47dba65a7625fce740a2bbe9f92136
SHA1 5d86731e89f9db1ad3b66dac0699ca29129a58e7
SHA512 60d56678f3ae49c70903bc35948e2d2571de4d82df25cf6a9a62cf1cb6fdc8f8e8bfa2bc601c34950751d2c3e5e0b86904908d78bd82541501cf25acf6063d5b
SSDEEP 768:lwQ75cI1zETv/7H0vFtZKSZTRomseFFxz4CFlogTJP1JgsZygs1wvcG7GyGBGoGB:9qNTn81Romsehz4CFloMJP1Jgwygs1/6
TLSH
T1D503AE61C409142BD273B3B6E138174B73FEF8124413A297ADE421A7296E87D7E4A34F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qingnse.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse.dll
Size 16.6MB
SHA256 9ba1ce2d666b7ac30211784259c679a00d2ecf84b111bd640b2066963106c34f
MD5 2fa8b2ed0d2a39c0717b42027fdc17a4
SHA1 edd0e7aa305bba39d25ff0651df72502dfa0f215
SHA512 d075519a7d1afb5e43bbd3e9800b23e81a05a277f4ca5eb8b6d9daef154685d21469202397c55b094ed4c30daa97eb36c8c232dcd2e0891ce2d31e71bea7b221
SSDEEP 98304:LQaL/0Ic5Q6Le+FGA0ZuyPnNhSoumyZ6qX8KS4CBwWvfhUUSHn9Ou+CnqKao/Dbx:NL/o5Q6LeYGrTSoty8qJ9Hp4odr
TLSH
T1CB073A4125F1C5A4D40652736EA0B6A6A8AC9D26873658CFF34C3E2A1F70ECE173BF15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qingnse64.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll
Size 17.9MB
SHA256 c86c2da48252e2b26d6222b11cb0008c1ae860559586eb85dafe67e775609bfe
MD5 fa0b759cc3a8d874865221af546af781
SHA1 9e2b1a239974f90929c971a53097935ab10b8c3a
SHA512 f9e9ef9a887b8b05ea7c72f95f14bb24f9bc69656287e3cf8a41e8846390783cffdf84a3aff7fcd43f43670a27e7a914c3a18176d1eeb0aa9231e8f15e045545
SSDEEP 98304:sBmyh0nWRtLpck+54N8WD1eYqFYA3EuEkoqKao/Dbeev:sBQ6tLpc15Y6YA0Jko4oR
TLSH
T1C317174661F441ACD407E136AA426552EAB9BC07837259CF734C3A2B1FB2F994B7FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qingshellext.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingshellext.dll
Size 732KB
SHA256 bc3df89c9df670e1afddac3474e7991a2148e0cced6b1c38a3c2a2291d8b0c10
MD5 4e79999c410fe66057483f2bd908ec7c
SHA1 be0cc148e3f1d85b45d4be6d13d678a374ad7a92
SHA512 58cd2defd79506c975f4899b5cdfba2fda5b4acdcb69ebb9c437f8aa831e965a2b4e783dd113b9506538115d7b12966ad537cfba4d92f19a7d72dbfd4116413c
SSDEEP 12288:g9+UWB7ECkSFLG+dr7QQkpTsRpr0zXLAySCHdDgWVgsyG34iVZ40:jUk6WQQkpTAd/ySMI64ivX
TLSH
T14EF48C607647C131E46D01B1493CAFBAB5BEAD690F7147CBA7D82B2A0D301D21F36E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qingshellext64.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingshellext64.dll
Size 847KB
SHA256 0a7f185398e7c9a45bd46c18fec90b73f1c21d950a9e2ca026c3ce30e250e90e
MD5 a5f1dbcf989f1813d6dfa95ff86a14f7
SHA1 47800c53ab48c2d0593fbcaab29a42162ffcab82
SHA512 c1e119fe937e45a4b8a38a58070a5e4fcf9b801f91055f2e915f186093515f3b1e96230175f63ce4a1d2e98f5a4accf98a6bd2911c545051c368406070416f46
SSDEEP 12288:Khc2o9FW5AaBVYwb0/ccisH7WYgeWYg955/155/T7Fcs23J8MpLkAovwVasJ4iVo:KhXkpf3ccisHsrgJ8Mj6BsJ4iW
TLSH
T1D3058C06A6B901BCE0BBD13989579A01F7F27C0607709BDF13A0166A2F777E15A3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpscloudsvr.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wpscloudsvr.exe
Size 1.1MB
SHA256 67d92e7a01fa21e8ba586748c4c16fea2722a1c8a5896a44f9a09c09e63165ad
MD5 706c7afb7ca410fc0e4ce2cbd1e4b34c
SHA1 1b527919ccedea865538e92ea10aa83d7d2d65ae
SHA512 fe8f9d58fc6556a3b81c77e64c889c8e3d88e4e4458f6828ce8652df56eaa145befca7543a8560dbdb4ad270092869f5fb362cf0076ef881a3d4cb6ce2459213
SSDEEP 24576:EccEqVZAreByVoA2IykNrB3D6W8J7zjhQZsmgd:EjgFz2IykN+J7zCZsm6
TLSH
T187355B4AA3B902FDE0ABE1798D525901E6B63C0607705BCF079027771F6BAE59E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpsoffice.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wpsoffice.exe
Size 1.2MB
SHA256 629caef8e3be8cd0659940fb09b28699f6edc193754856eeb104dace9825d8d2
MD5 f6abbae98d560dcce4dec384d33e69f6
SHA1 ff2c096f557cd5be4950851571909a032d1c32b8
SHA512 e830110ca9182989617331e7e76d3cd455b6fd17a71340771f5e526ef559cbdbce9c0d430cd875a542510b9b5c9a878c306db9bf8c18c37cd3eccfbd265a0003
SSDEEP 24576:HE0+wxj36sBeUOLK2wjoKL/NICI6RK9nBv0aEa7:Hs4j36sgECK7SCI6AtBsvy
TLSH
T1115508366EAB02ECE3ABD27876525901EDB53C06C7355ACB02D035763E73AE19E39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\utility\install.ini
Size 626B
SHA256 89a249f69987a479b2dec2e11de6fa8702769b0194e752639b5160f8db864fcd
MD5 c75357beb40016649509df4d9e3f303a
SHA1 44db6f74053818763b7fd6c5c5df63bf14ebe63d
SHA512 09acd2c0419c02e0f95d9fdf3d50c66e250497bbfd562fe181e03610b6b133b9f367069d3e8849b9a64e2a4079bbbf3789d95bb7dd56bd4b52262d16fc8a6891
TLSH
T166F07D090D99C66F362932CCA1E3D591AAABCE551D4CA020F2E76E5BAC06D0A157E42F
MD5 SHA1 SHA512 TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\utility\install.ini
Size 649B
SHA256 454a46cecb3de9378c9569640b82f81457e4127b90656706e25a8b85b3188a52
MD5 66d4ce5cc9157b3fe95a98473d2e6cbe
SHA1 b385ead3722839b9217e9f72741654f15982d7c0
SHA512 abfae5ae6c4bda24fb506a7456139e1c0ecd78ec8ae86304804f345dec117f4881d04accfdacf1c022358e5672f7faee228afcaf3d0d5e8e73e88ad1d92de909
TLSH
T1D1F09E080D99C5AE351832CCE0D3C5909ADFCB550D4CA020F2B76E17AC06D0A157A02F
MD5 SHA1 SHA512 TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\utility\install.ini
Size 462B
SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
MD5 71e0a7ecd6bd2e91c04a3edf760c45d7
SHA1 e6cf872ce6def16bca98818ba289395580701292
SHA512 282b4c8be6abb97383d7dda8258fbf069fd668f4fad722582567cbc916b5c7da9a39a157a35511210306c19e46ef34c02af17f2af1ec7707bb3d84f3d529c3ca
TLSH
T178F097090C98C66E36282188B0D3C2C0A9ABCE260D0CE410E2D36E1BFC02E0A217E02D
MD5 SHA1 SHA512 TLSH

Submit Download

07e13d6c-f7ca-4e37-9fb4-422598d8ca1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\07e13d6c-f7ca-4e37-9fb4-422598d8ca1b.tmp
Size 8KB
SHA256 ef35d857053343cbf8461553f33672011c89e3befcc90cda7c41a2bdef9523ea
MD5 f96e7a1454584ec5c4ad7c548060a14c
SHA1 6e50b50808ac83b05f791c72f85fe2bd811cfa13
SHA512 91c3b3cded91f70a97907bde9ad3e7a2f99a4e03ff25feb75388b98c5db43949ae7e64ad3df87f229c9fedb11ba89d1998c2692ae7d46e66c88127e3d3f365d3
SSDEEP 192:ZONt6xGuQmiUyUZ1D0hZ/1yEn+FqFFdroicSvU6:ZONt6UqB1D0hZgEUqzY4U6
TLSH
T18A02E7357C7C6CB79EF2BE46F5872A534FD4202BA5946F84D6E82E1C00D765C1306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a8d0744-20a3-4dde-a76e-6296402b3f24.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0a8d0744-20a3-4dde-a76e-6296402b3f24.tmp
Size 26KB
SHA256 c4753420432a042861df2b3c96e70bdae0f0f4863fd8d7a80477d12e636a8b5d
MD5 5723bfecd1b0e9b34025a904499e02a3
SHA1 6bfcaca3e32c5602b7b56de4bc4f5464e845b26e
SHA512 f11a1d70c321973cbf2cd45ff534b895ef78e65534c1e66e4a0fa069b637c9159eed29389459676464ed54e6b64a83f5da49a64fffaa5e9ae8d766bccc6bf34a
SSDEEP 384:DiFeQkUSv0PsNd8TUNTUlIlAA/wBnpduS0hZgEUqz6QIFH7vBEDaVIIlq:uFOQ4wgLupZ0YEUq+PFH75EuVLw
TLSH
T158C219F258E7893BD9AE6703A37E2D038EBCC057B5846A50B39D590CCC861BFD346811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1663a36b-e8b1-43dd-a12f-0fa630609957.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1663a36b-e8b1-43dd-a12f-0fa630609957.tmp
Size 26KB
SHA256 109bac37eac38743101048902e49760adedc8f2b0b044edca42600c9ea62e4f7
MD5 0f5fc913c358bcc168451093db9251d5
SHA1 0f9edd6aef7c303891721b7423dc8663b4711b23
SHA512 cecd84a6fd79a18d9020f42b0a9d5479f3a62b6526ce6ed1bf2479d587828309399dcf328312ab1f3c6a026423661cf43b0783ce0315de037930479b74570a30
SSDEEP 384:kiFeQkUSv0PsNK8TUNTUlIlAA/wBnpduS0hZgEUqz6QqFH7vBEDaVIIlq:/FOQVwgLupZ0YEUq+/FH75EuVLw
TLSH
T1F1C209F258E7893BD9AE6703A37E2D038EBCC057B5846A90B39D590CCD861BFD346811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20482499-af64-4c49-8c06-954846458513.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\20482499-af64-4c49-8c06-954846458513.tmp
Size 18KB
SHA256 ea223915869ea05a7dca46a22361f9d5ca69cfb336d6353426b8d0c1622bf28d
MD5 1a73d83caa218edca04ab24ac3a2093e
SHA1 74cd5555d114705ef2ffc5e8782907275cb6e24e
SHA512 9e00b2b8703084d245b5527e85afbf60622973d2d56490e0537aee9f6718afdfa07dc9cbfd5e1f97c02815bdcb3a60209f2f1a32be342bde5615bb603d1affd2
SSDEEP 384:uQkUSv8sNDAA/wBtpduS0hZgEUqz6QuFH7vBEDaVIIlq:e86MpZ0YEUq+bFH75EuVLw
TLSH
T19A825B316C785D3B4DB3B515F14A3A43DFF49067EAC86B90E1DE6B1C01CA69D234B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ad309b7-f355-49c8-a768-9dda9eb984d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5ad309b7-f355-49c8-a768-9dda9eb984d2.tmp
Size 8KB
SHA256 41d93d71080b3839861b696a43374d9a9215c385dad5f1994003a284a06f7694
MD5 fc95e06a487d8af01f37ad235a7477f2
SHA1 3c90ead279e5d782c682775d70866588188c7529
SHA512 e7c32fe326ed98edca6053f5f3559a4cf2d1186962d278cb5abd16055ea236b95a3ab74a7f03597373afe007039d693a4f1331265b093cc5aff7c336342c5688
SSDEEP 192:KONu6xGiQmiUyKZmD0hZ/1yEn+FqFFdrouDFVW23eqxU6:KONu6UeBmD0hZgEUqz6QdFU6
TLSH
T1A212E831787C9C779EA2B555F48735438FE45127EA887F94E2ED2A0C01DF6AC134AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65e6fe7a-549e-4098-9a9c-5167e6f01be9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\65e6fe7a-549e-4098-9a9c-5167e6f01be9.tmp
Size 18KB
SHA256 2e0cac01ef12b8b8a4308aca0f575ecaaed6001f0c82780c3f9e92797ac984e0
MD5 1455af94a42a586bc81bc89d59c6c9aa
SHA1 940b19a389ea3fc21a13fbfa2177d53bc256f41e
SHA512 d52b3205f0d32ec011e03905ab81f257ab07fefe99457fba0fdfe6db2a51af97a16a372e059eb27ca5cd0c1380b99b31aa18a421af9c19185a9f5fb79b0af5e5
SSDEEP 384:IQkUSv8sNDAZ/wBtpduS0hZgEUqz6QuFH7vBEDaVIIlq:A8FMpZ0YEUq+bFH75EuVLw
TLSH
T1CA825B316C785D3B4DB3A515F14A3A439FF49057EAC86B90E1DE6B1C01CA29D234BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

729ca882-1eb6-499c-acf7-c7373faa218d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\729ca882-1eb6-499c-acf7-c7373faa218d.tmp
Size 18KB
SHA256 70e23a68aa02e8daf20e8377c1049122a85cad1724aa6cbe2101a48e99fef563
MD5 ce174b1b8ea22d6191c47fce97ee3207
SHA1 b433d98e469a52c1b945bdfcdcc6eaedc7e9418b
SHA512 450d4fa4783da79fc037b4cc30e70e6a27e5c650665e4465e69a3f42e4ae4f44acff235fd335302ea090c5f45055450dc18dad5cd42b4c65dca2e8ff8d23813f
SSDEEP 384:tQkUSv0sNDkZ/w7tpduS0hZgEUqz6QuFH7vBEDaVIIlq:X0JQpZ0YEUq+bFH75EuVLw
TLSH
T179825B316C785D3B4DB3B615F18B3A439FF49027EAC86B90E5DE6B1C01CA29D134B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0999a38d-4e9e-4a79-9d04-13dbedcf32f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\0999a38d-4e9e-4a79-9d04-13dbedcf32f6.tmp
Size 105KB
SHA256 1d62e22dec5c299be491cb2f809a917a5b2650bcf6f26d1655b204a91c995427
MD5 a1423f7d471bb13fff5ecfcdaea6454c
SHA1 7ded49e29e2ee4ecada313702dc82cddf87e8600
SHA512 6e90c834830dc60cf4e69d47a842a672355eeac4f32e8a0122d66df5ce75da4ac71274dc3cb208dbb06f3cd4f506485158442b7832ede2cf24ef8c5b26c1705b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7N:fwUQC5VwBIiElEd2K57P7N
TLSH
T119B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d689794363e91be4e3d40432af9279354599c0ed54686304040d6a59b7db7829
MD5 e58de714840f6fbee1d39b033a0ecbc4
SHA1 6054c414731b3c89cfe5db86fc27446e671d1a22
SHA512 37ad74e09d90232881592dacb5df5c06d03990c25addf4022be40e82cd44284af1f9d402c761a7ce19d1fd4ced4b43cc1d009c97c0c7726a148487574a01097e
TLSH
T17FD09B54B7599D90D456647C17214701758DA9145513E103C5E112D55C86FF241D50B5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fb99b812e0f26496acf7edf8450c7e883ac93e161575fac4f8049c4bbb09dbdc
MD5 92a1815fe5f806ea550dc57373648623
SHA1 7d7c74ac6b25be926d5735733d65769dfa013948
SHA512 8c9be61577e3db490af35f3f6d0968eb947e1058b31432a80348469b982f86c545376176b95332b1cae6dd1db830b221e4aa4c2b602e0a7649bb73ce9732236b
TLSH
T1C0D09B5477999D90D856647C17214701758DA9145513E103C5E112D54C87FF241D50B5
MD5 SHA1 SHA512 TLSH

Submit Download

15005a9d-c4be-48cf-8d91-18db1aca2fbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\15005a9d-c4be-48cf-8d91-18db1aca2fbf.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68cbd877-3b38-497e-9047-fbd0d161f164.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\68cbd877-3b38-497e-9047-fbd0d161f164.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7f1d25fb-fc04-496f-abbf-30f203f1415d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7f1d25fb-fc04-496f-abbf-30f203f1415d.tmp
Size 10KB
SHA256 54f9ec911e0e51933644cabef222f874721dbf27f3d18e392705784e2d7623e0
MD5 7904af5c0ecf8bb87eb011b3295f216c
SHA1 7358ced5fd75d84946b183188b6f7addfef3de12
SHA512 e3c50fa3590533ea72dfd7e2c619b8c43bc1cb0c90ef4a5c7176f260b00ced06d12ff4f2229764542cc1517fd105852d1fd9e3383ba452d71d3351cbef1fd94d
SSDEEP 192:sxZERtnB/fIs2A5IdpY0HW6+WNX1q/YrigdRIg5mJ:sxZEnB/fIs2ASNHbw/+U
TLSH
T1D122C8526E38A97B8CC7E20DBB25BF53E6F9503251D11E48AAFC861C04E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89950138-eeef-4d6e-8393-ec3dc877b79f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\89950138-eeef-4d6e-8393-ec3dc877b79f.tmp
Size 27KB
SHA256 07f1bd4d261fbbcb078dbe2d6a0c02ff2b5210aae62534f27c18f57e7efc55bf
MD5 76c622cc892df17fb78636934363bb49
SHA1 39464768c5a05516dfcc8eb2be554b3a01ddecd5
SHA512 692d3e658deff53d431950658c21c0f3ea01a3781615255ee222b437858a63aa25b33b302469047e15a4ef0b48daadc940aa715da68e22ec7289a581e9810267
SSDEEP 768:rKqqHHlWvdD/T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVU4LliA1n8ro8pR1c+:rKqqHHlWvdD/Tu1jaF4LYsnnS
TLSH
T18DC20B3B284CCB7E4FC01A9DDD5A6F977EA802C7A6648D4047F9994C02C77EA61274CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95ab5749-52da-45cf-8e9f-c6592d299c6b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\95ab5749-52da-45cf-8e9f-c6592d299c6b.tmp
Size 10KB
SHA256 5866fad885caf8fb6bd9093f741fda8ee91f9b1a2470bb20f4befd4a17c3cd62
MD5 5e14f9d82ba1079ea1762eff6500598a
SHA1 0414a95190cacc978f110f8f2a82272007684ce9
SHA512 2d7171d616fddd699d1e995462ee2c75c748fee49e8ea9ebb87c38156a3afc7852ef4c14ac379bafec012f9d40a1750dbbbf1880a4f9f7bbfaa395f3c8ff6b4a
SSDEEP 192:sxZERtnB/fIs2A5Idpi0HW6+WNX1q/YrH9PdRIg5mJ:sxZEnB/fIs2ASfHbw/mU
TLSH
T16322C8526E38A97B8CC7E20DBA65BF53E6F9503251D11E48AAFC861C04E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 920ef63ae785c700ed0a963edfe8371c9bdfead7f080d1a070edb14ca7a2a855
MD5 94a21ba7bdd5b6ed395c4d9a705f426a
SHA1 038a1cef0fe3d62272f96f07c9de5f47127314be
SHA512 830a05eb631f439e841b827551003a5cf3a81f05c39f4a34be89fdbb98009d159ad43bdb054698577a0a4c9ec4253f7ed837453ceb442dceb369bed4c1bc9729
TLSH
T175E07DC604E8C32EE7086C5F01E85B8C9380362FEBC0698F3748CC887285C40F6C66A3
MD5 SHA1 SHA512 TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 40KB
SHA256 81b09fe53c328c8c8dbc58e613f2ac4c17deb6873b535d23f792df4e085b489b
MD5 0e0cd7412db53dc078a5ace9110c50ad
SHA1 8d59eb18358862d5a10fc2f7be2fcb3663ededf8
SHA512 526f834c7ff77ccd1d61dea2cebc1f43efb8a5dbec9aa544d04049ac2aef8c8845723c539b530ab82d24b7c23e9da4ca01abc60e8a44822895f499389bf3378c
SSDEEP 768:W3EeO8SsgKF6r1Af4OY14LT9rWVJ9MChlhw+KhVk2xpTEifemz2eJ/5Nsh:zeBIrKrY1c9SbZlW+SVkw2Kd//5Nsh
TLSH
T14503F1F7486E6C1DD820F71801BD87C6B572256BBC002FF9468286AB2D6C9917F163BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 21KB
SHA256 6c86d02cfdd5c5f6870001334e8107a4baab3e1aef66fe10c7d99cb5f00f364f
MD5 d0222ba3d2cb5a3bb8f2a47239e24d76
SHA1 276eb28af1bae0ee7b610bb1dc6ddd30631ec82e
SHA512 888efc525f3697404e7d83c10adf30b8d9181feed84f31da1fd11171d167a3d9fdcf1e993d1e41c5be4011f07ba52d1e3d11303385af9a91a5700b06300c70ca
SSDEEP 384:9LNhOQQykpPetdj5SCi/erzvxYmu/2tdSV63KahRRKBtj0uKigsJxK:7YHyAPeZskveZ27b3/hRwBt9KigwxK
TLSH
T108A2D0F297891DBC0CCDB0EEBA6C32C6552430B0757C757B5AB1EF1224448A5AB9BD83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 16KB
SHA256 eecc6eb9a84abf04b2d278a67ac92c4a025f3d365994904a6bedb49f720b112a
MD5 c5a49151188324b97a545f8e4503d425
SHA1 f71a9fb7fa9e839a193a6dcc932d5397645b8d36
SHA512 47f29d61ce0fcc447578ea6ac33356a602e3651c1a0f342a9c0dd62baafc3e19f2fc2ebc36c5913560c76cb0bb0258a53de36c5284f676e1799aef1a8e371de7
SSDEEP 96:iKZCiA/2PGjfQ7NdP+4HP4GsN7XDmjKN5ur7I65iM:i9x/2rXPBG7XDmtrF5
TLSH
T1E672326E323AD18EC10AAD7C1C74C66BA4993CB43846CB52FFA53D988273BC45C465F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 ce2e802b74f79dae8785817f9363b06b04eef2a7e4004e2e4447b78b3d1571db
MD5 1c64ce7c326597c790f2031acbaced0b
SHA1 9164d890ea9f4be8f469eb06c2b1ea0f2ca4a2c0
SHA512 2725c045aee2598da4f717803d9fdfc9ba1fb1b79dafdb7ee30374a62f9e2553cbcb24db6f9f62720aed8855d4a948e7316547c3f6378904ce831dcd91e3a052
TLSH
T1A8814DD563C19508EFBC07709ADEB49F3D7CDA8261831F2209AAF97C6882F902093CD4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a3cfe19837de842af6cd58ab19b8fa274bf24aab2513691eed84571ccd9d1624
MD5 4211732259f29bcbc7433240e2ec8f0c
SHA1 fb2417afb001859bf2adfd3d02fdcad95d0314e5
SHA512 be3bb15289fecdebeeade27b146c1d6ad0ead293e7ee7eb7e06447822366c4c8ee432c7911c4052b38d0324b85429d6aaa26b1e6c9b4a89a3ad6220aca813a4c
TLSH
T10D613BD517D18108EBBC13709A9FB09F3E7CCA81A1832F2209AAF97C6842F6400D3CE4
MD5 SHA1 SHA512 TLSH

Submit Download

c69015f7-4386-458d-9032-72a9cbec90f8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\c69015f7-4386-458d-9032-72a9cbec90f8.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_eu.wps.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

17001a05-4d8f-4652-ab77-0f8fb28f089e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\17001a05-4d8f-4652-ab77-0f8fb28f089e.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

5dc11c65-e56d-4815-a6e9-27cc0f51d9a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5dc11c65-e56d-4815-a6e9-27cc0f51d9a8.tmp
Size 3KB
SHA256 997561fa9d0a465362357250f4567b0adb5772c47f7d0156559efb0971f1849d
MD5 6a15dd511408a5b5a27056e0ab1fb596
SHA1 25f6ba98bf0f3a3479e02a9f8f9fe472570eb7bc
SHA512 43f04c3b9cda97d80b9444db952afe07b4b0cc5165e1ded089945aee517fcc3360154708b478467a99aa7e1a3d2ebca56294877a8c8dfb3d40d37a289fad6dc6
TLSH
T17781D0F3C3E94A6DDC1156F15A207E1BCE5D095642383C4A88E4BF0B63F2971A352A9E
MD5 SHA1 SHA512 TLSH

Submit Download

96c9cd5e-44ad-482b-9581-3d5663c0ff55.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\96c9cd5e-44ad-482b-9581-3d5663c0ff55.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 73117252badf113d25586a779f5743b872aad905b95bc3e655e47424e57ad1f1
MD5 1ab8ae0d42a0fd6fb11d2203ac47d6e6
SHA1 dbe1a95c96a0049cf3e178dc5d47d673dedf0ea8
SHA512 4f489955e0ec021bd1fe1763168805293dbe91eaa17a323f95b5ff3ea622669f0b0d142981a122cca2690a5cae496ccc92a55952073b8309696968a8ec403c37
SSDEEP 24:KvJSlEpInKdhq1WSgf3yXhqtiAYIJKWho1CSXgaylaIgIhKehQ1qSPI9yXTkbj:Ks+InK7qQLy1jIJKAoM4LIhKIQkrye
TLSH
T12D91938631A70290397E3C0C5475A62B4A8231E73165E6AB7FFE44664F7AF110DFC8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3155974-fde4-4709-b421-89a4f7ad73dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d3155974-fde4-4709-b421-89a4f7ad73dd.tmp
Size 10KB
SHA256 97a5126ac7f3976bbb013ff64076154b9e3065c55b842311decc7241817811da
MD5 4babdd58cc5b6c2bd666efa3e004bf9d
SHA1 91fa265f83be86e953c3877cde672807ed091da0
SHA512 e0de57816920f0f6014c52733331378b45774653595d592271dfd8e8b97c32bc08803df6d036cd2595f05d74b7b0d14a3d6dd888f217b15fdbd77102bce08a40
SSDEEP 192:sxZERtnB/fIshA5IdpY0HW6+WNX1q/YrOIdRIg5EJ:sxZEnB/fIshASNHbw/AW
TLSH
T1D522A9526E38A97B8CD7E20DBB65BF53E6F9503151D11E88AAFC861C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5197b63-ee9a-469b-8160-d31b2e7a7c84.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e5197b63-ee9a-469b-8160-d31b2e7a7c84.tmp
Size 9KB
SHA256 a2b542d860b2dd765d718f9597c0d43282fd9b169f86c8486379117399109eee
MD5 0f71771906792b583589b4c63f7aaed7
SHA1 b9542d9b48a248e99f2667d6a9c2330d28a52476
SHA512 8d7792dd658eaa57b0b1a6559e22f713434d20a9742a3548d235c4a6cec7384c995958cd1c4f431c41f87ab3066ee190d6c20300c9f6f4f733a5705562725cdb
SSDEEP 192:sxZERtnB/fIsPA5IdpY0HW6+WNX1q/YrOndRIgrJ:sxZEnB/fIsPASNHbw/b9
TLSH
T13822A7526E38A97B8CC7E20DBB65BF53D6F9503291D51E48AAFC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33ca646c-1dd4-4da8-afa0-15e8409da766.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\33ca646c-1dd4-4da8-afa0-15e8409da766.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

e83933b3-a01a-46ad-8ec2-011f89bb1f08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e83933b3-a01a-46ad-8ec2-011f89bb1f08.tmp
Size 26KB
SHA256 d78cca471c1605e2d93ab8ba46906bec55be6b970b57fdfea3dd51dd407ce143
MD5 5316a54bd1e9ddc1eb050ff48ded690d
SHA1 6dd136d2e0acad3549a1971ea9535848404d855f
SHA512 78080c11cdee21e404e680bb02cd6ad688abec3fc46eb4c28e88224b40e435439fd0391f0db871d616dfbe03e06e401b4dbaadc7312db4d63d7662b2c197dd1f
SSDEEP 384:kiFlQkUSv0gsNP8TUNTUlIRAAYw6EpdP2S0hZgEUqz6Q9FH7vBEDaVIIlq:/F/rewgQSpJv0YEUq+YFH75EuVLw
TLSH
T15CC219F258EB893BD9AE5703A37E2D038EBCC057B5846A50B39D590CCC861BFD346815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ceb0602a-7c54-49eb-bc62-e93327b81685.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ceb0602a-7c54-49eb-bc62-e93327b81685.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d67607847b0c362de6ea1b0e58f1695bbe17923db28516ce9baae150b07e8288
MD5 1b70ceee22b6b329af59fede0982a88f
SHA1 fc4433e126d709ab2ab29beb2496f8c36e7c37fa
SHA512 4f4145f48488269780bb50f3bc1ae46f608541ec72fadfcca521d7d26b5ae5e448dc2fc46c3cab0510d7f770c1536720abfea457d447a996fe8a9079dfaed5b9
TLSH
T116412A5CA6EA1109B3736F59AFF7646E583BBD773F06D45E00010D4E0A62A44C871737
MD5 SHA1 SHA512 TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\id_ID\style.xml
Size 3KB
SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
MD5 034f37e6536c1430d55f64168b7e9f05
SHA1 dd08c0ef0d086dfbe59797990a74dab14fc850e2
SHA512 0e1911c882152a4e1059a3ce1880d7fb2aed1e1e36cbd37055de2e2a1333acb2a0233ba2a4d969ccebbef1e77809aa5e78807aa9239545beae8c548c0f8f35c0
TLSH
T1E381CA80A610BD0AC563F51573AB7509762CB36383ECCFC4F0EE2E698753652644B63E
MD5 SHA1 SHA512 TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\ms_MY\style.xml
Size 4KB
SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
MD5 394488b30107bcebb84a97ed5d754cee
SHA1 69ebe17f7d577e9bf69c87cff45c3251f0bbc86e
SHA512 24a6bc7debbf7030c1261c69cb4ae7bf3cbb5c7fac315188163c6001e58dfbe2e634925cb767044da7ea0e6d08c709b2ade02f6e43930819e1bef6f7569cad5a
SSDEEP 96:gd6SmSZcFe9gSs8TcySCSi58VS5eQJ/gQkgQ0/Mw8CclQgYzdr/PwiCSeDeR3ciw:gdAh8Ax
TLSH
T13FA17780A610BD0AC563A51977AB7909B62C736383ECCFC4F0EE3E658753692644B63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5CoreKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\Qt5CoreKso.dll
Size 5.7MB
SHA256 ddd87a220eda4f1ce069a07a0f9928de1371931d4af2744ed38552f795ca3c00
MD5 856e6d47652fcb8ff81d50a12168eb83
SHA1 82f0554aef26981a81c17ca983b37892eb16d591
SHA512 c73a4985b0ab6b31f57fe212509e8fbc5183c2f2a9baed7e8d73dbafa4f505a73a04e590a670dfc0b65c708a7def616a48d857977b8ec81777cb3d2d5a8473ac
SSDEEP 98304:bk8b4Ur34vRrxAhJsv6tWKFdu9Cxijl4rWscai:bkk4Ur3KRrWJsv6tWKFdu9CxFWscai
TLSH
T110567C47FA964269D8B6C238C9D7C127F673B80247214BCF2258A3496A777F0293F359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5GuiKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\Qt5GuiKso.dll
Size 6.4MB
SHA256 f7b67c67541a04334115b17e61ef659b1ac3157365c04a14153479fe5121d223
MD5 ed2a2e51d902835904c4c276c7064c2a
SHA1 be0bed8df628b58ccad2e2e3eb4461d90be59965
SHA512 70575d0e5924dea361fdc131f8050014bf1f273f30a9ab4a23274354b24cb40064083069735e334ab2bcf0fa0ca546ff1cbebeb26b7731b24e623b158fd4db4c
SSDEEP 49152:/iQvRDjKlXYIjT0o5f4jMGaiJ/uLxOTeIl7qa2hgdaoWuxZUgNah4VfTNj6WiwO4:1RDj8hUp+G4uxZ9aKj6WEmPFJ
TLSH
T14866F886EA596359C972D17987CB041FE1F37C4283524BC36C45AB490E237EA1B7FE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5SvgKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\Qt5SvgKso.dll
Size 503KB
SHA256 195eb185c4f650c71ca83016ca2190a4c1605c90d4c9e6bace895d7caae7b3ab
MD5 c4dcb15840a7ac78ce5a9d689a2d5a57
SHA1 2945f0a57850ef5478cd101a349db17637502c97
SHA512 0ec20304f270afbd0ab0280707e0730c80dbe8315ce0705abdf662613145d6cbe920844910a5759f437627a11b3e50b473c6e45d08787ece0eef7a058bb970d8
SSDEEP 12288:fYYYJUNY675fyplktpsUMVLEgZ/ABXH9a/vngheZL/XEnEsrnJpaymesGrx1iTQb:fYYY475feyswR
TLSH
T1EAB44993FB520798D526D27CC8978812F273340443A39BDF2A5AEB651F236E1763E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WidgetsKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\Qt5WidgetsKso.dll
Size 5.6MB
SHA256 f0100e1d459b228e444d2cb255b38bdd30e1e9bc146c8f8900f6b9a902ec65da
MD5 37c2eded7077aa216f4259567e09df60
SHA1 79078a23965f9d2f1a1d34a12ee25b3c49ff64a3
SHA512 2a750b12421602e00c20df30a80497acf0db92954692e1337307c6bfa3c0995e7dcffbb4ecd4acaca6382f1ef5e17229f6abe7385c4b1bdfd9573219d40a8458
SSDEEP 49152:ndXSB18Wqh1sDJddut/SISAvVHzvce6YUv2Oss7zDQTWHUlT9BpnToovTUKZN0Ck:rW/dAnJBToovTUKZNRfYulo
TLSH
T1AC466C47FBA50389C56BD23CCACB8513E2B27804472347CB6969DB592F637E2197E780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WinExtrasKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\Qt5WinExtrasKso.dll
Size 251KB
SHA256 7add2d998ffe9abc6004ce70ec46ce91107a44ce759a425e1b3f3a20f88f0dc5
MD5 8ad90adda6f11171d9f886b81e4c3c8d
SHA1 ff2d7d45ce1fd87fddb7ebd74457fde1cf595bba
SHA512 40ec3bb2a8582a87c351bab0b067782561d6e529abed6f3e015a873106c4255cafed95acee300b9392790f4a1361f621a6624686b691994c80d522fac0f336c3
SSDEEP 3072:tF5o5cKUM7YLBwcJf1+6Ws2tL+xvN80DTWrYH:tfpMqxvN86dH
TLSH
T165448684BADD9619F80970B88FCCD199C223BAED8B47425F351ED39F4B619816E139F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-console-l1-1-0.dll
Size 11KB
SHA256 2afbfa1d77969d0f4cee4547870355498d5c1da81d241e09556d0bd1d6230f8c
MD5 919e653868a3d9f0c9865941573025df
SHA1 eff2d4ff97e2b8d7ed0e456cb53b74199118a2e2
SHA512 6aec9d7767eb82ebc893ebd97d499debff8da130817b6bb4bcb5eb5de1b074898f87db4f6c48b50052d4f8a027b3a707cad9d7ed5837a6dd9b53642b8a168932
SSDEEP 192:4nWYhWxWWFYg7VWQ4uWjXUtpwBqnajrmaaGJ:2WYhWvZqlQGJ
TLSH
T186421A838EFC9543F9A66E701B99D9833C3DABD76910905925A8F19C2CC33D1EB0072D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-console-l1-2-0.dll
Size 11KB
SHA256 00942431c2d3193061c7f4dc340e8446bfdbf792a7489f60349299dff689c2f9
MD5 7676560d0e9bc1ee9502d2f920d2892f
SHA1 4a7a7a99900e41ff8a359ca85949acd828ddb068
SHA512 f1e8db9ad44cd1aa991b9ed0e000c58978eb60b3b7d9908b6eb78e8146e9e12590b0014fc4a97bc490ffe378c0bf59a6e02109bfd8a01c3b6d0d653a5b612d15
SSDEEP 192:iTWYhWyWWFYg7VWQ4uWq6Cu87ZqnajgnLSyu:sWYhWi1XHllk2yu
TLSH
T15B423A93CEFC9543F5A6AD704699D9833C3CABCB2910916536A8F19D2CD33D1EB00A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-datetime-l1-1-0.dll
Size 11KB
SHA256 77577f35d3a61217ea70f21398e178f8749455689db52a2b35a85f9b54c79638
MD5 ac51e3459e8fce2a646a6ad4a2e220b9
SHA1 60cf810b7ad8f460d0b8783ce5e5bbcd61c82f1a
SHA512 6239240d4f4fa64fc771370fb25a16269f91a59a81a99a6a021b8f57ca93d6bb3b3fcecc8dede0ef7914652a2c85d84d774f13a4143536a3f986487a776a2eae
SSDEEP 192:5WYhWYWWFYg7VWQ4SWSS/njxceXqnajLJ35H:5WYhW4gjmAlnJpH
TLSH
T1FE322A838BBC4503FEA32EB042A9D9937D3D67D62A10C12A05B5F1682C937D1EB14B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-debug-l1-1-0.dll
Size 11KB
SHA256 45e48320abe6e3c6079f3f6b84636920a367989a88f9ba6847f88c210d972cf1
MD5 b0e0678ddc403effc7cdc69ae6d641fb
SHA1 c1a4ce4ded47740d3518cd1ff9e9ce277d959335
SHA512 2badf761a0614d09a60d0abb6289ebcbfa3bf69425640eb8494571afd569c8695ae20130aac0e1025e8739d76a9bff2efc9b4358b49efe162b2773be9c3e2ad4
SSDEEP 192:4WYhWFsWWFYg7VWQ4eWZzAR/BVrqnajcJH:4WYhWFMJRLlA5
TLSH
T1E9321B828BFC9103F9A7AFB053D9D9933C3DA7C72910916605A9F45D2CD37D1AB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-errorhandling-l1-1-0.dll
Size 11KB
SHA256 accdd7455fb6d02fe298b987ad412e00d0b8e6f5fb10b52826367e7358ae1187
MD5 94788729c9e7b9c888f4e323a27ab548
SHA1 b0ba0c4cf1d8b2b94532aa1880310f28e87756ec
SHA512 ab65495b1d0dd261f2669e04dc18a8da8f837b9ac622fc69fde271ff5e6aa958b1544edd8988f017d3dd83454756812c927a7702b1ed71247e506530a11f21c6
SSDEEP 192:imxD3vEWYhWnWWFYg7VWQ4eWMOwNbDXbBqnaj0qJm8:iIEWYhWFpLbBlwqJm
TLSH
T146321A928BFC8043F9E76E7017A5D9837C3D77D7295081A506A8F1A92C933D1EF11A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-file-l1-1-0.dll
Size 14KB
SHA256 7cb0396229c3da434482a5ef929d3a2c392791712242c9693f06baa78948ef66
MD5 580d9ea2308fc2d2d2054a79ea63227c
SHA1 04b3f21cbba6d59a61cd839ae3192ea111856f65
SHA512 97c1d3f4f9add03f21c6b3517e1d88d1bf9a8733d7bdca1aecba9e238d58ff35780c4d865461cc7cd29e9480b3b3b60864abb664dcdc6f691383d0b281c33369
SSDEEP 192:+AuVYPvVX8rFTsRWYhWyWWFYg7VWQ4eWQBAW+JSdqnajeMoLR9au:TBPvVXLWYhWiBdlaLFAu
TLSH
T1E962E853D9B4F25BF98FAE315192D843683852C7042541C91BD8A7AD3CE73C5E3D8A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-file-l1-2-0.dll
Size 11KB
SHA256 7a3c5167731238cf262f749aa46ab3bfb2ae1b22191b76e28e1d7499d28c24b7
MD5 35bc1f1c6fbccec7eb8819178ef67664
SHA1 bbcad0148ff008e984a75937aaddf1ef6fda5e0c
SHA512 9ab9b5b12215e57af5b3c588ed5003d978071dc591ed18c78c4563381a132edb7b2c508a8b75b4f1ed8823118d23c88eda453cd4b42b9020463416f8f6832a3d
SSDEEP 192:dzWYhW1sWWFYg7VWQ4yWL3sQlmqnajlD4h1N:BWYhW2e6l94h1N
TLSH
T111323B928BBC4143F9D66E7053E8D9877C3DA3DB2E60815905A9F09D2C837D1EB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-file-l2-1-0.dll
Size 11KB
SHA256 349a79fa1572e3538dfbb942610d8c47d03e8a41b98897bc02ec7e897d05237e
MD5 3bf4406de02aa148f460e5d709f4f67d
SHA1 89b28107c39bb216da00507ffd8adb7838d883f6
SHA512 5ff6e8ad602d9e31ac88e06a6fbb54303c57d011c388f46d957aee8cd3b7d7cced8b6bfa821ff347ade62f7359acb1fba9ee181527f349c03d295bdb74efbace
SSDEEP 192:/VyWYhWjAWWFYg7VWQ4eWiuNwzNbDXbBqnaj0q:/VyWYhW8g+LbBlwq
TLSH
T1C5321AC2CBFC9403F9A76E705299D8877C3DA7C7291081690AA8F5AC2C973C0EB51E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-handle-l1-1-0.dll
Size 11KB
SHA256 c78a1217f8dcb157d1a66b80348da48ebdbbedcea1d487fc393191c05aad476d
MD5 bbafa10627af6dfae5ed6e4aeae57b2a
SHA1 3094832b393416f212db9107add80a6e93a37947
SHA512 d5fcba2314ffe7ff6e8b350d65a2cdd99ca95ea36b71b861733bc1ed6b6bb4d85d4b1c4c4de2769fbf90d4100b343c250347d9ed1425f4a6c3fe6a20aed01f17
SSDEEP 192:P9RWYhWEWWFYg7VWQ4eWncTjxceXqnajLJS:LWYhWk3TjmAlnJS
TLSH
T1BC324DC2CBBC8003F9A76E7047A9D9937D3DA3DB2911816A05A9F1692C933C1DB10B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-heap-l1-1-0.dll
Size 11KB
SHA256 2e981ee04f35c0e0b7c58282b70dcc9fc0318f20f900607dae7a0d40b36e80af
MD5 3a4b6b36470bad66621542f6d0d153ab
SHA1 5005454ba8e13bac64189c7a8416ecc1e3834dc6
SHA512 84b00167abe67f6b58341045012723ef4839c1dfc0d8f7242370c4ad9fabbe4feefe73f9c6f7953eae30422e0e743dc62503a0e8f7449e11c5820f2dfca89294
SSDEEP 192:5t6DjZlTIWYhWsWWFYg7VWQ4eW4MtkR/BVrqnajc:5t6Dll0WYhWMqkRLlA
TLSH
T13E422A85CAEC9103F9676EB053D5D9873C3DB7C62510802615A8F19C2C937D1EB25B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-interlocked-l1-1-0.dll
Size 11KB
SHA256 b02324c49dd039fa889b4647331aa9ac65e5adc0cc06b26f9f086e2654ff9f08
MD5 a038716d7bbd490378b26642c0c18e94
SHA1 29cd67219b65339b637a1716a78221915ceb4370
SHA512 43cb12d715dda4dcdb131d99127417a71a16e4491bc2d5723f63a1c6dfabe578553bc9dc8cf8effae4a6be3e65422ec82079396e9a4d766bf91681bdbd7837b1
SSDEEP 192:nWYhWNWWFYg7VWQ4uWtGDlR/BVrqnajcU8:nWYhWLJDlRLlAU8
TLSH
T165321A828AFC5143FAB76E7042E4D9937C3DB7DB261091550AA8F49C2C877D1FB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-libraryloader-l1-1-0.dll
Size 12KB
SHA256 08484ed55e43584068c337281e2c577cf984bb504871b3156de11c7cc1eec38f
MD5 d75144fcb3897425a855a270331e38c9
SHA1 132c9ade61d574aa318e835eb78c4cccddefdea2
SHA512 295a6699529d6b173f686c9bbb412f38d646c66aab329eac4c36713fdd32a3728b9c929f9dcadde562f625fb80bc79026a52772141ad2080a0c9797305adff2e
SSDEEP 192:FvuBL3BBLZWYhWxWWFYg7VWQ4uW4g0jrQYcunYqnajv9Ml:FvuBL3BPWYhWv8jYulhMl
TLSH
T1A3422BC2CBAC9143F5E65E3042A5CC477C3963DB5960C46906ADE1A82CE33C0EB10B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-localization-l1-2-0.dll
Size 13KB
SHA256 059cb23fdcf4d80b92e3da29e9ef4c322edf6fba9a1837978fd983e9bdfc7413
MD5 8acb83d102dabd9a5017a94239a2b0c6
SHA1 9b43a40a7b498e02f96107e1524fe2f4112d36ae
SHA512 b7ecf60e20098ea509b76b1cc308a954a6ede8d836bf709790ce7d4bd1b85b84cf5f3aedf55af225d2d21fbd3065d01aa201dae6c131b8e1e3aa80ed6fc910a4
SSDEEP 384:NOMw3zdp3bwjGzue9/0jCRrndbwNWYhW6WAulh2:NOMwBprwjGzue9/0jCRrndbw5D
TLSH
T1CE520892C6E8D207F85DAD717167D9437C38A6C50822D95603F6FB2428E33C5E79172D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-memory-l1-1-0.dll
Size 11KB
SHA256 dadbd2204b015e81f94c537ac7a36cd39f82d7c366c193062210c7288baa19e3
MD5 808f1cb8f155e871a33d85510a360e9e
SHA1 c6251abff887789f1f4fc6b9d85705788379d149
SHA512 441f36ca196e1c773fadf17a0f64c2bbdc6af22b8756a4a576e6b8469b4267e942571a0ae81f4b2230b8de55702f2e1260e8d0afd5447f2ea52f467f4caa9bc6
SSDEEP 96:qo1aCFEWYhWwp/DEs39DHDs35FrsvYgmr0DD0ADEs3TDL2L4m2grMWaLNpDEs3OC:teWYhWVWWFYg7VWQ4yWwAKZRqnajl6x7
TLSH
T10E424B818BFCD503F5D72E708399CA977C3EA7C66DA0911902A9F1992CD33D1E710A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-namedpipe-l1-1-0.dll
Size 11KB
SHA256 b57e70798af248f91c8c46a3f3b2952effae92ca8ef9640c952467bc6726f363
MD5 cff476bb11cc50c41d8d3bf5183d07ec
SHA1 71e0036364fd49e3e535093e665f15e05a3bde8f
SHA512 7a87e4ee08169e9390d0dfe607e9a220dc7963f9b4c2cdc2f8c33d706e90dc405fbee00ddc4943794fb502d9882b21faae3486bc66b97348121ae665ae58b01c
SSDEEP 192:cWYhWZSWWFYg7VWQ4eWkcc7ZqnajgnLSp:cWYhW84cllk2p
TLSH
T1E7322B61C7AC8143F9AB6E7042D9D9933C3DA7CB2910C16556ADF9A92C837D0E730B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-processenvironment-l1-1-0.dll
Size 12KB
SHA256 aa415db99828f30a396cbd4e53c94096db89756c88a19d8564f0eed0674add43
MD5 f43286b695326fc0c20704f0eebfdea6
SHA1 3e0189d2a1968d7f54e721b1c8949487ef11b871
SHA512 6ead35348477a08f48a9deb94d26da5f4e4683e36f0a46117b078311235c8b9b40c17259c2671a90d1a210f73bf94c9c063404280ac5dd5c7f9971470beaf8b7
SSDEEP 192:qKWYhWbWWFYg7VWQ4eWYoWjxceXqnajLJe:qKWYhWJ4WjmAlnJe
TLSH
T1D14219C2CBBC5003FAD76D7042A9E4A77C3893E72D1080690564FA693C977D1EB94B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-processthreads-l1-1-0.dll
Size 13KB
SHA256 c9a686030e073975009f993485d362cc31c7f79b683def713e667d13e9605a14
MD5 e173f3ab46096482c4361378f6dcb261
SHA1 7922932d87d3e32ce708f071c02fb86d33562530
SHA512 3aafefd8a9d7b0c869d0c49e0c23086115fd550b7dc5c75a5b8a8620ad37f36a4c24d2bf269043d81a7448c351ff56cb518ec4e151960d4f6bd655c38aff547f
SSDEEP 192:AWXk1JzX9cKSIvWYhWLWWFYg7VWQ4SWW0uI7oinEqnajxMyqY:AWXk1JzNcKSIvWYhW5+uOEle6
TLSH
T1A1520AD5C6FC9183F88AAD306685D9533C3AD7C5192A813106E9F2E93DEB3C2D62462D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-processthreads-l1-1-1.dll
Size 11KB
SHA256 25a99bdf8bf4d16077dc30dd9ffef7bb5a2ceaf9afcee7cf52ad408355239d40
MD5 9c9b50b204fcb84265810ef1f3c5d70a
SHA1 0913ab720bd692abcdb18a2609df6a7f85d96db3
SHA512 ea2d22234e587ad9fa255d9f57907cc14327ead917fdede8b0a38516e7c7a08c4172349c8a7479ec55d1976a37e520628006f5c362f6a3ec76ec87978c4469cd
SSDEEP 192:NtxDfIeA6WYhW7WWFYg7VWQ4eWpB5ABzR/BVrqnajcb:NtxDfIeA6WYhWp28RLlA
TLSH
T17A422A929AFC9043F997AEB052D5E9533C3EB7C72621806515B4F16C2CD73C1EB11A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-profile-l1-1-0.dll
Size 10KB
SHA256 42f4e84073cf876bbab9dd42fd87124a4ba10bb0b59d2c3031cb2b2da7140594
MD5 0233f97324aaaa048f705d999244bc71
SHA1 5427d57d0354a103d4bb8b655c31e3189192fc6a
SHA512 8339f3c0d824204b541aecbd5ad0d72b35eaf6717c3f547e0fd945656bcb2d52e9bd645e14893b3f599ed8f2de6d3bcbebf3b23ed43203599af7afa5a4000311
SSDEEP 192:clIHyZ36WYhWulWWFYg7VWQ4yWqeQDbLtsQlmqnajlDC:clIHyZKWYhWKhlbp6l9C
TLSH
T111320992CBFC4043F5A36E7053D8DA837D3DA3DB6A6081190569F4AD1CC77D0AB6492E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 11KB
SHA256 02d987eba4a65509a2df8ed5dd0b1a0578966e624fcf5806614ece88a817499f
MD5 e1ba66696901cf9b456559861f92786e
SHA1 d28266c7ede971dc875360eb1f5ea8571693603e
SHA512 08638a0dd0fb6125f4ab56e35d707655f48ae1aa609004329a0e25c13d2e71cb3edb319726f10b8f6d70a99f1e0848b229a37a9ab5427bfee69cd890edfb89d2
SSDEEP 192:4GeVvXK9WYhW1WWFYg7VWQ4yWj6k50IsQlmqnajlDl:4GeVy9WYhWzVk6l9l
TLSH
T179422B968BBC5003F5A36E70139ACE8B7D3DA7D729A4812604A5F19D1CC33D4FB14A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-string-l1-1-0.dll
Size 11KB
SHA256 9447218cc4ab1a2c012629aaae8d1c8a428a99184b011bcc766792af5891e234
MD5 7a15b909b6b11a3be6458604b2ff6f5e
SHA1 0feb824d22b6beeb97bce58225688cb84ac809c7
SHA512 d01dd566ff906aad2379a46516e6d060855558c3027ce3b991056244a8edd09ce29eacec5ee70ceea326ded7fc2683ae04c87f0e189eba0e1d38c06685b743c9
SSDEEP 192:byMvQWYhW5fWWFYg7VWQ4eWio3gDwcunYqnajv9JS:byMvQWYhW/BXwulhw
TLSH
T17F321B82DBBC9003F9A36E704799ED877C3CABD72910826516A9F1942CD33C0EB14B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-synch-l1-1-0.dll
Size 13KB
SHA256 a31a15bed26232a178ba7ecb8c8aa9487c3287bb7909952fc06ed0d2c795db26
MD5 6c3fcd71a6a1a39eab3e5c2fd72172cd
SHA1 15b55097e54028d1466e46febca1dbb8dbefea4f
SHA512 ef1c14965e5974754cc6a9b94a4fa5107e89966cb2e584ce71bbbdd2d9dc0c0536ccc9d488c06fa828d3627206e7d9cc8065c45c6fb0c9121962ccbecb063d4f
SSDEEP 192:L1dv3V0dfpkXc2MAvVaoKKDWYhWTJWWFYg7VWQ4uWoSUtpwBqnajrmaaGWpmJ:Zdv3V0dfpkXc0vVaeWYhWj/qlQGWpmJ
TLSH
T1A8522A92D7E8A243F56FEE7046CAC5936C3857C74A20C0261195FAAD3DE33D0EB1562E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-synch-l1-2-0.dll
Size 11KB
SHA256 1c72ac404781a9986d8edeb0ee5dd39d2c27ce505683ca3324c0eccd6193610a
MD5 d175430eff058838cee2e334951f6c9c
SHA1 7f17fbdcef12042d215828c1d6675e483a4c62b1
SHA512 6076086082e3e824309ba2c178e95570a34ece6f2339be500b8b0a51f0f316b39a4c8d70898c4d50f89f3f43d65c5ebbec3094a47d91677399802f327287d43b
SSDEEP 192:ztZ3XWYhW3WWFYg7VWQ4eWNnpit7ZqnajgnLSl:ztZ3XWYhWVg+llk2
TLSH
T1DF422AA6CBAC5203F5A79D7047D9D8833C3DA7DA2950816116BDF1693CA33C1E700E2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-sysinfo-l1-1-0.dll
Size 12KB
SHA256 19c78ef5ba470c5b295dddee9244cbd07d0368c5743b02a16d375bfb494d3328
MD5 9d43b5e3c7c529425edf1183511c29e4
SHA1 07ce4b878c25b2d9d1c48c462f1623ae3821fcef
SHA512 c8a1c581c3e465efbc3ff06f4636a749b99358ca899e362ea04b3706ead021c69ae9ea0efc1115eae6bbd9cf6723e22518e9bec21f27ddaafa3cf18b3a0034a7
SSDEEP 192:fKIMFFyWYhW6WWFYg7VWQ4eWoVjxceXqnajLJ4:fcyWYhWKRjmAlnJ4
TLSH
T11E421992DBBC9203F9A76E7052D5D5833D38A7D62511C11906E9F3B83CA33C5DB50A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-timezone-l1-1-0.dll
Size 11KB
SHA256 3d798b9c345a507e142e8dacd7fb6c17528cc1453abfef2ffa9710d2fa9e032c
MD5 43e1ae2e432eb99aa4427bb68f8826bb
SHA1 eee1747b3ade5a9b985467512215caf7e0d4cb9b
SHA512 40ec0482f668bde71aeb4520a0709d3e84f093062bfbd05285e2cc09b19b7492cb96cdd6056281c213ab0560f87bd485ee4d2aeefa0b285d2d005634c1f3af0b
SSDEEP 192:4EWYhWdWWFYg7VWQ4eWvvJ6jxceXqnajLJn:4EWYhWbwYjmAlnJ
TLSH
T1F24228D3CBB88403FDEB6F7047A9D4937D38A7E61920815909E6E4693C973D1EB10A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-core-util-l1-1-0.dll
Size 11KB
SHA256 5eb724c51eecba9ac7b8a53861a1d029bf2e6c62251d00f61ac7e2a5f813aaa3
MD5 735636096b86b761da49ef26a1c7f779
SHA1 e51ffbddbf63dde1b216dccc753ad810e91abc58
SHA512 3d5110f0e5244a58f426fbb72e17444d571141515611e65330ecfeabdcc57ad3a89a1a8b2dc573da6192212fb65c478d335a86678a883a1a1b68ff88ed624659
SSDEEP 192:dZ89WYhWFWWFYg7VWQ4eW5QLyFqnajziMOci:dZ89WYhWDnolniMOP
TLSH
T1FD322B838BFC8403FAA76D304795DD837C3CA7DA266080A519A8F5992CC37D1EB14B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-crt-conio-l1-1-0.dll
Size 12KB
SHA256 b119adad588ebca7f9c88628010d47d68bf6e7dc6050b7e4b787559f131f5ede
MD5 031dc390780ac08f498e82a5604ef1eb
SHA1 cf23d59674286d3dc7a3b10cd8689490f583f15f
SHA512 1468ad9e313e184b5c88ffd79a17c7d458d5603722620b500dba06e5b831037cd1dd198c8ce2721c3260ab376582f5791958763910e77aa718449b6622d023c7
SSDEEP 192:R0WYhWRWWFYg7VWQ4eWLeNxUUtpwBqnajrmaaG:R0WYhWPzjqlQG
TLSH
T1BF42E68396FC5A03F5535F30A7F9DAC37D3A27D72A506069045AF4A838C23D5AB11A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-crt-convert-l1-1-0.dll
Size 15KB
SHA256 6c008be766c44bf968c9e91cddc5b472110beffee3106a99532e68c605c78d44
MD5 285dcd72d73559678cfd3ed39f81ddad
SHA1 df22928e43ea6a9a41c1b2b5bfcab5ba58d2a83a
SHA512 84ef0a843798fd6bd6246e1d40924be42550d3ef239dab6db4d423b142fa8f691c6f0603687901f1c52898554bf4f48d18d3aebd47de935560cde4906798c39a
SSDEEP 192:JM0wd8dc9cydWYhWyWWFYg7VWQ4eW9jTXfH098uXqnajH/VCf:G0wd8xydWYhWi2bXuXlTV2
TLSH
T14362C65366E42F26F69B177221FEC7D72A394781259143B4C217E54C3883781BDA7C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-crt-environment-l1-1-0.dll
Size 11KB
SHA256 aa3e3e99964d7f9b89f288dbe30ff18cbc960ee5add533ec1b8326fe63787aa3
MD5 5cce7a5ed4c2ebaf9243b324f6618c0e
SHA1 fdb5954ee91583a5a4cbb0054fb8b3bf6235eed3
SHA512 fc85a3be23621145b8dc067290bd66416b6b1566001a799975bf99f0f526935e41a2c8861625e7cfb8539ca0621ed9f46343c04b6c41db812f58412be9c8a0de
SSDEEP 192:6KNMWYhW6WWFYg7VWQ4eWSA5lJSdqnajeMh3:6KNMWYhWKiKdlaW
TLSH
T154420A868BBC5543F6976E7047B9E9437D3C67C7291082650569F1582CC73C0FB11A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-crt-filesystem-l1-1-0.dll
Size 13KB
SHA256 974af1f1a38c02869073b4e7ec4b2a47a6ce8339fa62c549da6b20668de6798c
MD5 41fbbb054af69f0141e8fc7480d7f122
SHA1 3613a572b462845d6478a92a94769885da0843af
SHA512 97fb0a19227887d55905c2d622fbf5451921567f145be7855f72909eb3027f48a57d8c4d76e98305121b1b0cc1f5f2667ef6109c59a83ea1b3e266934b2eb33c
SSDEEP 192:CGnWlC0i5ClWYhWwWWFYg7VWQ4eWtOUtpwBqnajrmaaGN4P:9nWm5ClWYhWQ8qlQGN6
TLSH
T1BF52F78387E86E12FAA71F7156EDDBD73E3D2BC2199282658016A45836C33C07F2255E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-crt-heap-l1-1-0.dll
Size 12KB
SHA256 8166321f14d5804ce76f172f290a6f39ce81373257887d9897a6cf3925d47989
MD5 212d58cefb2347bd694b214a27828c83
SHA1 f0e98e2d594054e8a836bd9c6f68c3fe5048f870
SHA512 637c215ed3e781f824ae93a0e04a7b6c0a6b1694d489e9058203630dcfc0b8152f2eb452177ea9fd2872a8a1f29c539f85a2f2824cf50b1d7496fa3febe27dfe
SSDEEP 192:8a9aY17aFBRAWYhWYWWFYg7VWQ4eWbr0tJSUtpwBqnajrmaaG:8ad9WYhW4F/qlQG
TLSH
T117420A938ABC5543F5A36F706AE8DACB3D3E63D67D5080670157F59829833C0AB2162E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-crt-locale-l1-1-0.dll
Size 11KB
SHA256 edc1699e9995f98826df06d2c45beb9e02aa7817bae3e61373096ae7f6fa06e0
MD5 242829c7be4190564becee51c7a43a7e
SHA1 663154c1437acf66480518068fbc756f5cabb72f
SHA512 3529fde428affc3663c5c69baee60367a083841b49583080f0c4c7e72eaa63cabbf8b9da8ccfc473b3c552a0453405a4a68fcd7888d143529d53e5eec9a91a34
SSDEEP 192:+WYhWoWWFYg7VWQ4eWSoV7jjT6iBTqnajbQwr1:+WYhWIiVTTXZl3QC
TLSH
T132422A468BFC5103F6936EB04AECEA837D3EA7C71A1181A50596F5982C833D8EB11A5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-crt-math-l1-1-0.dll
Size 20KB
SHA256 f6a93fe6b57a54aac46229f2ed14a0a979bf60416adb2b2cfc672386ccb2b42e
MD5 fb79420ec05aa715fe76d9b89111f3e2
SHA1 15c6d65837c9979af7ec143e034923884c3b0dbd
SHA512 c40884c80f7921addced37b1bf282bb5cb47608e53d4f4127ef1c6ce7e6bb9a4adc7401389bc8504bf24751c402342693b11cef8d06862677a63159a04da544e
SSDEEP 192:8JIDSM4Oe59rmkUALQe1hgmL44WYhWWWWFYg7VWQ4yWARgKZRqnajl6umA:8JI2M4Oe59Ckb1hgmLhWYhW2v2yRlwQ
TLSH
T14092A74749DCFF63D18F1BB741F08BCE6A385AA665D1B6B4C81B908434A27C47E83949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-crt-multibyte-l1-1-0.dll
Size 19KB
SHA256 5b3e29116383ba48a2f46594402246264b4cb001023237ebbf28e7e9292cdb92
MD5 a5b920f24aea5c2528fe539cd7d20105
SHA1 3fae25b81dc65923c1911649ed19f193adc7bdde
SHA512 f77f83c7fad442a9a915abcbc2af36198a56a1bc93d1423fc22e6016d5cc53e47de712e07c118dd85e72d4750ca450d90fdb6f9544d097afc170aeecc5863158
SSDEEP 384:4SrxLPmIHJI6/CpG3t2G3t4odXLhWYhWfgy6l9ne:4iPmIHJI6vZO
TLSH
T1CE921D6B8EE82E12E28FD7F3B5F6C7C62A350F9105C07375A26785483841EE9BD52E05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-crt-private-l1-1-0.dll
Size 62KB
SHA256 55bc91a549d22b160ae4704485e19dee955c7c2534e7447afb84801ee629639b
MD5 5c2004daf398620211f0ad9781ff4ec2
SHA1 e43dd814e90330880ee75259809eee7b91b4ffa6
SHA512 11edbbc662584bb1dea37d1b23c56426b970d127f290f3be21cd1ba0a80d1f202047abb80d8460d17a7cacf095de90b78a54f7c7ec395043d54b49ffe688df51
SSDEEP 1536:Se6De5c4bFe2JyhcvxXWpD7d3334BkZn+PI5c:Se6De5c4bFe2JyhcvxXWpD7d3334BkZU
TLSH
T1C05307DB49E63F21E18FF7B76BFB17C90B253A4418806274EAC7556B34853A9BC43A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-crt-process-l1-1-0.dll
Size 12KB
SHA256 191f53988c7f02dd888c4fbf7c1d3351570f3b641146fae6d60acdae544771ae
MD5 dd899c6ffecce1dca3e1c3b9ba2c8da2
SHA1 2914b84226f5996161eb3646e62973b1e6c9e596
SHA512 2db47faa025c797d8b9b82de4254ee80e499203de8c6738bd17ddf6a77149020857f95d0b145128681a3084b95c7d14eb678c0a607c58b76137403c80fe8f856
SSDEEP 192:+nqjd7dWYhWDWWFYg7VWQ4yWMJ5HKZRqnajl6b:+nsWYhWxp5HyRlwb
TLSH
T1604209878BF86953E6675F3082F9D7877F3B53C2690082698456F05D3C833D5AB21A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-crt-runtime-l1-1-0.dll
Size 15KB
SHA256 4390c389bbbf9ec7215d12d22723efd77beb4cd83311c75ffe215725ecfd55dc
MD5 883120f9c25633b6c688577d024efd12
SHA1 e4fa6254623a2b4cdea61712cdfa9c91aa905f18
SHA512 f17d3b667cc8002f4b6e6b96b630913fa1cb4083d855db5b7269518f6ff6eebf835544fa3b737f4fc0eb46ccb368778c4ae8b11ebcf9274ce1e5a0ba331a0e2f
SSDEEP 192:maajPrpJhhf4AN5/KixWYhW4XWWFYg7VWQ4eWvppXjxceXqnajLJhrdCq:mlbr7nWYhW41MXjmAlnJhUq
TLSH
T19572D74397FC7F27E5972B7216F9D7D72E3A638226108179C463B0983883781BD5721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-crt-stdio-l1-1-0.dll
Size 17KB
SHA256 6f6f6e857b347f70ecc669b4df73c32e42199b834fe009641d7b41a0b1c210af
MD5 29680d7b1105171116a137450c8bb452
SHA1 492bb8c231aae9d5f5af565abb208a706fb2b130
SHA512 87dcf131e21041b06ed84c3a510fe360048de46f1975155b4b12e4bbf120f2dd0cb74ccd2e8691a39eee0da7f82ad39bc65c81f530fc0572a726f0a6661524f5
SSDEEP 192:WpPLNPjFuWYFxEpahTWYhWHWWFYg7VWQ4eW9M3u57ZqnajgnLSuRCz:W19OFVhTWYhWlBu5llk2
TLSH
T15682C54785EC7F02E29787331AFAEBEA5A31578338007178C117E99836CA3D87E43559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-crt-string-l1-1-0.dll
Size 17KB
SHA256 45e0835b1d3b446fe2c347bd87922c53cfb6dd826499e19a1d977bf4c11b0e4a
MD5 f816666e3fc087cd24828943cb15f260
SHA1 eae814c9c41e3d333f43890ed7dafa3575e4c50e
SHA512 6860abe8ab5220efb88f68b80e6c6e95fe35b4029f46b59bc467e3850fe671bda1c7c1c7b035b287bdfed5daeac879ee481d35330b153ea7ef2532970f62c581
SSDEEP 384:NFvU4x0C5yguNvZ5VQgx3SbwA7yMVIkFGl/WYhW49PBolniMcx:T5yguNvZ5VQgx3SbwA71IkFwNJT
TLSH
T17482C64386F83F02DA8F57B359FAC7C32E385F46254153B5D467A48C38827A2BE67909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-crt-time-l1-1-0.dll
Size 13KB
SHA256 b48310b0837027f756d62c37ea91af988baa403cbcbd01cb26b6fdae21ea96a2
MD5 143a735134cd8c889ec7d7b85298705b
SHA1 906ac1f3a933dd57798ae826bbefa3096c20d424
SHA512 c9abe209508afae2d1776391f73b658c9a25628876724344023e0fc8a790ecb7dbce75fddae267158d08a8237f83336b1d2bd5b5ce0a8eed7dd41cbe0c031d48
SSDEEP 192:qy5NDSWYhWcQWWFYg7VWQ4eWAcSJR/BVrqnajcm2:qU0WYhWcwASJRLlA
TLSH
T1635209439AE86A07FA971B7212FDD7E73F3917C22A8071758166D4983A93390FE1381D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\api-ms-win-crt-utility-l1-1-0.dll
Size 11KB
SHA256 c81c4bba4e5f205359ad145963f6fbd074879047c66569f52b6d66711108e1ed
MD5 6f1a1dfb2761228ccc7d07b8b190054c
SHA1 117d66360c84a0088626e22d8b3b4b685cb70d56
SHA512 480b4f9179d5da56010fa90e1937fe3a232f2f8682596c16eeaed08f57cf8cffeaa506060429501764f695cb6c5b3e56b0037de948c4d0e3933f022a0b4103d2
SSDEEP 192:GI6fHQduPWYhWcWWFYg7VWQ4yWpbdsQlmqnajlDPD:2f5WYhW8Kd6l9L
TLSH
T1F64229838BFC5643F6A72F7083E8DA833D3E67D6696082654065F5993883BD0FB2151E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

concrt140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\concrt140.dll
Size 316KB
SHA256 2405355f0a58067b258f8df33c327e3a3d716eaac5a3a5aebb757842d85bd376
MD5 5fe9a647921ded8a2fad92deb9ec4ab2
SHA1 1ce87fac4c22aae82a81ddb26952c074b744e78d
SHA512 11fe4c0519cb1df73695ce38b5fdea2a563de565116a47ff0032d5a68b8c51fe732ad66738a7167e56d79193c60af9204a7ee0beae8ff8bb75abd0b484c2d764
SSDEEP 6144:jfjSd54rw5k9cZW1Cbfpri5/ww8VRj7nWzg/p8Wcz:DOP4rwK9c0ILqzocz
TLSH
T16C64398A76140CE6F96BE039C553851BE6F2BC416352D3CB0264839E6F637D1E93A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\dbghelp.dll
Size 1.5MB
SHA256 13f0c74845318b52b76e6000564b1a99c37de48422b44ac74d034fa222c65a23
MD5 a5e4b3ff51cf5b7926d9651908feb666
SHA1 4ef5d229709e40f3f84e46c3a28341eadbd1a044
SHA512 0615ff581b648715461349b1622fbc208042fc8c395cb2d271203b25b036f59edb0fc3470065dc15061af1be0fff48981f55bbea7f00c88906e9b470764a86fa
SSDEEP 24576:xU5lL6v/X5lknycQFrQ8gKt/X95WqbQLZopKjMcqpzd1YWLfY:Kni/X5lknDFUCaQLq8
TLSH
T1A975299BF97941F5DCBAC039D662A627F9B13859832497C367908B562F23BF4983D300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kbaseconfigcenter.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\kbaseconfigcenter.dll
Size 1.7MB
SHA256 c44d9839740a1123366f0d05733e8a30fd5e5dc3be997c19ec56ecfa9ad3a8ff
MD5 0cb825eff4abb9725b8fd455c8e4397c
SHA1 b708fd3da28aafa5f1371a7c44a372cdaa111d96
SHA512 a565c3cad458e748edf41b1991221d12c4372eab6e32f343e23216470f8ca146158b40c95464ed6cb2e89d28bd0a3abb90c3a31b1b7ecef2b7d07530e98cbfbf
SSDEEP 24576:sACojGfgw0waUWZEtMlKuYGGGZhxliF3AfbzB51GBpLN:sACMGfgOuqtMlKsBHHQAfbzNGBpN
TLSH
T136854B135B5A4C2CD15E93383A35274ABE7858F5073092FFAB982D954D2A2C0B73D7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kpacketui.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\kpacketui.dll
Size 889KB
SHA256 b9b4cd91b915ef7b3ed0ad3c505fa59db7ea34fd9b4cfdfa38af73b4f61f450c
MD5 699ff593721673b8f5aea78af58df8d3
SHA1 cb3ed5d660bd80c7c5103bd14221a459325c52d0
SHA512 6d3dfe2cb680015a84bb49e6c912782d67d3ae3313160fbc5e1ed9cf5dca074a850633fbb45c0e38ff87431532aad3c0aa373b5b05175cc1b17aa23853259e40
SSDEEP 12288:eLBofLZHd/OrH5Uf3s5042RfbFP4YeEU0zTo+/owiVDlBF5oDa+0:eSfL/OT5Uk64ehQYw4TafIaZ
TLSH
T1AA15491FAB9503B9E06AD17ACAC78803E171B44643B24BE75994EB753F733F1593A280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\msvcp140_1.dll
Size 35KB
SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
MD5 2a214cb2f0f9473e7765ee3b8db8651e
SHA1 9ce5c3d6c7d94b175f136f552af8771dca6147b3
SHA512 ea9a759babdec5818fa1e430d1cb453cac762cfaa8f934e01d7182100f66cae21527962696f5bd963fcb0fba2c0f38bf4028e75f89e9e599ddee008021646a33
SSDEEP 384:3jJ2J9VQH+qNy09dmFWcS5gW7YZ1gr4iSt+e92xS+R9zWd/I1IHRN7SUl8BR9zTr:d8QH+qNy0PmgogU9v2ci9zeHSn9z3
TLSH
T1C3F25D86F7248442EC674970C699EE837C3DB3D25B50969B17A5F61C0DA33C1FA34A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_2.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\msvcp140_2.dll
Size 273KB
SHA256 3ea06f0ee098b4823cb79599df3780e7f23cce52c19aac31d2a0d47efe33a5e9
MD5 3151333808c2c2339d5f5466df70b7dc
SHA1 e48159bb2127ec812ff679f6fabc41141009f26a
SHA512 8f1daa078e124dc89b51b84baab8d6cc2d77497be23b2ba95ef3fee54d9034e17bf5cd15a4043d025699972cae20f9c46d2e7bef48e4283f3ad9ca6b84fc64d1
SSDEEP 3072:1J51P7emwi1j+XZi7b1dbqtH0h6XV3Q0JPQo07ICl3Sg2xmygdCg2LMeDh5FD799:1JbjwvnQo/iy5L/XxTWrNM
TLSH
T1AD543912B51A2EBFC5D6E8B04939B416FC223A418775C48A57C31C8D9E2BB437FE3529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_atomic_wait.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\msvcp140_atomic_wait.dll
Size 49KB
SHA256 640b2aefced484d0368eea5bdd06addd0658a3a70a49256e560d6923b404a479
MD5 44aec42494531580bca182b0e2fb19c2
SHA1 a85a6a4de6656e5969fa4ab15f2230dfe2839e75
SHA512 d8afb5bbb1394fd14c3ec8ecdd4c02e1c6f23031b15173b1448dfd4915c392bb8512cd41eccb449db19969397a09046d27d54db704c8122ff62c12ff5a89c9d6
SSDEEP 768:ayMsqh8UGchsJr3KbYA5XeDmqw4DYPW9zr0JD0io9z7p1uF:W+UjCKb/5XeCqgazrURgz91G
TLSH
T19C337DDDA7684083E5678634C1A4E517FA7AB7E20710D6EF4352F0890FA37D1AE34B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_codecvt_ids.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\msvcp140_codecvt_ids.dll
Size 31KB
SHA256 f2069a52880ec885ee7f0511186100eb7fada0411a2b4948fafea7735b878a18
MD5 3ece3fb90bfaea8e9a5fb7139ff9cbdc
SHA1 91b19dd0db24a5cbd944eca9c67fad3b53f9c154
SHA512 c059ffd80de25ad10d34064b1e9421666525da67710de0ac445cfc45b8139715dd946f7e90c1e0d719c60e3d5902e3229db4496c87d674c0012c9b4a8c2b2291
SSDEEP 384:p7GVNpd36sRWioEWEw4himRSt+efdDtdQ5R9zpU8NSqHRN7w9ju0R9zlWdo:5GVsfaw4DYd7ds9zmMEu49z0G
TLSH
T19BE27C89DA3C4487EC9B5C7082ACDE477C3D77C60A10569B4392F5181DA33C6EB3866E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
Size 75KB
SHA256 454d2d4de427777085aa633276dafaef2b6e7c015fb0cfe3d8584fd0feb478ed
MD5 0a8a1f0c8b142cb0b278df1be405b3e0
SHA1 dcfaaddc8406f5321da28e5abe2a0db4769d2ac1
SHA512 ec377df0b3e5b5a7abe896737b8dc24e59b4869251dfc6c50989622146b462c024a78670908a43ef3287483f60d393ff459641be0a3082f11bc4a08a507cb5e3
SSDEEP 768:UXOzQ/DBnTQxkUtwZfVKFkYQJc11qTwf6NBvBJZSac6mWWrGYiDL9rA+J7QWHiYp:3jf8JVwf6NBBSac0+G7pHHZ7782
TLSH
T1C7736C93DB8407A9E51B8634CAD58A2BE6B27842076183CF6724E3680F737D2397D3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
Size 46KB
SHA256 446546b0a39c118792e13410d5debfab511a56bb0c865a2e44325e35dad3908a
MD5 9f8e5c31158d226c547ed72a08b6b726
SHA1 218376b867f072d50ce63d80cf8ef57be0b28626
SHA512 74ce44e3a0c6fc179806d23d749825c0d7b8dae92a3c11aa751bb306ba74d82cbaebe3a727bd0326009f98f648f5b87980de22cc22cb920414c64052be9b3d22
SSDEEP 768:ig1GoaNbxpmTE06VYiDL9rA+J79xmYi77fsrA+hLf:FGoaTpmTE06V7p5xm77zu
TLSH
T171236A97CF540809EA179730B8C98A26F972B4525B91C3CF2664C3690F563C23DBD7E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qskia.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\qt\plugins\platforms\qskia.dll
Size 1.9MB
SHA256 c5114ee341716213d33842ff69cffdb8415e758e22675a6c553fd22f8a1449b7
MD5 59bb6473a3aa9def9b94cb3a346ea4f7
SHA1 16d0f5b8a10d5db9442b2fa6baf6b3d9da912d00
SHA512 32afb94acfa3cdd81ae2bfc885725be4b753acd4e8213e4dc642779002b113467b05bd18b1b40ff9636f09839d3d108d54402162f9ac597287f6732a27152969
SSDEEP 49152:zYL+EV7G+Y3uKtxs0+bF4wQi0GH4Q9I4jlk82a66kTcjJdG:WV7G+NR0
TLSH
T1CB957D43E3B44298C2A7C13D868B8F1BE6B1740543A19BDB2560CF59EF237E21A7E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\qt\plugins\platforms\qwindows.dll
Size 1.6MB
SHA256 72e264acd9cc427f5ed9af8795e32f2c3915035c168b10d0b0d7a546cc568e6f
MD5 b3fc8b94ceffe0513600e2d2eb076430
SHA1 705d7e6855f35b8171be21190506346cabe20ff8
SHA512 3f939b5ddb283d1ba3fa9b5d8cba9538d63029a9ef08c16e11cf333af9978384e8b20b6e47a05aae84fa73e736df4e135ea7ef0c9a8507b3543853a25efb565e
SSDEEP 24576:QkGAzEn7Kn2eozTuqTttIrHhbR2gkNVDosZB1MwaaVe:Qozu7Kn2xzTuYarHh9cVVMgVe
TLSH
T102757B43E3A44398C16BC239C68B9A07E77174050361ABDF25A09F59EF63BE3177A781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsprintersupport.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\qt\plugins\printsupport\windowsprintersupport.dll
Size 88KB
SHA256 404c59777b1864d96a0c5d47f5afe90eccb19460aa88222a8ae3e63c5621d1c6
MD5 60cdea4aae6d120e8539af10602b11b0
SHA1 47684f11e77477d1452ef28c815f7722bf751987
SHA512 c0d76a57cd98d3066296845fbd851c69bfea588e37a3fb90196afa5bb6bd353e4eaf8bdfa25875c3237731cfc56125fd954e7487709d4c54abcfd669cb55d989
SSDEEP 1536:qUOvHEs27LT3nOv3sQwd3QHuxOaPG6Hbm9O7pt77s:qvvks2TOv3K3QwOaPG6Hbm9OTE
TLSH
T195934AA3EA650188D626C139E4D70927F732B41117A283CF6768D74D0F237D27EB939A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
Size 159KB
SHA256 3a245dbf55683848b2060cf476efa9c14c313b06b427f667c16cc791a7a0f8f6
MD5 60e48dfd1387324e8e764c4a149099c6
SHA1 a4854ea120625b6a03e37b51e50d98db284e5e7b
SHA512 f4a4c01c54f97d49e2c77423037138141106add6e9d27881cc953f697e10c3a69ed246a2c5058fff95ebf7bd4290259f1ebd97016f1f45850508a6e18cb3f8da
SSDEEP 3072:VSApjXbrT36b96bavsTHnbNgJUkEbgCtVjvvcI2oj4Pead:FX6b96bavqHnbNpNtVjvvcDd
TLSH
T17BF33913F65143D9C527D2B8C19A0512F3B37444436257AF29A6DBB82F533A2BD3EAC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\ucrtbase.dll
Size 987KB
SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
MD5 61eb0ad4c285b60732353a0cb5c9b2ab
SHA1 21a1bea01f6ca7e9828a522c696853706d0a457b
SHA512 44cd871f48b5193abb3b9664dbea8cdad19e72c47b6967c685cf1cc803bc9abb48a8a93009c972ef4936e7f78e3c92110828790aa0a9d26b80e6a523bbcd830d
SSDEEP 24576:xOPJ1g7mT6BNvwTOxNfoYotrz1111111r8SoKxmxvSZX0ypdNLh:xO1aNoaxNfo/+a
TLSH
T18D259E64F75C0AA6C17BE17CC95B550ED972340647608ACF03EA8BB97E2BBE91637310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vccorlib140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\vccorlib140.dll
Size 344KB
SHA256 19839407c3fdbc824e5bce189bf68ddf8097f12ec28b757797ffa0415c144ddd
MD5 0b4d02b22ffe3957db27d9cc6cff6edf
SHA1 bec5a8eed4434222956d9f0f0482f8562d992317
SHA512 9588f6e2c96b2793598cd6335bf10cdd53acd77886a5f703118c77af676da1ec3f393d55a1b1dc28dd33bf69c4c5bc70c615f8d41e1829e473ff9bbc1163ea3c
SSDEEP 6144:PpVeNd1C++IAU1qsxEW5QcT2Xgs4hiWi/GDhmVejWXaV+GpfOqmIzt/mtBGgVa0J:Pp0+Xgs4hiWi/GDhmVejWXabO/IzgtK+
TLSH
T16C74E4277B9C4CC3C931A0794E978309E372694207A1E3CB0691970E5F7B7E8AD3B665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_threads.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\office6\vcruntime140_threads.dll
Size 37KB
SHA256 219915cf20822f34d5e7c1fdd4e21ae7f3396881096c51036225fb8f84b47afa
MD5 e57bb2cda101fda5c72f3af09b035bd6
SHA1 77363f6b41d022dbd34e182a93087fc63a5b08cb
SHA512 cab172e140cc2da4444a0c37a42187c4bd29997aa5522f5cf076d8d40cb0116a9e905162349204415213c75ff34cca98cdcc5a7ee9535a8d28945af726545441
SSDEEP 768:CjJ+AiHEFeLUIHmJ9crFciw4DY0zxOW9zeLCbpiFds9z9:+uHEwLUIHscrFcig0zUizGEpiFdkz9
TLSH
T126037C86D7684487E9EA9870C2B9DA47BD3EBBD20B5041DF4381FA480D633C2EA3571D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\product.dat
Size 98KB
SHA256 694f339696e8a5fc662f09d9edf7403ebf8a0969829152189d2af37ab4d170d0
MD5 eac78d958f889c9dcb287c286c5247fe
SHA1 2db225f75b6e8395a86c547c6868c56d9891e013
SHA512 4f0356f3093d804183dcf1cef36e398fef1e53fe8d18b6c4ac41494a20fdd78cf56fcc49547d2630280e14ac5b215b07d8d564bbde9be212da511fa0623b8767
SSDEEP 1536:1yKvOpT+qaZnhBgrtZE6JjPHUAvSVxel50kyd2vnoD:1ybT+rZhBghu6JjvUAKV00kydenoD
TLSH
T183A37EF77E1D6BE49CCE233E5E37281CE9F9483525966448E282E5A5AC1C0B63CD790C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product_new.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59f340\CONTROL\product_new.dat
Size 86KB
SHA256 9e7d489a68c617de400fcc9ffb0b58dd9afd4923cfe6ee6fdf475572467c26a2
MD5 fb445d2a8636bea7e67f48a14504033e
SHA1 aa64a5fc6f9a570f683124b00e8aaf76215b381f
SHA512 88d9da4467c4381043b08bb8e703bc24f8b3bbec119d2e8496f8f8eb7069dc4189aed9eee35aa21cfd54fc36b55a059c62ac316d4343664c612a1f505bdb5608
SSDEEP 1536:I3Ccy4hYmpbeFpijcrp3Dvxp2L+03v7shof/hRUCe22pBXskeYzEy7B:QG4mepgrRX2zYhoBSO2pBUG
TLSH
T136832B18DCD16EAD685052791D376D8227B7DDA1A0DD30AC4B12AA4CFC3CF887F72A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 387B
SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
MD5 c38481658f9149eba0b9b8fcbcb16708
SHA1 f16a40af74c0a04a331f7833251e3958d033d4da
SHA512 8f98d62f88442b8ef94aa10074e35aa8d9494f3c76ce8b143ca0bf7fa0d917f3175212fbcd6e7b0597fd0ec0e1b2827f157135512fb01c88218d36e2f7dd73ce
TLSH
T1D4E09B1BA8D1B0ABDEB302E988979D54BAC03D9A066D23147762540D3D32918FB41D65
MD5 SHA1 SHA512 TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 433B
SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
MD5 a9519168ca6299588edf9bd39c10828a
SHA1 9f0635e39d50d15af39f5e2c52ad240a428b5636
SHA512 0607eb1f5598320961fbd8ef75beeb1b6dc1af3cae7eeb5ba352f3e2a2edb25e1d9e68fb46c24e4299957352c0c906314c889c2d1092437eccc1d1a0485f3557
TLSH
T194E0540FA891B0679D7302F488E39C007AC03E96055D1210773144093C32A14FB81D69
MD5 SHA1 SHA512 TLSH

Submit Download

1907571053.values

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cache\1907571053.values
Size 89KB
SHA256 5d5f6afe7574e4a714366c8c385bbd9bc7069dd92d03ead4dde9770918393c35
MD5 d2f848666897b4761a5a0657b5552fcd
SHA1 9f04be820ac3b2d48579c0c5e790a7fc57850c90
SHA512 f6ef80f6b4d2cf45ca62020eeed83af888731495a1902278f7b0d4835bccbce9a2dca10372e2fbdfca57c9fe3ef2f33a2d91e63dabb9fc517f147b312892cd8c
SSDEEP 768:ZZVutMDX0zdYgyrgd7tx7DkOkZVutMDX0zdYgyrgd7tx7DkOKHuC6HuCK:4tJz1ysd7thl7tJz1ysd7thlu+K
TLSH
T1DF9329D227E61E1DF5B60F3EA63666A15977FAC95E01B20C0271D41B0E3AE50C8F0B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08f92581a381c34eca30290b90995d56.prog.tmp

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cache\skia\sksl\120\angle\1414_008c\08f92581a381c34eca30290b90995d56.prog.tmp
Size 14KB
SHA256 fd12cd9359a102d073e193ad6436d0e0f956e1147beb5edefd5842b00b44f49c
MD5 52c98683ab1609c73cbcab033dcf7397
SHA1 f01fa47dd1ec9f2c934ef61b0361c4cbef00b8c8
SHA512 c396ab1af1147f025c9af378c4a432e0579474322b5161f3a09dea1b98d012781d60dce3842179e38f5a133f8adfc515053282e3919445548eabbbf4a3bc1a3f
SSDEEP 192:gPE+zRIuFZumTwa5DmEKk+xEDZ2qJVbEnBe7JyVZsG1SgUJE03Vy2qDQXNLYq/n4:izRqm2qJVbLkVnuzVy2qDQXNc6j
TLSH
T151620F0566A0C422CE1EB27C4CC78A857739ECE64ED6874B354C371E0E771AB4EA6EC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4bbfed7471133ca451ddb4afdfd1aa09.prog.tmp

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cache\skia\sksl\120\angle\1414_008c\4bbfed7471133ca451ddb4afdfd1aa09.prog.tmp
Size 18KB
SHA256 68918ec1708c82891ebb710b7ca16c4096a36948c9f3e18b6e47f9be145abbbb
MD5 ef2595f8ac0b43a5c5109702ae70d109
SHA1 225300a71f1cfc3d428355ea92515c35010dab65
SHA512 02a9fa726a3f8effbc57f0b05dafa16bdf0d4aacf83e4f13865f3bbd3ce9872947380aae25bf3a148266642c772b0b219e03a1d1c6e54060398d58fa83ba17de
SSDEEP 384:cWNHVJVbXnx4tMMJwfwg3TieAHvGiqRcE6Aa:htVJVznxOMMJwo+vGvGTyWa
TLSH
T1C0820002B770C436CD2EB27C4C8386486B39EC954DF192AB354CB72D0E771B75A6AA94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5df7af200ba905f133e465dd14044045.prog.tmp

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cache\skia\sksl\120\angle\1414_008c\5df7af200ba905f133e465dd14044045.prog.tmp
Size 10KB
SHA256 bee2a3203251ebfa12c6493e689e92a05bc615442dbaf933b4c53863da68e364
MD5 5f05b456eeddd3bf2a79669906c3686e
SHA1 0c5f3d774f43eb2cb432a98aaceb3242bc0326f6
SHA512 d0c0125bda7604e7ecfb55d28ee8c4006a2016eb4ec2b76a6859f960d1516b6a9523470c3385db46e40afb4749c0d7daee561e1c5cdaee6e2da091875fb944c0
SSDEEP 192:16duFZusa5DWBoO+xE5aJVbXbkKgk95aNgRiYq/lyn:1xBohJVbAeaqRZ6M
TLSH
T19922FE242A508422CE1EB17C5DC74A46233DECE28ED5975B710D360A5E3B1EB4BB7DCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65922b8a70c7f729626e398e389acb2c.prog.tmp

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cache\skia\sksl\120\angle\1414_008c\65922b8a70c7f729626e398e389acb2c.prog.tmp
Size 8KB
SHA256 37bc6fe5a3433f9fe26bf40165d8b239312d76354b9a2be825c5be6ff2041b92
MD5 c6e6f4a166ed1a281113a5831db45276
SHA1 017a7537552586aba2bfcb9ed11069263af2e066
SHA512 6aa0373f93688129df336d6cc74148eaf0c67c1278cef638ef6427b7d00b5f07e50124232025b8bd9fde09f4045955e007efbe4ccfb9d3add8b04e72b67c19cb
SSDEEP 192:lbuFZusa5DWb+xEj4JVbrDsRgQ2gmNgRGYq/Pw:ISJVbcDmqRN6
TLSH
T1AF12EC546A50C013DE1AB13C4DC68A4A633DECD25ED59B5F700C771A0E3B1AB4BA3ED9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77ca6a25d670b047f637285312ec1ae8.prog.tmp

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cache\skia\sksl\120\angle\1414_008c\77ca6a25d670b047f637285312ec1ae8.prog.tmp
Size 12KB
SHA256 7c55c8911e6c5731997bba1580445038959fd07429d164d8bd6d5950de49bae1
MD5 ea384f0815b5cd730402387dd7c9d191
SHA1 3636426e7e6d3f005ab7b909aa51e893804a3746
SHA512 af76461a167849394e0f8da1f56b4d06c4e8c5cb5906f6f9ad87ee165eca79c7ae25fa464c24cc9c8dfabafab4f03568a3896fb8d9625f996e232d8714726dc2
SSDEEP 192:DKIuFZumTwa5D6LT+xEngxqJVbuTB36R3XF1qgUEE0rzvzIFxsDYq/zWkPBEE409:7B6qJVbZn3PzvzI3sE6
TLSH
T165521C057660C822CE1EB27C4CC7868A2739ECD25EE5835B744C771E0E371AB5BA6EC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7bf4d7e09eadf0439241a5516198db6e.prog.tmp

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cache\skia\sksl\120\angle\1414_008c\7bf4d7e09eadf0439241a5516198db6e.prog.tmp
Size 15KB
SHA256 c8e1ad86ff0b5b4637e968ca6960f5a00dd9251daaef3aaff091e9be4b37366d
MD5 1a236fff359989c66e480f49a7780b81
SHA1 c58983e17e54877bfde154294e39d81dc1b85647
SHA512 e46c619428ac04d77953f647259558a91ab7dc0757db29260fda96abbca2e6da3e1cc1e774c89fdfe95833815d93b1cbd95738a44c4aff6d27232454dd6a0c4a
SSDEEP 192:SExNQuFZumTwa5D6LT+xEngxqJVbCTIvHBerr3XF1qgUEE0uij7ywdFxsDYq/zFb:5NUB6qJVbSn3aifyk3sE6
TLSH
T103620F0677B0C832CD2EB27C4C8386892739EC914DE1936B744D772D0E772AB5A66ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25a355448d733f0bfadfe69265753986.svg

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\configs\appicon\25a355448d733f0bfadfe69265753986.svg
Size 1KB
SHA256 d9addcc5613696a2c97ee42474ee5acbb7b442bddee543b1d933d60662fb592f
MD5 f471000724cd9f58e7629183f8f5cfa6
SHA1 ef1cc4079645cfbb140e90d4c8c7ab0aa1772266
SHA512 b04b60be1b78dccde6a3cd9b11818cd168b91840f707426366a8709a1517131e74410db015d02c83a1246f13f007802c6960743cdd5f4162252f56609d314469
TLSH
T12F21DDF6E01C5780484B8738FF0B2892B46FF8BE1F9A55F581967E1220702BA9D585F0
MD5 SHA1 SHA512 TLSH

Submit Download

4e4df5d3322d880f582f3c95b6f2ae88.svg

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\configs\appicon\4e4df5d3322d880f582f3c95b6f2ae88.svg
Size 1KB
SHA256 90dfbf1bc4b9b1d4363167d519d3e140a43d223a85063cd77e73c6a9baad6b34
MD5 072b879d8f0ca0721014a558646c0179
SHA1 aa85dcdbf1e466d4e7ada3d996d1a01247e8ac7d
SHA512 824455fd1c847633a21977f7712cf9028a131e96696ddd54a11d10fa4126faf6831b453c43152cc89de253df20d227f311cba833343ada41411b5c1f87231a79
TLSH
T1144176E22758E0C1B50D47BCCE2B14B0C52F78B83FDC451DE254F9E576192A1684CAD5
MD5 SHA1 SHA512 TLSH

Submit Download

50c4d3b6ffa860908c73643d2a9fe37b.svg

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\configs\appicon\50c4d3b6ffa860908c73643d2a9fe37b.svg
Size 1KB
SHA256 1a9c96c9463c52bd233edf3b5a7fdfae6b63cf6b7067602d476f8b7c670348ed
MD5 90e825ddd1bf1897fe25a9725d6c3529
SHA1 7660e999102c4acffdd6278316f53d75fb89002d
SHA512 802c836452e4173b7486747c441b835026657a0f3e0b51ef1b71b0b031f58f82ff6d3bff25f86525ec75298143a9d40f30aaef6d0a4b5e63796098546a180b38
TLSH
T1BD21E4F23144A3417E81CB72D75F727A532B3CFC5A5D449A60106AC2F81AB94594CCDC
MD5 SHA1 SHA512 TLSH

Submit Download

8e2c18164ccef1cf945648e9bd5c1991.svg

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\configs\appicon\8e2c18164ccef1cf945648e9bd5c1991.svg
Size 2KB
SHA256 49e0bba54191a9790aeb884dbd27508a9b17826fa39ed66907c9d0e39d9e3fcc
MD5 5fe01a988b73ccc23842bbe289c58688
SHA1 ca2425767b9182c00f03ae95703edd67c6ff0a92
SHA512 981d3f4e24bbf0ed8eb77b9c8d2dcf9d8c87f5456f87ba43be7342752d67df68dfdbf72151e84a5355f4ecb790bbfc2509d60065677f5d7febb9822aca461529
TLSH
T174411FF6D694F1C0B006BF74F1277439E06F787E3FCA8E958140EE95E9241A28D44C82
MD5 SHA1 SHA512 TLSH

Submit Download

aac1856207f372d91bf9c10d624d5905.svg

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\configs\appicon\aac1856207f372d91bf9c10d624d5905.svg
Size 1KB
SHA256 4529ebee10e0179dedc42d85dbd28e79d26bc6c056c3fc2961f12c126720c5bc
MD5 9ea616d7b9b407bc0bdbc6496733a396
SHA1 9e88ac8f360249844b8fe1b93c99d0731c60a082
SHA512 aebcc19c61ea1e44e4af18a539e3c89a088bace411499e707b20d466c2f95a2f7b9037b430b761a5ccd39337d789750cbd5b2fe78d0ec346c27ced0577857e09
TLSH
T1523110F612F826D5C95D83B3BAE638BB352A3AFC67128EC11B546F94DD510751708CC1
MD5 SHA1 SHA512 TLSH

Submit Download

e2bc5e2f6c4f468fc9922914b3b46427.svg

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\configs\appicon\e2bc5e2f6c4f468fc9922914b3b46427.svg
Size 907B
SHA256 316e694e8ce1053d2901161ff23ad26f32e1d7fd80d64b90c4ce7e710c55ca90
MD5 8b91cc9cf680c5b752f98b4e9a490312
SHA1 771c657a36395331753c1541df058104a74feaf0
SHA512 2463f3cb2121b73b1bf94ee4357b8dd8cbce35909ced0c4e9aef37a4d696b4dcb1cebd19efc7b8d9cc084ebe1ce4bd442e8840a1fccc020ca37030f2c73f7ce8
TLSH
T13B11D0EB7D49A594D00163B2DF07A02614FFB0AEE55B05DB1A376FC1B6AC8370F64690
MD5 SHA1 SHA512 TLSH

Submit Download

ids_v3_lang_128.ini

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\kfpccomb\ids_v3_lang_128.ini
Size 2KB
SHA256 34b9a6f7264575bd4b65e2dbccfabdb3292a5f41d94130f7528101e61087a8ea
MD5 0f0e2c7adc46796fa43fa55610d77f32
SHA1 8b28e3212d4a83a086399c5d43b050a6fa334d19
SHA512 923039c396d14f167b2d3945b648c24aae42ced43fc69b6469a2c04e118a413f1d0a037fa39d363af3d746d53352dbb59bf904791d1f20a752bd7f39e991d77c
TLSH
T1F84128CD8A7AD235829E2E05CBF7C39A4A339B4D770A7403F5B4725C488F7EA5881C40
MD5 SHA1 SHA512 TLSH

Submit Download

ids_v3_lang_60.ini

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\kfpccomb\ids_v3_lang_60.ini
Size 6KB
SHA256 6144870b8c353353f0f29623ecdeb2e8e3994f885a808ea6d567a10af32c7ac3
MD5 bfbde0b2c84b974eaa26916517d386af
SHA1 1e11431a34f0778723df581e5dd6ad065c1e7073
SHA512 271f9520cc4ddc1426ad186035a05fa9ff9531a210fd42b5f9d9fafbb8eb3fc1e7ce2a5b6ebc5aa565d59c31c0833d624b10099b993e13c8995b3b2ce6addc11
SSDEEP 192:TE6OsAccZP1ICU5WxqNRy9QqddR665OUKeRRh:Q6OlccZdNU5+qNRy9Q4hwteR3
TLSH
T11FD1F0DA0C2F8979236B695482F54307BB33532D7B1EEA42F76177D57A0B7C584D2801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksomisc_2026_11_02.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_11_02.log
Size 4KB
SHA256 7f42b3169a61481dd17381292c3276ba028fae6ac5443c89246edc3c5cf39680
MD5 b24f700b39511acd84744334a776b969
SHA1 2f417aed777e27b63ee4acc49860f1a5ef47f2c8
SHA512 ff305fbd2f9dd19b883da6ed9070506854c6cfbb7f4ff3a7a6e7b2d1353d5068bdcbef46f83645c26a343d76c45f7f7d41eec3f69f60519b4c6c2c132af43129
SSDEEP 96:Lw6qYoPJiWcstlkJiWL4Ji3+6qYoDJiWcJHfJi+HzJH6iRqJi+HWJHfJi+HKJHVS:ERYw/kmrRY86/jFaiRqjG/jKnZjfdSNh
TLSH
T1C5A16E9976F94145F3B78F56ACF644674E7ABC92AD21D80E1990230E44A1ED0FDB033B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 898B
SHA256 72f80fbb0df1fe7a4c7a84c5683022ba3a85536c9fd64c7cd8aa60a4d438258b
MD5 457ff4609eb0fb55142934ec0b941c6d
SHA1 0a116b1f8d25784b9ecb610dcb8e51de6d85cedc
SHA512 6fb2c5fcc3e54cae74f9ae248bf3ed0700a34b5f36f8f893d8e22db7e7f9d9cfde3bb7188ef67aa3806807fe36d49eaef8f950dae374fc493c082cfd73bf3b79
TLSH
T174115959109440D4C77A0628E1388ACA3D4F35F8125F217FFFE5CE4A49C845AC89DE55
MD5 SHA1 SHA512 TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 10KB
SHA256 afc37950cd2877e16942d486acb8afdfbfe690f0cba062c509d4daae99889453
MD5 1ae7f3bcf96bfb0926705c6efde804fa
SHA1 28a7615c4f878d2812622c1a18d06fb94faaadc9
SHA512 2529fa97d85eb0330d8a7d43885724527bd50c31af22249324dc5df21e364170a706e166c0856e7b20f55b77adc95c284e770a4f68a7a596b85f045d3bd1295f
SSDEEP 96:M4Hnbfuvu2DauzupuXumdulugBAuAuHuZquSqOuRugwuEeu3fuLuk8uZuIWuuuJN:Mk1BnqPnQ/Djnf7a
TLSH
T166329DAB40AE0198977E0E3863754CCA2F9E2DD9734725A07F73DD874ECE072429EA54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 11KB
SHA256 97f1be0dacd95c2b98885ab7262f508b75460a02c59968c654c13bdb1e26888b
MD5 693d93f329902b31368c9a60fb021a36
SHA1 3b4ae13856565857de3c4f724d5065b18446aa24
SHA512 0eb664aa5aeedc828bd62b749982c70bc721a9ebbd67d426c68c0036b916631bd993bfedb7ceb0e370e8b78cbaad6046ecfb6911c13af5dfea08067a03cb1e2a
SSDEEP 96:M4Hnbfuvu2DauzupuXumdulugBAuAuHuZquSqOuRugwuEeu3fuLuk8uZuIWuuuJH:Mk1BnqPnQ/Djnf7p4u4
TLSH
T118328CAB40AE0198977E0A3853754DCA3F8E2DD9734725A03F73DD874ECE07252AEA54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 27KB
SHA256 e19ba721ba1986ff67142b426802971d765127dfe0146d690c096f296baa5224
MD5 a4736a54fddfe8ded2f7f671478c2ed1
SHA1 d0075e71c08d451b62a1c4e81836a0889570e7ab
SHA512 f0a8a1ed8bacd0cbfb16755d06ff7eb6cdd384594cbdf642712391d090745b354e198eae69390aaae2c54a1e339da267039024193029652c9d2b592c64235bdc
SSDEEP 192:Mk1BnqPnQ/Djnf7p4u8In3pn5yguXaOB6u+ueXyjlq0iyPQ7NgVBAaawuKimXm9r:uQ/DTFeZguKe6u+uemK
TLSH
T19AD2DBAA107DA09047AF5BB4027D4DDA398F25AA335E26523FB3CD9A1CCD817D1ECD18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 61KB
SHA256 db31b2ab36bd6072592b87bbc5efdb147b66fa9afe19e4215f319db65a69bb0f
MD5 be983feb6e765ce19c188c49d72c245c
SHA1 cd42d59d9ec915522a01ca32275ead1fb87c1248
SHA512 b8b3d48390ef1062f3e59dbc319da310dcffa93a6d9022d2a4febb6e650990d68b8e9ac0f5d801d6f30e64ee24aca1467ebdd032a6eaed2f2e92862d078d1399
SSDEEP 384:uQ/DTFeZguKe6u+uem9zLpeLYUMTUnHAjQUdbayRM1voXqRUjB2h2GP8vlE/aHrd:uQ/DTFeZguKe6u+uecjg/ZvqQy
TLSH
T16753009E08289090E77F8770413A4ECE2D4F65AE232E29657FF3CC5669C8417D8EDE19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 66KB
SHA256 6e05071fcf71e1901be4802222e877e46bae2c6baa254ce0ccfd9f855f6e5f2b
MD5 0415dce88f2d09ffa19427a437cf6648
SHA1 c9ec4931541daf1bd11f3956a5dbe497951cb521
SHA512 70f3a0b4b6f816a3c50f349a425dcf101357fcc38220c00253683c295711a62763e03fc396484373b4554a31d30c5a771c0b1cab9c0d25b5f464e2b0fd42898e
SSDEEP 384:uQ/DTFeZguKe6u+uem9zLpeLYUMTUnHAjQUdbayRM1voXqRUjB2h2GP8vlE/aHrv:uQ/DTFeZguKe6u+uecjg/ZvqQW+H4
TLSH
T17B63109E08289090E77F8770413A4ECE2D4F65AA232B29657FF3DC4A6DC8417D8EDE15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpsupdate_2026_11_02.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\update\wpsupdate_2026_11_02.log
Size 2KB
SHA256 a5d2eaa462064f006601f323c004427267ba0d763ae856511e21fab8c19dcfd1
MD5 f893f36a1ed9ff68eb4333a7faff8988
SHA1 7fc2bb98e314496e3d0cacbe8275b22f65ef0f97
SHA512 51824f94ea1653ab85ceb8854daed089c60bd539356093f4cc7b8465b6c05afecdfb9084666128e307a37b320f690066e074b9bf024862dbe7047dd15ec6efdc
TLSH
T1A8418C6A36F5054B6933FA1B89F7041347BA722AA630DE8C10D203AF1EE1B40F97575E
MD5 SHA1 SHA512 TLSH

Submit Download

mdbx.dat

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-x64\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat
Size 64KB
SHA256 2710902cb4b604d238f7aeac880d735bbcb230abf29b3ea1178815d81171838d
MD5 7573688cc4f130dda13c0b2073d9a3a5
SHA1 b613532a2d924b0c21c8bc6744f493ef21cc9925
SHA512 83aa2fb7fef5037e4a8f70e61f86017aa2d0363e8a5d31b5e3ebd97836d5e0342d639a223f0e512605d068bd3945c48743d4c5337fb80fbd6db3dfe02eabd9ce
SSDEEP 192:M4i5hg6OLZ3502hgSOLZ350fUw3XfVOm6StJ9cSiW5xsFu2DmMv7Jrs2hghOLZ3y:MOnjxO/j7wcNSWSiBmqJFOSj
TLSH
T1F2537C8DE2E51FBCE9B91ABCA45A4D0FB7E71789E7091E053406130978436BD72A448F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcsdk_dpv3.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
Size 46KB
SHA256 1f05e3d8fbe0d9a14750aeb7b803a5d14d4e662989f8fb6f338aec8767e8e806
MD5 6f89bccbd45637131f4778560b112ba8
SHA1 d8f132ef147e8ff40a97eaf7d50012d48c77f80f
SHA512 14a2cb0eab1e7f559b803e5f6873135b0c2866be0b9da36129430b675a61855803423828a9d137711425a8ab8becbe546dd53d85f77fcedd170e97edb609f1c5
SSDEEP 768:6FwFa8RbbFZhDq9SYBaMdCMwWE0POTl2ltOLLzSDb+ZPsqAN:l04bbDhDq9SYBVEquhK
TLSH
T16F230196B7FA1558F6F72F6569B968944C3A7DD22C09E4EC01602C8E0932F90EDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcsdk_dpv3.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
Size 42KB
SHA256 efa5b84352bc0484fc0f15699003dd7abc9ceca0a926a034dca20369d34ad5c0
MD5 9480fa76ecefa541f66b9a1983f42b0d
SHA1 f519113e6aaf3fd2a9c02d952afe821309eee85b
SHA512 62b116067788e3a59f27a6d783ab828f9b2aa890d44a78b1ae7c66a3a3dd0988bd31dea5980ae27a053a09c542102981b10ed776115559fb9c3940377887d76b
SSDEEP 768:hfg6/bAFvHDB9SYBazRdBMITkO8NAXi2AQDbPNPLmAE:KAbAlHDB9SYBU1kO8Oj96
TLSH
T187131396BBF90558F6F72F6569B968944C7A7DD22C08E4EC01612C8E0932F90EDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\data\win-x64\cef_high\1\globalcache\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 235d6249d9fd54936a498c53ffd79ccb37021dec96cec314aa75867dad601790
MD5 cd2f0bf525a5abaa4f9234cb838c61c2
SHA1 08231c908c81e2ac2c87b43069d11649c4f55c2a
SHA512 76990f7ef125c02d8f415fd7af7a2f6838fb3600551aede059ac97036b5f62efb84573ed6a7345b78d72f31a3d7c01429080fbe3c7888c3d8649dc3861f291cf
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\data\win-x64\cef_high\1\globalcache\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\data\win-x64\cef_high\1\globalcache\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ab28842a-ed1f-41b3-a8e4-3bc0daafdfd1.tmp

Path C:\Users\Admin\Downloads\ab28842a-ed1f-41b3-a8e4-3bc0daafdfd1.tmp
Size 15KB
SHA256 7a24eed90e86433cc38fbd8273ff003d5a98633cea91698ec83c8246bfecef5c
MD5 80ad6a6a685b2a0b1ca82b1d3145db36
SHA1 698bb75c5498b2e5ea44696b50d29b85516cf363
SHA512 d46106c56d6bc82a7ce7de93a45220a662c825955b2771b412abd86277f2b1d528cec6b075eb6cdbe9b966c9485f4dd4c3bad6d289724331edf35e95285a7c77
SSDEEP 384:/4CIIIItrru7i2rnwR7i4SdY78RSnW9o/W+CFrK:/4CIIIICvjDoO+QrK
TLSH
T1D862D8056FF295B2F879FE35E2C2867C362E741242F41AEB94A6C8417D039C14E7B285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wps_wid.cid-1719612814.1793616304.exe.crdownload

Path C:\Users\Admin\Downloads\wps_wid.cid-1719612814.1793616304.exe.crdownload
Size 5.3MB
SHA256 41a17fe892d1066ad0d1ca22102d0d0ab57717bf1c8465f23d9e11c89f1893e8
MD5 cda8b76409b59ad373148f000088b4e3
SHA1 70e5a24262792cd3d86135e6ae05a0309a462128
SHA512 5005217f6e2a974967554f06945231f91a065e54465bd3c738bd7606b69cc6fa6f7e64724daf0b351fe5451bc908a472fa9f1cdd7f911ba0adaa16847f2885a9
SSDEEP 98304:0adhzWYtFg2KncTQfypmcaS9/Qci+THl9bs/GVk2J:TR3Qu7Qci0HltYGVk8
TLSH
T1D046B001B78AC5B1E59201B0197ABB7A487DBE285B3084C7E7D01D6A88316D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.wps_rw_test_1793616376133.tmp

Path C:\Users\Admin\WPS Cloud\.wps_rw_test_1793616376133.tmp
Size 19B
SHA256 c852b10799e8ea6f0e671e6f31badfdbd03ad4b5c1d50642e1d625dc89e1b910
MD5 fefe5fa40116430e6a662873a371bb30
SHA1 62987c2d466f89f59a3c6368ff7d9ff3979d1266
SHA512 7c3a13b0e8c5e41c72882340e64efe67a7140f3472aacc42a13927dd73d20165a1b39c7381d8c6a346e76643bf1adbf52fa13f8bd458c00d6b4cca9103c85800
MD5 SHA1 SHA512

Submit Download

memory/1632-792-0x00007FF88F720000-0x00007FF88FCAE000-memory.dmp

Download

memory/3348-10203-0x0000000002710000-0x0000000002730000-memory.dmp

Download

memory/5628-10219-0x00007FF86E840000-0x00007FF86E850000-memory.dmp

Download

memory/5628-10222-0x00007FF891340000-0x00007FF89155A000-memory.dmp

Download

memory/5628-10221-0x00007FF8894D0000-0x00007FF88A08C000-memory.dmp

Download

memory/5628-10223-0x00007FF888240000-0x00007FF8887CE000-memory.dmp

Download

memory/5628-10220-0x00007FF887130000-0x00007FF887BC9000-memory.dmp

Download

memory/5920-10227-0x00007FF6FBCF0000-0x00007FF6FC0B1000-memory.dmp

Download

memory/11748-9883-0x00007FF888240000-0x00007FF8887CE000-memory.dmp

Download

memory/11748-9880-0x00007FF88CF70000-0x00007FF88EAE5000-memory.dmp

Download

memory/11748-9882-0x00007FF891340000-0x00007FF89155A000-memory.dmp

Download

memory/11748-9884-0x00007FF882910000-0x00007FF88472B000-memory.dmp

Download

memory/11748-9879-0x00007FF6FBCF0000-0x00007FF6FC0B1000-memory.dmp

Download

memory/11748-9881-0x00007FF8894D0000-0x00007FF88A08C000-memory.dmp

Download

memory/11748-9885-0x00007FF887130000-0x00007FF887BC9000-memory.dmp

Download

memory/11888-9854-0x00007FF8894D0000-0x00007FF88A08C000-memory.dmp

Download

memory/11888-9852-0x00007FF6FBCF0000-0x00007FF6FC0B1000-memory.dmp

Download

memory/11888-9855-0x00007FF891340000-0x00007FF89155A000-memory.dmp

Download

memory/11888-9858-0x00007FF887130000-0x00007FF887BC9000-memory.dmp

Download

memory/11888-9856-0x00007FF888240000-0x00007FF8887CE000-memory.dmp

Download

memory/11888-9853-0x00007FF88CF70000-0x00007FF88EAE5000-memory.dmp

Download

memory/11888-9857-0x00007FF882910000-0x00007FF88472B000-memory.dmp

Download

memory/12152-9834-0x00007FF870480000-0x00007FF870490000-memory.dmp

Download

memory/12152-9824-0x00007FF882910000-0x00007FF88472B000-memory.dmp

Download

memory/12152-9819-0x00007FF6FBCF0000-0x00007FF6FC0B1000-memory.dmp

Download

memory/12152-9823-0x00007FF887130000-0x00007FF887BC9000-memory.dmp

Download

memory/12152-9821-0x00007FF888240000-0x00007FF8887CE000-memory.dmp

Download

memory/12152-9820-0x00007FF891340000-0x00007FF89155A000-memory.dmp

Download

memory/12152-9836-0x00007FF870480000-0x00007FF870490000-memory.dmp

Download

memory/12152-9835-0x00007FF870480000-0x00007FF870490000-memory.dmp

Download

memory/12152-9822-0x00007FF88CF70000-0x00007FF88EAE5000-memory.dmp

Download

memory/12152-9825-0x00007FF8894D0000-0x00007FF88A08C000-memory.dmp

Download

memory/12152-9833-0x00007FF870480000-0x00007FF870490000-memory.dmp

Download

memory/12152-9832-0x00007FF870480000-0x00007FF870490000-memory.dmp

Download

memory/12152-9831-0x00007FF870480000-0x00007FF870490000-memory.dmp

Download

memory/12152-9830-0x00007FF870480000-0x00007FF870490000-memory.dmp

Download

memory/12152-9829-0x00007FF870480000-0x00007FF870490000-memory.dmp

Download

memory/12152-9826-0x00007FF8707D0000-0x00007FF8707E0000-memory.dmp

Download

memory/12152-9827-0x00007FF870480000-0x00007FF870490000-memory.dmp

Download

memory/12152-9828-0x00007FF870480000-0x00007FF870490000-memory.dmp

Download

memory/12780-10047-0x00007FF8894D0000-0x00007FF88A08C000-memory.dmp

Download

memory/12780-10044-0x00007FF888240000-0x00007FF8887CE000-memory.dmp

Download

memory/12792-10045-0x00007FF888240000-0x00007FF8887CE000-memory.dmp

Download

memory/12792-10048-0x00007FF887130000-0x00007FF887BC9000-memory.dmp

Download

memory/12792-10041-0x00007FF88CF70000-0x00007FF88EAE5000-memory.dmp

Download

memory/12792-10042-0x00007FF8894D0000-0x00007FF88A08C000-memory.dmp

Download

memory/12792-10043-0x00007FF891340000-0x00007FF89155A000-memory.dmp

Download

memory/12792-10160-0x0000014F97000000-0x0000014F97143000-memory.dmp

Download

memory/12792-10046-0x00007FF882910000-0x00007FF88472B000-memory.dmp

Download

memory/12792-10040-0x00007FF6FBCF0000-0x00007FF6FC0B1000-memory.dmp

Download

memory/12832-10052-0x00007FF8894D0000-0x00007FF88A08C000-memory.dmp

Download

memory/12832-10049-0x00007FF6FBCF0000-0x00007FF6FC0B1000-memory.dmp

Download

memory/12832-10054-0x00007FF888240000-0x00007FF8887CE000-memory.dmp

Download

memory/12832-10051-0x00007FF88CF70000-0x00007FF88EAE5000-memory.dmp

Download

memory/12832-10055-0x00007FF882910000-0x00007FF88472B000-memory.dmp

Download

memory/12832-10057-0x00007FF887130000-0x00007FF887BC9000-memory.dmp

Download

memory/12832-10053-0x00007FF891340000-0x00007FF89155A000-memory.dmp

Download

memory/13836-10179-0x00007FF8894D0000-0x00007FF88A08C000-memory.dmp

Download

memory/13836-10176-0x00007FF888240000-0x00007FF8887CE000-memory.dmp

Download

memory/13836-10175-0x00007FF891340000-0x00007FF89155A000-memory.dmp

Download

memory/13836-10178-0x00007FF887130000-0x00007FF887BC9000-memory.dmp

Download

memory/13836-10171-0x00007FF88CF70000-0x00007FF88EAE5000-memory.dmp

Download

memory/13836-10177-0x00007FF882910000-0x00007FF88472B000-memory.dmp

Download

memory/13836-10170-0x00007FF6FBCF0000-0x00007FF6FC0B1000-memory.dmp

Download