privateloader | a824fc24df5520e0d33fadb77ba527711bfe74f1647df02d6bc20f7eb495b65e

Analysis

max time kernel
55s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wps_office_inst.exe
Size 5.3MB
Sample261111-w6wn2sbd73
SHA256 a824fc24df5520e0d33fadb77ba527711bfe74f1647df02d6bc20f7eb495b65e
MD5 0583c84e1fd8a2e59ffe14f49805e6d2
SHA1 81ca2b8418239d80a7d7052e0f77bb96d70f8787
SHA512 1c7e3861ec3d20cafe8ee5e92d0f9ba8411cb4a8ef2821c3e5899f4d5457fe1a38d2ee00c618a2d895ee55f30f7065d49eb7c276d4df291300b17847212d24f5
SSDEEP 98304:1TokqTTe4T5LbbyBNDxJgHObQtdnxNaznXhjlD/bmc:2kqGkJbWBcRxNcXhRzb1
TLSH
T13546AF01FB8AC5B1E59201B0197AAB7A487DAE285B3084C7E7D01D6E84316D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery privateloader loader persistence spyware trojan

Malware Config

Signatures

Family: PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	119.29.29.29
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	223.5.5.5
Destination IP	223.6.6.6

Writes a Windows system DLL name to a user directory 2 TTPs 1 IoCs

A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

defense_evasion

DLL Search Order Hijacking

T1574.001

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\office6\dbghelp.dll	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1356	ksomisc.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
File opened for modification	\??\PhysicalDrive0	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
File opened for modification	\??\PhysicalDrive0	wps_office_inst.exe

Executes dropped EXE 2 IoCs

pid	Process
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
4872	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe

Loads dropped DLL 15 IoCs

pid	Process
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wps_office_inst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wps_office_inst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wps_office_inst.exe

Modifies system certificate store 2 TTPs 40 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\OemEsim	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\TrustedDevices	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\FlightRoot	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\TestSignRoot	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	wps_office_inst.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2452	wps_office_inst.exe
2452	wps_office_inst.exe
2452	wps_office_inst.exe
2452	wps_office_inst.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
4872	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
4872	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
4872	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
4872	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
4872	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
4872	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
4872	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
4872	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
4872	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
4872	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
4872	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
4872	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5360	5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 5360	2452	wps_office_inst.exe	90

C:\Users\Admin\AppData\Local\Temp\wps_office_inst.exe
"C:\Users\Admin\AppData\Local\Temp\wps_office_inst.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2452
- C:\ProgramData\WPS\Installers\5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
  "C:\ProgramData\WPS\Installers\5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -installMsoAddin -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
  2⤵
  - Writes a Windows system DLL name to a user directory
  - Writes to the Master Boot Record (MBR)
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5360
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\ksomisc.exe" -installregister sharedMemory_message_E5A9F6E
    3⤵
    PID:3904
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\kwpsshellext64.dll"
      4⤵
      PID:3304
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\qingshellext64.dll"
      4⤵
      PID:2288
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\pdfwspv\pdfwspv.dll"
      4⤵
      PID:5484
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*install "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\qingnse64.dll"
      4⤵
      PID:2232
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*thumbnail "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\qingnse64.dll"
      4⤵
      PID:3344
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\pdfwspv\pdfwspv.dll"
      4⤵
      PID:1676
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*drivebho "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\qingnse64.dll"
      4⤵
      PID:5908
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\pdfwspv\pdfwspv.dll"
      4⤵
      PID:3380
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\ksomisc.exe" -checkInstallEnvironment
    3⤵
    PID:624
- - C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
    "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService
    3⤵
    PID:1396
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\wpsoffice.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\wpsoffice.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=klangmanager -dll_name=klangmanager.dll downloadlang en_US
    3⤵
    PID:2640
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\ksomisc.exe" -sendinstalldyn 5
    3⤵
    PID:5496
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\kwinappinstaller.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\kwinappinstaller.exe" -i "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\menuext" wpsappext1 wpsappext2 wpsappext3
    3⤵
    PID:2296
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\kvprinter\Kvpins64.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\kvprinter\Kvpins64.exe" /i "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\kvprinter\Kvpins64.inf" /s
    3⤵
    PID:2780

C:\ProgramData\WPS\Installers\5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe
"C:\ProgramData\WPS\Installers\5d232e4fbf30af4940138a67f6bf22e3_Personal_Office_i18n_Free.exe.601.1402.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -installMsoAddin -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5A0541 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\
1⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4872
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode -source=1
  2⤵
  - Network Service Discovery
  PID:1356
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk" 5386
    3⤵
    PID:1400
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\wtoolex\wpsupdate.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\wtoolex\wpsupdate.exe" /from:setup
  2⤵
  PID:3536
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\ksomisc.exe" -collectfileassoinfo -module=1;2;4;8;262144;524288;1048576 -daily -source=1
    3⤵
    PID:1976
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\wtoolex\wpsupdate.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\wtoolex\wpsupdate.exe" -createtask
  2⤵
  PID:5860
- C:\Windows\system32\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\kdesktopshellext\kdesktopshellext.dll"
  2⤵
  PID:2404
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\kdesktopshellext\kdesktopshellext.dll"
    3⤵
    PID:1200
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\ksomisc.exe" -regyunpanfornew -forceperusermode
  2⤵
  PID:5564
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\qingnse64.dll"
    3⤵
    PID:936
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:overlayicon "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\qingnse64.dll"
    3⤵
    PID:3344
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\qingnse64.dll"
    3⤵
    PID:5692
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\qingnse64.dll"
    3⤵
    PID:3060

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\ksomisc.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\ksomisc.exe" -installregister sharedMemory_message_E5ADFB3 -forceperusermode
1⤵
PID:1808
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\wps.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\wps.exe" Run "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\ktaskschdtool\ktaskschdtool.dll" /task=wpsexternal /createtask
  2⤵
  PID:2352
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\wps.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\wps.exe" CheckService
    3⤵
    PID:4328
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\wps.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\wps.exe" Run -User=Admin -Entry=EntryPoint "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29681/office6/addons/ktaskschdtool/ktaskschdtool.dll" /user=Admin /task=wpsexternal /cleantask /pid=2352 /prv
    3⤵
    PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2192

C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
1⤵
PID:3680

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"
1⤵
PID:5364
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\wps.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\wps.exe"
  2⤵
  PID:2492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Defense Evasion

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KingsoftUE.ttf

Path C:\ProgramData\kingsoft\office6\KingsoftUE\KingsoftUE.ttf
Size 3KB
SHA256 5ba32010d320d8fa6da72457393921985d04bc80e096f74d896244d6f2902a38
MD5 8d3a73edfaed94dd808169b04c32651a
SHA1 32282154a5bb57e3b3234bbe3935c576b858295c
SHA512 498ee21b9829e968b174eb5b59bd94deb005d654101eb63df3c81dd483a4c8e60ccc606250c93b0c0b0b56285e30d781d06f785564131bdd1ae080455ce1ac86
TLSH
T1F161B70D87B22D1EF6FBAA7430E697009E31B9215E33D34F3284D15B55158E08C99FBA
MD5 SHA1 SHA512 TLSH

Submit Download

WPSLingXiuHei.ttf

Path C:\ProgramData\kingsoft\office6\lingxiu\WPSLingXiuHei.ttf
Size 3.8MB
SHA256 2d04233c26361dcb102d388732aca6500169a3d64b12be3e8e3225d2f7f8cb5d
MD5 97df1209093f54f408eb8ef1397bebaf
SHA1 ca8971b1793d649f31de68889ab1a1411d55f078
SHA512 98bc7bd143f2a416d8ecf3dfd843656750f07b27b659f86cc0b6e7d7c2eb280eeb0620715869108a924b5c107a032bd97bad7d37db2583d24a7f203b7b9f0703
SSDEEP 49152:S7V0EgygB3vFr+m5V/pl/gCpfyIvl5b6dwl2:m01zJfyF
TLSH
T1DA062907D7B97916DA1CE325D2D6618700FB3501DF7C52E8BE43A0AEB09E5C5E89EE08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DejaVuMathTeXGyre.ttf

Path C:\ProgramData\kingsoft\office6\omath\DejaVuMathTeXGyre.ttf
Size 564KB
SHA256 40da67c0b6b03076504fbda4bf3e7b4f20b35999c98063019a3392fe9b1294fe
MD5 cbb215ab5974102cfbf2ddf6cde75b7e
SHA1 12c8c32bccb00ffa9115554ec9d90fd4ba490e45
SHA512 fc331f08f17b41209431aa814fb55010668658e4bd5c292007b8e3cd58bdb539ccb92cd0c2b156ab67170b5a5a2ab23810140f41c84135d5d9f250853386d278
SSDEEP 12288:rR03jc5J4IuAd80bQIgU57jFJOo0NdtI8jBb6PVPPTPPP8KbFQv//M//q///TzhS:rmjK4IuAd8zirOOKvK
TLSH
T1E3C46D4883ADAF5DEA2F76398817C387A1EAF631F5254317EF467C1C91861E848CE8D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 5f1a19b878f128f589a60c29fe9d02ff3358b088f3aaec07e0bf75d2508d4102
MD5 0e3d124c1a6b2569dd688ebd0ddbf00b
SHA1 2b2eba7c4fe802b02b4ae0db75fb4093f12bb34b
SHA512 e8f14fbf5bb2b629faddd359c6570e7e470f1604cae56e4423b94fd67cd933b18358668b156882cde050613761463f67d269ba5f5015a79f5b41d176ee9ec117
TLSH
T183F0DC932CAE34E64817980C0A6A893830F054A904D2C9AA3936CAE1D5EE7E2B257506
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 727B
SHA256 3da39f4e945a155fcd7fd922ef6cde7fb75de5581409054fdaa0c1e696e4a378
MD5 4c39fc1afb848f5064fb95537f62f207
SHA1 f088f7bd1a84ac26ebb0fe48fc947685f20c30dd
SHA512 05903da2b5f31db4c782db5b86d0cf23a9319e5b2b1a1b4b5748f232007c3b2c5c89b6ccb97237218d5d81a352b1e15290f6fb5ca75d1f40baeb540e4d0350fc
TLSH
T14E01946EEE3BF506ADA40C6E933E8AAE7172D26018D444CF3139468B524871F1E08AF4
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 c74acbd1a7fd16949c520cb85563c16b42465d7ac257cda8b05fa0ebdffea2ca
MD5 1e6d07fb29a2f11918322d77cccdd6a3
SHA1 569b6a3ee95a4d9d3e411317504e8847f78d461d
SHA512 92b744595e84aa05f2593e63a3fe913745e85aca4733853963e153507523c2b028b8e6092be07f63b1eaa81e736cac4c735ea360faf81b3904c2db3d6ebab5ab
TLSH
T1720199875CD9DBC0F7101400D50CA2F5ABF410653291C7E071720AD330BEFBA5627560
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 abf8b9e442285749b9037bd8a12395ed856d8f9439ba5e3dbf0113b16bb5a233
MD5 a5ad435c12b40747e319b719084542df
SHA1 ac426fadf1c0353a03180b4ed8572c15f33cba62
SHA512 89b9b66cc0911ac65fce57e3b3121190bcc25e1cf3a40f3e13d4bcc685630cae4b86a1a260d5b7b0c0ddf5ce47b292e353f4e4c878660cd597023f1de4c793ba
TLSH
T1D1E0202427FF111FF1B4977543D5D09A9F29F1023D4457FE0DD1151D691A9004CA2D70
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 404B
SHA256 a0b647112e8b7f01b3519489af8f3759ebe8b73eea2dc2a4914f0963b1ee0d0a
MD5 c6b71df0982f6bd8eac675e5ae46fc99
SHA1 4a2ab89dab04bb87b9398bc3bb1a4060d6272497
SHA512 76af445da112f85e5134ee68f27bcd14887af6d605301240ee4823d73eb51071a9f9364967fec104e223ebddff05e4c97004097b7cee5c1837a3d25fe1a9cb30
TLSH
T1ECE0263421FD4D5EF1F8E57443E6E8324D99F90B1945CAAA1594330AEA26E408CB2634
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 a85a2fa0fef2481facf70528fcc591fdbb3953a86df664bacd5ad8193e3af1bd
MD5 a2e399703d10c0ba8b6ef1cdc891175e
SHA1 1673e4325da7f0617a1662013297fa02ee00ddc1
SHA512 4c334c5470e3a542d2f3050eb1dbc1bd5beac9e19792e8d49b1e54678a8c4c4477f2a7360912a5dc2d9a5c36d7017255442623a378b69241bd6cde780601e02c
TLSH
T10CE0D82855EF655EF050993546E6A1761D49E2162444D77916905308B71BE00AD10AF0
MD5 SHA1 SHA512 TLSH

Submit Download

Qt5NetworkKso.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\Qt5NetworkKso.dll
Size 1.4MB
SHA256 2a6c6b147a6faf2a94ee0112ee2de2dc9637eecab89f104a833bbcd422d57ae8
MD5 193314ee16363e2f403bf99f4e483b7e
SHA1 d3ac69a6b11f11ada743cc50b68e0ce9c6a7a9a8
SHA512 4a2f04718f78438b4b36f7b7a3bf16a7af350976dd7a5746f00edb6710e5ebe982ad9455e4b8b4031dc899a4ddc64419eb88113061b90c7a972e2c920a763a71
SSDEEP 24576:ckjpQCCRXGAEOBWwrUh/95SlVF+UdByuET+JVQzqBg9FZ:jzCRWAEIJoh/iDVDy5T+JVSqBAFZ
TLSH
T141655A53F7554399D62AD139CA878902F272740083A75BEF2679DB192F337E2263E381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\cef\icudtl.dat
Size 10.0MB
SHA256 cb73d42d36839708013393ad0e4e932fdda9a1acda9275ecdbe74fe89eea8366
MD5 6690f2b2384e1bf8961fda96a4d07691
SHA1 111f6dd9833c653908431621fe8fbc87f1135632
SHA512 6a5242fdc0ba09e339151feae1b3f7a9f00a09288b6f4ea9305d1a09d8bc3015c074ee91de35b8d6fc765c2fb55ec37dd91b8e66b7a7bb3148cbc305de19b088
SSDEEP 196608:GTzwSv9AAyM0agliXUxCGZHa93Whlw6ZRiZ/:GoKlyMqliXUxCGZHa93Whlw6ZRiZ
TLSH
T1D3B62907A2FB4EC2F9F7AF30D9F152679467BD496E31805A11442F3B1C337A08661BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\cef\v8_context_snapshot.bin
Size 716KB
SHA256 5de9d535d8111f0b4c45b975c9862824c2391e0b64849b8c4ad2e41f0da6271a
MD5 bb0b157ad9835a33e6dae1b09f1648f6
SHA1 77c97e107e3ebacd1a8a6e8c0e9fb0a70fc8c134
SHA512 9cdaf5368a22014f6535946278203bb035e2b3b8a076a729e9021a036b3793e81462fc507917f84324e4867a6caad93edb578c2c7be7917a15226286a647f93a
SSDEEP 12288:oWT3WzmqO8SkcDZBvQUGAvScMEk5vFl7M:oWDWzvSBDZBvQUGAvScMH59lY
TLSH
T1A2F48435F701CA67EB174DFE1EDAC5487572F604AF8205AF71A98B4E60ABB541CB02E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything-KingSoft-CloudSearch.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\everythingsearch\everythingbinary\Everything-KingSoft-CloudSearch.ini
Size 137B
SHA256 0b31f4968bb116b987151c0fb7e4d8b3efd20cfcad808f834862ce3bfb7372f7
MD5 dd3630fa1cbd1b32ace16c8fb22f600e
SHA1 1c7ca2dfc3bbd7baac8dfccc6e8364b05e0b1b63
SHA512 ad16bea8893342ecc3b287c51cdb197006f1103e0662e50441149dbe2d4d7c78f9faf84cfd8f1997cc0b9af9188330ccc50fdb1f14efcc7eda96f93577562659
TLSH
T1F3C02B4182898410B39140718E82092A078001B84BEC077D030B4045A274A6CF730814
MD5 SHA1 SHA512 TLSH

Submit Download

Everything-KingSoft-wpsdesktop.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\everythingsearch\everythingbinary\Everything-KingSoft-wpsdesktop.ini
Size 104B
SHA256 60791d7a764fa47434e3c25ae6a20703d4f7b3540496da9028e2fc0e5b073f3a
MD5 d9d0b698e8bd1c6d3a1438052880ff7e
SHA1 f4736b7d86e8f4e5bf9797f0ed03f2b355debe0a
SHA512 54400671266c74800568c28f91d4b494f2f588673d9429ed0b5191db27f1fab442152065e0a57c7480d923651b4d3560c0d1b914c54331630605d44047249680
TLSH
T10DB012D587D5C460F3834171DF5601390B0015B88F8C1B3E070B001752A991CF730C15
MD5 SHA1 SHA512 TLSH

Submit Download

Everything.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\everythingsearch\everythingbinary\Everything.exe
Size 2.2MB
SHA256 f191f756996a14a11e5445fa7103d302efd510cf2fbf920e6c0c8ed51d512e36
MD5 464df9e59802fb4d6f4a0c743a5ded94
SHA1 2aaa17b0aceb7d017c47ea0110de97e29d920ace
SHA512 b95bba8a61f316d30d031ca2ad2307b2a42c89afb1f96edb03231a50120dd33700ee221e010b81242aee4427ac26c3d203c86562f0bdfa1b7662b9cd367768ec
SSDEEP 49152:/ota7/dTkNnVxSOEad3Gw6ffub5ro1FcyPiPRr4rAF:/oCGnF3l6uUmsW
TLSH
T15AB57E43933500E9E9ABC03689569623E7B1F4144732A7EF5690EEB12F237F15A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\kappessframework\mui\default\html_unified\run.ini
Size 171B
SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
MD5 b30cb271e143eace0f55ea2e562e1e9f
SHA1 9d97dbf24931cfc114384c3f4dbbae21c9e51be5
SHA512 dc593185fa63b458024c3a913c558e5686806154181dea67eec786ada50595c53bab822833ad1e76c9acdf21be3eba50631391b7e575d7f1f6409ceccf966535
TLSH
T1AAC080D4D0256F97DC31C6B5ED54AF1A7560E700251C1EC3D530DC4E9E9696551C805D
MD5 SHA1 SHA512 TLSH

Submit Download

error-net-72.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\kdocercore\mui\zh_CN\res\web\common\img\error-net-72.png
Size 1KB
SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
MD5 66726a0fbd424ccb700cecb212a47007
SHA1 9795ae26acf0b942ab6a0cd06f206ba69eda18db
SHA512 30ddd2fa17517792a86bdb03827a0809ed362ab2dbd9a7baf194d1f47348c96e0ca8e64515c1a58d7a1740e85f53a3676b49ff6c699d598a27c234c14672604f
TLSH
T1E031C6CD318AC42FCC61D531F4D534156817D760BF928C74102BC5576E0F68E58C6662
MD5 SHA1 SHA512 TLSH

Submit Download

theme_template_download_close.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\kdocercore\mui\zh_CN\res\web\common\img\theme_template_download_close.png
Size 1KB
SHA256 16a8f8609355a2ece290608c88b6275a9177a941a72ba614ad3e61d8b47ddbe6
MD5 e04531d270f67e9fc7982a6dda7b22ba
SHA1 fba7a8d716e80ff2213ffda76ae9dae973e731b3
SHA512 1cb4d61158f303fce074d04e14cd303df21c3ff2f8cafe7f019b0e4cf4280f0e9b823147edc0867541bcefc265c41a20f865e85cdd2c81465f7d1f22f361ccf4
TLSH
T1B311E9706E75BA1AC075CD1791D247ACABA1383009F4E20D6ADE443F11670FC0E3E081
MD5 SHA1 SHA512 TLSH

Submit Download

blank_official.docx

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\knewdocs\res\blanktemplate\blank_official.docx
Size 9KB
SHA256 2fc893a709273f3e26158cb42a3dff551fbd9929c13ff8b385ba3974dbd72c56
MD5 ca02de340022ca62e81500c3c0c35ad7
SHA1 ddd96189084bfae0b6530c9924efd258640ffd75
SHA512 6987ded12a861e025cff0a80f0368c405e54fba45ff972c21c0ebf9812e33ffa210a44eae06a90892aed456a94752a6227281e473aaaff6df39b4eccaf4423b5
SSDEEP 192:usvAMNEJrodJP75RrEaeLvDJgOts4Kfa4L5l2Sd8SQDHxaGt:usIiarQrRQVHts4KF5lqvaC
TLSH
T1D7227B25C10A6439D20276FD33190789D3B97A72A653F6123E1E23FC0A025BD0367C4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

normal.pptx

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\knewdocs\res\blanktemplate\normal.pptx
Size 54KB
SHA256 89689ea3a75e37c3bc3d10d0057074fbeed49261b6afa8887825bde5d5330fba
MD5 fb8eefb2958561a14e46c51bc6ba83d0
SHA1 2579bd8a6c0f5f8efbb160a61feaf602764c9437
SHA512 ba5293bc7499eed2f45645e6052981d45da263aa745d327be089dab4660c16e608611c83217cb320b9bf145aa48612d8d692093d633c37a55799893b3095e370
SSDEEP 768:lvKbmF4JeigqU36xM5amVRTjAsnlHUQ8GhfQ/DrRa/Cim5ML2h+gJOvwwKRl2E6e:4eHIMZXIoKWCiQ3
TLSH
T1FB435B2049E90A3FCD7320F4E2D92606577EF131070AB7A76CD4416AD826ABD5ECBB1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\kpdfaigcbox\res\dist\index.html
Size 636B
SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
MD5 72cdeca808b16e794ec5b66bd02246bf
SHA1 e75b6c4e084efc8e60c9e4fbe9e9ae02bfbf4132
SHA512 6562ed498bae7f819caa5ebff9ba373b1bbeae3c92befacbc44a72419e6a3aedeee7fe43347d1bf8c46b9c90c8e515181a6dc50c4ad954a640cf6b2520269ed8
TLSH
T1E5F002EA3C25F055CB911EA43DF2F19E245E3AB29DB9DE942AF4513543C03694D0BF48
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\kpdfaigcbox\res\dist\index.js
Size 2KB
SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
MD5 67dde682d1968824023dd9773f9ec48b
SHA1 81e0a21a7ba2c05193ecc13672a3f537539e0699
SHA512 86bccae3d66df4dd552c12a42d1ed0d57d6cdb7b904caa1f89c874e506fb76412b2df45e3e5f673837cb72aa18b0ab2c1dfb489b1da37068d83d7ccb25d3d8ea
TLSH
T1FD5173C9F79E702209EAE136583F0006E17735596098A1C8B87ED8F16EB555E7077F38
MD5 SHA1 SHA512 TLSH

Submit Download

kpluginrunner.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\kpluginrunner\kpluginrunner.dll
Size 352KB
SHA256 609ebc49057e62e92c6854ea94e47fbeef18a8d9e7b4c28ee9324441b296d4db
MD5 e4485aff20698fb7097124b2c0ec7a1d
SHA1 c9bbcd5e5119bebeb2004bdc87e79613a3f75778
SHA512 a7b12f8fd262071e4e40469c5827ccd039e498b5abb1241b2a0824045ca6587d1f5f103bae1446cc68a7558a9fbe022abe3d29960166a840164ca81cf4b884a7
SSDEEP 6144:XZqVSqucUTPn7/+9iSta+c7Ft2R3u+jGeIMi5UTJ6x2:XUV9ucUTfSEpt2R+rMfTA2
TLSH
T1DC745A5FE68547A9F137D138CA87CA02F6B334064362A6CF16298A352F377D9793A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo-small.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\kskincenter\ksolaunch\blackgold\logo-small.png
Size 17KB
SHA256 bff5b913e36537e76fbc239a4147eb2f4470e0a121e7bd66a71b24f345e311b0
MD5 5d28497f0d23c95bb82912311a0cccd4
SHA1 eb68a729edcf8a734b32a746b92f3821aa65b15e
SHA512 a99bf8149cb8cc947179a903ea9715f56dea9c8c1865a32155c655214e52cfd1487202d5c6c1cf49217b25098affff8c369322b491fd66c00430ad3301f010d5
SSDEEP 384:yBf/bfzFJfvaTuCEdDwwI8V1qe/6Wmzd9VIHKCeZ09729jvKZWh4pTgKJH:KzF9vaTdiwwI8n96z3CohiWepTg0
TLSH
T1F372CF43724ADA7F4DE41928799CA39CD408A8DC743F449ED403B0CA7A052B0B85EBBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\kskincenter\ksolaunch\blackgold\logo.png
Size 61KB
SHA256 8da39dd709d5f546e3d4ab6de6fb4c90b58e62902364da41baad9e6372d335a5
MD5 3b7d0551a9e9366946897e403b64a3ea
SHA1 0496f07c791528d68777aeef1c7d8ad2b42d108d
SHA512 9b0a2b590af27d2631b4a727f2125fecbaa1a404242f19af891af5e4d89313a5a9b5c9d8792581bf88b103b4327af2bd2dc8f07822299320005f6a3194e472c6
SSDEEP 1536:jhxhcv5/zMaGiGK6d7OcbjFUbM5BeuqJ4HH3/ufEN9XGFqUQ:jh3YVzxwKI7OcbJUEBTh3d9WQ
TLSH
T1E553F24986EC1B9EDED7545BC00426C03EDB6C80B9960B4D2A3D67A9D8C1DBA67FA130
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktaskpanelcopilot.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\ktaskpanelcopilot\mui\zh_TW\ktaskpanelcopilot.qm
Size 327B
SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
MD5 18770de3f96bac1e75e588015024fcf8
SHA1 e6254c054edef68f9c27059efd82eeaa69c863b5
SHA512 fcb76291a73d7f2e30f4266ea8f0dfa2d9e203cf9770fb7ffd73cc1994502992fabd0803224c1e1155c1e4b678b5af0e8b3aec114beb1f02299e8885d5a61d0a
MD5 SHA1 SHA512

Submit Download

IndexPage-c453f6ef.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\ktemplatepage\mui\default\kwebpcerrorpage\assets\IndexPage-c453f6ef.js
Size 144B
SHA256 6dc181d0b8f796944afec08717183a3956b1e2ecdefc6cefca020786c370db84
MD5 53cad8a957cee533e740e6c30d63bb01
SHA1 5a3f1729d259269ab9344606a4d233f699b638ff
SHA512 afabaca552da7923a1d7941b9e292cb525321b6bb24346600195516f5b9a4a13d99d70360aa5910a2ba5d30ed8d6ff1973298ac8e812253b66848136b7b64928
TLSH
T17FC02B6E1CD3C3F200110C8C08070402170A2DF803DA81E0C304533CF1360C2C40E110
MD5 SHA1 SHA512 TLSH

Submit Download

favicon.ico

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\kwebclouddrivesetting\entry\favicon.ico
Size 4KB
SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
MD5 1ba2ae710d927f13d483fd5d1e548c9b
SHA1 c0605efed936ee2600284e6480521d06fa64f872
SHA512 f933cd352eaba92f509b3863353ddfefadfada26a4152ecdc4727d450bbf35e7b10fb3038fe8db340d5c63d74e608c1560ec84d0f6ffc8ccd940c9e0d7533544
SSDEEP 48:i3H5R5hLOR4kt38PduMoglJrd6qTrp9hweFC0+6Ga:ipHFUs4MLBvuyCda
TLSH
T1EE9175DF61C388D9C1B1977F78C449A14F6FD951BA28351F55CF30622E5D75818C1C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webshapenotices.txt

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\kwebextensionlist\en_US\webshapenotices.txt
Size 279B
SHA256 a64c66198b34e1728de66a473a7d3fbc6b15335d80dd3fd961310f3457abed32
MD5 458e46631ae462a9711e32923f36171f
SHA1 5dd5d2d785b63689326d1f5cba9cca6257e8b1eb
SHA512 8c895895c659e83de21a01a3669d04e124125d43095ba20f51fbbdda7c20f2b7b3b9dddbac8833d998a5bb2a695c76de6230ed471039d1920eb3de998ee61462
TLSH
T16DD0C27B4269027942D10ADA2F26D6BAE62A510CB8E31302858FA4780E966984B438A0
MD5 SHA1 SHA512 TLSH

Submit Download

webshapenotices.txt

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\kwebextensionlist\ja_JP\webshapenotices.txt
Size 497B
SHA256 823052d26910d38e9600dd55237b700a9d029930daefbe32df94de34b274f89f
MD5 334a431351e5b8dae79075c8f1a6e374
SHA1 7971c403f242bdc444882bd14a68071aa4f501d0
SHA512 71e42c4538d51479c60f6c2192b8f8f11b88cd9d86b3487c61fef7eb779746610eadba3a1f3974d65a034980a7c3b45f72c60fbcfda031cc656b577f69092400
TLSH
T162F0277CD3606128155553227C8F30E4254AADD7EDA23176A53DC1773F201CED415BF0
MD5 SHA1 SHA512 TLSH

Submit Download

webshapenotices.txt

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\kwebextensionlist\zh_CN\webshapenotices.txt
Size 240B
SHA256 cb938d37bdd86d5080d644da14d30ce7c1831b15ca23127576154f8958f3137d
MD5 50d4a04b913169b435b3c1e2ea96f240
SHA1 1385fb5230739e6c8080398f02129457f0618037
SHA512 6e464fd7550a1b179d418992598b13b93019d9de47f33c256be5714503657857c6a63bafb24d961b1d59beba1381bb4c0c39974145add433a9386cab46d6361c
TLSH
T1E6D0A7BC48748CED01EC0876DBA307CC38C73BEA0222ED150F54480CB8AA92F80E442A
MD5 SHA1 SHA512 TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\kwebonlinetaskpane\run.ini
Size 226B
SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
MD5 abc3a6089b0ea76ffc960fbc9b6e66d1
SHA1 50ad0cb201c13799024de56cf45116cf65ff5569
SHA512 ec1e32b7bed882095b23e049a4e1a86acf0bf993e2f691105ffbd99d93ebf28faad4fbdd645ac1eefa74ede575854a3994c7c6d2bacc6f7a09a1991561b1a44b
TLSH
T157D09700C0B5658AC1254C827CA53DC411085B4B27608E02CCF0C34D508EBECE56B08A
MD5 SHA1 SHA512 TLSH

Submit Download

harmony_close.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\kweboptioncenter\entry\static\img\harmony_close.svg
Size 216B
SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
MD5 07306930f7d374663bd13e38ea0e92a1
SHA1 12f877e8ab93d874b55d75eef6747615619dad4f
SHA512 4cc0517ed0b9d665df4db93fb3093067e90f64b34f1d41420ed975b4cec64d4cc0aede64092d79c610c04e1ecd9514a9ef48389d5c157b5bcf698fc33670db98
TLSH
T1D8D0223BB3CC8E1CF9224A22F35A713580AF41C3548942E4D8322032E4011CEB93B6E8
MD5 SHA1 SHA512 TLSH

Submit Download

icons.data

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\kwppaiquoteppt\res\icons.data
Size 42B
SHA256 f364393b8eff5acd1beb05188cd48286b844cc950ac9e9ce354fae55bf63bba4
MD5 e1d82be3983f3381e094e84b452750f4
SHA1 7576ca74746fbc23af4c99e79b271dcfc3cb1dff
SHA512 d8e3a4659ca5356cdfc7a928b265043bf12da208bfe3820c841e34d12801ef181d52cd37ae06f4bd20d00070aae70893d112c0e21ef171de31cba57af16744f4
MD5 SHA1 SHA512

Submit Download

fail.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\officespace\mui\zh_CN\resource\usersecurecenter\fail.png
Size 4KB
SHA256 380b4e765b27129c1aad722d99295fb1db5dc91352087b7035b3443ebf150b43
MD5 aa92e4d3e5c0102eaee84a2a9b685e0f
SHA1 64db4b21bb95103f57d2fe698b76a7d087475056
SHA512 057b9a5705d5e70baa7eec977c179b474c28ec4d382b1312a38645c7ad82b0d5e53949192668d03e9c5d91a1c37b17a4f2077ec96f0aa1f532905e3167421260
SSDEEP 96:M/AhBsIJCuW3r80KOpSIpcr52h4y1xSkGI+HqaSbYfuDw:M43sEWr7vSIWr5S4uPaSeJ
TLSH
T123A16B80B9CAED7CD06F557715C8DAC88F0FDA1D078825815EC8C66C4C78C60B6FE5A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ferrPage_timeout.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\qing\mui\zh_CN\res\qingaccount\ferrPage_timeout.html
Size 7KB
SHA256 eb5dc549d839abd9dd7fb725629198959c7e5b0322454cf3c3bac89c57f53ca9
MD5 9b7a36d32ed674b3cb4d247d17b71794
SHA1 e756cff87d95360675b56b9ee4e2dd71bb96a852
SHA512 97520f64605b0f2690a03b1bf42eaae8b3d4b10c0925081ac250ed6bdba190d16368fafa0ec11783dd21177becc4d945acfbb327fdab32ff6350dc3155f58721
SSDEEP 96:9uMJIMzvOcuq4v+nB1W1QjjaKhwc3Rghfbtqm8bm83:9lTgVv+B1W1Q6ywc3RghfbEm8bm83
TLSH
T1D4F15115D69262066033A7B4DFA35719FB661023A3038A38BFDCA2558F75C499B53FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

element-icons.ttf

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\wpsbox\mui\default\html\folderselector\dist\static\fonts\element-icons.ttf
Size 54KB
SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
MD5 732389ded34cb9c52dd88271f1345af9
SHA1 8058fc55ef8432832d0b3033680c73702562de0f
SHA512 e8971ae48f5287d252f5b0a2d0516091bef0d2febf7d01fd7b435e426d106fea251037439ec42c2937e934b66f38e5eb43d00a213cdf334f482f4a06b1817f9c
SSDEEP 1536:qTIRCXXCwinqtuPM16hD2N3SUjbwaST4DCJe:39GEcgD2njb5ST4h
TLSH
T10A433B32436A9BE7F416047F5C1F55830A9F4F22F53DEA8B83A6192514162FD0864BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync-folder.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\wpsbox\mui\default\html\syncassistant\smarter\img\sync-folder.svg
Size 1KB
SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
MD5 c17417f321f52624ee0dc60ed76a31b6
SHA1 b64e19a5b03c92a931fa9a1eba899f491e669a1e
SHA512 bf160829598cf0b22ea48a5f7310adfbd26fbc1bbf23ea3cb8d9cebbeb92b5e81b914bd6021cd41df5984ef00698acb1c1151e134c714e0a1be7dcd439c78485
TLSH
T16D21F0ED57EE35C8644CD37028DA6079627B35F43969EF048914A9D1FE4205D499F9C0
MD5 SHA1 SHA512 TLSH

Submit Download

element-icons.woff

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\wpsbox\mui\default\html\wpsclouddisk\dist\static\fonts\element-icons.woff
Size 27KB
SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
MD5 535877f50039c0cb49a6196a5b7517cd
SHA1 0000c4e27d38f9f8bbe4e58b5ce2477e589507a7
SHA512 da269b20f13fb5b0bb4628b75ec29e69bb2d36999e94b61a846cb58db679287a13d0aa38cdf64b2893558d183c4cc5df8da770e5a5b2a3288622cd4bd0e1c87b
SSDEEP 768:gOvv6ExpCVxUtrT6w8ClFd80EjPVerMKBaGXjAlEm:Hvv6xVWewtlFdGjPlkFjAlEm
TLSH
T1B9C2E13197213AE9D9824EF876E498FEF1651402290F390E8696ADB3A98D5C73E16831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\yunbox\mui\default\html\cloudsettingsdlg\dist\static\css\chunk-vendors.css
Size 945B
SHA256 dcbbe47d67a84ca5330ae6addfc5f541b0888ab06b7555e0f29b3816df8758b3
MD5 5c6387a96512a512eb0da4d53ccab0f2
SHA1 d35c4202a12dd6383a00769d417d2af19a585b13
SHA512 ad8dba8e992e6bec07d2ca8093dd0d0031593bd3ade6c334f38b2e1f9b7dbc59bf285844599fab37cf8444e2e54c5e64283d4d9997dc59d7ca97713015ceaec9
TLSH
T161110266D6B0210DF4BBDC426BA1625A3300C5B358954BACE5183F74C9C726E077075D
MD5 SHA1 SHA512 TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\yunbox\mui\default\html\cloudsettingsdlg\dist\wps-i18n\chunk-vendors.js
Size 314KB
SHA256 5eeb347ded468ab8d168c51adbc559aaa0d5f33d4135b096293bde65499f015b
MD5 93fb24e9a371053b362589ecc937ab8d
SHA1 f2c891a82749f6ee732995f1ef611bdd9505d533
SHA512 1597457ba46e4303f00d9f8e85740afe2b5bd11b9c39e5533977a3b9926fa09bacf720c3639c0132ddf0e4055c46fe4ab4712ca78e16c72d743162903e7cc601
SSDEEP 3072:nmM3Ne7BFfXb+9pZHX0+xPT8N1JcXE+dBCD0K6xV02jQx+MjIWkvfl:nZN+b+RFPT8N1qEdYK6xVzH
TLSH
T1CA64E58DF2D6B0A517E731E4002F620BF2766958B88EC5D1E262E4D5AC7894E513BF3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\yunbox\mui\default\html\cloudsettingsdlg\dist\wps-i18n\en-us\index.js
Size 7KB
SHA256 f54d8fb11b54ed02402f0ea7c39e8e3f051140d828d39bc17957e6a05d72f03c
MD5 3c0df9379006d8cd49923b8567ef8669
SHA1 4b5fe6bac983b0a37e53a44c27d6001f61c41b8d
SHA512 6c36b9caf8121e09dcae2266c1eebdf505a5e2eeb213fcf3d33a2a9702c7b46fe23748e6556b435440dac86b883805980f997bb996a81895ece10d66418c6183
SSDEEP 96:6D7fPkc8tlq4zjJSgT9uuuRVtdztWFbr+BMkSvY7zc2hu4tdlquZIJ4BIQw+NXH+:6D7fotzYgw7lczQ3lz3q6IoIQwaG
TLSH
T1B2E1C82F260582751D6173C2FF0DABE2AA3A705D7351509998E9483C32B259EE2F74F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\yunbox\mui\default\html\cloudsettingsdlg\dist\wps-i18n\es-mx\index.js
Size 9KB
SHA256 bdbb2ee82e2847184dd14bce85e1dbb7941c4139ec437bca66d89287669428ae
MD5 dd3d9ccb33ec1a95156a8b75a371b800
SHA1 b4acbf863ad7bc2c4b0c15867831f85c5d4c687f
SHA512 a7d7a4737aef8939fdbf755927c3399009238447c55c0107b7a7d887ad4a2b4786c0ca3de757ec23145403b335e51aaa0a883af0a94180bdcc1c9bea260e9aa6
SSDEEP 192:NpXpWD7pfjdUCpIaxJH0Ui2zVhkkUUgptF5EFqnpZntnsOFr:NJkD7xWCuaxJH0Ungpj5EFqnpZntnJJ
TLSH
T11D12502EB3C01BB174D21784B942E6BBD0C419617C0DD2CAD9F5C2B911F8DCD8AB298A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\yunbox\mui\default\html\cloudsettingsdlg\dist\wps-i18n\ja-jp\index.js
Size 9KB
SHA256 8f3e93d42df0ada663d904486d895c30607b780ff7e2a135eb878aae1e33d226
MD5 b20289d274faab0e70a72d44bba7d49b
SHA1 f875be38f468260f9f1a588dff586acfa71536b6
SHA512 68f54084260c7f9f0ff69bf124a090e37623d125feba79f4caa01c6da3e3e992674a2916679541f16ef06bd3f53fe4d22185793c2f20d330d74794895996773f
SSDEEP 192:H1qpfa2VJgNZNPisiOBTUXBacOp2VJ1MVAb+Nox/h9ZgL9djOwOqk6UsMN8:HB2QgCBeBacOp2Z5b+ex/3WBdKBqk6UC
TLSH
T1B522303C83CA6A7A9C2542B20C0E75D635259C2AFD63BE3981ADE5742F50DDEE810DF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apm-init.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\yunbox\mui\default\html\settings\apm-init.js
Size 57B
SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
MD5 b684f2b8022aaa97ede28f9d224c4db5
SHA1 2087206ddbfd6d6d71f843a132b58ed533d87169
SHA512 8d30da66bfdd99dab88c4b9766b692c39ecbc8dd725e9f858c95993d4f2bf46c37891a1f8f4f1eb6fe09bed7008b8df48d2a9b4f10d7caf20f823f121f6ebb40
TLSH
T19F9002E7F0A1707344616959630722AA35D11130017430010900487434A580FCD22F88
MD5 SHA1 SHA512 TLSH

Submit Download

default_ava.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\yunbox\mui\default\html\settings\img\default_ava.svg
Size 906B
SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
MD5 c47a5cfed147c402538358294808e68a
SHA1 8aa499336bc4a50a70710735b67fc5da923fc61a
SHA512 a71831abb9393b6c0ad62feb29fefbb192e1706b08ab88dec0a8e6a9cf61b6a7e106454a7e6e518f69425cc91846036e8fe2956ea939625678f17b330860ba1b
TLSH
T15311E309934DC285960AD7B8563C1754347272DF9E1FD55CE7E633012D3C6AF185C27A
MD5 SHA1 SHA512 TLSH

Submit Download

loading.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\yunbox\mui\default\html\settings\img\loading.svg
Size 1KB
SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
MD5 0620393a949b58f6af37b0accb79e32c
SHA1 0025e4da5ffb8695a8f9731a05b1b89f1a71bf24
SHA512 0d308c758f825d548874cf8b4b8ec20f3685b39c7232246697dd95e5e5f40da7cd21de7ba5faafd0d8a121b5e6b85c5aadc4232e3f0c943535e062ae449ef29e
TLSH
T1333142D111BD0116E11AC365D7FD7AC70B3EB4DB26E558BCB68C250FAB404DB0A9B219
MD5 SHA1 SHA512 TLSH

Submit Download

weibo.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\yunbox\mui\default\html\settings\img\weibo.svg
Size 2KB
SHA256 13fe846f5d050decd03d9eef4f40e497995ad8b23e48a2f8eb339f97319f51bf
MD5 817f16b4919cc6a39e2efa836ab8fefa
SHA1 1e43cadbb17f104e50c227e861ef93bf2b1950cc
SHA512 fd333da359ff3c15f5c75c55b953bbef96f10122294bf9d0dfa6b7eb8c56cc487eacd0802f6774b7c8df40d05e7a54f089ab0731dce6044bc2124c27d8c67edb
TLSH
T16D4143FE2195A1D0D407ABA4DC37B452DA4E3CFA6FE853C88141EAA87B746D9CD48C10
MD5 SHA1 SHA512 TLSH

Submit Download

app.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\yunbox\mui\default\html\syncfolder\qing\static\css\app.css
Size 107KB
SHA256 907d1f5ee046fae72b52eaf99508ddb6b48d47b803076db0e9a86b0e21a54ba9
MD5 0ad676312c51d1b96bd08f056ab33496
SHA1 270438a06781cb68c376bc18c42437dd5ce262da
SHA512 6a6883f9fa0a1f768bf985340dc6cb4651e5ce691066c9597126ba1fc62b2a45a2eee52a1d8452faec885bbd3358be3fb04a15fbfca0302feaa1adc2c81130c3
SSDEEP 3072:KazzQ51KYGqMkYUl26MeCAAcdl6y7tqWD:mME/euD
TLSH
T15CB31B37214D132D343BDAA2E55D659960C8F61BC00253F9FA247B1DCA837873A7A3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\yunbox\mui\default\html\syncfolder\qing\static\css\chunk-vendors.css
Size 279KB
SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
MD5 a3964e72421a1ef5fb60c6e17eb5d705
SHA1 5dd9584be5141e884a230c48746e1c88126b0a55
SHA512 4ce4119b7407b460969041809354c4ede587047ee643f2897eb0ecb9627608431f43fed27c54c70bacff3a6694eb32a85b535c7d6397ac22d7d28e260b0a5467
SSDEEP 1536:39eSBQG+dyAUlHj/8D0Q+SPxZztR+LCrwHFfyqHYb3PPV7BYUOf0I79lDxiRSL2Q:3zfZYKVxiW
TLSH
T14054B6229140212E702BDE3DF7C4EA4AE225C6B3C4125BFEF953651DC7C36AA117778A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\yunbox\mui\default\html\syncfolder\qing\static\js\app.js
Size 381KB
SHA256 801a6171ec902a66db71f6fe5f0c9f9219de992111dadd53803ff9b4a400350d
MD5 d52b64bb35499b2ee123c241c279bc97
SHA1 6d4c704a224ad557ec5234147053c979d61f7870
SHA512 ea2c2aace1e59ab6fe429a0d964d0d3591cb302d903077aa2b2474fcaedf74de2f7114a24f52b29e4c1a830e6f73d21ddac643be7c958eb714ec782aa5968f8a
SSDEEP 6144:ZpK457wXrkaY0TbOXsEYlHBBs6Ve5NtXo4Ipgznl87A6v0eX4AiDuViQbgQgILTm:a4B0WtYl0iLlTj8QmIqU8NBqq
TLSH
T1D6846C4B758BBB5A1F35B66340DF3C88D01C6EC09812A5C9FABDD9D09144B9A32D63BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\yunbox\mui\default\html\syncfolder\qing\static\js\chunk-vendors.js
Size 249KB
SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
MD5 6351ea268f992f52e0f4418a7028b91d
SHA1 5bb3cb88465c550a1fd033a079a8b2eba5e071b8
SHA512 44940d07abfdee6403e9400e596ac5e5eb234ba77a1c90c2fe4086878c12f4805c709eb84538071f21d5710d3569d342e7caea10061e2ab2661c5117c5966297
SSDEEP 3072:p+Xy2rHhkiTtcsuaIwK3zqDLW/ix3Iu7doNFBWgz/bwUzxqcG7gLEOhA:phKHhklsi3zpCdoNFBHz/bwAfG7cW
TLSH
T10A44F8CDB2D1B0A517EB61B4813F610BF27B6499B44E80D0E226E5D4BC7998E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\yunbox\mui\default\html\syncfolder\qing\wps-i18n\chunk-vendors.js
Size 424KB
SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
MD5 cf29fba214e7f43f2ca1b629109d126b
SHA1 d0dda9486528586af6943abe7a3afa319c790f25
SHA512 2ad7e4711f5917b8d13f861d4fb2688e6ce3951da43a89263a2d9743199e173429398ec1a9537b1df25593d3999dd34fb590e2d2a6e7a632ccc44265d93c3bca
SSDEEP 6144:z8KzCOcC0CXWsJvRekr0dgei/zJbBoCF7az2bzNM:zbzCODTWsJvRbw6zJbBfaz2bC
TLSH
T13694198DB2C1B0A517EB60B4913F610BF23B6469B44E80D4F266E5E57C7898E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\yunbox\mui\default\html\syncfolder\qing\wps-i18n\en-us\index.js
Size 10KB
SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
MD5 0f4634d4af8b73f882440c1181697d86
SHA1 748bb9a14c8a6c64fa060ddcb1b4baebfb3f6fd3
SHA512 eeff081cb256a44ff4557dae145c3d277ad936fef58674cb7d2949b6c302c3a746f05495daa6ccabf39c26bacf13c6fee3bab20de4f1d13810be0503787c89d5
SSDEEP 192:cyxPpQcKb2d4U1nE92Ui6OPl20b3G0qE7I2ByobYGeBv+x9qkgYbeO:zzFZr6OddG0q/yTh3UYx
TLSH
T1AC32C887B30483755A90E790F6C76DA5A93ED0EE73A4168A3CEE421812581DEB3E7CC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\yunbox\mui\default\html\syncfolder\qing\wps-i18n\es-mx\index.js
Size 13KB
SHA256 dc85a5def9d68dcd2be1229fda33b501795b16f81c7c0f3f090beb565106b123
MD5 260aa1163189cb9e56f527009737180e
SHA1 70c931690839566880ec3de7fbca452ec312d6f8
SHA512 01254458cfcea45aa012e55b2f4edd234da9839604dc96890464c295acbb202ef517b6b15eaf0099dbc7cbbfeec944f231f76f93fb8d91689bedcc65b86b5270
SSDEEP 192:GwSuCUHXDhEblYfhQ9GYSOqUr9b1AARAU0qWo3wYXqMojXEjyaW:dCaXDhEK55YmUrLAgkqWo3RqhnF
TLSH
T1AD523199F3C60E22B4991749B903D57BF19598FAFC2CC18D5CF2D236136C9C98692CC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\yunbox\mui\default\html\syncfolder\qing\wps-i18n\ja-jp\index.js
Size 14KB
SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
MD5 5cee0947c1ef6f00e18eb17cf77388af
SHA1 5a27bc625acfb46d2368a9a376d797ecab912a3a
SHA512 1bf91f08d2a2a446ef0e22df40fd09b090fa300f599bacdd5c698aa61a6fef12ad3d3e38299804a016e5a22a82ddfeb6840cdc7a79ea51244942cb22e659331e
SSDEEP 384:HTO1ksU66rAJGO+NedvSGdv+GfBgLj95LKn:zO1ksU66rAJG5NedKGdv+GfyLj2n
TLSH
T11D6230ACC3CD5C69C86183FA090B35C27836ED49FEA5AE7280EDF4202DA19DFD815674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo_new_1.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\addons\yunbox\mui\default\html\transfer\img\logo_new_1.svg
Size 3KB
SHA256 7745db01242b975e980c02a5b5e21f86c3991842d14399af5b710e7042f6b133
MD5 05d802ce3149af594ca8ed90b552889e
SHA1 88b4b497d0519f690417e136525f040967e219e9
SHA512 0076d34b56672a00af4f4d0151021026076afd1f4f0dadfeaa023135eaa84bd67b6b5376e109884a8a6508b9eab32d90f1d1fe20ef2908ea87a495c198293f91
TLSH
T14D7100A9D70D587BC52AD3ECE6E4C056111F94E279F103BAE268DB0F1871BC7494EB21
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-console-l1-1-0.dll
Size 11KB
SHA256 2afbfa1d77969d0f4cee4547870355498d5c1da81d241e09556d0bd1d6230f8c
MD5 919e653868a3d9f0c9865941573025df
SHA1 eff2d4ff97e2b8d7ed0e456cb53b74199118a2e2
SHA512 6aec9d7767eb82ebc893ebd97d499debff8da130817b6bb4bcb5eb5de1b074898f87db4f6c48b50052d4f8a027b3a707cad9d7ed5837a6dd9b53642b8a168932
SSDEEP 192:4nWYhWxWWFYg7VWQ4uWjXUtpwBqnajrmaaGJ:2WYhWvZqlQGJ
TLSH
T186421A838EFC9543F9A66E701B99D9833C3DABD76910905925A8F19C2CC33D1EB0072D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-console-l1-2-0.dll
Size 11KB
SHA256 00942431c2d3193061c7f4dc340e8446bfdbf792a7489f60349299dff689c2f9
MD5 7676560d0e9bc1ee9502d2f920d2892f
SHA1 4a7a7a99900e41ff8a359ca85949acd828ddb068
SHA512 f1e8db9ad44cd1aa991b9ed0e000c58978eb60b3b7d9908b6eb78e8146e9e12590b0014fc4a97bc490ffe378c0bf59a6e02109bfd8a01c3b6d0d653a5b612d15
SSDEEP 192:iTWYhWyWWFYg7VWQ4uWq6Cu87ZqnajgnLSyu:sWYhWi1XHllk2yu
TLSH
T15B423A93CEFC9543F5A6AD704699D9833C3CABCB2910916536A8F19D2CD33D1EB00A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-datetime-l1-1-0.dll
Size 11KB
SHA256 77577f35d3a61217ea70f21398e178f8749455689db52a2b35a85f9b54c79638
MD5 ac51e3459e8fce2a646a6ad4a2e220b9
SHA1 60cf810b7ad8f460d0b8783ce5e5bbcd61c82f1a
SHA512 6239240d4f4fa64fc771370fb25a16269f91a59a81a99a6a021b8f57ca93d6bb3b3fcecc8dede0ef7914652a2c85d84d774f13a4143536a3f986487a776a2eae
SSDEEP 192:5WYhWYWWFYg7VWQ4SWSS/njxceXqnajLJ35H:5WYhW4gjmAlnJpH
TLSH
T1FE322A838BBC4503FEA32EB042A9D9937D3D67D62A10C12A05B5F1682C937D1EB14B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-debug-l1-1-0.dll
Size 11KB
SHA256 45e48320abe6e3c6079f3f6b84636920a367989a88f9ba6847f88c210d972cf1
MD5 b0e0678ddc403effc7cdc69ae6d641fb
SHA1 c1a4ce4ded47740d3518cd1ff9e9ce277d959335
SHA512 2badf761a0614d09a60d0abb6289ebcbfa3bf69425640eb8494571afd569c8695ae20130aac0e1025e8739d76a9bff2efc9b4358b49efe162b2773be9c3e2ad4
SSDEEP 192:4WYhWFsWWFYg7VWQ4eWZzAR/BVrqnajcJH:4WYhWFMJRLlA5
TLSH
T1E9321B828BFC9103F9A7AFB053D9D9933C3DA7C72910916605A9F45D2CD37D1AB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-errorhandling-l1-1-0.dll
Size 11KB
SHA256 accdd7455fb6d02fe298b987ad412e00d0b8e6f5fb10b52826367e7358ae1187
MD5 94788729c9e7b9c888f4e323a27ab548
SHA1 b0ba0c4cf1d8b2b94532aa1880310f28e87756ec
SHA512 ab65495b1d0dd261f2669e04dc18a8da8f837b9ac622fc69fde271ff5e6aa958b1544edd8988f017d3dd83454756812c927a7702b1ed71247e506530a11f21c6
SSDEEP 192:imxD3vEWYhWnWWFYg7VWQ4eWMOwNbDXbBqnaj0qJm8:iIEWYhWFpLbBlwqJm
TLSH
T146321A928BFC8043F9E76E7017A5D9837C3D77D7295081A506A8F1A92C933D1EF11A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-file-l1-1-0.dll
Size 14KB
SHA256 7cb0396229c3da434482a5ef929d3a2c392791712242c9693f06baa78948ef66
MD5 580d9ea2308fc2d2d2054a79ea63227c
SHA1 04b3f21cbba6d59a61cd839ae3192ea111856f65
SHA512 97c1d3f4f9add03f21c6b3517e1d88d1bf9a8733d7bdca1aecba9e238d58ff35780c4d865461cc7cd29e9480b3b3b60864abb664dcdc6f691383d0b281c33369
SSDEEP 192:+AuVYPvVX8rFTsRWYhWyWWFYg7VWQ4eWQBAW+JSdqnajeMoLR9au:TBPvVXLWYhWiBdlaLFAu
TLSH
T1E962E853D9B4F25BF98FAE315192D843683852C7042541C91BD8A7AD3CE73C5E3D8A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-file-l1-2-0.dll
Size 11KB
SHA256 7a3c5167731238cf262f749aa46ab3bfb2ae1b22191b76e28e1d7499d28c24b7
MD5 35bc1f1c6fbccec7eb8819178ef67664
SHA1 bbcad0148ff008e984a75937aaddf1ef6fda5e0c
SHA512 9ab9b5b12215e57af5b3c588ed5003d978071dc591ed18c78c4563381a132edb7b2c508a8b75b4f1ed8823118d23c88eda453cd4b42b9020463416f8f6832a3d
SSDEEP 192:dzWYhW1sWWFYg7VWQ4yWL3sQlmqnajlD4h1N:BWYhW2e6l94h1N
TLSH
T111323B928BBC4143F9D66E7053E8D9877C3DA3DB2E60815905A9F09D2C837D1EB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-file-l2-1-0.dll
Size 11KB
SHA256 349a79fa1572e3538dfbb942610d8c47d03e8a41b98897bc02ec7e897d05237e
MD5 3bf4406de02aa148f460e5d709f4f67d
SHA1 89b28107c39bb216da00507ffd8adb7838d883f6
SHA512 5ff6e8ad602d9e31ac88e06a6fbb54303c57d011c388f46d957aee8cd3b7d7cced8b6bfa821ff347ade62f7359acb1fba9ee181527f349c03d295bdb74efbace
SSDEEP 192:/VyWYhWjAWWFYg7VWQ4eWiuNwzNbDXbBqnaj0q:/VyWYhW8g+LbBlwq
TLSH
T1C5321AC2CBFC9403F9A76E705299D8877C3DA7C7291081690AA8F5AC2C973C0EB51E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-handle-l1-1-0.dll
Size 11KB
SHA256 c78a1217f8dcb157d1a66b80348da48ebdbbedcea1d487fc393191c05aad476d
MD5 bbafa10627af6dfae5ed6e4aeae57b2a
SHA1 3094832b393416f212db9107add80a6e93a37947
SHA512 d5fcba2314ffe7ff6e8b350d65a2cdd99ca95ea36b71b861733bc1ed6b6bb4d85d4b1c4c4de2769fbf90d4100b343c250347d9ed1425f4a6c3fe6a20aed01f17
SSDEEP 192:P9RWYhWEWWFYg7VWQ4eWncTjxceXqnajLJS:LWYhWk3TjmAlnJS
TLSH
T1BC324DC2CBBC8003F9A76E7047A9D9937D3DA3DB2911816A05A9F1692C933C1DB10B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-heap-l1-1-0.dll
Size 11KB
SHA256 2e981ee04f35c0e0b7c58282b70dcc9fc0318f20f900607dae7a0d40b36e80af
MD5 3a4b6b36470bad66621542f6d0d153ab
SHA1 5005454ba8e13bac64189c7a8416ecc1e3834dc6
SHA512 84b00167abe67f6b58341045012723ef4839c1dfc0d8f7242370c4ad9fabbe4feefe73f9c6f7953eae30422e0e743dc62503a0e8f7449e11c5820f2dfca89294
SSDEEP 192:5t6DjZlTIWYhWsWWFYg7VWQ4eW4MtkR/BVrqnajc:5t6Dll0WYhWMqkRLlA
TLSH
T13E422A85CAEC9103F9676EB053D5D9873C3DB7C62510802615A8F19C2C937D1EB25B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-interlocked-l1-1-0.dll
Size 11KB
SHA256 b02324c49dd039fa889b4647331aa9ac65e5adc0cc06b26f9f086e2654ff9f08
MD5 a038716d7bbd490378b26642c0c18e94
SHA1 29cd67219b65339b637a1716a78221915ceb4370
SHA512 43cb12d715dda4dcdb131d99127417a71a16e4491bc2d5723f63a1c6dfabe578553bc9dc8cf8effae4a6be3e65422ec82079396e9a4d766bf91681bdbd7837b1
SSDEEP 192:nWYhWNWWFYg7VWQ4uWtGDlR/BVrqnajcU8:nWYhWLJDlRLlAU8
TLSH
T165321A828AFC5143FAB76E7042E4D9937C3DB7DB261091550AA8F49C2C877D1FB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-libraryloader-l1-1-0.dll
Size 12KB
SHA256 08484ed55e43584068c337281e2c577cf984bb504871b3156de11c7cc1eec38f
MD5 d75144fcb3897425a855a270331e38c9
SHA1 132c9ade61d574aa318e835eb78c4cccddefdea2
SHA512 295a6699529d6b173f686c9bbb412f38d646c66aab329eac4c36713fdd32a3728b9c929f9dcadde562f625fb80bc79026a52772141ad2080a0c9797305adff2e
SSDEEP 192:FvuBL3BBLZWYhWxWWFYg7VWQ4uW4g0jrQYcunYqnajv9Ml:FvuBL3BPWYhWv8jYulhMl
TLSH
T1A3422BC2CBAC9143F5E65E3042A5CC477C3963DB5960C46906ADE1A82CE33C0EB10B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-localization-l1-2-0.dll
Size 13KB
SHA256 059cb23fdcf4d80b92e3da29e9ef4c322edf6fba9a1837978fd983e9bdfc7413
MD5 8acb83d102dabd9a5017a94239a2b0c6
SHA1 9b43a40a7b498e02f96107e1524fe2f4112d36ae
SHA512 b7ecf60e20098ea509b76b1cc308a954a6ede8d836bf709790ce7d4bd1b85b84cf5f3aedf55af225d2d21fbd3065d01aa201dae6c131b8e1e3aa80ed6fc910a4
SSDEEP 384:NOMw3zdp3bwjGzue9/0jCRrndbwNWYhW6WAulh2:NOMwBprwjGzue9/0jCRrndbw5D
TLSH
T1CE520892C6E8D207F85DAD717167D9437C38A6C50822D95603F6FB2428E33C5E79172D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-memory-l1-1-0.dll
Size 11KB
SHA256 dadbd2204b015e81f94c537ac7a36cd39f82d7c366c193062210c7288baa19e3
MD5 808f1cb8f155e871a33d85510a360e9e
SHA1 c6251abff887789f1f4fc6b9d85705788379d149
SHA512 441f36ca196e1c773fadf17a0f64c2bbdc6af22b8756a4a576e6b8469b4267e942571a0ae81f4b2230b8de55702f2e1260e8d0afd5447f2ea52f467f4caa9bc6
SSDEEP 96:qo1aCFEWYhWwp/DEs39DHDs35FrsvYgmr0DD0ADEs3TDL2L4m2grMWaLNpDEs3OC:teWYhWVWWFYg7VWQ4yWwAKZRqnajl6x7
TLSH
T10E424B818BFCD503F5D72E708399CA977C3EA7C66DA0911902A9F1992CD33D1E710A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-namedpipe-l1-1-0.dll
Size 11KB
SHA256 b57e70798af248f91c8c46a3f3b2952effae92ca8ef9640c952467bc6726f363
MD5 cff476bb11cc50c41d8d3bf5183d07ec
SHA1 71e0036364fd49e3e535093e665f15e05a3bde8f
SHA512 7a87e4ee08169e9390d0dfe607e9a220dc7963f9b4c2cdc2f8c33d706e90dc405fbee00ddc4943794fb502d9882b21faae3486bc66b97348121ae665ae58b01c
SSDEEP 192:cWYhWZSWWFYg7VWQ4eWkcc7ZqnajgnLSp:cWYhW84cllk2p
TLSH
T1E7322B61C7AC8143F9AB6E7042D9D9933C3DA7CB2910C16556ADF9A92C837D0E730B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-processenvironment-l1-1-0.dll
Size 12KB
SHA256 aa415db99828f30a396cbd4e53c94096db89756c88a19d8564f0eed0674add43
MD5 f43286b695326fc0c20704f0eebfdea6
SHA1 3e0189d2a1968d7f54e721b1c8949487ef11b871
SHA512 6ead35348477a08f48a9deb94d26da5f4e4683e36f0a46117b078311235c8b9b40c17259c2671a90d1a210f73bf94c9c063404280ac5dd5c7f9971470beaf8b7
SSDEEP 192:qKWYhWbWWFYg7VWQ4eWYoWjxceXqnajLJe:qKWYhWJ4WjmAlnJe
TLSH
T1D14219C2CBBC5003FAD76D7042A9E4A77C3893E72D1080690564FA693C977D1EB94B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-processthreads-l1-1-0.dll
Size 13KB
SHA256 c9a686030e073975009f993485d362cc31c7f79b683def713e667d13e9605a14
MD5 e173f3ab46096482c4361378f6dcb261
SHA1 7922932d87d3e32ce708f071c02fb86d33562530
SHA512 3aafefd8a9d7b0c869d0c49e0c23086115fd550b7dc5c75a5b8a8620ad37f36a4c24d2bf269043d81a7448c351ff56cb518ec4e151960d4f6bd655c38aff547f
SSDEEP 192:AWXk1JzX9cKSIvWYhWLWWFYg7VWQ4SWW0uI7oinEqnajxMyqY:AWXk1JzNcKSIvWYhW5+uOEle6
TLSH
T1A1520AD5C6FC9183F88AAD306685D9533C3AD7C5192A813106E9F2E93DEB3C2D62462D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-processthreads-l1-1-1.dll
Size 11KB
SHA256 25a99bdf8bf4d16077dc30dd9ffef7bb5a2ceaf9afcee7cf52ad408355239d40
MD5 9c9b50b204fcb84265810ef1f3c5d70a
SHA1 0913ab720bd692abcdb18a2609df6a7f85d96db3
SHA512 ea2d22234e587ad9fa255d9f57907cc14327ead917fdede8b0a38516e7c7a08c4172349c8a7479ec55d1976a37e520628006f5c362f6a3ec76ec87978c4469cd
SSDEEP 192:NtxDfIeA6WYhW7WWFYg7VWQ4eWpB5ABzR/BVrqnajcb:NtxDfIeA6WYhWp28RLlA
TLSH
T17A422A929AFC9043F997AEB052D5E9533C3EB7C72621806515B4F16C2CD73C1EB11A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-profile-l1-1-0.dll
Size 10KB
SHA256 42f4e84073cf876bbab9dd42fd87124a4ba10bb0b59d2c3031cb2b2da7140594
MD5 0233f97324aaaa048f705d999244bc71
SHA1 5427d57d0354a103d4bb8b655c31e3189192fc6a
SHA512 8339f3c0d824204b541aecbd5ad0d72b35eaf6717c3f547e0fd945656bcb2d52e9bd645e14893b3f599ed8f2de6d3bcbebf3b23ed43203599af7afa5a4000311
SSDEEP 192:clIHyZ36WYhWulWWFYg7VWQ4yWqeQDbLtsQlmqnajlDC:clIHyZKWYhWKhlbp6l9C
TLSH
T111320992CBFC4043F5A36E7053D8DA837D3DA3DB6A6081190569F4AD1CC77D0AB6492E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 11KB
SHA256 02d987eba4a65509a2df8ed5dd0b1a0578966e624fcf5806614ece88a817499f
MD5 e1ba66696901cf9b456559861f92786e
SHA1 d28266c7ede971dc875360eb1f5ea8571693603e
SHA512 08638a0dd0fb6125f4ab56e35d707655f48ae1aa609004329a0e25c13d2e71cb3edb319726f10b8f6d70a99f1e0848b229a37a9ab5427bfee69cd890edfb89d2
SSDEEP 192:4GeVvXK9WYhW1WWFYg7VWQ4yWj6k50IsQlmqnajlDl:4GeVy9WYhWzVk6l9l
TLSH
T179422B968BBC5003F5A36E70139ACE8B7D3DA7D729A4812604A5F19D1CC33D4FB14A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-string-l1-1-0.dll
Size 11KB
SHA256 9447218cc4ab1a2c012629aaae8d1c8a428a99184b011bcc766792af5891e234
MD5 7a15b909b6b11a3be6458604b2ff6f5e
SHA1 0feb824d22b6beeb97bce58225688cb84ac809c7
SHA512 d01dd566ff906aad2379a46516e6d060855558c3027ce3b991056244a8edd09ce29eacec5ee70ceea326ded7fc2683ae04c87f0e189eba0e1d38c06685b743c9
SSDEEP 192:byMvQWYhW5fWWFYg7VWQ4eWio3gDwcunYqnajv9JS:byMvQWYhW/BXwulhw
TLSH
T17F321B82DBBC9003F9A36E704799ED877C3CABD72910826516A9F1942CD33C0EB14B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-synch-l1-1-0.dll
Size 13KB
SHA256 a31a15bed26232a178ba7ecb8c8aa9487c3287bb7909952fc06ed0d2c795db26
MD5 6c3fcd71a6a1a39eab3e5c2fd72172cd
SHA1 15b55097e54028d1466e46febca1dbb8dbefea4f
SHA512 ef1c14965e5974754cc6a9b94a4fa5107e89966cb2e584ce71bbbdd2d9dc0c0536ccc9d488c06fa828d3627206e7d9cc8065c45c6fb0c9121962ccbecb063d4f
SSDEEP 192:L1dv3V0dfpkXc2MAvVaoKKDWYhWTJWWFYg7VWQ4uWoSUtpwBqnajrmaaGWpmJ:Zdv3V0dfpkXc0vVaeWYhWj/qlQGWpmJ
TLSH
T1A8522A92D7E8A243F56FEE7046CAC5936C3857C74A20C0261195FAAD3DE33D0EB1562E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-synch-l1-2-0.dll
Size 11KB
SHA256 1c72ac404781a9986d8edeb0ee5dd39d2c27ce505683ca3324c0eccd6193610a
MD5 d175430eff058838cee2e334951f6c9c
SHA1 7f17fbdcef12042d215828c1d6675e483a4c62b1
SHA512 6076086082e3e824309ba2c178e95570a34ece6f2339be500b8b0a51f0f316b39a4c8d70898c4d50f89f3f43d65c5ebbec3094a47d91677399802f327287d43b
SSDEEP 192:ztZ3XWYhW3WWFYg7VWQ4eWNnpit7ZqnajgnLSl:ztZ3XWYhWVg+llk2
TLSH
T1DF422AA6CBAC5203F5A79D7047D9D8833C3DA7DA2950816116BDF1693CA33C1E700E2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-sysinfo-l1-1-0.dll
Size 12KB
SHA256 19c78ef5ba470c5b295dddee9244cbd07d0368c5743b02a16d375bfb494d3328
MD5 9d43b5e3c7c529425edf1183511c29e4
SHA1 07ce4b878c25b2d9d1c48c462f1623ae3821fcef
SHA512 c8a1c581c3e465efbc3ff06f4636a749b99358ca899e362ea04b3706ead021c69ae9ea0efc1115eae6bbd9cf6723e22518e9bec21f27ddaafa3cf18b3a0034a7
SSDEEP 192:fKIMFFyWYhW6WWFYg7VWQ4eWoVjxceXqnajLJ4:fcyWYhWKRjmAlnJ4
TLSH
T11E421992DBBC9203F9A76E7052D5D5833D38A7D62511C11906E9F3B83CA33C5DB50A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-timezone-l1-1-0.dll
Size 11KB
SHA256 3d798b9c345a507e142e8dacd7fb6c17528cc1453abfef2ffa9710d2fa9e032c
MD5 43e1ae2e432eb99aa4427bb68f8826bb
SHA1 eee1747b3ade5a9b985467512215caf7e0d4cb9b
SHA512 40ec0482f668bde71aeb4520a0709d3e84f093062bfbd05285e2cc09b19b7492cb96cdd6056281c213ab0560f87bd485ee4d2aeefa0b285d2d005634c1f3af0b
SSDEEP 192:4EWYhWdWWFYg7VWQ4eWvvJ6jxceXqnajLJn:4EWYhWbwYjmAlnJ
TLSH
T1F24228D3CBB88403FDEB6F7047A9D4937D38A7E61920815909E6E4693C973D1EB10A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-core-util-l1-1-0.dll
Size 11KB
SHA256 5eb724c51eecba9ac7b8a53861a1d029bf2e6c62251d00f61ac7e2a5f813aaa3
MD5 735636096b86b761da49ef26a1c7f779
SHA1 e51ffbddbf63dde1b216dccc753ad810e91abc58
SHA512 3d5110f0e5244a58f426fbb72e17444d571141515611e65330ecfeabdcc57ad3a89a1a8b2dc573da6192212fb65c478d335a86678a883a1a1b68ff88ed624659
SSDEEP 192:dZ89WYhWFWWFYg7VWQ4eW5QLyFqnajziMOci:dZ89WYhWDnolniMOP
TLSH
T1FD322B838BFC8403FAA76D304795DD837C3CA7DA266080A519A8F5992CC37D1EB14B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-crt-conio-l1-1-0.dll
Size 12KB
SHA256 b119adad588ebca7f9c88628010d47d68bf6e7dc6050b7e4b787559f131f5ede
MD5 031dc390780ac08f498e82a5604ef1eb
SHA1 cf23d59674286d3dc7a3b10cd8689490f583f15f
SHA512 1468ad9e313e184b5c88ffd79a17c7d458d5603722620b500dba06e5b831037cd1dd198c8ce2721c3260ab376582f5791958763910e77aa718449b6622d023c7
SSDEEP 192:R0WYhWRWWFYg7VWQ4eWLeNxUUtpwBqnajrmaaG:R0WYhWPzjqlQG
TLSH
T1BF42E68396FC5A03F5535F30A7F9DAC37D3A27D72A506069045AF4A838C23D5AB11A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-crt-convert-l1-1-0.dll
Size 15KB
SHA256 6c008be766c44bf968c9e91cddc5b472110beffee3106a99532e68c605c78d44
MD5 285dcd72d73559678cfd3ed39f81ddad
SHA1 df22928e43ea6a9a41c1b2b5bfcab5ba58d2a83a
SHA512 84ef0a843798fd6bd6246e1d40924be42550d3ef239dab6db4d423b142fa8f691c6f0603687901f1c52898554bf4f48d18d3aebd47de935560cde4906798c39a
SSDEEP 192:JM0wd8dc9cydWYhWyWWFYg7VWQ4eW9jTXfH098uXqnajH/VCf:G0wd8xydWYhWi2bXuXlTV2
TLSH
T14362C65366E42F26F69B177221FEC7D72A394781259143B4C217E54C3883781BDA7C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-crt-environment-l1-1-0.dll
Size 11KB
SHA256 aa3e3e99964d7f9b89f288dbe30ff18cbc960ee5add533ec1b8326fe63787aa3
MD5 5cce7a5ed4c2ebaf9243b324f6618c0e
SHA1 fdb5954ee91583a5a4cbb0054fb8b3bf6235eed3
SHA512 fc85a3be23621145b8dc067290bd66416b6b1566001a799975bf99f0f526935e41a2c8861625e7cfb8539ca0621ed9f46343c04b6c41db812f58412be9c8a0de
SSDEEP 192:6KNMWYhW6WWFYg7VWQ4eWSA5lJSdqnajeMh3:6KNMWYhWKiKdlaW
TLSH
T154420A868BBC5543F6976E7047B9E9437D3C67C7291082650569F1582CC73C0FB11A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-crt-filesystem-l1-1-0.dll
Size 13KB
SHA256 974af1f1a38c02869073b4e7ec4b2a47a6ce8339fa62c549da6b20668de6798c
MD5 41fbbb054af69f0141e8fc7480d7f122
SHA1 3613a572b462845d6478a92a94769885da0843af
SHA512 97fb0a19227887d55905c2d622fbf5451921567f145be7855f72909eb3027f48a57d8c4d76e98305121b1b0cc1f5f2667ef6109c59a83ea1b3e266934b2eb33c
SSDEEP 192:CGnWlC0i5ClWYhWwWWFYg7VWQ4eWtOUtpwBqnajrmaaGN4P:9nWm5ClWYhWQ8qlQGN6
TLSH
T1BF52F78387E86E12FAA71F7156EDDBD73E3D2BC2199282658016A45836C33C07F2255E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-crt-heap-l1-1-0.dll
Size 12KB
SHA256 8166321f14d5804ce76f172f290a6f39ce81373257887d9897a6cf3925d47989
MD5 212d58cefb2347bd694b214a27828c83
SHA1 f0e98e2d594054e8a836bd9c6f68c3fe5048f870
SHA512 637c215ed3e781f824ae93a0e04a7b6c0a6b1694d489e9058203630dcfc0b8152f2eb452177ea9fd2872a8a1f29c539f85a2f2824cf50b1d7496fa3febe27dfe
SSDEEP 192:8a9aY17aFBRAWYhWYWWFYg7VWQ4eWbr0tJSUtpwBqnajrmaaG:8ad9WYhW4F/qlQG
TLSH
T117420A938ABC5543F5A36F706AE8DACB3D3E63D67D5080670157F59829833C0AB2162E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-crt-locale-l1-1-0.dll
Size 11KB
SHA256 edc1699e9995f98826df06d2c45beb9e02aa7817bae3e61373096ae7f6fa06e0
MD5 242829c7be4190564becee51c7a43a7e
SHA1 663154c1437acf66480518068fbc756f5cabb72f
SHA512 3529fde428affc3663c5c69baee60367a083841b49583080f0c4c7e72eaa63cabbf8b9da8ccfc473b3c552a0453405a4a68fcd7888d143529d53e5eec9a91a34
SSDEEP 192:+WYhWoWWFYg7VWQ4eWSoV7jjT6iBTqnajbQwr1:+WYhWIiVTTXZl3QC
TLSH
T132422A468BFC5103F6936EB04AECEA837D3EA7C71A1181A50596F5982C833D8EB11A5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-crt-math-l1-1-0.dll
Size 20KB
SHA256 f6a93fe6b57a54aac46229f2ed14a0a979bf60416adb2b2cfc672386ccb2b42e
MD5 fb79420ec05aa715fe76d9b89111f3e2
SHA1 15c6d65837c9979af7ec143e034923884c3b0dbd
SHA512 c40884c80f7921addced37b1bf282bb5cb47608e53d4f4127ef1c6ce7e6bb9a4adc7401389bc8504bf24751c402342693b11cef8d06862677a63159a04da544e
SSDEEP 192:8JIDSM4Oe59rmkUALQe1hgmL44WYhWWWWFYg7VWQ4yWARgKZRqnajl6umA:8JI2M4Oe59Ckb1hgmLhWYhW2v2yRlwQ
TLSH
T14092A74749DCFF63D18F1BB741F08BCE6A385AA665D1B6B4C81B908434A27C47E83949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-crt-multibyte-l1-1-0.dll
Size 19KB
SHA256 5b3e29116383ba48a2f46594402246264b4cb001023237ebbf28e7e9292cdb92
MD5 a5b920f24aea5c2528fe539cd7d20105
SHA1 3fae25b81dc65923c1911649ed19f193adc7bdde
SHA512 f77f83c7fad442a9a915abcbc2af36198a56a1bc93d1423fc22e6016d5cc53e47de712e07c118dd85e72d4750ca450d90fdb6f9544d097afc170aeecc5863158
SSDEEP 384:4SrxLPmIHJI6/CpG3t2G3t4odXLhWYhWfgy6l9ne:4iPmIHJI6vZO
TLSH
T1CE921D6B8EE82E12E28FD7F3B5F6C7C62A350F9105C07375A26785483841EE9BD52E05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-crt-private-l1-1-0.dll
Size 62KB
SHA256 55bc91a549d22b160ae4704485e19dee955c7c2534e7447afb84801ee629639b
MD5 5c2004daf398620211f0ad9781ff4ec2
SHA1 e43dd814e90330880ee75259809eee7b91b4ffa6
SHA512 11edbbc662584bb1dea37d1b23c56426b970d127f290f3be21cd1ba0a80d1f202047abb80d8460d17a7cacf095de90b78a54f7c7ec395043d54b49ffe688df51
SSDEEP 1536:Se6De5c4bFe2JyhcvxXWpD7d3334BkZn+PI5c:Se6De5c4bFe2JyhcvxXWpD7d3334BkZU
TLSH
T1C05307DB49E63F21E18FF7B76BFB17C90B253A4418806274EAC7556B34853A9BC43A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-crt-process-l1-1-0.dll
Size 12KB
SHA256 191f53988c7f02dd888c4fbf7c1d3351570f3b641146fae6d60acdae544771ae
MD5 dd899c6ffecce1dca3e1c3b9ba2c8da2
SHA1 2914b84226f5996161eb3646e62973b1e6c9e596
SHA512 2db47faa025c797d8b9b82de4254ee80e499203de8c6738bd17ddf6a77149020857f95d0b145128681a3084b95c7d14eb678c0a607c58b76137403c80fe8f856
SSDEEP 192:+nqjd7dWYhWDWWFYg7VWQ4yWMJ5HKZRqnajl6b:+nsWYhWxp5HyRlwb
TLSH
T1604209878BF86953E6675F3082F9D7877F3B53C2690082698456F05D3C833D5AB21A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-crt-runtime-l1-1-0.dll
Size 15KB
SHA256 4390c389bbbf9ec7215d12d22723efd77beb4cd83311c75ffe215725ecfd55dc
MD5 883120f9c25633b6c688577d024efd12
SHA1 e4fa6254623a2b4cdea61712cdfa9c91aa905f18
SHA512 f17d3b667cc8002f4b6e6b96b630913fa1cb4083d855db5b7269518f6ff6eebf835544fa3b737f4fc0eb46ccb368778c4ae8b11ebcf9274ce1e5a0ba331a0e2f
SSDEEP 192:maajPrpJhhf4AN5/KixWYhW4XWWFYg7VWQ4eWvppXjxceXqnajLJhrdCq:mlbr7nWYhW41MXjmAlnJhUq
TLSH
T19572D74397FC7F27E5972B7216F9D7D72E3A638226108179C463B0983883781BD5721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-crt-stdio-l1-1-0.dll
Size 17KB
SHA256 6f6f6e857b347f70ecc669b4df73c32e42199b834fe009641d7b41a0b1c210af
MD5 29680d7b1105171116a137450c8bb452
SHA1 492bb8c231aae9d5f5af565abb208a706fb2b130
SHA512 87dcf131e21041b06ed84c3a510fe360048de46f1975155b4b12e4bbf120f2dd0cb74ccd2e8691a39eee0da7f82ad39bc65c81f530fc0572a726f0a6661524f5
SSDEEP 192:WpPLNPjFuWYFxEpahTWYhWHWWFYg7VWQ4eW9M3u57ZqnajgnLSuRCz:W19OFVhTWYhWlBu5llk2
TLSH
T15682C54785EC7F02E29787331AFAEBEA5A31578338007178C117E99836CA3D87E43559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-crt-string-l1-1-0.dll
Size 17KB
SHA256 45e0835b1d3b446fe2c347bd87922c53cfb6dd826499e19a1d977bf4c11b0e4a
MD5 f816666e3fc087cd24828943cb15f260
SHA1 eae814c9c41e3d333f43890ed7dafa3575e4c50e
SHA512 6860abe8ab5220efb88f68b80e6c6e95fe35b4029f46b59bc467e3850fe671bda1c7c1c7b035b287bdfed5daeac879ee481d35330b153ea7ef2532970f62c581
SSDEEP 384:NFvU4x0C5yguNvZ5VQgx3SbwA7yMVIkFGl/WYhW49PBolniMcx:T5yguNvZ5VQgx3SbwA71IkFwNJT
TLSH
T17482C64386F83F02DA8F57B359FAC7C32E385F46254153B5D467A48C38827A2BE67909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-crt-time-l1-1-0.dll
Size 13KB
SHA256 b48310b0837027f756d62c37ea91af988baa403cbcbd01cb26b6fdae21ea96a2
MD5 143a735134cd8c889ec7d7b85298705b
SHA1 906ac1f3a933dd57798ae826bbefa3096c20d424
SHA512 c9abe209508afae2d1776391f73b658c9a25628876724344023e0fc8a790ecb7dbce75fddae267158d08a8237f83336b1d2bd5b5ce0a8eed7dd41cbe0c031d48
SSDEEP 192:qy5NDSWYhWcQWWFYg7VWQ4eWAcSJR/BVrqnajcm2:qU0WYhWcwASJRLlA
TLSH
T1635209439AE86A07FA971B7212FDD7E73F3917C22A8071758166D4983A93390FE1381D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\api-ms-win-crt-utility-l1-1-0.dll
Size 11KB
SHA256 c81c4bba4e5f205359ad145963f6fbd074879047c66569f52b6d66711108e1ed
MD5 6f1a1dfb2761228ccc7d07b8b190054c
SHA1 117d66360c84a0088626e22d8b3b4b685cb70d56
SHA512 480b4f9179d5da56010fa90e1937fe3a232f2f8682596c16eeaed08f57cf8cffeaa506060429501764f695cb6c5b3e56b0037de948c4d0e3933f022a0b4103d2
SSDEEP 192:GI6fHQduPWYhWcWWFYg7VWQ4yWpbdsQlmqnajlDPD:2f5WYhW8Kd6l9L
TLSH
T1F64229838BFC5643F6A72F7083E8DA833D3E67D6696082654065F5993883BD0FB2151E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.cfg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\cfgs\setup.cfg
Size 449B
SHA256 ba270201e6c18ef811430dd9839a1908b2bf7321481135306033a82550ad70f3
MD5 bca7e0e9164fceaa281e9978c6650f54
SHA1 65502adbbc83066e8fe82e21cbb55748597a4cbb
SHA512 bf778c728572dc7870c11753b81ef02a8b4fcca62f23fdbd6911e3f852d1ea1b3850c97390e36c52544156dad73206e71d4cb47f2d5888f64cec8ff02b5457fc
TLSH
T15FF0556A031370781F61430010B929F2A3F702C8102B804D25ACA88D6B7D83E8ABF13A
MD5 SHA1 SHA512 TLSH

Submit Download

concrt140.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\concrt140.dll
Size 316KB
SHA256 2405355f0a58067b258f8df33c327e3a3d716eaac5a3a5aebb757842d85bd376
MD5 5fe9a647921ded8a2fad92deb9ec4ab2
SHA1 1ce87fac4c22aae82a81ddb26952c074b744e78d
SHA512 11fe4c0519cb1df73695ce38b5fdea2a563de565116a47ff0032d5a68b8c51fe732ad66738a7167e56d79193c60af9204a7ee0beae8ff8bb75abd0b484c2d764
SSDEEP 6144:jfjSd54rw5k9cZW1Cbfpri5/ww8VRj7nWzg/p8Wcz:DOP4rwK9c0ILqzocz
TLSH
T16C64398A76140CE6F96BE039C553851BE6F2BC416352D3CB0264839E6F637D1E93A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

realword.txt

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\data\chinesesegment\dict\realword.txt
Size 528KB
SHA256 cd69e14d5b2dceab571009dcbbe17fe36b8fa99f395f5344da86bd5b831a59d6
MD5 ebe8429832fc8b050f0ea5f4e8193a30
SHA1 4435c6d2a7c861ec7a3c971bac1fd555fe2c159c
SHA512 b33e7153e57eb24907f1211de908fa01935aaa0600c3ffa3291c94b5f4b4560b545c39486b0f14f0afece263545a2f4175c4d5e80ddb0153db244fe7dd094b5d
SSDEEP 12288:0LyU27zXkHSfhWMLZT5FQJ80uap/rkg0yHkj6cah2Jvukvqvydlu:UyU27zXkyfhWMLNTu80ht0Ukj6cah2JW
TLSH
T17DB47E28EFB6A90E5EC754E5790403B739074D68A0DDCA91C9DF936B55E8F6E238C0B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify_hash_text.dat

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\data\verify_hash_text.dat
Size 876KB
SHA256 3c44813fddc25c823cb0b8f211fb2d8355f96bb4964b011c3462fa7f34ddbd87
MD5 2a47307769aca892d6aed6df92608240
SHA1 075155b15236f7c103ea8db1a92bdcb133491622
SHA512 a488144eb22aecfeb3ace1179b2850a020f1f0c9b01b085e0748f1fcf09cdf1544a0052c8c76b708db15536adae748259a297bf4960a3c9d5d97cd953a602540
SSDEEP 12288:OTkA+sYXRNkQIiwa1kWQs3AAwC105By5YK+I:OTKXRNkQIiwVs3AA9qoUI
TLSH
T16F157273B039E9B12D9E7BE4E4470E5D82F24ACE041572056CF78944BDAF14AE1EB60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\dbghelp.dll
Size 1.5MB
SHA256 13f0c74845318b52b76e6000564b1a99c37de48422b44ac74d034fa222c65a23
MD5 a5e4b3ff51cf5b7926d9651908feb666
SHA1 4ef5d229709e40f3f84e46c3a28341eadbd1a044
SHA512 0615ff581b648715461349b1622fbc208042fc8c395cb2d271203b25b036f59edb0fc3470065dc15061af1be0fff48981f55bbea7f00c88906e9b470764a86fa
SSDEEP 24576:xU5lL6v/X5lknycQFrQ8gKt/X95WqbQLZopKjMcqpzd1YWLfY:Kni/X5lknDFUCaQLq8
TLSH
T1A975299BF97941F5DCBAC039D662A627F9B13859832497C367908B562F23BF4983D300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\et.exe
Size 1.3MB
SHA256 7b80b787689e40a78ab16b1ce6f852da33c6aab2b7aa3ff85d42b5768ce435d4
MD5 e074fc75460358f639bd2ed3ec065830
SHA1 1c0690aacc5b96f76ffd6bf810db17e7cd87bc58
SHA512 dde502dbb010d2604c623af4bc68b5fb19dc7e6116d33a1081d59a86cee15f06c776845bcc58138b75912680211dc1a970aa6c64ab53baf20780a0d6f1f2bae2
SSDEEP 24576:SvBSrRKuNCuiKxsV5nXm3kzCIqE9RINKY2cc5yBEaY3hxO:SkrRlNCutxgXvzCIqiRINN2TQBIhM
TLSH
T11A55F726E1690EACD25BD37C454B5DA9E3B73C0E07A06AFF028035ADDE77AD14E79210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kbaseconfigcenter.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\kbaseconfigcenter.dll
Size 1.8MB
SHA256 a35490c128b0f1591cbbd8dbf65d65c9d5e7c4a912bf7a935297287d18d05106
MD5 198cb39f743699334fffad0cebf7eb2f
SHA1 46b75a1d908bc46271c03416693d2e2baf4de9d0
SHA512 3b45a23b3aeef1f52122691def0d24d329ed3e1a0e34d95b020f4ffaf41e03ebcdc48c660cb39eed91c05d068c5a462ff2df2516c40fe5d1e386e4c2f86be91c
SSDEEP 24576:XQCBo61zDvLJne4NOWMb2YhdvS8oUWzkeYfxdZYQFluzS:XQCBo61vFemOWhWjoUWzktfxjDnuzS
TLSH
T193855B135B4D492CD15E53783A36674AFE3899B2073081FBEBA82D954E262C0B73D763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcrashdumper.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\kcrashdumper.exe
Size 469KB
SHA256 f7cf941d40d2ea3d81cbd52e0673f015d4bf74e58a2ddb2d84804804cea48ce7
MD5 853aef8fabfa8b9f96913c743b51fdda
SHA1 70aed66cb478288cb4999679d95b6355789c47d3
SHA512 0cfcb1144937c8c6f2936f7b769b8bf49e5a48be0b00017eb3befda0ae7776340984ad9aad514aa2d56db2f002b4f569824e22e9328e0b6ddd4563d701934134
SSDEEP 12288:O1/eoh7J2Br312lTedc7CfsdtlwzLT3hHuQe0h:O5OMvCfeAfT9B
TLSH
T1C1A46B10B966C032E57182B00EB9DFB6A4BDAD684F6146DB77C41A395E306D33B31E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdesign.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\kdesign.dll
Size 2.1MB
SHA256 2dfd2ba192c928ccfa50224405d17c7bfbf720ff56c3bb2b627a30971631df50
MD5 50f8424dd7855d4e196dd8d2e50bf646
SHA1 bb5bafcd8acb6196ba790213d29fead889f4d5d8
SHA512 1641b5ba1dcbb6b75f46f5d7d8840f24db9ac4b1a4412510af744263d77bc9e0a10cbbd37d7419a02da751bd5ac58636a00075c3542e35f84096fc36b8166a9d
SSDEEP 24576:pHK3Vz1fu43b0pi01ajk4QAVopJZInS8NqVXnZGMDitdmoJ4YWuVssgxRqZxoM7l:eHLUsCPr1CTnBVbD69GhWYWvc
TLSH
T1B7A55B4BF7978396C0AAC378C9C78D0AE1B2B4414592970B3EDBDF591FA3322599D381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krt.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\krt.dll
Size 1.3MB
SHA256 135b5a3c74ef0ca811053c55da06071177d422aeac178da17697efdf8b441051
MD5 5aee6acc7fcefcc430d1a5ee482275b4
SHA1 f005f803b462118e33ce70168cfae616485f3eb0
SHA512 5a05318f6319aebe6fae212c5d523c0c43c605295c112c37ef40036993c144a0c330bcb21196de0c8bc3dbe73a60074678eaad5f8e7768a88f0606606bba5f9a
SSDEEP 24576:O7z7LfyTBiSrJI7k25cP7WzI4ZpJB/bOYZ8/KlI:O7z729iiJIwCcPizI4Zh/bOYZ8/KlI
TLSH
T164558D1FEBA943A8E17BD13CC6474946E2B2380243A19BEB16A04B6D1F37BD15B7D350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kshell.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\kshell.dll
Size 27.5MB
SHA256 f5f325ef2d3dab8491457f0d480d98cabaa1692ad28645ba5eb1a48c66a67461
MD5 3c804b6847752367969884c0fb85d83e
SHA1 f0f6bbde47ce1832a16c58c641f84aa4af6d88a5
SHA512 83ba60be33364cda78affc718b9b97d8cc4d29129823a057ca75606940210326f6b13df891029cc47dc690867bdd81816300d16a41e116e6d9f2315373e6d27d
SSDEEP 196608:I2AZ/2b95u4XfnxLUNd712qIEVc/oP9wD/HQg:I2J9s4XfnxLUNd71ORswD/HQg
TLSH
T15F575A4FB6A602A5D075E23CC9574A17EBF17810432197DF2021AF6E1F7BBE0297E681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksolaunch.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\ksolaunch.VisualElementsManifest.xml
Size 387B
SHA256 8a776d5e9f4375af8d92fae26f7a4f59f7b7609409026e19ad95c20f740ba6da
MD5 34483e8e422a4e80566a67871977adf6
SHA1 d7b9ffe029bb4b7eaeb548de3d9faf7db0aafb22
SHA512 667e3a5a91dabf4a3e2fe250333443a29bbddddf6f278394c7b641e15f05666aaaf50d83e18c90c1d6799bc295a068e90f8b534c7ae66f1d14aff49a4ac7d564
TLSH
T108E0614AB310005196D39AE69D3795CE39FDB1DF82D014C649E24539144644D1E4B104
MD5 SHA1 SHA512 TLSH

Submit Download

ksolaunch.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\ksolaunch.exe
Size 778KB
SHA256 9034e3002cef564bcc6b747f38ac8809d3dde70ada7cf65699cafb608819c51b
MD5 4a8a76eab8e0243f927469518ca0efe2
SHA1 f6669a67cd8759a13d14768542a1e5b585dffd82
SHA512 b3ae7ecc9beff75c4fbb0e119777ab589776e23f9dc85d154af91870dd380fc9e2c92e84a94c772819ff394c12a9eb247e6aa1a2dea26e4faace2e5056ad0ede
SSDEEP 12288:r6T3QU+Wzn7bnkuqLWYgeWYg955/155/rgm9uw/GsP5rLohf37hD/9Ihe:WT3jHnkuqSsw/xPlk/9Ihe
TLSH
T1E0053836AEA701E8E367D13879924815EE7A3C06C7609ADB13D076763E736D14F3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksolite.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\ksolite.dll
Size 11.8MB
SHA256 15e1f020da06bb722af7a43ab459bd809691dcb396f0c145047d61663e615bef
MD5 35c0cde6a018040b3ac1999b0eb5a2e9
SHA1 99141e67f18c596d11c608fd35a3e40568d9a9a6
SHA512 e228987732010e9f115058d52c933290ba272690edae309543bd653bd84411dd67a55222029aac325c2641d54f39d1f937cae0304ada7f77543e5962fb835cbd
SSDEEP 98304:Z5jTf7Z5wKDqPZfESBB2ag9kJxLft6+TwrB7:Zf5wKYfES20LV6frF
TLSH
T1B9C67C5FB76983E9D1A6C278C94B4903F2B1740287119BDB25298FB92F337E2097E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksomisc.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\ksomisc.exe
Size 3.7MB
SHA256 91fcbef8c3859e6cf81afe6fb8d82cf455699a9452806c2d4b9a72ca87281705
MD5 b9e273389f6be0d563dcc5205fead3a8
SHA1 0afeaccefcb0530d3a0980fbfe6026926fa45df4
SHA512 3887019c5d5abd8b484c82801016f4f9603812b753c9e1c3db18ff02c55b336a781fcc197976b8ea6b57e480518f288419f262f9e953b4600c2ab4dac1d0b1d0
SSDEEP 49152:f/2d0pIqqNlhcyKm+/FVJ9s0YFoG0Okvp55BO4IU/pWFiPNpP/NfDf0skgNp+eP6:MepxXvT5AHgBsSll4g2
TLSH
T11C066C5B62EA03ECE1B6C238CA965D03F3B6380647346ADB11548E790F737E15E7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kvpins64.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\kvprinter\kvpins64.exe
Size 354KB
SHA256 7cb9a1117e2a475ca60b3ef271a65cae769d879fed3c997b0e3b0593e8cc3d33
MD5 b3ac5026f3b8820012602ce722fa03f6
SHA1 908ee352a27c820eeddb80253e01085d27631235
SHA512 0240976e3914eebed9c95a5d267840e2c6e8130c8debaa7866f42203250527b79142daa44e446b1fc9ffd167248090aeb21b12c27e3e00bbf06a060b28c142e4
SSDEEP 6144:M5Y4fVG1o8FhIx1FonD/FEeqCM4mF5sAOj/dxCr9vZo:MmkVG1PwknB84OSdxUvi
TLSH
T17D74AD56B3A81CE9E837C1388D568A16E7B27C510720D7DF1360836A9F73AE1AD3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kwinappinstaller.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\kwinappinstaller.exe
Size 29KB
SHA256 18edd4ae5a2a5725d31618568e1f03b8319c2e73f6e2a17b3ff522866ea3ec0a
MD5 51005510eb0a63e30aac0a5f6c8cde5c
SHA1 00031a98c0b1de5612a440494a04148de1774af4
SHA512 b105be9ad46ca5b3ea2ac1cadb69c6d3cd52c49cfe1f3874f8d9eabe76801aeb189898498d0b8fd59d5802763265a7a4432ac9baf4b224203ca2fbc9ae76d046
SSDEEP 384:YX3jAgqYyeB7iZxsY0E5FvB1lNyEIYi2mL46rA+Wtw78xNpIYistw723jQrA+gmn:6q/cybaYiDL9rA+J7gIYi77g0rA+hLD
TLSH
T12AD27D538AD44C05EE67AF3078E05136AFFA7A477991C1DF7648C1064B923823BE92F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-kso-1_1-x64.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\libcrypto-kso-1_1-x64.dll
Size 3.4MB
SHA256 984082076c44d928451791167dc36c502a076039b7ff5d7160f642d07cb14dbf
MD5 267c90b5505c31caef5dbb6127b975b7
SHA1 d567863acdde79819693009c8578d83a00b01662
SHA512 213731becd71cb1ff47cbab591e719cb632d64acd668c42cedefece555894e02d3b72361027f27e6342837bede8a8273603f29d373ed4c200501539e4b8266e5
SSDEEP 49152:FOVwASOXFIU6idBGtlqXWq7TsRQuXk0AkOGYYNEhvla9+LEcJQNPn/ksqodj1CPt:IC+Zsu0h9gEx1/ksN1CPwDv3uFHUO
TLSH
T19AF58D5AA7A80184E5BAC13CC55B4737E3F2B95A17B09BCF18A1C1780F23BD66A3D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\msvcp140_1.dll
Size 35KB
SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
MD5 2a214cb2f0f9473e7765ee3b8db8651e
SHA1 9ce5c3d6c7d94b175f136f552af8771dca6147b3
SHA512 ea9a759babdec5818fa1e430d1cb453cac762cfaa8f934e01d7182100f66cae21527962696f5bd963fcb0fba2c0f38bf4028e75f89e9e599ddee008021646a33
SSDEEP 384:3jJ2J9VQH+qNy09dmFWcS5gW7YZ1gr4iSt+e92xS+R9zWd/I1IHRN7SUl8BR9zTr:d8QH+qNy0PmgogU9v2ci9zeHSn9z3
TLSH
T1C3F25D86F7248442EC674970C699EE837C3DB3D25B50969B17A5F61C0DA33C1FA34A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_2.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\msvcp140_2.dll
Size 273KB
SHA256 3ea06f0ee098b4823cb79599df3780e7f23cce52c19aac31d2a0d47efe33a5e9
MD5 3151333808c2c2339d5f5466df70b7dc
SHA1 e48159bb2127ec812ff679f6fabc41141009f26a
SHA512 8f1daa078e124dc89b51b84baab8d6cc2d77497be23b2ba95ef3fee54d9034e17bf5cd15a4043d025699972cae20f9c46d2e7bef48e4283f3ad9ca6b84fc64d1
SSDEEP 3072:1J51P7emwi1j+XZi7b1dbqtH0h6XV3Q0JPQo07ICl3Sg2xmygdCg2LMeDh5FD799:1JbjwvnQo/iy5L/XxTWrNM
TLSH
T1AD543912B51A2EBFC5D6E8B04939B416FC223A418775C48A57C31C8D9E2BB437FE3529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_atomic_wait.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\msvcp140_atomic_wait.dll
Size 49KB
SHA256 640b2aefced484d0368eea5bdd06addd0658a3a70a49256e560d6923b404a479
MD5 44aec42494531580bca182b0e2fb19c2
SHA1 a85a6a4de6656e5969fa4ab15f2230dfe2839e75
SHA512 d8afb5bbb1394fd14c3ec8ecdd4c02e1c6f23031b15173b1448dfd4915c392bb8512cd41eccb449db19969397a09046d27d54db704c8122ff62c12ff5a89c9d6
SSDEEP 768:ayMsqh8UGchsJr3KbYA5XeDmqw4DYPW9zr0JD0io9z7p1uF:W+UjCKb/5XeCqgazrURgz91G
TLSH
T19C337DDDA7684083E5678634C1A4E517FA7AB7E20710D6EF4352F0890FA37D1AE34B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_codecvt_ids.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\msvcp140_codecvt_ids.dll
Size 31KB
SHA256 f2069a52880ec885ee7f0511186100eb7fada0411a2b4948fafea7735b878a18
MD5 3ece3fb90bfaea8e9a5fb7139ff9cbdc
SHA1 91b19dd0db24a5cbd944eca9c67fad3b53f9c154
SHA512 c059ffd80de25ad10d34064b1e9421666525da67710de0ac445cfc45b8139715dd946f7e90c1e0d719c60e3d5902e3229db4496c87d674c0012c9b4a8c2b2291
SSDEEP 384:p7GVNpd36sRWioEWEw4himRSt+efdDtdQ5R9zpU8NSqHRN7w9ju0R9zlWdo:5GVsfaw4DYd7ds9zmMEu49z0G
TLSH
T19BE27C89DA3C4487EC9B5C7082ACDE477C3D77C60A10569B4392F5181DA33C6EB3866E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

printTemplate.pdf

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\mui\default\templates\printTemplate.pdf
Size 122KB
SHA256 c45820541f60340006ee32834b7c79ceb2e8ae7796c9b3c1b5b5abcaa6bc89e2
MD5 522d5253cd791c7e5bedc43581ac9cc9
SHA1 87f1d22439e074d18c21484bc67543919623ab3a
SHA512 47467c42be292a4ac346063b693008b140be60bc153bbdd1167ea2c85f58f7c42d3a32556225488b00474c26c06e4e0750c921fb53ddedbbdf460970c4c5aa1c
SSDEEP 1536:Izn9Q+1jRjYEgdET7cIiUkED5qi7C1UWLXA8aKJAE1lSXC7W9TJprmgzxJcdvZyP:a9JziU7NtC1Hw2KXAWFbrmgzxJfgQMU
TLSH
T186C3F180CB953CDDE2A0ABF76B062042695DB213F2C0C8F174ADD6DB4782F696DB6D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EqnEdit.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\mui\zh_CN\resource\ksee\EqnEdit.exe
Size 792KB
SHA256 c523615c6695dcf1d34e3a279a6f5730c726011fa4c269adc8c6c71ae3eef33c
MD5 1cbcea8ae1ec7c4e6ace5f2680c1ef3e
SHA1 a5b628491c1daf3b65a0be77cc4b92f28111c681
SHA512 f166ee8f6c92669441f858d966dda09d10c2dfc71a7ef8a9ffb3ee589d9b74f5bf6117ff5d74f2052983d2b8093df84916bfa73b5bc414c501f88684b62e73ac
SSDEEP 12288:SqFcULbbGlN+sPIfzvEfeMzLj3aqv2x2RxmSS0kbAPPAtO:VLbzo2ELj33RxQAQtO
TLSH
T15B051801F101F0A5D1620AFDDE7295B854686EB06E3115EB3E81FF2D7B71682B93226F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addwatermark_buildin_wps.doc

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\mui\zh_CN\resource\watermark\information\user_defined\addwatermark_buildin_wps.doc
Size 9KB
SHA256 43add80bf7f6495384fa15757101998fcef1688702830c538976dbf7a26d229c
MD5 ad591df2deede6c9e91ee34698ae9706
SHA1 8ad7d0506d8f39858f545d34b3f299b98bf58b25
SHA512 2a866d844cb80cea65458b2d51b61f66a21f7e7ef83e157cbafcd7b3c862703e18c9218c78e01dd187e8e416b4d49d9c142d1569084d3b31f25412de930cebfe
SSDEEP 48:r/UVygU1/o1zwAvBH6GgaNj01LTak6mSDnY0wcYYmtJSd:j8BUB6vBaG1h01L1LS4cLUJq
TLSH
T155123F12F390D90BE4A6533598EBC3D03731FD10AE128B4B3194B79E2C332908F52B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

presetLayout_15.pptx

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_15.pptx
Size 38KB
SHA256 8fa6a9553135ac26a602d5e4d8d72b70137b3781f040f6f17ab5707cb7581fde
MD5 3d47dba65a7625fce740a2bbe9f92136
SHA1 5d86731e89f9db1ad3b66dac0699ca29129a58e7
SHA512 60d56678f3ae49c70903bc35948e2d2571de4d82df25cf6a9a62cf1cb6fdc8f8e8bfa2bc601c34950751d2c3e5e0b86904908d78bd82541501cf25acf6063d5b
SSDEEP 768:lwQ75cI1zETv/7H0vFtZKSZTRomseFFxz4CFlogTJP1JgsZygs1wvcG7GyGBGoGB:9qNTn81Romsehz4CFloMJP1Jgwygs1/6
TLSH
T1D503AE61C409142BD273B3B6E138174B73FEF8124413A297ADE421A7296E87D7E4A34F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newchart.et

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\mui\zh_CN\templates\newchart.et
Size 27KB
SHA256 b488fa0bdee4d38be7ec4ed964b99190276c294d541719c160dd86ce23a8da36
MD5 c16d9a5a046c84808e02a5b0b5fbb1d5
SHA1 d2e4113b6027f3fb24a348d958265e916dc9034b
SHA512 18cecd340b041dee84b34f9dfe88deb194709b5fa0141c8148e9f760898c190aa7caadddea7436b92bc39ad4430bed9018c4b23dc79129a092ee29cb7967d010
SSDEEP 768:tCCCTbe/PE8lSKI0fXb4RzQUkzDat5RoNBWg4HcAveUwrM4K/8rMbx0MB0rP:tCCCTbe/PE8lSKI0fXb4RzQUk6t5RoNk
TLSH
T1E1C26251E6D39C89D7090331D2EAA622B333BC614BBB470B7B99B7972E715948C4370B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

photolaunch.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\photolaunch.exe
Size 1.2MB
SHA256 aa8a54c6c4ba15d86ac71ac1d324183613ecb134e400f73ec62d55001686ba17
MD5 854a1ece4ea264ef65377cb66dd2d42f
SHA1 3132d8bf07c438719a0a8828302d18cba43e8a1b
SHA512 f99ec1e88f3825d3a7c7cd0a1781e9b8ddbe1c1a3870dee3a57c073e6f1d41dc2820a12fed2ba7cf13abe9170a5bb4d8022e93a8c56a3414e21254fa5704fc94
SSDEEP 24576:sHeVit93qPLGiJNMnrW2BK3VAH3t7qImMl0vBE8PFVQkbm:sAit96PLtUrPwVAXxqImM6vBBoki
TLSH
T141555C0763A902ECD1AFE27C56425901E2F63C4A07759BCF079036762F67BE19E7A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qingnse.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\qingnse.dll
Size 16.6MB
SHA256 75166bb0080a9dd48246dcc4894ac6f98fa16a1adf397d8a89a676496b96d90b
MD5 2e405b65da0216d2e5419465c719466c
SHA1 97650ab5377d4a8a16436f8f7acaae410df235a1
SHA512 75eabf3e3e9b826ebeeae3cd694351f03f435e202a35620391b031de163e15d95fa8ab78c8ad10d0dcf1f00230621e0cd2188778edf5d99c973d510d4ee3c3dd
SSDEEP 98304:e8i/OpwWb3GSafUGhp+ifA1T7tbKSK1SICGKy+Pg9qXMs/Dbeeuvv:w/xWb3GSuU51TJOSCSkpsAv
TLSH
T1A4073A4225F1C4A4D40652736A90B6A6A8AC9D26877358CFF34C3E2A1F70ECE573BF15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qingnse64.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\qingnse64.dll
Size 17.9MB
SHA256 e8361cefb0b4beb05c72317a0873bf36b56342743af623f145adee2ffd9b9bb0
MD5 7acb359d6c494fa0c8fd2ae279651ec0
SHA1 9022eee889066ff6da25746f335969d04ee6124f
SHA512 46ed4e9f31fb6c07dc2d5284002867cad27d78e7dbc09559cd66105387eabec4a7f2197df4ae3ac1977068234ea7ace3f6ee75bdf7323d080d81898cbba7d556
SSDEEP 98304:9eskwIgIaFBLynxmi9+hhholm75urjhpIqXMs/Dbeek:9ee7FBLmxRSh5iwpsq
TLSH
T1B617184A61F441ACD457E136AA826552E9B9BC07433258CF734C3A2B1FB2F994B7FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qingshellext.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\qingshellext.dll
Size 732KB
SHA256 a52697d1d6050e4aa3f42cf2a7cc3a7f988cc6fcf33502b429060c57d8de3d9e
MD5 092b238cd8eb2a1b590d9aa6a03b4d93
SHA1 d9223559938e342cbc7d725ed5af6dc1d040697f
SHA512 9fde21c61cf0323459f7e94fb61584ecfd962188e97862fed32908b647e184c79aa883531c4bacc1a6679593647e6a299f2083ebdc0ee1ced2ff909c76af3e99
SSDEEP 12288:9d+UWB7ECkSFLG+drIJwkplsxpr0zXLAySQzZZgH+ssGv/B4iVZkV:2Uk6FJwkplgd/ySm0p4inW
TLSH
T15AF48C617643C131E46D01B1493CAFBAB57EAD690F7147CBA7D82B2A0D301D22F36E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qingshellext64.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\qingshellext64.dll
Size 847KB
SHA256 1cb58a4d34c4b4ce77b8ebbf74e3d1a9915bcec3f18673c886642260125f61e7
MD5 af8ebcef4f84c680a0b58736b954131a
SHA1 83119d32f565038a04a38b4deffca2a09339a7b2
SHA512 4aa7019abf83d524ed23eb27758cea53a7bde73f27b292b7648812f4f1fb6b2d7795eba07dee53b27e3a2433a39d114deea04936197b1436a3aa5fad6c7d2f2d
SSDEEP 12288:9h8Wo9FW5AaBVYwb0/ccisH7WYgeWYg955/155/NbFZMW3onMC/kSo8QIasJ4iVt:9hXkpf3ccisHSkAonMgB0sJ4ir
TLSH
T1B1058D0666AD01BCE0BBD13989579A01F7F2BC0607709BDF13A0166A2F777E15A3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsprintersupport.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\qt\plugins\printsupport\windowsprintersupport.dll
Size 88KB
SHA256 4d7c345ef386f3b7e4a022ef830526eba8b79a8fc94bf9473fd46597d5841cb5
MD5 c6458be518e9fe96c2fd8f9e111fe375
SHA1 838b6a21364b3b97e0e67165958fc3d2bd44fb5d
SHA512 c68438ba988bb514c4a3dc56ef26cd5309105f4bb53805ad0c8ebeea5cdd7549c85ffcf8976c071ffd9e1e7c451ffbba355f1d22f6035b9af192dcce9deae014
SSDEEP 1536:xUOvHEs27LT3nOv3sQwdAacbuBOwKxhIbm4SxMY7p877bHo:xvvks2TOv3KAac0OwKxhIbmsYGDHo
TLSH
T1A89349A3EA650188D626C13594E70927F772B41117A283CF6768D74D0F333D27EB939A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

refEdit.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\refEdit.dll
Size 176KB
SHA256 d4d3099255b3e29affcd13a5b51e3ae29b13b2e02f020a16e022da0cf025f5ae
MD5 e85543e0581346241c304fe1ccb3d257
SHA1 75b70a27e9216419808a2868bc3f211d5247e9f8
SHA512 cff75c11742271f43e0128911c129e2875fc09366e7d25b9277c6f2cc625cdb36e56ccfbe7e2a7d481190bdac9de16a3f15223ba9336d0d86e165edddfb29053
SSDEEP 3072:WOM2nWTwMk3IRV2LRGon9fAV3rciKx92aGSryF0Q/jgsaoB8M5fU/G0ysmI:BMlO7fmCx92aNmF0QbnaoB8M5f+G0d
TLSH
T1AF042847B6988897C125C13889678F59D7B2F4A11F1093CF23A0835E9F773E16EB9364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

watl.bin

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\tmp\PDF\Security\Trustworthy\watl.bin
Size 17KB
SHA256 436d575ab1be072af55a2d65c37150794d7044126c5a2ff52f6b9afa75bd0d91
MD5 a238a7199c4bad0bf835f1fe47a4db90
SHA1 b71b88650f385bd9b009ba027eacfca641fc106d
SHA512 5be66bf47dc6320b3ae5c2fcd6094b7ebc10b98aac0c83d280aad3261b5697ccb7b50a136ac4041ee37519129615e09d021c659a48db4c1a8b225e0f838aabfe
SSDEEP 384:OM95rF6i2n6CGMy8nidMlAtGwJNCgjWLIPJO5:OM95rFh25GlMlAcANCgikPJO5
TLSH
T159825B294A387428EFC6FF18A8D4ED236D70BAD0A5927C5F54A9CCE19D417F21C0421E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

transerr.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\transerr.exe
Size 885KB
SHA256 22c51f8169a14b6f497c30ac90130e08a8ae6326b004e06097ad5c16b7b9e642
MD5 b4e66619d0e76c570477f7156fbecb71
SHA1 d30087ccb2b5019f49c5b7f6dc9909bb46450d38
SHA512 a745ae29c167fa41f6e43854b39d3f0b635b74279de698c714bebfc697d2d9fdc5cc2a0b99d67f02ce6346f95244334eb9ae64059f3658396f4c723350f11cd6
SSDEEP 12288:rHM00rmA8eGqctPp+KStmaWbPskL8W60Wtyl:h0rcfbb9Zuu
TLSH
T150153B0AA7DD1A95F5B2D774C5E78200EA337C028332C25F27147E597D369A86C3AB93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vccorlib140.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\vccorlib140.dll
Size 344KB
SHA256 19839407c3fdbc824e5bce189bf68ddf8097f12ec28b757797ffa0415c144ddd
MD5 0b4d02b22ffe3957db27d9cc6cff6edf
SHA1 bec5a8eed4434222956d9f0f0482f8562d992317
SHA512 9588f6e2c96b2793598cd6335bf10cdd53acd77886a5f703118c77af676da1ec3f393d55a1b1dc28dd33bf69c4c5bc70c615f8d41e1829e473ff9bbc1163ea3c
SSDEEP 6144:PpVeNd1C++IAU1qsxEW5QcT2Xgs4hiWi/GDhmVejWXaV+GpfOqmIzt/mtBGgVa0J:Pp0+Xgs4hiWi/GDhmVejWXabO/IzgtK+
TLSH
T16C74E4277B9C4CC3C931A0794E978309E372694207A1E3CB0691970E5F7B7E8AD3B665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_threads.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\vcruntime140_threads.dll
Size 37KB
SHA256 219915cf20822f34d5e7c1fdd4e21ae7f3396881096c51036225fb8f84b47afa
MD5 e57bb2cda101fda5c72f3af09b035bd6
SHA1 77363f6b41d022dbd34e182a93087fc63a5b08cb
SHA512 cab172e140cc2da4444a0c37a42187c4bd29997aa5522f5cf076d8d40cb0116a9e905162349204415213c75ff34cca98cdcc5a7ee9535a8d28945af726545441
SSDEEP 768:CjJ+AiHEFeLUIHmJ9crFciw4DY0zxOW9zeLCbpiFds9z9:+uHEwLUIHscrFcig0zUizGEpiFdkz9
TLSH
T126037C86D7684487E9EA9870C2B9DA47BD3EBBD20B5041DF4381FA480D633C2EA3571D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpp.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\wpp.exe
Size 1.3MB
SHA256 e8258c14cd86125bcd3cc5160e543c82f350e8062f81251a8da8ff7788ac8a0f
MD5 a6e8896ecc7258870197f00b5954ea11
SHA1 618c129c8bf3c9c66d1d3d5cb19ee62290c1b132
SHA512 3d7c0d65a885158e3a708c33f39da842727c227d99fd063c8f4eb98c726344153b8e6fc265125c010ef67d85969b8bbd99a1f9be7e17cf8c2390238db992a246
SSDEEP 24576:89StLv6J99ATiZ8h6O72aoxhb3d4WuIu7lx2xMfiTBqaYvmF954:8ItLvqbAT+8hgampRuIuZxKfTBeyc
TLSH
T17E55E60661D902E8D1AAD77B894259F1E3B73F4507204BEB07BC39B57E72BDA4E39210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wps.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\wps.exe
Size 1.3MB
SHA256 fe8e9c5b4a2dee7640ec6d4f430ab94bd6f9754fa851e5f8efd34c69fce6b8fd
MD5 1f6ec947a031c59d4da99c764c368c77
SHA1 2aa42dd0dd340a4fa3ed800cf173dd6797c76e44
SHA512 b6e51afd870e46c4602829134feae2878096bd8e8f3e177dd878859bea277e377f35844af594a3e3a1ef84e9a83caf2d2a6148c47361e64ddb1652bf72a388a2
SSDEEP 24576:HXxdSBiK+u98Bs9fpIWh0yWC5j0IvuDDskEz3wXWByaYRz2:HBdScMSi9yWhCCJ0Ivu3sPz3wXWBEy
TLSH
T1C85519366EAB02ECD36BD27876425901EEB53C0AC7655ACB02D035763E77BE18E79310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpscloudsvr.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\wpscloudsvr.exe
Size 1.1MB
SHA256 b6cb9c742eea777e422ad5a443eda577d78c056489d11ddc160b7bf6925cecf5
MD5 61c70b6e8b81585bf39cf0a5dbdb0d2f
SHA1 f795e75afbee7eb196d08c956312fb2a24619343
SHA512 dba5160eea5cafb7b85390a58356ebfa4df24351210c9af0c9738954b1400143f40c2a5c441d865259f993f669102634ad4414cba5adedd0ea3ce92e9915c2ee
SSDEEP 24576:lccEqVZAreByVoAGITpNrtX3G6QVj74sbsZMGQd:ljgFzGITpNloj74bZMG6
TLSH
T119355B4AA3B902FDE0ABE1798D525901E6B63C0607705BCF079027771F6BAE59E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpsoffice.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\wpsoffice.exe
Size 1.3MB
SHA256 a8722aa63d94133b0b3dcd1eb3f01d4fa8597b40e4c4da9de3e33f44b4c8012b
MD5 f28c202fd4cbd3237363d0a5883dc391
SHA1 432edd6ae080b5f2cbade47385df60e9adbc8439
SHA512 692d4f9d57eb72d0b6facfc03ca3a702055b00538aa512b453d881379767973943358134422bb093ed89ff18b1f6bdc495e10ebf6b41736fcc25cf0ea650aa3d
SSDEEP 24576:ph4KU3lXQBjwm6CsvlrUZ0++7ILHPSIPzn5BTg2L9E:pNU39Q1wd3b++7ILPSIPT5BcN
TLSH
T1265519366EAB02ECD3ABD27876425901EEB63C46C7745ACB02D035763E77AD19E39310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpspdf.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\office6\wpspdf.exe
Size 1.6MB
SHA256 3dc3ed7e577d08dc71601e1f8f1b61827142332ba21fe141a1fe5b4495993427
MD5 80fc178ad9734c3be27d1ad653b115aa
SHA1 243edffd3d707f5fa97984525ff7713694dfadc3
SHA512 52398bbff2a45a25d9147c8c8584dcbc0c72943f858f8a62f3d9cfdd6394d272e604a710977f23ceac3a78476de2bee3e108064176a2c42cb0752030860a96aa
SSDEEP 24576:MNjLs8ePXUtlVtSM158voJObbdfIvMNeQeIBUESqFshjv:MVLsnsr2kRJObJfIv0eQLBlfsd
TLSH
T162756FC7615606DFDDDA923C054A8501E1BB3C890B206BC782B03BB99E7EAD77EF5610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything-KingSoft.ini_bk

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\utility\diffbase\office6\addons\everythingsearch\everythingbinary\Everything-KingSoft.ini_bk
Size 404B
SHA256 b5980cd1122d2ad4727bc06806e3d2a6598b7d67b6eb3d2732938d08c6deedbb
MD5 6a4653f40acaaa13e2b0f60f067ea93f
SHA1 34981baa55ef31ae6b6d5985fdd02798e3bacde2
SHA512 f286472389e50fa51abe03068cc3e1f9d18b19926d84b66b1df28c157cbc70e8de32a8deb7b4096f462605a2bdd4d76f9863c6ca0872703c60d473a3271778ea
TLSH
T15DE02B99808C4B1C7656E6948D715E4F42E1C79C1B98174CCB0BC241E91950DF63A439
MD5 SHA1 SHA512 TLSH

Submit Download

logo-small.png_bk

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\utility\diffbase\office6\addons\kskincenter\ksolaunch\normal\logo-small.png_bk
Size 6KB
SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
MD5 8d650fe389e3665607fdbf938c1a1722
SHA1 2e545f9555ff22313e4ce113995d8aa694e5cab8
SHA512 f116621bfecb602d02919eb1ee9d7dc92e82b313b8b54cda42ab48c5e7ec60b02005edcad763fff6b497ca4bc46e83cb0c9a249be791f245bb9c599950fdf015
SSDEEP 192:HSO0z+xgsZ7wNP+agwQznBm2KIvdgoeAtzpZb/D1:yMRoP+z5IIa8hD1
TLSH
T1CCD19EEE6F1CCE4F079D52F7500AC0A9DEA218AA905764D4D68E70B471FE6D120EC5C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png_bk

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\utility\diffbase\office6\addons\kskincenter\ksolaunch\normal\logo.png_bk
Size 12KB
SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
MD5 d58510dca6b659c6e4ba7a454d5b75ce
SHA1 e142de2dda3811a2e8bbbb2eb64d366e8eb9ea3c
SHA512 42409f9976ad08ecf1756d1c2915f3ffd17cdc78e9ff552c0a08bdfa2fda8960e408721bfc9de1a5ed9c9aca3e23b97adb721b3c51b6b3f0ed3ee4a4c780cf88
SSDEEP 192:ySLu8Kp8OtM5IirU31+5AejJ7D+N+QOtHQjrE9aTYpR8XnXrWjvyNTtLJci:NC8o8do1+5D+N+QPE9B2Xn7WrINJP
TLSH
T1BC42C08F68918EB2CE443C39F356115F1FE12A5E7E19A2CF2CE7944A239044ACE1591F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\utility\install.ini
Size 626B
SHA256 1c9cadc633328092ea09ded416aa1d4edeebd213a2767e42a3a5fdea36572639
MD5 e559a09dacca92b02fa954b68638b4cc
SHA1 a859356b1afcd31d20ca4f16f8bf7f22039c1c3b
SHA512 db05cc69f463a5214901bb0412637b85f737c259fad981e38fd044a1f462de3d665f8d3391d5835d9a8101e6ec50aa6c8d8fe7f8125e15321e58c5d6d3fa577a
TLSH
T186F07D080D89C57E36282288A1D3C5D199ABDE551D4CA020E2E36E5AFC46D0A167A42E
MD5 SHA1 SHA512 TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\utility\install.ini
Size 462B
SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
MD5 71e0a7ecd6bd2e91c04a3edf760c45d7
SHA1 e6cf872ce6def16bca98818ba289395580701292
SHA512 282b4c8be6abb97383d7dda8258fbf069fd668f4fad722582567cbc916b5c7da9a39a157a35511210306c19e46ef34c02af17f2af1ec7707bb3d84f3d529c3ca
TLSH
T178F097090C98C66E36282188B0D3C2C0A9ABCE260D0CE410E2D36E1BFC02E0A217E02D
MD5 SHA1 SHA512 TLSH

Submit Download

updatepolicy.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\wtoolex\updatepolicy.exe
Size 747KB
SHA256 66accddd9840de5dc4b78521a43d687c656d20f51b9a2532c42a4ba6d2ac952b
MD5 2489c6376ccf09ba263ce319a99dfc4e
SHA1 8f3feedd602f532d839d0d1f84e19af84ac3cf73
SHA512 39028165e2978b79bbf5e5099a4ed2b2cafdead9581122a8ea49541ff1a296c414d4e7b2c25da8fc00a7888b378e317ebc4d3123ace1254a2bd40f8dca287f54
SSDEEP 12288:cwU8wk8k7PtCHape3lGaoXldpF+WYgeWYg955/155/C3kh+d6P+Ek4n8IHMfW+WP:jIR2lSz3hoXPpFKUMd6GEd8X+boo
TLSH
T163F49E17A29A01EDE16BE23C46879A02F2BA7C551752CBCB2390B57A1F73BD41D3E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updateself.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\wtoolex\updateself.exe
Size 1.6MB
SHA256 23daaeb3659f4ffa762273b6529fe53a76f31fa90d38a6b268eada95183b36ec
MD5 f671ad5809b5f9e7c6128f541b085d87
SHA1 4601342e71718cde7784b510e14de1df8c6160e2
SHA512 602be0eb89edd30c72d79ea2b8d410c17c2ba0fef99ad6ba684e49b35262993ede59273d898d4d72220d5abfecf298d6d827e7608f8dc46e9a4702399130e981
SSDEEP 24576:5IyybnYGgrnrrPe8gScTjbeS2N+oARClh3BbEd8X+bN:5LyLYPrnrDevSgbA+o6S+bN
TLSH
T1B5856C1762A902ECE1ABE178C9469A05E7B67C46077197DF03A0397A1F77BF05E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpsupdate.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29681\wtoolex\wpsupdate.exe
Size 7.0MB
SHA256 9b70f8683518996642c4088bbaabf6ad95f70ef5a8125b462c06a3abac03bc0a
MD5 8d51e4368fa5831d890bf6a70e9b1abb
SHA1 a12658d3347ca04265c8458cb82d858389724a92
SHA512 3dbd2dde075dbd9dbe22716bd356039ee041673063e9402e2055ab489ddca6e83ba27f04e86b9b795492dece332f162b39b6d719a3c313e53bd3a6803609303e
SSDEEP 98304:J+Tb4CRVBgVZhjBIH9lBHnrpurTWQL6uHk2ZksAv/XXabb4un:JE4CRVeZhjBIHxH4WQRE2ZksAv/XXYt
TLSH
T1A9765C1292A8C1E8E0B6D138C95685F6E7727C15CB7197CB1650BE6A3F33AE05F3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.8thshqvu3sko9q1jma51a3odf.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.8thshqvu3sko9q1jma51a3odf.tmp
Size 10KB
SHA256 2213ba4351716cd6d787f3ff2f1eb0bb38d75b991ff1e742b1f95118f123c90f
MD5 788bd5e70e614ec1427b9233e001c973
SHA1 3835863a635cd1fdf4ea34aac49394d93fcaecb2
SHA512 5a8232eb388e4e56b72fb03ac4a7540d48177bf7f735b1e8241456dd255ee3615413b243dd53437afda7f134de5692b6ffba87102677688061261f8b4d0dfe6f
SSDEEP 192:R1IYiYF8+2Qih7X2t81578WzP7pDA+cdmL4pUQrNytfXrC:fIYistw7X2GdrA+gmL4nNytfXrC
TLSH
T198223A6388581C05DE079E5074D89A3BAFFA71963AD0C1D37218D1468B953873BEE1FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.goi7icmxc5to9vd74e_6x3b3.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.goi7icmxc5to9vd74e_6x3b3.tmp
Size 712B
SHA256 7310eb8c9a5115a236fe0f5b2a40386c478b4a1c8de6c16aa20363d4beaa2659
MD5 4c961876f316a4b5ff5d8c905d7e29c8
SHA1 d26d0304cc7d3ba77edfdb54934466d272475bb3
SHA512 75884549e7bcbfadeb2f7f6293caa6ed782e79b9ea389180c312248361dd8c029f22f47c4b3e65234288b628a753f446d2d8631f0de7e82f90522ec8a0a22c73
TLSH
T13C01FE289318BE2A46784FAA0BBEB9403C02815B23170A6E6CCA897658174A11AA71D9
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.ls30kx1c_86dm3tkvacf5utqh.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.ls30kx1c_86dm3tkvacf5utqh.tmp
Size 712B
SHA256 a3ca9aae4ba31a89982b18f1b929accb9db7d06a8d786f433ef5ccc667409b1d
MD5 16999ee867612360e46db316fe54ca27
SHA1 50e290a12b234894b2452342926802170d4d1160
SHA512 ee2d4abd25d50db7ecf28fef26e7c2cc82d1cd657521a746e2ed73ed55f63ae772f9daba305ceb4302541c486153fbcf08aca2c8d4a69d066d65f51dc83b73c4
TLSH
T14701F4289318BF3646784FAA0F7DB6403C13815B13170A2A5CC7887648270D11A571D9
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.mtglitqtrzupgyl7nbe2hmq1f.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.mtglitqtrzupgyl7nbe2hmq1f.tmp
Size 4KB
SHA256 81c968c375f69d9e4666901fd4c14a6ce4b738639ff78488562e2c79f8fb14d8
MD5 a4e510ae4ca446423550859eb3193a92
SHA1 de1f946c7687a9cbc4e427c106e62691a203b67c
SHA512 f835d5adb86ab9feb23517a26a7054a6cfdaead71c3b3e0f2a2dea959376a119e7dad97f1c02bd5ad7d53ea7b1f42e65e9847e2842a290a7d4f6ca807cded707
SSDEEP 96:0AxANmAN4ANGAxAqAGAmvACANANzAFjTpOS/VjHH3HMbgrbF/x4JT9:zeTJzetx/ViGhPVLH3sUrNx4JT9
TLSH
T17B91E14A98E415D092308825A367E251AF0D4FE716CD80DCB9DCDA6D3FC53A791336A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.q6piwmhliflwoat8o4fxtzz9.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.q6piwmhliflwoat8o4fxtzz9.tmp
Size 10KB
SHA256 75dfb0389a765ad1302ba041f1d6ef560a57dae677cc5b6a71f9d60a208af6ef
MD5 a12e320e6e2eabaa082ed68a436bbe9d
SHA1 655e404db30dcc06a41e34d606991148f1a28b96
SHA512 bd43c6e6623ed75b3b2347d8a0809b74166f487b86d3946b7904caf774872759ac6e3f9f63ae72848f87699ddfaed3b066859572a3f5a647a85bf4d073f01a45
SSDEEP 192:wIYiYF8+2Qih7pdu8m78WzP7pDA+cdmL4pUQrNydK0CiC2:wIYistw7bu80rA+gmL4nNy80m2
TLSH
T107225BA388945C05EE07AD10B0D8963BAFB676963B90C1D37119C2968B913833FED1FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.z0vc7c7j4zre6yksheu12mvef.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.z0vc7c7j4zre6yksheu12mvef.tmp
Size 4KB
SHA256 322a6bbe4151c8c0d85b94a20e1566a69e7e19532fe6bb7ee4b5d806daea5366
MD5 9829c378f563249eafe72d677b821374
SHA1 cc15a1a414235d26265ebec559f4673fccf3ea58
SHA512 08f7e7d3c93880f6fde8f0dafefa7c36c247f12a67239fa77c129c5e790b99a33622c24e7c08259d39fa0570c1057308d3650e3e7776602dfd29821853418ff6
SSDEEP 96:0AxANmAN4ANGAxAqAGAmvACANANzAFqTQOS/VjHH3HRburbv/x4JT9:zeTJzetx/ViGcqVLH3xyrjx4JT9
TLSH
T1C991004A98E415D052308825A3B7E251AF0D4FA316CD80DCB9DCDA6D3FC63A795336E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WPS Office.lnk

Path C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk
Size 2KB
SHA256 dcb448b05f0ab67a0d8dbe7fd9812cb67efedef506af6cdf4e3a376124612a69
MD5 ed4936139fc3162bd3e47cd29f1ac821
SHA1 90c0ae3a0ffe19273a3cb7d5a6af4cef99912931
SHA512 b453dd8d87791bf6075586b4e4a7cee0c838df95dac6402f1f231d9978aab1d91755ead9be40bc15ed864fab4646e67981b58a919e2bff05a53b424c68bfd8f0
TLSH
T1F6513102D4C51B29E3FEED3666F25012A936BD66BE33C75D2042920D2A61E80DC65F6F
MD5 SHA1 SHA512 TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\id_ID\style.xml
Size 3KB
SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
MD5 034f37e6536c1430d55f64168b7e9f05
SHA1 dd08c0ef0d086dfbe59797990a74dab14fc850e2
SHA512 0e1911c882152a4e1059a3ce1880d7fb2aed1e1e36cbd37055de2e2a1333acb2a0233ba2a4d969ccebbef1e77809aa5e78807aa9239545beae8c548c0f8f35c0
TLSH
T1E381CA80A610BD0AC563F51573AB7509762CB36383ECCFC4F0EE2E698753652644B63E
MD5 SHA1 SHA512 TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\ms_MY\style.xml
Size 4KB
SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
MD5 394488b30107bcebb84a97ed5d754cee
SHA1 69ebe17f7d577e9bf69c87cff45c3251f0bbc86e
SHA512 24a6bc7debbf7030c1261c69cb4ae7bf3cbb5c7fac315188163c6001e58dfbe2e634925cb767044da7ea0e6d08c709b2ade02f6e43930819e1bef6f7569cad5a
SSDEEP 96:gd6SmSZcFe9gSs8TcySCSi58VS5eQJ/gQkgQ0/Mw8CclQgYzdr/PwiCSeDeR3ciw:gdAh8Ax
TLSH
T13FA17780A610BD0AC563A51977AB7909B62C736383ECCFC4F0EE3E658753692644B63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5CoreKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\office6\Qt5CoreKso.dll
Size 5.7MB
SHA256 0023708308320d43f9cdb9369038313c5869cfcf929b79661d0d4d886868c81f
MD5 ca368b6428a7088ac0da130ac2743e3c
SHA1 ffa99399d468107207822d8a2650ebd2ef12b8e7
SHA512 358535748d5f63006be504b009d283f6f93270e475a50abfe92418646a36a045bc005b4703f2b2805eb578787728bb31f5345477cb6e3ddd833dbfe89e92973c
SSDEEP 98304:fkcb4UbPsq23KAnJsv6tWKFdu9CkiTl4rUsca9:fkE4UbPj23pJsv6tWKFdu9CklUsca9
TLSH
T1FA567C47FA964269D8B6C238C9D7C127F673B80247214BCF2258A3496A777F0293F359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5GuiKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\office6\Qt5GuiKso.dll
Size 6.4MB
SHA256 37d4e68d09b0debd1d2aea08fe7cd74e56d7e7a0a6c26699917eedde782d0b89
MD5 817feedb34f8033009180df465ff6a26
SHA1 2a0451039d85b44130c2d6a8f0e3f86991bdc28f
SHA512 b98b729fbeb852fa9a85ee87d91a93b00dd9393d31d5d032aa04fa9a529c169717cc70c4e80ec8fc89f59be229c4bd855ace08aeb8cd99c5b904b91f37ae413c
SSDEEP 49152:Uu40pzgXwHAF8ytgn7LCGxgz7jpzw3ZmYmCdU1nYXJUyzoYKVkqvxoNz5LSaTNPq:Uu40ZX8J2llKVkaoZ1j94awUie/U
TLSH
T1EC66F886EA596359C972D17987CB041FE1F37C4283524BC36C15AB490E237EA1B7FE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5SvgKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\office6\Qt5SvgKso.dll
Size 503KB
SHA256 ab2ada0b6bb64a5ea6d1aa6892fd0228494634818fcaedc59f83fcf5ab86491e
MD5 1e5a707aa663bed8ca5844b9933a931d
SHA1 cb9bb4de68d49e0c1efd20c5193fe78f1693ede7
SHA512 6085fd8496e83fcc4c2fee59379be728b432ee75c92ead677526b05fa6a8285c6e57feffd981dc83169faa048832f96882825f5c3b253daa9190fec3a89102c0
SSDEEP 12288:AYYYJUNY675fyplktps52OPZUVLEgZ/ABXH9a/vngheZL/XEnEsrnJpaymesGrx9:AYYY475feys5VPZqvhBI
TLSH
T173B44A53FB520798D526D27CC9978812F2B3340443A39BDF2A5AEB641F236E1763E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WidgetsKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\office6\Qt5WidgetsKso.dll
Size 5.6MB
SHA256 a9657854687fb173d3efb23dc647ecec7822ab6457e84eaac52ea14b167f0664
MD5 4e284dd85f693a62a814de8ebea21d06
SHA1 d75cb8ff4b19cc702bc4f0a5367d95e0d945fbad
SHA512 9e0f573a8739ef66e5e73a9a72a4c45c2a9ebb9aa465a77c5c2cf93598b38414e5ec89f9918a8c1ac0050d49e6306ac55f9bff66b5d7f8952d5ed02cf5599b13
SSDEEP 49152:rt0iB1MWqh1szJddutfrgDQv1Prnce6YUv2Ossdz9jcUSEhwoKKkCDIovjUdZ4na:MWuUQ/LeDIovjUdZ4GsL6R/T
TLSH
T185465C47FBA50389C16BD13CCACB8513E2B2780447634BCB6969DB691F637E2197E780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WinExtrasKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\office6\Qt5WinExtrasKso.dll
Size 251KB
SHA256 9170eefececcfb1f1b997523a33628ff3472223253999b09fdd43f6309ca2b42
MD5 07de1298e062b6d219701830004eb02c
SHA1 f93b332358ed6df6663783496f226435395a1ae9
SHA512 c6427c019fbadaaf9455c0e6978729051bc0f007f1999c50ad92bc90203aa0bc4cc20a828d124a8867aafb19a23bd5751670a795b765e0000f810738ed8f4e53
SSDEEP 3072:jF5o5cKUM7YLBwcJf1+6Wc2sbm+xvN988+gh:jfpMulxvNR
TLSH
T15A449684B6DD9619F809B0B88FCCD199C223BAED8B47425F351ED39F4B619816E139F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kpacketui.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\office6\kpacketui.dll
Size 895KB
SHA256 c8daaad1d4e04578b418c1b59ee3a740d7073a030a7b7caa6a42e4ff86a27974
MD5 2bce41d266b3d161073c08603b3f0b83
SHA1 bdfaca26ae62ee7cccae93ebadc3118b22414abb
SHA512 b4ac5960895b77e6af8cd3bd5bb216147779655f7e2190137cf2ab1c1afdce23b2f0873b5188b7828a3fc0fc3223f072472ecf4920c867b56c15edf697b8ca5e
SSDEEP 12288:oIn2oeQaj2IPfFQrPXQ5xSWxOboWmilDMVF8WN:o/opajtfFQr/0DxIUb
TLSH
T159156B1FA7A143B9E029D13AC6D78813E172740643B25BEB5685EA393F733F11A3E650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\office6\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
Size 75KB
SHA256 df6e03ec82f63835f2a2ab5f04623e280d0f7d9f03b7575bcb7a2e1d34d1d94b
MD5 da06657b2705a8c26b2b6401727bed70
SHA1 888a0023bc78b009c8d2b9dca1ab0122226f266b
SHA512 8657002349b449af794d769643459383f831e3f3d627796d94355ebcdb21a61a0e0fe1f37fa6c11967000baed091e0e6f76a9868af40e4bb3358a9f9e3af0c31
SSDEEP 768:0oXOzQ/DBnTQxkUtwZfVKFkYQZM1Nj/bqTwQCF5/oXZSyipOu8bLYiDL9rA+J7ag:Ejf8ZVwQCF5QSyibmL7pu77jc
TLSH
T159737B93DB84069DE61B8634CAD5892BE6B2784207A183CF6724E3281F737D2397D3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
Size 46KB
SHA256 1b25512a5c582f378ca156527f32c140a4976d9b6b7d363e92d1ed04a7b5fd80
MD5 b43fa0539482f5013ae9b0a9acbb019b
SHA1 52066a663b99052292603945d810325b14eb65bd
SHA512 46cdc91d870bc06cece2b981edf91cc74959fdb400dd43a541662d5b68f32d0a92b1e6fd278aa6c3f1910d94daefa0a13204a1e116f0a9023839c7cd876988d3
SSDEEP 768:zg1GYaNdXpm9C0a2YiDL9rA+J7hxYi77eW4rA+hLm:4GYavpm9C0a27pn77j
TLSH
T19C236B97CF580809EA13D770B4C98A26F976B8515B9183CF2694C3690F563C23DBD3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qskia.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\office6\qt\plugins\platforms\qskia.dll
Size 1.9MB
SHA256 bb4c81f0983bfc9b302692f9763372f2c4c2f812a5de2636c90c5c95d542517d
MD5 d4ec7e791f18546eaa608e0670f91028
SHA1 f01b0eb7307db36df0de6d3bbb2800184768adb0
SHA512 d54cef3502f70bae67add2d9902d92c9377253f0e8e88a46bccf2cf889f7757cf33f1b8158574b8b70b9ddf57ed9af4f17fadbf9aaa4abd58debce3136b61986
SSDEEP 49152:wgL5POvhPbRRHLGyY2Jbt69eKySn5HmIJkkbk82a66kTcOa/S:yvBbqlS
TLSH
T112957D47E3744298C2A7C13D868B5F0BD6B1740543A19BDB22A0CF59EF237E22A7E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\office6\qt\plugins\platforms\qwindows.dll
Size 1.6MB
SHA256 489873f66b5c3d0817bd333342b6d11b34f08dad1b32b5a52d2d5b22c4258f18
MD5 62e5eaf7f6fa6c2eddf1a3e572d3a4a7
SHA1 fffd4d4f8e05f1ce200ea785d5c1bd193ce33a7d
SHA512 5190e6791da9188019bc5a9e87b55a327f53c435596721c9649fec72e5443efa91e547047ac0ec3359dcecefb9293922c36eed9696336f45714fc14f7e7b3769
SSDEEP 24576:3McfTgHfJU/thgaPYXQVNVHp3bfakMUpsLZd3Sq:7f8H61hgaP/DVHpLIU4
TLSH
T192757C43E3A44398C267C239C68B9A0BD77174050361ABDF25A19F59EF63BE3173A781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
Size 159KB
SHA256 182c0130c4b6379e680385f7f7c04d380db7e883af98c984269da3021af1d2b6
MD5 78ab291e02c3b3306e34095175f19fc2
SHA1 1dcddb4d95c1d89a3453d9bd975162ec2b588180
SHA512 de5ca7463d13aef26bbe77c159be3f2cb348036cb9b01358e4a5c08661d447258b79c9d908166b2261d937f355754fdb6236276c398e3be9561d524f6f4a2c10
SSDEEP 3072:XSApjXbrT36b96bavsTHnbNgJUGjCflEslctsS2kQ:XX6b96bavqHnbNpnflEslco
TLSH
T16EF33913F65243DAC527D2B8C19E0512F3B37444436257AF2966DBB82F53392BD3DA82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\office6\ucrtbase.dll
Size 987KB
SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
MD5 61eb0ad4c285b60732353a0cb5c9b2ab
SHA1 21a1bea01f6ca7e9828a522c696853706d0a457b
SHA512 44cd871f48b5193abb3b9664dbea8cdad19e72c47b6967c685cf1cc803bc9abb48a8a93009c972ef4936e7f78e3c92110828790aa0a9d26b80e6a523bbcd830d
SSDEEP 24576:xOPJ1g7mT6BNvwTOxNfoYotrz1111111r8SoKxmxvSZX0ypdNLh:xO1aNoaxNfo/+a
TLSH
T18D259E64F75C0AA6C17BE17CC95B550ED972340647608ACF03EA8BB97E2BBE91637310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\office6\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\office6\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\product.dat
Size 98KB
SHA256 694f339696e8a5fc662f09d9edf7403ebf8a0969829152189d2af37ab4d170d0
MD5 eac78d958f889c9dcb287c286c5247fe
SHA1 2db225f75b6e8395a86c547c6868c56d9891e013
SHA512 4f0356f3093d804183dcf1cef36e398fef1e53fe8d18b6c4ac41494a20fdd78cf56fcc49547d2630280e14ac5b215b07d8d564bbde9be212da511fa0623b8767
SSDEEP 1536:1yKvOpT+qaZnhBgrtZE6JjPHUAvSVxel50kyd2vnoD:1ybT+rZhBghu6JjvUAKV00kydenoD
TLSH
T183A37EF77E1D6BE49CCE233E5E37281CE9F9483525966448E282E5A5AC1C0B63CD790C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product_new.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a00fb\CONTROL\product_new.dat
Size 87KB
SHA256 e54c33cf180030f0d6196537997c2da471eac1f128e8630d0374601f26487a86
MD5 148cdd48ec5f04f6225cf7c24082d3ea
SHA1 8da7c0be3909f20a2e700f93bc6fb554d1846ffe
SHA512 3205f247ea4eb5ef559ae513775e844705a0563eb03180cfb8113df4216e529f776fa814983c1c11fa7cdccb493d895fc8fa439b23f2ef2309db2c2b40108944
SSDEEP 1536:I3Ccy44KRbbe/p9bcr5RDvxp2L5K0mv7shof/vRUme2spBXskeYzEy7m:QG4RX4orrX21LzhoPS6spBUZ
TLSH
T16B932B18ECD16EAD685052791D375D8227B7DDA1A0DD30AC4B11AA4CFC3CF887F63A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 387B
SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
MD5 c38481658f9149eba0b9b8fcbcb16708
SHA1 f16a40af74c0a04a331f7833251e3958d033d4da
SHA512 8f98d62f88442b8ef94aa10074e35aa8d9494f3c76ce8b143ca0bf7fa0d917f3175212fbcd6e7b0597fd0ec0e1b2827f157135512fb01c88218d36e2f7dd73ce
TLSH
T1D4E09B1BA8D1B0ABDEB302E988979D54BAC03D9A066D23147762540D3D32918FB41D65
MD5 SHA1 SHA512 TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 433B
SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
MD5 a9519168ca6299588edf9bd39c10828a
SHA1 9f0635e39d50d15af39f5e2c52ad240a428b5636
SHA512 0607eb1f5598320961fbd8ef75beeb1b6dc1af3cae7eeb5ba352f3e2a2edb25e1d9e68fb46c24e4299957352c0c906314c889c2d1092437eccc1d1a0485f3557
TLSH
T194E0540FA891B0679D7302F488E39C007AC03E96055D1210773144093C32A14FB81D69
MD5 SHA1 SHA512 TLSH

Submit Download

.wps_rw_test_1794423048198.tmp

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\backup\.wps_rw_test_1794423048198.tmp
Size 19B
SHA256 c852b10799e8ea6f0e671e6f31badfdbd03ad4b5c1d50642e1d625dc89e1b910
MD5 fefe5fa40116430e6a662873a371bb30
SHA1 62987c2d466f89f59a3c6368ff7d9ff3979d1266
SHA512 7c3a13b0e8c5e41c72882340e64efe67a7140f3472aacc42a13927dd73d20165a1b39c7381d8c6a346e76643bf1adbf52fa13f8bd458c00d6b4cca9103c85800
MD5 SHA1 SHA512

Submit Download

ids_v3_lang_128.ini

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\kfpccomb\ids_v3_lang_128.ini
Size 2KB
SHA256 ab0c51e80cd5b78186da28b2774e79e3a7d7c3f9467112c9c85abf059af465e5
MD5 4bac87a4963da3cb2cbb618d6e005557
SHA1 a746a80bfb7e485d4182a77552abb69f12cfa4d9
SHA512 d2f58ffe85b8e6623c755651545e98f24a952df3147fa0dd61decc7c17fa133675a7ef3d9436327bec067678c9551bc806a50e8d5e69f0dd02fba72fc75eabec
TLSH
T1644135CD8A7AD235429E2E05CBFBC35A4A33974D770A7403F5B4B21C488F7EA5881C40
MD5 SHA1 SHA512 TLSH

Submit Download

ids_v3_lang_60.ini

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\kfpccomb\ids_v3_lang_60.ini
Size 6KB
SHA256 0f3b4c9cb7a1c2072e8e85d254e1a75b3b151c9c39a3c2134b501f4b8c7a59a3
MD5 cb0b66e240c7f8e973b01c7614a59d41
SHA1 430d2037fd3c2a3d6b62726192b9b46b34d270a7
SHA512 4d7c05f3c295ef1696dca9e8a594d770475ef3c5be4b9f3a17ba083321b2097feeccfca2764d4a8515f1cb21259e6f026353ddcd27bc02caa179a641ada8d8e5
SSDEEP 192:6E64sAkcZP1ICU5FeqVD59QtVdc6uEWRUR+E:T64lkcZdNU5kq559Qt06ERURj
TLSH
T1D9D1EEDA0C2F89B9236B694482F58707BB33532D7B1EEA43F76177D96A0B7C584D2801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksomisc_2026_11_11.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_11_11.log
Size 4KB
SHA256 3a96534d1bf11690de6df63d96825e0778a2d6688e9499a16e8cece64113b461
MD5 89e6fbb636283d651d22232e16c615c1
SHA1 662a2140039370b3ded94170cc612c1062793f20
SHA512 336179b7e966bc2e6118454a18ecfaf2281e5fe5632f7ed33fcd474a5b71067c5b1c0d8e9e2049ed6168c3509b9ac083625e9d2ead245424fb55dd6ac9a51213
SSDEEP 96:PT6qYocBJiWontlgBJiWP+BJijb6qYoaBJiWoMHSBJi+HHMH6mHBJi+HaMHSBJiW:7RYrBGgBsByRYNBDyBjMamHBj/yBjznl
TLSH
T160A16F657AF85145F3F78F56A8FA44770E75BC92AD20D80E1990230E44A6AD0E8B133F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 10KB
SHA256 f1f12cd10527f74581fdacab31a1ba7565456fc57163cbf85f98c69e9d88e679
MD5 1a4a2a5fe254872e70563ac72bc82d07
SHA1 5313690cf1e3a72ebdf055cab0a17180106bee30
SHA512 e52ac89979aa16360e081d77a684bc5aaabc12926ca758fbfde241e2386e3fa5d34f185a87eedd4d56d906f4aa5c77dee3b33d7f2c96eae3d4b15ae2fa25c661
SSDEEP 96:03HYWl2m2DVyYum0cgBTT+ZFSqhggjER32qknoIJB4JMtWXbsgJLj2neB37nbFeV:0IWlNBHqZ9c3xpJ/7a
TLSH
T16A32CD53405E415C0BBA0FBA13768D49398A6DB9A74422CC6F3BDDBB4BCE0A1436E56C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 11KB
SHA256 244d4670060d1d6ae0074aa4885c6e2a051919af74dcea096cce5b24d0661b90
MD5 ef463e16a188bfc54bcfb923afc33f2f
SHA1 69d01a222a899bdf86b57413e894684315a68688
SHA512 cd8766eac0b19e28864091c662aee4924fc8ca7f511ce8c2f422c74997a46d334cc50b3734d8f4f232ba7a2437663f198402915872fcb22ca5271213a6597465
SSDEEP 96:03HYWl2m2DVyYum0cgBTT+ZFSqhggjER32qknoIJB4JMtWXbsgJLj2neB37nbFeB:0IWlNBHqZ9c3xpJ/7dLV5D2
TLSH
T1B842DC53405E415C0BBA0EBA13778D89358A6DB9A74426CC7F3BDDBB0BCE0A1436E56C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 27KB
SHA256 f130afd6cb83a9bbef44cb3ef678e4039800b3510ec6da4cfd96c4225c04916a
MD5 c2647e72dc94b5e329cc1c3edd9d52f8
SHA1 ad51986ca2526dfb62e70069362a469e6acf38ae
SHA512 90398230421a01e613e6ae630663bb052514efa93230ae3e492b7c3c3c951582e887be02bdddbd93c782f4368735d71fb15e6f703729b0f51b089a3a2931b6a4
SSDEEP 192:0IWlNBHqZ9c3xpJ/7dLV5Dyh4ucohDET240HTP5EPwkD+MUn1DUmVm9DEkd0wg/p:Lc3xrxnOLj
TLSH
T1DAD27753441E800917EF5BE002B98E5A308B5EBA375C268D7F3BC9B719EA551D3ECD28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 61KB
SHA256 defdcb930dcc811c9e2d280075ef41b5d366f1fc628bee360b3e265d4d4b2a8b
MD5 f9aa3e99621f11f948e36779c4bbaa9c
SHA1 768b3c5d4e7366a968ac05e078a62ddaffc43cc4
SHA512 2edb15a4c1f06cf5387dcba6708024adc955fadc819c4cff3ae53dc2cc8572e097526f031c0a5ec52850dd901da7fb660213de428df2d42f1ea3b54ef0295ef2
SSDEEP 192:0IWlNBHqZ9c3xpJ/7dLV5Dyh4ucohDET240HTP5EPwkD+MUn1DUmVm9DEkd0wg/9:Lc3xrxnOLifvb/e6cTRRAsjWK
TLSH
T17D5300530C1E80181BFF87E1057B4E4E304B697A76282E5C7F7BC87769D95128AEDA2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 68KB
SHA256 a7236bfa46c54dd0e9e3afbf32bb3413a793a2178e4c3cdfd8d7e693fd02a1fc
MD5 7ff551911fe3276d378cf63d1ab53298
SHA1 82afbbd20de86c59c62b43fa07e9268e4977e641
SHA512 9dacd93828c8286a52d7ed6bb1b22af1090bd0d157b64e440aa3c377741fee507d70bc24acff97910c67cc4e07bd336cc01bf9f89a2d9544a4b1d2d19bb40216
SSDEEP 192:0IWlNBHqZ9c3xpJ/7dLV5Dyh4ucohDET240HTP5EPwkD+MUn1DUmVm9DEkd0wg/S:Lc3xrxnOLifvb/e6cTRRAsjWgqJMF3I
TLSH
T13E6310530C1E80181BFF87D2457B4E4E304B697A761C2A5C7F7BD87B29D95128AECA2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpsupdate_2026_11_11.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\update\wpsupdate_2026_11_11.log
Size 2KB
SHA256 9a08019edc4bb8a7784dac15d5bdf7373c87a8891384ed39e89f479603ee22b4
MD5 fa92617ecbe3735c73eb0741ad60efcf
SHA1 dce325f90cde44d4fc78af41018e80d13613b2b0
SHA512 3db35fcb62fc5c5941429dba051b5a2ebc9bdeabc8d4fd2ca7c1fdad249de7b15ad64af6f8e4b2f634dd4e0d5cb4fbcd3013b147737a9e50c4d195f6f1e6a39c
TLSH
T18441700A38E5018B693BF85BC8FB0463937A726BA830DE4D01D1139F6ED2751B23875E
MD5 SHA1 SHA512 TLSH

Submit Download

mdbx.dat

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-x64\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat
Size 64KB
SHA256 471cadef677dc8adcdcf91bf3733c8e7bb082fa9a7c7a1ed0cca7d19be6a6130
MD5 ade7b9965525e91010c254867f3f6066
SHA1 9ff73fff56e44eef275907d3e166cf4954013e86
SHA512 95e949ed071fbe78819907f6edee54565b915f85020c928d836fe3d9c7d00cc70f356c8ceb862e12a55b2bacfd5631c2ff107544d638e9d9d62e8da67449d3b7
SSDEEP 192:SIOLZ350+hgSOLZ350iUw3XfVOm6StJM:S9jpO/j6wcNSM
TLSH
T10F536C9CD2E51FF8E9BE057CE4184D0BE3E64788D7196F46301623087843ABC72B599E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcsdk_dpv3.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
Size 47KB
SHA256 746b62b09c8ada80e4b267665d48e1a6632ab8aa709a606cf86c864cef14fcbd
MD5 cf5aa8797938c22114082892df555081
SHA1 254ad501030fccd7989fde5bd407ea2ea0683b5d
SHA512 29c42451c8010aff71fdd08544bbaab9166e2377b56e861121cc7336cf6976774db61ee711a48dc2064feb30ee4f0a2e2b29c0f8b06e47ed82f623748f3fa669
SSDEEP 768:6YwFa8RbbFZhDq9SYBaMdCMwWE0Pq4l2ltOHL9SDb+ZPsqAN:m04bbDhDq9SYBVEqhhK
TLSH
T1BE230196B7FA1558F6F71FA569B968948C3A7DD22C09E4EC01502C8E0932F90EDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcsdk_dpv3.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
Size 42KB
SHA256 e0cf3a8a84567d2ba697e08aa536c3fefd8e616eab799a74dc4d8d6eb14a6f30
MD5 f83f060ddc7ad79fd5424983e6f80df3
SHA1 2e4c35b154695dffaaa84cd18fd69e130721ed3f
SHA512 d9f2eb8bd9855e2604ad31188260fcf1c12c333840651682b1f595540fcd795ae651614591344beb2313b7d8d626c580a022966a13d964550cf7b1bdfc8b6901
SSDEEP 768:hO8g6/bAFvHDB9SYBazRdBMITkO8NQ6fqAkDbPNPLmAE:EAbAlHDB9SYBU1kO8er96
TLSH
T16C131396BBF91558F6F72F6569B968944C3A7DD22C08E4EC01612C8E0932F90EDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/624-9645-0x00007FFC67210000-0x00007FFC67CD1000-memory.dmp

Download

memory/624-9643-0x00007FFC69060000-0x00007FFC695EE000-memory.dmp

Download

memory/624-9640-0x00007FFC69960000-0x00007FFC6B4F5000-memory.dmp

Download

memory/624-9639-0x00007FF6D1BE0000-0x00007FF6D1FA4000-memory.dmp

Download

memory/624-9642-0x00007FFC687C0000-0x00007FFC689DA000-memory.dmp

Download

memory/624-9641-0x00007FFC6B500000-0x00007FFC6C0C9000-memory.dmp

Download

memory/624-9644-0x00007FFC60B30000-0x00007FFC62A62000-memory.dmp

Download

memory/1356-9862-0x00007FFC6B500000-0x00007FFC6C0C9000-memory.dmp

Download

memory/1356-9878-0x00007FFC69960000-0x00007FFC6B4F5000-memory.dmp

Download

memory/1356-9879-0x00007FF6D1BE0000-0x00007FF6D1FA4000-memory.dmp

Download

memory/1356-9863-0x00007FFC687C0000-0x00007FFC689DA000-memory.dmp

Download

memory/1356-9866-0x00007FFC67210000-0x00007FFC67CD1000-memory.dmp

Download

memory/1356-9865-0x00007FFC60B30000-0x00007FFC62A62000-memory.dmp

Download

memory/1356-9864-0x00007FFC69060000-0x00007FFC695EE000-memory.dmp

Download

memory/1808-9670-0x00007FFC69960000-0x00007FFC6B4F5000-memory.dmp

Download

memory/1808-9673-0x00007FFC69060000-0x00007FFC695EE000-memory.dmp

Download

memory/1808-9675-0x00007FFC67210000-0x00007FFC67CD1000-memory.dmp

Download

memory/1808-9674-0x00007FFC60B30000-0x00007FFC62A62000-memory.dmp

Download

memory/1808-9671-0x00007FFC6B500000-0x00007FFC6C0C9000-memory.dmp

Download

memory/1808-9669-0x00007FF6D1BE0000-0x00007FF6D1FA4000-memory.dmp

Download

memory/1808-9672-0x00007FFC687C0000-0x00007FFC689DA000-memory.dmp

Download

memory/1976-10020-0x00007FFC60B30000-0x00007FFC62A62000-memory.dmp

Download

memory/1976-10021-0x00007FFC67210000-0x00007FFC67CD1000-memory.dmp

Download

memory/1976-10019-0x00007FFC69060000-0x00007FFC695EE000-memory.dmp

Download

memory/1976-10017-0x00007FFC6B500000-0x00007FFC6C0C9000-memory.dmp

Download

memory/1976-10015-0x00007FF6D1BE0000-0x00007FF6D1FA4000-memory.dmp

Download

memory/1976-10018-0x00007FFC687C0000-0x00007FFC689DA000-memory.dmp

Download

memory/1976-10016-0x00007FFC69960000-0x00007FFC6B4F5000-memory.dmp

Download

memory/2296-10014-0x0000000005970000-0x0000000005996000-memory.dmp

Download

memory/2296-10013-0x0000000003390000-0x000000000339A000-memory.dmp

Download

memory/2296-9999-0x0000000000FC0000-0x0000000000FC8000-memory.dmp

Download

memory/2640-9974-0x00007FFC6B500000-0x00007FFC6C0C9000-memory.dmp

Download

memory/2640-9973-0x00007FFC69060000-0x00007FFC695EE000-memory.dmp

Download

memory/3720-10052-0x00007FFC4F1F0000-0x00007FFC4F200000-memory.dmp

Download

memory/3720-10041-0x0000000003400000-0x0000000003401000-memory.dmp

Download

memory/3720-10040-0x00000000034B0000-0x00000000034D0000-memory.dmp

Download

memory/3904-9621-0x00007FFC4EE10000-0x00007FFC4EE20000-memory.dmp

Download

memory/3904-9607-0x00007FFC69060000-0x00007FFC695EE000-memory.dmp

Download

memory/3904-9619-0x00007FFC4EE10000-0x00007FFC4EE20000-memory.dmp

Download

memory/3904-9622-0x00007FFC4EE10000-0x00007FFC4EE20000-memory.dmp

Download

memory/3904-9618-0x00007FFC4EE10000-0x00007FFC4EE20000-memory.dmp

Download

memory/3904-9617-0x00007FFC4EE10000-0x00007FFC4EE20000-memory.dmp

Download

memory/3904-9616-0x00007FFC4EE10000-0x00007FFC4EE20000-memory.dmp

Download

memory/3904-9623-0x00007FFC4EE10000-0x00007FFC4EE20000-memory.dmp

Download

memory/3904-9608-0x00007FFC687C0000-0x00007FFC689DA000-memory.dmp

Download

memory/3904-9610-0x00007FF6D1BE0000-0x00007FF6D1FA4000-memory.dmp

Download

memory/3904-9615-0x00007FFC4EE10000-0x00007FFC4EE20000-memory.dmp

Download

memory/3904-9611-0x00007FFC6B500000-0x00007FFC6C0C9000-memory.dmp

Download

memory/3904-9620-0x00007FFC4EE10000-0x00007FFC4EE20000-memory.dmp

Download

memory/3904-9613-0x00007FFC69960000-0x00007FFC6B4F5000-memory.dmp

Download

memory/3904-9612-0x00007FFC60B30000-0x00007FFC62A62000-memory.dmp

Download

memory/3904-9609-0x00007FFC67210000-0x00007FFC67CD1000-memory.dmp

Download

memory/3904-9614-0x00007FFC4FF20000-0x00007FFC4FF30000-memory.dmp

Download

memory/3904-9624-0x00007FFC4EE10000-0x00007FFC4EE20000-memory.dmp

Download

memory/5360-478-0x00007FFC6D0A0000-0x00007FFC6D62E000-memory.dmp

Download

memory/5496-9846-0x00007FFC69060000-0x00007FFC695EE000-memory.dmp

Download

memory/5496-9832-0x00007FF6D1BE0000-0x00007FF6D1FA4000-memory.dmp

Download

memory/5496-9845-0x00007FFC687C0000-0x00007FFC689DA000-memory.dmp

Download

memory/5496-9849-0x00007FFC67210000-0x00007FFC67CD1000-memory.dmp

Download

memory/5496-9847-0x00007FFC60B30000-0x00007FFC62A62000-memory.dmp

Download

memory/5496-9842-0x00007FFC69960000-0x00007FFC6B4F5000-memory.dmp

Download

memory/5496-9844-0x00007FFC6B500000-0x00007FFC6C0C9000-memory.dmp

Download

memory/5564-10051-0x00007FFC67210000-0x00007FFC67CD1000-memory.dmp

Download

memory/5564-10049-0x00007FFC6B500000-0x00007FFC6C0C9000-memory.dmp

Download

memory/5564-10047-0x00007FF6D1BE0000-0x00007FF6D1FA4000-memory.dmp

Download

memory/5564-10046-0x00007FFC69060000-0x00007FFC695EE000-memory.dmp

Download

memory/5564-10045-0x00007FFC687C0000-0x00007FFC689DA000-memory.dmp

Download