Overview

overview

6

Static

static

1

2024-06-05...il.exe

windows7-x64

6

2024-06-05...il.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    62s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/06/2024, 12:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-05_2f0b206753d27b470f7ecf57669ef5a6_avoslocker_magniber_revil.exe
  • Size 5.6MB
  • Sample240605-p3dkqsgf72
  • SHA256 284d342758e15500884eda4f4ae8fdb0fd62c645e76a99e1a5f36565de577fae
  • MD5 SHA1 SHA512 SSDEEP
Score
6/10
bootkitdiscoveryevasionpersistencetrojan

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 64 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-05_2f0b206753d27b470f7ecf57669ef5a6_avoslocker_magniber_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-05_2f0b206753d27b470f7ecf57669ef5a6_avoslocker_magniber_revil.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Checks computer location settings
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3092
    • C:\Users\Admin\AppData\Local\Temp\wps_download\275a1a2f6ab4ada14302fff8c1081854-15_setup_XA_mui_Free.exe.500.2086.exe
      C:\Users\Admin\AppData\Local\Temp\wps_download\275a1a2f6ab4ada14302fff8c1081854-15_setup_XA_mui_Free.exe.500.2086.exe -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system certificate store
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1780
      • C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe
        "C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" InstallService
        3⤵
        • Checks whether UAC is enabled
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4008
      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\ksomisc.exe
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\ksomisc.exe" -installregister sharedMemory_message_E583803
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3020
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\kmso2pdfplugins.dll"
          4⤵
            PID:3224
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\kmso2pdfplugins64.dll"
            4⤵
              PID:1284
              • C:\Windows\system32\regsvr32.exe
                /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\kmso2pdfplugins64.dll"
                5⤵
                  PID:4928
            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\ksomisc.exe
              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\ksomisc.exe" -sendinstalldyn 5
              3⤵
              • Executes dropped EXE
              • Modifies system certificate store
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:2176
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\addons\html2pdf\html2pdf.dll"
              3⤵
                PID:1500
              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\ksomisc.exe
                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\\office6\ksomisc.exe" -defragment
                3⤵
                  PID:4336
            • C:\Users\Admin\AppData\Local\Temp\wps_download\275a1a2f6ab4ada14302fff8c1081854-15_setup_XA_mui_Free.exe.500.2086.exe
              "C:\Users\Admin\AppData\Local\Temp\wps_download\275a1a2f6ab4ada14302fff8c1081854-15_setup_XA_mui_Free.exe.500.2086.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E57B40E -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e57b0e1\
              1⤵
              • Writes to the Master Boot Record (MBR)
              • Executes dropped EXE
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:776
              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\ksomisc.exe
                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode
                2⤵
                • Executes dropped EXE
                • Suspicious behavior: AddClipboardFormatListener
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:3136
              • C:\Windows\SysWOW64\regsvr32.exe
                "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\kwpsmenushellext64.dll"
                2⤵
                  PID:2592
                  • C:\Windows\system32\regsvr32.exe
                    /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\kwpsmenushellext64.dll"
                    3⤵
                      PID:3008
                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\wpsupdate.exe
                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\wpsupdate.exe" /from:setup
                    2⤵
                      PID:848
                      • C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe
                        "C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" CheckService
                        3⤵
                          PID:1944
                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\wpsupdate.exe
                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\wpsupdate.exe" -createtask
                        2⤵
                          PID:4992
                          • C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe
                            "C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" CheckService
                            3⤵
                              PID:1884
                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\ksomisc.exe
                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\ksomisc.exe" -installregister sharedMemory_message_E582110 -forceperusermode
                          1⤵
                          • Writes to the Master Boot Record (MBR)
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Registers COM server for autorun
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious behavior: AddClipboardFormatListener
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:528
                          • C:\Windows\SysWOW64\regsvr32.exe
                            "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\kmso2pdfplugins.dll"
                            2⤵
                            • Loads dropped DLL
                            PID:4268
                          • C:\Windows\SysWOW64\regsvr32.exe
                            "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\kmso2pdfplugins64.dll"
                            2⤵
                            • Loads dropped DLL
                            • Suspicious use of WriteProcessMemory
                            PID:680
                            • C:\Windows\system32\regsvr32.exe
                              /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\kmso2pdfplugins64.dll"
                              3⤵
                              • Loads dropped DLL
                              • Registers COM server for autorun
                              PID:1088
                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\wps.exe
                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\wps.exe" Run "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\addons\ktaskschdtool\ktaskschdtool.dll" /task=wpsexternal /createtask
                            2⤵
                              PID:536
                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\wps.exe
                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\wps.exe" CheckService
                                3⤵
                                  PID:2528
                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\wps.exe
                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\wps.exe" Run -User=Admin -Entry=EntryPoint "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.17119/office6/addons/ktaskschdtool/ktaskschdtool.dll" /user=Admin /task=wpsexternal /cleantask /pid=536 /prv
                                  3⤵
                                    PID:684
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\SysWOW64\cmd.exe"
                                  2⤵
                                    PID:4240

                                Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      Qt5NetworkKso.dll
                                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\Qt5NetworkKso.dll
                                      • Size 1.1MB
                                      • SHA256 2096babaf761fe336d51d118f9477d24d9b07e282a06c263cc49d5e5a461273c
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      Qt5XmlKso.dll
                                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\Qt5XmlKso.dll
                                      • Size 169KB
                                      • SHA256 5293985c5dfe52733da3bc5b4fbf54bf214cd61778cdc798d4507dd976da7365
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      kpluginconfigcenter.dll
                                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\addons\kpluginconfigcenter\kpluginconfigcenter.dll
                                      • Size 2.4MB
                                      • SHA256 8b87990e8b82bd6d5d7f093d385bffe714f54b5111fb72df799e73fc8e696a0c
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      version.ini
                                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\addons\kpluginconfigcenter\version.ini
                                      • Size 43B
                                      • SHA256 69d7ea0ffbdbbc5dcb51efe9a4759a57d358440c90b26098bf94c956fa6dd611
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      kwpsaigc.qm
                                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\addons\kwpsaigc\mui\pt_BR\kwpsaigc.qm
                                      • Size 334B
                                      • SHA256 984ebeef80f6f50907afb92e5b5ae72df49fce045552c118a77a8887cc98e19b
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      history.js
                                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\addons\qing\mui\default_xa\res\clouddiskhomepage\static\js\pt_PT\history.js
                                      • Size 198KB
                                      • SHA256 910eada285d4900ea8e36faf305f731cfb200b317ea866839f5f4864a9dfc09b
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      setup.cfg
                                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\cfgs\setup.cfg
                                      • Size 401B
                                      • SHA256 552357da38203236932cda2a1566f281e70bffa0fea95fc3c0fc8da4a10a8904
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      setup.cfg
                                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\cfgs\setup.cfg
                                      • Size 433B
                                      • SHA256 4010bcceefcbc7d63bd7c60d1b927a89ac924d7243f50fb388485fea79276048
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      kbase.dll
                                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\kbase.dll
                                      • Size 55KB
                                      • SHA256 6528b1dc10ca5e8c66b8b7cff4a6efecc1331ef54594216e515a115beb4fde9b
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      krpt.dll
                                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\krpt.dll
                                      • Size 86KB
                                      • SHA256 a78d02befdf6f078f48f4e185f4cbff2d2e321c605e97d50656e11a02fe6304b
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      krt.dll
                                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\krt.dll
                                      • Size 1008KB
                                      • SHA256 d03d98e6709e37a352cc8172bcdde3ab0c280d695093ef0c609a3c51ca88a582
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      ksolite.dll
                                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\ksolite.dll
                                      • Size 9.4MB
                                      • SHA256 e37f7861034052f576c37661921348369067858a5bc4401a2aac19631b61de27
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      ksomisc.exe
                                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\ksomisc.exe
                                      • Size 3.0MB
                                      • SHA256 d89549326987b07d292db22f2eb8bcc6e409041bda8843a522554240b4a28b66
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      ent_background_2019_wpsoffice.png
                                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\mui\ja_JP\resource\splash\hdpi\2x\ent_background_2019_wpsoffice.png
                                      • Size 236KB
                                      • SHA256 5e7ba996d2331f37b9799767c0fa806cab9a39fea434796ab08dcaf39096e334
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      qt.conf
                                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\qt.conf
                                      • Size 271B
                                      • SHA256 b54bcf83fa006bf38dc845507e31dd5ae559ed68d45acc12ae1561142661a7d8
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      qdirect2d.dll
                                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\qt\plugins\platforms\qdirect2d.dll
                                      • Size 1.4MB
                                      • SHA256 aaa19214d9830767c7ee2e80a53d82517683b4e0d1f9e9172669c7e391a9c87b
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      wpscloudsvr.exe
                                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\office6\wpscloudsvr.exe
                                      • Size 1011KB
                                      • SHA256 3092410b76fe693f2a72288a2edac0000bd395543cb53f7769a9b1b4c445a7c7
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      install.ini
                                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\utility\install.ini
                                      • Size 499B
                                      • SHA256 ac4f26a184114522200169c5f57a0af4498a20d19b7ec6def14dd2c6413eb475
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      install.ini
                                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.17119\utility\install.ini
                                      • Size 675B
                                      • SHA256 2756ea4b567920c5a18f0010033a45653637e5882cc9001bb50bfdb8ceabfa99
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      WPS Office.lnk
                                      • Path C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk
                                      • Size 2KB
                                      • SHA256 eb0905196eba9ac28361216c8b94fd66bced4e3ef01962152001d86a448a735e
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      Qt5CoreKso.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e57b0e1\CONTROL\office6\Qt5CoreKso.dll
                                      • Size 5.0MB
                                      • SHA256 3043dde86a98ffc3a2c7525ae54ed28fb35e6fe1508be9b1ab860ae1cea74366
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      Qt5GuiKso.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e57b0e1\CONTROL\office6\Qt5GuiKso.dll
                                      • Size 5.3MB
                                      • SHA256 d41552b695cdaf895bba5b165a6af36f7a647c60c2d8b780b8764b30d34d9669
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      Qt5SvgKso.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e57b0e1\CONTROL\office6\Qt5SvgKso.dll
                                      • Size 378KB
                                      • SHA256 0361b1e69036a1e8bf380d88a09aca50e011fd0f3d27578588b06bbe86d8377c
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      Qt5WidgetsKso.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e57b0e1\CONTROL\office6\Qt5WidgetsKso.dll
                                      • Size 4.4MB
                                      • SHA256 9eaa9a7017f113fb0a661911d202f24a1f27fb5fe1c30170bcdeaf3446c34b64
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      Qt5WinExtrasKso.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e57b0e1\CONTROL\office6\Qt5WinExtrasKso.dll
                                      • Size 445KB
                                      • SHA256 7189bb480b8512cb942747d1f17d01f54ecc80a7af2bb687d39d4a3a68a8fdae
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      dbghelp.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e57b0e1\CONTROL\office6\dbghelp.dll
                                      • Size 1.2MB
                                      • SHA256 b0c26596939181c7d3a59ce5489735da08bf72fccfeb7fb49b9d267e5129ba7e
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      kpacketui.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e57b0e1\CONTROL\office6\kpacketui.dll
                                      • Size 2.9MB
                                      • SHA256 9cb68571a426f0911c6892345c6c34899252e5a4dbd347a7e0b801ece5c44fcc
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      msvcp140.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e57b0e1\CONTROL\office6\msvcp140.dll
                                      • Size 439KB
                                      • SHA256 02c7259456eac8cbadfb460377ba68e98282400c7a4a9d0bf49b3313ef6d554d
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      qsvgicon.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e57b0e1\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
                                      • Size 61KB
                                      • SHA256 f26db47c4c163e10276e3b18f5c1b9a9ba18626067b94b631fcc29027f33dbfb
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      qsvg.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e57b0e1\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
                                      • Size 41KB
                                      • SHA256 8986e95bf3b353570c59a6d62984b0900d89bbaecd5f8e9cc4c693aa86d90540
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      qwindows.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e57b0e1\CONTROL\office6\qt\plugins\platforms\qwindows.dll
                                      • Size 1.3MB
                                      • SHA256 08c19cef9c4750ec97719f741beb0af1bf38121b45dda7fc240efccdf87727e7
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      windowsprintersupport.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e57b0e1\CONTROL\office6\qt\plugins\printsupport\windowsprintersupport.dll
                                      • Size 70KB
                                      • SHA256 31d3fbdcca896670a950ef4eb662e1e1e6cf7b38f1cfc15c59e3c411f4b6561f
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      qwindowsvistastyle.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e57b0e1\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
                                      • Size 146KB
                                      • SHA256 377f226589f6275acbfa14c62d47805f7fb3bea25a69676fd02d1fd2f4c44e4b
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      ucrtbase.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e57b0e1\CONTROL\office6\ucrtbase.dll
                                      • Size 1.1MB
                                      • SHA256 2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      vcruntime140.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e57b0e1\CONTROL\office6\vcruntime140.dll
                                      • Size 81KB
                                      • SHA256 ff9c1123cff493a8f5eacb91115611b6c1c808b30c82af9b6f388c0ef1f6b46d
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      style.xml
                                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e57b0e1\CONTROL\pl_PL\style.xml
                                      • Size 3KB
                                      • SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      product.dat
                                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e57b0e1\CONTROL\product.dat
                                      • Size 113KB
                                      • SHA256 95400d62c7eb6fe4804e42dd2a273186bd92dd3ceaa4ee6534c60d0436f46459
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      tempinstall.ini
                                      • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                                      • Size 387B
                                      • SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      tempinstall.ini
                                      • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                                      • Size 433B
                                      • SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      3MGIE4I1IDOEVQRMJJTC.temp
                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3MGIE4I1IDOEVQRMJJTC.temp
                                      • Size 8KB
                                      • SHA256 156fc375ed6b5aa7a158cfba1209ecdd9f06c6a164f749f7183393b64a038ee9
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      onlineconfig.data
                                      • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cfg\onlineconfig.data
                                      • Size 907KB
                                      • SHA256 6a0bf01ba4eb9d335fc660c51ab985eab534ec3e56f64f897a392798e52c406c
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      ksomisc_2024_06_05.log
                                      • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2024_06_05.log
                                      • Size 4KB
                                      • SHA256 84a5bbddc26a54374dbebaaa25c45ca8173a94bbfd56fed50e50d77b92c0ca08
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      ksomisc_2024_06_05.log
                                      • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2024_06_05.log
                                      • Size 5KB
                                      • SHA256 64debcdc3c386a924e5dd7f243756c2fcc0be22193e9bbe3a2e07d149267d93d
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      wpssetup.log
                                      • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                      • Size 11KB
                                      • SHA256 c23b2e493743a85b8fa2b6d95b1983fb1df2c82d7b7280def10fcef6c75194dc
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      wpssetup.log
                                      • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                      • Size 12KB
                                      • SHA256 104ed45351225199c432569b85dac1c8c4e5aec5a56bc120900854bc27742b5a
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      wpssetup.log
                                      • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                      • Size 736B
                                      • SHA256 ab8866d23cee357f28330f915cb941dc9a23d5f05e122349fe45951a6c825b88
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      wpssetup.log
                                      • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                      • Size 29KB
                                      • SHA256 053178bdf45db147ec2b2749b72b89e63c9ec22838c5153cff1b013df32b24b3
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      wpssetup.log
                                      • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                      • Size 47KB
                                      • SHA256 d2e30db803a760161dfc21702ce8e272253d7dbc3eb511b29c3b4148b854be0d
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      wpssetup.log
                                      • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                      • Size 48KB
                                      • SHA256 ea86af1049a14dee258cb6f8aa480db328043bff1f6090602975aacbaa3bc46b
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      memory/528-4200-0x0000000037CC0000-0x0000000037CD0000-memory.dmp
                                      Download

                                      memory/528-4222-0x000000006B8A0000-0x000000006BF76000-memory.dmp
                                      Download

                                      memory/528-4208-0x000000006F820000-0x0000000070191000-memory.dmp
                                      Download

                                      memory/528-4223-0x000000006C000000-0x000000006F047000-memory.dmp
                                      Download

                                      memory/536-4546-0x000000006C000000-0x000000006F047000-memory.dmp
                                      Download

                                      memory/536-4545-0x000000006F820000-0x0000000070191000-memory.dmp
                                      Download

                                      memory/536-4547-0x000000006B8A0000-0x000000006BF76000-memory.dmp
                                      Download

                                      memory/684-4549-0x000000006F820000-0x0000000070191000-memory.dmp
                                      Download

                                      memory/684-4550-0x000000006B8A0000-0x000000006BF76000-memory.dmp
                                      Download

                                      memory/684-4548-0x000000006C000000-0x000000006F047000-memory.dmp
                                      Download

                                      memory/848-4651-0x000000006F820000-0x0000000070191000-memory.dmp
                                      Download

                                      memory/848-4652-0x000000006B8A0000-0x000000006BF76000-memory.dmp
                                      Download

                                      memory/848-4653-0x000000006C000000-0x000000006F047000-memory.dmp
                                      Download

                                      memory/1088-4309-0x00007FFA460F0000-0x00007FFA46100000-memory.dmp
                                      Download

                                      memory/1088-4310-0x00007FFA46190000-0x00007FFA461A0000-memory.dmp
                                      Download

                                      memory/1780-4842-0x0000000072C50000-0x00000000730C1000-memory.dmp
                                      Download

                                      memory/1780-4840-0x0000000073130000-0x00000000731B1000-memory.dmp
                                      Download

                                      memory/1780-4850-0x0000000071EF0000-0x0000000071EFF000-memory.dmp
                                      Download

                                      memory/1780-4841-0x00000000730D0000-0x000000007312E000-memory.dmp
                                      Download

                                      memory/1780-4849-0x0000000071F00000-0x0000000071F0A000-memory.dmp
                                      Download

                                      memory/1780-4838-0x00000000734B0000-0x00000000735CF000-memory.dmp
                                      Download

                                      memory/1780-4848-0x0000000071F10000-0x0000000071F33000-memory.dmp
                                      Download

                                      memory/1780-4845-0x0000000072170000-0x00000000721DF000-memory.dmp
                                      Download

                                      memory/1780-4846-0x0000000072150000-0x0000000072164000-memory.dmp
                                      Download

                                      memory/1780-4839-0x00000000731C0000-0x00000000734AA000-memory.dmp
                                      Download

                                      memory/1780-4844-0x00000000721E0000-0x0000000072737000-memory.dmp
                                      Download

                                      memory/1780-4843-0x0000000072740000-0x0000000072C43000-memory.dmp
                                      Download

                                      memory/1780-4847-0x0000000071FB0000-0x00000000720F9000-memory.dmp
                                      Download

                                      memory/2176-4459-0x000000006F820000-0x0000000070191000-memory.dmp
                                      Download

                                      memory/2176-4472-0x000000006B8A0000-0x000000006BF76000-memory.dmp
                                      Download

                                      memory/2176-4468-0x000000006C000000-0x000000006F047000-memory.dmp
                                      Download

                                      memory/3020-4322-0x000000006B8A0000-0x000000006BF76000-memory.dmp
                                      Download

                                      memory/3020-4318-0x000000006F820000-0x0000000070191000-memory.dmp
                                      Download

                                      memory/3020-4323-0x000000006C000000-0x000000006F047000-memory.dmp
                                      Download

                                      memory/3136-4471-0x000000006B8A0000-0x000000006BF76000-memory.dmp
                                      Download

                                      memory/3136-4470-0x000000006C000000-0x000000006F047000-memory.dmp
                                      Download

                                      memory/3136-4462-0x000000006F820000-0x0000000070191000-memory.dmp
                                      Download

                                      memory/3224-4689-0x000000006E900000-0x000000006E910000-memory.dmp
                                      Download

                                      memory/4268-4308-0x000000006E900000-0x000000006E910000-memory.dmp
                                      Download

                                      memory/4268-4307-0x000000006E870000-0x000000006E880000-memory.dmp
                                      Download

                                      memory/4336-4832-0x000000006BE50000-0x000000006EE97000-memory.dmp
                                      Download

                                      memory/4336-4819-0x000000006F820000-0x0000000070191000-memory.dmp
                                      Download

                                      memory/4336-4834-0x000000006B690000-0x000000006BD66000-memory.dmp
                                      Download

                                      memory/4928-4691-0x00007FFA46190000-0x00007FFA461A0000-memory.dmp
                                      Download

                                      memory/4992-4670-0x000000006B8A0000-0x000000006BF76000-memory.dmp
                                      Download

                                      memory/4992-4669-0x000000006F820000-0x0000000070191000-memory.dmp
                                      Download

                                      memory/4992-4671-0x000000006C000000-0x000000006F047000-memory.dmp
                                      Download