a13eb3f15d48c0f9a45376cd79e0a8e1f72cf4f55ff26a04242170283abd68d2

Analysis

max time kernel
88s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wps_office_inst.exe
Size 5.2MB
Sample260623-js4raabv7z
SHA256 a13eb3f15d48c0f9a45376cd79e0a8e1f72cf4f55ff26a04242170283abd68d2
MD5 5203a6690628895cfa680026e7bac843
SHA1 c4bbc6a857c18bfb03ac0e0603f0d4ffc427f13f
SHA512 3081d9329defd956564e7fa526c101e13d69600c058400c7b056a8f4fe6f02bc88dc9e10c79b1be5b02999ad695899130a8b6d56094851ad5d52e9eb16678ecc
SSDEEP 98304:1tSuMOINjO91x364DThTx4NVMFb/55PU/yO3:mMJcM9/5Rwb
TLSH
T12F46BF01BB85C5F1E5D201B0597AAB7A983DBE28573088C7A7D11D2A88312D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Unexpected DNS network traffic destination 16 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	223.6.6.6
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	223.6.6.6
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	119.29.29.29
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	119.29.29.29

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1152	ksomisc.exe

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	wps_office_inst.exe
File opened for modification	\??\PhysicalDrive0	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
File opened for modification	\??\PhysicalDrive0	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
File opened for modification	\??\PhysicalDrive0	ksomisc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 7 IoCs

pid	Process
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
2752	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5600	ksomisc.exe
3520	ksomisc.exe
4728	ksomisc.exe
2236	ksomisc.exe
1264	ksomisc.exe

Loads dropped DLL 64 IoCs

pid	Process
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wps_office_inst.exe

Modifies system certificate store 2 TTPs 64 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TrustedDevices	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TestSignRoot	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\FlightRoot	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\FlightRoot	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\OemEsim	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	wps_office_inst.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	wps_office_inst.exe

Suspicious behavior: AddClipboardFormatListener 5 IoCs

pid	Process
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
3520	ksomisc.exe
4728	ksomisc.exe
2236	ksomisc.exe
1264	ksomisc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3532	wps_office_inst.exe
3532	wps_office_inst.exe
3532	wps_office_inst.exe
3532	wps_office_inst.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
2752	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
2752	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
2752	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
2752	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
2752	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
2752	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
2752	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
2752	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
2752	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
2752	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
2752	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
2752	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
5600	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe
3520	ksomisc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
Token: SeRestorePrivilege	5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
Token: SeRestorePrivilege	5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
Token: SeRestorePrivilege	5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
Token: SeRestorePrivilege	5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
Token: SeDebugPrivilege	5600	ksomisc.exe
Token: SeDebugPrivilege	3520	ksomisc.exe
Token: SeLockMemoryPrivilege	3520	ksomisc.exe
Token: SeDebugPrivilege	4728	ksomisc.exe
Token: SeLockMemoryPrivilege	4728	ksomisc.exe
Token: SeDebugPrivilege	2236	ksomisc.exe
Token: SeLockMemoryPrivilege	2236	ksomisc.exe
Token: SeDebugPrivilege	1264	ksomisc.exe
Token: SeLockMemoryPrivilege	1264	ksomisc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
3520	ksomisc.exe
3520	ksomisc.exe
4728	ksomisc.exe
4728	ksomisc.exe
4728	ksomisc.exe
2236	ksomisc.exe
4728	ksomisc.exe
2236	ksomisc.exe
2236	ksomisc.exe
1264	ksomisc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 5140	3532	wps_office_inst.exe	89
PID 5140 wrote to memory of 5600	5140	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe	91
PID 2752 wrote to memory of 3520	2752	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe	92
PID 2752 wrote to memory of 4728	2752	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe	111
PID 2752 wrote to memory of 2236	2752	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe	94
PID 2752 wrote to memory of 1264	2752	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe	109

C:\Users\Admin\AppData\Local\Temp\wps_office_inst.exe
"C:\Users\Admin\AppData\Local\Temp\wps_office_inst.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3532
- C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
  "C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5140
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -checkInstallEnvironment
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5600
- - C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
    "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService
    3⤵
    PID:5044
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -addFirewallRule
    3⤵
    PID:2768
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpsoffice.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpsoffice.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=klangmanager -dll_name=klangmanager.dll downloadlang en_US
    3⤵
    PID:2528
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regmtfont
    3⤵
    PID:2372
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\\office6\ksomisc.exe" -setappcap
    3⤵
    PID:1264
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -sendinstalldyn 5
    3⤵
    PID:4932
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regPreviewHandler wps.exe et.exe wpp.exe
    3⤵
    PID:4576
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\\office6\ksomisc.exe" -registerqingshellext 1
    3⤵
    PID:4252
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingshellext64.dll"
      4⤵
      PID:2092
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regkwpsshellext admin
    3⤵
    PID:5676
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\kwpsshellext64.dll"
      4⤵
      PID:1204
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\kwinappinstaller.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\kwinappinstaller.exe" -i "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\menuext" wpsappext1 wpsappext2 wpsappext3
    3⤵
    PID:3536
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regqingdriveshellext_install
    3⤵
    PID:2372
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*install "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
      4⤵
      PID:4112
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*thumbnail "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
      4⤵
      PID:3576
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*drivebho "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
      4⤵
      PID:4784
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
      4⤵
      PID:2416
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
      4⤵
      PID:1148
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*onlinefile "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
      4⤵
      PID:2400
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regpdfwspv
    3⤵
    PID:4248
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\pdfwspv\pdfwspv.dll"
      4⤵
      PID:2400
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\pdfwspv\pdfwspv.dll"
      4⤵
      PID:5940
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\pdfwspv\pdfwspv.dll"
      4⤵
      PID:2952
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\\office6\ksomisc.exe" -setappcap
    3⤵
    PID:1304
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\\office6\ksomisc.exe" -assoepub -source=1
    3⤵
    PID:5652
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -clearmso2pdfplugins
    3⤵
    PID:2096
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -uninstalldatarecover
    3⤵
    PID:1248
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -collectmsoinfo 5
    3⤵
    PID:3544
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\\office6\ksomisc.exe" -assopic_whitelist -type=setup
    3⤵
    PID:1924
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regmso2pdfplugins
    3⤵
    PID:4372

C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe
"C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1288.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5948D7 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\
1⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -setlng en_US
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3520
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -getonlineparam 00601.00001288 -forceperusermode
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4728
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -getabtest -forceperusermode
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2236
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -fixoldversionassostatus
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1264
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -setservers
  2⤵
  PID:1144
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -register
  2⤵
  PID:4152
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
    3⤵
    PID:3492
  - - C:\Windows\SysWOW64\regsvr32.exe
      /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
      4⤵
      PID:2044
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
    3⤵
    PID:4772
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regprogid true
  2⤵
  PID:4112
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -assowordexcelpowerpnt 1 1 1 -source=1
  2⤵
  PID:2400
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -compatiblemso -source=1
  2⤵
  PID:52
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -checkcompatiblemso
  2⤵
  PID:2788
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -saveas_mso
  2⤵
  PID:1304
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -distsrc 00601.00001288
  2⤵
  PID:4908
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode -source=1
  2⤵
  - Network Service Discovery
  PID:1152
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk" 5386
    3⤵
    PID:2088
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -addcontextmenushellnew
  2⤵
  PID:4216
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regvascontextmenushellnew
  2⤵
  PID:1940
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\wtoolex\wpsupdate.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\wtoolex\wpsupdate.exe" /from:setup
  2⤵
  PID:5468
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -collectfileassoinfo -module=1;2;4;8 -daily -source=1
    3⤵
    PID:5156
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\wtoolex\wpsupdate.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\wtoolex\wpsupdate.exe" -createtask
  2⤵
  PID:3512
- C:\Windows\system32\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kdesktopshellext\kdesktopshellext.dll"
  2⤵
  PID:1508
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kdesktopshellext\kdesktopshellext.dll"
    3⤵
    PID:4412
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regyunpanfornew -forceperusermode
  2⤵
  PID:5956
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
    3⤵
    PID:2756
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:overlayicon "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
    3⤵
    PID:4944
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
    3⤵
    PID:2384
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
    3⤵
    PID:1204
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -setup_assopdf -source=1
  2⤵
  PID:3088
- - C:\Windows\System32\openwith.exe
    "C:\Windows\System32\openwith.exe"
    3⤵
    PID:1648
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -assofdf -source=1
  2⤵
  PID:4740
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -externaltask create -forceperusermode
  2⤵
  PID:5868
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe" Run "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\ktaskschdtool\ktaskschdtool.dll" /task=wpsexternal /createtask
    3⤵
    PID:5524
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe" CheckService
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe" Run -User=Admin -Entry=EntryPoint "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.26880/office6/addons/ktaskschdtool/ktaskschdtool.dll" /user=Admin /task=wpsexternal /cleantask /pid=5524 /prv
      4⤵
      PID:1976
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -createsubmodulelink desktop prometheus -source=1
  2⤵
  PID:204
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -createsubmodulelink startmenu prometheus -source=1
  2⤵
  PID:928
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -assoofd -source=1
  2⤵
  PID:1712
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -assoopg -source=1
  2⤵
  PID:1904
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regcadfileasso
  2⤵
  PID:5428
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regemailfileasso
  2⤵
  PID:5968
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regarchivefileasso
  2⤵
  PID:4264
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -installbrowserextensionhost
  2⤵
  PID:424
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regvideoeditsetupfileasso
  2⤵
  PID:3564
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regemmxfileasso
  2⤵
  PID:3672
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regeddxfileasso
  2⤵
  PID:764
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regposfileasso
  2⤵
  PID:4628
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regxmindfileasso
  2⤵
  PID:5368
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regvsdfileasso
  2⤵
  PID:4732
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -repair3rdlink
  2⤵
  PID:4260
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -createexternstartmenu "WPS Office"
  2⤵
  PID:1592
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -rebuildicon
  2⤵
  PID:5184
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -addJsapiCert
  2⤵
  PID:2644
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -updateskiaconfig
  2⤵
  PID:6124
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -createsubmodulelink desktop pdf -source=1
  2⤵
  PID:5652
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -createsubmodulelink startmenu pdf -source=1
  2⤵
  PID:4368
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -createsubmodulelink startmenu wps -source=1
  2⤵
  PID:4880
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -createsubmodulelink startmenu et -source=1
  2⤵
  PID:5844
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -createsubmodulelink startmenu wpp -source=1
  2⤵
  PID:5272
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -createsubmodulelink desktop pdf -source=1
  2⤵
  PID:5916

C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
1⤵
PID:4560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1812

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4728

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"
1⤵
PID:1892
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe"
  2⤵
  PID:2376

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpscloudsvr.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpscloudsvr.exe"
1⤵
PID:2916

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\\ksolaunch.exe"
1⤵
PID:5480
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe"
  2⤵
  PID:5940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 76571275e2e590f3b4daf40116298b4d52caae67da0fdaf4b01fa59dd10c5612
MD5 c49654c6cd9830828480d3541070b528
SHA1 fb71d17508edc706b4cef59c1b89e284af11482c
SHA512 890d093f11d4c87bffb09ff67f1bdc351f378adb7c0aaed07b196230bfaccfc3e4dcff6bdc09ed963178699ef4fdb494490b92d6d1847529f64ffdbe2ae3c84a
TLSH
T157F0DC638AF7A9E1161380A816F89D2135A8B2DE4CAA6021347804D181AA6BEF38F514
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 727B
SHA256 fd7462486dbf9bd34a4f2b6f624853ef8284dec37469c1924451ea05363fcccf
MD5 7499e57baf0a051214b655b6da9cfd95
SHA1 9638c87fee64c958c92a0bcec0c76062948f2ae5
SHA512 b0478231d0698a152a095fd5a142dd49b13c3bc3c6bc0b5a4398bd8e3686453939e771dd70a6d44a3bf41ce9458ca412d4b2e50ce79103748f76499f753fa088
TLSH
T1170160009A6D2BA1EC488804EFB00CBAF29793320F18E54B22262465A8A13B33E12520
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 0c6aa3c37fbb2e39615bf4614187b6c9456fb0c7ad57b18df494560b2392deb6
MD5 cd89f6daf122af0a2da894f0e8a32bc8
SHA1 31379e4e6cacbc82163d12cc22ed7e0fc2c23b74
SHA512 38ce033b3eee532f57218bc9c1e67d40aff73b81c2228f5a8f9f033cbfced6c62831c27cc2daed01787015bcfcbbe382dd66b2dcb6aeeb3f7523454189c131bf
TLSH
T10B0115230474BF98BA005B13CBBD8530B5E5B59625875A72398401C6559D9749D17544
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 afba484187c1357b227553f9cc3e8b6129ff898bb23f9353dff2435621efeefa
MD5 c769bdefc3ac0f9eb9baeabfda58bd59
SHA1 19d5e6df33f4b6be8488eb8463dd78b592b888d9
SHA512 7a2f8666a3adef805d567d2389e1cd635a43f2493666e1621221fa0ad2e17b98735e2106a904bb8dc17185a1d3ec4d17041b95c347d17edfb4c790afb59936dd
TLSH
T19CE0262427FA512EF1B4AF7803E59096AF2AF1176C9593BE1E91146D9E1AE005CA2C30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 404B
SHA256 e4efc32cf4724b4849f2d4ec38658bc77902dd5029c8fab8e5cd75a549acc3cd
MD5 5c4034d8d0b4e8d7431479e40c5e9ac0
SHA1 4c199c1b61e707bc2a6ec8677f4d0e00ca5e5b02
SHA512 fbb31b5ee96f990dcccc8a39072646f0b109ba1d7fc25e762045b24c643dd72f7348c1d9cda6f36724847c0a5c78e90d4225d5536e97046b256a16cac9d7963f
TLSH
T1BFE0263461FD09AEF9F4E57846F698214C99F11B1541C6A92644270AEB29E409CF2638
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 835c18fe631f604e3977142d447ee4cbae8a8bc06626752f23f1cf5012f18c09
MD5 5efe4099184459405e627da356736eda
SHA1 5aca0616342ffd613a8b54954c453d7521161ca8
SHA512 92eb2af6e05bbfdef62a3802f436d5da2a88aad1adc8046fb0e22ba61524adca02b490f2413ada4316a6ef8af1b2d292db2f7d9757eba8598099a1e3a4bfeb58
TLSH
T14BE0C03867EFB11EF4948C3142F6E4790D49F3055404837916C04709BB0AF405C11AF4
MD5 SHA1 SHA512 TLSH

Submit Download

Qt5NetworkKso.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\Qt5NetworkKso.dll
Size 1.4MB
SHA256 c1c94dd44d134dee803d48c475ce6692aa8e16fe41c9c2f955e784d9695a3919
MD5 a983ef2aed273449cabc6602b90cfcb5
SHA1 01453314a487e6dbb81999d3e28aebe9cf80a18c
SHA512 5922511dffb3e48a7b70d076903a59824846a67b9036da9e8493e3ed9bc70210ff99a9dfbdcfc8cb275886499d4d55b890100334c1f0c4ff7f6e5194349aca42
SSDEEP 24576:QkbqCgnInomjARXqFrdpEGcqHfwg0gN6+6VQHedk:vNgnOo2q1Gc4YI0+6V+z
TLSH
T1FA655A53F7554399D62AD134CA8BC902F672740083A75BEF2669DB192F337E2263E381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5XmlKso.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\Qt5XmlKso.dll
Size 213KB
SHA256 b4f8a94afdc7de1e7cb06eb723e75e333175dcb7464323232ce8372eb4ca80a2
MD5 d1bb8e1f4eb52790a820cef312301725
SHA1 cba9d4e0929b44aef2e4bacd416492524d9d57c9
SHA512 bd8ee811ad24d7ad3ff28b474778a95dfa0cfff1afcae27f4f0ec146c357a0030529a78fa8e8d87f724c709b5a91490ecaafd3e5ae739d5ea180624ead2578ac
SSDEEP 3072:the9UZLXlmma9ECFoib660hOcOg745kghowqjXiboFr4e:thbZL8B9Eooibz0gcOyLiboF
TLSH
T1DF242957FB15429AE127C138CD96880AE6B37C40476247DFA694A73A1F33BD2787E290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo-small.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\StartScreenTile\ksolaunch\logo-small.png
Size 6KB
SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
MD5 8d650fe389e3665607fdbf938c1a1722
SHA1 2e545f9555ff22313e4ce113995d8aa694e5cab8
SHA512 f116621bfecb602d02919eb1ee9d7dc92e82b313b8b54cda42ab48c5e7ec60b02005edcad763fff6b497ca4bc46e83cb0c9a249be791f245bb9c599950fdf015
SSDEEP 192:HSO0z+xgsZ7wNP+agwQznBm2KIvdgoeAtzpZb/D1:yMRoP+z5IIa8hD1
TLSH
T1CCD19EEE6F1CCE4F079D52F7500AC0A9DEA218AA905764D4D68E70B471FE6D120EC5C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\StartScreenTile\ksolaunch\logo.png
Size 12KB
SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
MD5 d58510dca6b659c6e4ba7a454d5b75ce
SHA1 e142de2dda3811a2e8bbbb2eb64d366e8eb9ea3c
SHA512 42409f9976ad08ecf1756d1c2915f3ffd17cdc78e9ff552c0a08bdfa2fda8960e408721bfc9de1a5ed9c9aca3e23b97adb721b3c51b6b3f0ed3ee4a4c780cf88
SSDEEP 192:ySLu8Kp8OtM5IirU31+5AejJ7D+N+QOtHQjrE9aTYpR8XnXrWjvyNTtLJci:NC8o8do1+5D+N+QPE9B2Xn7WrINJP
TLSH
T1BC42C08F68918EB2CE443C39F356115F1FE12A5E7E19A2CF2CE7944A239044ACE1591F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\ketaidataanalysis\webview\run.ini
Size 171B
SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
MD5 b30cb271e143eace0f55ea2e562e1e9f
SHA1 9d97dbf24931cfc114384c3f4dbbae21c9e51be5
SHA512 dc593185fa63b458024c3a913c558e5686806154181dea67eec786ada50595c53bab822833ad1e76c9acdf21be3eba50631391b7e575d7f1f6409ceccf966535
TLSH
T1AAC080D4D0256F97DC31C6B5ED54AF1A7560E700251C1EC3D530DC4E9E9696551C805D
MD5 SHA1 SHA512 TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kpubaigcbox\res\dist\index.html
Size 636B
SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
MD5 72cdeca808b16e794ec5b66bd02246bf
SHA1 e75b6c4e084efc8e60c9e4fbe9e9ae02bfbf4132
SHA512 6562ed498bae7f819caa5ebff9ba373b1bbeae3c92befacbc44a72419e6a3aedeee7fe43347d1bf8c46b9c90c8e515181a6dc50c4ad954a640cf6b2520269ed8
TLSH
T1E5F002EA3C25F055CB911EA43DF2F19E245E3AB29DB9DE942AF4513543C03694D0BF48
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kpubaigcbox\res\dist\index.js
Size 2KB
SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
MD5 67dde682d1968824023dd9773f9ec48b
SHA1 81e0a21a7ba2c05193ecc13672a3f537539e0699
SHA512 86bccae3d66df4dd552c12a42d1ed0d57d6cdb7b904caa1f89c874e506fb76412b2df45e3e5f673837cb72aa18b0ab2c1dfb489b1da37068d83d7ccb25d3d8ea
TLSH
T1FD5173C9F79E702209EAE136583F0006E17735596098A1C8B87ED8F16EB555E7077F38
MD5 SHA1 SHA512 TLSH

Submit Download

errPage.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
Size 7KB
SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
MD5 eb3b05c3a3fdef3b0c5c9020756ebb33
SHA1 27c5773e17f9c05f471ccd22db42015561b4e669
SHA512 9a511c6d0aad855448ae45130d7ed031062bb7e6881e68aa2406c7c122220318379c312bc13876599dd7fe88e2beac296adf5bcdc015ef4e0e3f362e76303ab0
SSDEEP 96:9uMJIMzvOcuq4v+nB1W1QjjaKhwc3Rgjfqqm8bm83:9lTgVv+B1W1Q6ywc3RgjfDm8bm83
TLSH
T141F15211D6925216603393B4DFA25719FB260023A3038A38BFECA2558F75C495B93FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicon.ico

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
Size 4KB
SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
MD5 1ba2ae710d927f13d483fd5d1e548c9b
SHA1 c0605efed936ee2600284e6480521d06fa64f872
SHA512 f933cd352eaba92f509b3863353ddfefadfada26a4152ecdc4727d450bbf35e7b10fb3038fe8db340d5c63d74e608c1560ec84d0f6ffc8ccd940c9e0d7533544
SSDEEP 48:i3H5R5hLOR4kt38PduMoglJrd6qTrp9hweFC0+6Ga:ipHFUs4MLBvuyCda
TLSH
T1EE9175DF61C388D9C1B1977F78C449A14F6FD951BA28351F55CF30622E5D75818C1C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwebpromehelp\run.ini
Size 226B
SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
MD5 abc3a6089b0ea76ffc960fbc9b6e66d1
SHA1 50ad0cb201c13799024de56cf45116cf65ff5569
SHA512 ec1e32b7bed882095b23e049a4e1a86acf0bf993e2f691105ffbd99d93ebf28faad4fbdd645ac1eefa74ede575854a3994c7c6d2bacc6f7a09a1991561b1a44b
TLSH
T157D09700C0B5658AC1254C827CA53DC411085B4B27608E02CCF0C34D508EBECE56B08A
MD5 SHA1 SHA512 TLSH

Submit Download

close-secondary.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
Size 216B
SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
MD5 07306930f7d374663bd13e38ea0e92a1
SHA1 12f877e8ab93d874b55d75eef6747615619dad4f
SHA512 4cc0517ed0b9d665df4db93fb3093067e90f64b34f1d41420ed975b4cec64d4cc0aede64092d79c610c04e1ecd9514a9ef48389d5c157b5bcf698fc33670db98
TLSH
T1D8D0223BB3CC8E1CF9224A22F35A713580AF41C3548942E4D8322032E4011CEB93B6E8
MD5 SHA1 SHA512 TLSH

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
Size 334B
SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
MD5 d36fe6147829a72b42e054a5db27d270
SHA1 80779a8eb37d8bb1d5fcc594576f80dbd61fac98
SHA512 94224816f757241b3a6d19788225378ae070fc62b4620e11e10a033e3be5d9cc858cd9e669cc275b1fa82e57094d0df13a6d9868cf00afaa17cf2ec0193acd74
MD5 SHA1 SHA512

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
Size 327B
SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
MD5 18770de3f96bac1e75e588015024fcf8
SHA1 e6254c054edef68f9c27059efd82eeaa69c863b5
SHA512 fcb76291a73d7f2e30f4266ea8f0dfa2d9e203cf9770fb7ffd73cc1994502992fabd0803224c1e1155c1e4b678b5af0e8b3aec114beb1f02299e8885d5a61d0a
MD5 SHA1 SHA512

Submit Download

element-icons.ttf

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
Size 54KB
SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
MD5 732389ded34cb9c52dd88271f1345af9
SHA1 8058fc55ef8432832d0b3033680c73702562de0f
SHA512 e8971ae48f5287d252f5b0a2d0516091bef0d2febf7d01fd7b435e426d106fea251037439ec42c2937e934b66f38e5eb43d00a213cdf334f482f4a06b1817f9c
SSDEEP 1536:qTIRCXXCwinqtuPM16hD2N3SUjbwaST4DCJe:39GEcgD2njb5ST4h
TLSH
T10A433B32436A9BE7F416047F5C1F55830A9F4F22F53DEA8B83A6192514162FD0864BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

element-icons.woff

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
Size 27KB
SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
MD5 535877f50039c0cb49a6196a5b7517cd
SHA1 0000c4e27d38f9f8bbe4e58b5ce2477e589507a7
SHA512 da269b20f13fb5b0bb4628b75ec29e69bb2d36999e94b61a846cb58db679287a13d0aa38cdf64b2893558d183c4cc5df8da770e5a5b2a3288622cd4bd0e1c87b
SSDEEP 768:gOvv6ExpCVxUtrT6w8ClFd80EjPVerMKBaGXjAlEm:Hvv6xVWewtlFdGjPlkFjAlEm
TLSH
T1B9C2E13197213AE9D9824EF876E498FEF1651402290F390E8696ADB3A98D5C73E16831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
Size 107KB
SHA256 c9c5602e26393532e59391d5944a578716f3b6cad104ae20ac8caac805e52f86
MD5 d758ec835091abce0528909c5dadfe24
SHA1 07a9ffb19860ece3293780c707bc71f25a6e5d42
SHA512 74d869f2cc25b5a49adea778f52f59c6f4b7f2eca31c511f19250538d241136a6cbefedccb250a3773500bdc6b9caa57ae7cee40c0dc2d8753f2386e2f390cc4
SSDEEP 3072:KazzQ51KYGqMkYUl26MeCsAcdl6y7tqWD:mMQ/euD
TLSH
T13DB31B37214D132D383BDAA2E55D659A60C8F61BC01253F5FA247B1DCA837873A763AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
Size 279KB
SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
MD5 a3964e72421a1ef5fb60c6e17eb5d705
SHA1 5dd9584be5141e884a230c48746e1c88126b0a55
SHA512 4ce4119b7407b460969041809354c4ede587047ee643f2897eb0ecb9627608431f43fed27c54c70bacff3a6694eb32a85b535c7d6397ac22d7d28e260b0a5467
SSDEEP 1536:39eSBQG+dyAUlHj/8D0Q+SPxZztR+LCrwHFfyqHYb3PPV7BYUOf0I79lDxiRSL2Q:3zfZYKVxiW
TLSH
T14054B6229140212E702BDE3DF7C4EA4AE225C6B3C4125BFEF953651DC7C36AA117778A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
Size 380KB
SHA256 f1bd1ffaba49fd0c0040f182231f739000b0e4bc762900ecacab4980f743b203
MD5 bb8a0b01c0ac1190e643c4e9daf4b69e
SHA1 f0286c3ea896a359666be8f10a7519c767afb321
SHA512 da37ebedf1e5365df105b3bfb559d0dc6a75b2896ad29c844c6b987ac5388139fe88414cc6128144f6fa50086564ea67f257eec54941dd43b124be0b8b276573
SSDEEP 6144:5pK457wXrka10TbOXsEYpHBBs6Ve5NtXoqIpgznl87A6v0eX4AiDuViQbgQgILTv:64G0WtYpmiLlTD8QmIqU1NBqq
TLSH
T1E4846C4B758BBB5A1F35B66340DF3C88D01C6EC09812A5C9FABDD9D09144B9A32D63BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
Size 249KB
SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
MD5 6351ea268f992f52e0f4418a7028b91d
SHA1 5bb3cb88465c550a1fd033a079a8b2eba5e071b8
SHA512 44940d07abfdee6403e9400e596ac5e5eb234ba77a1c90c2fe4086878c12f4805c709eb84538071f21d5710d3569d342e7caea10061e2ab2661c5117c5966297
SSDEEP 3072:p+Xy2rHhkiTtcsuaIwK3zqDLW/ix3Iu7doNFBWgz/bwUzxqcG7gLEOhA:phKHhklsi3zpCdoNFBHz/bwAfG7cW
TLSH
T10A44F8CDB2D1B0A517EB61B4813F610BF27B6499B44E80D0E226E5D4BC7998E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
Size 424KB
SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
MD5 cf29fba214e7f43f2ca1b629109d126b
SHA1 d0dda9486528586af6943abe7a3afa319c790f25
SHA512 2ad7e4711f5917b8d13f861d4fb2688e6ce3951da43a89263a2d9743199e173429398ec1a9537b1df25593d3999dd34fb590e2d2a6e7a632ccc44265d93c3bca
SSDEEP 6144:z8KzCOcC0CXWsJvRekr0dgei/zJbBoCF7az2bzNM:zbzCODTWsJvRbw6zJbBfaz2bC
TLSH
T13694198DB2C1B0A517EB60B4913F610BF23B6469B44E80D4F266E5E57C7898E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
Size 10KB
SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
MD5 0f4634d4af8b73f882440c1181697d86
SHA1 748bb9a14c8a6c64fa060ddcb1b4baebfb3f6fd3
SHA512 eeff081cb256a44ff4557dae145c3d277ad936fef58674cb7d2949b6c302c3a746f05495daa6ccabf39c26bacf13c6fee3bab20de4f1d13810be0503787c89d5
SSDEEP 192:cyxPpQcKb2d4U1nE92Ui6OPl20b3G0qE7I2ByobYGeBv+x9qkgYbeO:zzFZr6OddG0q/yTh3UYx
TLSH
T1AC32C887B30483755A90E790F6C76DA5A93ED0EE73A4168A3CEE421812581DEB3E7CC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
Size 13KB
SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
MD5 dd59d31e84434c59c5c3735bd0b0dc3b
SHA1 c34473850d3749aae725856f68a262a0afebee00
SHA512 f3acd51920f945b49dceb56fd2a5a4ff170c4a5770665bef3d888f8497a288dc33bd15f24780cbe9b8ced585fbacb92a8700d1322a6d4acd2b6e5893370822ac
SSDEEP 192:GwSuCUHXDhEblYfhQ9GYSOqUr9b1AARAU0qWo3wYXVMojXiyaH:dCaXDhEK55YmUrLAgkqWo3RVhpQ
TLSH
T140523295F3C50E22B4991749BA03D57BF19558FAFC2CC18D5CF2D236136C9C986928C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
Size 14KB
SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
MD5 5cee0947c1ef6f00e18eb17cf77388af
SHA1 5a27bc625acfb46d2368a9a376d797ecab912a3a
SHA512 1bf91f08d2a2a446ef0e22df40fd09b090fa300f599bacdd5c698aa61a6fef12ad3d3e38299804a016e5a22a82ddfeb6840cdc7a79ea51244942cb22e659331e
SSDEEP 384:HTO1ksU66rAJGO+NedvSGdv+GfBgLj95LKn:zO1ksU66rAJG5NedKGdv+GfyLj2n
TLSH
T11D6230ACC3CD5C69C86183FA090B35C27836ED49FEA5AE7280EDF4202DA19DFD815674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apm-init.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
Size 57B
SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
MD5 b684f2b8022aaa97ede28f9d224c4db5
SHA1 2087206ddbfd6d6d71f843a132b58ed533d87169
SHA512 8d30da66bfdd99dab88c4b9766b692c39ecbc8dd725e9f858c95993d4f2bf46c37891a1f8f4f1eb6fe09bed7008b8df48d2a9b4f10d7caf20f823f121f6ebb40
TLSH
T19F9002E7F0A1707344616959630722AA35D11130017430010900487434A580FCD22F88
MD5 SHA1 SHA512 TLSH

Submit Download

default_ava.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
Size 906B
SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
MD5 c47a5cfed147c402538358294808e68a
SHA1 8aa499336bc4a50a70710735b67fc5da923fc61a
SHA512 a71831abb9393b6c0ad62feb29fefbb192e1706b08ab88dec0a8e6a9cf61b6a7e106454a7e6e518f69425cc91846036e8fe2956ea939625678f17b330860ba1b
TLSH
T15311E309934DC285960AD7B8563C1754347272DF9E1FD55CE7E633012D3C6AF185C27A
MD5 SHA1 SHA512 TLSH

Submit Download

desk-sync.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
Size 1KB
SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
MD5 c17417f321f52624ee0dc60ed76a31b6
SHA1 b64e19a5b03c92a931fa9a1eba899f491e669a1e
SHA512 bf160829598cf0b22ea48a5f7310adfbd26fbc1bbf23ea3cb8d9cebbeb92b5e81b914bd6021cd41df5984ef00698acb1c1151e134c714e0a1be7dcd439c78485
TLSH
T16D21F0ED57EE35C8644CD37028DA6079627B35F43969EF048914A9D1FE4205D499F9C0
MD5 SHA1 SHA512 TLSH

Submit Download

loading.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
Size 1KB
SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
MD5 0620393a949b58f6af37b0accb79e32c
SHA1 0025e4da5ffb8695a8f9731a05b1b89f1a71bf24
SHA512 0d308c758f825d548874cf8b4b8ec20f3685b39c7232246697dd95e5e5f40da7cd21de7ba5faafd0d8a121b5e6b85c5aadc4232e3f0c943535e062ae449ef29e
TLSH
T1333142D111BD0116E11AC365D7FD7AC70B3EB4DB26E558BCB68C250FAB404DB0A9B219
MD5 SHA1 SHA512 TLSH

Submit Download

setup.cfg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\cfgs\setup.cfg
Size 449B
SHA256 62b60d2fba63532572d6ba8301351b60af331a287bd66c40fe2095a710738094
MD5 e7e17a564ebe4688b97e4ec4463e145a
SHA1 7e27b0d3777c9d6f4120bc09831a0f1d64e96a2c
SHA512 02e42bb89519d61927313fe8c7b9540ecacf1ad8f1e71eaec281e64808dc91665a535b76324339cf3ba51f3dba4ef4149e96e5803fb0911f8669b2f66dabd155
TLSH
T1A5F0AB6B0303B0745E21530010B914F2B3FB01C9101B840D256CA88D7B7EC3D86BF13E
MD5 SHA1 SHA512 TLSH

Submit Download

kbase.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\kbase.dll
Size 1.2MB
SHA256 15b7cae965255a39cac0e048a320a1b338e7a1e59cfa2610e8b08f94e18bfa8d
MD5 35bb42494888b55af982848cbc68ed8e
SHA1 c5d35261a8b251ff1d38bfb33ce9e81e5f69acd0
SHA512 abccd37be5d9cfdc37ec622af75079382cc482260f6758e83bc988cb2480b0172d638850d8d2db7640d9cbbbdb78144628807d3a8c9c65db9c29b41642efffea
SSDEEP 24576:jLhFMBWZyW1HgJPTrBM7bxevE/D19mgUFTpZFRiklddhy0u6:3fmJIirBAevE/55UFTpZF7y09
TLSH
T19C455C5B71A800E9D5BAD1B88E6B9916D7B170860720CBCF26D0975B2F63FE16E7D300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdesign.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\kdesign.dll
Size 1.3MB
SHA256 61151bf1372baf4401859b4f1b7cf256879c896ae381d13add602b9aae87068f
MD5 481a76b84fce01bb59164a5aaff6f0b9
SHA1 f3de975dbeca68360eee993ce5de6f641b8e69c3
SHA512 b1d89bc8584988ec2074d6de6d17fd1d5904aed7e18fcd2e42c8ebc9395efade41b370fc5bef8f226ed4a1069c17516f841632d01c807e0af213484a2f306ff6
SSDEEP 24576:ujO4YdPOyaKYKNisO8SqRpKYSPp3wmRJe:9tPOyatK8JuKYSPpRe
TLSH
T1EA556E4BEB5683A5C0F9D27AC5CB8516E1F2B84181A38317649FEF293F633629C5D780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krt.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\krt.dll
Size 1.3MB
SHA256 573f2ac053ddf0ad023a0ba257d59fe9a37c29f383923c59afad34b8f89122eb
MD5 379a3ada6bbc64224b810cfa73bdee2c
SHA1 8169e2580ab60a4ff092e673879af10593163857
SHA512 e00e6cdee1796ed14d0d98ecd328cd97a53cdae04c525251cbd483988b72367c8e8e88c5d642da6206a092fdf71325b11b7770252ee9a9e61991fc822595fe22
SSDEEP 24576:8aiaomjY5YVrYQU9LENTDqfZI9Rc4Pf/lHL8jfUgKF:3inmUbQUCByZI9Pf/lHL8jfUgI
TLSH
T1B6657E1BEEA943A8E17AD13CC98B4906E2F23802436197EB16A55F5D1F337E24B7D350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksolite.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksolite.dll
Size 12.3MB
SHA256 fb5fee591d3b5c0f7092c72f3ae44ceb3078e2e42bda1d2edad1c1a00fbc19d9
MD5 14fb40c32a68dc22ab56ea1a7e081e29
SHA1 4495b0dc37250eda25cc89f83f537e387d96ef79
SHA512 e864ae33795e7c50f90f3dd06db38ba4fe08ef9101cea10ff5ca10160f24d3d6d3e3b0db2b9570a0656f44766baae0809b3e1547f3142807b2dde38e2361bbd1
SSDEEP 98304:CS9bOuEDuc4TkJx5iQRdhhGxDavCnFRsJ/wUTA9lDx7Qs:C2qV0kJx5bRdUDaKw/wSAjDx5
TLSH
T1D1D68D5FBBA603E9D1A6C138C99B4902F6B17806872197EB25299F791F333E14D7DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksomisc.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
Size 3.7MB
SHA256 3342f9691125a2214c37b2a5b5fcf43ea3320d838bedd5d6343a22788c25644d
MD5 62b99e1e6782787a026069fd3fbb5b21
SHA1 0db5c24c4c5376220624144ec59808563f326e0b
SHA512 c99253924b30389129d24a1cac05d526db30e370d8a8ba1e8dfafab174c5423965484e816944e30984f02b9b802491148157667e7b5fb3a245f3cdf416cdba3d
SSDEEP 49152:0qPmk0JH6yx1l6Nair+mq9mm4yaEPAD0T1pkBSPIU7BmckP0pPFj5+qa0skgNp+Q:r0JxTVb4ylEEpgYg2gZ
TLSH
T176067D5B62FA03ECE1BBC278D6965903E2B2390687315ADB11549E750F337E19E3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kwinappinstaller.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\kwinappinstaller.exe
Size 29KB
SHA256 3fc338363884ae614fb457c2cee699994fe097f3350271b3288915cba956aa33
MD5 789ef8bd972228a57e0c91217d5f24ff
SHA1 0e0614fb98368a89cfd368891945b5f87b903abe
SHA512 a4aff50d10b8e5c55f83b0f287b28436124cb016ae6f7333b14b29cf67fedad7a2745b9ea658875677154a4ddf2bd0205aa4dbcf5760986e0289579c9fbe3cb1
SSDEEP 384:zX3jAgqYyeB7iZxsY0E5FvB1lNyEIYi2mL4/y8Rxtw78xkwU2KIYistw723jFy8k:7q/cybaYiDLk5C7gHU23Yi77gp5AL4m
TLSH
T10BD26D938AD04C05ED77AF30B8D05522AFB5B55769D1C1CF7288C1168B923822BDE3F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-kso-1_1-x64.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\libcrypto-kso-1_1-x64.dll
Size 3.4MB
SHA256 958d72a1aa20d4f090cfdd00ef5f3711cbf7ef6ec7f1768ee4e335e93c3b3092
MD5 699d6cc6b61bf2a37c6c415f1941ade2
SHA1 ed3311cf1d6d50e72cdbc95b0eb492e09a418e91
SHA512 db31c1688db821683190ee8c44ddcfec0ca771ea3400cbf614123518b1ea4962a586b4506aaa9c712942a2f645ba255c60ead066ec2bd6619a64b9f1fd1181e7
SSDEEP 49152:cOVwASOXFIU6idBGtlqXWq7TsRQuXk0AkOGYYNEhvla9+LEcJQNPn/zsqocj1CPh:XC+Zsu0h9gEx1/zs+1CPwDv3uFHUu
TLSH
T1A2F58D5AA7A80184E5BAC13CC55B4737E3F2B95A17B09BCF18A1C1780F23BD66A3D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\libcurl.dll
Size 825KB
SHA256 9b2cddadbb3c542ff6f44d2c879b658587f906d4598f96e6c6a43e40c5945055
MD5 9b6ee0de1a75d048d3ffb5413fb40342
SHA1 192dc4b5178cca178913bd5e01beb668158b60f5
SHA512 b9037936b16788b57b309cc7c9e58d5e78e3cd41935bb67d192cc4fb627920eff2ef5a504b207d64c69650fd1900d5b127f52271fb1bad5195090131ac626c86
SSDEEP 12288:NoEQluG1zBQ+X00nWkZ4wmDFhBpePcjbvAuoq1/C:cMEzH0aJmDFhfePCoy/C
TLSH
T148057D5AB7B804A8D577C138C6434217E7B3B4552320A7DF16B48BBA6F23BD2673A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_codecvt_ids.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\msvcp140_codecvt_ids.dll
Size 31KB
SHA256 f2069a52880ec885ee7f0511186100eb7fada0411a2b4948fafea7735b878a18
MD5 3ece3fb90bfaea8e9a5fb7139ff9cbdc
SHA1 91b19dd0db24a5cbd944eca9c67fad3b53f9c154
SHA512 c059ffd80de25ad10d34064b1e9421666525da67710de0ac445cfc45b8139715dd946f7e90c1e0d719c60e3d5902e3229db4496c87d674c0012c9b4a8c2b2291
SSDEEP 384:p7GVNpd36sRWioEWEw4himRSt+efdDtdQ5R9zpU8NSqHRN7w9ju0R9zlWdo:5GVsfaw4DYd7ds9zmMEu49z0G
TLSH
T19BE27C89DA3C4487EC9B5C7082ACDE477C3D77C60A10569B4392F5181DA33C6EB3866E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

error-net-72.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
Size 1KB
SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
MD5 66726a0fbd424ccb700cecb212a47007
SHA1 9795ae26acf0b942ab6a0cd06f206ba69eda18db
SHA512 30ddd2fa17517792a86bdb03827a0809ed362ab2dbd9a7baf194d1f47348c96e0ca8e64515c1a58d7a1740e85f53a3676b49ff6c699d598a27c234c14672604f
TLSH
T1E031C6CD318AC42FCC61D531F4D534156817D760BF928C74102BC5576E0F68E58C6662
MD5 SHA1 SHA512 TLSH

Submit Download

presetLayout_16.pptx

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
Size 41KB
SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
MD5 f41e909b0284949bdd3bea9393a6ff2f
SHA1 a41497f65f44368ad517f464eb0da4403aa700c0
SHA512 d800b9b807a72d19f17bf5bb923d2489328b2f8801c2146b0c67d3d4cd8c70d5f22decd6581ad14d5584f3895140180c8578ede4fa8df755ca742c18cbb3b67b
SSDEEP 768:lwQ75cI1zETv/7H0vFtZKSZTRomseFVEFqG5IphchDB8h/rW7oELmG1wvcG7GyGK:9qNTn81Romse8Fl5ahcVChjQmG1/sl+Q
TLSH
T114139F61D40A142FC263B3F6E478164F73FEE86248179797ACD51096282F97C2E9D38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpscloudsvr.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpscloudsvr.exe
Size 1.1MB
SHA256 f5726c54eabfa893b1cebeba9c9b9731715faec9e01d137d705f70150375fdf8
MD5 ffbba1782f20a683a6e1c65e6ed54618
SHA1 fbd85ac9eb4586c48f191b79d9a5f7218cee2691
SHA512 85a50e430508255d1e48a94353ea43b40332b71a0b8b406e78cef5726c808b96b3cfc76bc08305a776994b593351bd85649e3c3ec06750e4c6228ee352719136
SSDEEP 24576:3GkDhWVvkc7xEItMad32IV0cZZl7KyfHGoiZYaYA:3BNHqSa12IVblHGZZYaT
TLSH
T1AF356B4A63B902FDE0ABE1798D525905E2B63C0607B05BCF079067771F7BAE95E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpsoffice.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpsoffice.exe
Size 1.2MB
SHA256 c70e66e699cf1b6a61ee1c77360203cbcd4cb5f401fa390cc8eda7b7c8fa9b6b
MD5 ed12b41dff76f0c341d093ff22fa63cd
SHA1 286246c144a113abd9ff954b3a0e29cd9a08f7b5
SHA512 05d3c3f661d2b02e566efa0c7f58b699750d1b266817c22ee34bad54a5c20cd2c384183bc91b495cae5f5d940ea3cc62c9ad1b156404a554a8fde157581406e1
SSDEEP 24576:LD/tF/gTs5QQeHO5W/P0VBoIhw1yiP6BS9cEf:LZFYTs5QH4AKSIh7iCBXc
TLSH
T185451A366EAB02ECD36BD2787A525901EDB53C4AC7255ACB02D035763E77BE18E39310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\utility\install.ini
Size 610B
SHA256 27e22e1928244e0e50c1ec3c5e7b37d739ed4b0f0e03d2e74f564c1546007ee3
MD5 e4f85a65c87eeebb2d30ee4c5778dc1d
SHA1 ffd754f762964c42262db06a6513f45e864e2d2e
SHA512 cf1f585074d06ab37742fbeb9511369fbaf27180368f0835bf19774e41f8b0dc4f533ed7ce8f850c280c7524240ecfb8aded23c58606427e1adf7470a6dc67fc
TLSH
T178F0780809C9C66E3228228CB0D3C591AAABDE550D4DA060E2A76E5BEC42D0A227D06F
MD5 SHA1 SHA512 TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\utility\install.ini
Size 462B
SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
MD5 71e0a7ecd6bd2e91c04a3edf760c45d7
SHA1 e6cf872ce6def16bca98818ba289395580701292
SHA512 282b4c8be6abb97383d7dda8258fbf069fd668f4fad722582567cbc916b5c7da9a39a157a35511210306c19e46ef34c02af17f2af1ec7707bb3d84f3d529c3ca
TLSH
T178F097090C98C66E36282188B0D3C2C0A9ABCE260D0CE410E2D36E1BFC02E0A217E02D
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.16tggctt7gizovz_ejnh138v.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.16tggctt7gizovz_ejnh138v.tmp
Size 4KB
SHA256 322a6bbe4151c8c0d85b94a20e1566a69e7e19532fe6bb7ee4b5d806daea5366
MD5 9829c378f563249eafe72d677b821374
SHA1 cc15a1a414235d26265ebec559f4673fccf3ea58
SHA512 08f7e7d3c93880f6fde8f0dafefa7c36c247f12a67239fa77c129c5e790b99a33622c24e7c08259d39fa0570c1057308d3650e3e7776602dfd29821853418ff6
SSDEEP 96:0AxANmAN4ANGAxAqAGAmvACANANzAFqTQOS/VjHH3HRburbv/x4JT9:zeTJzetx/ViGcqVLH3xyrjx4JT9
TLSH
T1C991004A98E415D052308825A3B7E251AF0D4FA316CD80DCB9DCDA6D3FC63A795336E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX._idpp6jggad5xl8llqxkef3vd.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX._idpp6jggad5xl8llqxkef3vd.tmp
Size 712B
SHA256 7310eb8c9a5115a236fe0f5b2a40386c478b4a1c8de6c16aa20363d4beaa2659
MD5 4c961876f316a4b5ff5d8c905d7e29c8
SHA1 d26d0304cc7d3ba77edfdb54934466d272475bb3
SHA512 75884549e7bcbfadeb2f7f6293caa6ed782e79b9ea389180c312248361dd8c029f22f47c4b3e65234288b628a753f446d2d8631f0de7e82f90522ec8a0a22c73
TLSH
T13C01FE289318BE2A46784FAA0BBEB9403C02815B23170A6E6CCA897658174A11AA71D9
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.blye9bhm7vl0vp0czoqfjitue.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.blye9bhm7vl0vp0czoqfjitue.tmp
Size 712B
SHA256 40206cc446612c3c79d0aae7d80976f941e05a4f31112819b7342716bae98233
MD5 e4911f915aac45058d33a617a75af221
SHA1 831550d3f984b85b018aef38dca0d893bcca1d71
SHA512 70e09f820bde70ffa5b8f22400e40a054ae4a02adf2437df81c0e08343983bac3a9951864530ebd1815436ba2323f3ad3ef2a82aba4f948c43cdd6e0a08d5b94
TLSH
T1B2012828A318FE35467C4FAA0FBDB5443C13415713171E6E6CC6C875581B1D11A571C9
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.d9sgvsuc497x5_ru_oivbwabh.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.d9sgvsuc497x5_ru_oivbwabh.tmp
Size 712B
SHA256 a3ca9aae4ba31a89982b18f1b929accb9db7d06a8d786f433ef5ccc667409b1d
MD5 16999ee867612360e46db316fe54ca27
SHA1 50e290a12b234894b2452342926802170d4d1160
SHA512 ee2d4abd25d50db7ecf28fef26e7c2cc82d1cd657521a746e2ed73ed55f63ae772f9daba305ceb4302541c486153fbcf08aca2c8d4a69d066d65f51dc83b73c4
TLSH
T14701F4289318BF3646784FAA0F7DB6403C13815B13170A2A5CC7887648270D11A571D9
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.fdyoz6yknbqnl121hkp8j16y.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.fdyoz6yknbqnl121hkp8j16y.tmp
Size 4KB
SHA256 9d2f34f1b17536dd689db858d42c85a78cb48ccf24f55fd578699dd1cbd7c930
MD5 2bc82584706945350309746d863da639
SHA1 f0862f788988dce106735e4bb66708aab43a06e0
SHA512 1956c1d910995ee93dbb0977f8bc82c1aaf14bdb7549b34eead6055390d26361321192d6cef4e18fbb1ad5cf6faf44693fadc932ce63595550769c6a50b81a5e
SSDEEP 96:0AxANmAN4ANGAxAqAGAmvACANANzAFFTfOS/VjHH3HSbUrbVj/x4JT9:zeTJzetx/ViGfBVLH3y4rpbx4JT9
TLSH
T1F291F14A98E415D052308825A36BE251AF0D4F9316CD80DCF9DCDA6D3FC53A79133AA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.jblmgqeoi7apc93oyw2iy3eph.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.jblmgqeoi7apc93oyw2iy3eph.tmp
Size 10KB
SHA256 366478aa06db9582293152d2f1dcdc59776d2457c46299fd5652155e218bafca
MD5 bde7563b63ae910904102d3f5683a19c
SHA1 e708d60975d2140b90f9171ec8f2b1d185ec26eb
SHA512 3daffa84342d4dd74c221dceb8bd1592bd6643574ba4ff214a12be726a6d8d5aa5d5a628778e5e94824866906a12914b174cf78255cffd8a60131077071afb81
SSDEEP 192:wIYiYF8+2Qih7pm94GiULc8pq8RuwdmL4pUQrNyJAmu0c:wIYistw7E94oy8RbmL4nNyqmu0c
TLSH
T1EE2239A388546C04EE17AD10B4C4E93BBEB2B2A52AD0C1D27159D195C7823873FDD2FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.ogmok2tsqba5qneixjx2v1v5d.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.ogmok2tsqba5qneixjx2v1v5d.tmp
Size 10KB
SHA256 4ffbe02e04c899246680c09ede8656f120990f57dd5172892cbc05444d9e25b3
MD5 26ad7757339c0df72e067340fe7b5c31
SHA1 f5447ba243f601f01da867e56c75c1e46e62129f
SHA512 228ad118261e86040f841eb0a3f310f01b4ee0d2101e3aa25a49f3a74a3f021f411c049ecb10adc2df25137e7055abfedfb119034d7dcb4b80229dc0467a8cfe
SSDEEP 192:tOIYiYF8+2Qih7GhB1ULc8pq8RuwdmL4pUQrNyq/k:tOIYistw7Ghgy8RbmL4nNyq/k
TLSH
T116222AE388542C09DD57AD00B0D4A93BFEB276952ED0C1D37158D26987863863BDE2FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.suhbcmddz40hqdvar_8x3quqg.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.suhbcmddz40hqdvar_8x3quqg.tmp
Size 4KB
SHA256 81c968c375f69d9e4666901fd4c14a6ce4b738639ff78488562e2c79f8fb14d8
MD5 a4e510ae4ca446423550859eb3193a92
SHA1 de1f946c7687a9cbc4e427c106e62691a203b67c
SHA512 f835d5adb86ab9feb23517a26a7054a6cfdaead71c3b3e0f2a2dea959376a119e7dad97f1c02bd5ad7d53ea7b1f42e65e9847e2842a290a7d4f6ca807cded707
SSDEEP 96:0AxANmAN4ANGAxAqAGAmvACANANzAFjTpOS/VjHH3HMbgrbF/x4JT9:zeTJzetx/ViGhPVLH3sUrNx4JT9
TLSH
T17B91E14A98E415D092308825A367E251AF0D4FE716CD80DCB9DCDA6D3FC53A791336A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.yb4na1lql7h61s9u16kv7t4jf.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.yb4na1lql7h61s9u16kv7t4jf.tmp
Size 10KB
SHA256 cec20a7d5151fefc82fd0b1dd679524bf70c1015580db00eaccd95b93c303c5e
MD5 1e7ccab0deca10836497a90811c0f59d
SHA1 c69792a518cd358464e57ceffb8358cc7fc3b182
SHA512 91e638e5c5641fcb3a672ac41bff118aeb1ce4697a0502d283e2b58378134dee8366bc797f3c643d6eef6ef0da20371f922694ea1c87932311d32a03b7a57821
SSDEEP 192:nIYiYF8+2Qih7rnsq4eu5ULc8pq8RuwdmL4pUQrNyZTnt:nIYistw7rns6uyy8RbmL4nNyZTt
TLSH
T1FD223BE388A06C05ED17AD10B4D4A93BBEB275A53AD0C1D33159D1A5CB853823BDD1FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5CoreKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\CONTROL\office6\Qt5CoreKso.dll
Size 5.7MB
SHA256 ae105320fafecbdf6e26a3c2ac51bff164ed60e2c80d7c2a909f7c8abf350d21
MD5 0baefb9d5911265bcf18ac0bcc9064a3
SHA1 d1e47757851abed060119f9268ddb69bfcf1885a
SHA512 714751941292c12a640a9f6e29c4b17ddfa1df2263f89f90a146b86d8e3dae2e142e718212d254097c28ea0926969f95f222fc4138504e43257b332f0129aa57
SSDEEP 98304:hUri4dRGPsSlU3Jsv6tWKFdu9C39iSl4r3IscaL:hUe4dRHS4Jsv6tWKFdu9C39i4scaL
TLSH
T10E567C47FA960269D8B6C238C9D78117F673BC0147224BDF2298A3496A777F0293F359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5GuiKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\CONTROL\office6\Qt5GuiKso.dll
Size 6.4MB
SHA256 62bb5bae4f0cd7cd7776471bf93cb00601badaded78a1d6978b085a38d9a5ac7
MD5 f4a22145f47c27bb6ead2a63413d2019
SHA1 0f236b06941198365616e17866f6192d1ba09a91
SHA512 686340df75da618260e5cd895346ffd1c4e38c9bb25e4462a00047a3c9ac55963ffd85418ccc278157c26b986a02ff918349907c0cd842cd2a18f311c9028a4b
SSDEEP 49152:tfwVgzsWrginPvS/6E4hNk3sbwIbapmRW63/LmkNuMdmboZAi073Wt0LcajSdTNB:9wVgzPUd8vLmTiy31LR8TXyZ2
TLSH
T1BC66F986EA466359C572D17987CB042FE1F37C4683524BC36C45AB490E237EA1B7FE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5SvgKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\CONTROL\office6\Qt5SvgKso.dll
Size 503KB
SHA256 399cd93775185a1a0db67abebd302d8f227e3e17f8e42836a297ba148d4a6ec9
MD5 d6661626aa98972b7ffaa49888bb4a15
SHA1 042520dc91f31bf5d6e22d4020baf4232b887163
SHA512 9c69f5d6f4edf2a67dd97a09abc03074b06fa7f47bf16f83b8d665e64bdfc6ee6fdadb89e09472b8e74418409756cae3245c7cdc434658c67d27b61453f6364f
SSDEEP 12288:2eu0/Bj7pgf5fqNXGPRG8PFNBAVLEgZ/ABXH9a/vngheZB/XEnEsrnJpaymesGrh:2eu0/Yf5fM6RFP9binCn
TLSH
T1DAB44993FB520398D526D27CC8978812F273340443A39BDF6A5AEB651F236E1763E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WidgetsKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\CONTROL\office6\Qt5WidgetsKso.dll
Size 5.6MB
SHA256 44cd4abc65e8c79047182c2f1846cc554acd01836445b3e3ce51483bab103c86
MD5 69e494161123658847a9553c0c19b030
SHA1 11492cf190a1ff6d19c502c085e6ab70ca26dbdf
SHA512 a7f68789fde8a40bd3bc6801fde08cac81fea7626b70b584d640ba1e42c93f9f8fef97dcfd6c683deb9463a73b8c0cc5de97d2459e292d5103d9ce9baee5b702
SSDEEP 49152:A3fqL/IkO1RNxuQ4Njz8MaCr+6CWpTkY9vTRC+WAGwczT9yVx80qi1QGoQXppdcm:0x4rRNTppdcpwj667olQXr
TLSH
T143466C47F7A50389C56BD23CCACB8613E6B2780047234BCB6559DB692F637E2197E780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WinExtrasKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\CONTROL\office6\Qt5WinExtrasKso.dll
Size 251KB
SHA256 ac783be33b205c69a7d77191bc5f4af8aae1ec0e86ac861e1ee2649a06cf0e5a
MD5 9c9a516e1bba629418a607e63b1d152b
SHA1 a7cc7aecf75194ac172167acb1495951fc52fbb1
SHA512 137ac148ed5582c44ab755ab520a6fefff161a26a84aa08c464d6ab701ae10693e535f82df9771ffa2e77b64a279d7ba484b84aeb42c5a23eb0afd307287ff95
SSDEEP 3072:IF5o5cKUM7YLBwcJf1+6Ws2g1+xvN80L92M:IfpM/xvN8M
TLSH
T181449684B6DD9619F819B0B88FCCD199C223BAED8B47425F351EC39F4B619816E139F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kpacketui.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\CONTROL\office6\kpacketui.dll
Size 699KB
SHA256 64037be52e7e91ed511e278834867fd3f5481efd8620f88d94ad6371f021d5e5
MD5 35a99ae392b70b02d7557d2e57c233ba
SHA1 0f69a977b06e60e364edd1ac2d245f30203bfc43
SHA512 f7df83e68503b7ebf1a09a0a950c2bc16661aeec5b9e5f70492a326ceed4a7680099a3dcf5230a3afe0b4cc6eac85a62af0d5a3075512a8c56dbf02f6e9a662f
SSDEEP 12288:fHn2Nqk+g7ufzQAEit2GRqj3b4skvRkTJu:fHn2NojQyojjJu
TLSH
T1E2E45A1FA69103B9E032C17AC6A78803F2327C0543A25BDB6555EB251F73BD91B3EB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\CONTROL\office6\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
Size 75KB
SHA256 49c19cd06a911fc42ed256d1691243e20dde7596fc9a19ea71a29f261d1f823a
MD5 2a9a0e490ed87340d31c835902f9030d
SHA1 368cfd9a6856e21557d5cfc2539b40d59067d358
SHA512 b683e2314497115521b2c11681cd6f9bebc722ad9ba0e229ce9ba1065a673365e7a4005727bb0d05598d1b0334b2df684b397c25c2e5f57103c215125ed5b3ba
SSDEEP 768:dXOzQ/DBnTQxkUtwZfVKFkYQJc19qTwz6NBvgUZSac6mWWr5YiDLk5C7DHYi777D:wjf8JNwz6NBxSac0+57b377T
TLSH
T1A0736B93DB441799E51B8634DAD58A1BE6B2784207A293CF6328E3680F733D2397D3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
Size 46KB
SHA256 a81f7b0fcde9820fe96471746854a7a1f5100f53adb71da30e6c14fe35f5774d
MD5 3091ad2fae079b46dd38a11f9eb095a9
SHA1 19b9b0a0b44a00c0872fe0e28a7bfdbc2601c4c9
SHA512 2699be0deba1057a8e6b6c68bf9c562d54a7bec17c9032f63c682568604eb2ccddd0d15ecb2d7a821a1cf4212fccb8767dcc6e67a7c104aa5d03ec302dbcd2e0
SSDEEP 768:qnBLz7xcTbdofpkos+DVYiDLk5C7a5IfYi77l5AL1z:qh7xWofpkossV7bWIf77Gz
TLSH
T154235A93CE641809E923DA70B4C54926F972B8514B9283CF21A5D3694F973C23EBD3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qskia.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\CONTROL\office6\qt\plugins\platforms\qskia.dll
Size 1.9MB
SHA256 ed2434466d697329e29941aea13b87bf104679652c7c33bd1b358b6fd623ae67
MD5 e4c5e812619ab113ac309244c200a37c
SHA1 8bdd28a1013215fff4191fe382e00aef938e862b
SHA512 6fa606ab52e8e0b75bc6384208babe90f07271b51dbbc17b72c0e4cff800b51de0a1be37a705e30837534b85abad2b7f75dcfbedb02f7e93096e03142ae245bd
SSDEEP 49152:v0rOoPmNWAG+mr9gb7jxSfL0FHYX52k2ik82a66kTcAjY:6mNWERY
TLSH
T1F1957C43E3B44299C2A7C13D869B8F0BE6B1740543619BDB2690CF59EF237E21A7E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\CONTROL\office6\qt\plugins\platforms\qwindows.dll
Size 1.6MB
SHA256 85a5998534e16d1eba7f151395e8e892c16a4c30468236a636e1da213d27e37d
MD5 383f213649e7dca74389bc7717ecab07
SHA1 ab780df56eba236c2892570552e7117810138779
SHA512 9a636ff6713e3288e4cd897144dc68714507b1aed7b922bcc895b71da423dcf78bba3b3c985142acbfd18f367f69f39cbb780ba9bbd90847b9c1004982eb54c0
SSDEEP 24576:yA9T04p4/1MGXCrbBB376YStwHxDCWYkbJ3tYbZsZbpZ6:xT0IycbBxlowHx+eJTbpk
TLSH
T1F2757C43E3A44798C167C239C68B9A0BD77178050362ABDF25A08F59EF63BE3177A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
Size 159KB
SHA256 28b753795101ece7c933d4d47130f51f2b7de8635ba154eaa03ebc82f8cc9f78
MD5 2fa56e927d91beb5e6996e60b6311b73
SHA1 67775975e2e2055590c93cfed03958a77d427727
SHA512 7fa1ea01a5477db7e312416f186291fa440dfe75d476be8654ec84845ace6dd9ea13133f693a013ce8e14e24ccae9589ce63cf1a7b088e80422d6d0a78472420
SSDEEP 3072:XSApjXbrT36b96bavsTHnbNgJUcJbgPHsLCncI2ojCZr:XX6b96bavqHnbNpXHsLCnc/
TLSH
T1BAF33913F65143D9C567D2B8C18E0512F3B37444436297AF25A6DBB82F533A2BD3EA82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\CONTROL\office6\ucrtbase.dll
Size 987KB
SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
MD5 61eb0ad4c285b60732353a0cb5c9b2ab
SHA1 21a1bea01f6ca7e9828a522c696853706d0a457b
SHA512 44cd871f48b5193abb3b9664dbea8cdad19e72c47b6967c685cf1cc803bc9abb48a8a93009c972ef4936e7f78e3c92110828790aa0a9d26b80e6a523bbcd830d
SSDEEP 24576:xOPJ1g7mT6BNvwTOxNfoYotrz1111111r8SoKxmxvSZX0ypdNLh:xO1aNoaxNfo/+a
TLSH
T18D259E64F75C0AA6C17BE17CC95B550ED972340647608ACF03EA8BB97E2BBE91637310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\CONTROL\office6\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\CONTROL\office6\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\CONTROL\pl_PL\style.xml
Size 3KB
SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
MD5 034f37e6536c1430d55f64168b7e9f05
SHA1 dd08c0ef0d086dfbe59797990a74dab14fc850e2
SHA512 0e1911c882152a4e1059a3ce1880d7fb2aed1e1e36cbd37055de2e2a1333acb2a0233ba2a4d969ccebbef1e77809aa5e78807aa9239545beae8c548c0f8f35c0
TLSH
T1E381CA80A610BD0AC563F51573AB7509762CB36383ECCFC4F0EE2E698753652644B63E
MD5 SHA1 SHA512 TLSH

Submit Download

product.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\CONTROL\product.dat
Size 79KB
SHA256 864381c3016e55b25aea9ae26d8fffdef73765fd46f4236be41362d6f65a7f3e
MD5 40f76894c78e6663c228b1838980753d
SHA1 1cadeddca59ea127d390303c98af4dc947ccced7
SHA512 918f18e2140efd4e0e34ec6f77b7ec496ec3274d9c60a9a642ad988dc507279cf49f334c0ff70b5de6e33f286552379b26bd06669b82371d79a6bb19b021136f
SSDEEP 1536:1yKppE+qTZTbosBhg4/vS8UeZC0kySpgno6:1yUE+mZJBhF/K8k0kySmno6
TLSH
T19F837DFB7E1E2EE568CF232A5D7B2C2CAAF54D15349B548862C3E558EC1C0B63CD6508
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product_new.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\CONTROL\product_new.dat
Size 72KB
SHA256 8b8908a5a2964c840f954bbfd59679fb684c3bc3aee98332b28d5eda76bd5db7
MD5 dce25ef9e38d176ac64218dc2893eb7a
SHA1 4b98920088e6e12056d2059bc5fb618e26b84e11
SHA512 a95e331e650953fecd10f19dde0a1e1ff5d1fd0a79e2c43f42118f4d783151bd2d4f959a9c6a3e79b9eacf5cf53761545721e1ccb3648ecda596c7fa0ae3ed01
SSDEEP 1536:I3Vrh5eCifWIY/Q2pHggLLw52P/E/nNsB+e/zEy7m:2Vr/UdOAGN0FsBsV
TLSH
T1BA731B19DCE26DBD685056B91D376D8227B7DDD060DD30AC4B12AA0CFC3CF887B62A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5944ef\CONTROL\vi_VN\style.xml
Size 4KB
SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
MD5 394488b30107bcebb84a97ed5d754cee
SHA1 69ebe17f7d577e9bf69c87cff45c3251f0bbc86e
SHA512 24a6bc7debbf7030c1261c69cb4ae7bf3cbb5c7fac315188163c6001e58dfbe2e634925cb767044da7ea0e6d08c709b2ade02f6e43930819e1bef6f7569cad5a
SSDEEP 96:gd6SmSZcFe9gSs8TcySCSi58VS5eQJ/gQkgQ0/Mw8CclQgYzdr/PwiCSeDeR3ciw:gdAh8Ax
TLSH
T13FA17780A610BD0AC563A51977AB7909B62C736383ECCFC4F0EE3E658753692644B63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 387B
SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
MD5 c38481658f9149eba0b9b8fcbcb16708
SHA1 f16a40af74c0a04a331f7833251e3958d033d4da
SHA512 8f98d62f88442b8ef94aa10074e35aa8d9494f3c76ce8b143ca0bf7fa0d917f3175212fbcd6e7b0597fd0ec0e1b2827f157135512fb01c88218d36e2f7dd73ce
TLSH
T1D4E09B1BA8D1B0ABDEB302E988979D54BAC03D9A066D23147762540D3D32918FB41D65
MD5 SHA1 SHA512 TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 433B
SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
MD5 a9519168ca6299588edf9bd39c10828a
SHA1 9f0635e39d50d15af39f5e2c52ad240a428b5636
SHA512 0607eb1f5598320961fbd8ef75beeb1b6dc1af3cae7eeb5ba352f3e2a2edb25e1d9e68fb46c24e4299957352c0c906314c889c2d1092437eccc1d1a0485f3557
TLSH
T194E0540FA891B0679D7302F488E39C007AC03E96055D1210773144093C32A14FB81D69
MD5 SHA1 SHA512 TLSH

Submit Download

5f495c40c234747f57cbcaf29f2f3725.prog.tmp

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cache\skia\sksl\120\angle\1414_008c\5f495c40c234747f57cbcaf29f2f3725.prog.tmp
Size 15KB
SHA256 865adbc3d44637fcd84fba1606c54f9f50a42bf8fc316372b6a28d57cb0a5f2d
MD5 5b3df70acac0add3131c94dafb455f6a
SHA1 2301fd20881d7d6c0e20d721d02c493c397ec38c
SHA512 d81494d31a3d04d47ce2a22e57e3696073ee4eb1fecbffe99fdfdb8f00ca8c404e70947851a55ce3e6722232eb9f48aedb4abf3f8b4a14d0a5413dd1dd32ab34
SSDEEP 192:sExNQuFZumTwa5D6LT+xEngxqJVbCTIvHBerr3XF1qgUEE00ij7ywdFxsDYq/ztR:vNUB6qJVbSn3Iifyk3sE6
TLSH
T1F2620F0677B0C832CD2EB27C4C8386892739EC914DE1935B744C772D0E772AB5A66ED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73b548de20df7f5a13684ebb0d11ffc6.prog.tmp

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cache\skia\sksl\120\angle\1414_008c\73b548de20df7f5a13684ebb0d11ffc6.prog.tmp
Size 12KB
SHA256 01a6a0c8f44c5b03846714ec49e2437bafe8b89e61f86803c31d077f41dd3bcd
MD5 57ea2382eb6e75e6c406afe49863ec23
SHA1 3cdea3aa766a83066fdcc0a27f7ee0a8bd68c8e7
SHA512 5be809614ab69ba5c34865266630931ca80e704592f8a0630d28bed9b104750d98dcd0c0dab69aac138896b884b29ed770ff2d50e5566e7cbf3a1f27ec551b30
SSDEEP 192:hKIuFZumTwa5D6LT+xEngxqJVbuTB36R3XF1qgUEE03zvzIFxsDYq/z7kLBEE409:1B6qJVbZn3DzvzI3sE6
TLSH
T19F521D057660C822CE1EB27C4CC7868A2739ECD25EE5835B744C771E0E371AB5BA6EC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksomisc_2026_06_23.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_06_23.log
Size 3KB
SHA256 aa5794ba00985604f66d694913ded46b2ef95a23d9f31ff963813cf0691aeddc
MD5 7f5f63f91b0f7b61c3cf2f43b893c2c5
SHA1 3512d26052851eb96aa5ddaef183fb435d71d5ca
SHA512 06b1614bd736192a9e8696ec32236478f212d0e59032ccccacfa241787dbd3b53979bd8df64142b68d4f5dea4b724c01a4d9ee568156c95e434e672d6aaea8f0
TLSH
T1C1717A69ABF94044F7B78F56ACF654A34E76BC93AC20D80E0951234948B6E94EC7073B
MD5 SHA1 SHA512 TLSH

Submit Download

ksomisc_2026_06_23.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_06_23.log
Size 5KB
SHA256 4973639d07ae655fac31dc50b9d5dae01b435dd0aafb49c5e071e676d056dd8c
MD5 cdc1f2af51cd98ba893374609a20f689
SHA1 08f02ed1bbe3fb2b9637f4bb004ac2cc91c1d6bd
SHA512 566b99755a76e6979dbccd6ef05bf6f366aeb3784268a4b7a653e60d2125c6070da3b835a8db928cde3a725fe4a9b7b49df346d61dab74c6a5778fe263eeabc8
SSDEEP 96:JK/6qYoH5siWOKoHGsi+HhKoH6uzsi+HiKoHGsi+H1cKoHVNAsi+HEhK3c1siWOA:SRYmlmWtauzWumWSnAWk6EvgLRYLzb3I
TLSH
T1D6C15C6A6BF94145F7B78F46A8F654A34E76BC93AC30D80E195123494CB6E90EC3073B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 10KB
SHA256 b920efb5e6ee671044fb6d1f81af428ab6872da926e4f3f9116d40aacc3c3298
MD5 70833da7883b05559e10b96a0705230c
SHA1 5523e0ba5af87ffbf18681b08fa8499938b45c15
SHA512 52ac4321a2993ae79485c0cb4759710f6284174cb18a378b1741dedf903f89745921440e71e1192b7a18dd78249ad59f16435ee91f4aa90333e45f0cad459e77
SSDEEP 192:oXKZkkZtPQrA+mfo5pLyZBGqmOtpCqTX5GCwUZbFsk/LyVyfLW8ue03AOmwsxI7F:BhIYF0
TLSH
T1EA328E6380DE015C167E5B29A2F24C8435CA3AC8634537553F37EE9BEECE422427F668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 11KB
SHA256 01d5263481f457e48e52fd507b5804db1de7c56875de1a1a4f1e8a1e9c276ba6
MD5 117f5f824e9eb5af717e922ff42697e9
SHA1 e899c7cacb1ec502d5bb6bb9bc321dc70850df15
SHA512 b86587cf56e6326065c3b95276e106e80f46399422f42d33e38aeaa6e7235ab5f835e65bef9db872367a79cb59959ba4cb5735329e87ba8ff94664ed9f5b9551
SSDEEP 192:oXKZkkZtPQrA+mfo5pLyZBGqmOtpCqTX5GCwUZbFsk/LyVyfLW8ue03AOmwsxI7g:BhIYFLv
TLSH
T12C32AE6380DE415C167E5B29A2B24D8435CA3AC8334537553F37EE9BEECE422427F668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 26KB
SHA256 f8576baef16972b17f61fa570bc2206fe52cb10528add0ca3bf31c686241da67
MD5 835abeed2b3b9377e9ace06da8edc415
SHA1 9aa02396a78697ac776f4c3a0d50891e371306b4
SHA512 188e2382ee1ddf3cafe01f3d885354ea4486e03866fb0a670673811454f24e42938e8ff151f34add95dd241d73b2c6b1cfb96e6be6128f9cefcbe3456fe2ba8b
SSDEEP 192:oXKZkkZtPQrA+mfo5pLyZBGqmOtpCqTX5GCwUZbFsk/LyVyfLW8ue03AOmwsxI75:BhIYFLkCF/E
TLSH
T1ADC2706740DF900812FE974092B58EAD30C7569B371836563F728AA3A99D91383FDF6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 59KB
SHA256 d132c86562cb8c6f45ef13140be73fa4d42d69d6c61c126d82c54d939447b372
MD5 22314460126337cd19b67edace47d400
SHA1 41b1158cf1de98b21d53e9da7b60729cbb217167
SHA512 d93a3bed3e84586575fb637fec01d1ac38cb74e78488f4022c5d3f6b6dc6e28e9bb3eb723e1034dd0ef08e4642f169f2dfb897d5c89c46ae03c120e3c39e5154
SSDEEP 192:oXKZkkZtPQrA+mfo5pLyZBGqmOtpCqTX5GCwUZbFsk/LyVyfLW8ue03AOmwsxI7N:BhIYFLkCF/bK9hmKJYAkCtS1P8
TLSH
T1E153A06708DE841416BED75041B38E6930C7565923183B2A3FF354A7FD8D8178ABEB6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 59KB
SHA256 4c7de14a67bcbe60ce6d1e392d4bc3f77957663754fe0b7ecc2952d728986279
MD5 ea373c466420e3302c072f7a2a79a5e2
SHA1 6e6d4a8d60e9b1eb5630e1ed5b826feeb99a6b6c
SHA512 aed3167848a5c7b60bc255fa8d1f9d6645d1d48cb4fe0278b53cece47785f79e41be98e77cb197af36d1e1902262cf9c6dd13ae57da2f96db8752d4fcb4b3d08
SSDEEP 192:oXKZkkZtPQrA+mfo5pLyZBGqmOtpCqTX5GCwUZbFsk/LyVyfLW8ue03AOmwsxI7H:BhIYFLkCF/bK9hmKJYAkCtS1PE
TLSH
T1F653A06708DE841416BED75041B38E6930C7565923183B2A3FF394A7FD8D8178ABEB6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 65KB
SHA256 0c373c2b7ab71f60e074e6fee6a0fe6027309a38fe2bf102d6eb3b9b3c574aea
MD5 79e276bbec7a2f5ca3273193c20b2475
SHA1 a8d390f556956a6652307300513fa26471c73d38
SHA512 2c7f415e0c7d0c5bf8dfabb5d584ca6affadb0bde3cee4443f0f04e120046bc6077655b0deddef09f75c9c8c15dd8e9b7f21c58be3ef46d99151c014861b4eb4
SSDEEP 192:oXKZkkZtPQrA+mfo5pLyZBGqmOtpCqTX5GCwUZbFsk/LyVyfLW8ue03AOmwsxI7p:BhIYFLkCF/bK9hmKJYAkCtS1PBWuaZj1
TLSH
T1AD63905708DE8414167EC75091B78E9930C7569923183B2A3FF394A7FD8C8178ABEB6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdbx.dat

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-x64\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat
Size 64KB
SHA256 6c3177c77c1ff170acf1006e5a92331d64ff5d16307d99c0162764c3f630ba26
MD5 9d347c9b284b8ce4cdf30f674545e458
SHA1 e5a154499a65185116017d7ab580b23a95a43ccc
SHA512 f7589ff74bf32350e3d1e6e24d5a8d4fdb0782966d6607117f1e8892ac7c07f2346bc519a2464632e0529ed7459d6fbd94dfdad48931b9dad465b0cf5d8ac8cd
SSDEEP 192:shgSOLZ350HhjbMv7Jrs2hgVUw3XfVOm6StJNMv7Jrs2hgpcSiW5xsFu2DoJMv77:sO/jsZqJFOywcNSNqJFOiSiB+qJFO9j
TLSH
T155538D5CE1959F7CEDE517B8B91B8E2F6AF74788A20A0B053413671668835BE71804CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdbx.dat

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-x64\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat
Size 64KB
SHA256 d59af4f0d948df1d6020ca1f3853c7c192d4804fcf384befc72b7f042cf5dc03
MD5 a182ee448e5b80d9c1eecc94fb7c31e3
SHA1 7b7970a1dd2a80d813a7b2b744f6c266e0bef0dd
SHA512 36401c9b8ea000c7effd85d97f9dd32d396f9cb2e4e0c5dab1f521ec030aefbdc47ff1067b090d31ff673b091754a77532e2fcbae4c2ed97ed7c051cfea551ec
SSDEEP 192:ThgSOLZ3500hg6OLZ350bUw3XfVOm6StJMMv7Jrs2hg8cSiW5xsFu2DoJMv7Jrsz:TO/jXOnjLwcNSMqJFOxSiB+qJFO
TLSH
T1DB537C8CE1D5AFBCE9B916B8B85A4E2FB6FB4785A30A0F053403171578835BE719448F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcsdk_dpv3.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
Size 40KB
SHA256 bc95d2f3432292aa81dcd1d0bdf9a57d4d9deb9d63dd924708db3a0164ae9415
MD5 69eec8f351f586d2902042015daec8b1
SHA1 3aba18a818cfbe5468a73d330093bbaf08f1cd17
SHA512 eb1109f377836b18fd3a3c75bda6d0ced79f535b1940a7e68bc91af47990323aeec79f4ff0d397c93b567d741e46204ca422a5217b387b89cfc89ef16b2f4174
SSDEEP 768:6mwOa8RbbFZhDq9SYBaMdCMwWE0ENT116DbPdPsqAN:EF4bbDhDq9SYBVEF0tK
TLSH
T121130F96B7FA1558F6F72F6569B968944C3A7DD22C09E4EC01602C8E0932F90EDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcsdk_dpv3.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
Size 40KB
SHA256 68563f87af89d938470debb88815a95519033f765540f021f33611fe61dc1a5a
MD5 862d3b567f386f4d62e2afa5cbeabe8b
SHA1 8c2e2ae883fbf02549356ee31110c99aeefef98d
SHA512 b821bb08d429f9e07b1c995478ac59b8291dbe5da6a604f89888a2681740b880addfd47e56a42ad54afd67f734baa409ed563092baf30c88b579862f87dc17d8
SSDEEP 768:6/wOa8RbbFZhDq9SYBaMdCMwWE0ENT116DbPdPsqAp:HF4bbDhDq9SYBVEF0t+
TLSH
T191130F96B7FA1558F6F72F6569B968944C3A7DD22C09E4EC01602C8E0932F90EDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kappconnectivity_3.1.0.1698\download.7z
Size 798KB
SHA256 e231e00cdb25d1eb4f16e5f4275f3db79637ea9d2a3a1fd707d02fa37fc9a2ee
MD5 8a51f14292fa44559a37a42586a63b74
SHA1 094abb4def67e37d3d363e42058a9b68fd6d8901
SHA512 95e1fa96bc73062d1719ad0741b7053f8995dd47876bfcc57d15bd52512144f3c8b8d79316d56abc9fa6f924f786b50f1c15af8c602d9a897b5075c9c74c08f5
SSDEEP 12288:OqtpzIx+wVCk0Ye4uEnyiGO80MVB2+DQFm9ia/bg7o2GaPUAIYFWdKtI4LAy/0az:sxLVxqEn3GOXaMXFgz/b6sYFWdPbGjdp
TLSH
T10E0523F3304FB663997ABAF0D3072081BA296F51158CD7491FA4E4FB7B81316F1458A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.0fc07147.css

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kappconnectivity_3.1.0.1698\mui\default\html\email\entry\static\css\chunk-vendors.0fc07147.css
Size 62KB
SHA256 d9d0cde090ad393ceec510d347fd12127d082ada343936320e582cfcc24b8b00
MD5 c96afe57670301c26dac84a000609d80
SHA1 b2b7bf5834097996ab165b36e3afe86597ebbf5c
SHA512 d2957baa84f0cc7aced5a96a93687c62fda23a0778423786c39775e1ea47fc5029be3f0a684babc1d275eb3f22b51eb96a32bb54c3f34de6cb36c7d461ef1968
SSDEEP 384:HKRmkrxprNOoYrTrvpHEJXz1E48U0hKRmkruT8VKomkrs4o+OuIzK6mkr8v3Kem3:8r3BruirsbyAr8nriV
TLSH
T1AA536D20FA5B803FBA7F16BF46D8D56E299A59C2CD059BD37DA10234F7993B72042930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kapplist_3.1.0.1012\download.7z
Size 359KB
SHA256 1bf89e0ae9b86a6415e69d20565720cb13db959741db7d3bfedb1df0c6fedf6b
MD5 c575964d2a7127ad34f7a8e21c93d430
SHA1 747d0b82df5b0d042268b40a56ee91020ca8bf21
SHA512 eb8ec89bb67c4729d63c215026c98982367c2b6cec8ace1c604b27fa866dbdda25ac1c9f4b440ff57d7252a80212013cf0eb82a1554860cc31094571484121ab
SSDEEP 6144:c6wjztuWQgMbvtn5JMXW1TIzfvod3h957Gcdar/vNvvSlI3j5a:A5uWD+tkmdI8dhxMTdKCjc
TLSH
T1767423455BE9472B02F8CB5AF0F36B03E54CCE9F9DA00B6860F5599D0635134F2EB998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kcopilotentrylite_3.1.0.1950\download.7z
Size 382KB
SHA256 675fbc85824e7ed9626d9c9dc0fb284edf0363c3104d5799108b51a572681b38
MD5 394ce73091cd5d32297e38e58ea116fa
SHA1 fcd7116d8cb7dd79bd1e50435e52be60670a3ec4
SHA512 481c6cae1d7dae48eb7ec1ebdcbe066cea77eba137268774b4018d9b2bf77a81485d024696a9c92f6c1635a64ab32c4dd6c9aa908a054034af3b2d6ecd597a04
SSDEEP 6144:QIh0PiooMk/R1+bwxwGvqSKqXDS8i3TDbh0z8fZ86Ob5rbx6H6WHR478/Yk8CR1J:QIGiUkp1+cxwwNDS8GTJ0z8fr4IH6+K4
TLSH
T18F8423B328363F366990C8CE0874496CAB6B3180DD0E05EE8FD8C154F756662F9BA7D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kopenappmgr_3.1.0.6013\download.7z
Size 93KB
SHA256 262875ab35b912339d2ca3eff83ed0766960e6adef2c0c330958cbd46d3194e6
MD5 de3ee6809c50b962a902279a69cba466
SHA1 55020e374f6a0478b94f11b503868ac44c591c37
SHA512 e009c77331e0689ea8ac0ea366443a2c06e005e9d13b295a0b737266f1cc38a550e46b641753f2fb7bdf3f12f39eccb920a08a71d39f9ab7893c9897fdb1a825
SSDEEP 1536:X31Qh+rCDaCjOXIRnWlqsWAAPuFk5+lxN0TwFwNrdwO8j1e+Xsn141I/+nRJOBMR:Xl0+ODakWIRWwsCunlx/ZXsnK3CzDxe
TLSH
T15893129D1D64020A5410B0567BFBD210C42A0D8E3791BDEB1CA96C95877F8C21FD9EFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kprivilegeresource_3.1.0.3455\download.7z
Size 469KB
SHA256 d206b59fb32466c3013fe2a15c11f264e45937d893b492d70439f9cccd3a9370
MD5 47de7337f395e5344513bc4daf7ba3dd
SHA1 4c4acf875294a77cf9a2411da7da8dcf4b43974a
SHA512 41da833b62428d80ff78b9f6626da9079ab56b2cc543e347e98985832128e26f570ae3186c7c8f3af6c5047f2133f13a0afb95b93804e9a5b0eabf2492e9092b
SSDEEP 12288:nPUAwlPG63MMK0g8t4ZpHBe6IDfEGjESgS55g:MPVP8MuBetoqHg
TLSH
T11EA423AC99912B0511C86F4863D9BA1ECCDD0779640F397F5FC58A536BA2D9CE230A0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kpromeextic_3.1.0.6066\download.7z
Size 31KB
SHA256 20f7f6c57e7567b6d24f2acdd7850b6e0ff2e5e3f8705f0f58db9ad17bd8363d
MD5 75213f8596234a8cfe0e834da8e95251
SHA1 f64cfadb11dc145de49e16ba53249f30b32b05f6
SHA512 d58f45d62b2a6d35ec88aee61f41c0f5db4a65889d6fc1e658e827329d2233c9ab1b5059f52974d644fbf7c012d6bb9df607f891b2119bc0eb382aef4022a7b2
SSDEEP 768:l2mT06UYtdAbhB0rIPqbFjlxSUJ7ILfzt+AqIU34/V1f6A:UmTttd9oqJjlxSUFS63SJ6A
TLSH
T13FE2E1A56CAA38D7A5582CDC1A30C81457EF8A13EF04A5F391496387E87F6BE0C06967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kpromeextic.dll

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kpromeextic_3.1.0.6066\kpromeextic.dll
Size 87KB
SHA256 a9f5efd8282f4d1483445f8b6ef79ccf15529f9fc6754662f6bfabb381edf130
MD5 dbca1dc6ece3c52effc69b4ae79202bb
SHA1 00c51def7b9f7e30880c9794c4907b93f8fc3feb
SHA512 dee9bcd3258b8f47b03b6fc74d48bc069e868014441b12d534bf88df255b5f67e43535334dc09bc877689936669e3a2df1dbf20510bd626896508e937698f0cd
SSDEEP 1536:VctMF8EpHDaNDFDfig9Hsdvu+FQL7bDju77+:Ay8EpHDkDFDM9uJL7a2
TLSH
T1F9935A7EAACC4365E46AD134D9D14602F9F27060A760A3CF12558B3E0F27BE12E79F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kpromeextic_3.1.0.6066\run.ini
Size 254B
SHA256 ee4e99e62e9d5d8a695f3bca3924c2dd8e1ff560b1605f8d30bdaeab4fbd0610
MD5 34cab09c7041df85fe486eca14090b1b
SHA1 999bad45ff56b62e4e326c0d6306b3ea5f0b1d65
SHA512 485520ddfd2e0f34e6b2ba17dca8767164c3b8c8b20606aa58bbcb3ed008f4accd5f6044efcc72ceea56913efe140f85cfc4e7aee181f1bf74c5ee7e33dde2b5
TLSH
T162D02B0291B0A44C96240E6194392F56116037733609A96681F904981EBCC2C96D9166
MD5 SHA1 SHA512 TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kpromeforceclosedlg_3.1.0.6024\download.7z
Size 66KB
SHA256 c3ea60cbfecf39c431318ccb28a136ca56efb2c64dba0d55dda5d9260b2d9ba9
MD5 41c5456d008c9508928a9ca83b53167b
SHA1 e184fedcb251f6545745dacf96496a5bb5c664ca
SHA512 ec2921c05edff7d5613e7b6180242f4297b1740e20fb56e9a7df8db15e1310ad7305bd8729dd04488b34b33a9909880ec4e9b89e39804b628aa63b2b67f3e916
SSDEEP 1536:4Nm3WdNFDerbIreywAvqrHiLuAZwOy2Mx4P9l5HxuU3wlySxcPza:4NYWZDerbIKywQqzcvLy2Jl9cySxcba
TLSH
T18F630225BBC5C6018A683873417A1FF268C2343D7D5E44169D2BA488DBA2A7BF7900CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kpromeforceclosedlg.qm

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kpromeforceclosedlg_3.1.0.6024\mui\en_US\kpromeforceclosedlg.qm
Size 1KB
SHA256 e560c266bd3d7bec7e21374f0e3fe749c905bca8586625bcccb094ef7fc5634d
MD5 4ae165a4b39bc063151c3a8a59d62eb4
SHA1 5c8d1f57369fecfb45f3d2dae152785cf12d95fc
SHA512 6ae04f88465078763e8dc30e5b96ccb980c7ae595d4665294dcceba56c5702a65718b871cfc492d71d4072050cd533ed407166377c253c4a9b39876feba73d2c
TLSH
T19341699267FD0800F3B77FB57E7526A00E3ABC56E838C64E0210044E4AB4E90CC71B63
MD5 SHA1 SHA512 TLSH

Submit Download

kpromeforceclosedlg.qm

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kpromeforceclosedlg_3.1.0.6024\mui\es_MX\kpromeforceclosedlg.qm
Size 2KB
SHA256 7d7675137f7c29d8b52775c2c41bc936d4aa174b183002d0e0fc2b9b241f3826
MD5 ba25bdf828db266d2d8d53f0701b935a
SHA1 d3d5c3b91aeb1754136e5b8bd6b284fb6c4805e1
SHA512 83961b04acbcaf226902350745c464ae20f7a29ad5878a382636cb21d6eabc2a9264d1e6d879118b803525dfedee37d500402319a9139f269b58c576ec5442ce
TLSH
T18041806127FD5546FBF73B35A83916644E7A7CE1AC3EC41E02202A9E0930F849D64B33
MD5 SHA1 SHA512 TLSH

Submit Download

kpromeforceclosedlg.qm

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kpromeforceclosedlg_3.1.0.6024\mui\fr_FR\kpromeforceclosedlg.qm
Size 2KB
SHA256 5afe32de5ac5165ce8e9b594f4fe4dd4c3baa36b35c1fbf97b119c4247c7cef1
MD5 ec576b2a7794e5d5f549bfeccdd9cc3d
SHA1 da629b88617ef13fcae15cba96bd3001a2993e22
SHA512 9cae190aca49be6e93ebbb868ac6f2956dceb8561082d27c393505de56d9125b9f766b6e723a70ab545f19ed236e1c3a6db610e8fc427311c3a02d4eff0a12c5
TLSH
T144417A20A3FE1915FBF27B757C38152A4F3A3C869D38D41E0628259E5972E488DB0B33
MD5 SHA1 SHA512 TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kqingaccountsdk_3.1.0.579\download.7z
Size 2.8MB
SHA256 b6c65e37eab9bc3a7669b9c776bad57dbc8ec3890afde5d21baa9018b8280c7d
MD5 bdb2df518ece8bf323b45b99ce30ec81
SHA1 d08e3be9af93b456dd17547fc02f2307ec4f045c
SHA512 40fb7f206b6004675519f8cfe8f7787c68abbc9339afbc0a32bea9a87ce847112aa90424983693877b54328b27a589b2797f9a91dc6528b5471a9a561b263673
SSDEEP 49152:RKNDndTPx6uBWfaBh163JR9Iu/q8MapXSdCoWegXu5YFBCjLc4IhbgcPC1/:wYuIaBhEJRV/+dChel5YFELc4C6V
TLSH
T187D533B1DAE1380FD1719F7E1CF25909DF3434EE8D7B58D1CCE46B66B24A48648EA025
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

close.png

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kqingaccountsdk_3.1.0.579\resource\vippayment\assist\close.png
Size 1KB
SHA256 bcd8c6d489d395d55c672d71d63670c683299d7b909373a18fc8ad239118874c
MD5 6273157ba552379b2dc34816e3807df5
SHA1 91eb0d424775da522ef9bcc1bdfcac0bfe39441b
SHA512 342888d30ca1035863adfa149aee4cb96edc0c86232a9137e5c2260cce3c62fdd2b66197c836d8000ab9ff00a23cf6ca2851fe6f59aeb7b6c9b22af2aa9ebd38
TLSH
T1CD11634DE9C12842A58CD64214FE8137BD164AC0DAE4E467FDCDD052A8611FE845DADB
MD5 SHA1 SHA512 TLSH

Submit Download

json2.js

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kqingaccountsdk_3.1.0.579\resource\vippayment\assist\json2.js
Size 17KB
SHA256 7e35a128a3995615056c6cf0ac6acdd8c573d311ea7eb77944a38b0cc249a48c
MD5 70076c10161172dce6461c4a7e2c0328
SHA1 3c3af30b5390eefc902155477ca577db5508ad94
SHA512 e97bc35a19c42d452313e38ea8389ebc3e2f25ac8bfb77b98c91a68a44539c857927fe49d85214d82c2a7f66a0dedab6142e819c1616f0999fb4afef1d388299
SSDEEP 192:Ow9jtYQcSd+FlRfzegonUKhA4wRjKiv8LRLhbt2534rngViSX0YO4RExrM44A/2L:XjVkDsgYujuLLbiincimV9k//2h
TLSH
T1798282477D861233483A63549B1E601AEB298177936CE4D4B8DDC3992F31838527AFEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loading.gif

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kqingaccountsdk_3.1.0.579\resource\vippayment\assist\loading.gif
Size 2KB
SHA256 9a437409d5a4393137aaa5e4152e4737e0df91354bd574afa13cfa9c2940d6d6
MD5 a0a1a4631aa04ed6fba64a083e239476
SHA1 241892834d80db16b78e0f9edc926b5dc217d0b4
SHA512 f82ebbfac68e6a0aaef82cff589c7a9731e64d40d0ac72edfca64eb68f6504a7376a0c2c5161bc6ac401da0273060bf6343806e339387417aa1daff3789c2fb5
TLSH
T17D51B65FB8407C0B619F25592DBE9677B90604D48950F26DAC4CD0925E7B2BA033A2EF
MD5 SHA1 SHA512 TLSH

Submit Download

loading.svg

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kqingaccountsdk_3.1.0.579\resource\vippayment\main\img\loading.svg
Size 1KB
SHA256 a3df9710c7e09fd8cffc14bfe45f5a1576deb1846ced44e5050b34caf5527049
MD5 544223e85768fd134633a1af9d5bf536
SHA1 5536a0023ddbfb2ab67e9ad8ca4d38c60f413b9a
SHA512 a5cacba054d41af8efd607074c02f36ab731b5d6bc9ffd3bd7ce6b09a4af09b31e29359eb965728d2a00849467b1af66e16186a0c07b4415b3b423a5ea4f68ca
TLSH
T1142165D433B77469A49483787FEDB807D05558E21B824964FB8D0915FF001A718BE3C4
MD5 SHA1 SHA512 TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kqingaccountsdk_3.1.0.579\resource\vippayment\run.ini
Size 303B
SHA256 9378a1ea8baddf207fa68aff55acf14f68e348c6dba6bc800e25da37b84a740f
MD5 c646b8698a216d20e84200150b24eb0f
SHA1 d6c9929f7197d6d9a7406df5ea28f04d36fb0ed4
SHA512 8c2e63b2bac753a285ee0181cb8fd3e27e21771fc3ce9a28f158b43dd1c377945fda17652bc742b30e573cfd45660db642e68db49680bb812d9df1eeb9b2656e
TLSH
T1E1E07DD8D0787FCBA83787B1D854BB4B71A5B635703D0983643048894EA74552484059
MD5 SHA1 SHA512 TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\krpt_3.1.0.907\download.7z
Size 1KB
SHA256 9c7c826abaa375e74858c405463c213b3e7099d66851419da1996a7b705df340
MD5 ce12bb86e613011b1ac1fafd3850ae21
SHA1 4120e27be5f4827e08013f7a60ba5dac8ed5a150
SHA512 ce54b96409b6923f9d0589bc68b808c94063b7db70f1b29a7c14e3334034e6bff79cd0ddb92c66163ad42d661264b93d039ec4b9be7c9ab6ebd50870946048e2
TLSH
T10C21CA9257521F0BE9D16B75D637F5020A95C2BF2580A09C49FC55397506A7911B0E1C
MD5 SHA1 SHA512 TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kuip_3.1.0.18\download.7z
Size 7KB
SHA256 862892de2b7ac0461a9a8b587ffc8afcaf03cccd605da65f4184d8acbe569348
MD5 617879771bde74c485e882803515026b
SHA1 d9e0bdb529f55b4df5091e7c98688179895549b5
SHA512 09e0835a5c99916c653e63c1083d255d7808c1a26aeaf3c98e386d38df001fd37a58c62072e2648b8ecce375ba23d1221829f269329f40eb9ff847682f7f23bb
SSDEEP 192:TtnHnDlEDydIyYLVGsqhLYnOBENwv2UhNVawqHp:Ttj2DydIywVGTLMb825wqJ
TLSH
T1DEF1AF660D5F717B9288E7A400E73E43AD9B08C9B44099E8F9AE4C33FC97D44ED58E64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kwpsaiwordtool_3.1.0.1693\download.7z
Size 512KB
SHA256 197a3ad251e605151c301c5302a59095894392ec5ac005ae2bcb25a0551e237c
MD5 f8dcdf4873ac8fd4063bc14fc5483255
SHA1 98392050420465d9276ecaea30215eab852452f8
SHA512 5a7be8d5589792de031f4d8802ee7065279dfde3a788d9990ff272c6f5c8f5cb4108cb855b2a0f075a9d84616a972c7e93b9e829216c2a2a172067926c2a2276
SSDEEP 12288:e8LIQGLfMUu0p++wip1ZKra2YBj5tmD3YP1quLTKR:0Lf6oPpTHxbmjYku/KR
TLSH
T176B423C4F64898130E4F9C64D6B7DFDF54DA7B6ABBF09F9824B100862E569C83D8221D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kwpsserver_3.1.0.6064\download.7z
Size 202KB
SHA256 f260af15df6c9e97c11c637399472679dfbea67323b22e7f3cddfa3653077025
MD5 a18f266df77db6404c57ff9c9a223311
SHA1 015fa75a681e55edb4ea321f09ea71d39c0aada5
SHA512 b95a33dab685cdf1b1d54a53b3959d759f1d67e46d840f3e6f620fe3bf53608a5f42942bcfc447af7affffec1f430acbec65da71c68076dfdfca60fe2e673e3b
SSDEEP 6144:7KY5ik/vB+Ua8pqNBuKQfBKU+hKTJIow2Q0HtSmLwZRg:7zh+ipEQFJKaTE0NB8g
TLSH
T14F14232321B30ED4E68EAC41C045B04FB91F67CF51F46B18725B9D753D3A9AAA40B6EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\perfmon_3.1.0.6049\download.7z
Size 116KB
SHA256 2add31e605d9186997bcfdb58eb4ea5f893f8f7619f0806f93a651b9af044775
MD5 424e2612d041a30bbefc078d068c3dee
SHA1 de5e9a7ca23eaa734c05f39dc6740b0986bad2d0
SHA512 dd7434917d5438c8975ce303855ddf82af49687120b48a4af8b06444bc8f60de5c923b34cd139d784b83e25eefd067a978ee5f22b10c68b7b1a2fa53ec3a79f6
SSDEEP 3072:TvkSl68rHgdgtfa9hrUm8zcV/xzDUznxBYcS9sU+PusEjIsQCH:TsSl6QAdBrnE8FUzry2fPII3CH
TLSH
T146C312E0412A7AE12F036D1185DCFA87F997FB1E895527FA29B39528D34CE045326CE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1144-8369-0x00007FF6E36C0000-0x00007FF6E3A6E000-memory.dmp

Download

memory/1144-8387-0x00007FFD60370000-0x00007FFD62070000-memory.dmp

Download

memory/1144-8370-0x00007FFD6A300000-0x00007FFD6AF4E000-memory.dmp

Download

memory/1144-8372-0x00007FFD698B0000-0x00007FFD69E3E000-memory.dmp

Download

memory/1144-8371-0x00007FFD6A1B0000-0x00007FFD6A2F4000-memory.dmp

Download

memory/1264-8275-0x00007FFD6A1B0000-0x00007FFD6A2F4000-memory.dmp

Download

memory/1264-8276-0x00007FFD698B0000-0x00007FFD69E3E000-memory.dmp

Download

memory/1264-8273-0x00007FF6E36C0000-0x00007FF6E3A6E000-memory.dmp

Download

memory/1264-8274-0x00007FFD6A300000-0x00007FFD6AF4E000-memory.dmp

Download

memory/1264-8295-0x00007FFD60370000-0x00007FFD62070000-memory.dmp

Download

memory/2236-8294-0x00007FFD65DC0000-0x00007FFD667D9000-memory.dmp

Download

memory/2236-8293-0x00007FFD5E8D0000-0x00007FFD60367000-memory.dmp

Download

memory/2236-8247-0x00007FFD6A1B0000-0x00007FFD6A2F4000-memory.dmp

Download

memory/2236-8246-0x00007FFD6A300000-0x00007FFD6AF4E000-memory.dmp

Download

memory/2236-8245-0x00007FF6E36C0000-0x00007FF6E3A6E000-memory.dmp

Download

memory/2236-8248-0x00007FFD698B0000-0x00007FFD69E3E000-memory.dmp

Download

memory/2236-8265-0x00007FFD60370000-0x00007FFD62070000-memory.dmp

Download

memory/2528-8414-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/2528-8409-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/2528-8408-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/2528-8407-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/2528-8410-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/2528-8411-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/2528-8412-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/2528-8413-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/2528-8415-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/2528-8416-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/2768-8322-0x00007FFD6A300000-0x00007FFD6AF4E000-memory.dmp

Download

memory/2768-8343-0x00007FFD60370000-0x00007FFD62070000-memory.dmp

Download

memory/2768-8321-0x00007FF6E36C0000-0x00007FF6E3A6E000-memory.dmp

Download

memory/2768-8323-0x00007FFD6A1B0000-0x00007FFD6A2F4000-memory.dmp

Download

memory/2768-8324-0x00007FFD698B0000-0x00007FFD69E3E000-memory.dmp

Download

memory/3520-8210-0x00007FFD60370000-0x00007FFD62070000-memory.dmp

Download

memory/3520-8192-0x00007FF6E36C0000-0x00007FF6E3A6E000-memory.dmp

Download

memory/3520-8193-0x00007FFD6A300000-0x00007FFD6AF4E000-memory.dmp

Download

memory/3520-8195-0x00007FFD698B0000-0x00007FFD69E3E000-memory.dmp

Download

memory/3520-8194-0x00007FFD6A1B0000-0x00007FFD6A2F4000-memory.dmp

Download

memory/3536-8988-0x00000000057A0000-0x00000000057C6000-memory.dmp

Download

memory/3536-8987-0x00000000032E0000-0x00000000032EA000-memory.dmp

Download

memory/3536-8969-0x0000000000E00000-0x0000000000E08000-memory.dmp

Download

memory/4152-8419-0x00007FFD69680000-0x00007FFD69C0E000-memory.dmp

Download

memory/4152-8417-0x00007FFD6A0D0000-0x00007FFD6AD1E000-memory.dmp

Download

memory/4152-8418-0x00007FFD69F80000-0x00007FFD6A0C4000-memory.dmp

Download

memory/4152-8420-0x00007FF6E36C0000-0x00007FF6E3A6E000-memory.dmp

Download

memory/4728-8291-0x00007FFD5E8D0000-0x00007FFD60367000-memory.dmp

Download

memory/4728-8292-0x00007FFD65DC0000-0x00007FFD667D9000-memory.dmp

Download

memory/4728-8244-0x00007FFD60370000-0x00007FFD62070000-memory.dmp

Download

memory/4728-8223-0x00007FFD6A1B0000-0x00007FFD6A2F4000-memory.dmp

Download

memory/4728-8222-0x00007FFD6A300000-0x00007FFD6AF4E000-memory.dmp

Download

memory/4728-8225-0x00007FF6E36C0000-0x00007FF6E3A6E000-memory.dmp

Download

memory/4728-8224-0x00007FFD698B0000-0x00007FFD69E3E000-memory.dmp

Download

memory/5140-459-0x00007FFD6B210000-0x00007FFD6B79E000-memory.dmp

Download

memory/5600-8168-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/5600-8174-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/5600-8169-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/5600-8170-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/5600-8171-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/5600-8172-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/5600-8173-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/5600-8167-0x00007FFD4E820000-0x00007FFD4E830000-memory.dmp

Download

memory/5600-8175-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/5600-8176-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/5600-8177-0x00007FFD4D3C0000-0x00007FFD4D3D0000-memory.dmp

Download

memory/5600-8166-0x00007FF6E36C0000-0x00007FF6E3A6E000-memory.dmp

Download

memory/5600-8163-0x00007FFD698B0000-0x00007FFD6A4FE000-memory.dmp

Download

memory/5600-8161-0x00007FFD6A500000-0x00007FFD6AA8E000-memory.dmp

Download

memory/5600-8160-0x00007FFD6AE00000-0x00007FFD6AF44000-memory.dmp

Download