291c3b70a93496d9a03f448d9851415b11d1a1d52017c27fde938afbb36693d6

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Size 5.2MB
Sample260708-fe873aa151
SHA256 291c3b70a93496d9a03f448d9851415b11d1a1d52017c27fde938afbb36693d6
MD5 33a194a4530566c813fcced8e9e51ab3
SHA1 daa31f2ae46a2b03349dd28c4902c0332176c698
SHA512 764c198183edaf2a3ca02c1945dd7a840b611d75ee59ddabdc15f727f38095d8431f8fb79c42255aa9004f54b0c5e2bd15960b18c9c0908bd3d873767b2aa340
SSDEEP 98304:ttS5drV2MeZ08Rdaz0PB4XqCc8br5MUG/rx:+XoDrCcmr5dqd
TLSH
T1E146AF01BB85C5B1F59201B0587AAB7A583EBE38573089C7A7D11E2A84312D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
1188	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
11656	ksomisc.exe
11912	ksomisc.exe
12088	ksomisc.exe
6912	ksomisc.exe

Loads dropped DLL 64 IoCs

pid	Process
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	119.29.29.29
Destination IP	223.6.6.6
Destination IP	223.5.5.5

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1212	ksomisc.exe

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	\??\PhysicalDrive0	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
File opened for modification	\??\PhysicalDrive0	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
File opened for modification	\??\PhysicalDrive0	ksomisc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Modifies system certificate store 2 TTPs 64 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\TrustedDevices	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\OemEsim	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\TestSignRoot	2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\FlightRoot	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\TrustedDevices	2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
11912	ksomisc.exe
12088	ksomisc.exe
6912	ksomisc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5760	2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
5760	2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
5760	2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
5760	2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
1188	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
1188	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
1188	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
1188	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
1188	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
1188	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
1188	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
1188	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
1188	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
1188	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
1188	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
1188	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11656	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe
11912	ksomisc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
Token: SeRestorePrivilege	5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
Token: SeRestorePrivilege	5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
Token: SeRestorePrivilege	5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
Token: SeRestorePrivilege	5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
Token: SeDebugPrivilege	11656	ksomisc.exe
Token: SeDebugPrivilege	11912	ksomisc.exe
Token: SeLockMemoryPrivilege	11912	ksomisc.exe
Token: SeDebugPrivilege	12088	ksomisc.exe
Token: SeLockMemoryPrivilege	12088	ksomisc.exe
Token: SeDebugPrivilege	6912	ksomisc.exe
Token: SeLockMemoryPrivilege	6912	ksomisc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
11912	ksomisc.exe
11912	ksomisc.exe
12088	ksomisc.exe
12088	ksomisc.exe
12088	ksomisc.exe
12088	ksomisc.exe
6912	ksomisc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5760 wrote to memory of 5148	5760	2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe	89
PID 5148 wrote to memory of 11656	5148	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe	91
PID 1188 wrote to memory of 11912	1188	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe	92
PID 1188 wrote to memory of 12088	1188	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe	93
PID 1188 wrote to memory of 6912	1188	34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_33a194a4530566c813fcced8e9e51ab3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5760
- C:\ProgramData\WPS\Installers\34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
  "C:\ProgramData\WPS\Installers\34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5148
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -checkInstallEnvironment
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:11656
- - C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
    "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService
    3⤵
    PID:12808
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -addFirewallRule
    3⤵
    PID:12860
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wpsoffice.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wpsoffice.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=klangmanager -dll_name=klangmanager.dll downloadlang en_US
    3⤵
    PID:13560
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regmtfont
    3⤵
    PID:14144
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\\office6\ksomisc.exe" -setappcap
    3⤵
    PID:7108
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -sendinstalldyn 5
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regPreviewHandler wps.exe et.exe wpp.exe
    3⤵
    PID:7316
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\\office6\ksomisc.exe" -registerqingshellext 1
    3⤵
    PID:16188
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingshellext64.dll"
      4⤵
      PID:16784
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regkwpsshellext admin
    3⤵
    PID:17356
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\kwpsshellext64.dll"
      4⤵
      PID:5852
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\kwinappinstaller.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\kwinappinstaller.exe" -i "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\menuext" wpsappext1 wpsappext2 wpsappext3
    3⤵
    PID:17452
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regqingdriveshellext_install
    3⤵
    PID:14532
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*install "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
      4⤵
      PID:18608
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*thumbnail "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
      4⤵
      PID:18708
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*drivebho "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
      4⤵
      PID:18888
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
      4⤵
      PID:18912
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
      4⤵
      PID:18948
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*onlinefile "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
      4⤵
      PID:19004
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regpdfwspv
    3⤵
    PID:19468
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\pdfwspv\pdfwspv.dll"
      4⤵
      PID:19952
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\pdfwspv\pdfwspv.dll"
      4⤵
      PID:20252
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\pdfwspv\pdfwspv.dll"
      4⤵
      PID:20344
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\\office6\ksomisc.exe" -setappcap
    3⤵
    PID:19484
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\\office6\ksomisc.exe" -assoepub -source=1
    3⤵
    PID:19904
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -clearmso2pdfplugins
    3⤵
    PID:20616
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -uninstalldatarecover
    3⤵
    PID:7716
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -collectmsoinfo 5
    3⤵
    PID:10052
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\\office6\ksomisc.exe" -assopic_whitelist -type=setup
    3⤵
    PID:3468
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regmso2pdfplugins
    3⤵
    PID:12260
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
      4⤵
      PID:12728
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
        5⤵
        
        PID:12688
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
      4⤵
      PID:12696
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regPreviewHandler wps.exe et.exe wpp.exe
    3⤵
    PID:12772
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\\office6\ksomisc.exe" -defragment
    3⤵
    PID:14012
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -unregisterwpsphotoautoasso
    3⤵
    PID:14032

C:\ProgramData\WPS\Installers\34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe
"C:\ProgramData\WPS\Installers\34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1150.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E59F274 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -setlng en_US
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:11912
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -getonlineparam 00601.00001150 -forceperusermode
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:12088
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -getabtest -forceperusermode
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:6912
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -fixoldversionassostatus
  2⤵
  PID:12572
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -setservers
  2⤵
  PID:6944
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -register
  2⤵
  PID:6460
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
    3⤵
    PID:13980
  - - C:\Windows\SysWOW64\regsvr32.exe
      /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
      4⤵
      PID:14024
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
    3⤵
    PID:14092
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regprogid true
  2⤵
  PID:5768
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -assowordexcelpowerpnt 1 1 1 -source=1
  2⤵
  PID:8420
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -compatiblemso -source=1
  2⤵
  PID:18396
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -checkcompatiblemso
  2⤵
  PID:14740
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -saveas_mso
  2⤵
  PID:14940
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -distsrc 00601.00001150
  2⤵
  PID:15172
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode -source=1
  2⤵
  - Network Service Discovery
  PID:1212
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk" 5386
    3⤵
    PID:16028
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -addcontextmenushellnew
  2⤵
  PID:7332
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regvascontextmenushellnew
  2⤵
  PID:15828
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\wtoolex\wpsupdate.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\wtoolex\wpsupdate.exe" /from:setup
  2⤵
  PID:21400
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -collectfileassoinfo -module=1;2;4;8 -daily -source=1
    3⤵
    PID:17612
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\wtoolex\wpsupdate.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\wtoolex\wpsupdate.exe" -createtask
  2⤵
  PID:6976
- C:\Windows\system32\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kdesktopshellext\kdesktopshellext.dll"
  2⤵
  PID:17720
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kdesktopshellext\kdesktopshellext.dll"
    3⤵
    PID:17880
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regyunpanfornew -forceperusermode
  2⤵
  PID:17968
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
    3⤵
    PID:13668
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:overlayicon "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
    3⤵
    PID:7896
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
    3⤵
    PID:23980
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
    3⤵
    PID:24128
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -setup_assopdf -source=1
  2⤵
  PID:19248
- - C:\Windows\System32\openwith.exe
    "C:\Windows\System32\openwith.exe"
    3⤵
    PID:16092
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -assofdf -source=1
  2⤵
  PID:20132
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -externaltask create -forceperusermode
  2⤵
  PID:20528
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wps.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wps.exe" Run "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\ktaskschdtool\ktaskschdtool.dll" /task=wpsexternal /createtask
    3⤵
    PID:20920
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wps.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wps.exe" CheckService
      4⤵
      PID:21348
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wps.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wps.exe" Run -User=Admin -Entry=EntryPoint "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.26886/office6/addons/ktaskschdtool/ktaskschdtool.dll" /user=Admin /task=wpsexternal /cleantask /pid=20920 /prv
      4⤵
      PID:9220
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createsubmodulelink desktop prometheus -source=1
  2⤵
  PID:20580
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createsubmodulelink startmenu prometheus -source=1
  2⤵
  PID:20608
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -assoofd -source=1
  2⤵
  PID:20624
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -assoopg -source=1
  2⤵
  PID:4156
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regcadfileasso
  2⤵
  PID:6400
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regemailfileasso
  2⤵
  PID:7492
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regarchivefileasso
  2⤵
  PID:7128
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -installbrowserextensionhost
  2⤵
  PID:7008
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regvideoeditsetupfileasso
  2⤵
  PID:21672
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regemmxfileasso
  2⤵
  PID:23800
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regeddxfileasso
  2⤵
  PID:15128
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regposfileasso
  2⤵
  PID:22508
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regxmindfileasso
  2⤵
  PID:8432
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regvsdfileasso
  2⤵
  PID:24168
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -repair3rdlink
  2⤵
  PID:7732
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createexternstartmenu "WPS Office"
  2⤵
  PID:21848
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -rebuildicon
  2⤵
  PID:23792
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -addJsapiCert
  2⤵
  PID:23844
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -updateskiaconfig
  2⤵
  PID:18256
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createsubmodulelink desktop pdf -source=1
  2⤵
  PID:10064
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createsubmodulelink startmenu pdf -source=1
  2⤵
  PID:11040
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createsubmodulelink startmenu wps -source=1
  2⤵
  PID:11312
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createsubmodulelink startmenu et -source=1
  2⤵
  PID:11616
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createsubmodulelink startmenu wpp -source=1
  2⤵
  PID:12028
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createsubmodulelink desktop pdf -source=1
  2⤵
  PID:12164
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regpersistprintmenu
  2⤵
  PID:12216
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -pintostartscreen -source=1
  2⤵
  PID:12464
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\kstartscreenpinchecker64.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\kstartscreenpinchecker64.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Office.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Docs.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Slides.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Sheets.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk"
    3⤵
    PID:4692
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Office.lnk" 51609
    3⤵
    PID:12860
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk" 51609
    3⤵
    PID:9260
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Docs.lnk" 51609
    3⤵
    PID:12388
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Slides.lnk" 51609
    3⤵
    PID:13092
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Sheets.lnk" 51609
    3⤵
    PID:6544
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk" 51609
    3⤵
    PID:13504
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Docs.lnk" 51606
    3⤵
    PID:13508
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Slides.lnk" 51606
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Sheets.lnk" 51606
    3⤵
    PID:1580
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk" 51606
    3⤵
    PID:7280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:13260

C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
1⤵
PID:13408

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"
1⤵
PID:6688
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wps.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wps.exe"
  2⤵
  PID:2064

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wpscloudsvr.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wpscloudsvr.exe"
1⤵
PID:13608

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\\ksolaunch.exe"
1⤵
PID:22964
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wps.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wps.exe"
  2⤵
  PID:23004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 f5c6189950488e958eccbde807d980fdd84022bc53a29587e6791b9e1805254f
MD5 84b72e9895a1c8922733b0fa92ca481d
SHA1 dc86edf0654180fd11bb063b2b78d760c9e21c68
SHA512 5e5b112c18d039305be4b2519a09f72abcf24dc7943ed5d325939acd099028492dbeab47a7317bcf8e69dfe790434f7a34b742b45a82c051c7ffcc04801b99d9
TLSH
T1FFF0DCFB65BB60423803F96C0DE88A761374D9CF4996D1B261B119C48B942AA624F05E
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 727B
SHA256 30db3e84d6a8b9d50419ba36a6a7c38553c6d66c8fcb964488f3b5124eb17459
MD5 b48d0abdefeac9b4b78dedf13d08c2dd
SHA1 45737c38b9f512b0eba2172eadccb421956f1821
SHA512 5e4192440dc84ebc30f4094d905004a819dd38782519a30b508ab275cbb56afca13c72d1ec8a7f758166da7b1a9297ce62584a41cceea6f71bc72790df6c49fe
TLSH
T1B401D8056F4B6612001B011B0AE0AFFC3F631AA56A2808FE772519C1B0C43333E163B0
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 a1f94b5beb7cbf9c3a608a3576ab072d303f92c9a8d4f6d0f348cb5e91200bd2
MD5 8ea56e8ffe7fce997d4f848ce9297372
SHA1 b435370908898c778a99946461bd38ed8ab6aebd
SHA512 d188745f3787580ef372151479557056f7b59116846a219ad8e8b5775d2e9481d134fc3e8b802391ea75542138b1c7f79dc3655dc1bb2a6f1d9acada89f13027
TLSH
T18501609E33A0A74838261D45D7CCC07CF2B780C22EC90304B53A35AA92A67EBCB03815
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 5f00a9b24dd1f35567356a78a3091f911a18c0d47cfbb742d8df5a654097c94e
MD5 50acc51734f54b5540b3ff01a27358b4
SHA1 5f729396c401fb3fc4a8f6c8024de835c8bee6ae
SHA512 a0cd4e55fc43202c8d0e3a0311d33205b38b83023d2505ab7b059b8546244072199c95d5747fba63dd86333edfcefcf9823b21cdb0d5d15e232b339ef957ff0a
TLSH
T166E0202017FB616EF2749B7847D594D79F26F1162C4D96BD1F82149DA919D005C62C30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 404B
SHA256 f94d0fb793a3a241d9af0a767bb7d763df2000a0c53143cb1b3c1718c8cea793
MD5 5b333c8b2eda42881642af905c6d860e
SHA1 ddd1784409b9063c57da15be8830152a61a838c3
SHA512 822b7b10d9cafbef44cb5001e62b0812d91d83aedf4d0dab74538ef318eae84d60eddb1e1bffcfc189f5c64f941254b448be51577fd501d739f5c4416e9eb75d
TLSH
T150E0C63033F9499EF0F8E4344BE7AC224C9AF10A09C0C3A80640230AAA2AE008CF3234
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 ad0d77ed90274d2a35aab3b3eb640c5c2684dc88b5b7740a92a3b09d826be562
MD5 fa0eec26e1a18b67539e1742a163f963
SHA1 886e23b7c760f9152f3b326db7b071e29196f4b5
SHA512 f66a3a1632eb1c2454a8081033306b9e6f696eb0d81e31a2493b8575191a097b50482910bc7d8c82fbc0156875de18e8e079ef981dbb9ff0233eeec67a3d374e
TLSH
T169E0202C56EFB6AEF090DC3546F9A5771D9AF3055444E77917D54308B71AF405C10AF0
MD5 SHA1 SHA512 TLSH

Submit Download

Qt5NetworkKso.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\Qt5NetworkKso.dll
Size 1.4MB
SHA256 3a0a4fdf72e953e2d7712da7506c45bfbf1ca1ead3f1e3c1ea8d1983f82f2ccd
MD5 68c2e9eaa53e526fb98d6d19d550ab70
SHA1 e865bf02f95e4ab4caec4ff8cb92f1006ed6460c
SHA512 a18e6806ae086f09b48752610a60f37e97ee37078c63de8b65969e4130ebb49eb5258d0cb3fb036be637a16008a6c7e047b4f6921f280b861702222296c7355f
SSDEEP 24576:SkbqCgnInomjARXqFrdpEGcqHnwg0iVB+6VQ6actu:1NgnOo2q1Gc4wKL+6VHI
TLSH
T195655A53F7554399D62AD134CA8BC902F272740083A75BEF2669DB192F737E2263E381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5XmlKso.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\Qt5XmlKso.dll
Size 213KB
SHA256 0ca5325eca7238dfe2a51213450f9ba097e0bfb8a70dbf39ee589c85d3742b14
MD5 6d4ee7ad2cddd28fde9ac54f86739345
SHA1 daf0356ef05ac5bd110796414f5b045c17a7211e
SHA512 3b9abe87e8065c8515eb6b5db5625dd169d6836e8ae688ffa01a4ab7d44e636e3b45cc5c6db55669ee4563a77729c469295e08bd65e2b940c38a388b7386a9a4
SSDEEP 3072:Ghe9UZLXlmma9ECFoib660hOcOg7y5kghPldccXib+KkGDo7:GhbZL8B9Eooibz0gcOHdcMib+wm
TLSH
T18F242843FB15429AE127C138CD968807E6737C40576287DFA698A73A1F33BD2797E290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo-small.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\StartScreenTile\ksolaunch\logo-small.png
Size 6KB
SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
MD5 8d650fe389e3665607fdbf938c1a1722
SHA1 2e545f9555ff22313e4ce113995d8aa694e5cab8
SHA512 f116621bfecb602d02919eb1ee9d7dc92e82b313b8b54cda42ab48c5e7ec60b02005edcad763fff6b497ca4bc46e83cb0c9a249be791f245bb9c599950fdf015
SSDEEP 192:HSO0z+xgsZ7wNP+agwQznBm2KIvdgoeAtzpZb/D1:yMRoP+z5IIa8hD1
TLSH
T1CCD19EEE6F1CCE4F079D52F7500AC0A9DEA218AA905764D4D68E70B471FE6D120EC5C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\StartScreenTile\ksolaunch\logo.png
Size 12KB
SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
MD5 d58510dca6b659c6e4ba7a454d5b75ce
SHA1 e142de2dda3811a2e8bbbb2eb64d366e8eb9ea3c
SHA512 42409f9976ad08ecf1756d1c2915f3ffd17cdc78e9ff552c0a08bdfa2fda8960e408721bfc9de1a5ed9c9aca3e23b97adb721b3c51b6b3f0ed3ee4a4c780cf88
SSDEEP 192:ySLu8Kp8OtM5IirU31+5AejJ7D+N+QOtHQjrE9aTYpR8XnXrWjvyNTtLJci:NC8o8do1+5D+N+QPE9B2Xn7WrINJP
TLSH
T1BC42C08F68918EB2CE443C39F356115F1FE12A5E7E19A2CF2CE7944A239044ACE1591F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\ketaidataanalysis\webview\run.ini
Size 171B
SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
MD5 b30cb271e143eace0f55ea2e562e1e9f
SHA1 9d97dbf24931cfc114384c3f4dbbae21c9e51be5
SHA512 dc593185fa63b458024c3a913c558e5686806154181dea67eec786ada50595c53bab822833ad1e76c9acdf21be3eba50631391b7e575d7f1f6409ceccf966535
TLSH
T1AAC080D4D0256F97DC31C6B5ED54AF1A7560E700251C1EC3D530DC4E9E9696551C805D
MD5 SHA1 SHA512 TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kpubaigcbox\res\dist\index.html
Size 636B
SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
MD5 72cdeca808b16e794ec5b66bd02246bf
SHA1 e75b6c4e084efc8e60c9e4fbe9e9ae02bfbf4132
SHA512 6562ed498bae7f819caa5ebff9ba373b1bbeae3c92befacbc44a72419e6a3aedeee7fe43347d1bf8c46b9c90c8e515181a6dc50c4ad954a640cf6b2520269ed8
TLSH
T1E5F002EA3C25F055CB911EA43DF2F19E245E3AB29DB9DE942AF4513543C03694D0BF48
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kpubaigcbox\res\dist\index.js
Size 2KB
SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
MD5 67dde682d1968824023dd9773f9ec48b
SHA1 81e0a21a7ba2c05193ecc13672a3f537539e0699
SHA512 86bccae3d66df4dd552c12a42d1ed0d57d6cdb7b904caa1f89c874e506fb76412b2df45e3e5f673837cb72aa18b0ab2c1dfb489b1da37068d83d7ccb25d3d8ea
TLSH
T1FD5173C9F79E702209EAE136583F0006E17735596098A1C8B87ED8F16EB555E7077F38
MD5 SHA1 SHA512 TLSH

Submit Download

errPage.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
Size 7KB
SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
MD5 eb3b05c3a3fdef3b0c5c9020756ebb33
SHA1 27c5773e17f9c05f471ccd22db42015561b4e669
SHA512 9a511c6d0aad855448ae45130d7ed031062bb7e6881e68aa2406c7c122220318379c312bc13876599dd7fe88e2beac296adf5bcdc015ef4e0e3f362e76303ab0
SSDEEP 96:9uMJIMzvOcuq4v+nB1W1QjjaKhwc3Rgjfqqm8bm83:9lTgVv+B1W1Q6ywc3RgjfDm8bm83
TLSH
T141F15211D6925216603393B4DFA25719FB260023A3038A38BFECA2558F75C495B93FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicon.ico

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
Size 4KB
SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
MD5 1ba2ae710d927f13d483fd5d1e548c9b
SHA1 c0605efed936ee2600284e6480521d06fa64f872
SHA512 f933cd352eaba92f509b3863353ddfefadfada26a4152ecdc4727d450bbf35e7b10fb3038fe8db340d5c63d74e608c1560ec84d0f6ffc8ccd940c9e0d7533544
SSDEEP 48:i3H5R5hLOR4kt38PduMoglJrd6qTrp9hweFC0+6Ga:ipHFUs4MLBvuyCda
TLSH
T1EE9175DF61C388D9C1B1977F78C449A14F6FD951BA28351F55CF30622E5D75818C1C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kwebpromehelp\run.ini
Size 226B
SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
MD5 abc3a6089b0ea76ffc960fbc9b6e66d1
SHA1 50ad0cb201c13799024de56cf45116cf65ff5569
SHA512 ec1e32b7bed882095b23e049a4e1a86acf0bf993e2f691105ffbd99d93ebf28faad4fbdd645ac1eefa74ede575854a3994c7c6d2bacc6f7a09a1991561b1a44b
TLSH
T157D09700C0B5658AC1254C827CA53DC411085B4B27608E02CCF0C34D508EBECE56B08A
MD5 SHA1 SHA512 TLSH

Submit Download

close-secondary.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
Size 216B
SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
MD5 07306930f7d374663bd13e38ea0e92a1
SHA1 12f877e8ab93d874b55d75eef6747615619dad4f
SHA512 4cc0517ed0b9d665df4db93fb3093067e90f64b34f1d41420ed975b4cec64d4cc0aede64092d79c610c04e1ecd9514a9ef48389d5c157b5bcf698fc33670db98
TLSH
T1D8D0223BB3CC8E1CF9224A22F35A713580AF41C3548942E4D8322032E4011CEB93B6E8
MD5 SHA1 SHA512 TLSH

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
Size 334B
SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
MD5 d36fe6147829a72b42e054a5db27d270
SHA1 80779a8eb37d8bb1d5fcc594576f80dbd61fac98
SHA512 94224816f757241b3a6d19788225378ae070fc62b4620e11e10a033e3be5d9cc858cd9e669cc275b1fa82e57094d0df13a6d9868cf00afaa17cf2ec0193acd74
MD5 SHA1 SHA512

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
Size 327B
SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
MD5 18770de3f96bac1e75e588015024fcf8
SHA1 e6254c054edef68f9c27059efd82eeaa69c863b5
SHA512 fcb76291a73d7f2e30f4266ea8f0dfa2d9e203cf9770fb7ffd73cc1994502992fabd0803224c1e1155c1e4b678b5af0e8b3aec114beb1f02299e8885d5a61d0a
MD5 SHA1 SHA512

Submit Download

element-icons.ttf

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
Size 54KB
SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
MD5 732389ded34cb9c52dd88271f1345af9
SHA1 8058fc55ef8432832d0b3033680c73702562de0f
SHA512 e8971ae48f5287d252f5b0a2d0516091bef0d2febf7d01fd7b435e426d106fea251037439ec42c2937e934b66f38e5eb43d00a213cdf334f482f4a06b1817f9c
SSDEEP 1536:qTIRCXXCwinqtuPM16hD2N3SUjbwaST4DCJe:39GEcgD2njb5ST4h
TLSH
T10A433B32436A9BE7F416047F5C1F55830A9F4F22F53DEA8B83A6192514162FD0864BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

element-icons.woff

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
Size 27KB
SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
MD5 535877f50039c0cb49a6196a5b7517cd
SHA1 0000c4e27d38f9f8bbe4e58b5ce2477e589507a7
SHA512 da269b20f13fb5b0bb4628b75ec29e69bb2d36999e94b61a846cb58db679287a13d0aa38cdf64b2893558d183c4cc5df8da770e5a5b2a3288622cd4bd0e1c87b
SSDEEP 768:gOvv6ExpCVxUtrT6w8ClFd80EjPVerMKBaGXjAlEm:Hvv6xVWewtlFdGjPlkFjAlEm
TLSH
T1B9C2E13197213AE9D9824EF876E498FEF1651402290F390E8696ADB3A98D5C73E16831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
Size 107KB
SHA256 c9c5602e26393532e59391d5944a578716f3b6cad104ae20ac8caac805e52f86
MD5 d758ec835091abce0528909c5dadfe24
SHA1 07a9ffb19860ece3293780c707bc71f25a6e5d42
SHA512 74d869f2cc25b5a49adea778f52f59c6f4b7f2eca31c511f19250538d241136a6cbefedccb250a3773500bdc6b9caa57ae7cee40c0dc2d8753f2386e2f390cc4
SSDEEP 3072:KazzQ51KYGqMkYUl26MeCsAcdl6y7tqWD:mMQ/euD
TLSH
T13DB31B37214D132D383BDAA2E55D659A60C8F61BC01253F5FA247B1DCA837873A763AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
Size 279KB
SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
MD5 a3964e72421a1ef5fb60c6e17eb5d705
SHA1 5dd9584be5141e884a230c48746e1c88126b0a55
SHA512 4ce4119b7407b460969041809354c4ede587047ee643f2897eb0ecb9627608431f43fed27c54c70bacff3a6694eb32a85b535c7d6397ac22d7d28e260b0a5467
SSDEEP 1536:39eSBQG+dyAUlHj/8D0Q+SPxZztR+LCrwHFfyqHYb3PPV7BYUOf0I79lDxiRSL2Q:3zfZYKVxiW
TLSH
T14054B6229140212E702BDE3DF7C4EA4AE225C6B3C4125BFEF953651DC7C36AA117778A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
Size 380KB
SHA256 f1bd1ffaba49fd0c0040f182231f739000b0e4bc762900ecacab4980f743b203
MD5 bb8a0b01c0ac1190e643c4e9daf4b69e
SHA1 f0286c3ea896a359666be8f10a7519c767afb321
SHA512 da37ebedf1e5365df105b3bfb559d0dc6a75b2896ad29c844c6b987ac5388139fe88414cc6128144f6fa50086564ea67f257eec54941dd43b124be0b8b276573
SSDEEP 6144:5pK457wXrka10TbOXsEYpHBBs6Ve5NtXoqIpgznl87A6v0eX4AiDuViQbgQgILTv:64G0WtYpmiLlTD8QmIqU1NBqq
TLSH
T1E4846C4B758BBB5A1F35B66340DF3C88D01C6EC09812A5C9FABDD9D09144B9A32D63BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
Size 249KB
SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
MD5 6351ea268f992f52e0f4418a7028b91d
SHA1 5bb3cb88465c550a1fd033a079a8b2eba5e071b8
SHA512 44940d07abfdee6403e9400e596ac5e5eb234ba77a1c90c2fe4086878c12f4805c709eb84538071f21d5710d3569d342e7caea10061e2ab2661c5117c5966297
SSDEEP 3072:p+Xy2rHhkiTtcsuaIwK3zqDLW/ix3Iu7doNFBWgz/bwUzxqcG7gLEOhA:phKHhklsi3zpCdoNFBHz/bwAfG7cW
TLSH
T10A44F8CDB2D1B0A517EB61B4813F610BF27B6499B44E80D0E226E5D4BC7998E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
Size 424KB
SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
MD5 cf29fba214e7f43f2ca1b629109d126b
SHA1 d0dda9486528586af6943abe7a3afa319c790f25
SHA512 2ad7e4711f5917b8d13f861d4fb2688e6ce3951da43a89263a2d9743199e173429398ec1a9537b1df25593d3999dd34fb590e2d2a6e7a632ccc44265d93c3bca
SSDEEP 6144:z8KzCOcC0CXWsJvRekr0dgei/zJbBoCF7az2bzNM:zbzCODTWsJvRbw6zJbBfaz2bC
TLSH
T13694198DB2C1B0A517EB60B4913F610BF23B6469B44E80D4F266E5E57C7898E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
Size 10KB
SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
MD5 0f4634d4af8b73f882440c1181697d86
SHA1 748bb9a14c8a6c64fa060ddcb1b4baebfb3f6fd3
SHA512 eeff081cb256a44ff4557dae145c3d277ad936fef58674cb7d2949b6c302c3a746f05495daa6ccabf39c26bacf13c6fee3bab20de4f1d13810be0503787c89d5
SSDEEP 192:cyxPpQcKb2d4U1nE92Ui6OPl20b3G0qE7I2ByobYGeBv+x9qkgYbeO:zzFZr6OddG0q/yTh3UYx
TLSH
T1AC32C887B30483755A90E790F6C76DA5A93ED0EE73A4168A3CEE421812581DEB3E7CC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
Size 13KB
SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
MD5 dd59d31e84434c59c5c3735bd0b0dc3b
SHA1 c34473850d3749aae725856f68a262a0afebee00
SHA512 f3acd51920f945b49dceb56fd2a5a4ff170c4a5770665bef3d888f8497a288dc33bd15f24780cbe9b8ced585fbacb92a8700d1322a6d4acd2b6e5893370822ac
SSDEEP 192:GwSuCUHXDhEblYfhQ9GYSOqUr9b1AARAU0qWo3wYXVMojXiyaH:dCaXDhEK55YmUrLAgkqWo3RVhpQ
TLSH
T140523295F3C50E22B4991749BA03D57BF19558FAFC2CC18D5CF2D236136C9C986928C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
Size 14KB
SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
MD5 5cee0947c1ef6f00e18eb17cf77388af
SHA1 5a27bc625acfb46d2368a9a376d797ecab912a3a
SHA512 1bf91f08d2a2a446ef0e22df40fd09b090fa300f599bacdd5c698aa61a6fef12ad3d3e38299804a016e5a22a82ddfeb6840cdc7a79ea51244942cb22e659331e
SSDEEP 384:HTO1ksU66rAJGO+NedvSGdv+GfBgLj95LKn:zO1ksU66rAJG5NedKGdv+GfyLj2n
TLSH
T11D6230ACC3CD5C69C86183FA090B35C27836ED49FEA5AE7280EDF4202DA19DFD815674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apm-init.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
Size 57B
SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
MD5 b684f2b8022aaa97ede28f9d224c4db5
SHA1 2087206ddbfd6d6d71f843a132b58ed533d87169
SHA512 8d30da66bfdd99dab88c4b9766b692c39ecbc8dd725e9f858c95993d4f2bf46c37891a1f8f4f1eb6fe09bed7008b8df48d2a9b4f10d7caf20f823f121f6ebb40
TLSH
T19F9002E7F0A1707344616959630722AA35D11130017430010900487434A580FCD22F88
MD5 SHA1 SHA512 TLSH

Submit Download

default_ava.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
Size 906B
SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
MD5 c47a5cfed147c402538358294808e68a
SHA1 8aa499336bc4a50a70710735b67fc5da923fc61a
SHA512 a71831abb9393b6c0ad62feb29fefbb192e1706b08ab88dec0a8e6a9cf61b6a7e106454a7e6e518f69425cc91846036e8fe2956ea939625678f17b330860ba1b
TLSH
T15311E309934DC285960AD7B8563C1754347272DF9E1FD55CE7E633012D3C6AF185C27A
MD5 SHA1 SHA512 TLSH

Submit Download

desk-sync.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
Size 1KB
SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
MD5 c17417f321f52624ee0dc60ed76a31b6
SHA1 b64e19a5b03c92a931fa9a1eba899f491e669a1e
SHA512 bf160829598cf0b22ea48a5f7310adfbd26fbc1bbf23ea3cb8d9cebbeb92b5e81b914bd6021cd41df5984ef00698acb1c1151e134c714e0a1be7dcd439c78485
TLSH
T16D21F0ED57EE35C8644CD37028DA6079627B35F43969EF048914A9D1FE4205D499F9C0
MD5 SHA1 SHA512 TLSH

Submit Download

loading.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
Size 1KB
SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
MD5 0620393a949b58f6af37b0accb79e32c
SHA1 0025e4da5ffb8695a8f9731a05b1b89f1a71bf24
SHA512 0d308c758f825d548874cf8b4b8ec20f3685b39c7232246697dd95e5e5f40da7cd21de7ba5faafd0d8a121b5e6b85c5aadc4232e3f0c943535e062ae449ef29e
TLSH
T1333142D111BD0116E11AC365D7FD7AC70B3EB4DB26E558BCB68C250FAB404DB0A9B219
MD5 SHA1 SHA512 TLSH

Submit Download

setup.cfg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\cfgs\setup.cfg
Size 449B
SHA256 82f87a27f1ba7a594e884c8a0421556550400ac4830a1d302f87f488f825b179
MD5 ad259f976d7125635f4ef04484549af2
SHA1 1247fd35bc25230fec4c273406f9ee0e60ab473c
SHA512 ab62458ea097d2388f4fc86bac4c433dc94dab38ab31977b150d9e30cea9b04ef9c1c4db874de77f672d94b3469f5a260b55f0a8f4cbc1a0646e3d242f5b3449
TLSH
T19BF0556A0303B0741A61530010B914F2A3FB01C81117C04D2568AC8D6B7DC3D86BF13E
MD5 SHA1 SHA512 TLSH

Submit Download

kbase.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\kbase.dll
Size 1.2MB
SHA256 46edfa3ba43c594f802193a5ca5bce989a483dbe9f2a92c32a9797ee9b5f23c4
MD5 aff894e6a0d641959beeea14a7e0c5aa
SHA1 b652ac50f7916b8e4ad7e01d56d07147fd30d926
SHA512 6deb91768049ed38a1adfa2818bed3ecad6d90eea8c0f7de88efe788ad5cb7198cb534d63cabcd0f42fc25ef1e424177ded296a6cbc9f807afedf7f94e69c810
SSDEEP 24576:3LhFM4WZalXgeJa8VPizbud1qa1jw0eKGphF3Tbddilmt:7f3Zg8VKud1q29eKGphF2lmt
TLSH
T168455D5771A800E8D1AAD1B88EAB9D06D7B170960720DBCF16D0975B2F67FE16E7E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdesign.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\kdesign.dll
Size 1.3MB
SHA256 4072fbac904f3f734cc6eee3ee45414903795fbc2297459ba87272959f32798e
MD5 13f6f40eca5c3c6ea3f5f2f4c570463b
SHA1 90502cd0e2bbf45bf84c9b51ab59fb6cdd373cb5
SHA512 e1da11d54c72e31bf2b614e98557c75e9b9dea569dfdc588956d87ac5bac6dc4bf0b4613246b14ebd4b60acb5c30e3801128bd5438b53469d34ffd8983029971
SSDEEP 24576:njO4YdPOyaKYKNisO8SqRpzYSPp3wmRlQ:ytPOyatK8JuzYSPpNQ
TLSH
T105556E4BEB5683A5C0F9D27AC5CB8516E1F2B84181A38317649FEF293F633629C5D780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krt.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\krt.dll
Size 1.3MB
SHA256 bda1e9176fe2bba2386781750ef5e3b3467620eeca9860703969fa3d39d57f9e
MD5 13f487e34d18477856a477bf9d9cda67
SHA1 bdec93d92f426031ef5a0c4c39e9d92c0e860e81
SHA512 c406acef521f4777908bd21658bf8e911fe123eca637ebda4df1ea39934c4d9fca563e6c38485075e414a9aacd0a273b1db1a07eac1b82b08edc1198516495ed
SSDEEP 24576:naiaomjY5YVrYQU9LENTDqfZI9Rc4PfclH68jfUNKh:ainmUbQUCByZI9PfclH68jfUN4
TLSH
T1AF657E1BEEA943A8E17AD13CC98B4906E2F23802436197EB16A55F5D1F337E24B7D350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksolite.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksolite.dll
Size 12.3MB
SHA256 011db4b8073a9e732f6d3eb4e9de3a2296efb195e5d87de04c1c4535e8a54e09
MD5 11b08029055f1dfb6270e321da7dfcf4
SHA1 abe2f4fb85803125b416a4afa039efae8df2d7a4
SHA512 d48bdb2b44e7396885d8593587ed9a64a947cfabffdffa5bd56affaa60dd46b4decb410f54e643293c195b588b177c7148848b39a4c1857407aee114e1d0e0ac
SSDEEP 98304:u7OgLGApFZ95jUv6nkD0LYhAp2TFS+RqXFdzHzZ2:unD/Uv6kD0Ll2T7qX7zHzZ2
TLSH
T1BFD68E9FBBAA03E9D1A6C138C99B4902E5B17402872197EB25299F791F333F14D7DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksomisc.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
Size 3.7MB
SHA256 9d71d0e9daf7fbd9fe3ec176b8c63ea8fe568770ffa2a7e59620fea0cab35f1c
MD5 5ddd72ce7660bd8f7fd351c74b73a92e
SHA1 a6a6b3ab319678ca2d8f4c9541c73cc989091c28
SHA512 0b7cf49c35a92439650a8867131aa8ea006a34e692f42d7b7a91f218c6f8dfb222de5c818d00acf68100951bac38f03711057346c1ae5acf76ed230a5916ca12
SSDEEP 49152:CqPmT0JH6yx1l6NaCrjKq9uYCyaEP1Q0T1jReSPIU7BV6lPRpPFj5CqO0NkgNp+1:q0JxTMJCylf3xgcWCgm
TLSH
T157067D5B62FA03ECE1BBC278D6965903E2B2390687315ADB11549E750F337E19E3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kwinappinstaller.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\kwinappinstaller.exe
Size 29KB
SHA256 a72df058fc4c53201f90d03f130bdc53cd1cebc6f6a4171284f33240424c64ac
MD5 05136a9047ee1928e0d615b9b570aed3
SHA1 759fc1adcc1034b325e82e204cd6055810e0cd9f
SHA512 197dddbff6a66234c0cfde8c12d3d99bfd3ca55020c412b21b6b8ce171746bd0a56995b246bda679e862620376aa65e1a96a4cc8b336835fc9b711f8c951e8e1
SSDEEP 384:GX3jAgqYyeB7iZxsY0E5FvB1+NyEIYi2mL4/y8Rxtw7MxS1IYistw7a3jby8RbmW:Iq/cybzYiDLk5C7QpYi77kX5AL6
TLSH
T1AED26D938AD04C05ED77AF30B8E15125AFFAB5577991C1CF7288D1168B923822BD93F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-kso-1_1-x64.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\libcrypto-kso-1_1-x64.dll
Size 3.4MB
SHA256 e09f4377c19802677433467d1078efff457a6a14424410608188a5d3deb6a9a3
MD5 033cf459e694bca4f9882e10cfd45651
SHA1 791cf2af844c038f1ccacb02c648ba6dea84c5ee
SHA512 0a6de9c99a3398307e57c42a4a6c4ecad062b6c61013134343123d9795443a09db8ff380246858b7e4ce2655b346a950af53314b6341682f8e1e5d42a312c9ec
SSDEEP 49152:IOVwASOXFIU6idBGtlqXWq7TsRQLLMcCVetuaWvFIzNMmEn/NPnnUsjo1CPwDv3/:zC+ZsTc1NvE/1nUsE1CPwDv3uFHU7
TLSH
T1AEF58D5AA7A80184E5BAC13CC55B4737E3F2B95A17B09BCF18A1C1780F27BD62A3D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_codecvt_ids.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\msvcp140_codecvt_ids.dll
Size 31KB
SHA256 f2069a52880ec885ee7f0511186100eb7fada0411a2b4948fafea7735b878a18
MD5 3ece3fb90bfaea8e9a5fb7139ff9cbdc
SHA1 91b19dd0db24a5cbd944eca9c67fad3b53f9c154
SHA512 c059ffd80de25ad10d34064b1e9421666525da67710de0ac445cfc45b8139715dd946f7e90c1e0d719c60e3d5902e3229db4496c87d674c0012c9b4a8c2b2291
SSDEEP 384:p7GVNpd36sRWioEWEw4himRSt+efdDtdQ5R9zpU8NSqHRN7w9ju0R9zlWdo:5GVsfaw4DYd7ds9zmMEu49z0G
TLSH
T19BE27C89DA3C4487EC9B5C7082ACDE477C3D77C60A10569B4392F5181DA33C6EB3866E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

error-net-72.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
Size 1KB
SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
MD5 66726a0fbd424ccb700cecb212a47007
SHA1 9795ae26acf0b942ab6a0cd06f206ba69eda18db
SHA512 30ddd2fa17517792a86bdb03827a0809ed362ab2dbd9a7baf194d1f47348c96e0ca8e64515c1a58d7a1740e85f53a3676b49ff6c699d598a27c234c14672604f
TLSH
T1E031C6CD318AC42FCC61D531F4D534156817D760BF928C74102BC5576E0F68E58C6662
MD5 SHA1 SHA512 TLSH

Submit Download

presetLayout_16.pptx

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
Size 41KB
SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
MD5 f41e909b0284949bdd3bea9393a6ff2f
SHA1 a41497f65f44368ad517f464eb0da4403aa700c0
SHA512 d800b9b807a72d19f17bf5bb923d2489328b2f8801c2146b0c67d3d4cd8c70d5f22decd6581ad14d5584f3895140180c8578ede4fa8df755ca742c18cbb3b67b
SSDEEP 768:lwQ75cI1zETv/7H0vFtZKSZTRomseFVEFqG5IphchDB8h/rW7oELmG1wvcG7GyGK:9qNTn81Romse8Fl5ahcVChjQmG1/sl+Q
TLSH
T114139F61D40A142FC263B3F6E478164F73FEE86248179797ACD51096282F97C2E9D38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpscloudsvr.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wpscloudsvr.exe
Size 1.1MB
SHA256 ab1d3b24149d6be428a92620cb36f00f8a7ac732eb1537949f38a70e23e3b3a6
MD5 52cdb0fbab34ade1eecf62c26019d9af
SHA1 df7e7fb4e6552f15aa628097202574e3e918d48c
SHA512 5bafe61d3c652d6b7677b529c6a15db6ad10de4a468f271c749eab9628232b072c6aaa7c84c80d2872c39325cd97ace2f67aeb5e136f16b80343f6ce28ae9ac8
SSDEEP 24576:bGkDgtVvkc7xEItMad32IV0cZZl7KyfHGoAZYuYD2:bBU0qSa12IVblHGzZYus2
TLSH
T15B355B4A63B902FDE0ABE1798D525905E2B63C0607B05BCF079067771F7BAE95E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpsoffice.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wpsoffice.exe
Size 1.2MB
SHA256 7590159e451ab812e134d1479f42f77da57d5d77bf75451e4b484cad3c31d268
MD5 fc1d84893ef88d69771901c68f20f269
SHA1 4c25207395c8fef15e94449fec4b9b6a4fd1c224
SHA512 3596ff981a6987a5a354c2150f4b0da3b58675d90372351cea19cca3543966bdedcd40c71b54b319139173dd102c2142976bf6129470d734245006cf182921ae
SSDEEP 24576:ZD/tF/gTs5QQeHu5W/P0VBoIhw1yyC6BS9cUw:ZZFYTs5QHYAKSIh7yrBXf
TLSH
T15E451A366EAB02ECD36BD2787A525901EDB53C4AC7255ACB02D035763E77BE18E39310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\utility\install.ini
Size 610B
SHA256 b38a480343731a9dfbc06553a103aadb1425d5ec62f4f9916e702bae577b9b3a
MD5 0980dcc1ced7ba86175883187783a944
SHA1 6c04e4782060d58bd2525f2546b563a4c0bdafab
SHA512 7daa86ec8e3b2edd49e91fcbb22e434f4fcb8b51daa8d41e4a142406338f2346f2ba9928903e271817e1d90dd04d180079fa373be0187d12d21b198b3022f2a9
TLSH
T16DF07D0809C9C56E35292288A0D3859199AFCE552D8CD420E2B36E1AFC42D0E127947F
MD5 SHA1 SHA512 TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\utility\install.ini
Size 462B
SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
MD5 71e0a7ecd6bd2e91c04a3edf760c45d7
SHA1 e6cf872ce6def16bca98818ba289395580701292
SHA512 282b4c8be6abb97383d7dda8258fbf069fd668f4fad722582567cbc916b5c7da9a39a157a35511210306c19e46ef34c02af17f2af1ec7707bb3d84f3d529c3ca
TLSH
T178F097090C98C66E36282188B0D3C2C0A9ABCE260D0CE410E2D36E1BFC02E0A217E02D
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.1kyw3cbcsh7my2xvw8yukrl2.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.1kyw3cbcsh7my2xvw8yukrl2.tmp
Size 4KB
SHA256 9d2f34f1b17536dd689db858d42c85a78cb48ccf24f55fd578699dd1cbd7c930
MD5 2bc82584706945350309746d863da639
SHA1 f0862f788988dce106735e4bb66708aab43a06e0
SHA512 1956c1d910995ee93dbb0977f8bc82c1aaf14bdb7549b34eead6055390d26361321192d6cef4e18fbb1ad5cf6faf44693fadc932ce63595550769c6a50b81a5e
SSDEEP 96:0AxANmAN4ANGAxAqAGAmvACANANzAFFTfOS/VjHH3HSbUrbVj/x4JT9:zeTJzetx/ViGfBVLH3y4rpbx4JT9
TLSH
T1F291F14A98E415D052308825A36BE251AF0D4F9316CD80DCF9DCDA6D3FC53A79133AA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.7vys2iv3j8aq5avrfjsuw03ee.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.7vys2iv3j8aq5avrfjsuw03ee.tmp
Size 712B
SHA256 a3ca9aae4ba31a89982b18f1b929accb9db7d06a8d786f433ef5ccc667409b1d
MD5 16999ee867612360e46db316fe54ca27
SHA1 50e290a12b234894b2452342926802170d4d1160
SHA512 ee2d4abd25d50db7ecf28fef26e7c2cc82d1cd657521a746e2ed73ed55f63ae772f9daba305ceb4302541c486153fbcf08aca2c8d4a69d066d65f51dc83b73c4
TLSH
T14701F4289318BF3646784FAA0F7DB6403C13815B13170A2A5CC7887648270D11A571D9
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.jt0kqcyxjql8qx_y8ssdlxnt.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.jt0kqcyxjql8qx_y8ssdlxnt.tmp
Size 10KB
SHA256 6a4d990b0be7003b95bc575b5ad238994d031b2c69526448cabd29b4921213a8
MD5 87ad4327dc796a24011079bd1b65a275
SHA1 0b0f888a0dedf4f735af39a7ebadf5d808a0d6c2
SHA512 bbbfbf0e8da96938119ad9a02be8a9b50e95763621e754e81826376119820b53c7aacf56bc3df878be5fc4721aae56bd4bd53dea89729d8b4fa9f0914fefcd00
SSDEEP 192:3IYiYF8+2Qih7Gi6ULc8pq8RuwdmL4pUQrNy9jBNX:3IYistw7GUy8RbmL4nNy9dNX
TLSH
T1E2223AE388905C05ED17AD00B4C4E93BBEB276996AD0C1D77258C1A5CB813863BDD2F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.lsae2ewpzs04_sr9wdj6rozu.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.lsae2ewpzs04_sr9wdj6rozu.tmp
Size 712B
SHA256 7310eb8c9a5115a236fe0f5b2a40386c478b4a1c8de6c16aa20363d4beaa2659
MD5 4c961876f316a4b5ff5d8c905d7e29c8
SHA1 d26d0304cc7d3ba77edfdb54934466d272475bb3
SHA512 75884549e7bcbfadeb2f7f6293caa6ed782e79b9ea389180c312248361dd8c029f22f47c4b3e65234288b628a753f446d2d8631f0de7e82f90522ec8a0a22c73
TLSH
T13C01FE289318BE2A46784FAA0BBEB9403C02815B23170A6E6CCA897658174A11AA71D9
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.nf_73rbb1i4twb17sttzxj7cf.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.nf_73rbb1i4twb17sttzxj7cf.tmp
Size 10KB
SHA256 cb6e5f191043debcfd241bcaab6604c2640e3b74496a9cd5df3053363c67504e
MD5 b995b17de85c67ac8012ccf19db8cd47
SHA1 bafcd5e48adbccbdd9a8e1c028fa549970253d3f
SHA512 8a162fd3157ac13b4beaa65d0778f27b6790dd480be4fa66aaeb38088b73e1cd0c7331b11489f2c7231eea6ef1cf339980ea0b7f696f899105f84eed1d32434f
SSDEEP 192:BIYiYF8+2Qih7tUy3ueULc8pq8RuwdmL4pUQrNy1giXUc:BIYistw7tUn/y8RbmL4nNy1gIUc
TLSH
T108224BA388641C06DD17AD40B4C8993BBEB6B6962ED0C1D37258D5658BC13833BDD2F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.nk12o5n47zmo80jzxeaijgmtb.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.nk12o5n47zmo80jzxeaijgmtb.tmp
Size 4KB
SHA256 322a6bbe4151c8c0d85b94a20e1566a69e7e19532fe6bb7ee4b5d806daea5366
MD5 9829c378f563249eafe72d677b821374
SHA1 cc15a1a414235d26265ebec559f4673fccf3ea58
SHA512 08f7e7d3c93880f6fde8f0dafefa7c36c247f12a67239fa77c129c5e790b99a33622c24e7c08259d39fa0570c1057308d3650e3e7776602dfd29821853418ff6
SSDEEP 96:0AxANmAN4ANGAxAqAGAmvACANANzAFqTQOS/VjHH3HRburbv/x4JT9:zeTJzetx/ViGcqVLH3xyrjx4JT9
TLSH
T1C991004A98E415D052308825A3B7E251AF0D4FA316CD80DCB9DCDA6D3FC63A795336E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.pud3t1yw345z_q0mg3kqbdysf.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.pud3t1yw345z_q0mg3kqbdysf.tmp
Size 4KB
SHA256 81c968c375f69d9e4666901fd4c14a6ce4b738639ff78488562e2c79f8fb14d8
MD5 a4e510ae4ca446423550859eb3193a92
SHA1 de1f946c7687a9cbc4e427c106e62691a203b67c
SHA512 f835d5adb86ab9feb23517a26a7054a6cfdaead71c3b3e0f2a2dea959376a119e7dad97f1c02bd5ad7d53ea7b1f42e65e9847e2842a290a7d4f6ca807cded707
SSDEEP 96:0AxANmAN4ANGAxAqAGAmvACANANzAFjTpOS/VjHH3HMbgrbF/x4JT9:zeTJzetx/ViGhPVLH3sUrNx4JT9
TLSH
T17B91E14A98E415D092308825A367E251AF0D4FE716CD80DCB9DCDA6D3FC53A791336A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.s2im5lucomjh_re_9ldivqfqd.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.s2im5lucomjh_re_9ldivqfqd.tmp
Size 712B
SHA256 c4cbc1fe8ab082b7e179d5d73115ba2580cb1170e38f98ba559c61bbc8bed882
MD5 8cb162c05b7b15b7cdffbbc3b1fffcca
SHA1 5469c3a7fd57409caa9d668a24fe6d901655b472
SHA512 2fecaa7d5021c87582afa83df4e74f82888132b131fa00237f1e867996055da58643b38e573790d338a514e0f088039b788a30d8b619b9257fc2c7a0346f6a80
TLSH
T102012828A318FE35467C4FAA0FBDB5443C13415713171E6E6CC6C875581B1D11A571C9
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.xan9met1r8wfsors77ixj8lp.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.xan9met1r8wfsors77ixj8lp.tmp
Size 10KB
SHA256 73987e8a6a801a931993acb02080747b188fc99ad2afda42c910ec282f721c78
MD5 5528abecc22f8187ca5581f2f860f55a
SHA1 24f8651377fbc488747b90af1e500e43424b35e5
SHA512 b681c4751777278a910c236eebee6d382abd0ac8f4b3ad0ea82e623fb67ef4212dc7a88f8e7bd0737406ec9ad6a5f16f08af48ad0aafb1b80afa33176bbefcfa
SSDEEP 192:ZhIYiYF8+2Qih72n03sQJULc8pq8RuwdmL4pUQrNymYmSQym:ZhIYistw72n03Tiy8RbmL4nNyB+
TLSH
T1C42229E388505C05DD17ED50B0D4A93BBEB2A6992ED0C1D37258C1A5DB823863BDD2F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5CoreKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\Qt5CoreKso.dll
Size 5.7MB
SHA256 65d137a523877290b1f6ff9b91e1af2af59abbe73d777d29f1104363f4b8e7b9
MD5 cd4c6dcde7d8bba3fc6994c1fc637d6c
SHA1 f50214bbdf865cffd946bb376896069d2ab1ec04
SHA512 a02276bac417897153bb958fff46b9876f24a416fa0e4f5249365abfc6fc409d0e7eff2c769bb44fa1896a746dadfd70ea4d01f9a2e145cd2bc4d735a088b991
SSDEEP 98304:RUri4dZGPsSlUXJsv6tWKFdu9Cs9iSl4rhIscaY:RUe4dZHSwJsv6tWKFdu9Cs9iCscaY
TLSH
T1BA567C47FA960269D8B6C238C9D7C117F673B80147224BDF2298A3496A777F0293F359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5GuiKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\Qt5GuiKso.dll
Size 6.4MB
SHA256 8d7df941af0ffed8773b7c309c09c4eb7880d730e9adb5851218969536fa83b9
MD5 e80e45b25a485906cb792472c5999c74
SHA1 d1958d5b02f9f2b9c7c40f74a5e042de97fe4c86
SHA512 6d9f69cca7a278b375c42b8398c65ef9adb9a2c7c07ff286872f52ec55da0f3011572d711f6da41859edda9d9c19e8ce50f3f20c024b4b7fb3c930eab71181bc
SSDEEP 49152:rfwVgzsWrginPvS/6E4hlk3sbwIbapmRW63/LmkNuMdmboZAi073At0Lcaj1dTNt:TwVgzPU18vLmTiy3XLR5DfaFnyVCZa
TLSH
T1D166F986E6466359C972D17987CB042FE1F37C4683524BC36C45AB490E237EA1B7FE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5SvgKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\Qt5SvgKso.dll
Size 503KB
SHA256 a9d535ef73d2ecb8a65548c6fa33ef2ab1821f222e2e441e50ed042cfe56b5cc
MD5 4ec6a37ea49c3d0684d4a83a6626bdb5
SHA1 a1cb09c0c5927616b3d4b8e70e85b14ea778c8eb
SHA512 535c182121d2b4cb89bf5209f3facd9789cadd796aea7c06fbb7a318390185fa283c40eafdf5b90fb2010012ba9b28ad433193f1c7e71d034fb157cb452e8c17
SSDEEP 12288:meu0/Bj7pgf5fqNXGPhkjNBAVLEgZ/ABXH9a/vngheZB/XEnEsrnJpaymesGrx1s:meu0/Yf5fM6hAbw
TLSH
T1E0B44A93FB520398D526D27CC8978812F273340443A39BDF6A5AEB651F236E1763E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WidgetsKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\Qt5WidgetsKso.dll
Size 5.6MB
SHA256 0cdd865ee6e8929e84d588ca36510ab78099402e4d51831954e7fca5a77de905
MD5 9f051f09a8c18c495ed215237671c191
SHA1 c0cfa8b837b2e1471c6172dc9c16d00f5a35bd45
SHA512 cf0434b1af0862ce6eef71ffdc1f6cfbfe1f22fde9995450da51685561be1a2a29880bcaa1ba43144a4551f87e2374857d5bdfe21320aa8dcb405c6f6a9ed57f
SSDEEP 49152:9qfq5/IkuixdBehYNjzWVatL+RKR5TXY9vTRquLqPIPaRKp1BpHUtLZvwXJ7dcOf:yVSL3y5J7dcOw+6P8WW71iq
TLSH
T10D465C43FBA50389C56BD23CCACB8513E6B27800472347DB6959DB692F637E2197E780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WinExtrasKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\Qt5WinExtrasKso.dll
Size 251KB
SHA256 7d37dddac87b495479b8e0e99eee847efe5a73969b42a707f8d2a9598187aefd
MD5 f65a9b18f0cb40d4c1849c47f4d6ee56
SHA1 0943fd20df9a5f3764242d991bd3d0f67929cbc8
SHA512 bb9aca2d30f73e0e940a290c2f74b2fa7478eece2582535fdfe78a85d3bf659f2415efb0dedb2ba12da1d0a34f1ab55f0e4e835f119b96e5283ab8b13bee3493
SSDEEP 3072:vF5o5cKUM7YLBwcJf1+6Ws2v1+xvN80X+O:vfpMixvN8G
TLSH
T1D6449684BADD9619F81970B88FCCD199C223BAED8B47425F351EC39F4B619816E139F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 11KB
SHA256 02d987eba4a65509a2df8ed5dd0b1a0578966e624fcf5806614ece88a817499f
MD5 e1ba66696901cf9b456559861f92786e
SHA1 d28266c7ede971dc875360eb1f5ea8571693603e
SHA512 08638a0dd0fb6125f4ab56e35d707655f48ae1aa609004329a0e25c13d2e71cb3edb319726f10b8f6d70a99f1e0848b229a37a9ab5427bfee69cd890edfb89d2
SSDEEP 192:4GeVvXK9WYhW1WWFYg7VWQ4yWj6k50IsQlmqnajlDl:4GeVy9WYhWzVk6l9l
TLSH
T179422B968BBC5003F5A36E70139ACE8B7D3DA7D729A4812604A5F19D1CC33D4FB14A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\api-ms-win-core-synch-l1-1-0.dll
Size 13KB
SHA256 a31a15bed26232a178ba7ecb8c8aa9487c3287bb7909952fc06ed0d2c795db26
MD5 6c3fcd71a6a1a39eab3e5c2fd72172cd
SHA1 15b55097e54028d1466e46febca1dbb8dbefea4f
SHA512 ef1c14965e5974754cc6a9b94a4fa5107e89966cb2e584ce71bbbdd2d9dc0c0536ccc9d488c06fa828d3627206e7d9cc8065c45c6fb0c9121962ccbecb063d4f
SSDEEP 192:L1dv3V0dfpkXc2MAvVaoKKDWYhWTJWWFYg7VWQ4uWoSUtpwBqnajrmaaGWpmJ:Zdv3V0dfpkXc0vVaeWYhWj/qlQGWpmJ
TLSH
T1A8522A92D7E8A243F56FEE7046CAC5936C3857C74A20C0261195FAAD3DE33D0EB1562E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\api-ms-win-core-synch-l1-2-0.dll
Size 11KB
SHA256 1c72ac404781a9986d8edeb0ee5dd39d2c27ce505683ca3324c0eccd6193610a
MD5 d175430eff058838cee2e334951f6c9c
SHA1 7f17fbdcef12042d215828c1d6675e483a4c62b1
SHA512 6076086082e3e824309ba2c178e95570a34ece6f2339be500b8b0a51f0f316b39a4c8d70898c4d50f89f3f43d65c5ebbec3094a47d91677399802f327287d43b
SSDEEP 192:ztZ3XWYhW3WWFYg7VWQ4eWNnpit7ZqnajgnLSl:ztZ3XWYhWVg+llk2
TLSH
T1DF422AA6CBAC5203F5A79D7047D9D8833C3DA7DA2950816116BDF1693CA33C1E700E2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\api-ms-win-core-sysinfo-l1-1-0.dll
Size 12KB
SHA256 19c78ef5ba470c5b295dddee9244cbd07d0368c5743b02a16d375bfb494d3328
MD5 9d43b5e3c7c529425edf1183511c29e4
SHA1 07ce4b878c25b2d9d1c48c462f1623ae3821fcef
SHA512 c8a1c581c3e465efbc3ff06f4636a749b99358ca899e362ea04b3706ead021c69ae9ea0efc1115eae6bbd9cf6723e22518e9bec21f27ddaafa3cf18b3a0034a7
SSDEEP 192:fKIMFFyWYhW6WWFYg7VWQ4eWoVjxceXqnajLJ4:fcyWYhWKRjmAlnJ4
TLSH
T11E421992DBBC9203F9A76E7052D5D5833D38A7D62511C11906E9F3B83CA33C5DB50A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\api-ms-win-core-timezone-l1-1-0.dll
Size 11KB
SHA256 3d798b9c345a507e142e8dacd7fb6c17528cc1453abfef2ffa9710d2fa9e032c
MD5 43e1ae2e432eb99aa4427bb68f8826bb
SHA1 eee1747b3ade5a9b985467512215caf7e0d4cb9b
SHA512 40ec0482f668bde71aeb4520a0709d3e84f093062bfbd05285e2cc09b19b7492cb96cdd6056281c213ab0560f87bd485ee4d2aeefa0b285d2d005634c1f3af0b
SSDEEP 192:4EWYhWdWWFYg7VWQ4eWvvJ6jxceXqnajLJn:4EWYhWbwYjmAlnJ
TLSH
T1F24228D3CBB88403FDEB6F7047A9D4937D38A7E61920815909E6E4693C973D1EB10A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\api-ms-win-core-util-l1-1-0.dll
Size 11KB
SHA256 5eb724c51eecba9ac7b8a53861a1d029bf2e6c62251d00f61ac7e2a5f813aaa3
MD5 735636096b86b761da49ef26a1c7f779
SHA1 e51ffbddbf63dde1b216dccc753ad810e91abc58
SHA512 3d5110f0e5244a58f426fbb72e17444d571141515611e65330ecfeabdcc57ad3a89a1a8b2dc573da6192212fb65c478d335a86678a883a1a1b68ff88ed624659
SSDEEP 192:dZ89WYhWFWWFYg7VWQ4eW5QLyFqnajziMOci:dZ89WYhWDnolniMOP
TLSH
T1FD322B838BFC8403FAA76D304795DD837C3CA7DA266080A519A8F5992CC37D1EB14B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\api-ms-win-crt-conio-l1-1-0.dll
Size 12KB
SHA256 b119adad588ebca7f9c88628010d47d68bf6e7dc6050b7e4b787559f131f5ede
MD5 031dc390780ac08f498e82a5604ef1eb
SHA1 cf23d59674286d3dc7a3b10cd8689490f583f15f
SHA512 1468ad9e313e184b5c88ffd79a17c7d458d5603722620b500dba06e5b831037cd1dd198c8ce2721c3260ab376582f5791958763910e77aa718449b6622d023c7
SSDEEP 192:R0WYhWRWWFYg7VWQ4eWLeNxUUtpwBqnajrmaaG:R0WYhWPzjqlQG
TLSH
T1BF42E68396FC5A03F5535F30A7F9DAC37D3A27D72A506069045AF4A838C23D5AB11A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\api-ms-win-crt-convert-l1-1-0.dll
Size 15KB
SHA256 6c008be766c44bf968c9e91cddc5b472110beffee3106a99532e68c605c78d44
MD5 285dcd72d73559678cfd3ed39f81ddad
SHA1 df22928e43ea6a9a41c1b2b5bfcab5ba58d2a83a
SHA512 84ef0a843798fd6bd6246e1d40924be42550d3ef239dab6db4d423b142fa8f691c6f0603687901f1c52898554bf4f48d18d3aebd47de935560cde4906798c39a
SSDEEP 192:JM0wd8dc9cydWYhWyWWFYg7VWQ4eW9jTXfH098uXqnajH/VCf:G0wd8xydWYhWi2bXuXlTV2
TLSH
T14362C65366E42F26F69B177221FEC7D72A394781259143B4C217E54C3883781BDA7C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\api-ms-win-crt-environment-l1-1-0.dll
Size 11KB
SHA256 aa3e3e99964d7f9b89f288dbe30ff18cbc960ee5add533ec1b8326fe63787aa3
MD5 5cce7a5ed4c2ebaf9243b324f6618c0e
SHA1 fdb5954ee91583a5a4cbb0054fb8b3bf6235eed3
SHA512 fc85a3be23621145b8dc067290bd66416b6b1566001a799975bf99f0f526935e41a2c8861625e7cfb8539ca0621ed9f46343c04b6c41db812f58412be9c8a0de
SSDEEP 192:6KNMWYhW6WWFYg7VWQ4eWSA5lJSdqnajeMh3:6KNMWYhWKiKdlaW
TLSH
T154420A868BBC5543F6976E7047B9E9437D3C67C7291082650569F1582CC73C0FB11A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\api-ms-win-crt-filesystem-l1-1-0.dll
Size 13KB
SHA256 974af1f1a38c02869073b4e7ec4b2a47a6ce8339fa62c549da6b20668de6798c
MD5 41fbbb054af69f0141e8fc7480d7f122
SHA1 3613a572b462845d6478a92a94769885da0843af
SHA512 97fb0a19227887d55905c2d622fbf5451921567f145be7855f72909eb3027f48a57d8c4d76e98305121b1b0cc1f5f2667ef6109c59a83ea1b3e266934b2eb33c
SSDEEP 192:CGnWlC0i5ClWYhWwWWFYg7VWQ4eWtOUtpwBqnajrmaaGN4P:9nWm5ClWYhWQ8qlQGN6
TLSH
T1BF52F78387E86E12FAA71F7156EDDBD73E3D2BC2199282658016A45836C33C07F2255E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\api-ms-win-crt-heap-l1-1-0.dll
Size 12KB
SHA256 8166321f14d5804ce76f172f290a6f39ce81373257887d9897a6cf3925d47989
MD5 212d58cefb2347bd694b214a27828c83
SHA1 f0e98e2d594054e8a836bd9c6f68c3fe5048f870
SHA512 637c215ed3e781f824ae93a0e04a7b6c0a6b1694d489e9058203630dcfc0b8152f2eb452177ea9fd2872a8a1f29c539f85a2f2824cf50b1d7496fa3febe27dfe
SSDEEP 192:8a9aY17aFBRAWYhWYWWFYg7VWQ4eWbr0tJSUtpwBqnajrmaaG:8ad9WYhW4F/qlQG
TLSH
T117420A938ABC5543F5A36F706AE8DACB3D3E63D67D5080670157F59829833C0AB2162E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\api-ms-win-crt-locale-l1-1-0.dll
Size 11KB
SHA256 edc1699e9995f98826df06d2c45beb9e02aa7817bae3e61373096ae7f6fa06e0
MD5 242829c7be4190564becee51c7a43a7e
SHA1 663154c1437acf66480518068fbc756f5cabb72f
SHA512 3529fde428affc3663c5c69baee60367a083841b49583080f0c4c7e72eaa63cabbf8b9da8ccfc473b3c552a0453405a4a68fcd7888d143529d53e5eec9a91a34
SSDEEP 192:+WYhWoWWFYg7VWQ4eWSoV7jjT6iBTqnajbQwr1:+WYhWIiVTTXZl3QC
TLSH
T132422A468BFC5103F6936EB04AECEA837D3EA7C71A1181A50596F5982C833D8EB11A5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\api-ms-win-crt-math-l1-1-0.dll
Size 20KB
SHA256 f6a93fe6b57a54aac46229f2ed14a0a979bf60416adb2b2cfc672386ccb2b42e
MD5 fb79420ec05aa715fe76d9b89111f3e2
SHA1 15c6d65837c9979af7ec143e034923884c3b0dbd
SHA512 c40884c80f7921addced37b1bf282bb5cb47608e53d4f4127ef1c6ce7e6bb9a4adc7401389bc8504bf24751c402342693b11cef8d06862677a63159a04da544e
SSDEEP 192:8JIDSM4Oe59rmkUALQe1hgmL44WYhWWWWFYg7VWQ4yWARgKZRqnajl6umA:8JI2M4Oe59Ckb1hgmLhWYhW2v2yRlwQ
TLSH
T14092A74749DCFF63D18F1BB741F08BCE6A385AA665D1B6B4C81B908434A27C47E83949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\api-ms-win-crt-private-l1-1-0.dll
Size 62KB
SHA256 55bc91a549d22b160ae4704485e19dee955c7c2534e7447afb84801ee629639b
MD5 5c2004daf398620211f0ad9781ff4ec2
SHA1 e43dd814e90330880ee75259809eee7b91b4ffa6
SHA512 11edbbc662584bb1dea37d1b23c56426b970d127f290f3be21cd1ba0a80d1f202047abb80d8460d17a7cacf095de90b78a54f7c7ec395043d54b49ffe688df51
SSDEEP 1536:Se6De5c4bFe2JyhcvxXWpD7d3334BkZn+PI5c:Se6De5c4bFe2JyhcvxXWpD7d3334BkZU
TLSH
T1C05307DB49E63F21E18FF7B76BFB17C90B253A4418806274EAC7556B34853A9BC43A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kpacketui.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\kpacketui.dll
Size 699KB
SHA256 6ba7f8b833b3cf4ec43b96094fa1418d23833f570007f6183f7f1c1bf24a8e4c
MD5 47101011d064fe8e76970906ae86b2cd
SHA1 fc44c660790a7e409e5c97f2eda499fe569972cd
SHA512 0b784b3dc3756df68d4164e7c250f7fbd1ac5704e7dfb436e9616cfc2d30de2d133bd7df664d2e975e4f564b866e06b3e4364652def5211de24e57c4843d89ba
SSDEEP 12288:cHn2Nqk+g7ufzQAEit2GRra3b4skvRkTJC:cHn2NojQyxajJC
TLSH
T1C9E45B1FA69103B9E032C17AC6A78803F2327C0543A25BDB6555EB251F73BD91B3EB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
Size 75KB
SHA256 0953c0bab57e0c177f9dfc5da781d7b0577a4323c98f786277717f33e228476d
MD5 724faa9b9d8bfc5626ff946cc0b14f49
SHA1 88ea95c6a7b7ed8ef51864350afe9dbb8a409971
SHA512 c5135f54d2f0578175de245c11677032dd2b3f0b447a147ea59f7ec7128bf5b82baba2fc1f659ec4be6c9842a42501ada2c259a0842f63e68f3b13924bafed4f
SSDEEP 768:LXOzQ/DBnTQxkUtwZfVKFkYQJc1ZqTwT6NBvgUZSac6mWWrqYiDLk5C7PuJYi77r:Gjf8J5wT6NBxSac0+q7brw771h
TLSH
T14B736B93DB44169CE51B8634CAD58A1BE6B2784207A293CF6728E3680F733D2397D7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
Size 46KB
SHA256 08d40ed7b384e8ee7cbb6f0b46f51bf692272e3c963e5ecf745b7830c9fa3d1e
MD5 1f786f130eb0e410fe57202a669290be
SHA1 7067d8d7ee9010fa07ea8231d4f595e19bacd523
SHA512 ba9e60fb8f5d568d93054d4404e6960f47ec06c09240d4ca88152ba8c813008347360bf688fe329f6ed261fa7eb2175310db362a8d3e01acddd0a54225ace706
SSDEEP 768:q/BLzrhcTaIwXpkossKYiDLk5C7Njyp1Yi77mAb5ALln:qprhKwXpkossK7bq1776AU
TLSH
T131235A92CE541809E923DB74B4C58926F9B2B8501B9283CF31A5D36D4F963C23EBD3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qskia.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\qt\plugins\platforms\qskia.dll
Size 1.9MB
SHA256 c622017322fa4442e4e7521d5a00642f66eaea46c1995562a6688fa4803dde1b
MD5 dd0c4dcd9f824909c3e52ed43b00338b
SHA1 e2abe7822019b4d4cfb0880e51d4fc029428cf75
SHA512 2e94430b448df9c9d5af98a59f39a4016dda47d5649c8b84e9af96ce063f3f7db5b4dc2145055103090770002456e047cb6d3d8f25fdf19d3bba4563fae574fe
SSDEEP 49152:D0rOoPmNWAG+mr9gb7jxSfL0FHYX52k2ik82a66kTcbjV:WmNWEAV
TLSH
T132957C43E3B44299C2A7C13D869B8F0BE6B1740543619BDB2690CF59EF237E21A7E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\qt\plugins\platforms\qwindows.dll
Size 1.6MB
SHA256 eb39b42dbe225a92aed40c31d881788be2e33ee137c043741e081cfb6598a7e6
MD5 c552d1b035a9c1bd95834e13242ac1d9
SHA1 386a1a07bc3ab1963b7fe4fe72ec048be8b49b3c
SHA512 c69e98ca8953a34aa928c8af64711d2ffb577ed5eba8ea626be7f5336b194948c32792f1921fa09ae531fc941afff4a471670ee85839b3c09d4c305bff200fe9
SSDEEP 24576:7A9T04p4/1M+XCrbBB376YStwHxDCWYkbJ36bZ/OAKOz:KT0IKcbBxlowHx+eJNANz
TLSH
T155757C43E3A44398C167C239C68B9A1BE77178050361ABDB25A08F59FF63BE3177A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
Size 159KB
SHA256 ba708eb228d11c7ed86aedcf01a313fd3bb58dc2ae9478d8e5bb969cfa629cb6
MD5 cb2110a00eb6c7579a3dc8229fd9a30c
SHA1 02be9f5d30db5df1f7ca4f79625d4ddb9fedf0c8
SHA512 40b52bee49aef7874b08fe1a7204b38eb48b8db71cdc7fd2e384f700a3f4ab1a5c1c7865c3dd406673b3073f376de664de81559f5a1fe3ad7bc81d338be4ffde
SSDEEP 3072:nSApjXbrT36b96bavsTHnbNgpUsl7ulXHsLCncaFg+XC:HX6b96bavqHnbNJs0VHsLCncD
TLSH
T1A7F34913F65143DAC527D2B8C09E0512F3B37454436257AF25A6DBB81F533A2BD3EA82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\ucrtbase.dll
Size 987KB
SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
MD5 61eb0ad4c285b60732353a0cb5c9b2ab
SHA1 21a1bea01f6ca7e9828a522c696853706d0a457b
SHA512 44cd871f48b5193abb3b9664dbea8cdad19e72c47b6967c685cf1cc803bc9abb48a8a93009c972ef4936e7f78e3c92110828790aa0a9d26b80e6a523bbcd830d
SSDEEP 24576:xOPJ1g7mT6BNvwTOxNfoYotrz1111111r8SoKxmxvSZX0ypdNLh:xO1aNoaxNfo/+a
TLSH
T18D259E64F75C0AA6C17BE17CC95B550ED972340647608ACF03EA8BB97E2BBE91637310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vccorlib140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\vccorlib140.dll
Size 192KB
SHA256 cf624407d2b281f79a94490a8608ac52fecb160babcceb3dfcaa1fce864ee206
MD5 f8e52aaaaecc5b8f35090e5cd5f0f2d1
SHA1 9e33fd7bfb9fa4cd746f77e089070db8bad19a19
SHA512 35610934bb8c60da180678df24674d9466bc28bf8c479ed0eae26aa2ff4aac6b7edc46a50482af588dddc9bbce8b7f4881a368f9f6597ef8f1740b67dd6a64cb
SSDEEP 3072:CfXCl1Jp3ls3Nd1C++IAU1qsxEW5QcT2Xgs4hiWi/GDhmVejWXEw2jV+WbOwQTx/:PpVeNd1C++IAU1qsxEW5QcT2Xgs4hiWO
TLSH
T17514C6392B9C00D2DA74B0BA5E97930AF572398653A191CF02D5924E077B9F8BC3F275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\office6\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\pl_PL\style.xml
Size 3KB
SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
MD5 034f37e6536c1430d55f64168b7e9f05
SHA1 dd08c0ef0d086dfbe59797990a74dab14fc850e2
SHA512 0e1911c882152a4e1059a3ce1880d7fb2aed1e1e36cbd37055de2e2a1333acb2a0233ba2a4d969ccebbef1e77809aa5e78807aa9239545beae8c548c0f8f35c0
TLSH
T1E381CA80A610BD0AC563F51573AB7509762CB36383ECCFC4F0EE2E698753652644B63E
MD5 SHA1 SHA512 TLSH

Submit Download

product.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\product.dat
Size 79KB
SHA256 864381c3016e55b25aea9ae26d8fffdef73765fd46f4236be41362d6f65a7f3e
MD5 40f76894c78e6663c228b1838980753d
SHA1 1cadeddca59ea127d390303c98af4dc947ccced7
SHA512 918f18e2140efd4e0e34ec6f77b7ec496ec3274d9c60a9a642ad988dc507279cf49f334c0ff70b5de6e33f286552379b26bd06669b82371d79a6bb19b021136f
SSDEEP 1536:1yKppE+qTZTbosBhg4/vS8UeZC0kySpgno6:1yUE+mZJBhF/K8k0kySmno6
TLSH
T19F837DFB7E1E2EE568CF232A5D7B2C2CAAF54D15349B548862C3E558EC1C0B63CD6508
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product_new.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\product_new.dat
Size 72KB
SHA256 ceac182427191b7baf9fb1041c946353d5be8294b4c792027dc6a65f89e19451
MD5 d9c29eecb86ef216e22d928c04c4c051
SHA1 2cc52d6c0317be5743f6cd60e001f3b45b702a40
SHA512 bac90b99e5477c4a846695550f04ba2baf11e38dced68cc7c3e62856bad918548ffe76c2ae710a3154af7a38cf927e49ee9d81ed16cf56e0253eecbad2dabce5
SSDEEP 1536:I3Vrh5eCifWIY/Q2pHggLLw52P/E/nNsB+e/zEy73p:2Vr/UdOAGN0FsBs6
TLSH
T1DE731A19DCE26DBD685056B91D376D8227B3DD9060DD30AC4B12AA0CFC3CF887B63A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e59ee2f\CONTROL\vi_VN\style.xml
Size 4KB
SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
MD5 394488b30107bcebb84a97ed5d754cee
SHA1 69ebe17f7d577e9bf69c87cff45c3251f0bbc86e
SHA512 24a6bc7debbf7030c1261c69cb4ae7bf3cbb5c7fac315188163c6001e58dfbe2e634925cb767044da7ea0e6d08c709b2ade02f6e43930819e1bef6f7569cad5a
SSDEEP 96:gd6SmSZcFe9gSs8TcySCSi58VS5eQJ/gQkgQ0/Mw8CclQgYzdr/PwiCSeDeR3ciw:gdAh8Ax
TLSH
T13FA17780A610BD0AC563A51977AB7909B62C736383ECCFC4F0EE3E658753692644B63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 387B
SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
MD5 c38481658f9149eba0b9b8fcbcb16708
SHA1 f16a40af74c0a04a331f7833251e3958d033d4da
SHA512 8f98d62f88442b8ef94aa10074e35aa8d9494f3c76ce8b143ca0bf7fa0d917f3175212fbcd6e7b0597fd0ec0e1b2827f157135512fb01c88218d36e2f7dd73ce
TLSH
T1D4E09B1BA8D1B0ABDEB302E988979D54BAC03D9A066D23147762540D3D32918FB41D65
MD5 SHA1 SHA512 TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 433B
SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
MD5 a9519168ca6299588edf9bd39c10828a
SHA1 9f0635e39d50d15af39f5e2c52ad240a428b5636
SHA512 0607eb1f5598320961fbd8ef75beeb1b6dc1af3cae7eeb5ba352f3e2a2edb25e1d9e68fb46c24e4299957352c0c906314c889c2d1092437eccc1d1a0485f3557
TLSH
T194E0540FA891B0679D7302F488E39C007AC03E96055D1210773144093C32A14FB81D69
MD5 SHA1 SHA512 TLSH

Submit Download

5f495c40c234747f57cbcaf29f2f3725.prog.tmp

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cache\skia\sksl\120\angle\1414_008c\5f495c40c234747f57cbcaf29f2f3725.prog.tmp
Size 15KB
SHA256 865adbc3d44637fcd84fba1606c54f9f50a42bf8fc316372b6a28d57cb0a5f2d
MD5 5b3df70acac0add3131c94dafb455f6a
SHA1 2301fd20881d7d6c0e20d721d02c493c397ec38c
SHA512 d81494d31a3d04d47ce2a22e57e3696073ee4eb1fecbffe99fdfdb8f00ca8c404e70947851a55ce3e6722232eb9f48aedb4abf3f8b4a14d0a5413dd1dd32ab34
SSDEEP 192:sExNQuFZumTwa5D6LT+xEngxqJVbCTIvHBerr3XF1qgUEE00ij7ywdFxsDYq/ztR:vNUB6qJVbSn3Iifyk3sE6
TLSH
T1F2620F0677B0C832CD2EB27C4C8386892739EC914DE1935B744C772D0E772AB5A66ED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73b548de20df7f5a13684ebb0d11ffc6.prog.tmp

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cache\skia\sksl\120\angle\1414_008c\73b548de20df7f5a13684ebb0d11ffc6.prog.tmp
Size 12KB
SHA256 01a6a0c8f44c5b03846714ec49e2437bafe8b89e61f86803c31d077f41dd3bcd
MD5 57ea2382eb6e75e6c406afe49863ec23
SHA1 3cdea3aa766a83066fdcc0a27f7ee0a8bd68c8e7
SHA512 5be809614ab69ba5c34865266630931ca80e704592f8a0630d28bed9b104750d98dcd0c0dab69aac138896b884b29ed770ff2d50e5566e7cbf3a1f27ec551b30
SSDEEP 192:hKIuFZumTwa5D6LT+xEngxqJVbuTB36R3XF1qgUEE03zvzIFxsDYq/z7kLBEE409:1B6qJVbZn3DzvzI3sE6
TLSH
T19F521D057660C822CE1EB27C4CC7868A2739ECD25EE5835B744C771E0E371AB5BA6EC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klogindex

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\klogindex
Size 1KB
SHA256 d193f6f936ae169d379c7ebc2ec6a54c60c4a1174c6b9ef4e7babd0b3794215c
MD5 4ea81dd6206b412169648a87dab2d348
SHA1 f2b80857be5a0c584d5f1b62f05cde2623ca1f75
SHA512 0ea49b06a41870f9181b22324012e6103f645382952161debbd0808b3254dc38ff88934984723deaeb34fa9d01363432be5174e14159528890c42d0c965ab034
TLSH
T123310CD3C63D80C47CC67510BFD5A53A7E1BB635AA1C55B47A09150E338CCA328DAE75
MD5 SHA1 SHA512 TLSH

Submit Download

ksomisc_2026_07_08.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_07_08.log
Size 3KB
SHA256 68909ac93fa9259feea2c8ed2d037e9656bb4f495a2e7185dc28056622a60354
MD5 076e4453dadc03865e6621a9288351b1
SHA1 5405319e772b1f10046aff4ebe515ff96e67e700
SHA512 92dbc370eeaf29b8e5fd7425d716a1ca5cff93a01ade4b1859605ccd6e7f6f1b7cddbabc2c9876659534be92c029f8b073c3a758f84bb442f974852cee3a2d2a
TLSH
T189718C6966F94109F3F78F86E8F654635E76BC82AC20D80A0990234D49B6F91FC7073B
MD5 SHA1 SHA512 TLSH

Submit Download

ksomisc_2026_07_08.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_07_08.log
Size 5KB
SHA256 c3e0895b225009049d8ab1bfb30631146837fa95561fab18c058d5eeeecfa6ed
MD5 692cf324622d861c9020d2d10e00dde2
SHA1 60cba2a53035d5aa0339bc3b5a7e6dc1a24e0e6b
SHA512 73f691bb2ed0963eb79276bdff3919a56bd1a02709ffa67bc9e02611f1620c919ad1fdd23166f7fba616755577fcb9b44b21e19b1bfbf68399ed8f47c0c55629
SSDEEP 96:Iv6qYovsiWd4H/si+HQ4H6kqsi+HZ4H/si+H1n4HVN5si+HEQHcssiW5q94siolR:KRYYdfW1akqWmfWan5WkC9OgpRY9bb34
TLSH
T12CC15A6A66FA4109F3F78F86E8F654634E76BC82AC20D80A1990134D49B7F91FD70736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logdata

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\logdata
Size 96B
SHA256 a71c2bd3b98429c2b6158d9f3ca6fd7ded0e7b722c6a558bd52b19b98f23b502
MD5 354990bd97597bf7234a580a26780859
SHA1 f68ecdbff0c1d996fcfb6e05e60ed706495bfc24
SHA512 dd161f122e00743395532cddbfff136e5e3e794b30829e2c0f63a1ef24ac1515be44a6358942f35d54a5df74877654a7900573811510edfe71ed2fa7a203677d
MD5 SHA1 SHA512

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 10KB
SHA256 ec163d652dc85432f291d2bbf0bd5c8379a84cbf815b506de7100e34a29251ba
MD5 05d637e865d8ad21857f6742ece76500
SHA1 6e2d450a0272583c8553b856af47dfc1960b8e7c
SHA512 8ede1a41d8da4738e417735912eaa29da4a60478cbdbdf1fd43fb2399b0716ed93323b9f4e68aa3ccc0494d6743e76033da487627729bd1301cdc856f517a88b
SSDEEP 96:KrueHpTNdYDDm4+/wNOzOfSYB6bqhmoKxdPobaIMXoWMzwDddITSb8L3/eXNvATM:dATNd7AYqlrAd3l3O8P
TLSH
T127329BA7859F412826BF1B2E22724E49258A7EDC274126D43F33FF878EDE41081BED55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 11KB
SHA256 74f5819fc8b3c9b31a8bab1fac7c638f3e2031fdf20b408710c974d12d389d9c
MD5 591aac321976dc9471376af8edc60e72
SHA1 0c6559db388d8e9ada7dc53051d6dfdae3211852
SHA512 c9faf617c8e60fed223bf6feddd2b50d77a6df298c4fdfa91cc2257f98bbba2c337630029008394c94737c5536ab29ee65ec692ae2496c06d0bef5eb2831f48a
SSDEEP 96:KrueHpTNdYDDm4+/wNOzOfSYB6bqhmoKxdPobaIMXoWMzwDddITSb8L3/eXNvATg:dATNd7AYqlrAd3l3O8OIeN5Q
TLSH
T1CE429BA7859E413826BB1F2E62324E49258A7FDC274426D43F33FB874EDE41081BEE55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 26KB
SHA256 ecd594e21e07379900b4d64a875d2aa8b1c2347f33b39da6fa8a243142d7ba42
MD5 e9ca5ac3917fcc5c068f151e569a2790
SHA1 b973f5ab01d220b69e0429a0a91eb387d4fb981f
SHA512 b0ba0f8c3c55018e94d217ad0d871cb2a382e9e97d03287ae2e29df49ea7f19f502dd20e32bd90b122b6c1ffd5bcb2910a1ba48b8bb2dd088cb305bcd82d20a3
SSDEEP 192:dATNd7AYqlrAd3l3O8OIeN5fL5TwvIgjw3p0oY7c28hbomC0Jo7E7o7mlK:1Ad3dOhNI
TLSH
T1E0C27C93485E806016FF5F4851768E6E348B7B5D27082A993F73FA974AED84182FCF18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 59KB
SHA256 8849db63a4c3791d199145ed43a052dd1b43f1721c242fd6471fdd9b329fa6a1
MD5 e2b6cfd77c59918b8e5e8d09105ad19f
SHA1 b5003789899536b03acffe1f65b83c24820b37ec
SHA512 2531cadb193625e51f20e1e885eb296c178cd4fddc4f37205de6e5ca1227fd1918af6667a36f42ecacc05891a9c36e5c0cc23156b5fdc61e24b61a6748ae3ccf
SSDEEP 192:dATNd7AYqlrAd3l3O8OIeN5fL5TwvIgjw3p0oY7c28hbomC0Jo7E7o7mly4A09PR:1Ad3dOhNJnHjsRLKEGGnAAO
TLSH
T14053BD974D5E803026BF9B9801738F6E644BBB5D22082E583FB375929DAC801C9EDF59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 65KB
SHA256 b36e9bf3a7fd128d21e026e074b53a9394529e105788e5afb519fafdc2b205af
MD5 66142896bb0c5df8dde030c46391deeb
SHA1 34ab68e5365d0e6903c09c00459a0d8cf2bf546c
SHA512 d66b4a7aa2241ce1432e9782ac15fdf86afefd1729bd53e02c291943158668f09fee6aec13067c1f4373759624eff5a82c3bf1679249175218865787e96be412
SSDEEP 192:dATNd7AYqlrAd3l3O8OIeN5fL5TwvIgjw3p0oY7c28hbomC0Jo7E7o7mly4A09Pq:1Ad3dOhNJnHjsRLKEGGnAAKB21N
TLSH
T16863BE974D5E803026BF9B5801738F6E644BBB5D220C2E583FB3B5929DAC801C9EDF59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdbx.dat

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-x64\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat
Size 64KB
SHA256 cf1ed8b0650191b305bf5358360032f787b29c026ab2adb3a91dbd3fdab528d0
MD5 9d25c2125c0255ea217ed71ddc97dacd
SHA1 efee78a306cf27bd391d6fd5b974c17df2a12c9f
SHA512 fcff75c3c29def7e32f480445de8ee6615ddd7fe11c7c58119495011751461679ce062b5fb7e053cb80feb571f0471019bb8892c9e87d1737b60dae17832f82f
SSDEEP 192:6hgSOLZ3501hgrOLZ350wUw3XfVOm6StJnMv7Jrs2hg8cSiW5xsFu2D:6O/jGO0jQwcNSnqJFOxSiB
TLSH
T129538C8CE2D66FBCE9A916BCA41A4D1FF7FB0785D70A1F06340213156843ABD76A048F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcsdk_dpv3.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
Size 41KB
SHA256 311b70370bf1df44607e3278aad3ff149d0cae01e24b9524994de44eeda2b8f6
MD5 3b289bd32a4ce27a05b03c25dcf38c0c
SHA1 482b141a2d1a704037fb3019c86b470676c70d10
SHA512 fba0f0dae3b64d1de476663016040d28381cfd1b163a8a7f1fb2e1e682067e982fd7e18476d410dd6347fe6c9a3167b139f62241fe67ad8b5af4b6f75c4faad0
SSDEEP 768:6Ua8nbAFZhDB9SYBaFwWE3LH58Kcq73hdjqaDbPuPntAN:wKbADhDB9SYBeE79ke
TLSH
T139130096B7E91568F6F72F6569B968944C3E7DD22C09E0EC01602D8E0932F90EDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcsdk_dpv3.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
Size 35KB
SHA256 4dede323cbcec0d9e8688f51168f2b828db4fc1fb4ef92d3fcb502b834da0d2b
MD5 319831122ea326246d2b2b7f12da085f
SHA1 128002d0ccf6ad6c21f6261ed8b2ca5f134a72e1
SHA512 ae828e92e7522ca7318e0d98a2ba1330ad36bd7c859b65efd39b2eb23f54f273cb9029d3acbf8b6f735b43b1d44dd7d14aca3463cca53eb6c7880fb4cf602b37
SSDEEP 768:hMg6/bAFhHDB9SYBazRdBMIRkO8N76FDbPQPJlAE:/AbA7HDB9SYBUHkO8JAG9
TLSH
T128F21396BBF90558F6F72F6569B969944C7ABDD22C08D4EC01602C8E0932F90EDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kqingaccountsdk_3.1.0.604\download.7z
Size 2.8MB
SHA256 fdb9fff008b21f238dc3df1cb8397439c47d3f2dd298dd39ee35f4ccc17639a7
MD5 f7a9de6b57ccd7cb4a94158d4272130d
SHA1 1c2932af70c063897aec37947b57bbd59a5ea6de
SHA512 ee6766281bbeeeebd4bb611cac864159773e03654d9ec7a1ef0b4eeb36aaebf9ed2d0bcc51241611b038c10fbeab70c1ecf53bc5252a2a33fc8659a0701d6566
SSDEEP 49152:w9NybEu3K//5OKjFhlp84vuYYGbJLO+RnH6Zus1vF07BHE1nF+QgjVKc0ErCEqIC:w9y96/VjOAI66ZussVHsnkt5Kc0ErCh5
TLSH
T105D5333E10A65C9B2326F871F814EB806171D92ED868EF9F798C1D51C25FFE139C6226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loading.svg

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kqingaccountsdk_3.1.0.604\resource\vippayment\main\img\loading.svg
Size 1KB
SHA256 a3df9710c7e09fd8cffc14bfe45f5a1576deb1846ced44e5050b34caf5527049
MD5 544223e85768fd134633a1af9d5bf536
SHA1 5536a0023ddbfb2ab67e9ad8ca4d38c60f413b9a
SHA512 a5cacba054d41af8efd607074c02f36ab731b5d6bc9ffd3bd7ce6b09a4af09b31e29359eb965728d2a00849467b1af66e16186a0c07b4415b3b423a5ea4f68ca
TLSH
T1142165D433B77469A49483787FEDB807D05558E21B824964FB8D0915FF001A718BE3C4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5148-462-0x00007FFDB45A0000-0x00007FFDB4B2E000-memory.dmp

Download

memory/5148-5906-0x00000283F8500000-0x00000283F8AB8000-memory.dmp

Download

memory/5148-8327-0x00000283F8500000-0x00000283F8AB8000-memory.dmp

Download

memory/5148-8008-0x00000283F8500000-0x00000283F8AB8000-memory.dmp

Download

memory/5148-7627-0x00000283F8500000-0x00000283F8AB8000-memory.dmp

Download

memory/6912-8224-0x00007FF79B170000-0x00007FF79B51E000-memory.dmp

Download

memory/6912-8246-0x00007FFDAC740000-0x00007FFDAD159000-memory.dmp

Download

memory/6912-8245-0x00007FFDA8F00000-0x00007FFDAA997000-memory.dmp

Download

memory/6912-8242-0x00007FFDAEDA0000-0x00007FFDB0AA0000-memory.dmp

Download

memory/6912-8227-0x00007FFDB2D20000-0x00007FFDB396E000-memory.dmp

Download

memory/6912-8225-0x00007FFDB2420000-0x00007FFDB29AE000-memory.dmp

Download

memory/6912-8226-0x00007FFDBF7F0000-0x00007FFDBF934000-memory.dmp

Download

memory/6944-8343-0x00007FF79B170000-0x00007FF79B51E000-memory.dmp

Download

memory/6944-8363-0x00007FFDAEC50000-0x00007FFDB0950000-memory.dmp

Download

memory/6944-8344-0x00007FFDBF7F0000-0x00007FFDBF934000-memory.dmp

Download

memory/6944-8346-0x00007FFDB2420000-0x00007FFDB29AE000-memory.dmp

Download

memory/6944-8345-0x00007FFDB2D20000-0x00007FFDB396E000-memory.dmp

Download

memory/11656-8144-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/11656-8149-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/11656-8137-0x00007FFDC1B70000-0x00007FFDC1CB4000-memory.dmp

Download

memory/11656-8138-0x00007FFDB2790000-0x00007FFDB2D1E000-memory.dmp

Download

memory/11656-8141-0x00007FFDB2D20000-0x00007FFDB396E000-memory.dmp

Download

memory/11656-8142-0x00007FF79B170000-0x00007FF79B51E000-memory.dmp

Download

memory/11656-8145-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/11656-8146-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/11656-8147-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/11656-8153-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/11656-8152-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/11656-8151-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/11656-8150-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/11656-8143-0x00007FFD97120000-0x00007FFD97130000-memory.dmp

Download

memory/11656-8148-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/11912-8168-0x00007FF79B170000-0x00007FF79B51E000-memory.dmp

Download

memory/11912-8186-0x00007FFDAEDA0000-0x00007FFDB0AA0000-memory.dmp

Download

memory/11912-8169-0x00007FFDB2D20000-0x00007FFDB396E000-memory.dmp

Download

memory/11912-8171-0x00007FFDB2420000-0x00007FFDB29AE000-memory.dmp

Download

memory/11912-8170-0x00007FFDBF7F0000-0x00007FFDBF934000-memory.dmp

Download

memory/12088-8248-0x00007FFDAC740000-0x00007FFDAD159000-memory.dmp

Download

memory/12088-8247-0x00007FFDA8F00000-0x00007FFDAA997000-memory.dmp

Download

memory/12088-8216-0x00007FFDAEDA0000-0x00007FFDB0AA0000-memory.dmp

Download

memory/12088-8200-0x00007FFDBF7F0000-0x00007FFDBF934000-memory.dmp

Download

memory/12088-8198-0x00007FF79B170000-0x00007FF79B51E000-memory.dmp

Download

memory/12088-8201-0x00007FFDB2420000-0x00007FFDB29AE000-memory.dmp

Download

memory/12088-8199-0x00007FFDB2D20000-0x00007FFDB396E000-memory.dmp

Download

memory/12572-8283-0x00007FFDAEDA0000-0x00007FFDB0AA0000-memory.dmp

Download

memory/12572-8264-0x00007FFDB2D20000-0x00007FFDB396E000-memory.dmp

Download

memory/12572-8266-0x00007FFDB2420000-0x00007FFDB29AE000-memory.dmp

Download

memory/12572-8265-0x00007FFDBF7F0000-0x00007FFDBF934000-memory.dmp

Download

memory/12572-8263-0x00007FF79B170000-0x00007FF79B51E000-memory.dmp

Download

memory/12860-8326-0x00007FFDAEDA0000-0x00007FFDB0AA0000-memory.dmp

Download

memory/12860-8310-0x00007FFDBF7F0000-0x00007FFDBF934000-memory.dmp

Download

memory/12860-8308-0x00007FF79B170000-0x00007FF79B51E000-memory.dmp

Download

memory/12860-8311-0x00007FFDB2420000-0x00007FFDB29AE000-memory.dmp

Download

memory/12860-8309-0x00007FFDB2D20000-0x00007FFDB396E000-memory.dmp

Download

memory/13560-8385-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/13560-8382-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/13560-8383-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/13560-8384-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/13560-8386-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/13560-8387-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/13560-8388-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/13560-8389-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/13560-8390-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/13560-8391-0x00007FFD94FF0000-0x00007FFD95000000-memory.dmp

Download

memory/17452-8952-0x00000000005C0000-0x00000000005C8000-memory.dmp

Download

memory/17452-8977-0x00000000050B0000-0x00000000050D6000-memory.dmp

Download

memory/17452-8976-0x0000000005020000-0x000000000502A000-memory.dmp

Download