Overview

overview

6

Static

static

1

Personal_O...ee.exe

windows10-2004-x64

6

Personal_O...ee.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/07/2026, 02:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Personal_Office_i18n_Free.exe
  • Size 353.9MB
  • Sample260728-cl72sshp21
  • SHA256 06c3c00b57f3127929a03d9aa564d11e649a35b6b34317f4ca48244c03060330
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
bootkitdiscoverypersistence

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Loads dropped DLL 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Personal_Office_i18n_Free.exe
    "C:\Users\Admin\AppData\Local\Temp\Personal_Office_i18n_Free.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Loads dropped DLL
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1304
  • C:\Users\Admin\AppData\Local\Temp\Personal_Office_i18n_Free.exe
    "C:\Users\Admin\AppData\Local\Temp\Personal_Office_i18n_Free.exe" -downpower -msgwndname=wpssetup_message_E589E4E -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e589aa5\
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    PID:3892

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        kcoworkdockpanel.qm
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kcoworkdockpanel\mui\es_MX\kcoworkdockpanel.qm
        • Size 846B
        • SHA256 8f0de81b05e2ce8a22432406009084933f0cf410e6efb534aafd71699651120c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kcoworkdockpanel.qm
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kcoworkdockpanel\mui\vi_VN\kcoworkdockpanel.qm
        • Size 839B
        • SHA256 ad5549bf1c748909f191eba6e08caccfb31dbe1a2ce4bfafcb1e41702f40c95f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        run.ini
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\ketaiconditionalformat\webview\run.ini
        • Size 171B
        • SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        index.html
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kpdfcorporateglossary\res\dist\index.html
        • Size 636B
        • SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        index.js
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kpdfcorporateglossary\res\dist\index.js
        • Size 2KB
        • SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        errPage.html
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
        • Size 7KB
        • SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        favicon.ico
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
        • Size 4KB
        • SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        run.ini
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwebpromehelp\run.ini
        • Size 226B
        • SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        close-secondary.svg
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
        • Size 216B
        • SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kwpsaibasetypo.qm
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
        • Size 334B
        • SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
        • MD5 SHA1 SHA512
        Submit Download

        kwpsaibasetypo.qm
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
        • Size 327B
        • SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
        • MD5 SHA1 SHA512
        Submit Download

        element-icons.ttf
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
        • Size 54KB
        • SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        element-icons.woff
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
        • Size 27KB
        • SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app.css
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
        • Size 107KB
        • SHA256 c9c5602e26393532e59391d5944a578716f3b6cad104ae20ac8caac805e52f86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chunk-vendors.css
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
        • Size 279KB
        • SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app.js
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
        • Size 380KB
        • SHA256 f1bd1ffaba49fd0c0040f182231f739000b0e4bc762900ecacab4980f743b203
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chunk-vendors.js
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
        • Size 249KB
        • SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chunk-vendors.js
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
        • Size 424KB
        • SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        index.js
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
        • Size 10KB
        • SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        index.js
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
        • Size 13KB
        • SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        index.js
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
        • Size 14KB
        • SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        apm-init.js
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
        • Size 57B
        • SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        default_ava.svg
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
        • Size 906B
        • SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        desk-sync.svg
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
        • Size 1KB
        • SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        loading.svg
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
        • Size 1KB
        • SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        error-net-72.png
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
        • Size 1KB
        • SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        presetLayout_16.pptx
        • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
        • Size 41KB
        • SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5CoreKso.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wps\~e589aa5\CONTROL\office6\Qt5CoreKso.dll
        • Size 5.7MB
        • SHA256 594f50c668648035620f9e180e4419f0d5309097a69bf85d6a21cee14d1523f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5GuiKso.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wps\~e589aa5\CONTROL\office6\Qt5GuiKso.dll
        • Size 6.4MB
        • SHA256 8be6e669754d5455e76417710a52dff1a56702b408ab0d1137774fa96c92fdf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5SvgKso.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wps\~e589aa5\CONTROL\office6\Qt5SvgKso.dll
        • Size 503KB
        • SHA256 e7e63cdeb522b8e72607c3a365eba4e7f1538955ef1c9ca9df799ca178c9677b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5WidgetsKso.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wps\~e589aa5\CONTROL\office6\Qt5WidgetsKso.dll
        • Size 5.6MB
        • SHA256 423c0c95b6c4e005798aa6151d7f4b43a4f4c9694f0e926d0b0cc34106ba7ba1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5WinExtrasKso.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wps\~e589aa5\CONTROL\office6\Qt5WinExtrasKso.dll
        • Size 251KB
        • SHA256 86cb3e80b1a162c0e11c23e5501ef023de6894ec1056a5aea137470024c157a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kpacketui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wps\~e589aa5\CONTROL\office6\kpacketui.dll
        • Size 829KB
        • SHA256 856122dae51a56a793e0a3c82492998f07e32ad57a98b64eb9e368c5826d19a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wps\~e589aa5\CONTROL\office6\msvcp140.dll
        • Size 544KB
        • SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qsvgicon.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wps\~e589aa5\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
        • Size 75KB
        • SHA256 762ed66bb00b4265179bb880b1fe9257f2c70f8aaa4f40ddaa7b5203b48e7e95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qsvg.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wps\~e589aa5\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
        • Size 46KB
        • SHA256 affe52c29ffb15dbc71fcbe4404d0f87211dad147c4387961879a1d7edcc72f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwindows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wps\~e589aa5\CONTROL\office6\qt\plugins\platforms\qwindows.dll
        • Size 1.6MB
        • SHA256 90a8bc6abbb6709372a924c852bcf73268fc98b07126eab14763859271e89d46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwindowsvistastyle.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wps\~e589aa5\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
        • Size 159KB
        • SHA256 c2ca509b65c67bda29de9738ee2fb40ab14d465dd9848871a291739fd4eb7407
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wps\~e589aa5\CONTROL\office6\ucrtbase.dll
        • Size 987KB
        • SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wps\~e589aa5\CONTROL\office6\vcruntime140.dll
        • Size 121KB
        • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wps\~e589aa5\CONTROL\office6\vcruntime140_1.dll
        • Size 48KB
        • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        style.xml
        • Path C:\Users\Admin\AppData\Local\Temp\wps\~e589aa5\CONTROL\pl_PL\style.xml
        • Size 3KB
        • SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        product.dat
        • Path C:\Users\Admin\AppData\Local\Temp\wps\~e589aa5\CONTROL\product.dat
        • Size 80KB
        • SHA256 dfafb839b12ed1150bce08960e25601fd322667c6f784ac901c5e0b4666098d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        product_new.dat
        • Path C:\Users\Admin\AppData\Local\Temp\wps\~e589aa5\CONTROL\product_new.dat
        • Size 79KB
        • SHA256 08c0a368ca8956d7e20bdb83288cb72542c9cbf3cb5446f371a7667d119c24f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        style.xml
        • Path C:\Users\Admin\AppData\Local\Temp\wps\~e589aa5\CONTROL\vi_VN\style.xml
        • Size 4KB
        • SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempinstall.ini
        • Path C:\Users\Admin\AppData\Local\tempinstall.ini
        • Size 382B
        • SHA256 bca613688e735ccd1fae7164550bd8ae90862028cd0bf31534c149ea0d7c9f60
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        tempinstall.ini
        • Path C:\Users\Admin\AppData\Local\tempinstall.ini
        • Size 428B
        • SHA256 23456d8ce681d1a5a31bf06262e088f4feb8d0e8fdc1d37afa4aa02830ffacdc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wpssetup.log
        • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
        • Size 10KB
        • SHA256 ff1c7635f0cf2df12a26550151894b7f6ac830f4018a7705eefa82d73c1406b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wpssetup.log
        • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
        • Size 11KB
        • SHA256 0fc634ae5c50d9ed85d5964fb9d952c34c5fbafb8d893a6a9c685f3e08c47192
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wpssetup.log
        • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
        • Size 28KB
        • SHA256 0330a256326d2543166a017d5d2cc627fb823c6723cc6be487c38ca6fccc654a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wpssetup.log
        • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
        • Size 61KB
        • SHA256 2f397048453097134041d74f7b279e2b52d0a5fa06ae5169dffa4288e62dad10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dcsdk_dpv3.data
        • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
        • Size 36KB
        • SHA256 8103f6cdbcf45dd01d359166b189c414e6126ceb36dca13f08f3836ab36029b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1304-485-0x00007FFDC7BC0000-0x00007FFDC814E000-memory.dmp
        Download