Overview

overview

6

Static

static

1

Personal_O...ee.exe

windows10-2004-x64

6

Personal_O...ee.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    138s
  • max time network
    175s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/07/2026, 02:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Personal_Office_i18n_Free.exe
  • Size 353.9MB
  • Sample260728-cl72sshp21
  • SHA256 06c3c00b57f3127929a03d9aa564d11e649a35b6b34317f4ca48244c03060330
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
bootkitdiscoverypersistence

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Loads dropped DLL 19 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Personal_Office_i18n_Free.exe
    "C:\Users\Admin\AppData\Local\Temp\Personal_Office_i18n_Free.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Loads dropped DLL
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3748
    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe" -checkInstallEnvironment
      2⤵
        PID:13276
    • C:\Users\Admin\AppData\Local\Temp\Personal_Office_i18n_Free.exe
      "C:\Users\Admin\AppData\Local\Temp\Personal_Office_i18n_Free.exe" -downpower -msgwndname=wpssetup_message_E59819A -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\
      1⤵
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      PID:1696
      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe" -setlng en_US
        2⤵
          PID:11992
        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe
          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe" -getonlineparam 00001.00000001 -forceperusermode
          2⤵
            PID:14040

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              Qt5NetworkKso.dll
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\Qt5NetworkKso.dll
              • Size 1.4MB
              • SHA256 f3f41dc45e7a2a8face33ca127ceab4e4792e822aa0ee5062bbd7d7f83a78d55
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Qt5XmlKso.dll
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\Qt5XmlKso.dll
              • Size 213KB
              • SHA256 c9145e6691d83fcd7523351795b094a9cfb7c4007011e1dd82a77e71ffd2d1f6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              logo-small.png
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\StartScreenTile\ksolaunch\logo-small.png
              • Size 6KB
              • SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              logo.png
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\StartScreenTile\ksolaunch\logo.png
              • Size 12KB
              • SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Everything-KingSoft-Read-Only.ini
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\everythingsearch\everythingbinary\Everything-KingSoft-Read-Only.ini
              • Size 404B
              • SHA256 b5980cd1122d2ad4727bc06806e3d2a6598b7d67b6eb3d2732938d08c6deedbb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              kcoworkdockpanel.qm
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kcoworkdockpanel\mui\es_MX\kcoworkdockpanel.qm
              • Size 846B
              • SHA256 8f0de81b05e2ce8a22432406009084933f0cf410e6efb534aafd71699651120c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              kcoworkdockpanel.qm
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kcoworkdockpanel\mui\vi_VN\kcoworkdockpanel.qm
              • Size 839B
              • SHA256 ad5549bf1c748909f191eba6e08caccfb31dbe1a2ce4bfafcb1e41702f40c95f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              run.ini
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\ketaiconditionalformat\webview\run.ini
              • Size 171B
              • SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              index.html
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kpdfcorporateglossary\res\dist\index.html
              • Size 636B
              • SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              index.js
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kpdfcorporateglossary\res\dist\index.js
              • Size 2KB
              • SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              errPage.html
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
              • Size 7KB
              • SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              favicon.ico
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
              • Size 4KB
              • SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              run.ini
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwebpromehelp\run.ini
              • Size 226B
              • SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              close-secondary.svg
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
              • Size 216B
              • SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              kwpsaibasetypo.qm
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
              • Size 334B
              • SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
              • MD5 SHA1 SHA512
              Submit Download

              kwpsaibasetypo.qm
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
              • Size 327B
              • SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
              • MD5 SHA1 SHA512
              Submit Download

              element-icons.ttf
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
              • Size 54KB
              • SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              element-icons.woff
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
              • Size 27KB
              • SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              app.css
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
              • Size 107KB
              • SHA256 c9c5602e26393532e59391d5944a578716f3b6cad104ae20ac8caac805e52f86
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chunk-vendors.css
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
              • Size 279KB
              • SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              app.js
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
              • Size 380KB
              • SHA256 f1bd1ffaba49fd0c0040f182231f739000b0e4bc762900ecacab4980f743b203
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chunk-vendors.js
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
              • Size 249KB
              • SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chunk-vendors.js
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
              • Size 424KB
              • SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              index.js
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
              • Size 10KB
              • SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              index.js
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
              • Size 13KB
              • SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              index.js
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
              • Size 14KB
              • SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              apm-init.js
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
              • Size 57B
              • SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              default_ava.svg
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
              • Size 906B
              • SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              desk-sync.svg
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
              • Size 1KB
              • SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              loading.svg
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
              • Size 1KB
              • SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              setup.cfg
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\cfgs\setup.cfg
              • Size 449B
              • SHA256 43da7b18b9685f34614e3e6cb71a6feda052247eae7372e59e1f84011528d020
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              kbase.dll
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\kbase.dll
              • Size 1.2MB
              • SHA256 c108afe8b807c775a5f1ed5f7f320e84b2859a08e13738a691d71f61f5e18329
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              kbaseconfigcenter64.dll
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\kbaseconfigcenter64.dll
              • Size 2.2MB
              • SHA256 422a2d9aa374cf1dbe0b04803e68e532a2ffbb0ec0beeb4438864b970ecc3283
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              kdesign.dll
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\kdesign.dll
              • Size 1.3MB
              • SHA256 03eca843378c4b659466d13649b8bac31881e3270553a7512512a356f76bb38f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              krpt.dll
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\krpt.dll
              • Size 347KB
              • SHA256 bc7f79420945d1986a6b9055dafb3f29119452e63a48b8ed6818205270b092c1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              krt.dll
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\krt.dll
              • Size 1.4MB
              • SHA256 ea881164cc61e32f006db9511d29181e2cf9fa8bfb95d9f03fe459010127db4e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ksolite.dll
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksolite.dll
              • Size 12.3MB
              • SHA256 3d32fa5e40629df5b24d909e93a173eff9b352124fe903823eaec4eba486ffaf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ksomisc.exe
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe
              • Size 3.7MB
              • SHA256 95f40227bcc81d32eac522a51e9a043bb6ce5be3f2d4d1b7517e87051a9d6af3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libcrypto-kso-1_1-x64.dll
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\libcrypto-kso-1_1-x64.dll
              • Size 3.4MB
              • SHA256 43cb26b87970d3a357e1bd2e67fe3fbca4222265a59813e65b7c05414e2830c7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libcurl.dll
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\libcurl.dll
              • Size 825KB
              • SHA256 5b69e4a2c8abb5d9b530bb97617e60a25cc2e517d2d928693a61e82a97ed2151
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libssl-kso-1_1-x64.dll
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\libssl-kso-1_1-x64.dll
              • Size 718KB
              • SHA256 2d0ac54892db33fc81fee165577e8f930efcff31fb5e8e91be68f9ebca54dbd2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msvcp140_codecvt_ids.dll
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\msvcp140_codecvt_ids.dll
              • Size 31KB
              • SHA256 f2069a52880ec885ee7f0511186100eb7fada0411a2b4948fafea7735b878a18
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              lang.conf
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\mui\en\lang.conf
              • Size 44B
              • SHA256 6f88990f089b750ac283d6ae5896c6eaff8097e39899a6b195993ad8e9b40356
              • MD5 SHA1 SHA512
              Submit Download

              error-net-72.png
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
              • Size 1KB
              • SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              presetLayout_16.pptx
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
              • Size 41KB
              • SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              install.ini
              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\utility\install.ini
              • Size 462B
              • SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Qt5CoreKso.dll
              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\CONTROL\office6\Qt5CoreKso.dll
              • Size 5.7MB
              • SHA256 594f50c668648035620f9e180e4419f0d5309097a69bf85d6a21cee14d1523f6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Qt5GuiKso.dll
              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\CONTROL\office6\Qt5GuiKso.dll
              • Size 6.4MB
              • SHA256 8be6e669754d5455e76417710a52dff1a56702b408ab0d1137774fa96c92fdf6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Qt5SvgKso.dll
              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\CONTROL\office6\Qt5SvgKso.dll
              • Size 503KB
              • SHA256 e7e63cdeb522b8e72607c3a365eba4e7f1538955ef1c9ca9df799ca178c9677b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Qt5WidgetsKso.dll
              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\CONTROL\office6\Qt5WidgetsKso.dll
              • Size 5.6MB
              • SHA256 423c0c95b6c4e005798aa6151d7f4b43a4f4c9694f0e926d0b0cc34106ba7ba1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Qt5WinExtrasKso.dll
              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\CONTROL\office6\Qt5WinExtrasKso.dll
              • Size 251KB
              • SHA256 86cb3e80b1a162c0e11c23e5501ef023de6894ec1056a5aea137470024c157a5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              kpacketui.dll
              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\CONTROL\office6\kpacketui.dll
              • Size 829KB
              • SHA256 856122dae51a56a793e0a3c82492998f07e32ad57a98b64eb9e368c5826d19a1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msvcp140.dll
              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\CONTROL\office6\msvcp140.dll
              • Size 544KB
              • SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qsvgicon.dll
              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
              • Size 75KB
              • SHA256 762ed66bb00b4265179bb880b1fe9257f2c70f8aaa4f40ddaa7b5203b48e7e95
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qsvg.dll
              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
              • Size 46KB
              • SHA256 affe52c29ffb15dbc71fcbe4404d0f87211dad147c4387961879a1d7edcc72f9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qskia.dll
              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\CONTROL\office6\qt\plugins\platforms\qskia.dll
              • Size 1.9MB
              • SHA256 b2d433e26b427b1969bec756734592c509327b3bd681e00bb284e89ba5997d13
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qwindows.dll
              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\CONTROL\office6\qt\plugins\platforms\qwindows.dll
              • Size 1.6MB
              • SHA256 90a8bc6abbb6709372a924c852bcf73268fc98b07126eab14763859271e89d46
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qwindowsvistastyle.dll
              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
              • Size 159KB
              • SHA256 c2ca509b65c67bda29de9738ee2fb40ab14d465dd9848871a291739fd4eb7407
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ucrtbase.dll
              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\CONTROL\office6\ucrtbase.dll
              • Size 987KB
              • SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcruntime140.dll
              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\CONTROL\office6\vcruntime140.dll
              • Size 121KB
              • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcruntime140_1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\CONTROL\office6\vcruntime140_1.dll
              • Size 48KB
              • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              style.xml
              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\CONTROL\pl_PL\style.xml
              • Size 3KB
              • SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              product.dat
              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\CONTROL\product.dat
              • Size 80KB
              • SHA256 dfafb839b12ed1150bce08960e25601fd322667c6f784ac901c5e0b4666098d8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              product_new.dat
              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\CONTROL\product_new.dat
              • Size 79KB
              • SHA256 08c0a368ca8956d7e20bdb83288cb72542c9cbf3cb5446f371a7667d119c24f2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              style.xml
              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597de1\CONTROL\vi_VN\style.xml
              • Size 4KB
              • SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tempinstall.ini
              • Path C:\Users\Admin\AppData\Local\tempinstall.ini
              • Size 382B
              • SHA256 bca613688e735ccd1fae7164550bd8ae90862028cd0bf31534c149ea0d7c9f60
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              tempinstall.ini
              • Path C:\Users\Admin\AppData\Local\tempinstall.ini
              • Size 428B
              • SHA256 23456d8ce681d1a5a31bf06262e088f4feb8d0e8fdc1d37afa4aa02830ffacdc
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ksomisc_2026_07_28.log
              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_07_28.log
              • Size 3KB
              • SHA256 b584a4394998f3b5085c2b1cf7cc395ebc862d7ca7d922ec80683b3d9d6989b0
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ksomisc_2026_07_28.log
              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_07_28.log
              • Size 5KB
              • SHA256 acc27fc283f34bc20b8aa748db7abf498f169f65f1cdff7f8810d0d7ced4f2a7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wpssetup.log
              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
              • Size 10KB
              • SHA256 f4582b4c8f9abf9d61b8137cc66a661bccbd4d6bfcb9ca44b97bef91388f0c4e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wpssetup.log
              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
              • Size 12KB
              • SHA256 2e0af8954129b7514349bb0d211b1a0a5e53d085d208214395ec310c5f244c89
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wpssetup.log
              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
              • Size 28KB
              • SHA256 b9ad832042d5a963aa6e5fde8d3f74644e12e10a1efe328267903222f7e34b77
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wpssetup.log
              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
              • Size 62KB
              • SHA256 06f570bc75d50be15e0670c319fa9b90b4567f667fd354cadf62e9736379b56e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wpssetup.log
              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
              • Size 68KB
              • SHA256 a05735d71e95b9d5844ef9a103aa642a1568409c8c13999ac05ac81025fc3e39
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dcsdk_dpv3.data
              • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
              • Size 36KB
              • SHA256 8103f6cdbcf45dd01d359166b189c414e6126ceb36dca13f08f3836ab36029b2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/3748-439-0x00000205F6780000-0x00000205F6D0E000-memory.dmp
              Download

              memory/3748-467-0x00000205F6780000-0x00000205F6D0E000-memory.dmp
              Download

              memory/3748-470-0x00000205F6780000-0x00000205F6D0E000-memory.dmp
              Download

              memory/3748-3463-0x00000205F6780000-0x00000205F6D0E000-memory.dmp
              Download

              memory/3748-8387-0x00000205F6780000-0x00000205F6D0E000-memory.dmp
              Download

              memory/11992-8959-0x00007FF6AFE60000-0x00007FF6B0219000-memory.dmp
              Download

              memory/11992-8960-0x00007FF901A40000-0x00007FF901FCE000-memory.dmp
              Download

              memory/11992-8957-0x00007FF902340000-0x00007FF902F98000-memory.dmp
              Download

              memory/11992-8958-0x00007FF91E130000-0x00007FF91E275000-memory.dmp
              Download

              memory/11992-8975-0x00007FF8F7AB0000-0x00007FF8F9851000-memory.dmp
              Download

              memory/13276-8945-0x00007FF8E5530000-0x00007FF8E5540000-memory.dmp
              Download

              memory/13276-8943-0x00007FF8E5530000-0x00007FF8E5540000-memory.dmp
              Download

              memory/13276-8939-0x00007FF8E5530000-0x00007FF8E5540000-memory.dmp
              Download

              memory/13276-8938-0x00007FF8E5530000-0x00007FF8E5540000-memory.dmp
              Download

              memory/13276-8941-0x00007FF8E5530000-0x00007FF8E5540000-memory.dmp
              Download

              memory/13276-8929-0x00007FF900E10000-0x00007FF901A68000-memory.dmp
              Download

              memory/13276-8930-0x00007FF6AFE60000-0x00007FF6B0219000-memory.dmp
              Download

              memory/13276-8942-0x00007FF8E5530000-0x00007FF8E5540000-memory.dmp
              Download

              memory/13276-8931-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp
              Download

              memory/13276-8940-0x00007FF8E5530000-0x00007FF8E5540000-memory.dmp
              Download

              memory/13276-8926-0x00007FF91E130000-0x00007FF91E275000-memory.dmp
              Download

              memory/13276-8944-0x00007FF8E5530000-0x00007FF8E5540000-memory.dmp
              Download

              memory/13276-8919-0x00007FF9026A0000-0x00007FF902C2E000-memory.dmp
              Download

              memory/13276-8946-0x00007FF8E5530000-0x00007FF8E5540000-memory.dmp
              Download

              memory/13276-8947-0x00007FF8E5530000-0x00007FF8E5540000-memory.dmp
              Download

              memory/14040-8992-0x00007FF901DB0000-0x00007FF90233E000-memory.dmp
              Download

              memory/14040-8990-0x00007FF902340000-0x00007FF902F98000-memory.dmp
              Download

              memory/14040-8991-0x00007FF91E130000-0x00007FF91E275000-memory.dmp
              Download

              memory/14040-8989-0x00007FF6AFE60000-0x00007FF6B0219000-memory.dmp
              Download