db89c53d2f1f00f52ccd5a3bf32b759f84bc777e79238ef89def04f80f5cc8f5

Analysis

max time kernel
71s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Size 5.2MB
Sample260729-2efreaw1gt
SHA256 db89c53d2f1f00f52ccd5a3bf32b759f84bc777e79238ef89def04f80f5cc8f5
MD5 8cc3f63a152cddd5c4a60a278d7c303f
SHA1 48c9eef650d1c5cfc6dc6852180a66277d8c00ae
SHA512 8dc6de6b9f1b5bf8a79dea546051bcb61cac7aee057fbf9c3cf7b1e888b7a9fd8fa07744a7e07b80e7782d0bddb38da6593ca4c29f9fc416cfedbe4569cfea81
SSDEEP 98304:+tSmIpRRoT9bdCZl5C7SvvyyY4BDt8jAmY7R7qq/X:lmgRSsdDujY7ReGX
TLSH
T12546BF11F685C5B1F5D201B0297AAB7A943DBE28573088C7A7D11E2A88312D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	\??\PhysicalDrive0	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
File opened for modification	\??\PhysicalDrive0	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe

Executes dropped EXE 2 IoCs

pid	Process
3320	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
4936	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe

Loads dropped DLL 1 IoCs

pid	Process
3320	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Modifies system certificate store 2 TTPs 40 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\TrustedDevices	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\TestSignRoot	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\FlightRoot	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\OemEsim	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3260	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3260	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3260	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3260	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3320	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
3320	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
3320	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
3320	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
3320	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
3320	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
3320	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
3320	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
4936	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
4936	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
4936	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
4936	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
4936	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
4936	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
4936	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
4936	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
4936	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
4936	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
4936	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
4936	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
3320	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
3320	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
3320	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
3320	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
3320	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
3320	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3320	5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 3320	3260	2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_8cc3f63a152cddd5c4a60a278d7c303f_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3260
- C:\ProgramData\WPS\Installers\5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
  "C:\ProgramData\WPS\Installers\5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3320
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe" -checkInstallEnvironment
    3⤵
    PID:1280
- - C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
    "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService
    3⤵
    PID:3764
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe" -addFirewallRule
    3⤵
    PID:1232
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\wpsoffice.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\wpsoffice.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=klangmanager -dll_name=klangmanager.dll downloadlang en_US
    3⤵
    PID:1756

C:\ProgramData\WPS\Installers\5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe
"C:\ProgramData\WPS\Installers\5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1187.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5A7ED6 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\
1⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4936
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe" -setlng en_US
  2⤵
  PID:1704
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe" -getonlineparam 00601.00001187 -forceperusermode
  2⤵
  PID:5356
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe" -getabtest -forceperusermode
  2⤵
  PID:5008
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe" -fixoldversionassostatus
  2⤵
  PID:5436
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe" -setservers
  2⤵
  PID:5600
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe" -register
  2⤵
  PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4144

C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
1⤵
PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 b6370e40beec453b472e64045b4033fc9e4caa08a5916d0908da56399875f33c
MD5 a1a888ceb8f65fc4934aa181bfca5cbf
SHA1 e5681dab2fff23f4d59373d9780bdd9f0e0821c4
SHA512 609c29c07506f3f5c85bc4853b244b0828522f82b1d7d7c73d70a2a044eca5f8d352c8064a9f180dbc3427655194d4e39b4cb8a9328ee85e589111cca07a92c8
TLSH
T135F0D46745F228B11A95449C11F459557878B7CF08838066607808D5EA462A5744F455
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 727B
SHA256 e0365868125950f2397d2d53988206575d6debf622700afd3432cc4d1452b2d1
MD5 aa5d7e2c00414ebef70aee386dd23875
SHA1 1cfb73ce1d83b03a84501fbbe4fbf23f50d79689
SHA512 6c9376662209b390646a4d9e266783bacc5ee1b51c6f5d4b1e32ce1e6446e193e8924709dc9cfd7919493d777dc4baf1fb5417dfb2fbdd15a9b25c0060c22ae9
TLSH
T1100194035024AC8B2751D429AB7AD7656F30876020E943FE242EA0C8E884B32D306904
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 a979724fe78a75e9ebd04b45951bedf4560a843e90fe02283b2da2d01c3c6f11
MD5 e08d7206c6b1328162021158be2a3bba
SHA1 b2be6544fe648af07b04b5df08ed12055966c822
SHA512 7f7ad41d29021a1402267706e79dcaaefb26e46ed9e65b37901098745ed0a863e0f897d54ce1c35592719b92bc2aaaf95bd95443c0707e664f45b31be848f07e
TLSH
T18301991744B5D3603523050AFB9C65A93A670E8408E283B53E920CFF2C8DCFD0F8E410
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 91677a1fccc5d6124544c7d8e8382633e97752047fef6d381285e9def7956660
MD5 b72a0955f3df9044ed7c4efb833bd253
SHA1 58c08a627d1d0efbcaf487c21ec5ecf9832714cb
SHA512 2b8d9e36e9fad0244a38e353036341004fb7f71021f945c0ceaf239917e5d61ac3ad5e936a27cf1fdf5cb4c10ae582d355536575560ea3e19ef91c2ec742edd7
TLSH
T15BE0C03427FF005FF160473803D580D66F26F0033C4552BD0E81512C590B9404C62C30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 404B
SHA256 ecf09f054701c1f9210a17bdad9bdeccf7d375ae41c5ca19c532fa61faa46ff1
MD5 2c8be33649660d447d13071e735567e8
SHA1 2536770db00921624e9398e9a06df02c110b6247
SHA512 a442c6ea801f74f7bd5bd59d6d2a0ba1213d3ad6dc957a51a4fbe80e65d05eae0d137fa28f3e5fc1a4be1838068a80e7dd33c26483447941fd172ba897585717
TLSH
T177E0203421F9495EF0F8D47443EB98625D59F10719418B6D15401329EA15F408CB2674
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 32c24952061e4a4885365118539729732a1c765af97fd7bc06e3b07157a4ce9d
MD5 eb94e55009e692e8ade251669984868d
SHA1 670f95337771b36a0926d8e29fed12feb6d04e8d
SHA512 392c5a7aabdbd8ba6c243623e95601a900893c7abfa9d6b94031933a9b857b2d0240e441c95ed3161367cb6a502020efa1b138c78da55957e81b6e7d0f8e9d86
TLSH
T105E0683815EB650EF050D83142E5A0BA0D88F2061400967907C04388F78AE009E51AB4
MD5 SHA1 SHA512 TLSH

Submit Download

Qt5NetworkKso.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\Qt5NetworkKso.dll
Size 1.4MB
SHA256 f3f41dc45e7a2a8face33ca127ceab4e4792e822aa0ee5062bbd7d7f83a78d55
MD5 3a882fc2cb62f868631ad284e4d7c8f7
SHA1 50cd060bd00f25e9801de466aa6fd91146b89511
SHA512 294b488a0e18fd0a214cf7abbd52cb6e2affb4f3c8e48258454485ed4bf54f35b37d54450a7d751038cd58c55972d58645b4797f56c01041a327dc914e000302
SSDEEP 24576:vkbqCgnInomjARXqFrdpEGcqHnwg0iWJ+6VQQactc:wNgnOo2q1Gc4wKE+6VJu
TLSH
T1F3655A53F7554399D62AD134CA8BC902F272740083A75BEF2669DB192F737E2263E381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5XmlKso.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\Qt5XmlKso.dll
Size 213KB
SHA256 c9145e6691d83fcd7523351795b094a9cfb7c4007011e1dd82a77e71ffd2d1f6
MD5 c56ec8f67bf2349c272be96665c16cc0
SHA1 cf9cb09d64f094048f6dc7c9328ed999373185f7
SHA512 bb6b778f1e6c155555ef4c1b66abae8120854a0747c1b7e6fe285030c354d1d656d8e011d0d738fa45d00d7b10254ffe7dc5c73d720b7d050eb0047dd815bc85
SSDEEP 3072:che9UZLXlmma9ECFoib660hOcOg745kgWfwqjXiboF0NX1l:chbZL8B9Eooibz0gcOOLiboIl
TLSH
T1BE243A53FB15429AE127C138CD96880AF6B37C40476247DFA694A73A1F33BD2797E290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo-small.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\StartScreenTile\ksolaunch\logo-small.png
Size 6KB
SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
MD5 8d650fe389e3665607fdbf938c1a1722
SHA1 2e545f9555ff22313e4ce113995d8aa694e5cab8
SHA512 f116621bfecb602d02919eb1ee9d7dc92e82b313b8b54cda42ab48c5e7ec60b02005edcad763fff6b497ca4bc46e83cb0c9a249be791f245bb9c599950fdf015
SSDEEP 192:HSO0z+xgsZ7wNP+agwQznBm2KIvdgoeAtzpZb/D1:yMRoP+z5IIa8hD1
TLSH
T1CCD19EEE6F1CCE4F079D52F7500AC0A9DEA218AA905764D4D68E70B471FE6D120EC5C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\StartScreenTile\ksolaunch\logo.png
Size 12KB
SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
MD5 d58510dca6b659c6e4ba7a454d5b75ce
SHA1 e142de2dda3811a2e8bbbb2eb64d366e8eb9ea3c
SHA512 42409f9976ad08ecf1756d1c2915f3ffd17cdc78e9ff552c0a08bdfa2fda8960e408721bfc9de1a5ed9c9aca3e23b97adb721b3c51b6b3f0ed3ee4a4c780cf88
SSDEEP 192:ySLu8Kp8OtM5IirU31+5AejJ7D+N+QOtHQjrE9aTYpR8XnXrWjvyNTtLJci:NC8o8do1+5D+N+QPE9B2Xn7WrINJP
TLSH
T1BC42C08F68918EB2CE443C39F356115F1FE12A5E7E19A2CF2CE7944A239044ACE1591F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything-KingSoft-Read-Only.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\everythingsearch\everythingbinary\Everything-KingSoft-Read-Only.ini
Size 404B
SHA256 b5980cd1122d2ad4727bc06806e3d2a6598b7d67b6eb3d2732938d08c6deedbb
MD5 6a4653f40acaaa13e2b0f60f067ea93f
SHA1 34981baa55ef31ae6b6d5985fdd02798e3bacde2
SHA512 f286472389e50fa51abe03068cc3e1f9d18b19926d84b66b1df28c157cbc70e8de32a8deb7b4096f462605a2bdd4d76f9863c6ca0872703c60d473a3271778ea
TLSH
T15DE02B99808C4B1C7656E6948D715E4F42E1C79C1B98174CCB0BC241E91950DF63A439
MD5 SHA1 SHA512 TLSH

Submit Download

kcoworkdockpanel.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kcoworkdockpanel\mui\es_MX\kcoworkdockpanel.qm
Size 846B
SHA256 8f0de81b05e2ce8a22432406009084933f0cf410e6efb534aafd71699651120c
MD5 6e815f2b93f16067d08e51cdb69b81e4
SHA1 40630f21ec4e2ce47da271f5e379737bef67fad5
SHA512 7e9586a605815f829a2881ae328d4df3cb9600949767cc5c8fb8186cc2243b08d8cec4bd52cff81c728fdb0c8fd7ce1c9d8e52e9fe4139722e99d4be12c6e482
TLSH
T12F01E9D527FD2F19F3F79BB179E652108F3679082931D16F2145A40D05A15505DD0327
MD5 SHA1 SHA512 TLSH

Submit Download

kcoworkdockpanel.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kcoworkdockpanel\mui\vi_VN\kcoworkdockpanel.qm
Size 839B
SHA256 ad5549bf1c748909f191eba6e08caccfb31dbe1a2ce4bfafcb1e41702f40c95f
MD5 3eabae85edf1db8a54d42509c660862c
SHA1 ea6133582aaf7aaf5330142474dec996e527b461
SHA512 05d619228af227bec2d3b33aab044dcaf79b69633c604f81d6456eb10d4420e48024a9a88cd706fb5c00908565347f5e04302f90bc5211d48d99e2aab2feb7d9
TLSH
T16801E29523BD2F19F3F79BB17AEAA2208F3679082932D16F2145A40D05A29508EE0327
MD5 SHA1 SHA512 TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\ketaiconditionalformat\webview\run.ini
Size 171B
SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
MD5 b30cb271e143eace0f55ea2e562e1e9f
SHA1 9d97dbf24931cfc114384c3f4dbbae21c9e51be5
SHA512 dc593185fa63b458024c3a913c558e5686806154181dea67eec786ada50595c53bab822833ad1e76c9acdf21be3eba50631391b7e575d7f1f6409ceccf966535
TLSH
T1AAC080D4D0256F97DC31C6B5ED54AF1A7560E700251C1EC3D530DC4E9E9696551C805D
MD5 SHA1 SHA512 TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kpdfcorporateglossary\res\dist\index.html
Size 636B
SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
MD5 72cdeca808b16e794ec5b66bd02246bf
SHA1 e75b6c4e084efc8e60c9e4fbe9e9ae02bfbf4132
SHA512 6562ed498bae7f819caa5ebff9ba373b1bbeae3c92befacbc44a72419e6a3aedeee7fe43347d1bf8c46b9c90c8e515181a6dc50c4ad954a640cf6b2520269ed8
TLSH
T1E5F002EA3C25F055CB911EA43DF2F19E245E3AB29DB9DE942AF4513543C03694D0BF48
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kpdfcorporateglossary\res\dist\index.js
Size 2KB
SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
MD5 67dde682d1968824023dd9773f9ec48b
SHA1 81e0a21a7ba2c05193ecc13672a3f537539e0699
SHA512 86bccae3d66df4dd552c12a42d1ed0d57d6cdb7b904caa1f89c874e506fb76412b2df45e3e5f673837cb72aa18b0ab2c1dfb489b1da37068d83d7ccb25d3d8ea
TLSH
T1FD5173C9F79E702209EAE136583F0006E17735596098A1C8B87ED8F16EB555E7077F38
MD5 SHA1 SHA512 TLSH

Submit Download

errPage.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
Size 7KB
SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
MD5 eb3b05c3a3fdef3b0c5c9020756ebb33
SHA1 27c5773e17f9c05f471ccd22db42015561b4e669
SHA512 9a511c6d0aad855448ae45130d7ed031062bb7e6881e68aa2406c7c122220318379c312bc13876599dd7fe88e2beac296adf5bcdc015ef4e0e3f362e76303ab0
SSDEEP 96:9uMJIMzvOcuq4v+nB1W1QjjaKhwc3Rgjfqqm8bm83:9lTgVv+B1W1Q6ywc3RgjfDm8bm83
TLSH
T141F15211D6925216603393B4DFA25719FB260023A3038A38BFECA2558F75C495B93FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicon.ico

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
Size 4KB
SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
MD5 1ba2ae710d927f13d483fd5d1e548c9b
SHA1 c0605efed936ee2600284e6480521d06fa64f872
SHA512 f933cd352eaba92f509b3863353ddfefadfada26a4152ecdc4727d450bbf35e7b10fb3038fe8db340d5c63d74e608c1560ec84d0f6ffc8ccd940c9e0d7533544
SSDEEP 48:i3H5R5hLOR4kt38PduMoglJrd6qTrp9hweFC0+6Ga:ipHFUs4MLBvuyCda
TLSH
T1EE9175DF61C388D9C1B1977F78C449A14F6FD951BA28351F55CF30622E5D75818C1C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwebpromehelp\run.ini
Size 226B
SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
MD5 abc3a6089b0ea76ffc960fbc9b6e66d1
SHA1 50ad0cb201c13799024de56cf45116cf65ff5569
SHA512 ec1e32b7bed882095b23e049a4e1a86acf0bf993e2f691105ffbd99d93ebf28faad4fbdd645ac1eefa74ede575854a3994c7c6d2bacc6f7a09a1991561b1a44b
TLSH
T157D09700C0B5658AC1254C827CA53DC411085B4B27608E02CCF0C34D508EBECE56B08A
MD5 SHA1 SHA512 TLSH

Submit Download

close-secondary.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
Size 216B
SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
MD5 07306930f7d374663bd13e38ea0e92a1
SHA1 12f877e8ab93d874b55d75eef6747615619dad4f
SHA512 4cc0517ed0b9d665df4db93fb3093067e90f64b34f1d41420ed975b4cec64d4cc0aede64092d79c610c04e1ecd9514a9ef48389d5c157b5bcf698fc33670db98
TLSH
T1D8D0223BB3CC8E1CF9224A22F35A713580AF41C3548942E4D8322032E4011CEB93B6E8
MD5 SHA1 SHA512 TLSH

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
Size 334B
SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
MD5 d36fe6147829a72b42e054a5db27d270
SHA1 80779a8eb37d8bb1d5fcc594576f80dbd61fac98
SHA512 94224816f757241b3a6d19788225378ae070fc62b4620e11e10a033e3be5d9cc858cd9e669cc275b1fa82e57094d0df13a6d9868cf00afaa17cf2ec0193acd74
MD5 SHA1 SHA512

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
Size 327B
SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
MD5 18770de3f96bac1e75e588015024fcf8
SHA1 e6254c054edef68f9c27059efd82eeaa69c863b5
SHA512 fcb76291a73d7f2e30f4266ea8f0dfa2d9e203cf9770fb7ffd73cc1994502992fabd0803224c1e1155c1e4b678b5af0e8b3aec114beb1f02299e8885d5a61d0a
MD5 SHA1 SHA512

Submit Download

element-icons.ttf

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
Size 54KB
SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
MD5 732389ded34cb9c52dd88271f1345af9
SHA1 8058fc55ef8432832d0b3033680c73702562de0f
SHA512 e8971ae48f5287d252f5b0a2d0516091bef0d2febf7d01fd7b435e426d106fea251037439ec42c2937e934b66f38e5eb43d00a213cdf334f482f4a06b1817f9c
SSDEEP 1536:qTIRCXXCwinqtuPM16hD2N3SUjbwaST4DCJe:39GEcgD2njb5ST4h
TLSH
T10A433B32436A9BE7F416047F5C1F55830A9F4F22F53DEA8B83A6192514162FD0864BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

element-icons.woff

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
Size 27KB
SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
MD5 535877f50039c0cb49a6196a5b7517cd
SHA1 0000c4e27d38f9f8bbe4e58b5ce2477e589507a7
SHA512 da269b20f13fb5b0bb4628b75ec29e69bb2d36999e94b61a846cb58db679287a13d0aa38cdf64b2893558d183c4cc5df8da770e5a5b2a3288622cd4bd0e1c87b
SSDEEP 768:gOvv6ExpCVxUtrT6w8ClFd80EjPVerMKBaGXjAlEm:Hvv6xVWewtlFdGjPlkFjAlEm
TLSH
T1B9C2E13197213AE9D9824EF876E498FEF1651402290F390E8696ADB3A98D5C73E16831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
Size 107KB
SHA256 c9c5602e26393532e59391d5944a578716f3b6cad104ae20ac8caac805e52f86
MD5 d758ec835091abce0528909c5dadfe24
SHA1 07a9ffb19860ece3293780c707bc71f25a6e5d42
SHA512 74d869f2cc25b5a49adea778f52f59c6f4b7f2eca31c511f19250538d241136a6cbefedccb250a3773500bdc6b9caa57ae7cee40c0dc2d8753f2386e2f390cc4
SSDEEP 3072:KazzQ51KYGqMkYUl26MeCsAcdl6y7tqWD:mMQ/euD
TLSH
T13DB31B37214D132D383BDAA2E55D659A60C8F61BC01253F5FA247B1DCA837873A763AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
Size 279KB
SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
MD5 a3964e72421a1ef5fb60c6e17eb5d705
SHA1 5dd9584be5141e884a230c48746e1c88126b0a55
SHA512 4ce4119b7407b460969041809354c4ede587047ee643f2897eb0ecb9627608431f43fed27c54c70bacff3a6694eb32a85b535c7d6397ac22d7d28e260b0a5467
SSDEEP 1536:39eSBQG+dyAUlHj/8D0Q+SPxZztR+LCrwHFfyqHYb3PPV7BYUOf0I79lDxiRSL2Q:3zfZYKVxiW
TLSH
T14054B6229140212E702BDE3DF7C4EA4AE225C6B3C4125BFEF953651DC7C36AA117778A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
Size 380KB
SHA256 f1bd1ffaba49fd0c0040f182231f739000b0e4bc762900ecacab4980f743b203
MD5 bb8a0b01c0ac1190e643c4e9daf4b69e
SHA1 f0286c3ea896a359666be8f10a7519c767afb321
SHA512 da37ebedf1e5365df105b3bfb559d0dc6a75b2896ad29c844c6b987ac5388139fe88414cc6128144f6fa50086564ea67f257eec54941dd43b124be0b8b276573
SSDEEP 6144:5pK457wXrka10TbOXsEYpHBBs6Ve5NtXoqIpgznl87A6v0eX4AiDuViQbgQgILTv:64G0WtYpmiLlTD8QmIqU1NBqq
TLSH
T1E4846C4B758BBB5A1F35B66340DF3C88D01C6EC09812A5C9FABDD9D09144B9A32D63BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
Size 249KB
SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
MD5 6351ea268f992f52e0f4418a7028b91d
SHA1 5bb3cb88465c550a1fd033a079a8b2eba5e071b8
SHA512 44940d07abfdee6403e9400e596ac5e5eb234ba77a1c90c2fe4086878c12f4805c709eb84538071f21d5710d3569d342e7caea10061e2ab2661c5117c5966297
SSDEEP 3072:p+Xy2rHhkiTtcsuaIwK3zqDLW/ix3Iu7doNFBWgz/bwUzxqcG7gLEOhA:phKHhklsi3zpCdoNFBHz/bwAfG7cW
TLSH
T10A44F8CDB2D1B0A517EB61B4813F610BF27B6499B44E80D0E226E5D4BC7998E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
Size 424KB
SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
MD5 cf29fba214e7f43f2ca1b629109d126b
SHA1 d0dda9486528586af6943abe7a3afa319c790f25
SHA512 2ad7e4711f5917b8d13f861d4fb2688e6ce3951da43a89263a2d9743199e173429398ec1a9537b1df25593d3999dd34fb590e2d2a6e7a632ccc44265d93c3bca
SSDEEP 6144:z8KzCOcC0CXWsJvRekr0dgei/zJbBoCF7az2bzNM:zbzCODTWsJvRbw6zJbBfaz2bC
TLSH
T13694198DB2C1B0A517EB60B4913F610BF23B6469B44E80D4F266E5E57C7898E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
Size 10KB
SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
MD5 0f4634d4af8b73f882440c1181697d86
SHA1 748bb9a14c8a6c64fa060ddcb1b4baebfb3f6fd3
SHA512 eeff081cb256a44ff4557dae145c3d277ad936fef58674cb7d2949b6c302c3a746f05495daa6ccabf39c26bacf13c6fee3bab20de4f1d13810be0503787c89d5
SSDEEP 192:cyxPpQcKb2d4U1nE92Ui6OPl20b3G0qE7I2ByobYGeBv+x9qkgYbeO:zzFZr6OddG0q/yTh3UYx
TLSH
T1AC32C887B30483755A90E790F6C76DA5A93ED0EE73A4168A3CEE421812581DEB3E7CC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
Size 13KB
SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
MD5 dd59d31e84434c59c5c3735bd0b0dc3b
SHA1 c34473850d3749aae725856f68a262a0afebee00
SHA512 f3acd51920f945b49dceb56fd2a5a4ff170c4a5770665bef3d888f8497a288dc33bd15f24780cbe9b8ced585fbacb92a8700d1322a6d4acd2b6e5893370822ac
SSDEEP 192:GwSuCUHXDhEblYfhQ9GYSOqUr9b1AARAU0qWo3wYXVMojXiyaH:dCaXDhEK55YmUrLAgkqWo3RVhpQ
TLSH
T140523295F3C50E22B4991749BA03D57BF19558FAFC2CC18D5CF2D236136C9C986928C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
Size 14KB
SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
MD5 5cee0947c1ef6f00e18eb17cf77388af
SHA1 5a27bc625acfb46d2368a9a376d797ecab912a3a
SHA512 1bf91f08d2a2a446ef0e22df40fd09b090fa300f599bacdd5c698aa61a6fef12ad3d3e38299804a016e5a22a82ddfeb6840cdc7a79ea51244942cb22e659331e
SSDEEP 384:HTO1ksU66rAJGO+NedvSGdv+GfBgLj95LKn:zO1ksU66rAJG5NedKGdv+GfyLj2n
TLSH
T11D6230ACC3CD5C69C86183FA090B35C27836ED49FEA5AE7280EDF4202DA19DFD815674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apm-init.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
Size 57B
SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
MD5 b684f2b8022aaa97ede28f9d224c4db5
SHA1 2087206ddbfd6d6d71f843a132b58ed533d87169
SHA512 8d30da66bfdd99dab88c4b9766b692c39ecbc8dd725e9f858c95993d4f2bf46c37891a1f8f4f1eb6fe09bed7008b8df48d2a9b4f10d7caf20f823f121f6ebb40
TLSH
T19F9002E7F0A1707344616959630722AA35D11130017430010900487434A580FCD22F88
MD5 SHA1 SHA512 TLSH

Submit Download

default_ava.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
Size 906B
SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
MD5 c47a5cfed147c402538358294808e68a
SHA1 8aa499336bc4a50a70710735b67fc5da923fc61a
SHA512 a71831abb9393b6c0ad62feb29fefbb192e1706b08ab88dec0a8e6a9cf61b6a7e106454a7e6e518f69425cc91846036e8fe2956ea939625678f17b330860ba1b
TLSH
T15311E309934DC285960AD7B8563C1754347272DF9E1FD55CE7E633012D3C6AF185C27A
MD5 SHA1 SHA512 TLSH

Submit Download

desk-sync.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
Size 1KB
SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
MD5 c17417f321f52624ee0dc60ed76a31b6
SHA1 b64e19a5b03c92a931fa9a1eba899f491e669a1e
SHA512 bf160829598cf0b22ea48a5f7310adfbd26fbc1bbf23ea3cb8d9cebbeb92b5e81b914bd6021cd41df5984ef00698acb1c1151e134c714e0a1be7dcd439c78485
TLSH
T16D21F0ED57EE35C8644CD37028DA6079627B35F43969EF048914A9D1FE4205D499F9C0
MD5 SHA1 SHA512 TLSH

Submit Download

loading.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
Size 1KB
SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
MD5 0620393a949b58f6af37b0accb79e32c
SHA1 0025e4da5ffb8695a8f9731a05b1b89f1a71bf24
SHA512 0d308c758f825d548874cf8b4b8ec20f3685b39c7232246697dd95e5e5f40da7cd21de7ba5faafd0d8a121b5e6b85c5aadc4232e3f0c943535e062ae449ef29e
TLSH
T1333142D111BD0116E11AC365D7FD7AC70B3EB4DB26E558BCB68C250FAB404DB0A9B219
MD5 SHA1 SHA512 TLSH

Submit Download

setup.cfg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\cfgs\setup.cfg
Size 449B
SHA256 43da7b18b9685f34614e3e6cb71a6feda052247eae7372e59e1f84011528d020
MD5 8c15c1fe6e9b92a00d8bf6ea26a0b40f
SHA1 943cb383daa545f2389463e67ef446d75efbb5e9
SHA512 1e65bb741d94af3ec194e2fbbd54c5df08cae51fc74e0e0bc011108551a7ff6886ea58d8e1c87b603e71e4e914625244236e11ba1f9c9971a04a0980914562db
TLSH
T1C8F0556A030370741E22431410BA14F2E3FB02C81017800D25A8A88D7BBD83E86BF13A
MD5 SHA1 SHA512 TLSH

Submit Download

kbase.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\kbase.dll
Size 1.2MB
SHA256 c108afe8b807c775a5f1ed5f7f320e84b2859a08e13738a691d71f61f5e18329
MD5 9220d94f1dcaf20ef69e02ce50102839
SHA1 ce7ce6b500836c42b99943e73688a65de669f29d
SHA512 7921b5d860e2edd8f6ec36550e3219d973fc6945aefe2f2e5a60c0ef519c53d541a5651c9d8d740b274cb279be3a39862120826c291042879732b14eb21bce34
SSDEEP 24576:0LhFMBWZyW1HgJPTrBM7bxevE/D19mgUFTpZFpiulddhy0O:EfmJIirBAevE/55UFTpZFxy0O
TLSH
T1E7455C5B71A800E9D5BAD1B88E6B9916D7B170860320DBCF26D0975B2F63FE16E7D300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdesign.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\kdesign.dll
Size 1.3MB
SHA256 03eca843378c4b659466d13649b8bac31881e3270553a7512512a356f76bb38f
MD5 7be2fc269fa43e2dee60c10845a5cff3
SHA1 f063db1bbf61bde7fde672b0cf11a18636aefe2e
SHA512 a65e3b70f11510fd192135b95990d84d78df7ce5fe7810ccc1eebc3dc9a795adb6dacbd440a49a22134232dac87f5333d0ad126b13f6397d42410401f88f95fa
SSDEEP 12288:s5jo64Bp16JMYNujALy47BZgmEdzBghvQWLudqUKdQdvSQrvj03RnJ7GceXa9RrS:s5t4Bp16JMYN04d6xkhtgqoRP4Mp
TLSH
T1F1554C4BEB5683AAC1E9C235C5CB4516E1F2B842C2A38317759EEF2D3F63362585D381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krt.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\krt.dll
Size 1.4MB
SHA256 ea881164cc61e32f006db9511d29181e2cf9fa8bfb95d9f03fe459010127db4e
MD5 f1e7e3d2d8c2ccf0c531a43bc7e79450
SHA1 747e5a3d3b4946e929a0df38b846622f58ac035a
SHA512 70af0dc62f08eb08d21915699073e42b4ac492286e14049d2985d513a2b1b51f7fd1038244c898fb2d9f3de9650050bba35cde3f64b45c0995a75ec86adb3b71
SSDEEP 24576:EvP2/IFF2VM7v9ZKDI1dFUdftIcsM770VYIlVTcD938jfg3RNb:EvP2/IOVg9Zg8HstIcsMMHlVo98jfg33
TLSH
T107657D1BEA6943B8E17BD13CC9874902E6F1384143619BEB16A59F291F337E24B7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksolite.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksolite.dll
Size 12.3MB
SHA256 3d32fa5e40629df5b24d909e93a173eff9b352124fe903823eaec4eba486ffaf
MD5 36685977884f6002f0f068cdf121e987
SHA1 ec98305e64e1c4234a58fa021caddb21e4387a6e
SHA512 6c8931ba89c11aac79f85a7c24cc8e68625edf19b913bd283f11033eb7dfbd653474bcb0af387c5e2540304eb10545384a62c99a892580b3f0cfb17fde6cd86c
SSDEEP 98304:flte00ZG7SAy0lx455v2+/A1StO7XRlV5sL3EoScVes:flI0QG+H+455O+/mt7XRfuL0fcVes
TLSH
T1CBD68D5FB7A943E9D066C278CA9B4D02E571744687219BEB25298F3A1F333F1097EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksomisc.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\ksomisc.exe
Size 3.7MB
SHA256 95f40227bcc81d32eac522a51e9a043bb6ce5be3f2d4d1b7517e87051a9d6af3
MD5 822a0838c689d60a63c68134104ca315
SHA1 2e8d501ccc55c1a02cfdc0ccd6b100661daa5e03
SHA512 f18e3257cbf77fa5f58367882ac114c9a33f474df13aa10b05552b735ded815a690d4497591c5c152df11b0a95dc5252549125a71c0aa7d37fd8ad5ae69ed90a
SSDEEP 49152:Q/OSFZr7GE7sR4SkQvSMmCRwf+fN2agCI6rGHhHApP1pPFj5IWd0GkgNp+eruz42:QfIR4SfaPWArFgTfgn
TLSH
T11C067D6B62E903E8D17BD27CCA965903F2B6380587315AEB11548E790F337F29E79B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-kso-1_1-x64.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\libcrypto-kso-1_1-x64.dll
Size 3.4MB
SHA256 43cb26b87970d3a357e1bd2e67fe3fbca4222265a59813e65b7c05414e2830c7
MD5 64832c182c247d11aad00b0df58a9c2d
SHA1 6638c6802ffaf91a7e248f6f2fc39d61817eb7f5
SHA512 e849fc36ce63a9083b5776823b8cbff16c0521d57219f40ceb9a85857ba13e738e37123e113793a9473c4acd9a804a2f515dff60e52b4d05dec6b7a81f38373c
SSDEEP 49152:NOVwASOXFIU6idBGtlqXWq7TsRQuXk0AkOGYYNEhvla9+LEcJQNPn/Esqomj1CPU:wC+Zsu0h9gEx1/Eso1CPwDv3uFHUX
TLSH
T12AF58D5AA7A80184E5BAC13CC55B4737E3F2B95A17B09BCF18A1C1780F23BD66A3D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

error-net-72.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
Size 1KB
SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
MD5 66726a0fbd424ccb700cecb212a47007
SHA1 9795ae26acf0b942ab6a0cd06f206ba69eda18db
SHA512 30ddd2fa17517792a86bdb03827a0809ed362ab2dbd9a7baf194d1f47348c96e0ca8e64515c1a58d7a1740e85f53a3676b49ff6c699d598a27c234c14672604f
TLSH
T1E031C6CD318AC42FCC61D531F4D534156817D760BF928C74102BC5576E0F68E58C6662
MD5 SHA1 SHA512 TLSH

Submit Download

presetLayout_16.pptx

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
Size 41KB
SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
MD5 f41e909b0284949bdd3bea9393a6ff2f
SHA1 a41497f65f44368ad517f464eb0da4403aa700c0
SHA512 d800b9b807a72d19f17bf5bb923d2489328b2f8801c2146b0c67d3d4cd8c70d5f22decd6581ad14d5584f3895140180c8578ede4fa8df755ca742c18cbb3b67b
SSDEEP 768:lwQ75cI1zETv/7H0vFtZKSZTRomseFVEFqG5IphchDB8h/rW7oELmG1wvcG7GyGK:9qNTn81Romse8Fl5ahcVChjQmG1/sl+Q
TLSH
T114139F61D40A142FC263B3F6E478164F73FEE86248179797ACD51096282F97C2E9D38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpscloudsvr.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\wpscloudsvr.exe
Size 1.1MB
SHA256 303b3f824c28653f8e7f322540472bfd10f8a3af3fa1792ed6475cc082c2b2fb
MD5 3559f2d8c390e0d1851862a849792d1f
SHA1 d51423ba76d2168caa36c1e9451c4e56b70f081c
SHA512 5a7653f9da2adcb3deb46d1433535595eb37725df120780d1af6d3879ed3aedea09f9adc1c84036cea2861fb69244fd5f6bf96a3442c32e13a0e2b5519ed2b8d
SSDEEP 24576:bdDUdZ8lCjjgeXQ11CTm5IXMwWEgCvH79FhPC2sBZCi7RglV:btXWHG1v5IXnF9FFBQZCsRE
TLSH
T103355A4663B902FDE0BBE1798D525902E2B63C0607B05BCF079066771F67AE59E3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpsoffice.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\wpsoffice.exe
Size 1.2MB
SHA256 030c58463fe01c7824f9964b9ad6ed9cd5e959e7eb95042da8a3acdb9f738514
MD5 9fee087c4ac3784196538a98ce6d8319
SHA1 067990cf0b496e56d753fe3b5a8fd0f1e3de3641
SHA512 1c1e4cb3578fc90c5e713fbe22547fb060cb1910a561c7a19b341e08081367ee1dccec75908c138ff11898622c6782c0819ffd63cb88269d3fe43432e3361b1e
SSDEEP 24576:yXkuBR1Ox1OY603Vg4/EESMvOW9IIvDcXnHBhjHBK:yzj1Ox1h68joMmW9IIvkHB9s
TLSH
T1654519366EAB02ECD36BD27875925901EEB53C4AC7245ACB02D035763E77BE58E39310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\utility\install.ini
Size 462B
SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
MD5 71e0a7ecd6bd2e91c04a3edf760c45d7
SHA1 e6cf872ce6def16bca98818ba289395580701292
SHA512 282b4c8be6abb97383d7dda8258fbf069fd668f4fad722582567cbc916b5c7da9a39a157a35511210306c19e46ef34c02af17f2af1ec7707bb3d84f3d529c3ca
TLSH
T178F097090C98C66E36282188B0D3C2C0A9ABCE260D0CE410E2D36E1BFC02E0A217E02D
MD5 SHA1 SHA512 TLSH

Submit Download

Qt5CoreKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\CONTROL\office6\Qt5CoreKso.dll
Size 5.7MB
SHA256 594f50c668648035620f9e180e4419f0d5309097a69bf85d6a21cee14d1523f6
MD5 4c9f67ecacbdb972e7feb27afbc810fb
SHA1 2c755665772c76deea21365938450464c23c588c
SHA512 faaa08ef6d6df0463f05dd01277d7f4c8c83a1b83c35354bef6a8b0033fcc3dd7553547219b86be205ccdc40df24df591529bceca66ec4c8bd645421c46c2b93
SSDEEP 98304:ekcp4wh3njl0wPXJsv6tWKFdu9CUWigl4rHIscar:ekm4whzl0CJsv6tWKFdu9CUWIoscar
TLSH
T114567C47FA960269D8B6C238C9D7C117F673B80247214BDF2298A3496A777F0293F359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5GuiKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\CONTROL\office6\Qt5GuiKso.dll
Size 6.4MB
SHA256 8be6e669754d5455e76417710a52dff1a56702b408ab0d1137774fa96c92fdf6
MD5 9e1f7f93f937031e5297c90c7075d3fa
SHA1 97656ecf71e2724b6791a92a9d537d35a731e3cd
SHA512 4e83d0aeefbf1d13db7e1398c266ea1cfa6224640f5a658bc80575d07fbedb058e04c80a385b4d95917c5a1ac92bf614d973114d2613cb9708faadae79cf7ba3
SSDEEP 49152:+0TIj9QFYeZhXgDIZil6pwbCOn33vV93VxX6Fo5uldoFf7oO+PzzzjVKLSJDTNRG:1TIjqzbc3am3+7z1K2RIvLCNi54N18
TLSH
T19566F886EA456359C972D17987CB042FE1F37C4283524BC76C45AB490E237EA1B7FE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5SvgKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\CONTROL\office6\Qt5SvgKso.dll
Size 503KB
SHA256 e7e63cdeb522b8e72607c3a365eba4e7f1538955ef1c9ca9df799ca178c9677b
MD5 f3fef98acf450e3c5ff2b44cafe8144c
SHA1 4dcc3afa44a9c437185ec9c3c7273d088c230beb
SHA512 ce2e6fd13cc406effecbdb518ccd1c38e55e526b688dbf0bbb34b9cd29f70e7c35e9103179848e6031255500f31a01ff54fe889dac116f381ca2806c6a8dc253
SSDEEP 12288:NYYYJUNY675fyplktpsPQVLEgZ/ABXH9a/vngheZL/XEnEsrnJpaymesGrx10rka:NYYY475feysfE
TLSH
T121B44993FB520798D526D27CC8978806F273340443A39BDF2A5AEB651F236E1763E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WidgetsKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\CONTROL\office6\Qt5WidgetsKso.dll
Size 5.6MB
SHA256 423c0c95b6c4e005798aa6151d7f4b43a4f4c9694f0e926d0b0cc34106ba7ba1
MD5 19b86ef8be86dfd4bfbf87bb226a7826
SHA1 d65a0eb74c3e750020d1181cc0a53b72b83e70af
SHA512 5fa6b120b42488198d497a3b5da093a9ecd130e7078fb0b30b7909a7107c73825bfc00920dbcf5e557112491b92ce879b00901c7ddea9611bb0382f573248ed4
SSDEEP 49152:b96ypjI6A3p4lPvwtjPZFQ1+KXJjYxok/reBsgGCJ6eJ0Jd0ba8R9RtWDiRl9TId:DXcLAhRl9TIXdkroNiBTJ7XC
TLSH
T157466B43FBA50389C56BD23CCACB8513E2B2780447234BCB6959DB691F637E2197E790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WinExtrasKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\CONTROL\office6\Qt5WinExtrasKso.dll
Size 251KB
SHA256 86cb3e80b1a162c0e11c23e5501ef023de6894ec1056a5aea137470024c157a5
MD5 5c467ef99bbdcaa30e2910aee511ec90
SHA1 3b460734f120090115a81f9430f3cf972a8c5113
SHA512 db70ad44ebd21680a16098a681a15f82bf13b07215940320c02414e331ab18e767dab07cae730c2a7a8ad539584d6ff861611d7705cfd02914c6700ebfac2121
SSDEEP 3072:cF5o5cKUM7YLBwcJf1+6Ws2LB+xvN805sR:cfpMqxvN81
TLSH
T191449684B6DD9619F809B0B88FCCD199C223BAED8B47425F351ED39F4B619816E139F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kpacketui.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\CONTROL\office6\kpacketui.dll
Size 829KB
SHA256 856122dae51a56a793e0a3c82492998f07e32ad57a98b64eb9e368c5826d19a1
MD5 c76665e46eed60428cea6b6147de0b21
SHA1 6932cd2232dab53dfe0f72e93734b4a6fd86e8f8
SHA512 6f26d5ce204628ee354e44424293270c219b069a5d50e01d115eddd324828824c62405732d0f67ed7c12d1621b513f3df66116d1538ece007fe2a6b633ab1ad9
SSDEEP 12288:yvFtoWXnnjy0lmkr1DN3Z7JfVGnYxoukUJowWqYYSj3:yvFt3nnGi5D9NGYxfEbz
TLSH
T1CF058C1FE7A903B9E03EC17AC5978813E272744503A6ABEB5944EE652F773E5093E340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\CONTROL\office6\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
Size 75KB
SHA256 762ed66bb00b4265179bb880b1fe9257f2c70f8aaa4f40ddaa7b5203b48e7e95
MD5 1c5eba9682c2c2e69661b7cc8c62709d
SHA1 bb211c35a8b339c2f4d28cb737a07b28e29b6b50
SHA512 0cf18d94f7dacd68afddca1fa31de59bbcfaa6afbbb2f74dd10b31b55f619c6d897ded9119d35cec23997a84f1185063b1cd16530793ceabfa3bdc7d58110240
SSDEEP 768:IXOzQ/DBnTQxkUtwZfVKFkYQJc1lqTwj6NBvfeZSac6mWWr9YiDLk5C7auy7Yi7w:Ljf8Jdwj6NBCSac0+97b2j777NW
TLSH
T117737CA3DB44169DE51B8634CAD58A1BE6B27842076293CF6728E3680F733D2397D3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
Size 46KB
SHA256 affe52c29ffb15dbc71fcbe4404d0f87211dad147c4387961879a1d7edcc72f9
MD5 7328166c3e14c50d476a69509ed90faf
SHA1 bfd19cde8a117aa69a117747ef6ea50d473c14fd
SHA512 cd23e28f80996b2047b1217bd4c5fb6b9526e448f5d99757fa94757d32cde6e1c540ff0b448f6d28f49e9340398730470fd75ab03823d1ac3d723c53ccf75297
SSDEEP 768:R/6pbQ2EGQ9VPbHZwUK5YiDLk5C7oYi77rh5ALG3:eQ2TqbHZwUK57bs773t3
TLSH
T167237BA7CF540C09E9279B70B4C98A26F972B8515B92C3CF2294D2690F963C23DBD3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qskia.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\CONTROL\office6\qt\plugins\platforms\qskia.dll
Size 1.9MB
SHA256 b2d433e26b427b1969bec756734592c509327b3bd681e00bb284e89ba5997d13
MD5 c2562793bb2c8214bd59e98c4afb221e
SHA1 e06b8360527a4eb5c9b2effc7731c26518e44ce8
SHA512 1eccc45f6e4c248251293f60a2e4f023473787391f3b6b19f1a91034f50cab00bc0c446ada71888a38d2784b5f8f6dbe9aea255f0ed344e050438fc7bf37dd0e
SSDEEP 49152:/Gscv0F9WxN+G7hwbbAlsUlc/Hq/zBUok82a66kTcKawv:/F9WRhwv
TLSH
T1EA957D43E3B44299C2A7C13D868B8F0BE6B1740543629BDB2650CF59EF237E21A7E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\CONTROL\office6\qt\plugins\platforms\qwindows.dll
Size 1.6MB
SHA256 90a8bc6abbb6709372a924c852bcf73268fc98b07126eab14763859271e89d46
MD5 1b3e863b6da468450f5a3064012de1cc
SHA1 c1b83819e7da9d1bf09dd25c95078980498cbdbe
SHA512 e9ae543d9c8e6c4d7fc753a3353c973b57e6bb4bef472c628523dda33e6cec218848212d56ea21ae483c1a5755bffa81a53de46c1530af8d15e40a18d0401613
SSDEEP 24576:FA9T04p4/1M+XCrbBB376YStwHxDCWYkbJ3KbZ+OiKO2:8T0IKcbBxlowHx+eJCiN2
TLSH
T1E2757C43E3A44398C167C239C68B9A1BE77178050361ABDB25A08F59FF63BE3177A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
Size 159KB
SHA256 c2ca509b65c67bda29de9738ee2fb40ab14d465dd9848871a291739fd4eb7407
MD5 04c9c8d51b78875061fc4ed3e56b047a
SHA1 50797d3e04d0e00600b688ccacf4442bbf08843c
SHA512 4c962db9f119f64c856bad63880cb3e80ed5129849727a8b69ed6bc5f8debc003101542c6b9d3ca650d3a75c5eeb8540e783f8273b7808cd4231ccd7f5ee1804
SSDEEP 3072:GSApjXbrT36b96bavsTHnbNgJUtybgP6vsHVcI2ojOWa:yX6b96bavqHnbNpn6vsHVcb
TLSH
T159F33913F65143D9C527D2B8C19A0512F3B37444436257AF29A6DBB82F533A2BD3EAC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\CONTROL\office6\ucrtbase.dll
Size 987KB
SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
MD5 61eb0ad4c285b60732353a0cb5c9b2ab
SHA1 21a1bea01f6ca7e9828a522c696853706d0a457b
SHA512 44cd871f48b5193abb3b9664dbea8cdad19e72c47b6967c685cf1cc803bc9abb48a8a93009c972ef4936e7f78e3c92110828790aa0a9d26b80e6a523bbcd830d
SSDEEP 24576:xOPJ1g7mT6BNvwTOxNfoYotrz1111111r8SoKxmxvSZX0ypdNLh:xO1aNoaxNfo/+a
TLSH
T18D259E64F75C0AA6C17BE17CC95B550ED972340647608ACF03EA8BB97E2BBE91637310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\CONTROL\office6\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\CONTROL\office6\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\CONTROL\pl_PL\style.xml
Size 3KB
SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
MD5 034f37e6536c1430d55f64168b7e9f05
SHA1 dd08c0ef0d086dfbe59797990a74dab14fc850e2
SHA512 0e1911c882152a4e1059a3ce1880d7fb2aed1e1e36cbd37055de2e2a1333acb2a0233ba2a4d969ccebbef1e77809aa5e78807aa9239545beae8c548c0f8f35c0
TLSH
T1E381CA80A610BD0AC563F51573AB7509762CB36383ECCFC4F0EE2E698753652644B63E
MD5 SHA1 SHA512 TLSH

Submit Download

product.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\CONTROL\product.dat
Size 80KB
SHA256 dfafb839b12ed1150bce08960e25601fd322667c6f784ac901c5e0b4666098d8
MD5 ecdfe28d5282840199df0d192cb1bf67
SHA1 38ff2fdc99aa3a76eef2253878261f0cebf05f08
SHA512 10b2161fdfa407e0c0c9b00ba34b43c5bb8639404b4f1cfd6ef97902a44e8edf5fcd4f2e20b64d5ccd6dedecb6564a4e99a7987da726d710017cade8faacdf32
SSDEEP 1536:1yKKOpT+q2ZAJBgBrAvSVxel50kydpgnoNQ:1yGT+jZqBg5AKV00kydmnou
TLSH
T1E6837EFB7E0E2EE568CF232B5D7B282CAAF54D15349B548862C3E558EC1C0B63CD6548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product_new.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\CONTROL\product_new.dat
Size 79KB
SHA256 08c0a368ca8956d7e20bdb83288cb72542c9cbf3cb5446f371a7667d119c24f2
MD5 cd7c6055b61f512ceae7f3cde761e3ee
SHA1 05946131d0fcedf8267a5634efaace1749edd785
SHA512 b33373ad7d68150568e8a86eb773149ae28d31e7059c382e45804df6f9ffe045408395aea1635a6591c06fd256e3d862db9d1d41490ad18e8300a21dcdae30e1
SSDEEP 1536:83CcyHh6mkieSiLIBI1e2pFgEkKH6fh3/tI2QcsB5zJzEy7c:qGHQ+rvOK5BhljsB0D
TLSH
T188832C09ECD16EAD685052791D376D8227B7DD91A0DD30AC4B12AA4CFC3CF887B72A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a7a23\CONTROL\vi_VN\style.xml
Size 4KB
SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
MD5 394488b30107bcebb84a97ed5d754cee
SHA1 69ebe17f7d577e9bf69c87cff45c3251f0bbc86e
SHA512 24a6bc7debbf7030c1261c69cb4ae7bf3cbb5c7fac315188163c6001e58dfbe2e634925cb767044da7ea0e6d08c709b2ade02f6e43930819e1bef6f7569cad5a
SSDEEP 96:gd6SmSZcFe9gSs8TcySCSi58VS5eQJ/gQkgQ0/Mw8CclQgYzdr/PwiCSeDeR3ciw:gdAh8Ax
TLSH
T13FA17780A610BD0AC563A51977AB7909B62C736383ECCFC4F0EE3E658753692644B63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 387B
SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
MD5 c38481658f9149eba0b9b8fcbcb16708
SHA1 f16a40af74c0a04a331f7833251e3958d033d4da
SHA512 8f98d62f88442b8ef94aa10074e35aa8d9494f3c76ce8b143ca0bf7fa0d917f3175212fbcd6e7b0597fd0ec0e1b2827f157135512fb01c88218d36e2f7dd73ce
TLSH
T1D4E09B1BA8D1B0ABDEB302E988979D54BAC03D9A066D23147762540D3D32918FB41D65
MD5 SHA1 SHA512 TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 433B
SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
MD5 a9519168ca6299588edf9bd39c10828a
SHA1 9f0635e39d50d15af39f5e2c52ad240a428b5636
SHA512 0607eb1f5598320961fbd8ef75beeb1b6dc1af3cae7eeb5ba352f3e2a2edb25e1d9e68fb46c24e4299957352c0c906314c889c2d1092437eccc1d1a0485f3557
TLSH
T194E0540FA891B0679D7302F488E39C007AC03E96055D1210773144093C32A14FB81D69
MD5 SHA1 SHA512 TLSH

Submit Download

ksomisc_2026_07_29.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_07_29.log
Size 3KB
SHA256 248422c16da60ea06cb8bb501212e21e68b17ab3a11a0edf2626c4c9ec5ff8c1
MD5 8caaa82cc11627ea85293e54e13350fa
SHA1 092d665c0ac6ac8666a8fb781bfd6d7e5fe3a200
SHA512 b9eb310dcb036332fba8672aa08b4045f99386de4d021e191f9c202687ba469e1182e1509e89f9582da545e7547aee64c31d54a07454bedf4c57a653d1c07b38
TLSH
T1AD718E59B6F54510F3F78F56A8EA14738E7ABC82AC30CC0A0991234D48A6ED1ED7073B
MD5 SHA1 SHA512 TLSH

Submit Download

ksomisc_2026_07_29.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_07_29.log
Size 5KB
SHA256 00f60ddc305649329ae48121507dc6e22b518eb435c8a765c9955a33fa551e27
MD5 8237b2f41e00f941eed59b2b676d1940
SHA1 1bbf48eb32a6c72ac3944e48c87830f32cf46026
SHA512 ec33846ab2037a8999bafd536bf0b79bde84fee1674dc750c3c07babd07a64695b3f25ff22cd4ccf66ad0c7ba914a1a2763269856786616583e349598292edd6
SSDEEP 96:Tz6qYoKWLiW8MkHiWLi+HLkH6WBWLi+HOkHiWLi+H1MkHVNgWLi+HELrcXWLiWBd:vRYrWmCWhQaWBWhjCWh/ngWhkfMWkW/v
TLSH
T194C15E6976F94510F7B78F56A8E614734E7ABCD2AC30CC0A0981274948AAED1ED7073B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 10KB
SHA256 277b30e6d76eccd274a0c0077cc0604ee518d069221af0da196d1648380f1f25
MD5 78e97db138e75e34492d9702a3b3f1df
SHA1 cfbd1ec47df89d3f7ad6b5a3f93c921df0628c8f
SHA512 2c9100831eef1937cc7bacf5305af035b978f318c54dd33e901f48406973670b8ba4788544aa2c9318066ef64d12e346044420bb0d46952dd2b9f8c4dea6240d
SSDEEP 96:B1HteMAD/tjnHiUKB41SEafqtOEIun0KcZUYQJMMtlKZsS8vT+8V/VkA6uQfg:Bf7Bpq0Igyw3g
TLSH
T18C22B157C4BE0A1C167B0A6913635E4D3A8A2DEC634961C43F33EF8B8FDE061459F6A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 11KB
SHA256 3c36c0da07a308285a4d8561d34442a5c95964647222a23fd0a8e78c5f41667c
MD5 8e190809acdc11207754af2eed274c51
SHA1 d99c07ad22c4b2ec274bf2194d6e256445f9b1b6
SHA512 029914b5729794c6a2f3ab61ddb937ec7bfffa76bdac8805ed5131abccc032024c15b7d5a59b047db83a4f88075dc66681b2485d6bd6bafdd2ceb360fdb876e3
SSDEEP 96:B1HteMAD/tjnHiUKB41SEafqtOEIun0KcZUYQJMMtlKZsS8vT+8V/VkA6uQfVyQD:Bf7Bpq0Igyw3VJpybsb
TLSH
T1B032B457C4BE0A1C127B0A6913675E4D3A8A2DFC634961C83F33EF878FDE061459E6A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 27KB
SHA256 667f8f2757a9e70174f0b25fc3e0b4ac6144ebde28027f5c0075a7e60fdd56b8
MD5 b86514e67bfc7baa78855ebbe9ce46d3
SHA1 3b0b19804fdc373f947504ce088a619e30773dfd
SHA512 96a3e4738ae1948d83c35fe7a614873d961ad5df2a5340cc3dd462dc2d10f326cbd5f9ceaed5ef6aaba9e015ced2a2ba93061169ccb4f4804c8bb7b9524f7d75
SSDEEP 384:CgywFObsVbUewdRsRE7V6jYwppSsn8jD/JCPgJQ9FkNssVHXgAaoxhMMkN5p9exh:CgywFxPa
TLSH
T1BCD2AD5A946D851993BF5BC003764E8D308B0EBE270C71693F77EA938BDD910C6ECA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 60KB
SHA256 51092a43778c37ea7754407f43aadb601616a1746ef49c4448eeeeb1965f4b56
MD5 d7753cf4e3c5db2523abaa04af32c786
SHA1 d094645bfd408c000b289cebd91b177a8763163d
SHA512 6f482305f69bd56fedf9ddcc70090ff03c0df430466a98fa385885374cf2886402eb37d70005f1164be4ba9cd756d9f2ac2917a64adfb8bae2ce54c3bd054d5c
SSDEEP 384:CgywFObsVbUewdRsRE7V6jYwppSsn8jD/JCPgJQ9FkNssVHXgAaoxhMMkN5p9exQ:CgywFxPrBeVV5dkj
TLSH
T14753C19A8C7D8929627B87C003278F4D704B5D7D710C29283FBBB6579FD89018DDDAA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 61KB
SHA256 e9104e64b076acb4a94dccd83bf6bc186bb85605668ad756ab70956114e1f332
MD5 2c1a83a9c4683d7e766c76c08f0c370a
SHA1 2383dd53643b9a7cf2e02c1e2ffff894d4bec29f
SHA512 fc4c0e7c0e53583110aab49909962c43d419a001277f3b0755c7ecdaad85629d3a5c362aa1ea43a5defa7a977cdf8b3820376ccdca364b67f90b25fc1c83f79d
SSDEEP 384:CgywFObsVbUewdRsRE7V6jYwppSsn8jD/JCPgJQ9FkNssVHXgAaoxhMMkN5p9exx:CgywFxPrBeVV5dkI
TLSH
T17A53B09A8C7D8929627B87C003278F4D704B5D7D610C29283FBBB6579FD89018DDDEA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 67KB
SHA256 264702e2048fc6b00148f2c6be5c52ca73a691106699cc88d82de904de491bc7
MD5 0ff08f5056b154b1ceba432d60bb5549
SHA1 a2c2c7107d46ac83530cf98bcb04bb0e3caf4e95
SHA512 c8b67fbef684b5016db08ced6a4190e09e95ae9eeb1a714928d65e7d00936c389b968476a682e2a06a2b4bffa3bccbc3d0aa2a6d8b78cbded29220e27b17d241
SSDEEP 384:CgywFObsVbUewdRsRE7V6jYwppSsn8jD/JCPgJQ9FkNssVHXgAaoxhMMkN5p9ext:CgywFxPrBeVV5dkXfJI
TLSH
T1A963D05A8C7D8929627B87C003378F4D714B1D7D610C29283FBBA6579FD89018DEDEA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcsdk_dpv3.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
Size 42KB
SHA256 73108ea2158963882524b677e22943f61db11d876517157d5ce4bde5ed63d4c4
MD5 59f24a3730ea451e51a1a6f82ecdaddf
SHA1 b811734229fe2f977008a65095a23333a605f4af
SHA512 3282c61b3c4a9d52d34730d7af7fa728743e0b5ea445a2e2e61245f056590c1faf0d5882d5c92744c0a63346bfbd71672d9ef1f7da9e3d62679602a3fffb63bf
SSDEEP 768:6Swwa8RbbFZhDq9SYBaMdCMwWE0ETEO5p6Db+qPsqAN:or4bbDhDq9SYBVEFFYK
TLSH
T17E130196B7F91558F6F72F6569B968944C3A7DD22C09E4EC01602C8E0932F90EDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1232-9138-0x00007FFF1F5F0000-0x00007FFF21391000-memory.dmp

Download

memory/1232-9122-0x00007FFF2B0D0000-0x00007FFF2B215000-memory.dmp

Download

memory/1232-9121-0x00007FFF230A0000-0x00007FFF23CF8000-memory.dmp

Download

memory/1232-9123-0x00007FFF227A0000-0x00007FFF22D2E000-memory.dmp

Download

memory/1232-9120-0x00007FF6309F0000-0x00007FF630DA9000-memory.dmp

Download

memory/1280-8951-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/1280-8944-0x00007FFF21B70000-0x00007FFF220FE000-memory.dmp

Download

memory/1280-8955-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/1280-8954-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/1280-8958-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/1280-8953-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/1280-8952-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/1280-8946-0x00007FF6309F0000-0x00007FF630DA9000-memory.dmp

Download

memory/1280-8950-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/1280-8949-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/1280-8947-0x00007FFF230A0000-0x00007FFF23CF8000-memory.dmp

Download

memory/1280-8945-0x00007FFF3F410000-0x00007FFF3F555000-memory.dmp

Download

memory/1280-8948-0x00007FFF074C0000-0x00007FFF074D0000-memory.dmp

Download

memory/1280-8957-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/1280-8956-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/1704-8974-0x00007FFF2B0D0000-0x00007FFF2B215000-memory.dmp

Download

memory/1704-8991-0x00007FFF1F5F0000-0x00007FFF21391000-memory.dmp

Download

memory/1704-8973-0x00007FFF230A0000-0x00007FFF23CF8000-memory.dmp

Download

memory/1704-8976-0x00007FF6309F0000-0x00007FF630DA9000-memory.dmp

Download

memory/1704-8975-0x00007FFF227A0000-0x00007FFF22D2E000-memory.dmp

Download

memory/1756-9199-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/1756-9200-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/1756-9201-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/3320-488-0x000001BBA00B0000-0x000001BBA063E000-memory.dmp

Download

memory/3320-930-0x000001BBA00B0000-0x000001BBA063E000-memory.dmp

Download

memory/5008-9076-0x00007FFF1E1C0000-0x00007FFF1EC27000-memory.dmp

Download

memory/5008-9031-0x00007FFF227A0000-0x00007FFF22D2E000-memory.dmp

Download

memory/5008-9075-0x00007FFF17C50000-0x00007FFF1971D000-memory.dmp

Download

memory/5008-9049-0x00007FFF1F5F0000-0x00007FFF21391000-memory.dmp

Download

memory/5008-9028-0x00007FF6309F0000-0x00007FF630DA9000-memory.dmp

Download

memory/5008-9030-0x00007FFF2B0D0000-0x00007FFF2B215000-memory.dmp

Download

memory/5008-9029-0x00007FFF230A0000-0x00007FFF23CF8000-memory.dmp

Download

memory/5356-9007-0x00007FFF227A0000-0x00007FFF22D2E000-memory.dmp

Download

memory/5356-9077-0x00007FFF17C50000-0x00007FFF1971D000-memory.dmp

Download

memory/5356-9006-0x00007FFF2B0D0000-0x00007FFF2B215000-memory.dmp

Download

memory/5356-9004-0x00007FF6309F0000-0x00007FF630DA9000-memory.dmp

Download

memory/5356-9017-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/5356-9005-0x00007FFF230A0000-0x00007FFF23CF8000-memory.dmp

Download

memory/5356-9018-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/5356-9078-0x00007FFF1E1C0000-0x00007FFF1EC27000-memory.dmp

Download

memory/5356-9009-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/5356-9032-0x00007FFF1F5F0000-0x00007FFF21391000-memory.dmp

Download

memory/5356-9010-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/5356-9011-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/5356-9012-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/5356-9013-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/5356-9014-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/5356-9015-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/5356-9016-0x00007FFF05320000-0x00007FFF05330000-memory.dmp

Download

memory/5436-9079-0x00007FFF1F5F0000-0x00007FFF21391000-memory.dmp

Download

memory/5436-9060-0x00007FFF227A0000-0x00007FFF22D2E000-memory.dmp

Download

memory/5436-9058-0x00007FFF230A0000-0x00007FFF23CF8000-memory.dmp

Download

memory/5436-9059-0x00007FFF2B0D0000-0x00007FFF2B215000-memory.dmp

Download

memory/5436-9057-0x00007FF6309F0000-0x00007FF630DA9000-memory.dmp

Download

memory/5600-9160-0x00007FF6309F0000-0x00007FF630DA9000-memory.dmp

Download

memory/5600-9162-0x00007FFF227A0000-0x00007FFF22D2E000-memory.dmp

Download

memory/5600-9161-0x00007FFF36BE0000-0x00007FFF36D25000-memory.dmp

Download

memory/5600-9163-0x00007FFF230A0000-0x00007FFF23CF8000-memory.dmp

Download

memory/5600-9178-0x00007FFF1F4A0000-0x00007FFF21241000-memory.dmp

Download