4c0232139d3d8c45634e497de52c5cf2e558c16e66b7fe737051371e502d4a1e

Analysis

max time kernel
66s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wps_wid.cid-659623612.1780490993.exe
Size 7.3MB
Sample260802-pt5mvsab56
SHA256 4c0232139d3d8c45634e497de52c5cf2e558c16e66b7fe737051371e502d4a1e
MD5 811ad91ad95ea492d61c60ace0d620c8
SHA1 163ce9e48036b3328e701630f2687e0dcc49b1bb
SHA512 e904bbc783d4d383e02028863450680f0bb6980f546513f6d473b09f65573bed59302dfcc8248703a12f71e67ecc3e26fff5b0fcdab9995eaae5def47ca383ea
SSDEEP 98304:9F+FrNL4TlyNLjZ44tko0mdrkGSHKafsHK+23Ww1j4DO8ZQoovaPifAEC/y:v2rN8TINLjZ+7aui5O8saAAEuy
TLSH
T17F769F47A3E801ECD0BBD13C89569613E7B2B85513709BCF16A1867A1F63AF25E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	223.5.5.5
Destination IP	223.6.6.6
Destination IP	119.29.29.29

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1820	ksomisc.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
File opened for modification	\??\PhysicalDrive0	wps_wid.cid-659623612.1780490993.exe
File opened for modification	\??\PhysicalDrive0	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 2 IoCs

pid	Process
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
620	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe

Loads dropped DLL 21 IoCs

pid	Process
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe

Modifies system certificate store 2 TTPs 40 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\OemEsim	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\FlightRoot	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\TrustedDevices	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\TestSignRoot	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	wps_wid.cid-659623612.1780490993.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	wps_wid.cid-659623612.1780490993.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
4868	wps_wid.cid-659623612.1780490993.exe
4868	wps_wid.cid-659623612.1780490993.exe
4868	wps_wid.cid-659623612.1780490993.exe
4868	wps_wid.cid-659623612.1780490993.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
620	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
620	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
620	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
620	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
620	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
620	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
620	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
620	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
620	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
620	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
620	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
620	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
Token: SeRestorePrivilege	3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
Token: SeRestorePrivilege	3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
Token: SeRestorePrivilege	3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
Token: SeRestorePrivilege	3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3848	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 3848	4868	wps_wid.cid-659623612.1780490993.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\wps_wid.cid-659623612.1780490993.exe
"C:\Users\Admin\AppData\Local\Temp\wps_wid.cid-659623612.1780490993.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4868
- C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
  "C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3848
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -checkInstallEnvironment
    3⤵
    PID:4476
- - C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
    "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -addFirewallRule
    3⤵
    PID:5084
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wpsoffice.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wpsoffice.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=klangmanager -dll_name=klangmanager.dll downloadlang en_US
    3⤵
    PID:6092
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -regmtfont
    3⤵
    PID:1104
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\\office6\ksomisc.exe" -setappcap
    3⤵
    PID:2180
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -sendinstalldyn 5
    3⤵
    PID:6856
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -regPreviewHandler wps.exe et.exe wpp.exe
    3⤵
    PID:5084
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\\office6\ksomisc.exe" -registerqingshellext 1
    3⤵
    PID:3540
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingshellext64.dll"
      4⤵
      PID:3956
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -regkwpsshellext admin
    3⤵
    PID:5708
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\kwpsshellext64.dll"
      4⤵
      PID:4620
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\kwinappinstaller.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\kwinappinstaller.exe" -i "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\menuext" wpsappext1 wpsappext2 wpsappext3
    3⤵
    PID:2904
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -regqingdriveshellext_install
    3⤵
    PID:3728
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*install "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
      4⤵
      PID:2820
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*thumbnail "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
      4⤵
      PID:7028
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*drivebho "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
      4⤵
      PID:6748
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
      4⤵
      PID:2500
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
      4⤵
      PID:5100
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*onlinefile "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
      4⤵
      PID:1104

C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe
"C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1229.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5A0E69 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\
1⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:620
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -setlng en_US
  2⤵
  PID:6664
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -getonlineparam 00601.00001229 -forceperusermode
  2⤵
  PID:2932
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -getabtest -forceperusermode
  2⤵
  PID:4372
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -fixoldversionassostatus
  2⤵
  PID:6660
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -setservers
  2⤵
  PID:5480
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -register
  2⤵
  PID:3456
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
    3⤵
    PID:4104
  - - C:\Windows\SysWOW64\regsvr32.exe
      /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
      4⤵
      PID:2472
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
    3⤵
    PID:7024
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -regprogid true
  2⤵
  PID:3428
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -assowordexcelpowerpnt 1 1 1 -source=1
  2⤵
  PID:1160
- - C:\Windows\System32\openwith.exe
    "C:\Windows\System32\openwith.exe"
    3⤵
    PID:4480
- - C:\Windows\System32\openwith.exe
    "C:\Windows\System32\openwith.exe"
    3⤵
    PID:904
- - C:\Windows\System32\openwith.exe
    "C:\Windows\System32\openwith.exe"
    3⤵
    PID:5528
- - C:\Windows\System32\openwith.exe
    "C:\Windows\System32\openwith.exe"
    3⤵
    PID:4336
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -compatiblemso -source=1
  2⤵
  PID:2312
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -checkcompatiblemso
  2⤵
  PID:5516
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -saveas_mso
  2⤵
  PID:1320
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -distsrc 00601.00001229
  2⤵
  PID:4276
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode -source=1
  2⤵
  - Network Service Discovery
  PID:1820
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk" 5386
    3⤵
    PID:2120
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -addcontextmenushellnew
  2⤵
  PID:6668
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -regvascontextmenushellnew
  2⤵
  PID:4920
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\wtoolex\wpsupdate.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\wtoolex\wpsupdate.exe" /from:setup
  2⤵
  PID:3524
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -collectfileassoinfo -module=1;2;4;8 -daily -source=1
    3⤵
    PID:2064
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\wtoolex\wpsupdate.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\wtoolex\wpsupdate.exe" -createtask
  2⤵
  PID:6796
- C:\Windows\system32\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kdesktopshellext\kdesktopshellext.dll"
  2⤵
  PID:1012
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kdesktopshellext\kdesktopshellext.dll"
    3⤵
    PID:4136
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -regyunpanfornew -forceperusermode
  2⤵
  PID:1224
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
    3⤵
    PID:5016
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:overlayicon "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
    3⤵
    PID:6776
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
    3⤵
    PID:2592
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
    3⤵
    PID:5360

C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
1⤵
PID:6828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6456

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"
1⤵
PID:4420
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wps.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wps.exe"
  2⤵
  PID:6756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 fe97c3f89c4204d7aff528addbb02355efdcc9cbc71158f75570cf9e664fa0f6
MD5 da6f0330a27f76a8d3f60cb4bcd839f7
SHA1 8d2dd05a344a89347ba0b79e0e03d37da12861c3
SHA512 574996a82b044a2bbef18ac30db2b57706414cfc27001457c3d5c664cbf1447c920264df246f4ea71006f0c40e5762a50399895d5c97c5566f0470607a57e167
TLSH
T170F0DC3B04EA49D33C03C42816E88A353278F48E58C0C47630280CF68B5B2C4B08F01A
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 727B
SHA256 4c9050695dce5153aae7df81362c59e303ff6463e6bb3173703980b22d4a7426
MD5 d4662865c24a6076ee02df007b2fc5e9
SHA1 40a3045b0b792ba1b7f723f84c91516978a7c9a9
SHA512 abac024897e4f67224cd4de15764205f3954da3688cdbf851b24d20755da5196a397964076b4c0877d6152ac3a2ab040b362678fcb4b868337bd139bb9656d40
TLSH
T1290165838ADCC7A49B03C9BF022B9FB57EBE55209689814E04110052F7C27653C11D30
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 e737524b4374c9dbaeaf53f139cc82c9f670b9dd145c0be92efcbfb85ae0125a
MD5 d7b91b9471036ece56c0fa0535145ee2
SHA1 6fd274db5edafdc7ecac3893676dc0625ab92380
SHA512 2f1511a8b2205ae71aa7a66aa58f57d0209918f50129b5c5bf24343ff83faa480376b93bcc457e741b84f5ca566c82b35349df719aef4c7095259d643a0f848d
TLSH
T1EB0165875D5007513C91D5968AA964643836B28825D012BB33A120DF1A687A4ADCBC0D
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 88c0b5e8bfab24c8d7d2cfbd7f11e1e2fb67f0183878b2cd22107dcc4b4df014
MD5 5df791f92149079ed0ebac33548ecf99
SHA1 9b6afe8ae4b749ff6fcd914368a2be004418d338
SHA512 9ffba0a4051a5e181ed0b3c850691d790e4927976692b17de863519bb9d3a50a187532d8c239824c624a5067fc173cec0dbf28796f06be43fa5b205f3bc2a2fc
TLSH
T16DE0203027FA501EF5A05B7C03D5919ABF26F1073C5666BD0DA1185E590A9004C92D31
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
Size 404B
SHA256 57a4e9b481518994577489539eb93ca678f5f8ba288614b2c90682ba9df67ab5
MD5 dad7a413e7d62ecd8f0febc4f48f1883
SHA1 dfd6b9fd67f9015247f5d378083f4ca7359a34c3
SHA512 d68bb59943aa1b5c74e6988535fbc5ff8c9c76b48b34b65d70987496cb57df85dc2d0ccb649f221b303952bdeab88708dc872e12d12792ffb39c17191bc56071
TLSH
T1D2E0C63021FA0C8EF0F4D4784AE29C351CA9F2020901C7A90370170AAB28A008CF2234
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 c1e4640b053dc261b6a02278746649fb160de913b707a6d707392126981157aa
MD5 d9f9bf9dbd05a16631e71471fd008c3f
SHA1 e82a95ac51abf13721fddeaccfc71783210319fc
SHA512 ca9a8073002d61a1adb71cb2a925e6565c0c7834b9dae8693cb381d02d6d9c230c2541e0c79d18ee535a2dfc5943cf2fb80cad8a32ba60931f7ca67c621c0096
TLSH
T173E0682815AFA02EF050983546F6A1751D4AE205240087B807A14309FB1AE089C119B0
MD5 SHA1 SHA512 TLSH

Submit Download

Qt5NetworkKso.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\Qt5NetworkKso.dll
Size 1.4MB
SHA256 77586248b2db8ecd9951a9d7e624999178cec189f5565d2e13f9ec933fad107d
MD5 a67608b8301e598a5e2d77511481005e
SHA1 d81f127daa3a24d38c038b0982dac05a77905b7d
SHA512 58704b138601df8ad9abc7d1ad783d676c5f08313651191af0b102cba4d5e40b51d7a91e884c64693e84876acf5125385eeb355bd2c75e52766c4a4746b230b8
SSDEEP 24576:zkbqCgnInomjARXqFrdpEGcqHnwg0iyj+6VQuact7:UNgnOo2q1Gc4wKi+6VbB
TLSH
T1F7655A53F7554399D62AD134CA8BC902F272740083A75BEF2669DB192F737E2263E381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5XmlKso.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\Qt5XmlKso.dll
Size 213KB
SHA256 408f32ef4127643e3357bd39d745eb770344916016e99728d084e6bbbff0ae74
MD5 8a5b338ea6c5a6de1712639f26f94c68
SHA1 e51f3895458942d799b83d77720deaad3b078485
SHA512 9d5535fbad8d038c9348496e5c6fca3731414002b0a9de4cad6f977700e559145dac0baff1976bed6e5a18ff913f5195d9cf048dfc1b94bc84f42afbc7315fc7
SSDEEP 3072:6he9UZLXlmma9ECFoib660hOcOg745kgj+wqjXiboF5UG:6hbZL8B9Eooibz0gcOiLiboL
TLSH
T1D9243A53FB15429AE127C138CD96880BE6737C40476247DFA694A73A1F33BD2787E290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo-small.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\StartScreenTile\ksolaunch\logo-small.png
Size 6KB
SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
MD5 8d650fe389e3665607fdbf938c1a1722
SHA1 2e545f9555ff22313e4ce113995d8aa694e5cab8
SHA512 f116621bfecb602d02919eb1ee9d7dc92e82b313b8b54cda42ab48c5e7ec60b02005edcad763fff6b497ca4bc46e83cb0c9a249be791f245bb9c599950fdf015
SSDEEP 192:HSO0z+xgsZ7wNP+agwQznBm2KIvdgoeAtzpZb/D1:yMRoP+z5IIa8hD1
TLSH
T1CCD19EEE6F1CCE4F079D52F7500AC0A9DEA218AA905764D4D68E70B471FE6D120EC5C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\StartScreenTile\ksolaunch\logo.png
Size 12KB
SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
MD5 d58510dca6b659c6e4ba7a454d5b75ce
SHA1 e142de2dda3811a2e8bbbb2eb64d366e8eb9ea3c
SHA512 42409f9976ad08ecf1756d1c2915f3ffd17cdc78e9ff552c0a08bdfa2fda8960e408721bfc9de1a5ed9c9aca3e23b97adb721b3c51b6b3f0ed3ee4a4c780cf88
SSDEEP 192:ySLu8Kp8OtM5IirU31+5AejJ7D+N+QOtHQjrE9aTYpR8XnXrWjvyNTtLJci:NC8o8do1+5D+N+QPE9B2Xn7WrINJP
TLSH
T1BC42C08F68918EB2CE443C39F356115F1FE12A5E7E19A2CF2CE7944A239044ACE1591F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything-KingSoft-Read-Only.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\everythingsearch\everythingbinary\Everything-KingSoft-Read-Only.ini
Size 404B
SHA256 b5980cd1122d2ad4727bc06806e3d2a6598b7d67b6eb3d2732938d08c6deedbb
MD5 6a4653f40acaaa13e2b0f60f067ea93f
SHA1 34981baa55ef31ae6b6d5985fdd02798e3bacde2
SHA512 f286472389e50fa51abe03068cc3e1f9d18b19926d84b66b1df28c157cbc70e8de32a8deb7b4096f462605a2bdd4d76f9863c6ca0872703c60d473a3271778ea
TLSH
T15DE02B99808C4B1C7656E6948D715E4F42E1C79C1B98174CCB0BC241E91950DF63A439
MD5 SHA1 SHA512 TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\karticlewebcloudsummary\mui\dist\run.ini
Size 171B
SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
MD5 b30cb271e143eace0f55ea2e562e1e9f
SHA1 9d97dbf24931cfc114384c3f4dbbae21c9e51be5
SHA512 dc593185fa63b458024c3a913c558e5686806154181dea67eec786ada50595c53bab822833ad1e76c9acdf21be3eba50631391b7e575d7f1f6409ceccf966535
TLSH
T1AAC080D4D0256F97DC31C6B5ED54AF1A7560E700251C1EC3D530DC4E9E9696551C805D
MD5 SHA1 SHA512 TLSH

Submit Download

kcoworkdockpanel.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kcoworkdockpanel\mui\es_MX\kcoworkdockpanel.qm
Size 846B
SHA256 8f0de81b05e2ce8a22432406009084933f0cf410e6efb534aafd71699651120c
MD5 6e815f2b93f16067d08e51cdb69b81e4
SHA1 40630f21ec4e2ce47da271f5e379737bef67fad5
SHA512 7e9586a605815f829a2881ae328d4df3cb9600949767cc5c8fb8186cc2243b08d8cec4bd52cff81c728fdb0c8fd7ce1c9d8e52e9fe4139722e99d4be12c6e482
TLSH
T12F01E9D527FD2F19F3F79BB179E652108F3679082931D16F2145A40D05A15505DD0327
MD5 SHA1 SHA512 TLSH

Submit Download

kcoworkdockpanel.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kcoworkdockpanel\mui\vi_VN\kcoworkdockpanel.qm
Size 839B
SHA256 ad5549bf1c748909f191eba6e08caccfb31dbe1a2ce4bfafcb1e41702f40c95f
MD5 3eabae85edf1db8a54d42509c660862c
SHA1 ea6133582aaf7aaf5330142474dec996e527b461
SHA512 05d619228af227bec2d3b33aab044dcaf79b69633c604f81d6456eb10d4420e48024a9a88cd706fb5c00908565347f5e04302f90bc5211d48d99e2aab2feb7d9
TLSH
T16801E29523BD2F19F3F79BB17AEAA2208F3679082932D16F2145A40D05A29508EE0327
MD5 SHA1 SHA512 TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kpdfcorporateglossary\res\dist\index.html
Size 636B
SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
MD5 72cdeca808b16e794ec5b66bd02246bf
SHA1 e75b6c4e084efc8e60c9e4fbe9e9ae02bfbf4132
SHA512 6562ed498bae7f819caa5ebff9ba373b1bbeae3c92befacbc44a72419e6a3aedeee7fe43347d1bf8c46b9c90c8e515181a6dc50c4ad954a640cf6b2520269ed8
TLSH
T1E5F002EA3C25F055CB911EA43DF2F19E245E3AB29DB9DE942AF4513543C03694D0BF48
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kpdfcorporateglossary\res\dist\index.js
Size 2KB
SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
MD5 67dde682d1968824023dd9773f9ec48b
SHA1 81e0a21a7ba2c05193ecc13672a3f537539e0699
SHA512 86bccae3d66df4dd552c12a42d1ed0d57d6cdb7b904caa1f89c874e506fb76412b2df45e3e5f673837cb72aa18b0ab2c1dfb489b1da37068d83d7ccb25d3d8ea
TLSH
T1FD5173C9F79E702209EAE136583F0006E17735596098A1C8B87ED8F16EB555E7077F38
MD5 SHA1 SHA512 TLSH

Submit Download

errPage.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
Size 7KB
SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
MD5 eb3b05c3a3fdef3b0c5c9020756ebb33
SHA1 27c5773e17f9c05f471ccd22db42015561b4e669
SHA512 9a511c6d0aad855448ae45130d7ed031062bb7e6881e68aa2406c7c122220318379c312bc13876599dd7fe88e2beac296adf5bcdc015ef4e0e3f362e76303ab0
SSDEEP 96:9uMJIMzvOcuq4v+nB1W1QjjaKhwc3Rgjfqqm8bm83:9lTgVv+B1W1Q6ywc3RgjfDm8bm83
TLSH
T141F15211D6925216603393B4DFA25719FB260023A3038A38BFECA2558F75C495B93FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicon.ico

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
Size 4KB
SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
MD5 1ba2ae710d927f13d483fd5d1e548c9b
SHA1 c0605efed936ee2600284e6480521d06fa64f872
SHA512 f933cd352eaba92f509b3863353ddfefadfada26a4152ecdc4727d450bbf35e7b10fb3038fe8db340d5c63d74e608c1560ec84d0f6ffc8ccd940c9e0d7533544
SSDEEP 48:i3H5R5hLOR4kt38PduMoglJrd6qTrp9hweFC0+6Ga:ipHFUs4MLBvuyCda
TLSH
T1EE9175DF61C388D9C1B1977F78C449A14F6FD951BA28351F55CF30622E5D75818C1C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebpromehelp\run.ini
Size 226B
SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
MD5 abc3a6089b0ea76ffc960fbc9b6e66d1
SHA1 50ad0cb201c13799024de56cf45116cf65ff5569
SHA512 ec1e32b7bed882095b23e049a4e1a86acf0bf993e2f691105ffbd99d93ebf28faad4fbdd645ac1eefa74ede575854a3994c7c6d2bacc6f7a09a1991561b1a44b
TLSH
T157D09700C0B5658AC1254C827CA53DC411085B4B27608E02CCF0C34D508EBECE56B08A
MD5 SHA1 SHA512 TLSH

Submit Download

close-secondary.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
Size 216B
SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
MD5 07306930f7d374663bd13e38ea0e92a1
SHA1 12f877e8ab93d874b55d75eef6747615619dad4f
SHA512 4cc0517ed0b9d665df4db93fb3093067e90f64b34f1d41420ed975b4cec64d4cc0aede64092d79c610c04e1ecd9514a9ef48389d5c157b5bcf698fc33670db98
TLSH
T1D8D0223BB3CC8E1CF9224A22F35A713580AF41C3548942E4D8322032E4011CEB93B6E8
MD5 SHA1 SHA512 TLSH

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
Size 334B
SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
MD5 d36fe6147829a72b42e054a5db27d270
SHA1 80779a8eb37d8bb1d5fcc594576f80dbd61fac98
SHA512 94224816f757241b3a6d19788225378ae070fc62b4620e11e10a033e3be5d9cc858cd9e669cc275b1fa82e57094d0df13a6d9868cf00afaa17cf2ec0193acd74
MD5 SHA1 SHA512

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
Size 327B
SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
MD5 18770de3f96bac1e75e588015024fcf8
SHA1 e6254c054edef68f9c27059efd82eeaa69c863b5
SHA512 fcb76291a73d7f2e30f4266ea8f0dfa2d9e203cf9770fb7ffd73cc1994502992fabd0803224c1e1155c1e4b678b5af0e8b3aec114beb1f02299e8885d5a61d0a
MD5 SHA1 SHA512

Submit Download

element-icons.ttf

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
Size 54KB
SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
MD5 732389ded34cb9c52dd88271f1345af9
SHA1 8058fc55ef8432832d0b3033680c73702562de0f
SHA512 e8971ae48f5287d252f5b0a2d0516091bef0d2febf7d01fd7b435e426d106fea251037439ec42c2937e934b66f38e5eb43d00a213cdf334f482f4a06b1817f9c
SSDEEP 1536:qTIRCXXCwinqtuPM16hD2N3SUjbwaST4DCJe:39GEcgD2njb5ST4h
TLSH
T10A433B32436A9BE7F416047F5C1F55830A9F4F22F53DEA8B83A6192514162FD0864BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

element-icons.woff

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
Size 27KB
SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
MD5 535877f50039c0cb49a6196a5b7517cd
SHA1 0000c4e27d38f9f8bbe4e58b5ce2477e589507a7
SHA512 da269b20f13fb5b0bb4628b75ec29e69bb2d36999e94b61a846cb58db679287a13d0aa38cdf64b2893558d183c4cc5df8da770e5a5b2a3288622cd4bd0e1c87b
SSDEEP 768:gOvv6ExpCVxUtrT6w8ClFd80EjPVerMKBaGXjAlEm:Hvv6xVWewtlFdGjPlkFjAlEm
TLSH
T1B9C2E13197213AE9D9824EF876E498FEF1651402290F390E8696ADB3A98D5C73E16831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
Size 107KB
SHA256 907d1f5ee046fae72b52eaf99508ddb6b48d47b803076db0e9a86b0e21a54ba9
MD5 0ad676312c51d1b96bd08f056ab33496
SHA1 270438a06781cb68c376bc18c42437dd5ce262da
SHA512 6a6883f9fa0a1f768bf985340dc6cb4651e5ce691066c9597126ba1fc62b2a45a2eee52a1d8452faec885bbd3358be3fb04a15fbfca0302feaa1adc2c81130c3
SSDEEP 3072:KazzQ51KYGqMkYUl26MeCAAcdl6y7tqWD:mME/euD
TLSH
T15CB31B37214D132D343BDAA2E55D659960C8F61BC00253F9FA247B1DCA837873A7A3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
Size 279KB
SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
MD5 a3964e72421a1ef5fb60c6e17eb5d705
SHA1 5dd9584be5141e884a230c48746e1c88126b0a55
SHA512 4ce4119b7407b460969041809354c4ede587047ee643f2897eb0ecb9627608431f43fed27c54c70bacff3a6694eb32a85b535c7d6397ac22d7d28e260b0a5467
SSDEEP 1536:39eSBQG+dyAUlHj/8D0Q+SPxZztR+LCrwHFfyqHYb3PPV7BYUOf0I79lDxiRSL2Q:3zfZYKVxiW
TLSH
T14054B6229140212E702BDE3DF7C4EA4AE225C6B3C4125BFEF953651DC7C36AA117778A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
Size 380KB
SHA256 fd9dcbe72da3477714bf68b8987db4718e4be32f313d09bfefbd4d78aa051a84
MD5 64ac5333133e48efc94a0f579e10878f
SHA1 ca547d97d85fa913f48aabcbb23a227c6a2e6bad
SHA512 be9be830f1a3149b238b7363cb6aac08281d244825f4c0ebdd69e31daaf05562555a46484af78de442b7deb3ca71b8a8698331e617b433a0f86cf39e2668576f
SSDEEP 6144:qpK457wXrkaY0TbOXsEYlHBBs6Ve5NtXoqIpgznl87A6v0eX4AiDuViQbgQgILTV:x4B0WtYlmiLlTj8QmIqUrNBqq
TLSH
T1DE846C4B758BBB5A1F35B66340DF3C88D01C6EC09812A5C9FABDD9D09144B9A32D63BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
Size 249KB
SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
MD5 6351ea268f992f52e0f4418a7028b91d
SHA1 5bb3cb88465c550a1fd033a079a8b2eba5e071b8
SHA512 44940d07abfdee6403e9400e596ac5e5eb234ba77a1c90c2fe4086878c12f4805c709eb84538071f21d5710d3569d342e7caea10061e2ab2661c5117c5966297
SSDEEP 3072:p+Xy2rHhkiTtcsuaIwK3zqDLW/ix3Iu7doNFBWgz/bwUzxqcG7gLEOhA:phKHhklsi3zpCdoNFBHz/bwAfG7cW
TLSH
T10A44F8CDB2D1B0A517EB61B4813F610BF27B6499B44E80D0E226E5D4BC7998E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
Size 424KB
SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
MD5 cf29fba214e7f43f2ca1b629109d126b
SHA1 d0dda9486528586af6943abe7a3afa319c790f25
SHA512 2ad7e4711f5917b8d13f861d4fb2688e6ce3951da43a89263a2d9743199e173429398ec1a9537b1df25593d3999dd34fb590e2d2a6e7a632ccc44265d93c3bca
SSDEEP 6144:z8KzCOcC0CXWsJvRekr0dgei/zJbBoCF7az2bzNM:zbzCODTWsJvRbw6zJbBfaz2bC
TLSH
T13694198DB2C1B0A517EB60B4913F610BF23B6469B44E80D4F266E5E57C7898E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
Size 10KB
SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
MD5 0f4634d4af8b73f882440c1181697d86
SHA1 748bb9a14c8a6c64fa060ddcb1b4baebfb3f6fd3
SHA512 eeff081cb256a44ff4557dae145c3d277ad936fef58674cb7d2949b6c302c3a746f05495daa6ccabf39c26bacf13c6fee3bab20de4f1d13810be0503787c89d5
SSDEEP 192:cyxPpQcKb2d4U1nE92Ui6OPl20b3G0qE7I2ByobYGeBv+x9qkgYbeO:zzFZr6OddG0q/yTh3UYx
TLSH
T1AC32C887B30483755A90E790F6C76DA5A93ED0EE73A4168A3CEE421812581DEB3E7CC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
Size 13KB
SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
MD5 dd59d31e84434c59c5c3735bd0b0dc3b
SHA1 c34473850d3749aae725856f68a262a0afebee00
SHA512 f3acd51920f945b49dceb56fd2a5a4ff170c4a5770665bef3d888f8497a288dc33bd15f24780cbe9b8ced585fbacb92a8700d1322a6d4acd2b6e5893370822ac
SSDEEP 192:GwSuCUHXDhEblYfhQ9GYSOqUr9b1AARAU0qWo3wYXVMojXiyaH:dCaXDhEK55YmUrLAgkqWo3RVhpQ
TLSH
T140523295F3C50E22B4991749BA03D57BF19558FAFC2CC18D5CF2D236136C9C986928C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
Size 14KB
SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
MD5 5cee0947c1ef6f00e18eb17cf77388af
SHA1 5a27bc625acfb46d2368a9a376d797ecab912a3a
SHA512 1bf91f08d2a2a446ef0e22df40fd09b090fa300f599bacdd5c698aa61a6fef12ad3d3e38299804a016e5a22a82ddfeb6840cdc7a79ea51244942cb22e659331e
SSDEEP 384:HTO1ksU66rAJGO+NedvSGdv+GfBgLj95LKn:zO1ksU66rAJG5NedKGdv+GfyLj2n
TLSH
T11D6230ACC3CD5C69C86183FA090B35C27836ED49FEA5AE7280EDF4202DA19DFD815674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apm-init.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
Size 57B
SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
MD5 b684f2b8022aaa97ede28f9d224c4db5
SHA1 2087206ddbfd6d6d71f843a132b58ed533d87169
SHA512 8d30da66bfdd99dab88c4b9766b692c39ecbc8dd725e9f858c95993d4f2bf46c37891a1f8f4f1eb6fe09bed7008b8df48d2a9b4f10d7caf20f823f121f6ebb40
TLSH
T19F9002E7F0A1707344616959630722AA35D11130017430010900487434A580FCD22F88
MD5 SHA1 SHA512 TLSH

Submit Download

default_ava.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
Size 906B
SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
MD5 c47a5cfed147c402538358294808e68a
SHA1 8aa499336bc4a50a70710735b67fc5da923fc61a
SHA512 a71831abb9393b6c0ad62feb29fefbb192e1706b08ab88dec0a8e6a9cf61b6a7e106454a7e6e518f69425cc91846036e8fe2956ea939625678f17b330860ba1b
TLSH
T15311E309934DC285960AD7B8563C1754347272DF9E1FD55CE7E633012D3C6AF185C27A
MD5 SHA1 SHA512 TLSH

Submit Download

desk-sync.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
Size 1KB
SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
MD5 c17417f321f52624ee0dc60ed76a31b6
SHA1 b64e19a5b03c92a931fa9a1eba899f491e669a1e
SHA512 bf160829598cf0b22ea48a5f7310adfbd26fbc1bbf23ea3cb8d9cebbeb92b5e81b914bd6021cd41df5984ef00698acb1c1151e134c714e0a1be7dcd439c78485
TLSH
T16D21F0ED57EE35C8644CD37028DA6079627B35F43969EF048914A9D1FE4205D499F9C0
MD5 SHA1 SHA512 TLSH

Submit Download

loading.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
Size 1KB
SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
MD5 0620393a949b58f6af37b0accb79e32c
SHA1 0025e4da5ffb8695a8f9731a05b1b89f1a71bf24
SHA512 0d308c758f825d548874cf8b4b8ec20f3685b39c7232246697dd95e5e5f40da7cd21de7ba5faafd0d8a121b5e6b85c5aadc4232e3f0c943535e062ae449ef29e
TLSH
T1333142D111BD0116E11AC365D7FD7AC70B3EB4DB26E558BCB68C250FAB404DB0A9B219
MD5 SHA1 SHA512 TLSH

Submit Download

setup.cfg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\cfgs\setup.cfg
Size 449B
SHA256 45a9cbbacd1a5a9ef690f4b0d8978d908cf12fc423254b3b591b00a7231aa5bd
MD5 656e40598e526d31a49004aea4f1e0ed
SHA1 e8a58d582f70b6f4a331508143c758f241c785ff
SHA512 8ca2432f432482a87cbc6f744416bde09ba69f7a234848ff20d82a02b362b8c48ffd2be45e268a0876298e62dbcd36b620901d9290fa4a87f5abd3a7a95584d4
TLSH
T123F0556A030370741A21431410B914F2A3F601C91117840D656CA88D6B7DC3D86BF13A
MD5 SHA1 SHA512 TLSH

Submit Download

kbase.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\kbase.dll
Size 1.2MB
SHA256 6ae278b062c39e2b6cd3299408fb136fe1664a6ff7c5168520de670badb4968d
MD5 a010c038cf2189cf84a2d61d00ad3ee7
SHA1 5d1234d9b591c0a4314cead8bef36845f12117ba
SHA512 9aa5d45906c79bd37b61e065629c8b364ad4f73198970939d893c4e2bb2cbe19f9d6787bf41c03a1e9e9cdd08face4fd30ec4d6afd433debc0e9042f71a9e985
SSDEEP 24576:rNVvYJXp1IyWO1+4HVQMpni5Ugd8xvXGujhpNF0ZtodZib:RhOHdNQUi5UA8sujhpNFgN
TLSH
T1D5454C5771A900E8D1AAD1B88F6B9906D7B170960721CBCF16E0979B2F67FE06E7D300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdesign.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\kdesign.dll
Size 1.3MB
SHA256 027df5dd563cfc2dcd95b2799cd6e4b2e29f3953d3b0726f6b1f11eeb0c602eb
MD5 2b052a16afd2ac11462e1ff9383f6ade
SHA1 814043df961ce1f16993e681e62359dd39ac12ab
SHA512 0a867f262214b65988d7c09ed9490862eae20439739e861faa996579d2dec8801a2e438b3b950dbb5f5d51891abbe0ad9aff4cd0ba0bae510814c14c1e537534
SSDEEP 24576:jad+LLBqr9f6uZKIZ2yzqBsbUfT+hXWPmZPz:uoLLU9f6uZDFzSsbkoGPsz
TLSH
T1BA555C1BEB5643A6C0EAD236C9CB4515E1F2B842C1A38317759EEF293F633225D5E381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krt.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\krt.dll
Size 1.4MB
SHA256 3691f73fb7fbef11cc75dbab0de195f9edf51dd33bd61ef784dc6abdf00b25ca
MD5 57e6346634a01bea31b19121f88eeeff
SHA1 cef70fb5005c4d5a878d5eb2f3c12164cf8adda7
SHA512 e5cbcc3787fc2471cff10b0c4305bb82e6beaf8ef25bab43891bd474ae00d4f80a6b72bc0e111b2a026db2918791c4139d04454fef8b4d0a9694b3691d34afe8
SSDEEP 24576:5rxX/7HCeeMs5QSUifXLTZLT/R+IxZDNm0EEQil/nye8jiDfvu2hJ:5rZ/75aQSTblLTZ+IxZc0Efil/nye8jG
TLSH
T1AA656C1BFBA943B8E06AD13DC9874906E6B1380143619BDF26995F2A1F377E24B3D350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kshell.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\kshell.dll
Size 27.0MB
SHA256 21a0b5fb9aaa6674589dfa30f6cbc22b2a6ecd896e7bc2095971f13d204b926b
MD5 fd6b0f186a5e75c2a957be1e6d47974a
SHA1 387a8a4d217aed708dbeef05a5b6db90bd1146ae
SHA512 a72b8bafc2597d5ba470e3602fd099f3e17d1c2a7f6d4513c404be80043ba9b2e8d7a40192790d0e900f03ae9c5f3e1401f0e2a7fd685d6ede7895c748514768
SSDEEP 196608:6XLzUzOEk6ywyz5gyfp4AFDPZj4uP20fTkTcQM:4gOE3ywytgyfp4AFtnVgTcQM
TLSH
T144575A1FB66942A5D175D338C65B5A07E3B1B8214321FBCF1172EB6A9F373E0283A650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksolite.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksolite.dll
Size 12.4MB
SHA256 ca5bd7244b5136c9901963bc2cd11d5aa919e6363fa3a13fb7685d5bffea12e2
MD5 34acfe19e350cf5f5724b5e858130d14
SHA1 6f131f69f80ffa325dc16b711dbafdb33eb1dee5
SHA512 38fe9f3b2ee40cc0734ed61495281847904b6c1df4109257414bbe960101e6430f5a529a20aeef57420f7a4277ea7610eca20f412ceb82e83c0d4638198784ee
SSDEEP 98304:bQL7W5uTvczhZoLh5XH+5Z4wRJSsaAHE7M:buyWvczLoLH+5Z4wthEg
TLSH
T192D67B8FB69903E9D0A6C279C99B4D03E2B17446831297DB3569DE392F333E1493E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksomisc.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
Size 3.7MB
SHA256 9555ca85ef085b11d92dd2fa4c901d4fa3c72865df5e7a6bfeee6cc7c8a8f3b0
MD5 f36a666ccbf1a286eab2aab3fce0f72b
SHA1 df8dfbb550195edba779d3deb30b3ebd8d437aaf
SHA512 f873872331477835895c47c06af5a4a62cbd57eceda336fa854fd113d393a8e3772de80c0638f0e753f91001556c523a029da55d7111a29ce7d399060d027497
SSDEEP 49152:NM2VJSc5XE2+OX6KujrtYtB+OL+ro3RauJIwmfL5PEpPJj5W6L0TkgNp+eUqASsY:9H5XbRXCszwogk0NJgs
TLSH
T136067C1BA2E903E8D1B6C238CA955D03F6B6380643316ADF11509E790F7BBF15E7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kwinappinstaller.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\kwinappinstaller.exe
Size 29KB
SHA256 bacb8970f47d8334db58d9e5ff08d473577fa03db871dd7162b6581608d723df
MD5 c856e7f491f5dc09b1775b26822fe93e
SHA1 d6c610cff1b67758a4ab8e59fa6317a451ab3595
SHA512 edca0049af28a21b6917f45192612041f6e5408c386fc68e146ea3adc2af2502458ab7a11de9c94dc82dd51b631cd1dfd124ffe61740ada5f141aeef17de270f
SSDEEP 384:0X3jAgqYyeB7iZxsY0E5FvB1+NyEIYi2mL4/y8Rxtw7Mxi+/IYistw7a3j/y8RbL:+q/cybzYiDLk5C7QwYi77kz5ALWJ
TLSH
T164D27D938AD44C05ED77AF30B8D05126AFF6B6573991C1DF7288C1568B923822BD93F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-kso-1_1-x64.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\libcrypto-kso-1_1-x64.dll
Size 3.4MB
SHA256 367a50ae0ab3f5f04259e190cb837ae169517190f2a8da6efa5f776412111464
MD5 7e80684877e31950c33d275867ffd124
SHA1 e7ff1b7a32e92d228471ae755f845ef6015c5fbe
SHA512 8c161852a0a94b92d16574be9bbefd89f29a8987a04e19b4d2b166d046940710e6073b804af226fd80d495744bac0c777c25760605b4618cd852aa1392a9be09
SSDEEP 49152:oOVwASOXFIU6idBGtlqXWq7TsRQuXk0AkOGYYNEhvla9+LEcJQNPn/zsqocj1CPw:TC+Zsu0h9gEx1/zs+1CPwDv3uFHUT
TLSH
T177F58D5AA7A80184E5BAC13CC55B4737E3F2B95A17B09BCF18A1C1780F23BD66A3D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_codecvt_ids.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\msvcp140_codecvt_ids.dll
Size 31KB
SHA256 f2069a52880ec885ee7f0511186100eb7fada0411a2b4948fafea7735b878a18
MD5 3ece3fb90bfaea8e9a5fb7139ff9cbdc
SHA1 91b19dd0db24a5cbd944eca9c67fad3b53f9c154
SHA512 c059ffd80de25ad10d34064b1e9421666525da67710de0ac445cfc45b8139715dd946f7e90c1e0d719c60e3d5902e3229db4496c87d674c0012c9b4a8c2b2291
SSDEEP 384:p7GVNpd36sRWioEWEw4himRSt+efdDtdQ5R9zpU8NSqHRN7w9ju0R9zlWdo:5GVsfaw4DYd7ds9zmMEu49z0G
TLSH
T19BE27C89DA3C4487EC9B5C7082ACDE477C3D77C60A10569B4392F5181DA33C6EB3866E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

error-net-72.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
Size 1KB
SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
MD5 66726a0fbd424ccb700cecb212a47007
SHA1 9795ae26acf0b942ab6a0cd06f206ba69eda18db
SHA512 30ddd2fa17517792a86bdb03827a0809ed362ab2dbd9a7baf194d1f47348c96e0ca8e64515c1a58d7a1740e85f53a3676b49ff6c699d598a27c234c14672604f
TLSH
T1E031C6CD318AC42FCC61D531F4D534156817D760BF928C74102BC5576E0F68E58C6662
MD5 SHA1 SHA512 TLSH

Submit Download

presetLayout_16.pptx

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
Size 41KB
SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
MD5 f41e909b0284949bdd3bea9393a6ff2f
SHA1 a41497f65f44368ad517f464eb0da4403aa700c0
SHA512 d800b9b807a72d19f17bf5bb923d2489328b2f8801c2146b0c67d3d4cd8c70d5f22decd6581ad14d5584f3895140180c8578ede4fa8df755ca742c18cbb3b67b
SSDEEP 768:lwQ75cI1zETv/7H0vFtZKSZTRomseFVEFqG5IphchDB8h/rW7oELmG1wvcG7GyGK:9qNTn81Romse8Fl5ahcVChjQmG1/sl+Q
TLSH
T114139F61D40A142FC263B3F6E478164F73FEE86248179797ACD51096282F97C2E9D38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpscloudsvr.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wpscloudsvr.exe
Size 1.1MB
SHA256 0f455a3cc797ff1b5f6c947285649203ac4ccc0a1d0f900a0b7e43435d41eeb0
MD5 5b686fedb64b29e878c890ef34dfa01b
SHA1 8b1f461ea08d0fee944e7ac29a54bf28e82a49f8
SHA512 56586eca535569845417398357d099eef6c54ff8621338ef7850b3b7ab5f7c02e53463e54362164ec5f7de8d93cb68d88a4ef94a122cc3fe0e4bc04404176741
SSDEEP 24576:auUcCucCi//7/Q7cYae4IrVbyIAKOpgH7ILn1ZQL2Yw:aBgm8gYv4Irp9HM71ZQy7
TLSH
T1CA355A46A3B902FDE0ABE1798D525901E2B63C0607B05BCF079067771F67AE59E3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpsoffice.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wpsoffice.exe
Size 1.2MB
SHA256 4937dc6011b827af8acf4625d5b8cd3fec1b9f310e78024542830bcc2d5c7b04
MD5 81e2602cd1cf223758792568807cbafe
SHA1 97a4956fb69763de73a6ace52798a4cfcdb88283
SHA512 d8b9769944c73f9e59faef992ff7c59eb439e416ef4eb42008b705d989767bf7b8d076ba035cb9445677b8227c56eacff25becad275d3d9cf7b58de1ba4799f5
SSDEEP 24576:5IvLtL0dk0/TCbr8KLhzcfdPXO+ItzS4hzBPftoT:5Ipwdk0/ebjEdP++Itm41BXt8
TLSH
T15B5519366EAB02ECE3ABD27876525901EDB53C4AC7745ACB02D035763E77AD18E39310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\utility\install.ini
Size 346B
SHA256 e8e682420ccee8fc9f4e41f3e9e3cb2684497712115974209574270b27c9e108
MD5 90401b5539c2d59a59b40311c177e32b
SHA1 16af4a5cbd0d11a65b20266def6694315b05d1b0
SHA512 e00b45d5e9cea67114098e96d623a73ea39e1f7ec2dba0a75cd05901759b78abc563cb78fe21064a0ed90cb3270592ca10c7cb316cc374c8b0e4043ebcc277e8
TLSH
T13CE0D80918DCCA5E26392198B0E3C2D0E5AACE660D4CD051E1D76E1BFC11A1E117E56D
MD5 SHA1 SHA512 TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\utility\install.ini
Size 462B
SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
MD5 71e0a7ecd6bd2e91c04a3edf760c45d7
SHA1 e6cf872ce6def16bca98818ba289395580701292
SHA512 282b4c8be6abb97383d7dda8258fbf069fd668f4fad722582567cbc916b5c7da9a39a157a35511210306c19e46ef34c02af17f2af1ec7707bb3d84f3d529c3ca
TLSH
T178F097090C98C66E36282188B0D3C2C0A9ABCE260D0CE410E2D36E1BFC02E0A217E02D
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.0og025yi10iuhskewm81mdlqg.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.0og025yi10iuhskewm81mdlqg.tmp
Size 4KB
SHA256 81c968c375f69d9e4666901fd4c14a6ce4b738639ff78488562e2c79f8fb14d8
MD5 a4e510ae4ca446423550859eb3193a92
SHA1 de1f946c7687a9cbc4e427c106e62691a203b67c
SHA512 f835d5adb86ab9feb23517a26a7054a6cfdaead71c3b3e0f2a2dea959376a119e7dad97f1c02bd5ad7d53ea7b1f42e65e9847e2842a290a7d4f6ca807cded707
SSDEEP 96:0AxANmAN4ANGAxAqAGAmvACANANzAFjTpOS/VjHH3HMbgrbF/x4JT9:zeTJzetx/ViGhPVLH3sUrNx4JT9
TLSH
T17B91E14A98E415D092308825A367E251AF0D4FE716CD80DCB9DCDA6D3FC53A791336A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.1dlj1ztpvd4o6621q13e4k4zc.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.1dlj1ztpvd4o6621q13e4k4zc.tmp
Size 10KB
SHA256 b40d28e789ecfc7dd669f7c6f4850de9750c2d9e04c1339f1940a45511b1b809
MD5 d103864a47226a8aac8eba4a370068cf
SHA1 7a6ed70397ddd65448341049da90e5737b04139b
SHA512 45768b42260e4c9e459a3bb54606f5a57d895c544386771aa699ac5a0e0ebac828fd06b7148533c18b3d411fc76c3598fc012af98a40ff94d4078e29ec2fd420
SSDEEP 192:OIYiYF8+2Qih75uX5ULc8pq8RuwdmL4pUQrNyKpUCJYn:OIYistw75uXyy8RbmL4nNyK+CJYn
TLSH
T1552229A388905C05DD17ED10B4D4A93BFEB6729A6AE0C1D37118C6A6C7823873BDD1F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.h2qse_xj38ol0md4gt47g3h6e.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.h2qse_xj38ol0md4gt47g3h6e.tmp
Size 712B
SHA256 7310eb8c9a5115a236fe0f5b2a40386c478b4a1c8de6c16aa20363d4beaa2659
MD5 4c961876f316a4b5ff5d8c905d7e29c8
SHA1 d26d0304cc7d3ba77edfdb54934466d272475bb3
SHA512 75884549e7bcbfadeb2f7f6293caa6ed782e79b9ea389180c312248361dd8c029f22f47c4b3e65234288b628a753f446d2d8631f0de7e82f90522ec8a0a22c73
TLSH
T13C01FE289318BE2A46784FAA0BBEB9403C02815B23170A6E6CCA897658174A11AA71D9
MD5 SHA1 SHA512 TLSH

Submit Download

Qt5CoreKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\CONTROL\office6\Qt5CoreKso.dll
Size 5.7MB
SHA256 d76ce35aa1a6d2d9ee025bbb2e8743c401039cd4161058dc4f379588057a5b94
MD5 16c3e81f3e45df75d11e28cb07b001c3
SHA1 d4d46eec649ececc72466873d2bb6bbbc4c515c4
SHA512 f7bd1025a66f168f14034726da7bf7369c8c34e53ded56327dbf1ee1a0ef87627910d255487b2ea5ee9e3098a769e367f2e43783b3d7d3aa7223a4300cbda562
SSDEEP 98304:FkAb4j8eO36Z5AKJsv6tWKFdu9C6iPl4rVsca4:Fkg4j8eg6ZZJsv6tWKFdu9C6xVsca4
TLSH
T16C567C47FA964269D8B6C238C9D7C127F673B80247214BDF2258A3496A737F0293F359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5GuiKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\CONTROL\office6\Qt5GuiKso.dll
Size 6.4MB
SHA256 c3a2de3161f7cc03dccd2c375cb10aeda109069c13689c105ba161f39c2a35d4
MD5 569c0bed6125720be6793d7facabb2f0
SHA1 d3ec78f7c465d00544fa2e21b345afb2d60cbb2d
SHA512 755abb42e1c7f1427c55938a611c8e1f8c73c228ae390b4c7f5d252804f06c46e466de30ce948a75670c8e4b7e605339fd41ca346aa2451ece42993259f006df
SSDEEP 49152:8dwe5wpMO4YOd3vBY5atKJmv+X8YXTJTyCIyCjIzjuwIomuyox3GREHckZFUT6YR:Kwe5W4LhPWfr2uyoZGGdBJ4P
TLSH
T11166F886EA556359C972D17987CB042FE1F37C4283524BC36C45AB490E237EA1B7FE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5SvgKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\CONTROL\office6\Qt5SvgKso.dll
Size 503KB
SHA256 bc68fc65d3620fd0e31e625ac359ce68d0c26bc45f68d5ada1e4cb4df9852978
MD5 dd6a72edfaaa9f0db4172ec0ee37e47e
SHA1 3e01006aecaf7f8557805c7495fb8a9309caabb2
SHA512 82877887e307a211d6108dc439f104a602e31edc9647cb67c3e8b7bd45d9862f53497a5c3b4d5023825d02294e46e0ad4f1931b8d080427f506e5d600d57405b
SSDEEP 12288:xYYYJUNY675fyplktpsz/VLEgZ/ABXH9a/vngheZL/XEnEsrnJpaymesGrx1/9kJ:xYYY475feysZMa
TLSH
T105B44993FB520799D526D27CC8978802F273340443A39BDF2A5AEB651F236E1763E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WidgetsKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\CONTROL\office6\Qt5WidgetsKso.dll
Size 5.6MB
SHA256 70eeb2b38bd9e4b17d49e62a1a8c5040a0ba309205224d500a89b20480ff4886
MD5 7a9d9082e35636aab6d53fd9cb43b5bc
SHA1 8c4c36e1d0093b51be7b515064b8c2bd78375a7b
SHA512 2e21462bc80d2615556f3e34df721a549d066ec8a93f1445748c2473807d613b397edf091cb99143b8addccb118f8951203c4ecc19cddc26d047cc39ba567324
SSDEEP 49152:cbXPQj9zA+84QMzrV2gPZUIU2wuxPjYqok/revAgxSkSsODt5fVKnsjBKRI0QdBZ:B7ValZRI0QdBbj8PwtxTMnd4X
TLSH
T113466B47F7A50389C56BD23CCACB8613E2B2780447234BCB6959DB681F637E2197E790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WinExtrasKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\CONTROL\office6\Qt5WinExtrasKso.dll
Size 251KB
SHA256 5f55c44db9c677781b79f5c0527fc5ec81dad8e4fbfac6076a45f1d0d747e24e
MD5 ad3380736b935ae7c3c8a986f3d90adc
SHA1 6530bd9ec891b074029880b02614b56564e0d6c9
SHA512 70eccfa8b101ec12dc5fbbea3cee0d148ae18edb72618f54cad8302d01a9a0d82efb2bbc3b24249502888250d2bb8828f58206486d286fcd3ba772dce7bd28ad
SSDEEP 3072:BF5o5cKUM7YLBwcJf1+6Ws2F0+xvN8093ZWFh:BfpMjxvN808
TLSH
T1F6449684BADD9619F81970B88FCCD199C223BAED8B47425F351EC39F4B619816E139F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kpacketui.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\CONTROL\office6\kpacketui.dll
Size 836KB
SHA256 e0db71f3a34e740fad2e39f52a63272340d3bb719e2f60294bf0520fa3cf6dae
MD5 e74a8762d246b8e1a49eebd418d6f248
SHA1 397235808d3784c5c88de81328c26ce6534e45ef
SHA512 01747ecc5a45fc5c7649388b61581caf84fd1e793c6177c9c9556c356a6329566e153b932ab447515cd572bf52ae715a4cf49d92cf1503eac870377a894cd4f3
SSDEEP 12288:cWgn/cyY1jnMEJxI+jhYmnjxKX6Ll20ovdV9IMX1kOKpW:cWg61jME/jh/jxi6pb6XR
TLSH
T143057C1FAB9903BAE03BD139C597C813E172740203A29BEB9945EE652F773E5493E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\CONTROL\office6\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
Size 75KB
SHA256 dcf5212ec3fe7746f8b26a504687be3bb29954294b7f448c4940b413fb04c527
MD5 80946fdc71e0211e5e4c54428615ac29
SHA1 2df40528efde1df3b996568df59900832b1ad9e8
SHA512 d842f4d7e956fc96902742a3095753be43d33f60f7d0bee53e95d2342da998d95ca1aac5c56c284a5ae078c923f45effd19b16b9921ef7ed0e13c306d8a34b9b
SSDEEP 768:YXOzQ/DBnTQxkUtwZfVKFkYQJc1EqTwi6NBv9ZpZSac6mWWrDYiDLk5C7toHZtY0:7jf8J6wi6NBV9Sac0+D7bRQt77f
TLSH
T1C9736CA3DB441799E51B8634DAD58A1BE6B2784207A293CF6324E3680F733D2397D3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
Size 46KB
SHA256 524e279aa876ea45ac1205c4f4210c226aded2298d96b4ba46f3e7c4faec499a
MD5 d7957c1bee4a820225202b81e5cef01c
SHA1 de1e1969fe0dff1c7fbaaae9aceb19e68303126d
SHA512 7f7347bc8a1de88638d85af90c12fb6f23e6e963a2a5db8b70ea3ff681c8070622a36ab0b542c49de6834ae04561042217e3e3f2de73b04c4a49211f73a1ef7f
SSDEEP 768:m/6pbQ2EGQ9UXbX8UKaYiDLk5C7blYi77M5ALlt:rQ2TTbX8UKa7bPl77L
TLSH
T16E237B97CF540C09E9279A70B8C58A26F972B8514B92C3CF3294D2694F963C23DBD3D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qskia.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\CONTROL\office6\qt\plugins\platforms\qskia.dll
Size 1.9MB
SHA256 6daafb39daca277e272ba56a115eed0235b45d5d820fa9b315f78005e048e6e6
MD5 d6935f83ac4579a4ad454d9115ba5c3a
SHA1 27e617a82f8b472e017113e0aefa10d2822998e5
SHA512 8dfd760c0627ff40d878b450d72f2d80e0dd4d341f78cfd9ef97ae13c059c6f6292d2ffc8a9bc48234613ad9a78f35865139be584f28c79b0840b448131e1001
SSDEEP 49152:ddsZt1rO+9yWfbVQLR4bC9c4RmZSHpjlW2k82a66kTc5d7:5+kW3yp
TLSH
T137957D43E3B44298C1A7C13D869B9F0BDAB1740543629BDB2260CF59EF237D21A7E791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\CONTROL\office6\qt\plugins\platforms\qwindows.dll
Size 1.6MB
SHA256 8a87eb5fad6e90294115e7b3df56971dd278a48456344b4bf2ea15a3055c56af
MD5 7f388c6765a0b162126462c8c3828dc7
SHA1 c79b5d39b0bd5be4e7d8969ee85b7981ba0767ed
SHA512 1aec90ed4e0b8ba0c64e295adaee2b3331936dc5ca96aba8576b936c4c1df398a31e13df27c691019ab32f826993db676bb5353dd5c5bedbee3615190f909344
SSDEEP 24576:AkGAzEn7Kn2eozTuqTttIrHhbR2gkNVDIsZM1M3aaV+Z:Aozu7Kn2xzTuYarHh9cVWM1Vs
TLSH
T160756B43E3A44398C16BC239C68B9A07E77174050361ABDF25A09F59EF63BE3177A781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
Size 159KB
SHA256 a4c3bb047f8d6d9240d5b020de80ee53585ed5029fec341ce2bab300b615a586
MD5 f10b88b6bec3fb5b9178b991475b432e
SHA1 5be625fa162f3a82a9d59297663b5072e4db0ab4
SHA512 261cf4b1e7ee029c6f3be6dc177137a258f6a44639fb10abf4b33ac0cc051c080efe5627e402328470d6eab0514d8a2f1619d5d418e88090d490ba2c7b8e040d
SSDEEP 3072:eSApjXbrT36b96bavsTHnbNgJUtrbgPwYhEIcI2oj9NQRu:qX6b96bavqHnbNpowYhEIc9Ru
TLSH
T14CF34913F25143DAC527D2B8C19E0512F3B37454436257AF25A6DBB82F533A2BD3EA82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\CONTROL\office6\ucrtbase.dll
Size 987KB
SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
MD5 61eb0ad4c285b60732353a0cb5c9b2ab
SHA1 21a1bea01f6ca7e9828a522c696853706d0a457b
SHA512 44cd871f48b5193abb3b9664dbea8cdad19e72c47b6967c685cf1cc803bc9abb48a8a93009c972ef4936e7f78e3c92110828790aa0a9d26b80e6a523bbcd830d
SSDEEP 24576:xOPJ1g7mT6BNvwTOxNfoYotrz1111111r8SoKxmxvSZX0ypdNLh:xO1aNoaxNfo/+a
TLSH
T18D259E64F75C0AA6C17BE17CC95B550ED972340647608ACF03EA8BB97E2BBE91637310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\CONTROL\office6\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\CONTROL\office6\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\CONTROL\pl_PL\style.xml
Size 3KB
SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
MD5 034f37e6536c1430d55f64168b7e9f05
SHA1 dd08c0ef0d086dfbe59797990a74dab14fc850e2
SHA512 0e1911c882152a4e1059a3ce1880d7fb2aed1e1e36cbd37055de2e2a1333acb2a0233ba2a4d969ccebbef1e77809aa5e78807aa9239545beae8c548c0f8f35c0
TLSH
T1E381CA80A610BD0AC563F51573AB7509762CB36383ECCFC4F0EE2E698753652644B63E
MD5 SHA1 SHA512 TLSH

Submit Download

product.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\CONTROL\product.dat
Size 97KB
SHA256 2e844013324b6d0b45e0f68706c289221de46dcb231c45a52cdbfce80bcac54c
MD5 fae72737598e680d5e8ca1b737714b80
SHA1 40043206cfaa2f8dd7e05becb512c94456dc0bcb
SHA512 60fff6d93e507e9d534f185372d09fc1682e57f718f9369d9f5bf572c6880255672ee5cd44c0d7a79b5b778bca354457761e53730c7b79e7c146e454b582fe9e
SSDEEP 1536:1yKvOpT+qaZnhBgrtZE6JjPHUAvSVxel50kydpgnoz:1ybT+rZhBghu6JjvUAKV00kydmnoz
TLSH
T141A37EFB7E1D6BE49CCE233E5E37281CE5F9482525966448E282E5A5AC1C0B73CD790C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product_new.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\CONTROL\product_new.dat
Size 83KB
SHA256 53a97ea8fd5bde7018db62835a7aaf4ec5689e175224e7cdb18bf070357de113
MD5 b58e647aabdee999ac048482ce15ff98
SHA1 4c8d0c481563b187cf00d1de36ae65ce6b2b7cb5
SHA512 b885fd8be8f72caf0eef8d4439b234035c1e71eefa5b69efe7adba2943de872c0bfce1cf06e06a41e3b8de6f776e07da283f75974171e34e6442176ed79355e0
SSDEEP 1536:I3CcyHhFmk6ebivjsUd1YXpFgnkJWvxh3/hICzQgKBVkeUzEy7n:2GHDW1ITZKkEh5zPKBtc
TLSH
T17E832C18ECE16EAD685052791D376D8227B7DD9160DD30AC4B12AA4CFC3CF887F72A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a0987\CONTROL\vi_VN\style.xml
Size 4KB
SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
MD5 394488b30107bcebb84a97ed5d754cee
SHA1 69ebe17f7d577e9bf69c87cff45c3251f0bbc86e
SHA512 24a6bc7debbf7030c1261c69cb4ae7bf3cbb5c7fac315188163c6001e58dfbe2e634925cb767044da7ea0e6d08c709b2ade02f6e43930819e1bef6f7569cad5a
SSDEEP 96:gd6SmSZcFe9gSs8TcySCSi58VS5eQJ/gQkgQ0/Mw8CclQgYzdr/PwiCSeDeR3ciw:gdAh8Ax
TLSH
T13FA17780A610BD0AC563A51977AB7909B62C736383ECCFC4F0EE3E658753692644B63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 387B
SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
MD5 c38481658f9149eba0b9b8fcbcb16708
SHA1 f16a40af74c0a04a331f7833251e3958d033d4da
SHA512 8f98d62f88442b8ef94aa10074e35aa8d9494f3c76ce8b143ca0bf7fa0d917f3175212fbcd6e7b0597fd0ec0e1b2827f157135512fb01c88218d36e2f7dd73ce
TLSH
T1D4E09B1BA8D1B0ABDEB302E988979D54BAC03D9A066D23147762540D3D32918FB41D65
MD5 SHA1 SHA512 TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 433B
SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
MD5 a9519168ca6299588edf9bd39c10828a
SHA1 9f0635e39d50d15af39f5e2c52ad240a428b5636
SHA512 0607eb1f5598320961fbd8ef75beeb1b6dc1af3cae7eeb5ba352f3e2a2edb25e1d9e68fb46c24e4299957352c0c906314c889c2d1092437eccc1d1a0485f3557
TLSH
T194E0540FA891B0679D7302F488E39C007AC03E96055D1210773144093C32A14FB81D69
MD5 SHA1 SHA512 TLSH

Submit Download

ksomisc_2026_08_02.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_08_02.log
Size 3KB
SHA256 8033d2d2602fed61e905a74a4c17f4f976fe0da7b405cccd45c96f969e7b9292
MD5 6cdea9c032c1cf6678424b4ca41adb9e
SHA1 0132507f01db67c169d908e3a61a0e0ef9e3f104
SHA512 462510f2a6361a1a5be409d966ce3b8cad6217ccb302e54cb6919b7a0732936e3dbdf37dee93916a8efbf7fd40e32e20f7b4d8dac3eb17c0fc9e9e81b982efc3
TLSH
T1E7616D69A6F94405F3F38F86ACFA44630E76BC82AC20D80A1990231D4976FD1FC7173A
MD5 SHA1 SHA512 TLSH

Submit Download

ksomisc_2026_08_02.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_08_02.log
Size 5KB
SHA256 e20b5a6bcdaf04eb46e4efa5edcba55d66c45fd30f9c399414906fa30d2bb74b
MD5 d105c8ed6ab87137b19430b51f473743
SHA1 df5301d635e84b15ef9a602e5b6cdc1454226764
SHA512 4e4bc692e46601f0e777a23a1d54f0d7e677a0203214da4748b87d8225425a5ec57626ad26f511ea4a7eb7cc38374f1974d8f431802a2222268e04b3084bfa41
SSDEEP 96:m/6qYoSsiWCoHvsi+HJoH6Pasi+HAoHvsi+HkoHVNpsi+HC3ccsiWD69osiol3fI:gRYNEPWmaPaW1PW5npWktcg1URYviR60
TLSH
T143C16B6A66F94545F3F38F86A8FA04634E76BD83AC31D80A1991130949B6ED1FC3173B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 10KB
SHA256 2375f065b1686789f85f2f2692fabcc91ff8745230c1e18e1de572cde3be608c
MD5 14ca1ad5f69f1499f87a7cda9c8f34a2
SHA1 80f79f7826fd9d08179fecd92133f9c56e0522d8
SHA512 8b6dc212235e8d95ece5046642e0efe4448e5d521a7928d67e652b69efc0344296de02c08273f6f66aafa27a72906116bc166d0de0632991ff09beaf5f74569b
SSDEEP 96:Jp5G5G5iHF5S5PF+wj1AD0moMHXNKBheS9ffqmO9xzM0PFSUBJCMMtOKSVSlvYDe:JZjJBxqtntmA1mcax
TLSH
T18A32BF67407E816E227B0A2C13689F44368A15EC2B45F5D13F3BEE974ADF0B0517FA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 11KB
SHA256 3bd973a93989a9de53be4da6704ccc61248a0432c5e256f42d0d2cc43d78ef6c
MD5 1e879285edbfdd60f51b5340bbaf2cd1
SHA1 32267cf1dca6c09d908c9c7e33be7ac923c0b1ab
SHA512 0f4aa79aa67b5b1e92f858aee5edbd77de1d49cdd7c83f5f26a1e1bda8856d595f1426f963acb32167f8f5ba4c0d7693f70f88f44bdda3a928f6d8a19f22130a
SSDEEP 96:Jp5G5G5iHF5S5PF+wj1AD0moMHXNKBheS9ffqmO9xzM0PFSUBJCMMtOKSVSlvYDr:JZjJBxqtntmA1mca4CMD
TLSH
T1DA32CF67407D816A22BB0A2C13689F44368E16EC2745F5913F3FEE974ADF0B0517FA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 27KB
SHA256 c6519a995520ee040ba275779ad907efad1760d1d1dc502529992b06c26601e9
MD5 30bf5ea315f736e2cc5d07f85a82a1fb
SHA1 38f21d667dd42ed6287c7ba1a8b8a19a5f752c25
SHA512 259b320c6a9baff82a52e9a3c2d9afa0a1b0598299fe12bcc774a296507ba27f47ffd585807c69961a408df0d7b4bd6e69ade00390d1db6cc5c01e036d016826
SSDEEP 192:JZjJBxqtntmA1mca4CMNylh+EdPK05wPeYMwpX5b6eU0pxn5lkeXZZY+du0AmImq:3StmAckjrPeYMw1bh3/2
TLSH
T116D2595600BD902612FFDB8453B8CB29328F46BD3748F6527F3AD9F3499A5A081FD918
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 60KB
SHA256 361ea9bda457f036c9155ace003801400908f4b6f88f726cadb069c42ae40b55
MD5 889e053c324708872753d1e6203cd274
SHA1 722b32223d49caa6a46f72d90a7d7c7107014f28
SHA512 a9d7fbdec1fe1ab2a6a5f9b5cdbfbc727f9fc2046c39bb86142f1708bdfeea2f312d8353b96983518fdd5cfc9824ef22d37786055263815a322d9397c89d180c
SSDEEP 384:3StmAckjrPeYMw1bh3/3DZP8/N9uWsNSENVqF:itmAckjrPeYMwph3FoAWsNSEvqF
TLSH
T15753CD57083DC03172FBC75043AE8F18354B85BD271CBA123F7F69A7999A42189FEA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 66KB
SHA256 f1939c483d0d1e847c86a572f4754339edf78cefde62f9155071a27497d4a62d
MD5 ba2379de5f5af54b67343cc1e38852fb
SHA1 9871ce5c6a89f274a4be81483cadb3fc293eb35f
SHA512 ab54b8435c8ffd567ba157ec71e5e651ad785f800e61e2ac3e7380e89007363d144cfa0c8217a8f4a0c56a465ef0bedd01b00c72c44eac9cc5824086ff4de0f1
SSDEEP 384:3StmAckjrPeYMw1bh3/3DZP8/N9uWsNSENVq+KY3:itmAckjrPeYMwph3FoAWsNSEvq+KY3
TLSH
T1D763DE17083DC021A2FBC754437DCF18354F85BD271CBA223F7BA9E7999942189BEA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdbx.dat

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-x64\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat
Size 64KB
SHA256 3157556834087b6217728da273bc300030c5bc4907f3a9f336ca66d9d0aaf72d
MD5 d688f4c0441a1e056d1e0065c76afc98
SHA1 35b513f1c3c4578b77c816cc6554d31ac4e14ce5
SHA512 e812b680d954bf5d14ca2f8851007ab1399c83fc52ea47ad9b0868676a837287725d94a7f1de1a6a0d317f900ca2fb27ab877354082ed37e1d3e3665f81c3a88
SSDEEP 12:VIx61kXDFwXJk7jk9N79ID8tQWAkruOGyJToXGnLsY9pE0IXjk6bJOGyJT8gSY:V+wXlxCAJTrPNajk0AJT8
TLSH
T16853E751AA48C936D8E4427C9EB682F33772CDC45B4357C33165724F1C723A82AE2A6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdbx.dat

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-x64\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat
Size 64KB
SHA256 773740814467be863fc27593ba7198dddef0a698486f3e69be438ab81ac48e42
MD5 50e0f55777052de72ec17de33dc17d57
SHA1 0292af40bf724c2373850c9459e7fd4b35d2ebc3
SHA512 f33cbad475ffa28a764161226a89fab0343d0bf7c7914df32d6b69287d75fbd44472e3656b07ab56b84131f86957d61683586629be72cec156b4d530efd5da7a
SSDEEP 192:3hYhgSOLZ3509hgSOLZ350aUw3XfVOm6StJPMv7JrsPcSiW5xsFu2D:3mO/j6O/jawcNSPqJ1SiB
TLSH
T1FC538D9CE1D59FBCD9E812BCA51A8D1FB7F74B85D7061E073012231678436BC32A589E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcsdk_dpv3.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
Size 36KB
SHA256 02f7e52c32f3da99fdec2d4ab4700b95f49199fc84dc91638ae76a89445f9fdf
MD5 d1f95c71520684259ee0db2df0271403
SHA1 4a0fae7a845a6939c7afbab0aba0fa2b75783c1e
SHA512 fc10f63c0c1a4802179da23a10884466139b2faba50bce6fc8344a11dcfbf091a71968a137aed270d7fea7aefdf3be6888ce66c5fc6f626ae7cc7ffa5a193baf
SSDEEP 768:hqg6/bAFhHDB9SYBazRdBMImkO8N7h+iDbPnPSmAE:pAbA7HDB9SYBUskO8J1Pd
TLSH
T134031496BBF90558F6F72F6569B969944C7ABDD22C08D4EC01602C8E0932F90EDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2904-10001-0x0000000000E30000-0x0000000000E38000-memory.dmp

Download

memory/2904-10024-0x00000000057D0000-0x00000000057F6000-memory.dmp

Download

memory/2904-10021-0x0000000005760000-0x000000000576A000-memory.dmp

Download

memory/2932-9195-0x00007FFE1FB60000-0x00007FFE200EE000-memory.dmp

Download

memory/2932-9192-0x00007FF61ED70000-0x00007FF61F131000-memory.dmp

Download

memory/2932-9193-0x00007FFE20990000-0x00007FFE21600000-memory.dmp

Download

memory/2932-9197-0x00007FFE1C130000-0x00007FFE1CB9D000-memory.dmp

Download

memory/2932-9196-0x00007FFE17EC0000-0x00007FFE19C6E000-memory.dmp

Download

memory/2932-9198-0x00007FFE1DDF0000-0x00007FFE1F916000-memory.dmp

Download

memory/2932-9194-0x00007FFE20460000-0x00007FFE205A5000-memory.dmp

Download

memory/3848-487-0x00007FFE22230000-0x00007FFE227BE000-memory.dmp

Download

memory/4372-9226-0x00007FFE20460000-0x00007FFE205A5000-memory.dmp

Download

memory/4372-9227-0x00007FFE20990000-0x00007FFE21600000-memory.dmp

Download

memory/4372-9231-0x00007FFE1C130000-0x00007FFE1CB9D000-memory.dmp

Download

memory/4372-9228-0x00007FFE1DDF0000-0x00007FFE1F916000-memory.dmp

Download

memory/4372-9229-0x00007FFE1FB60000-0x00007FFE200EE000-memory.dmp

Download

memory/4372-9230-0x00007FFE17EC0000-0x00007FFE19C6E000-memory.dmp

Download

memory/4372-9225-0x00007FF61ED70000-0x00007FF61F131000-memory.dmp

Download

memory/4476-9142-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/4476-9132-0x00007FFE17EC0000-0x00007FFE19C6E000-memory.dmp

Download

memory/4476-9128-0x00007FFE21340000-0x00007FFE21485000-memory.dmp

Download

memory/4476-9141-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/4476-9140-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/4476-9139-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/4476-9138-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/4476-9137-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/4476-9136-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/4476-9131-0x00007FFE20020000-0x00007FFE205AE000-memory.dmp

Download

memory/4476-9130-0x00007FFE1C130000-0x00007FFE1CB9D000-memory.dmp

Download

memory/4476-9129-0x00007FFE1ECB0000-0x00007FFE1F920000-memory.dmp

Download

memory/4476-9133-0x00007FF61ED70000-0x00007FF61F131000-memory.dmp

Download

memory/4476-9143-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/4476-9135-0x00007FFE04A60000-0x00007FFE04A70000-memory.dmp

Download

memory/4476-9134-0x00007FFE1D180000-0x00007FFE1ECA6000-memory.dmp

Download

memory/4476-9144-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/4476-9145-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/5084-9312-0x00007FF61ED70000-0x00007FF61F131000-memory.dmp

Download

memory/5084-9314-0x00007FFE1FB60000-0x00007FFE200EE000-memory.dmp

Download

memory/5084-9316-0x00007FFE20990000-0x00007FFE21600000-memory.dmp

Download

memory/5084-9318-0x00007FFE1C130000-0x00007FFE1CB9D000-memory.dmp

Download

memory/5084-9313-0x00007FFE20460000-0x00007FFE205A5000-memory.dmp

Download

memory/5084-9315-0x00007FFE1DDF0000-0x00007FFE1F916000-memory.dmp

Download

memory/5084-9317-0x00007FFE17EC0000-0x00007FFE19C6E000-memory.dmp

Download

memory/6660-9260-0x00007FFE1C130000-0x00007FFE1CB9D000-memory.dmp

Download

memory/6660-9258-0x00007FFE1FB60000-0x00007FFE200EE000-memory.dmp

Download

memory/6660-9256-0x00007FFE1DDF0000-0x00007FFE1F916000-memory.dmp

Download

memory/6660-9259-0x00007FFE17EC0000-0x00007FFE19C6E000-memory.dmp

Download

memory/6660-9255-0x00007FFE20990000-0x00007FFE21600000-memory.dmp

Download

memory/6660-9254-0x00007FF61ED70000-0x00007FF61F131000-memory.dmp

Download

memory/6660-9257-0x00007FFE20460000-0x00007FFE205A5000-memory.dmp

Download

memory/6664-9165-0x00007FFE17EC0000-0x00007FFE19C6E000-memory.dmp

Download

memory/6664-9176-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/6664-9175-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/6664-9174-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/6664-9173-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/6664-9172-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/6664-9171-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/6664-9170-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/6664-9169-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/6664-9168-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/6664-9166-0x00007FFE1C130000-0x00007FFE1CB9D000-memory.dmp

Download

memory/6664-9164-0x00007FFE1FB60000-0x00007FFE200EE000-memory.dmp

Download

memory/6664-9163-0x00007FFE20460000-0x00007FFE205A5000-memory.dmp

Download

memory/6664-9160-0x00007FF61ED70000-0x00007FF61F131000-memory.dmp

Download

memory/6664-9161-0x00007FFE20990000-0x00007FFE21600000-memory.dmp

Download

memory/6664-9177-0x00007FFE02B80000-0x00007FFE02B90000-memory.dmp

Download

memory/6664-9162-0x00007FFE1DDF0000-0x00007FFE1F916000-memory.dmp

Download