3cb6d3f2237d6b9ff3a903de28d5ac3c691db1685f0cc67bc4070cca11b09a30

Analysis

user interaction
yes
max time kernel
97s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-es
resource tags

arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
27/08/2026, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20260827_wps_office_inst.doc.exe
Size 5.5MB
Sample260827-g1659sysbw
SHA256 3cb6d3f2237d6b9ff3a903de28d5ac3c691db1685f0cc67bc4070cca11b09a30
MD5 d23bbf6f75142b9a5cf8aeaa686feb9e
SHA1 7e415afa83b52ea1c38bac41198840c767e22c2a
SHA512 a4eb78303b387b9da9383d943dc06b9e615a68054276ffa41cfdb382db40c2fdff09c59d0abbb63ca4c96819042218e5d63b73b93ed043e1ef589521ba2c8059
SSDEEP 98304:umZ3eGE9jD37+nOlsYf3Njm2f6OFhKvszGZ9pDjAB/qZ:1uGE9/IOlbBRhKvn9pXApqZ
TLSH
T13946B012FB8680F1E5D101B0547BBB76583DAA284B2489D7E7D12E7588302D37A3BB5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2072	ksomisc.exe

Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
File opened for modification	\??\PhysicalDrive0	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
File opened for modification	\??\PhysicalDrive0	ksomisc.exe
File opened for modification	\??\PhysicalDrive0	ksomisc.exe
File opened for modification	\??\PhysicalDrive0	20260827_wps_office_inst.doc.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	20260827_wps_office_inst.doc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe

Executes dropped EXE 9 IoCs

pid	Process
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
3380	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
3532	ksomisc.exe
2112	ksomisc.exe
4616	ksomisc.exe
1696	wpscloudsvr.exe
1272	ksomisc.exe
800	wpscloudsvr.exe
3156	ksomisc.exe

Loads dropped DLL 64 IoCs

pid	Process
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
2112	ksomisc.exe
2112	ksomisc.exe
2112	ksomisc.exe
2112	ksomisc.exe
2112	ksomisc.exe
2112	ksomisc.exe
2112	ksomisc.exe
2112	ksomisc.exe
2112	ksomisc.exe
2112	ksomisc.exe
2112	ksomisc.exe
2112	ksomisc.exe
2112	ksomisc.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wpscloudsvr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ksomisc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpscloudsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ksomisc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpscloudsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20260827_wps_office_inst.doc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ksomisc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ksomisc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ksomisc.exe

Modifies system certificate store 2 TTPs 64 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\FlightRoot	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\Homegroup Machine Certificates\CRLs	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\FlightRoot	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\FlightRoot	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\Homegroup Machine Certificates\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CRLs	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\Homegroup Machine Certificates\CTLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\Homegroup Machine Certificates\CTLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CTLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\FlightRoot	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\Homegroup Machine Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\Homegroup Machine Certificates\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\Homegroup Machine Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\TrustedDevices	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\Homegroup Machine Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\TrustedDevices	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\TrustedDevices	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\TrustedDevices	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	ksomisc.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\SystemCertificates\TestSignRoot	ksomisc.exe

Suspicious behavior: AddClipboardFormatListener 5 IoCs

pid	Process
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
3532	ksomisc.exe
2112	ksomisc.exe
4616	ksomisc.exe
1272	ksomisc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4200	20260827_wps_office_inst.doc.exe
4200	20260827_wps_office_inst.doc.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
3380	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
3380	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
3380	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
3380	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
3380	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
3380	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
3380	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
3380	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
3380	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
3380	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
3380	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
3380	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
3532	ksomisc.exe
2112	ksomisc.exe
2112	ksomisc.exe
2112	ksomisc.exe
2112	ksomisc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Token: SeRestorePrivilege	2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Token: SeRestorePrivilege	2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Token: SeRestorePrivilege	2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Token: SeRestorePrivilege	2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Token: SeDebugPrivilege	3532	ksomisc.exe
Token: SeLockMemoryPrivilege	3532	ksomisc.exe
Token: SeDebugPrivilege	2112	ksomisc.exe
Token: SeLockMemoryPrivilege	2112	ksomisc.exe
Token: SeDebugPrivilege	4616	ksomisc.exe
Token: SeLockMemoryPrivilege	4616	ksomisc.exe
Token: SeDebugPrivilege	1272	ksomisc.exe
Token: SeLockMemoryPrivilege	1272	ksomisc.exe
Token: SeDebugPrivilege	3156	ksomisc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
3532	ksomisc.exe
3532	ksomisc.exe
2112	ksomisc.exe
2112	ksomisc.exe
2112	ksomisc.exe
2112	ksomisc.exe
4616	ksomisc.exe
4616	ksomisc.exe
4616	ksomisc.exe
1272	ksomisc.exe
1272	ksomisc.exe
4616	ksomisc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 2404	4200	20260827_wps_office_inst.doc.exe	94
PID 3380 wrote to memory of 3532	3380	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe	98
PID 3380 wrote to memory of 2112	3380	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe	99
PID 3380 wrote to memory of 4616	3380	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe	100
PID 2404 wrote to memory of 1696	2404	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe	101
PID 3380 wrote to memory of 1272	3380	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe	159
PID 3380 wrote to memory of 3156	3380	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe	105

C:\Users\Admin\AppData\Local\Temp\20260827_wps_office_inst.doc.exe
"C:\Users\Admin\AppData\Local\Temp\20260827_wps_office_inst.doc.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4200
- C:\ProgramData\WPS\Installers\96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
  "C:\ProgramData\WPS\Installers\96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -curlangofinstalledproduct=es_ES -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe
    "C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" InstallService
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    PID:1696
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -regmtfont
    3⤵
    PID:2524
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\\office6\ksomisc.exe" -setappcap
    3⤵
    PID:2952
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -sendinstalldyn 5
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\\office6\ksomisc.exe" -assoepub -source=1
    3⤵
    PID:4000
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\\office6\ksomisc.exe" -registerqingshellext 1
    3⤵
    PID:1472
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\addons\html2pdf\html2pdf.dll"
    3⤵
    PID:3052
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -regmso2pdfplugins
    3⤵
    PID:4392
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
      4⤵
      PID:2028
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
      4⤵
      PID:1764
    - - C:\Windows\system32\regsvr32.exe
        
        /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
        5⤵
        
        PID:2396
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -regPreviewHandler
    3⤵
    PID:1272
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\\office6\ksomisc.exe" -assopic_whitelist -type=setup -direct=on|.gif,0|.jfif,0|.jpe,0|.jpeg,0|.jpg,0|.png,0|.webp,0|.wmf,0 -optional=on|.ai,0|.arw,0|.bmp,0|.cr2,0|.cr3,0|.crw,0|.dng,0|.emf,0|.heic,0|.ico,0|.mrw,0|.nef,0|.orf,0|.pbm,0|.pcx,0|.pef,0|.pgm,0|.ppm,0|.psb,0|.psd,0|.raf,0|.ras,0|.rw2,0|.tga,0|.tif,0|.tiff,0|.wap,0|.wbm,0|.wbmp,0|.wdp,0|.x3f,0|.xbm,0|.xpm,0
    3⤵
    PID:3956
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\\office6\ksomisc.exe" -defragment
    3⤵
    PID:4424
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe" /prometheus /download_lang_on_start /lang=es_ES /from=get_start_with_wps_after_install_onlinesetup
  2⤵
  PID:4632
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wps.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wps.exe" /prometheus /download_lang_on_start /lang=es_ES /from=get_start_with_wps_after_install_onlinesetup
    3⤵
    PID:4928
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpscloudsvr.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpscloudsvr.exe" /qingbangong /start_from=qingipc /qingbangong /start_from=kstartpage silentautologin
      4⤵
      PID:4760
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -collectfileassoinfo -module=1;2;4;8 -daily -source=2
        5⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -getabtest -forceperusermode
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe" /messagepush /PushType=mipush /From=Qing
        5⤵
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpscloudsvr.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpscloudsvr.exe" /messagepush /PushType=mipush /From=Qing
        6⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -getonlineparam -forceperusermode
        5⤵
        
        PID:2484
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe" /krecentfile /init /From=Qing
        5⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpscloudsvr.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpscloudsvr.exe" /krecentfile /init /From=Qing
        6⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wps.exe" Run -User=Admin "\"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kwinappinstaller.exe\"" -u "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\systemshareext" ksystemsharehostzhCN ksystemsharehostenUS ksystemsharehostzhHK ksystemsharehostjaJP
        5⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wps.exe" Run -User=Admin "\"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kwinappinstaller.exe\"" -u "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6" ksystemsharehostzhCN ksystemsharehostenUS ksystemsharehostzhHK ksystemsharehostjaJP
        5⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kwinappinstaller.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kwinappinstaller.exe" -u "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6" ksystemsharehostzhCN ksystemsharehostenUS ksystemsharehostzhHK ksystemsharehostjaJP
        5⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kwpswnsserver.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kwpswnsserver.exe" checkrt
        5⤵
        
        PID:5464
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wps.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wps.exe" Run -Entry=EntryPoint "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.23196/office6/addons/kcef/jsapibrowser.dll" --server=browser.a3ba19ec797144349ea5dbc1b742aca1.23196.e3afed0047b08059.high.dpi1.pipe --rendererswitchflag=0 --from=wpsoffice
      4⤵
      PID:5116
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\promecefpluginhost.exe
        
        "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.23196/office6\promecefpluginhost.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\debug.log" --mojo-platform-channel-handle=2244 --field-trial-handle=2204,i,21944132856773383,3153934915440307027,131072 --disable-features=TSFImeSupport /prefetch:2
        5⤵
        
        PID:2816
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\promecefpluginhost.exe
        
        "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.23196/office6\promecefpluginhost.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\debug.log" --mojo-platform-channel-handle=1736 --field-trial-handle=2204,i,21944132856773383,3153934915440307027,131072 --disable-features=TSFImeSupport /prefetch:8
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.231\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.231\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=5116 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.23196/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.23196.e3afed0047b08059.high.dpi1.pipe --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\debug.log" --js-flags=--expose-gc --lang=en-US --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3284 --field-trial-handle=2204,i,21944132856773383,3153934915440307027,131072 --disable-features=TSFImeSupport /prefetch:1
        5⤵
        
        PID:3024
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.231\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.231\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=5116 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.23196/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.23196.e3afed0047b08059.high.dpi1.pipe --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=en-US --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3364 --field-trial-handle=2204,i,21944132856773383,3153934915440307027,131072 --disable-features=TSFImeSupport /prefetch:1
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.231\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.231\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=5116 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.23196/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.23196.e3afed0047b08059.high.dpi1.pipe --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=en-US --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3400 --field-trial-handle=2204,i,21944132856773383,3153934915440307027,131072 --disable-features=TSFImeSupport /prefetch:1
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.231\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.231\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=5116 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.23196/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.23196.e3afed0047b08059.high.dpi1.pipe --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=en-US --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3460 --field-trial-handle=2204,i,21944132856773383,3153934915440307027,131072 --disable-features=TSFImeSupport /prefetch:1
        5⤵
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.231\office6\wps.exe
        
        "C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.231\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMzE5NlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=5116 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.23196/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.23196.e3afed0047b08059.high.dpi1.pipe --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=en-US --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3376 --field-trial-handle=2204,i,21944132856773383,3153934915440307027,131072 --disable-features=TSFImeSupport /prefetch:1
        5⤵
        
        PID:5128

C:\ProgramData\WPS\Installers\96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
"C:\ProgramData\WPS\Installers\96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -curlangofinstalledproduct="es_ES" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E58CFBF -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\
1⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -setlng es_ES
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3532
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -getonlineparam 00601.00001133 -forceperusermode
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2112
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -getabtest -forceperusermode
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4616
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -setservers
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1272
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -register
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3156
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
    3⤵
    PID:1084
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
    3⤵
    PID:5024
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
      4⤵
      PID:1032
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -regprogid true
  2⤵
  PID:116
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -assoword
  2⤵
  PID:3504
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -assoexcel
  2⤵
  PID:2732
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -assopowerpnt
  2⤵
  PID:1980
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -compatiblemso -source=1
  2⤵
  PID:1608
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -checkcompatiblemso
  2⤵
  PID:1992
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -saveas_mso
  2⤵
  PID:432
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -distsrc 00601.00001133
  2⤵
  PID:2228
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode -source=1
  2⤵
  - Network Service Discovery
  PID:2072
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk" 5386
    3⤵
    PID:2804
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -regvascontextmenushellnew
  2⤵
  PID:2216
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -regpersistprintmenu
  2⤵
  PID:4648
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -updateskiaconfig
  2⤵
  PID:3160
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -externaltask create -forceperusermode
  2⤵
  PID:2228
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wps.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wps.exe" Run "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\addons\ktaskschdtool\ktaskschdtool.dll" /task=wpsexternal /createtask
    3⤵
    PID:3388
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wps.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wps.exe" CheckService
      4⤵
      PID:180
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wps.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wps.exe" Run -User=Admin -Entry=EntryPoint "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.23196/office6/addons/ktaskschdtool/ktaskschdtool.dll" /user=Admin /task=wpsexternal /cleantask /pid=3388 /prv
      4⤵
      PID:1520
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -createsubmodulelink startmenu prometheus -source=1
  2⤵
  PID:1284
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -createsubmodulelink startmenu pdf -source=1
  2⤵
  PID:1956
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -createsubmodulelink startmenu wps -source=1
  2⤵
  PID:4012
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -createsubmodulelink startmenu et -source=1
  2⤵
  PID:700
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -createsubmodulelink startmenu wpp -source=1
  2⤵
  PID:2784
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -createsubmodulelink desktop pdf -source=1
  2⤵
  PID:1284
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -createsubmodulelink desktop prometheus -source=1
  2⤵
  PID:3984
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -createCustomDestList
  2⤵
  PID:2416
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kwpsmenushellext64.dll"
  2⤵
  PID:224
- - C:\Windows\system32\regsvr32.exe
    /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kwpsmenushellext64.dll"
    3⤵
    PID:3372
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -setup_assopdf -source=1
  2⤵
  PID:3392
- - C:\Windows\SysWOW64\openwith.exe
    "C:\Windows\SysWOW64\openwith.exe"
    3⤵
    PID:1792
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpsupdate.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpsupdate.exe" /from:setup
  2⤵
  PID:3816
- - C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe
    "C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" CheckService
    3⤵
    PID:3160
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpsupdate.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpsupdate.exe" -createtask
  2⤵
  PID:1452
- - C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe
    "C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" CheckService
    3⤵
    PID:3628
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -createexternstartmenu "WPS Office"
  2⤵
  PID:928
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -pintostartscreen -source=1
  2⤵
  PID:2836
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kstartscreenpinchecker64.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kstartscreenpinchecker64.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Office.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Writer.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Presentation.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Spreadsheets.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk"
    3⤵
    PID:4300
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Office.lnk" 51609
    3⤵
    PID:3032
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk" 51609
    3⤵
    PID:2608
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Writer.lnk" 51609
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Presentation.lnk" 51609
    3⤵
    PID:3160
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Spreadsheets.lnk" 51609
    3⤵
    PID:3040
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk" 51609
    3⤵
    PID:2388
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Writer.lnk" 51606
    3⤵
    PID:116
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Presentation.lnk" 51606
    3⤵
    PID:1412
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Spreadsheets.lnk" 51606
    3⤵
    PID:4256
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk" 51606
    3⤵
    PID:3476
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -rebuildicon
  2⤵
  PID:5116
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -reportAssoInfo -forceperusermode
  2⤵
  PID:3224

C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe
"C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" LocalService
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:800

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpscloudsvr.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpscloudsvr.exe"
1⤵
PID:1796

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpsupdate.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpsupdate.exe"
1⤵
PID:3484
- C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe
  "C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" CheckService
  2⤵
  PID:2616

C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe
"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\\ksolaunch.exe"
1⤵
PID:212
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wps.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wps.exe"
  2⤵
  PID:4948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

616AD1AB067CFD351D6C0EF6F3E12F40

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40
Size 1KB
SHA256 8cfd849d45eb825cb298aa8ade9bdde9b786c3ad18d148e2930245f997f8c83a
MD5 af8e135593c1e8468714e53bb835f0d4
SHA1 9d14d181f222dd0fbe1efc6de127fb2918067aee
SHA512 3e4a8717f2ebce3f42df609766dae0fe25648611af69e5cb93260019ada8304f95fac2d88c822de04a29ee1fd12c2be8b010f084804110c45c22e25a53e8712a
TLSH
T11B11DD4A05542A27B90A2E70DCCACCA7ADF1B38A82919C4BD75089C145A3BC41E8C4BD
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_660CACFBF957CBCC19C054A0402E41C3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_660CACFBF957CBCC19C054A0402E41C3
Size 727B
SHA256 958da9400db8d2202d6ccd6c4e6529e0106dfa233d3673842ea8cfd4eff94cdc
MD5 e75e26c25e4152bd6fb842e050a51026
SHA1 a9ea7f9584d40c7321fd206d028e545bb823696d
SHA512 a0d5189705ebab57f8299da9d41428d8cff17c519b55ecb9dc9ef858d1567bb7a96d4187632b2d95956b91e9683571b6f77a0896c519d88027ba012b59e882d1
TLSH
T15601600875265AE3898ADCA00DE4B124758383B0164E8B4EEE3A00A641803BA2F1AE70
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 1f5ee77c64261bf5b920cbdf6cac5d2c23fb36c5e194f4737d0c5909e74152bd
MD5 02038e7d7fa8a213fbc922bbda0df5e3
SHA1 b2690bd396861de44a468eef3128daef9daf55ef
SHA512 8fbe24010c0ee17d32e43c727c2226dfd5762d97f5143c2c0b29c78deb8705c927f67020beb0d17044711ec0dd2a69eaf95840f70a2488bae419481d80faec32
TLSH
T126016042682CAE1878217C0346CCC4FCBE91C2E96888C9A501EC049EC1ECF65B99B409
MD5 SHA1 SHA512 TLSH

Submit Download

616AD1AB067CFD351D6C0EF6F3E12F40

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40
Size 252B
SHA256 405e7970e25783273e987456a23fc75735cb943e3e56d6919d26c12837ba2b56
MD5 9e000642fba1d47071ffcc7957a7c6d3
SHA1 6bfa26be8203c66a428b6fa36765d1b85efaaeaf
SHA512 364f6d0665d4e1b44e8757a0cd019b184fb3ca133e7f1dfbde283e298d3e232d00be5b87d84d6d7dc53430fd82ecce0458a2ceb4e2bd97b151362e7bdd03b59e
TLSH
T17AD02310B7E61311F15410792F600581FB1475279805CB191B5E020F0C1DF404F31506
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_660CACFBF957CBCC19C054A0402E41C3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_660CACFBF957CBCC19C054A0402E41C3
Size 404B
SHA256 e7bcfa7936c77f35a66f7e8ea7b1079bd233647d4e2a70a9cb2841f5334b317e
MD5 1c39d317adc3c033391586b8f4e86d68
SHA1 154b2814114430bfc49524b6864e81b1986cc0c4
SHA512 046912196c5ab090bcd25473b0a85c10f2e637e9ae8e6e7c4f65b983af67eebfefc62646974a33188c0da81d8169c4bfe8f6b59f54387479838e1bac824cb6ab
TLSH
T12BE0C63823FA85A9F0F0D03842EB9C22088DF60A010ACBBC07A0120AAB29E000CE2620
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 f7391d9eb3ce0e6a60d53ac3e0cdab372aa045e71aedf254fe50dbef13d6734f
MD5 cc65108947ba72ee6ceb9584c04e22c2
SHA1 e419778505226f8b2289563ab7fff07d46133f5d
SHA512 3603de5aeb4e3b350372c03d2519cb4d0588057abd57e1574e4ce51937b5145487b4e4d6eacf82487f24ac9096556f273b16b7620fa33913159d493f6f9598f1
TLSH
T138E0682C21EBB91EF0509C3542F5A1B21D59E2051104C37916C18308B71BF406C30AB4
MD5 SHA1 SHA512 TLSH

Submit Download

Qt5NetworkKso.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\Qt5NetworkKso.dll
Size 1.1MB
SHA256 e516dbe63a0b57f21c4cae2350a39c62dfb5b13650f0ca1ad74c2ba3a9aa72c4
MD5 3472b66c2a4acd21968108b56d2c687b
SHA1 a4e5118dee0f556ebd1b539c5615ef1557d356a9
SHA512 d442796ea1a9ab3a87ce1ef4655a1a04b4b04420ee3d6b5d45e4ab2775220cd81322acd9695bc7f470d113fe2dd744ae17fcaefa926b15c9cb25f081f6ea0833
SSDEEP 24576:jjAcWxiAenqLvATU5hNfgv+O6vZ+K9Lr0amOyM2g:jyXeqLvATU3Nf0+0KBBN
TLSH
T18F354A6FFA018635F8935172C6E9FFAAA02C9421431B63D7F748BF145570AD26A3F182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5XmlKso.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\Qt5XmlKso.dll
Size 170KB
SHA256 7f0c65a44653d92ee6ece93ebf86d0661d2f7b602ffd41be50c09d3cf5d20968
MD5 d46eab9d59dc4cd341dc9075b84bf7b8
SHA1 3ab30e9b5f5269d3d901268b4a3f2acb7a7f7807
SHA512 d5316c6050e2134adf0ffd4f4151c3171d7416956fbcda29da91820b57c1889d8d8d79211f4003a95673121e5c87f647561852f076d7063a7be92e44cdc8ec72
SSDEEP 3072:jj55786gnSipAjpDhhrtzdlmlUAFriVClc62oRZntWQEWk:3557gnSipAxHiiVkc62UAQdk
TLSH
T1AA041863F806836AF57282315CEAA56EF5ABDD19033903C3F6497B2709746C21A3F1D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\addons\kstartpage\mui\default\productkey\html\run.ini
Size 171B
SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
MD5 b30cb271e143eace0f55ea2e562e1e9f
SHA1 9d97dbf24931cfc114384c3f4dbbae21c9e51be5
SHA512 dc593185fa63b458024c3a913c558e5686806154181dea67eec786ada50595c53bab822833ad1e76c9acdf21be3eba50631391b7e575d7f1f6409ceccf966535
TLSH
T1AAC080D4D0256F97DC31C6B5ED54AF1A7560E700251C1EC3D530DC4E9E9696551C805D
MD5 SHA1 SHA512 TLSH

Submit Download

kwppcopilotentry.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\addons\kwppcopilotentry\mui\pt_BR\kwppcopilotentry.qm
Size 334B
SHA256 984ebeef80f6f50907afb92e5b5ae72df49fce045552c118a77a8887cc98e19b
MD5 2b42be10ddde43a0b6c2e461beae293a
SHA1 53888c4798bc04fdfc5a266587b8dc1c4e0103f3
SHA512 be3ebd02d37de367200696351fb5f9cd0ec4c206c3a33f281cb8b62386457a30a899322798c63a0d495577393e47258994feb7f8e2445645f552c2b7a2de6778
MD5 SHA1 SHA512

Submit Download

history.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\addons\qing\mui\default\res\clouddiskhomepage\static\js\default\history.js
Size 198KB
SHA256 632f2d1136280eaed004b7231ae90ed76bbd06c25f73d900873abc1c6ae71769
MD5 d79cca3c379636510ddd6adc09a31d51
SHA1 6470c9569dcbd7b2ef0c75549799ef3c93fbf523
SHA512 1f066715066c6125e7556455f67eccdafcfb0a15642c25425c865c6def6ea3dae819018fa8d2abdcf9eca53de94c49f1310bd1c7883247f84a6043df03e1f80d
SSDEEP 3072:nEXIajlB1Y5cXuKkx9XcZpxOMKLm4j22creMSMikF:nEXR71ocXuKkxqMbm4jpMX
TLSH
T10314F68DB296B07507E720B4412F150BF27AAD69680E85D0F235E8E97DB884D917BF3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.cfg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\cfgs\setup.cfg
Size 456B
SHA256 ff445cf361df14616040107d93e99be5a3862b5ad20ec3488452a1a42b2e076d
MD5 618e2afe10b4ca35a39bd33783032a54
SHA1 bf59f276b85586765000ee4230d437ef5f60a9d2
SHA512 b8f078ef783de19f81152dcdd66007aa787d4b7dbe90d660843f0ae40a944a38eaea829a53b22595b3bb04b272fd58f41a5aca71edbe8668b71e5c205cbdf1cd
TLSH
T149F027AB030270752B61971410B524E2A7F602C9255A880E116898496B2EC3D81BD136
MD5 SHA1 SHA512 TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\dbghelp.dll
Size 1.2MB
SHA256 c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f
MD5 4003e34416ebd25e4c115d49dc15e1a7
SHA1 faf95ec65cde5bd833ce610bb8523363310ec4ad
SHA512 88f5d417377cd62bde417640a79b6ac493e80f0c8b1f63a99378a2a67695ef8e4a541cedb91acfa296ed608e821fee466983806f0d082ed2e74b0cd93eb4fb84
SSDEEP 24576:9AkmijauMug/iyFzb2DfsPV8A4C2vNI1cPdf8xZLGNfav9T:9WiOuRg/iyFzb2QN83XfeYaZ
TLSH
T12D453B31E641817DCCE731F656BD323D266CAAB2130422C722C81FF99B666E17E3459B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kbase.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kbase.dll
Size 290KB
SHA256 8f2e14188b7049e4aa82f0091fff676b8080b8784552137334b72f7bbe124473
MD5 dec1d7924d84582a4e2eb7963bf0345d
SHA1 3716166df97a4309086393a924846a6cff36f6b4
SHA512 da30ba09d7f1906468d01cf59c5df6c130b353a592afa29a89b6ccae392f97a8abae577a6548e8e17446fdd99719cf99721aaa3979cf9128d5eb8d11aaf14dcb
SSDEEP 6144:+rSL9e1KkQnzx47D5Hc1CCHXeA6iITcebI+irswuCz:+mLk1KHac1BHXJ7IK+xwuCz
TLSH
T133547D727606853AC9CF02B0182D87BED47586A52F77C0C3F3986D6D6A229D30F35D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kbaseconfigcenter.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kbaseconfigcenter.dll
Size 794KB
SHA256 03bd526b273a3aa87c0a0710276c48903450c6822e58fddd3d7c7bf634f774c0
MD5 06daecddf01ac3e67c5bf093dc3e0acd
SHA1 0ba2d918f504cff179c1dcf5c439482200aa931b
SHA512 44ef426c261dc3d08cb2e5634284663433c58e33b22cd8c07b87b1c356020b3fcda32b351698800e18cab48f434c4babdfbee56b84966021f6d4dee0971c6af0
SSDEEP 12288:ZmIKM9gOyh8p+rZj5JWeTaJwPxTJjftncYnv4i2DlSHQO+OeO+OeNhBBhhBBau7i:Z05h5j5JWe0w9cYelSwu3ZeA7
TLSH
T104059D70794AD531E9AD00F11D38AFEF94BDAD640B7486DBA3C86B3A89301D11B37E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdesign.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kdesign.dll
Size 907KB
SHA256 a82d5eedd4f7c155b926fdb27fbd88e6ae53f1d24a48f49ce35662755fde0bb1
MD5 0f7c59e14ac1dbfddd86ab14adbafda7
SHA1 09578ea2da19409108e0eac568642deed485b793
SHA512 c149c090623f3f0d6d3114a0bd235f065b23e8d2ef2e0a989fc9aef0242d3e7c11f76988420dff9bf195d8eebb24cb18242b4f3ab771bf03bef4f616e25814a0
SSDEEP 24576:EuGEvB3uAugKM5ax0ZmvOnGUV4M9KSsSOlD1ExppJ0:ii3uAugKM5ax0ZmvOGUV4M9KSJKD1EpG
TLSH
T14C157D23EE068379D7FD933009C44355E3BADC2106A2475FB94DFBA925B96E38A19343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krt.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\krt.dll
Size 1.2MB
SHA256 332e4117eaa6bc0d86f58d880cb413639d140d3fffac02f55ccfc9c35b1db145
MD5 745c19b9bba7f5a57d4201c75b7b9d2a
SHA1 49cc5ebf80605a65cfc792f8312ca54184e611e8
SHA512 81d95379879d49679f35dcaa1a482ff5a3fea14c93b43d3fed61ce3041ce8f19034b2460b75c647b1b0fad45e14eaaaeef63ab6b419373a4aad8f59249472a30
SSDEEP 24576:QjNVOq2t11Ss7voSQP57I76FY/Z5Wv6iWwG89Mij48:Agq2t11lotP57RY/Z5Wv6iWwGNij48
TLSH
T1FC456C33BA2DE237E75C24B07928679B502D9C74077653D7AA883AA934341C36773E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kshell.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kshell.dll
Size 24.4MB
SHA256 69ebabdfbde0101af884be1d663bb23292feeda5a41be5ff64ecf7cda3b056aa
MD5 afe2f4ad5018ba55eaf3bcbf3642a862
SHA1 adbe2f3ea4960f5b614e7b43d28f95c8947ebd04
SHA512 04f57d9703dfb7a7ea43a20276039811618ed918587235eb85bce23c7c773c6f43ae7d84b81330c3f4eac97edd629e9b7a3ef5d77a2d9b1544a413cded0aca3a
SSDEEP 786432:ggFI9EFYQmruoo6KcepStuFfk3D0U0jk5:ggFoEFYQm6oo6Kc4StuFfE0jg
TLSH
T1D2475B337774C63AE5A951F85928ABEA801CBCE10B6356C3E254FB9B28705C75B34B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kso.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kso.dll
Size 25.0MB
SHA256 e07a7977016d1d0e06ba699d62133b1f217cf867f0fc22c77837f74ab94a5611
MD5 88c15161edb31953b287ca0c1829fa43
SHA1 5a8f0a1292777dfd5bedc163fcfa8b6bfd8db2ab
SHA512 28d161163c77b3272063f065e77a9fe2503580b104cb5f8fd1cee8453ca9a940f3f89725a6d6c24f95cb3db32f3c244ad9b552ca8616eadef3b85c6a722f9511
SSDEEP 196608:D/UKxliN3LbNSSGIYszu8pIAVAQEWSGYg97+pKbohgqBr+ZAqLNUEU4KTGt:QKxkN3A832QEWSGYHpKMeqBZqbKTk
TLSH
T10F478E32B356C275DCA54170887E6F6F992D9E610B3985C7A6492F2D0C709D32F3AB0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksolite.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksolite.dll
Size 10.7MB
SHA256 3176c8729945ff3fadcdcf1556590c2f78f3211bf50a7dd036e01b75b3d74117
MD5 3c64bbd1b2c644ebf440b02c52458633
SHA1 d7d175c48a371634e66f33d228b2b2c8b97d48f5
SHA512 54fe07eb9a74344e2547c5d73b233579adbcd3517a163d5d70bace4b95383d99c1c75657f01ce2b63d2032151a8f0748a745b55f981432ec5ae22570b3e186fd
SSDEEP 98304:Sbd7PPI9BlmG0mvrn+M7pj2bKXgomvKY3cmASCA9sgRf3nsJiwH6j8BpRPqcL:ShbIwG0mvrn+GpjwKXgomvKY3vPh8nth
TLSH
T10FB64C637B098336F7DF31784C28A7E6501CDCAA0B2501D3F2AC6E6A55B05E71AB7613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksomisc.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
Size 3.4MB
SHA256 c4f99e39b7fc705eec256e095d5f03576def4dd6f4ca177c852021ea3755e1de
MD5 832a0c181a0b9ef431da655bb1659ac1
SHA1 7f779c117de8d3fe3cdf2ed0ccbf49ab7440fe60
SHA512 d4ef24609ca02900cdc12622178d2d5cac1ef473003e93fdacd63070c0fbdd013e0425093abc1bc4d10473b514ba205068fb37155dbde7471fa0492b7d721199
SSDEEP 98304:yBi6Jt14pw6e8uFUtd0hYWigHEgUAESeW7++gxUjyMZeXoAL:B6JL4p3uFUQKWx7PTZG
TLSH
T14EF56BA6F70D8135E971D1745A78ABA7803CBC38DB6A42C7B1843F9E15705C2A931E3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ent_background_2019_wpsoffice.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\mui\ja_JP\resource\splash\hdpi\2x\ent_background_2019_wpsoffice.png
Size 236KB
SHA256 5e7ba996d2331f37b9799767c0fa806cab9a39fea434796ab08dcaf39096e334
MD5 c5ad1903526a9ca4c2f55cfea1e22778
SHA1 9c7b9ba9100a919cad272fb85ff95c4cde45de9f
SHA512 e482142e81fbe71666b40f7a2c53702b4278436a0240e0f56200443cf4235d9942cccc3545cc01486d53a0972be553cbf93442e8b05de7b4fcd1fe8a4ec16bb4
SSDEEP 6144:VP27xIj3rgLFbuLG0QxhCi5+sfi/32bGY1ZR:QmjSqLG0Qb/+oi/32bGY1b
TLSH
T1DA340107CAF664D76412125C83C6C4A2150C14BEE560CFFBE5A7DDEF26913A12EA2C9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsprintersupport.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\qt\plugins\printsupport\windowsprintersupport.dll
Size 71KB
SHA256 6d7e642ab312956b8532282234910020cac46bbc49c1ef6853a8186bfa30d436
MD5 358db8de9b6a9f63edee941df6b72a5b
SHA1 6811f90543303d0d09124b870b69976648e7aecb
SHA512 de0ad7104a8e965fb2f772c2f8b400a0e21b8737e0d3337537cb63d25da005c7f0ef1c1cb3a7e6b51ccf26ec2134041aded44cb06bbde5721f2dbf210b6e2e8a
SSDEEP 1536:IbcV5m/XHwbs+1jZhDUTVwIXtIf28CQlet5NLg9g7ak76Q:ScV8/3wdUBwIIf28CQlet5Bg9gWkWQ
TLSH
T140636CC3D9004166EA97813125D9A316E53AB5600BE1C3C7774FA9C58E213D3FEBD39A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpscloudsvr.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpscloudsvr.exe
Size 1.0MB
SHA256 8592de1b80efd075d731d526f8400cc779fb5a02f09debc72cf4f3b1b10028ce
MD5 ceb2a8aed1e5d66c9979fee5c0c9a2cb
SHA1 3ac6a49f1d5a5cb32ccb2af009185e5d2d8df640
SHA512 f039525c7f1730ec7546bac05ed7490d70e5d85ea8e751fcd85397cc07bab0b49aa7f64ecc1b3b1761499c6214c1cc6c3ff7e874210331c3089ba393ba8d5183
SSDEEP 24576:GGRoNSYb9Bo/YIV7cz6G7B1hMnJAJaQ0ox1MZiY4v+lM:2boYPz6G7B1SnJAT0oxOZiYDlM
TLSH
T1CD358E607356D232D46180B20DB9EFAAA16CED295F7206CFA3C42F3D56356D22B31E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\utility\install.ini
Size 499B
SHA256 514656186e18e09dbe3efcf8c38934803b1eca3cdb39847809e51e441bcbcaa1
MD5 0714d37ce4fc179602d83b687b6a6ae7
SHA1 5f1fb78fe8a479016fde988be224613ef2bcecd5
SHA512 668801e71484fb6a4fdc07056133c9885a7568a7889c8048958b4d6df6b0e039e2916ef4764b5e64b2540b1e506f91ad79b19de3c485a1d405cd51418c470295
TLSH
T1A5F0590A0D94C66E35282298B0E3D6C1AAAF8E25194CA410D2D36E17FC03D2E117E05E
MD5 SHA1 SHA512 TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\utility\install.ini
Size 670B
SHA256 fba697594f2f878bfb0216a9d0ce26362be879547dd5e59999a32a1da2420be2
MD5 1879823186e6fc8634d0bba9b18355ca
SHA1 2d5a04a8d397417626a24f43c7f91684d9417816
SHA512 57a9403cbd87db666d47495d7cb534f6ed8522f5dd33098e9ec9e534adba6c7b1e5303f7daf75bf6eda7e9b529e8741132bfb78b16577b9bd4c1fe26bdea1cc6
TLSH
T137019E0A8D85C6AE351832C8A1D3C6D1AAEFCF641D4CA460D2A76E5BFC06D1E16BD05F
MD5 SHA1 SHA512 TLSH

Submit Download

API-MS-Win-core-xstate-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\API-MS-Win-core-xstate-l2-1-0.dll
Size 10KB
SHA256 144eb756de343fcb063034e9708cded52fe7f83ac3c94244a8de9baf95fe954a
MD5 b74d06f62cd28683b35052715273f70f
SHA1 28f0ff95c64faa31eafdc4e5e95cd7dbeb54ca22
SHA512 fd20a4342d365396c950b7a1c1b9672b4151fc1097af3abff6af9e0723f8bfb0628ac8cf3cdbae466fcb78ad5520ce5ef7a76d76a86f889dfa98b9a4d2fc032d
SSDEEP 192:yf5baWYhWqWWFYg7VWQ4eWK7J8p2kacqnajYYxye:yf5baWYhW6X8pUclM4y
TLSH
T1F4321A824ABC4043F5F7AE7057D9E9837C3CA3D72954825505A8F5AD2CD33C1AB10B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5CoreKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\Qt5CoreKso.dll
Size 5.1MB
SHA256 df7da12c96aef17ae7640ff38ee11d13b746eccaf7bfe53cd1956af9398f3169
MD5 b91d084c8772fff1c377f5e8ae3a948f
SHA1 a33f37613ac9cf4faf55e457f614e020d3b4bb34
SHA512 151db064fea8ad69f32ac43126ad1ebf04e0d15d1d39fbd9dd6935977252a9491580c0e9687c34963a4ca9b97a34c490f8906135217aaebbe9473498fc0a84d4
SSDEEP 98304:zmHBCG066jN+53hrUQ7kxJsv6tWKFdu9Cnvnl4rX+uHi8v:zWBCGN6o5evxJsv6tWKFdu9CnCa8v
TLSH
T1D9367DA2FE43C23EEEA54231C9FDAA9F4115AC15072202C76B9C771859759E13B3B34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5GuiKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\Qt5GuiKso.dll
Size 5.3MB
SHA256 c161c1a91ee9f07d1fc47d1b414057e555530d31cb54c538e08189401afe9bb0
MD5 56ac894f103b109dae1fb4d7eedf7ae4
SHA1 cd1e7e9175ad385d6c64ea71490f32d4a63eee98
SHA512 8f014aa3c229da3c7e3285fa1c112d550594375da5fc1364bd3062787126aef9de7189e953371b2e8fe0d82c81f7ea8c9ef42bed37d812128255e95cc9d3fa5d
SSDEEP 98304:oAne3f7gtUxvI0ISCR3b5y7Jdc+sy5yZP:LYfctU1I0r+5qJdYy5yZP
TLSH
T1B7462A91EC40732AD9B2A2B687DF15AF70A69D52C31483C3BD447B4485346FB1B3BA87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5SvgKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\Qt5SvgKso.dll
Size 392KB
SHA256 04e25b6feb73c3a3a2ae654b75c2a3887cd5f79799c248c7537515cec34ea31e
MD5 d1159a9b494fb44c560e635bfd1946ff
SHA1 c7b1dfdc84499626e13557916261752fa6e84416
SHA512 acccb90bcd4a67359903dadf5042bdd38e5ff01f66ffb1852dca3083dca05ae40497390f0aecb2d29a3dbc74feab2216632d9eeb6883d39c80a8acb7f42c0963
SSDEEP 12288:5BnQdgnrpfxSyn6U3GqHSg1nqg6vIDsiSrGjyMsjgBij1hmN7BKetQsIM1jgwKJ/:5BnQdgrNxH3u
TLSH
T112842B63F90D432DF042B33485AC369A553EC92093F983D77659BB2618786E35A37B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WidgetsKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\Qt5WidgetsKso.dll
Size 4.5MB
SHA256 4d4dd82c4b92ca239f2d6c2d988ddf3f378c308ea59b8f425eab9ccc5e2dc309
MD5 e46a6644c5cbd269a57ddb149396ae1f
SHA1 94c5cc3a11d828914a30bca57eb470969be7777b
SHA512 ad65798b2613a366b966e0708e897e95c24e5681cfd34a8c87dce7419a1074b31add99ec467411347f05e6db5396f7cfd64450dbfc602680beccf21694ad7e23
SSDEEP 49152:Sw99OhkJADjEKlP6qwsRGBYNQ0aFoy7Nrisqve9wbzhkafulJcgSnb+nJhgJ:Swh4AKlP6q9GvU3GafAcihk
TLSH
T19F265B23F94D8329E5D691338DEC6796A029DC15C73A53C77688BF1519B42E23A3F283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WinExtrasKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\Qt5WinExtrasKso.dll
Size 217KB
SHA256 03bf44f6fbdefa9c504dd57fe72086712f6686a56440acd6a12d1be15de662b3
MD5 aff2d3cf11639967d5476f24286ab582
SHA1 239a48597647c994c30111235069805b02b25dfc
SHA512 39235874cfc9f11ab54837b16273e66e6389478b2db6f6e311f60336e5816789bb9f7dc2817070cb8d98923040daf54055b5cd2bad5f8e80734039504f33c222
SSDEEP 3072:8S0mxfK+6LPq3jGdIVJwtoRaETHvAO2hcj7Z9BQWcWm:8Z8fh6TsjpVJbX7vAENlm
TLSH
T128240F4478DA933DF45174BD4FCAE2D8A21FB5F04BC24ABF396B534F42646422A3A871
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-console-l1-1-0.dll
Size 11KB
SHA256 1c057286bdf0cb90f7dd1fecf5e8afbcff1e27f2a94612967c0634ae639ca43d
MD5 b951011ba021c374455e8d1e18af84d2
SHA1 2d2e5e097ba5d92e6977cbb23afcc60b2e1d1c8c
SHA512 bc7007ea97647b53a62561c7eafdc292478e2d1dd9cad9f84a3641eba5a57184274fd992f08a18c7f9afa82d5c37a15b6058f147e88623d5d0f5b962931b3850
SSDEEP 192:p0cWYhW2WWFYg7VWQ4eW3Tux5DqnajuyG:DWYhWWvDli7
TLSH
T1F0321A978EFC9503F5A6AD7047D4E8837C3CA7C75A11A04915A9F6AD2C933C1EB0072D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-console-l1-2-0.dll
Size 11KB
SHA256 73e4264dd66696163fbbf868729841f2e9b86f5a59912e64fb9718a8c889a7aa
MD5 c26d7d913fd245afc0f0d658595447dc
SHA1 b5e00a0516b6c8c6f6a51ea40fae1beba3dd49ba
SHA512 f7e22751671ef8f5d9768cb96733377cd5f38cdf241503234f69c4c6ac9348416c1a7622d7008fc1323a8673359db9e0bef29a4fec7853c5b5fe0b94e294471a
SSDEEP 192:PKdtsWYhWhWWFYg7VWQ4uW9jQC8p2kacqnajYoCxI93:meWYhWf5C8pUclMvId
TLSH
T101321A834EFC8543F5E7AD704A94E8837C3DABC71614919525A8F55D2C933D2EB10B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-datetime-l1-1-0.dll
Size 10KB
SHA256 7ea1c2902a47fcd4a30180a4fe5ba5800fcad76b63da5ca4494e24954cea9bd3
MD5 7435c7831c7b3b47e55701e5c6cca67a
SHA1 8e0fcc170f5d66beea796b38cd544a045375204b
SHA512 453fde0df6bf8867dac38e1dd155300a4fb3ab88a20de3420f14ce2c05d890459b767671b23d21422c49ff1aebb9ea84b47bee0e2b2305a7af1314393de28267
SSDEEP 192:GWWYhWjWWFYg7VWQ4eWh5a0qyQ8p2kacqnajYYx2J:lWYhWRcaJ8pUclM42J
TLSH
T16F320A824EBC4143FAE76E7057A8D9837D3DA3DB2950815505A4F59D2C937C2EB10B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-debug-l1-1-0.dll
Size 10KB
SHA256 273516d86d92975ba14f0f85bdce5b81f75f8ba76e08e33575c67f34d7236775
MD5 d05f970cf2bdb0da0a1bf33cbc36b53d
SHA1 505b7e21e237d7f8c454bdfb37b19932ae6980d3
SHA512 62b843ea200fee7868482de417048458c304a218ccacf44b70e0026bafc5e37aec4e7ad2c93513cfdbaa06e5ced7a826fa4701d27d6fb9eb81f183335fa182d0
SSDEEP 192:3WYhWZWWFYg7VWQ4uWR8Leux5DqnajuyRwf:3WYhWXj5Dligwf
TLSH
T1EA321D929BFC4043F9A76D705394E9C37C3C73C7292185960569F5E82C937D1E710A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-errorhandling-l1-1-0.dll
Size 10KB
SHA256 be330de7aa8f2f33bcdabf0cec2551399b4ea0f22335a0277ea9c3a7aa405bdd
MD5 801750157960c928af876c3ec8dd4651
SHA1 1cb405eb7339ef121df51f5eba44e0b0177a76d3
SHA512 70d84b12ec65f497720dd3ee2c634a67d2f0011c9ea825bdbf20343f3572a99432a843cb178f705d923649694cd38aea9ed97b7162138e56374cd369d158d2b0
SSDEEP 192:sqmxD3XWYhWhWWFYg7VWQ4eWfUex9N8xqnajFAg:sqEWYhWf9enMlZ
TLSH
T18A321C528BBC8043F9A76E7053A8ED837C3D67C72910915905A8F5B92C937C2EF10B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-file-l1-1-0.dll
Size 14KB
SHA256 50347ffd660720cb1f41691be2793d00b169c864f7260dba1966a8ce5c9da943
MD5 7f3c75a78482e1ea21cdd81055b3135f
SHA1 e0fa94d72626531aa971c3f1385f03ded6bde6a0
SHA512 925ee75ea5261de55d50e0c72de891833e20975b06cf9a1712385c077fef4548639d629354969cc8d18bc7664b6b3e03ffd11d08965e2fc94b3a11d3de6cf839
SSDEEP 192:rUCYYPvVX8rFTstWYhW2WWFYg7VWQ4eWUsNux5DqnajuyO:rUC7PvVXfWYhWWxDli
TLSH
T170620953D9B4E25BF8CFAF3112A5D8836C3583CA052584CA0BD4A7AC3CE73C6E394959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-file-l1-2-0.dll
Size 11KB
SHA256 676a6da661e0c02e72bea510f5a48cae71fdc4da0b1b089c24bff87651ec0141
MD5 cd3cec3d65ae62fdf044f720245f29c0
SHA1 c4643779a0f0f377323503f2db8d2e4d74c738ca
SHA512 aca1029497c5a9d26ee09810639278eb17b8fd11b15c9017c8b578fced29cef56f172750c4cc2b0d1ebf8683d29e15de52a6951fb23d78712e31ddcb41776b0f
SSDEEP 192:KdWYhWJWWFYg7VWQ4WWeRkJqnajgrTZutRnPZA9S:KdWYhWHsJl0huHnPZA9S
TLSH
T14B321AC65BBC8043FA936F7047A9D9937D3CA3DA1A20815505A9F19D2C937C1EB10B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-file-l2-1-0.dll
Size 10KB
SHA256 24ea638dfa9f40e2f395e26e36d308db2ab25ed1baa5c796ac2c560ad4c89d77
MD5 b181124928d8eb7b6caa0c2c759155cb
SHA1 1aadbbd43eff2df7bab51c6f3bda2eb2623b281a
SHA512 2a43bf4d50d47924374cde689be24799c4e1c132c0bc981f5109952d3322e91dd5a9352b53bb55ca79a6ea92e2c387e87c064b9d8c8f519b77fff973d752dc8f
SSDEEP 192:UC/b2WYhWIWWFYg7VWQ4eW5AZa8p2kacqnajYhx:UC/b2WYhWoY8pUclMH
TLSH
T1D1321AC29BBC9043F5E7AE7043A4D9837D3DA7D71A14819905A4F5AC2C933C2EB20B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-handle-l1-1-0.dll
Size 10KB
SHA256 9f2c87a8f541fd2e563778208c51f1e1852d4874571b6c5218066c0d58f9539c
MD5 d65ef6902015757c4b5e2b550c233e1d
SHA1 8b3a44beceb81727071337a9c9e7d0f3b1370455
SHA512 01dc60cf2d8f902848a4234cb97b12329d813f836786407ee090083a9fa6750df7f6b4db6d3496a873fc352bba4edf109ea6d5811d124075d8f3d21008c96773
SSDEEP 96:yo1pFqrTMEWYhWwQGixDEs39DHDs35FrsvYgmr0DD0ADEs3TDL2L4m2grMWaLNNK:8WYhWAWWFYg7VWQ4eWYv1N8xqnajF
TLSH
T10832FA91CBBC4043F5A76E7047A8E9837D3DB3C71910D19A09A8F5A82C977C1EB14B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-heap-l1-1-0.dll
Size 11KB
SHA256 2e9a683aa69db2f8186ce9ac3e6a610fc727390155668b2680a728a6e6c67247
MD5 8af9779906d36b71166a1e286c880d0d
SHA1 deb18c79ab7def1f7ce1b22f90d21b3f6c5d8ef3
SHA512 c9927edc959272747aad42f9d243119fba2d126ac7e0463b59847e3738fe62fe58c01f666791d66177949e61b6bf36da67d558475382aa71a236794137186e96
SSDEEP 192:Bcl6WYhWKWWFYg7VWQ4eW1128s88p2kacqnajY+xxD:Wl6WYhWaUL8pUclMC
TLSH
T189322B868BFC4143F5FBAE7013A4E9837C3C67CA191081A505A4F19D2C937D2EB25B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-interlocked-l1-1-0.dll
Size 11KB
SHA256 96509b560bc604a30af26e08d6181d24dde1d51bf3654a12cd663a4ba1a11eac
MD5 2f68cbb35c4c8e66c7d1a8b6c2079700
SHA1 2acb3bdfb7209323d586866e276e152d540d5ae3
SHA512 d5886e85abb2b2b4dd0d632e56d7f056f58374b774769bc83dc84f734827fc87b91d85f609f6faae3e3c10703716b31d775ca7f5819a1f719a355a154a8cc1ec
SSDEEP 192:XYsFuWYhWRWWFYg7VWQ4eWsy8p2kacqnajYOx:XYsFuWYhWPu8pUclMS
TLSH
T16532F8424ABC5043F6FBAEB107A8E9837C3D63C61914819106A9F5ED2CDB7C1EB10B5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-libraryloader-l1-1-0.dll
Size 11KB
SHA256 f378ed4e0a68ca5fefff824912a5ec14992a6a8859e088a50a6df6d632611834
MD5 57a0a074d52e17ce0fec69b4106bceb4
SHA1 f6fbe3fe91884d3aa19ce93156423da55bdd6ced
SHA512 8878c3bc77e004924e4595e03d0e717c75e44475e3bef923facd8435fbb26d2f7b3e16acb1e0516e0d0a5df502375ef86aa360d7c9cd79a52256b946896a7df3
SSDEEP 192:evuBL3BBLQWYhWFWWFYg7VWQ4eW/JvwiN8xqnajF:evuBL3BqWYhWDDiMlZ
TLSH
T18642F9928AAC5543F5F76E7043A4D8837C3963C75524D4AD45EDF2AC28A33C1EB20B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-localization-l1-2-0.dll
Size 13KB
SHA256 5fbd69186f414d1d99ac61c9c15a57390ff21fe995e5c01f1c4e14510b6fb9b1
MD5 21519f4d5f1fea53532a0b152910ef8b
SHA1 7833ac2c20263c8be42f67151f9234eb8e4a5515
SHA512 97211fad4aae2f6a6b783107938f0635c302445e74fc34a26aa386864509919c3f084e80579d2502105d9256aab9f57ea16137c43344b1c62f64e5bc1125a417
SSDEEP 384:6GEOMw3zdp3bwjGzue9/0jCRrndbFWYhWfRDli:6TOMwBprwjGzue9/0jCRrndbB0
TLSH
T135521992D6E8D207F84DE9713157D8437C38638A1922D49A07E6FB6838E37C6E79072D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-memory-l1-1-0.dll
Size 11KB
SHA256 7733252eb66a1f3ce0efc5c375fadd6fa20a596324658c72d4e707f67909a433
MD5 ed6d551457d8a41b48bf017b79765e27
SHA1 fa1609389caea2192f37017a23ec66e0c7f21d65
SHA512 a0fb6d1420c9a74266c368f246af06c173379c78f0ac6eb676aa95f5c41e9b12f52fc32ec79c89d1cf4ea67c0a8d092d0ca3caba651188598a52b1a2ff2f4c69
SSDEEP 192:bBBBWYhWDWWFYg7VWQ4eWsBGN8xqnajF7:bBBBWYhWxAMlZ
TLSH
T1EE322A858ABC9407F5E76E305394DA93BC3EA7C71D50D06906B8F5A92CD33D1EB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-namedpipe-l1-1-0.dll
Size 10KB
SHA256 04532aed545a391a9e95d6103a816ec5d26df14af51f51dd0c649ddd57862e5c
MD5 d8873df4158c5d449f13fd32442f10f5
SHA1 52c9bf4137e466124eab9aa639671795d05125f1
SHA512 e52876ca557755f50bdd3f9adf124a6a562798a725480238f747348c9f81539903f8a19eeb00a61e50f5fde6e7acc8e613b4ba94cc0d8facc2a91f98078997d3
SSDEEP 192:ROWYhW3NWWFYg7VWQ4uWtRgRHB8p2kacqnajY7x9:ROWYhW3Lq6RB8pUclMd9
TLSH
T13B320C514ABC9043F9ABAE7053D8E5837C3DB3CB1915815416A4FDAD2C937D1EB30A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-processenvironment-l1-1-0.dll
Size 11KB
SHA256 ed755e302cc2a9f5d3cc38140a90697c6bb24965acc6cdaddb63e95c3d2cb9bd
MD5 0a34f6f91287218a1d451999957701b3
SHA1 05727b747b29845e025d2efde0e43ee36927439e
SHA512 24d69f006cdfb91182e3cf9d917dad90353c5824cb19a00a9c4dc9feff0a279a32750a83774a5fe4f5e863386e23efb96a0b54a82c551f28822c6df410eebed8
SSDEEP 192:ATWYhWBEWWFYg7VWQ4eWufP8p2kacqnajYosx:ATWYhWe1P8pUclMoU
TLSH
T1E8421A829ABC5003F6D7BE705299E9A37C3C93E71D1480A40164FAAD2CD7792EB54B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-processthreads-l1-1-0.dll
Size 13KB
SHA256 6d298ae58e7651d23b75a4f6cc070794e716574fe497105fb4ef727ce9782779
MD5 45578c4fafc6d9d5ab6e78a07827c19e
SHA1 2fdf383c24a697a0cc29231dab4d0a77207a29f1
SHA512 63ce2272ecc03e7e8c60395360fc685b4b144fb1cadc709f15e070e4e7b769ab282e7a652254386e83827d7982936f38a152014848e183fdb0ea38dff92e83bd
SSDEEP 192:gPRCIk1JzX9cKSIxWYhWJ+WWFYg7VWQ4eWnL1sN8xqnajFH0qW:KkIk1JzNcKSIxWYhWQEsMlZU
TLSH
T18A520B918ABCD283F8DA6D706355E9533C3A93861929817405E8F6FD3DFB3C2D62852C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-processthreads-l1-1-1.dll
Size 11KB
SHA256 6c27ac0542281649ec8638602fbc24f246424ba550564fc7b290b683f79e712d
MD5 b5c8334a10b191031769d5de01df9459
SHA1 83a8fcc777c7e8c42fa4c59ee627baf6cbed1969
SHA512 59e53c515dfa2cd96182ca6539ed0ea2ebb01f5991beb08166d1fc53576aeaafebbb2c5ee0ccbdab60ae45fc6a048fff0b5e1b8c9c26907791d31fb7e75b1f39
SSDEEP 192:k/DiDfIeJWYhWGWWFYg7VWQ4eWlLoCjux5Dqnajuy:JDfIeJWYhWm+PUDli
TLSH
T1D432099196BC8043F5A76E706395F9837C3DA7CA2A25C06505A4F6AC2CD73C1E700A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-profile-l1-1-0.dll
Size 10KB
SHA256 a99b485112b305623ec3c8ea0d4c9acfac0c5c66821d4a98cde7b43edb8b78fc
MD5 1672a33674cbaf42b3eec20d52930bd9
SHA1 f6e3da76e7de8a0d5f2e254b080ba973c92ba817
SHA512 7b405243d474706c192e3e3b67ff61412adf41ea3bbbdcd5281aab2e7bed01c0c83a09fe60c0a0274d176a3aeb54dc0406dd044e002b8a447503c6dceb34d237
SSDEEP 192:VbaIWYhWMwWWFYg7VWQ4eWb58p2kacqnajY9x/:VWIWYhWBW8pUclML
TLSH
T12E220C968EBC4443F5E7AE7053E4E9837C3DB3D7692481550568F5AD2C933C1AF10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 10KB
SHA256 a45a7143971e7f8bbe4d5667927e3ba0fe5d0c025ef5d776ff8a5826341a99cf
MD5 83cad14da9e92a8baf84a9afe2c9a5b0
SHA1 14c89f2ade657eb9249b95f9290fb4284908c9c6
SHA512 a5e93d77555e65bff5d47b2d6e9f7668cc6353a815cb1b11eaa6910594d53a9a2a538b8fe6b89cc2589f0dee321215039c012637809fc513b39fb902c02fdb4d
SSDEEP 192:DGlWYhWQWWFYg7VWQ4eWrT7dN8xqnajF5qlR:DGlWYhWwqMlZ58
TLSH
T1D2321B928BBC4043F9A36E7053E4ED937C3D67C72954916905A9F5B82C937C1FB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-string-l1-1-0.dll
Size 10KB
SHA256 0c1cbbb4630d38632ed6a5bae9ba7e06fe19433f2a5bd548f3d73f315359d79e
MD5 990cba52bd41c096c79778188dd63a15
SHA1 4a902cf7e4500c736ab4830e762cc1e18bb224ec
SHA512 1ed847989d02ef2c57edbd4726d818ea4bd811a255873765dd6090b9f8b204dff3610e887979ff8016c9b40bdcd2eab39ed064bb0f5f4447a94d56ab24e5183e
SSDEEP 192:oJGyMvJWYhWpWWFYg7VWQ4eWuGGO8p2kacqnajYCxYWe:oJGyMvJWYhWnUh8pUclMuxe
TLSH
T1C8321C929ABC8003F5F7AE7053A5E9937D3CB7D7292481A505A4F5A92C933C1EB10B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-synch-l1-1-0.dll
Size 12KB
SHA256 cc39ce8fe4a38a80c7b316a7191bd319efd99f9f7cb5b97fe8c3d65d2e788070
MD5 69e1eddc7cd991f9f5db2fc6fdb6f46e
SHA1 6e8a961767f5ac308d569fd57e84b56b145c6c53
SHA512 61935e8eab14babb17dc4362e49f06119efde5de0d3b8d0e330b8b8989ffaeacefd23eada19d4747605f9e9f510ed4f11618b047f6c915554162f19e5a138f3f
SSDEEP 192:Y2dv3V0dfpkXc2MAvVaoKFWYhWpWWFYg7VWQ4eWhpW8p2kacqnajYQx:Ldv3V0dfpkXc0vVafWYhWnx8pUclMA
TLSH
T12B521A42D6E8A543F1AFEE7087DAD5837C3853C74A1485621594F6AE3CE33C1EB1162E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-synch-l1-2-0.dll
Size 11KB
SHA256 148adef6a34269e403bb509f9d5260abe52f413a6c268e8bd9869841d5f2bd02
MD5 eb6f7af7eed6aa9ab03495b62fd3563f
SHA1 5a60eebe67ed90f3171970f8339e1404ca1bb311
SHA512 a9961212b40efc12fd1ab3cc6551c97c987e73b6e409c9ab8a5e1b24542f9e5884811f06883bd31d2585219c4f60c30de2d188788513c01b6cbfe22d539d7875
SSDEEP 192:JDQtZ34WYhWVWWFYg7VWQ4uW+Jf8p2kacqnajY2xyU:JDQtZ34WYhWT/f8pUclMqx
TLSH
T10932F7974BBC5543F9EBEE7047D5E4833C3C67C61A10455115A9F1AA2CA33D2EA10E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-sysinfo-l1-1-0.dll
Size 11KB
SHA256 328dff5738e59b78e2951920efcc69e97548c8081f4714540b4e723443b8feb4
MD5 d4359815e2a7f10b4dd3ec3945eed45a
SHA1 4c83bd868c963c3afa29d92f75d185ad612c9b11
SHA512 09ac1040e0a9edd8562c4b76430c82cc25ca94634a9c632803d8bc8eec6ac34d9ad5fb6509416bcd970accb6dce27730bcfeb1ce29d0920c84cc2daf5102d627
SSDEEP 192:j8QzKIMF8WYhWwEWWFYg7VWQ4eWLLTux5DqnajuykbJ:j7zhWYhWwk2EDliL
TLSH
T18642F852EAFC9103F59B6E3013D9E9837C3897C61925C15906E5F7A86CA33C5E72063E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-timezone-l1-1-0.dll
Size 11KB
SHA256 64eccd818f6ffc13f57a2ec5ca358b401ffbb1ca13b0c523d479ef5ee9eb44ab
MD5 86421619dad87870e5f3cc0beb1f7963
SHA1 2f0fe3eb94fa90577846d49c03c4fd08ef9d3fb2
SHA512 dbce9904dd5a403a5a69e528ee1179cc5faab1361715a29b1a0de0cd33ad3ae9c9d5620dafb161fda86cb27909d001be8955940fd051077ffe6f3ff82357ad31
SSDEEP 192:FPWYhW5WWFYg7VWQ4eWxSwPGux5DqnajuyVp:FPWYhW3+Dligp
TLSH
T19B32F9A2DBB88403FDDB6E7017E5E8937D3C63DA1960819A09E6F5583C973C1A710A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-core-util-l1-1-0.dll
Size 10KB
SHA256 e4e4e55abf599d1a9ef7b95da0d7fd37f23a6cf1d368a77f88390eb2e0c1340d
MD5 e0727785f827d39eb167749227a316ed
SHA1 c063a309aeff016f0a7d728c44fe169ce6da12c5
SHA512 83c2bc0f3049b619bf39a8cd6b5fa1ee1346ada2075e7495f264360a62f6fe7ddaafb382b60dfc18857c981c584c750a0b07c1d5d81410a80c296fa1b276ad0b
SSDEEP 192:UWYhWqWWFYg7VWQ4eWF1k8p2kacqnajYyxM:UWYhW6uk8pUclMeM
TLSH
T10532F9838AFC8443F9E7AE7057D8D9837C3CA7D71A5481950594F5992C833D2EB14B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-crt-conio-l1-1-0.dll
Size 11KB
SHA256 3181c520d7ab831c8ff330afe15ad717a5a1ed85b5d91b50b838be1e5c96d052
MD5 a76584c4923b1be911d9ece4ea439116
SHA1 e025b0afc3b9a8046f83e5df718bac4ad05c9c2c
SHA512 9e701066b81979318f41ac54ef4e1faf7a5e4cfa7482e61a60717fde10bba0851bf86f446f53a8bb26a1df95405cba0969648435fff3368bf9c2fec9ffc333be
SSDEEP 192:4p0WYhWTWWFYg7VWQ4eWWl8p2kacqnajYtx/:4p0WYhWBT8pUclM7/
TLSH
T1AF4207835AFC4907F1A7AB30A7F8EAC3AD3967D72A1450690455F4A83CC33D6AF1162D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-crt-convert-l1-1-0.dll
Size 14KB
SHA256 02c78781bf6cc5f22a0ecedc3847bfd20bed4065ac028c386d063dc2318c33cc
MD5 88f89d0f2bd5748ed1af75889e715e6a
SHA1 8ada489b9ff33530a3fb7161cc07b5b11dfb8909
SHA512 1f5a00284ca1d6dc6ae2dfce306febfa6d7d71d421583e4ce6890389334c2d98291e98e992b58136f5d1a41590553e3ad42fb362247ae8adf60e33397afbb5df
SSDEEP 192:YM0wd8dc9cydWYhWtWWFYg7VWQ4eWydY8p2kacqnajYWx:B0wd8xydWYhWrjY8pUclMK
TLSH
T16B62C55366E82F26F6DF577221FE9BD36A385782155043B0C217E45C3882782BDA7C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-crt-environment-l1-1-0.dll
Size 11KB
SHA256 d5164aecde4523ffa2dcfd0315b49428ac220013132ad48422a8ea4ca2361257
MD5 0979785e3ef8137cdd47c797adcb96e3
SHA1 4051c6eb37a4c0dba47b58301e63df76bff347dd
SHA512 e369bc53babd327f5d1b9833c0b8d6c7e121072ad81d4ba1fb3e2679f161fb6a9fa2fca0df0bac532fd439beb0d754583582d1dbfeccf2d38cc4f3bdca39b52d
SSDEEP 192:CKNMWYhWtWWFYg7VWQ4eWSwRrHN8xqnajFW:CKNMWYhWrYHMlZW
TLSH
T11C320A924BBC0543F6A76E3053F8EA937C3C63C72900907909A9F55828937D1FF21A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-crt-filesystem-l1-1-0.dll
Size 12KB
SHA256 162ccf78fa5a4a2ee380f72fbd54d17a73c929a76f6e3659f537fa8f42602362
MD5 a1b6cebd3d7a8b25b9a9cbc18d03a00c
SHA1 5516de099c49e0e6d1224286c3dc9b4d7985e913
SHA512 a322fb09e6faaff0daabb4f0284e4e90ccacff27161dbfd77d39a9a93dbf30069b9d86bf15a07fc2006a55af2c35cd8ea544895c93e2e1697c51f2dafad5a9d7
SSDEEP 192:BGnWlC0i5ClWYhWCWWFYg7VWQ4SWg896Tem8p2kacqnajYPxw:cnWm5ClWYhWyld8pUclMpw
TLSH
T1B452F74346E86E13EAA71F7252FCEBC73F3D6BC2154782A18016E46839D33C17E1695A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-crt-heap-l1-1-0.dll
Size 11KB
SHA256 150d32b77b2d7f49c8d4f44b64a90d7a0f9df0874a80fc925daf298b038a8e4c
MD5 a6a9dfb31be2510f6dbfedd476c6d15a
SHA1 cdb6d8bd1fbd1c71d85437cff55ddeb76139dbe7
SHA512 b4f0e8fa148fac8a94e04bf4b44f2a26221d943cc399e7f48745ed46e8b58c52d9126110cdf868ebb723423fb0e304983d24fe6608d3757a43ad741bddb3b7ec
SSDEEP 192:h7aY17aFBRAWYhW4WWFYg7VWQ4eW1R7N8xqnajFzL:J9WYhWYy7MlZ
TLSH
T1974218924BBC5543F5A37F7057E8EA873C3E67C72911846640AAF5A82C833C1BF2162D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-crt-locale-l1-1-0.dll
Size 11KB
SHA256 db495c7c4ad2072d09b2d4506b3a50f04487ad8b27d656685ea3fa5d9653a21d
MD5 50b721a0c945abe3edca6bcee2a70c6c
SHA1 f35b3157818d4a5af3486b5e2e70bb510ac05eff
SHA512 ef2f6d28d01a5bad7c494851077d52f22a11514548c287e513f4820c23f90020a0032e2da16cc170ae80897ae45fc82bffc9d18afb2ae1a7b1da6eef56240840
SSDEEP 192:iWYhWFGWWFYg7VWQ4eWd3BSB8p2kacqnajYu4x:iWYhWkWxSB8pUclMuY
TLSH
T11E322A434AFC5443F5E7AFB047A8EA877C3DB3C7190585A51156F8A82C833C9BA11B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-crt-math-l1-1-0.dll
Size 21KB
SHA256 f9ce464b89dd8ea1d5e0b852369fe3a8322b4b9860e5ae401c9a3b797aed17bf
MD5 461d5af3277efb5f000b9df826581b80
SHA1 935b00c88c2065f98746e2b4353d4369216f1812
SHA512 229bf31a1de1e84cf238a0dfe0c3a13fee86da94d611fbc8fdb65086dee6a8b1a6ba37c44c5826c3d8cfa120d0fba9e690d31c5b4e73f98c8362b98be1ee9600
SSDEEP 384:nt1MCbM4Oe5grykfIgTmLSWYhWZjMlZi:t6gMq5grxfInsYL
TLSH
T18BA2954789ECBF67E5CF1BB701F48BCA6A381BA255E1B5F4C887918834927D03E47909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-crt-multibyte-l1-1-0.dll
Size 18KB
SHA256 50752719a62627e7a8d2c26970fe59af839692d060c009fd0652325362752659
MD5 cce453c53f6dac9496bfa5415cc92731
SHA1 18fee669be0aa8a1839a75a167980f3f246c93a4
SHA512 2cfe07c602c2e6205a2a2aa0de4ca8e105c9973d14b9d131a6372ba54697d17af7c84c898329425a3d19fd6c1434bcaf162ca0dbc5f0d20cb5973c63aee6b23a
SSDEEP 384:GSrxLPmIHJI6/CpG3t2G3t4odXLhWYhWOPPMlZ:GiPmIHJI6v5P
TLSH
T1C2922D6B4EA83E12E18FD7F3B5F6C7C62A351F8104C073B5A66B95583801EE9BD52E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-crt-private-l1-1-0.dll
Size 64KB
SHA256 601ccd84d252fc6e024b1319902e48cf98bb922bf7799384a85640d5ce6f4a16
MD5 1f72bfe2fb7bb2a403efda6ee963d259
SHA1 bcfb984771542970488bd6132dfa2746267b7fbc
SHA512 e47c4c7a939d8e1022b6ce41ca15b1e3e4028f3bb302d1836bbdb3ec8d0c0141dd79ff147e6dc7fe56e09ab65dd15385362ea190d8792173674660a33acd5d61
SSDEEP 1536:nfolDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPe:folDe5c4bFE2Jy2cvxXWpD9d3334BkZR
TLSH
T16B531ADB89E63F22E18FF7A76BFB13C90B253B4418806174E9C7556B34853A9BC43A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-crt-process-l1-1-0.dll
Size 11KB
SHA256 4c058e5b8f83ce395a7004d8c4043735526de01c5764242d4ce4f683dcf1425c
MD5 108433c271995786a8289afd611ea28c
SHA1 ba58c577311e39ff7e92a6be0dd6b80abfee6edc
SHA512 800bd7a8702905fd9be83f17087440228f1428237d202160a5618aa6cfe1d1aad3c2608f324db38d235348bd2c8682f55d8ff52d13f9c37fa7c32d64a967db77
SSDEEP 192:hnqjd7dWYhWpWWFYg7VWQ4eW8u8Pvxux5Dqnajuy:hnsWYhWnRPvuDli
TLSH
T1F0420A8797FC4557F6675F3042F8DAC3BE3B53C6A81081658866F05D3C823C5AB2062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-crt-runtime-l1-1-0.dll
Size 15KB
SHA256 876bd768c8605056579dd8962e2fd7cc96306fab5759d904e8a24e46c25bd732
MD5 4f06da894ea013a5e18b8b84a9836d5a
SHA1 40cf36e07b738aa8bba58bc5587643326ff412a9
SHA512 1d7c0682d343416e6942547e6a449be4654158d6a70d78ad3c7e8c2b39c296c9406013a3cfe84d1ae8608f19bee1d4f346d26576d7ed56456eea39d5d7200f79
SSDEEP 192:nJB0fhrpIhhf4AN5/jiTWYhWjWWFYg7VWQ4uWT67dEO8p2kacqnajYvxfyfA:n0hrKIWYhWR/7F8pUclMJfz
TLSH
T1DC62D6434AFC6F27E5976F7316F9D7C75E3A6382260082798863F0993883781BD5720A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-crt-stdio-l1-1-0.dll
Size 16KB
SHA256 8f7ace43040fa86e972cc74649d3e643d21e4cad6cb86ba78d4c059ed35d95e4
MD5 5765103e1f5412c43295bd752ccaea03
SHA1 6913bf1624599e55680a0292e22c89cab559db81
SHA512 5844ac30bc73b7ffba75016abefb8a339e2f2822fc6e1441f33f70b6eb7114f828167dfc34527b0fb5460768c4de7250c655bc56efd8ba03115cd2dd6f6c91c0
SSDEEP 192:exUO+1pPLNPjFuWYFxEpahTWYhWWWWFYg7VWQ4eWNuvwN8xqnajFD:exUX119OFVhTWYhW2bwMlZ
TLSH
T19072B34385EC7E06E29747331AFAFBDB5A355383340471BDC407A8A836CA399BE07519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-crt-string-l1-1-0.dll
Size 17KB
SHA256 a797c0d43a52e7c8205397225ac931638d73b567683f38dd803195da9d34eac2
MD5 f364190706414020c02cf4d531e0229d
SHA1 5899230b0d7ad96121c3be0df99235ddd8a47dc6
SHA512 a9c8abbd846ab55942f440e905d1f3864b82257b8daa44c784b1997a060de0c0439ecc25a2193032d4d85191535e9253e435deed23bdf3d3cb48c4209005a02e
SSDEEP 384:9FvU4x0C5yguNvZ5VQgx3SbwA7yMVIkFGl/WYhWl76tW8pUclMgp:j5yguNvZ5VQgx3SbwA71IkFw5W8pUq
TLSH
T1A182A64346F83F02DACF57B359FA8BC72A385F8625415375C077A49C3881792BE67A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-crt-time-l1-1-0.dll
Size 13KB
SHA256 fd44d833ea40d50981b3151535618eb57b5513ed824a9963251d07abff2baedf
MD5 d0b6a2caec62f5477e4e36b991563041
SHA1 8396e1e02dace6ae4dde33b3e432a3581bc38f5d
SHA512 69bd6df96de99e6ab9c12d8a1024d20a034a7db3e2b62e8be7fdbc838c4e9001d2497b04209e07a5365d00366c794c31ee89b133304e475dde5f92fdb7fcb0bc
SSDEEP 192:g3sy5NDSWYhWmVWWFYg7VWQ4uWOpxCN8xqnajFs:LU0WYhWmTLaMlZs
TLSH
T10E52D84346E86A07F9A71B7113F9DBD77F3813C21A80617A8166E4A836933C1FE2252D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\api-ms-win-crt-utility-l1-1-0.dll
Size 11KB
SHA256 0cd6d0ff0ff5ecf973f545e98b68ac6038db5494a8990c3b77b8a95b664b6feb
MD5 3dfb82541979a23a9deb5fd4dcfb6b22
SHA1 5da1d02b764917b38fdc34f4b41fb9a599105dd9
SHA512 f9a20b3d44d39d941fa131c3a1db37614a2f9b2af7260981a0f72c69f82a5326901f70a56b5f7ad65862630fce59b02f650a132ee7ecfe2e4fc80f694483ca82
SSDEEP 192:a0I6fHQduPWYhWIWWFYg7VWQ4eW87AEp8p2kacqnajY4xnS:aIf5WYhWosEp8pUclMYnS
TLSH
T1EE3217934EBC5503F6EB6F7057E8EA837D3D67C2191082A50165F4A92883BC1FF2162E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

concrt140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\concrt140.dll
Size 238KB
SHA256 1cddacbfb0c61652fcd543fef1e72cf649e27f3ee8f0d1c0d3988c0b5093e74e
MD5 4cc02ba9d10b18be0a02e3555aa78a98
SHA1 d1f63d5aa58b0b7ea1925dd3447861b3faf8cd8e
SHA512 9d345573ec7a55aa06414cdd5b23e9085d016f4e9eec10581f93109c12e51603f39b01ce5539f8b1d16086e92b94baba05ebe45e9556c96a6b439c97cb82dc3e
SSDEEP 6144:Svy1UNAZHA2nSG5LbEcutDkSaqiOHYb8f6TjLOeHFQaSwuzGW12z/NpI9yT:2hsH0Yb8fiLxruzGzzP
TLSH
T196345DE1344044F7F77B07368828D7B991BEA68027EB81D71F6CA64A1E646C1EB33593
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensibility.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\extensibility.dll
Size 10KB
SHA256 39e9af87ed0eae0fa0c520088d7edc3e1edd3889f109ef1220467ffa0e425e36
MD5 c6133749ba22cf955b526d9bb3911f09
SHA1 dc61798a22b3e6a9dfc66782a1020107eac0a9b5
SHA512 b17b0e23e0dd52e6ac778f27916367199290fe7e25e6e2b444491e39a65b5dc3906d87037c1e6c73c35e6fd9e6302f5346a35fd2f280f4b8f31683ab46ab95bf
SSDEEP 192:hB9HPj6Yx2bTQWjHWlQKPnEtObMacxc8hjeyveCH4kn:n9HX2bTQWjHWlLXci2jpvSkn
TLSH
T13E22F9825B3C8243FEAB5FB466E5DBD33D38E7C20A25912B1079E6981C477D09F2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdiplus.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\gdiplus.dll
Size 1.4MB
SHA256 66732f097fe39d370410d85aec9a86f373638e7cac46473da799e9e666fc6c8b
MD5 31b9fc652711265760068b421aaabd52
SHA1 ac6e6b4f16b706083f74d2294ea7fdc631ee8b0d
SHA512 58d8a4bfc8d60882e84a4c8270645623d2256c4a354d1db22791c2e98c3ada2a90bdb576f7ecdb0df5c420b13aa51ce6e728f24b941846e27de101b59e563cee
SSDEEP 24576:lnTuSZAWrKkVVZw9srkwWF6tHxVrI+KrFn7o6bgGNRt3oNjznFrAluiWKcOWqaxQ:lnTuQARKvWF4+EibsqaxCHzuLP6qWVw4
TLSH
T1C0658E51E1814025D8AFA973410E373DF1ECAB31173551CB37B8EAA9A9B06D06A3D39F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kpacketui.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\kpacketui.dll
Size 2.9MB
SHA256 f3a116361e08baad8f70f5fc1643f53658ef21276c67b13144d0b40751e5da29
MD5 7220c6122217d18b122595e4fc26cabb
SHA1 4f283922f60854f1d292a91b16bda1c215c3000b
SHA512 cbf837b8eeb12026f1a5900e71a8468d139bcc14dbc7e4db04e2cea5dc738d463312f8f45c5918fe5e6f2ca4090065f0b539e7309fee9966c96ad8f15803ffc0
SSDEEP 49152:o0sCS4MS5HgjfCXcecTNXp6sHBqST77qD2Ns:f
TLSH
T1BEE52361534882BEF15CC33C64B55592F1273CEEA76283C7B24CBB7669246C28D3E693
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msaddndr.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\msaddndr.dll
Size 96KB
SHA256 561c909f76faedfd010fc049faa503e249f00cab16d6b57bff0fa74604345731
MD5 0febe1efb25daac6f6f301b6e341dff4
SHA1 3d356f13e2363bdee48c817e31575019d2eff335
SHA512 a81b66160a4d1205d400107b213841d19c21369836e5e285aff369e717f96a51952d0eea99d0cdd26179253133a0004a69a345d1cd10a85d203573a7a3101e11
SSDEEP 3072:I6h/gS4naNpvwXCj/P0WbRx0Nlk/TvQF2Z1h:fZ4n4wgsWbolCFh
TLSH
T13EA34BA5B2C4C02AF1E2173456E577EABEF6AD217D2C84179314775E9C30286EE2C31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\msvcp140.dll
Size 427KB
SHA256 5a6dfa5e1ffb6c1e7fc76bd121c6c91305e10dd75fc2124f79fee291a9dd9e86
MD5 db1e9807b717b91ac6df6262141bd99f
SHA1 f55b0a6b2142c210bbfeebf1bac78134acc383b2
SHA512 f0621977d20989d21ae14b66c1a7a6c752bfd6d7ccc2c4c4ec1c70ba6756e642fb7f9b1c6a94afadd0f8a05d3c377792e4aa4c1a771d833c40a6f46b90cbe7c3
SSDEEP 12288:X3xU+0XySH2CyKSPRBb22umbyghUgiW6QR7t5s03Ooc8dHkC2es8Y45:HxUwSH2CyKaBb22umbY03Ooc8dHkC2ex
TLSH
T139943932BB464DF1E48913B971C9472193FAFC610362E3C397DAF1262F166C6A633A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\msvcp140_1.dll
Size 21KB
SHA256 4e94f9c89188fba7cae4bde37cf824d654717731559d47985d2b0749cfb11aa6
MD5 4c3501beb23e601cef5337a47289cb34
SHA1 a39b0f789e3fa8be545ba5b62f537d611d68e11c
SHA512 336c54f5c9fd537f1c870a02bd41a39074b85723e1c8c9cb56d80d0356a0df030e67b5e6f61a9e5d267b0db26a4fba7774cfa8e3ee061a709cebfc71d2c14bfe
SSDEEP 384:GH2LRmpNhYQjty3dVWc75gWsJvsHRN72Xr6zaHeR9zt/LbCJ:GWKgsyvww8C9zt/PCJ
TLSH
T109A25D82FB140AA2E99E183051B8D5576C79BBA14FE092D76BD1F60E0CE63C2FE3051D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_2.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\msvcp140_2.dll
Size 163KB
SHA256 94a12bedb9a25393dc75fccde7243d5e90acf40b1f14406132a44ff42e220f2e
MD5 d11eb12bf225dcad9219c5938d97c6df
SHA1 fee3132cfa6ea6b9a5d3e3bdcc90050e4b2fcbd8
SHA512 8749aceb55f92c3e92862bd07a83fb999cd7db15a5cee7ddd468ffc42be8df8e8b7b32b82fcd73d2c17c64d9f760ce32c76b70f378d5430b67cef39104c3be09
SSDEEP 3072:4ZAg1ocb42/lCmyPieky8DbRhn0WoGgvQHwRvf567d3WoiiCWnO1O8XV:4ZKc8myP/u0h9f56JmViDO08F
TLSH
T193F37DC3A92880A6D09F097FB4145B2F642DFD921BBE46DF2794410BDE38ED38DB2945
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_codecvt_ids.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\msvcp140_codecvt_ids.dll
Size 19KB
SHA256 74ee4398ae24c1b787af944d650aa345ba0e9787cd112542d782b714209e35cc
MD5 a8fc72d7ffaa5fbaafa754a4db378b8e
SHA1 76ff351f692637e456eb988d4609792fe44b152f
SHA512 244a0fd1d08dcc17a17c99375d52e1ab47736dc6909f039ca9d62c28dbb91e7c128c9dc5c12daafea6741fed3c58a4ebcb591203a65442ee28f92b6f2387d6eb
SSDEEP 384:WDSdV39IjIjU2dNWiVEWIbRtHRN7mTUR9zoOoN:Wc3ej5yWRtB9zGN
TLSH
T1FD923BD6EB244987FDAB0D7062E4D853AD7CBF911D50902317D2E20C1C97782FE34669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
Size 61KB
SHA256 7102bb7e8846473f29de1cf1012e4aa19b2ed01834044ae6e328764e933afae3
MD5 71b9d538fd2cf63e13ae4f1fa7847f40
SHA1 11daa516a60760e7eb39de3723c2029f995d641d
SHA512 dd0e92e2b9f9f43a0f09519d5112efe0b17bab22d3c5f3602c633a8bb80b7d6981a9bc274be46c71a42af4f6ac6221b0cd612b33b0e3ff36f2b32599e6f48996
SSDEEP 768:jthvo/KfnJjKWESUyx6u5cZhLaQSbAD6i9YgFJYiDLk5P/ssYio/sc65ALC:B1jjjUE6NaUWi9YgFJ7aN76Hk
TLSH
T19D536D53D80146BAE567A53078D89A7ADB79FC5007D083E7B72BE1740AA03D23A7D287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
Size 41KB
SHA256 9859a8df89fd3e7fec559db651e090a02f4adf2ec75eaf600939a24be4fab41d
MD5 ccee43aa4cffa082c1eb766614d51d0b
SHA1 5be9891903cf6aaf69a6de903cab1c3432718b38
SHA512 85de8c60315e093c6ac7aa8ea5af2cca8978ec6ae6e17370ac84718cfd91c328a8bddbd5836a53bf3824c1c3c5b2b0a68f86e4060c1b67a22aeabdec29443290
SSDEEP 768:b/07OUoOfo/KYWp3pVJ8YiDLk5P/s3LYio/s05ALtH:b0OUoz/KYWp3pVJ87aeL76CH
TLSH
T10F138D53DE105C65DE1F567078C4D63BF97ABA600AD0C3C37A0AD2281BA43D23EB9399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qdirect2d.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\qt\plugins\platforms\qdirect2d.dll
Size 1.4MB
SHA256 223e4f650d17a2881ff6fefdcf4bfbb110dfabe3570dda9e0a7207bdd687ab14
MD5 0c4473b9df3e5a75e0d6101855cd85dc
SHA1 02f9a3035af5a4d5b3d4310568e1efafeb9d8a6d
SHA512 65b051231561eaff95c8d03d07efe6b106aa2f47b130c650844ef676d3d5fca17c98fffa2a42fd4d779d43d28ea4051dd6235a763112b33a8e3840805c39659c
SSDEEP 24576:mImA2jwYaSqYQyVjLTKXkgWKr2su6buVKtZvmDbh1N7HAZeABWF:mRLjwYDQOjLTKUgWKr2GbuV+vON7aoF
TLSH
T1C7659E13F94181E5E4D20071C6EDABB2492C8A310B2642CB76D8ADADF9346F7773A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\qt\plugins\platforms\qwindows.dll
Size 1.3MB
SHA256 bc0e285559e229fca74479304b6d8c7596fff1aa8b25d77b25642341a3e4ab28
MD5 569261817c3391efc4848cc219229438
SHA1 d60e48a59fb19a3b040bdea9e1c639a3e0bf24b0
SHA512 70862005e6efe65e7d437b1e71b07b45a182a7e7217f6cc4d811fffd553f40133e5de43e2f862d73ea2e17b14aebc74bd4f3166f022e5857c4f5f5ca89caa8c0
SSDEEP 24576:Rh8p5xTJf4kLS1yGhg8EIMAlZ79DbCuG7xuZST:RhQfGyWEIMAH7VG75T
TLSH
T12155AE23F90081E5E0D20A7182EFBB7A9D2C9A31072742C375D86D59E9745EB7B39387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
Size 145KB
SHA256 b68d4d903ffe525506c4a7527df19225d03e80103777876578e6cb33523c0076
MD5 0738b9436e8d286f26a0c6955aa10e7c
SHA1 058ee73c3ba807255be0f5c6ba0ba86cc66e6b64
SHA512 64198c0451018e967f11bb5db0659f93e69a30ff67ebeaa4b2a92dad247fbe416bef6a624be76a3bc4d5eed15512da9aba7841c7ad6272a18286eccf12fe1e9c
SSDEEP 3072:t1XlaZUvCCE8y+gUqx42/WavP/r9+qxQOugMKXLP6CQpCozkpHl2WpI6qythwrQL:Zv9u5/1vC4PdBpI6qythwEAFw
TLSH
T1ADE35A52FA455326F082117C2488D7D2F137EE3046B593D3FF91A66939752E3AE2A383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stdole.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\stdole.dll
Size 21KB
SHA256 8cc8b5f4aac936407520b2e792a2bff207ed80df60a316a52d569f9d248b5872
MD5 a390735ec9f5136a1228c5c855672848
SHA1 7357d079dafd1d63a3eba255bec2152f83f8cb35
SHA512 834a59231f36d4b98e9535ab1e3ab735aa1d4ff34a28051f694ff582abccd5ada9ec88bbb57c6f391b0498f4638d5dd44631acd7930952979ceaf93f2f20de79
SSDEEP 384:YxcmnjOXjWQCEKxeiQCR3xbLslvpNj457WFWWLLXci2jXHUv+:Pmnj8jWteByhQfNj48XMi2jXHUv+
TLSH
T131A23AA1B96CD03EDD560A392122BB417D39E7935323CF1B11BCD19D1F813DB89A2A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\ucrtbase.dll
Size 1.1MB
SHA256 2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359
MD5 2040cdcd779bbebad36d36035c675d99
SHA1 918bc19f55e656f6d6b1e4713604483eb997ea15
SHA512 83dc3c7e35f0f83e1224505d04cdbaee12b7ea37a2c3367cb4fccc4fff3e5923cf8a79dd513c33a667d8231b1cc6cfb1e33f957d92e195892060a22f53c7532f
SSDEEP 24576:tCjjeiNFnAp+O+R2l2WDPc/9qHrX0cJ/gAp0ei5mcvIZPoy4aVvFjDp:4jyuRR2l2WD6I/bp0erVL
TLSH
T1F4454A117A09C2F6DDD931B97379B12214BCF5D08F24ECC3BB8466E95A243C079366EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vccorlib140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\vccorlib140.dll
Size 262KB
SHA256 d43812f712f02a50017128463c357eae8f78b665353f889848f59a9faefd8ff7
MD5 1b3229660d446d18e5659d74fe84d2aa
SHA1 e27b0e3e98d13a0d5860618a674743da0d3b57b8
SHA512 bdfa91ac0962d56671aadf2ed45f4079faca08aece763201a19f79b74aed7c547252879e021169f491bf0bd2e3048529ca99900d7adf4eb0a133cc4fc4d3a7eb
SSDEEP 3072:79WZlGbvxHdmJOHpxyBIBaQ0I/Iuljl1ma48MHnxwgSmiSeF:74WTmJO/BH0IwuljK18VgS7
TLSH
T192443A333D9C68B2D5BE5238DA849638426A74908FD1D7C76E58DBCA1DA43C09D30A7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\office6\vcruntime140.dll
Size 75KB
SHA256 f1fd5f6ec1cfe0cc3b66b5322ac97568bc63b19c1e415b99aad7c69ddbafa33c
MD5 8fdb26199d64ae926509f5606460f573
SHA1 7d7d8849e7c77af3042a6f54bdf2bb303d7cd678
SHA512 f56bf11d4259dbf5d4d1f9fc2ad60ff609cddb21278999e9fa55fe5d74552e8a01ddc55cfdc9bf4b09b3e3130a1356142a24a7db8ec5ea19344de617dc9fa99f
SSDEEP 1536:AyH1qvERANBw6qntn64lqVwhNDyUZXRqtn5EecbC9E0tT7+zn:AyHMMRANK6qtnsVON7JY+ecbC9EyK
TLSH
T1DD73AE5278C48272C1AE49B9017AF612663DAA204FD15FDB7FD8598C9F79AC1EF30213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\pl_PL\style.xml
Size 3KB
SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
MD5 034f37e6536c1430d55f64168b7e9f05
SHA1 dd08c0ef0d086dfbe59797990a74dab14fc850e2
SHA512 0e1911c882152a4e1059a3ce1880d7fb2aed1e1e36cbd37055de2e2a1333acb2a0233ba2a4d969ccebbef1e77809aa5e78807aa9239545beae8c548c0f8f35c0
TLSH
T1E381CA80A610BD0AC563F51573AB7509762CB36383ECCFC4F0EE2E698753652644B63E
MD5 SHA1 SHA512 TLSH

Submit Download

product.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\product.dat
Size 49KB
SHA256 737821b96941c073cfac485cf7e08616ed63a6c732ff37f1735acaec9878e0c3
MD5 09dfd5db212927d1259aff9e48e8a2d4
SHA1 6c19e099ace3cd42350035bc51b8ce30f6a3f605
SHA512 76204171034a95a49102f9accd392f60878bc27536fcc94e35bdc88e5ed40be8cdac4cdcb1e18895805c492a161d0ad5012b2ce6e8828e86f2fd8e274ed8e4a9
SSDEEP 768:rjZ5+qkjhJieQUzb32by4CrMfHvD4LTc+Ms57u+QUz/4da+7wFmXyfjonN:vZ5+qkDieQUf2WQUeWroN
TLSH
T1DD336DFB7E1E2EE55CCF221A9D7B281CA6F54915354A6888B2D2E958EC1C0B33CD6508
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product_new.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e58ca8e\CONTROL\product_new.dat
Size 602KB
SHA256 30e66afb9e9b4ffe7316ea1c9689f49ee4ac9d20a9e221cdfa1489d09fd7a106
MD5 f36acb8e058788b11e3d41a82669ffa9
SHA1 ee17ba3e097cf2ab947b51139adc5125739d62b7
SHA512 dd2d224d078ef6db48040cc9c9f0f30588c5b3e9f124262fbadd9620e2e28e2520aedc543ca1c276bc5689045a07b116e0033705c62ed25a7dd777eeb456b39b
SSDEEP 12288:nKDU+911nSo3ra3aZQN2NJ6x2myZKK2o2WV3TiZckNt4:nsUo1v3FtNA2mL0VtKt4
TLSH
T13BD4C684CFE81DBC44067BB92EE33A451FB3AE5760D9A29C87234C3CE99975D44412EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 387B
SHA256 72204e4f61bb796b0618531d35644f66ec68b474c4448705851687915c654fbd
MD5 33d2a9536a37b465529e5f9063f8f456
SHA1 83f0a000ef069208815827bf11dba82c88896b2d
SHA512 4bb2d3ea8df0f67fc3454b9e8f467f6012b7a8d672d975980df921264cbc52a62743a1e72d949ae34b503a5f52a1c07218973961e0c79d230d883f7016f24e74
TLSH
T11CE09B1BE8D1B0ABDEB302F9C897DD54BEC03D9A066D13147762940D3C32918FB41D65
MD5 SHA1 SHA512 TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 433B
SHA256 b7d70693201ccf0e31c73d1262aefee43bc029da7797c250cfbe2cad26b16733
MD5 420de6ff3159c2e3d110364b920e5574
SHA1 c7c4c2c7d3f14c5c4fa99c30af9decd0b0551faf
SHA512 141fad9e8f32217c24bc8eaa9414e9f3735ba6346228c934846df57bc58c03bb19847e76144d4a3193c07d6ce3e6f723628419fd73204d1feda4d88689a344af
TLSH
T153E0540FE891B0679D7302F4C8E39C007AC03E95055D1214373184093C32A14FB81D59
MD5 SHA1 SHA512 TLSH

Submit Download

WPS Office.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\WPS Office.lnk
Size 2KB
SHA256 b2737e5184ad4d682fbcadc8e4c819013a1fa9b276c8d841fe40c2879598996c
MD5 0cccba16bf61f16e863c841a3f87658b
SHA1 53f731917639fa65b365e4bd17919057d5c3e7ed
SHA512 f47a40f1d620365ee057ff22f4e2209f640dde1296fc0e01d74ac34138e2999a9409a6ad766b05bbccaac9655b1b3dae26b1586f714a1c0b316c6dc6961cb19f
TLSH
T114411302D5EA1B15D3FEDE3A55F615129932BC52AA268A5E0101D30D1E57E40EC2AF3F
MD5 SHA1 SHA512 TLSH

Submit Download

3QVQ5PHETJSLM6A7W8TH.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3QVQ5PHETJSLM6A7W8TH.temp
Size 9KB
SHA256 9c8fa768d165b335ddec9a8127ccb87a98b868e0d8a31b65a6b2fcac7bdf0b91
MD5 854f083e73ff018883d87604acddd8da
SHA1 f8bfa5a41690aa0c546d88621bb36b2e29957ec0
SHA512 d4378e4c4b1ef16200f179986e0f2f6153e71acf6e380542c350e298b47d64afe4e17a7cab8d5b1286912de6361a9b99d70fd7679a1118779003f57539a6303c
SSDEEP 96:JSoLHJEiFPfIRoLHJEiFP4Ia0oLHJEiFPKI7oLHJEiFPdvI6d+:somiVfAomiV4R0omiVKyomiVF6
TLSH
T18412551696EA5B91F2FAC63661E32A2479307CC2AB265B8E1046510A1F53E40FD17B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

onlineconfig.data

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cfg\onlineconfig.data
Size 140KB
SHA256 2aaa92dc3f743e48cf4258021a5f9da6941b4d6a8fe1cd42076be2a793484f21
MD5 083d8b04a691a45b58614a9cfe4b73ae
SHA1 5d01bf71bc876336d812552d84a0d85f7ed290de
SHA512 1623139b63b56e77a7edbd1c1fa89c70389093a378f7aeba40e486208446ff68e2cd79c66594f579b7e1dc8036d15dee27132b3ae959f90c186e2d80477f44a0
SSDEEP 1536:TBVC2bindn6Hlus8gbZf0PfIjZlIitJtQtKvUgk2yw:tV1iRelf8g9wIjDf+2H
TLSH
T123E3E91A71B0DC7BC283AE4D7936BD26754836EA28D694D8B99CC5CD7FC0A74012BC93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configure2

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\configs\configure2
Size 224B
SHA256 f1c9b1d153a5ec5b650921a513230e6eeea61ded8a5663d6a280190950525edc
MD5 cce3d995a76446d4f9bbb9ee73056bb0
SHA1 01ea58bea5df5eb2e440dab6dc39d46230e87867
SHA512 40307547651f2bb1fc897e85e1093d4b64d3e43a68e9c6899a02b64706caa2c0b28e677449ed7f7e60785eac4ed1c7edb43d75148c073b6424d861b169179ba5
TLSH
T1D5D023451C4030E3000DCCD7000405B0FFEF60413CA5CD7620020D740DF0C4710F20D0
MD5 SHA1 SHA512 TLSH

Submit Download

ksomisc_2026_08_27.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_08_27.log
Size 6KB
SHA256 8bae1227c901c3d10f6562c65ac627767d243def1658fa5e0e9f645f29e68671
MD5 e27dafb1fd5bcfffa846e69b8c7afc9e
SHA1 15afcb408e8c7ad85be905fea539a70ec90e58f8
SHA512 6e0b0659d92c0c8638b4638939a7f62c17b22954d498c29814691c44e3b4ab1bcd8da3d1a99a44d626ab166cf12858beed630be4dcffed424dfd3e389e8e95e9
SSDEEP 192:dFRY1Efdld4Pd+ttL6/yrMRYKO0fjdlRY1drdiMRY1o7dYdJ:dsW1YU76KJN+r
TLSH
T1E9D135AA26F94505FBB78F0395F604239E39BDD6AC30CD0E1891070988A7E91FD7076B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 11KB
SHA256 9bca930d6c3c6cc2cade3b5d17f75e545c4ede0d6c5c90ba03004a848e969494
MD5 344a8662dc77438b459c5204747d9d85
SHA1 2901b9a225cf256a6d8a597b1f023989d2dc8c28
SHA512 65cc90a6da4ed36ecf92481905f36304145bc45eed8d9ee65327c8b7c1aa638adc8ec979e04c0b67fc29abbdc0ea9235d36516feda465c643060243ec6b02b3b
SSDEEP 96:xOHJIicyCvTAFXGxG2jsJ1APeM2+jerUrGJGom29JOMMtiKe7SLvYMxq9A6+7TSM:xc72Rd0Ml1tP
TLSH
T108328793025E421C1EAE0A3853E1CE983A85E88D735639A03F73DFE34AEF451479F658
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 12KB
SHA256 2a08a885d1ab453ac3d929c808dad7d8e37b161bd6a3302d6fc4b3f8c4660a20
MD5 151cc7b7105c78ca511e1a052678fb50
SHA1 e7b3bcb3fc6bb311a55bc5810c7861d62ad9ae31
SHA512 9ee0a91492afc14577ac964113acfee9b046f7f253f55a0408c57990b29db3a6c526c36b6d93c94b3190d256fdd020e507feae60f91c2486e479938f70c63cba
SSDEEP 96:xOHJIicyCvTAFXGxG2jsJ1APeM2+jerUrGJGom29JOMMtiKe7SLvYMxq9A6+7TS7:xc72Rd0Ml1tkOAx
TLSH
T1DB426593025E421C1EAE0A3853E1DE983A86E98D735539603F73CFE34AEF491479F658
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 26KB
SHA256 dadd22f91acf9b5ca53792bea7f59b85b3323f8fdd3579522077ed82cef10a12
MD5 6754bd504bf1b58a8d6cdcd7b5fda7de
SHA1 11a1553568cfcbb08f95aea83aacb44a28354008
SHA512 d1ba4e58f5a669b8341bcd751fef9e7a91f94a2e6bead365cb7ea28a61862aa8716ac1468c94f5bd5980dba41e408e777ba88492198f3c46e7ea9f2d07bec37e
SSDEEP 192:xc72Rd0Ml1tkOAtI4ZLlb2QC7Z60LIJOPEBY2mszl9Uj0/rJ:BeMl1M
TLSH
T119C258C2052D81150BEF57A082B5CFA93697A5AE375835213F73CBE315DB84186EEE2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 63KB
SHA256 7e8a2416a71beebf80d2f15bec623927a271704c06c009712a5ee88e2b36c6e4
MD5 c59b93ab5fb25a056cf20a28db5f467f
SHA1 8f9136b14a943148e22346928be581a88d77c8c0
SHA512 12e18de56dc0a8663c493fb34ad630af8c559d93a369ca1f24879a05c5893f4900de897c3fea50503e3182aa0ad09f52a0f9a8ed2d6033c1f68cbeaa89b96f80
SSDEEP 768:BeMl1uGCqin9fZLPR8IP/PhsxLrHFc20rjKNGesg:IM/us
TLSH
T1A353A0C2091D81141EEF476086B6CFAD3257A59D322839203FB397E359DB4429EEEE5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 63KB
SHA256 9b98a1d7ba92ebd025a7033ffa5f23e7b875f80215ebe7d7fcaf34224db72506
MD5 aa9a951bc6989828baf817c79da44d84
SHA1 fd92bf587a8986680cb86baff7eb11037a829f66
SHA512 119d763adc166b986f0477cbdab3d086394f0eb0fd7530bcdf5192ca9d347f139b75111bb9f542b6ac7c2290ec060bf624900349103704e8dcd5348b87327acd
SSDEEP 768:BeMl1uGCqin9fZLPR8IP/PhsxLrHFc20rjKNGesVq:IM/u4
TLSH
T1E253A0C2091D81141EEF476086B6CFAD3257A59D322839203FB397E359DB4429EEEE5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 52KB
SHA256 d815c52a483716b60a4ac2004e5c30016bef6f24d447e777470731d7ea01ece5
MD5 3839f12dd051a7d917d9b7860eadaaa7
SHA1 c7ccc420f5ae6ad697f4d4e75d44295fa8f1be54
SHA512 ea7edcaa16b40661ac8d036c1d3dddc8b1af099ee3cfe6b05405ac88d60b96fb94f9e26524cd6247d84bb16a098847136b38655ed3cbb7f63101913fe4f5c51f
SSDEEP 192:xc72Rd0Ml1tkOAtI4ZLlb2QC7Z60LIJOPEBY2mszl9Uj0/rMCu9cub1SpFgdvPG7:BeMl1zi844jjC0F1M5
TLSH
T1A4339DC2091D81141EAF876046B5CFAD3647A59D332839203FB39BE359DB4429AEFE5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-i386\cef_high\1\kwebstartup_commercialize\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

plgpack.plgx

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\list\win-i386\12.2.0.23196\plgpack.plgx
Size 9KB
SHA256 172ec444e605c31301451cf8480c63797b3b5f90d39f16c1cd39d1b1a9c32a93
MD5 a2e9798625cb268691b9b1db261bd5f7
SHA1 5040712fe3873774a285ec9cf574ff23ab32f220
SHA512 97482576f820acae709582ee6d9b6e9b2d16530e0b66ec428529614f1bbd20389b242be6d0a816cca6b0a414c68f440ecff1529e570524b36e864804c3e65078
SSDEEP 192:5260pe7TAzvM2dW+Ao3QaFuXBoxqBhqyHyy1EWXIk1l90S0MAGsLhwZP6b:E6932oQQIuCxhAyYECISV0GIhwtK
TLSH
T19922CF1477244948FD0B069599ACF26CA1B276730E4CE1BF27725DE0B30B94FE2B2D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kqingdlg_1.1.2026.0\download.7z
Size 801KB
SHA256 cf3ec4df99146daa0cb13d8fe127922278cf0da9be93175e59abe420f3c7339f
MD5 bae883f60ee1476d51f8c42f15a566ff
SHA1 c65de30e22d017947857298f10696e5e82650f18
SHA512 b615a889c655d4ebc5b0ff6b9a0bd7ae50d63b6780ba351d26bcda6998ac6d4ba694089c26e726791648483432c3a8ac8a3c3e64ba1187683bee102ff005e810
SSDEEP 12288:xa1CA01Rkvrrz52o3ncJw0Fb0j7KHiFnniTZR0xtwzizHXJGd+Z1rqcUKx:xPkTx3nyw0tIRpiT/2Lwd+nqcUKx
TLSH
T16B0533252581944A9C5F38B8F1D33583CE09C8F4A0F669F88FC4D3C9664DB6B34B97A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\krpt_1.0.0.116\download.7z
Size 1KB
SHA256 7af6c5ceb290ff91fdd9d2d756dd728b61925da67465e102c530e76ef8dc6ad3
MD5 e70c324fa11c0ec0c62d734672810381
SHA1 ab19c58917a059a3efbcb4b72e4dcd943a665212
SHA512 810f5ac81a0be2390402d994da56ea2ae1ee0cd2c46f892bad4a082601b31d75d328b5941fd4a9574d49d4bde7f58a8bca9171fc0928a772d39976e4b81c9a38
TLSH
T1AA11B6FBCF76880E88D7707BE8B8804E43144976D5A254393F8FB4124100449C4ABD06
MD5 SHA1 SHA512 TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kscreengrabapp_1.0.2020.421\download.7z
Size 22KB
SHA256 4c71e2c0de1dae39146f39f6cb1b828190989ede5dd84a700eec2944078cb3d7
MD5 01553b230e40fd8276cdc6bac1dd2f38
SHA1 5756c1aa9c0918ce9ec7a6944a2b9b911e2fa292
SHA512 f359bcf821856ad2609b4c7deb64a76bc0387254626c3da0f5eba710a760e1db8a164bbb4bafbab4333dd5745062b183afd55a2b5db0c406e0c0d004bb875137
SSDEEP 384:PcS24GKOl42kdxlxj99h+xkp9Tj5gmU1ob5iy8rBkNmNQ8WPbVSmxoTANRMa7Zay:HGKOl42qv9gkp9X5gmf5iJQ8yByTANR/
TLSH
T1FFB2E122D275B00DE7420AB338501C564D33AB3717394D2E991E61BB7EDA2DEBB8D364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kwebintlupdateinvite_1.0.0.11\download.7z
Size 463KB
SHA256 9e914665262552992ba1f0abcaf54ebb1900a1d6411c87f5b5f91278a26e19d7
MD5 be882892ade7b5551a972a3e6cc7e2ba
SHA1 239feded07588d5a9d84e59dea1ed89446e717da
SHA512 69c7497978e07cda8216b66a1c3e4740729a9c33beed85061473ab4e653ae79e9891ea831587ce20d542d06cebfe7ca9ce1404a063a311bb26f0b73088866d60
SSDEEP 12288:V2Pqx82eJ1htVnJuYa5etzXPK36wdDwcHFz3mV8Wb+I6:VDReJ1ChGTPw6aDJFbRs6
TLSH
T11BA42350B278B9C7A149C4E7D4C3FF06C0BFBCFA2691F598318827A191712BF552E662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kwebstartup_commercialize_1.0.2025.117\download.7z
Size 20KB
SHA256 39afcfc0180c073321ce86daa065a361678a3866b20c5b663da36f615f1b2e8a
MD5 7ff215f4a9302a9780035052251c298d
SHA1 ec626c3d4b33c9a2d23e2add2b768ef37c392f62
SHA512 5e0a8a246a756dce115df89e30be9f555593200383ac841e45567fc5f70944557c268368424e888d14ac13ba573382ab6ce9a418a1318cdc80c6326c8670ac19
SSDEEP 384:mRgUT7CQ6+MOBSYx+bIAvSwpFw3XCFp1VJBjV0fpWNfVatkG6oNGr1Ee:mziYSY8/6bOlDCpW+6G6oIr1J
TLSH
T19092E1D7CB442AB4A812332656A93925550336FC9BC24CF95988E8E8C3F1169B06E3CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kwebstartup_commercialize_1.0.2025.117\run.ini
Size 303B
SHA256 9378a1ea8baddf207fa68aff55acf14f68e348c6dba6bc800e25da37b84a740f
MD5 c646b8698a216d20e84200150b24eb0f
SHA1 d6c9929f7197d6d9a7406df5ea28f04d36fb0ed4
SHA512 8c2e63b2bac753a285ee0181cb8fd3e27e21771fc3ce9a28f158b43dd1c377945fda17652bc742b30e573cfd45660db642e68db49680bb812d9df1eeb9b2656e
TLSH
T1E1E07DD8D0787FCBA83787B1D854BB4B71A5B635703D0983643048894EA74552484059
MD5 SHA1 SHA512 TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kwpsinco_1.2.2025.17\download.7z
Size 141KB
SHA256 5138b347bbdc15cea032760c8749af3610e008694067958dfa8016780e5b192c
MD5 65b65a0db5734d030994e45c80964e69
SHA1 79c642a2fa4672d77259ad746c736f895019f18c
SHA512 12cd84491c6c50ec93c4a7f2793feffbf4b79d7f3e01e4037782a4f152531052ff1f42c4e5cd23681fd93a4b9ad442631d07559d7ceb1000616cb8c4525cba8f
SSDEEP 3072:vD+ffbixAjj7DeAQK4bV+1erh0WWkQ5GJT0rIwz:vKmADeAQKGE0rh0ST0rIwz
TLSH
T1FDE313922E05550EF283627DEBB31D6DFAD95F25E77A0A21E039F51B14374AD11F4208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kwpsinco_xa_nokso_1.0.202504.22\download.7z
Size 112KB
SHA256 23afc2574bb2a47681fe6516f7745e92f62540e6dd1f31787385631701ab07d7
MD5 6a8847c5e6536271950f41d71b8d432c
SHA1 42283c139df5215e05951bef472259751c4f3f41
SHA512 c961223c2718706a4ad1b457b00ab36a28b015c7c298e9dfff64bcc964d701c6b7f482c1cc109a58784237728cd56907e0765a209f328619f82a7ca16923f400
SSDEEP 3072:ICFnDnqzIfIJakbsqYEqtK6G4x1DTQ8JkMaJS8Fj1Tlyc:lFnDncILIsqYlvt1DTvJhYSsT
TLSH
T190B3121C847B4D3F6E84577F4662AEA5FCCD1282BFA05A166B86506E830B27707EF058
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\pdfwspvreg_1.0.2024.225\download.7z
Size 33KB
SHA256 b1e23708623e851ea6478c684c6c6194797e1e48c639142069ed3bda8c813296
MD5 6c3c078b80466136de5cf99497f1927e
SHA1 6d73d44b55323c3a255dcec34ad78b454c2e800b
SHA512 81e71b2c81869c95fb05cebe32c9d434215c8c3f7fa6eeaef2ca7802add967a0bda7d394e854060fa8b9f150f8e57752f5628892552b6e81c3d6a8bd26f461ef
SSDEEP 768:ct3bXeibL/bSahUVd5nMqkxNU9rHsz/GsFJ9JTjVpQR:ctrXeibDbZhUVdzkkM7nvw
TLSH
T123F2F1ADEB930AE1D11E7518CC2137910E24FBAD046EA165D29B670ED20DE58CF7CE4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\upkdcsdk_1.1.2026.4\download.7z
Size 531KB
SHA256 a3c3294e1b98c4905cc8d0446b4b1d05ace8e6ca49e815b8341bf6865cbccc54
MD5 f4e944b098e68f40e23bd014cee3966e
SHA1 ad21c1f49b5af3086d4dc151913fc2a63152bfba
SHA512 0ef834cfbb4034fbec62347f5064fc249164b3afe82e97b4d0d0ac754185d416df02851f9a1cff51b59fba36e44ff61eb7eb94234d39a19b1aef1d14e41089dd
SSDEEP 12288:SF/XwE+7/unG1MBahB0vCxsXobIZfsXxpq41o4sCmJ:S9wJuG1yahivCmXVZEKJ
TLSH
T1EDC423E446E5D341AC62FDC71679E306398BAAE0219E74A1C474328DFF2AB6B4D0CC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.7z

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\wpsbox_1.1.2020.437\download.7z
Size 532KB
SHA256 9d6e49ec3f637fc60c112b57eb4d2274b6c7c0329cb3784b770d55639d830d79
MD5 e8986b808a8f8a5dfd16a4765256e761
SHA1 56633743dd087d21e05a55fc9f2d72360528ca1a
SHA512 270c5892bece618d691c21c4992dbeebf02929ee2dd73327ed2660ff74be733e9534d714aa7ed137d15ab232c08aa34315b41867ef95a2d07ebe2a303d5be813
SSDEEP 12288:qgt7SCQSfsmiMVQxBdBRV3YkPau6A3k7laYe4wbZ+h+65jxDw:q/CpffitxLVTmKucY4S5jxDw
TLSH
T194C423DEE18BC52AB047EA045EEEA1818C3464E38125BBEC7F3E721BEC470967EC4551
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-5253-0x000000006F6B0000-0x0000000070F34000-memory.dmp

Download

memory/116-5254-0x000000006EAB0000-0x000000006F571000-memory.dmp

Download

memory/116-5255-0x000000006B520000-0x000000006BE03000-memory.dmp

Download

memory/116-5276-0x0000000003200000-0x00000000032C6000-memory.dmp

Download

memory/1272-5106-0x000000006B520000-0x000000006BE03000-memory.dmp

Download

memory/1272-5104-0x000000006F6B0000-0x0000000070F34000-memory.dmp

Download

memory/1272-5105-0x000000006EAB0000-0x000000006F571000-memory.dmp

Download

memory/1272-5140-0x0000000003230000-0x00000000032F6000-memory.dmp

Download

memory/1608-5399-0x0000000003200000-0x00000000032C6000-memory.dmp

Download

memory/1608-5373-0x000000006F100000-0x0000000070984000-memory.dmp

Download

memory/1608-5372-0x000000006B520000-0x000000006BE03000-memory.dmp

Download

memory/1608-5371-0x000000006E500000-0x000000006EFC1000-memory.dmp

Download

memory/1980-5366-0x0000000002B30000-0x0000000002BF6000-memory.dmp

Download

memory/1980-5342-0x000000006B520000-0x000000006BE03000-memory.dmp

Download

memory/1980-5341-0x000000006EAB0000-0x000000006F571000-memory.dmp

Download

memory/1980-5340-0x000000006F6B0000-0x0000000070F34000-memory.dmp

Download

memory/1992-5404-0x000000006F6B0000-0x0000000070F34000-memory.dmp

Download

memory/1992-5405-0x000000006EAB0000-0x000000006F571000-memory.dmp

Download

memory/1992-5406-0x000000006B520000-0x000000006BE03000-memory.dmp

Download

memory/1992-5428-0x0000000003320000-0x00000000033E6000-memory.dmp

Download

memory/2112-5166-0x0000000003600000-0x00000000036C6000-memory.dmp

Download

memory/2112-5119-0x0000000003600000-0x00000000036C6000-memory.dmp

Download

memory/2112-5035-0x000000006F6B0000-0x0000000070F34000-memory.dmp

Download

memory/2112-5033-0x000000006EAB0000-0x000000006F571000-memory.dmp

Download

memory/2112-5034-0x000000006B520000-0x000000006BE03000-memory.dmp

Download

memory/2524-5211-0x0000000003250000-0x0000000003316000-memory.dmp

Download

memory/2524-5187-0x000000006F6B0000-0x0000000070F34000-memory.dmp

Download

memory/2524-5185-0x000000006B520000-0x000000006BE03000-memory.dmp

Download

memory/2524-5186-0x000000006EAB0000-0x000000006F571000-memory.dmp

Download

memory/2732-5312-0x000000006EAB0000-0x000000006F571000-memory.dmp

Download

memory/2732-5337-0x0000000002E10000-0x0000000002ED6000-memory.dmp

Download

memory/2732-5311-0x000000006F6B0000-0x0000000070F34000-memory.dmp

Download

memory/2732-5313-0x000000006B520000-0x000000006BE03000-memory.dmp

Download

memory/2952-5215-0x000000006B520000-0x000000006BE03000-memory.dmp

Download

memory/2952-5247-0x0000000002FA0000-0x0000000003066000-memory.dmp

Download

memory/2952-5216-0x000000006F6B0000-0x0000000070F34000-memory.dmp

Download

memory/2952-5217-0x000000006EAB0000-0x000000006F571000-memory.dmp

Download

memory/3156-5146-0x000000006F6B0000-0x0000000070F34000-memory.dmp

Download

memory/3156-5147-0x000000006EAB0000-0x000000006F571000-memory.dmp

Download

memory/3156-5148-0x000000006B520000-0x000000006BE03000-memory.dmp

Download

memory/3156-5180-0x0000000003220000-0x00000000032E6000-memory.dmp

Download

memory/3504-5281-0x000000006F6B0000-0x0000000070F34000-memory.dmp

Download

memory/3504-5282-0x000000006EAB0000-0x000000006F571000-memory.dmp

Download

memory/3504-5283-0x000000006B520000-0x000000006BE03000-memory.dmp

Download

memory/3504-5307-0x0000000002EB0000-0x0000000002F76000-memory.dmp

Download

memory/3532-5004-0x000000006B520000-0x000000006BE03000-memory.dmp

Download

memory/3532-5013-0x000000006B0A0000-0x000000006B0B0000-memory.dmp

Download

memory/3532-5005-0x000000006EAB0000-0x000000006F571000-memory.dmp

Download

memory/3532-5006-0x000000006B0B0000-0x000000006B0C0000-memory.dmp

Download

memory/3532-5029-0x0000000003380000-0x0000000003446000-memory.dmp

Download

memory/3532-5016-0x000000006B0A0000-0x000000006B0B0000-memory.dmp

Download

memory/3532-5015-0x000000006B0A0000-0x000000006B0B0000-memory.dmp

Download

memory/3532-5014-0x000000006B0A0000-0x000000006B0B0000-memory.dmp

Download

memory/3532-5012-0x000000006B0A0000-0x000000006B0B0000-memory.dmp

Download

memory/3532-5003-0x000000006F6B0000-0x0000000070F34000-memory.dmp

Download

memory/3532-5007-0x000000006B0A0000-0x000000006B0B0000-memory.dmp

Download

memory/3532-5008-0x000000006B0A0000-0x000000006B0B0000-memory.dmp

Download

memory/3532-5009-0x000000006B0A0000-0x000000006B0B0000-memory.dmp

Download

memory/3532-5010-0x000000006B0A0000-0x000000006B0B0000-memory.dmp

Download

memory/3532-5011-0x000000006B0A0000-0x000000006B0B0000-memory.dmp

Download

memory/4616-5171-0x0000000002D70000-0x0000000002E36000-memory.dmp

Download

memory/4616-5056-0x000000006EAB0000-0x000000006F571000-memory.dmp

Download

memory/4616-5057-0x000000006B520000-0x000000006BE03000-memory.dmp

Download

memory/4616-5055-0x000000006F6B0000-0x0000000070F34000-memory.dmp

Download

memory/5700-6945-0x0000000005780000-0x00000000057A6000-memory.dmp

Download

memory/5700-6944-0x00000000032A0000-0x00000000032AA000-memory.dmp

Download

memory/5700-6942-0x0000000000F50000-0x0000000000F58000-memory.dmp

Download