3cb6d3f2237d6b9ff3a903de28d5ac3c691db1685f0cc67bc4070cca11b09a30

Analysis

user interaction
yes
max time kernel
96s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20260827_wps_office_inst.doc.exe
Size 5.5MB
Sample260827-g1659sysbw
SHA256 3cb6d3f2237d6b9ff3a903de28d5ac3c691db1685f0cc67bc4070cca11b09a30
MD5 d23bbf6f75142b9a5cf8aeaa686feb9e
SHA1 7e415afa83b52ea1c38bac41198840c767e22c2a
SHA512 a4eb78303b387b9da9383d943dc06b9e615a68054276ffa41cfdb382db40c2fdff09c59d0abbb63ca4c96819042218e5d63b73b93ed043e1ef589521ba2c8059
SSDEEP 98304:umZ3eGE9jD37+nOlsYf3Njm2f6OFhKvszGZ9pDjAB/qZ:1uGE9/IOlbBRhKvn9pXApqZ
TLSH
T13946B012FB8680F1E5D101B0547BBB76583DAA284B2489D7E7D12E7588302D37A3BB5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5960	ksomisc.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	20260827_wps_office_inst.doc.exe
File opened for modification	\??\PhysicalDrive0	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
File opened for modification	\??\PhysicalDrive0	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 3 IoCs

pid	Process
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
5332	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
4520	ksomisc.exe

Loads dropped DLL 48 IoCs

pid	Process
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe
4520	ksomisc.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20260827_wps_office_inst.doc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ksomisc.exe

Modifies system certificate store 2 TTPs 64 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\FlightRoot	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\FlightRoot	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\OemEsim	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TrustedDevices	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	20260827_wps_office_inst.doc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 1900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54367e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd90b000000010000001200000044006900670069004300650072007400000014000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1556200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c70161090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\OemEsim	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TestSignRoot	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TestSignRoot	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TrustedDevices	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	20260827_wps_office_inst.doc.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
4196	20260827_wps_office_inst.doc.exe
4196	20260827_wps_office_inst.doc.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
5332	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
5332	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
5332	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
5332	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
5332	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
5332	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
5332	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
5332	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
5332	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
5332	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
5332	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
5332	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
4520	ksomisc.exe
4520	ksomisc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Token: SeRestorePrivilege	1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Token: SeRestorePrivilege	1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Token: SeRestorePrivilege	1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
Token: SeRestorePrivilege	1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1804	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 1804	4196	20260827_wps_office_inst.doc.exe	90
PID 5332 wrote to memory of 4520	5332	96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe	92

C:\Users\Admin\AppData\Local\Temp\20260827_wps_office_inst.doc.exe
"C:\Users\Admin\AppData\Local\Temp\20260827_wps_office_inst.doc.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4196
- C:\ProgramData\WPS\Installers\96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
  "C:\ProgramData\WPS\Installers\96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -curlangofinstalledproduct=es_ES -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1804
- - C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe
    "C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" InstallService
    3⤵
    PID:2420
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -regmtfont
    3⤵
    PID:2620
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\\office6\ksomisc.exe" -setappcap
    3⤵
    PID:4000
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -sendinstalldyn 5
    3⤵
    PID:2884
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kwinappinstaller.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kwinappinstaller.exe" -i "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\menuext" wpsappext1 wpsappext2 wpsappext3
    3⤵
    PID:4808

C:\ProgramData\WPS\Installers\96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe
"C:\ProgramData\WPS\Installers\96aa40b0f55bd6748cdc4993345e7fba-16_setup_XA_mui_Free.exe.601.1133.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -curlangofinstalledproduct="es_ES" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5A3049 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5a2973\
1⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5332
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -setlng es_ES
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -getonlineparam 00601.00001133 -forceperusermode
  2⤵
  PID:5368
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -getabtest -forceperusermode
  2⤵
  PID:4164
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -setservers
  2⤵
  PID:5896
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -register
  2⤵
  PID:4444
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
    3⤵
    PID:1968
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
    3⤵
    PID:5600
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
      4⤵
      PID:3516
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -regprogid true
  2⤵
  PID:2672
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -assoword
  2⤵
  PID:4420
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -assoexcel
  2⤵
  PID:1732
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -assopowerpnt
  2⤵
  PID:1544
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -compatiblemso -source=1
  2⤵
  PID:5612
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -checkcompatiblemso
  2⤵
  PID:3500
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -saveas_mso
  2⤵
  PID:2948
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -distsrc 00601.00001133
  2⤵
  PID:936
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode -source=1
  2⤵
  - Network Service Discovery
  PID:5960
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk" 5386
    3⤵
    PID:4120
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -regvascontextmenushellnew
  2⤵
  PID:4532
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -regpersistprintmenu
  2⤵
  PID:4824
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe" -updateskiaconfig
  2⤵
  PID:1952

C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe
"C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" LocalService
1⤵
PID:1496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

616AD1AB067CFD351D6C0EF6F3E12F40

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40
Size 1KB
SHA256 8cfd849d45eb825cb298aa8ade9bdde9b786c3ad18d148e2930245f997f8c83a
MD5 af8e135593c1e8468714e53bb835f0d4
SHA1 9d14d181f222dd0fbe1efc6de127fb2918067aee
SHA512 3e4a8717f2ebce3f42df609766dae0fe25648611af69e5cb93260019ada8304f95fac2d88c822de04a29ee1fd12c2be8b010f084804110c45c22e25a53e8712a
TLSH
T11B11DD4A05542A27B90A2E70DCCACCA7ADF1B38A82919C4BD75089C145A3BC41E8C4BD
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_660CACFBF957CBCC19C054A0402E41C3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_660CACFBF957CBCC19C054A0402E41C3
Size 727B
SHA256 958da9400db8d2202d6ccd6c4e6529e0106dfa233d3673842ea8cfd4eff94cdc
MD5 e75e26c25e4152bd6fb842e050a51026
SHA1 a9ea7f9584d40c7321fd206d028e545bb823696d
SHA512 a0d5189705ebab57f8299da9d41428d8cff17c519b55ecb9dc9ef858d1567bb7a96d4187632b2d95956b91e9683571b6f77a0896c519d88027ba012b59e882d1
TLSH
T15601600875265AE3898ADCA00DE4B124758383B0164E8B4EEE3A00A641803BA2F1AE70
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 1f5ee77c64261bf5b920cbdf6cac5d2c23fb36c5e194f4737d0c5909e74152bd
MD5 02038e7d7fa8a213fbc922bbda0df5e3
SHA1 b2690bd396861de44a468eef3128daef9daf55ef
SHA512 8fbe24010c0ee17d32e43c727c2226dfd5762d97f5143c2c0b29c78deb8705c927f67020beb0d17044711ec0dd2a69eaf95840f70a2488bae419481d80faec32
TLSH
T126016042682CAE1878217C0346CCC4FCBE91C2E96888C9A501EC049EC1ECF65B99B409
MD5 SHA1 SHA512 TLSH

Submit Download

616AD1AB067CFD351D6C0EF6F3E12F40

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40
Size 252B
SHA256 2f4702f316b1330813c92876296cb447d4db9897b40b0fc8aaa67ea3722f6dc3
MD5 55d2cd4e383f525cd0ac13ed95405077
SHA1 a9d443626f4b4dc9691127347e1cb627283ed048
SHA512 51427463683a792d67de5fc32e1181ad63429d8ccfa2ef59b82c6f889794ec416227c3291a66cdb251da08dc98773c4d2fc1222a1037d2c2622a1081ab18aba9
TLSH
T1D3D01310B7E62311F15515796F605641FF15B5679845DF190B6F070F5C2DF404F31506
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_660CACFBF957CBCC19C054A0402E41C3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_660CACFBF957CBCC19C054A0402E41C3
Size 404B
SHA256 bd998c5d27829956cf7d2dde389ee6a4564c53aaab285a5f887f6ff1807bc30e
MD5 3d0227fad5a270fc9cfefb75d47329c1
SHA1 d8818a91b70aa9f02579935f4b1a7c8046dae617
SHA512 fae1a9ea8dc1cd166b04f88620424e74e1b905a1b809e47dd604efd47ee5ff6f77a1eb4d399b50f7d1156cd5780db31a1f0cf2be96e577dde1d060a105428bdb
TLSH
T1A2E0267823FA456AF4F4D03942FA9D22088AF65A060A8BBD1690164AAB2AE400CD2630
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 c46cd4c6e93ddb4c7beaa37b7d1da542623bfdd6de7b904050b6f0172f399e8f
MD5 a0100c74581b86d9e29fb6535e68bc44
SHA1 9e1aebcc40f8c8c3f424cf37b44e199c3e888d0d
SHA512 27b52f55fa446dd07784ea677c5e925ef888a75632ecd2face5844d8ae1f35d29cab2671c08ca04b45536693702c8fc2a61d4eb52114638c1538b4710859dea8
TLSH
T187E0682C21EBB91EF0909C3442F5A1B60D59E2011104C3B916C18308A71BE406C20AB4
MD5 SHA1 SHA512 TLSH

Submit Download

Qt5NetworkKso.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\Qt5NetworkKso.dll
Size 1.1MB
SHA256 e516dbe63a0b57f21c4cae2350a39c62dfb5b13650f0ca1ad74c2ba3a9aa72c4
MD5 3472b66c2a4acd21968108b56d2c687b
SHA1 a4e5118dee0f556ebd1b539c5615ef1557d356a9
SHA512 d442796ea1a9ab3a87ce1ef4655a1a04b4b04420ee3d6b5d45e4ab2775220cd81322acd9695bc7f470d113fe2dd744ae17fcaefa926b15c9cb25f081f6ea0833
SSDEEP 24576:jjAcWxiAenqLvATU5hNfgv+O6vZ+K9Lr0amOyM2g:jyXeqLvATU3Nf0+0KBBN
TLSH
T18F354A6FFA018635F8935172C6E9FFAAA02C9421431B63D7F748BF145570AD26A3F182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5XmlKso.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\Qt5XmlKso.dll
Size 170KB
SHA256 7f0c65a44653d92ee6ece93ebf86d0661d2f7b602ffd41be50c09d3cf5d20968
MD5 d46eab9d59dc4cd341dc9075b84bf7b8
SHA1 3ab30e9b5f5269d3d901268b4a3f2acb7a7f7807
SHA512 d5316c6050e2134adf0ffd4f4151c3171d7416956fbcda29da91820b57c1889d8d8d79211f4003a95673121e5c87f647561852f076d7063a7be92e44cdc8ec72
SSDEEP 3072:jj55786gnSipAjpDhhrtzdlmlUAFriVClc62oRZntWQEWk:3557gnSipAxHiiVkc62UAQdk
TLSH
T1AA041863F806836AF57282315CEAA56EF5ABDD19033903C3F6497B2709746C21A3F1D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\addons\kqingaccountsdk\resource\vippayment\run.ini
Size 171B
SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
MD5 b30cb271e143eace0f55ea2e562e1e9f
SHA1 9d97dbf24931cfc114384c3f4dbbae21c9e51be5
SHA512 dc593185fa63b458024c3a913c558e5686806154181dea67eec786ada50595c53bab822833ad1e76c9acdf21be3eba50631391b7e575d7f1f6409ceccf966535
TLSH
T1AAC080D4D0256F97DC31C6B5ED54AF1A7560E700251C1EC3D530DC4E9E9696551C805D
MD5 SHA1 SHA512 TLSH

Submit Download

kwppcopilotentry.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\addons\kwppcopilotentry\mui\pt_BR\kwppcopilotentry.qm
Size 334B
SHA256 984ebeef80f6f50907afb92e5b5ae72df49fce045552c118a77a8887cc98e19b
MD5 2b42be10ddde43a0b6c2e461beae293a
SHA1 53888c4798bc04fdfc5a266587b8dc1c4e0103f3
SHA512 be3ebd02d37de367200696351fb5f9cd0ec4c206c3a33f281cb8b62386457a30a899322798c63a0d495577393e47258994feb7f8e2445645f552c2b7a2de6778
MD5 SHA1 SHA512

Submit Download

history.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\addons\qing\mui\default\res\clouddiskhomepage\static\js\default\history.js
Size 198KB
SHA256 632f2d1136280eaed004b7231ae90ed76bbd06c25f73d900873abc1c6ae71769
MD5 d79cca3c379636510ddd6adc09a31d51
SHA1 6470c9569dcbd7b2ef0c75549799ef3c93fbf523
SHA512 1f066715066c6125e7556455f67eccdafcfb0a15642c25425c865c6def6ea3dae819018fa8d2abdcf9eca53de94c49f1310bd1c7883247f84a6043df03e1f80d
SSDEEP 3072:nEXIajlB1Y5cXuKkx9XcZpxOMKLm4j22creMSMikF:nEXR71ocXuKkxqMbm4jpMX
TLSH
T10314F68DB296B07507E720B4412F150BF27AAD69680E85D0F235E8E97DB884D917BF3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.cfg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\cfgs\setup.cfg
Size 456B
SHA256 ff445cf361df14616040107d93e99be5a3862b5ad20ec3488452a1a42b2e076d
MD5 618e2afe10b4ca35a39bd33783032a54
SHA1 bf59f276b85586765000ee4230d437ef5f60a9d2
SHA512 b8f078ef783de19f81152dcdd66007aa787d4b7dbe90d660843f0ae40a944a38eaea829a53b22595b3bb04b272fd58f41a5aca71edbe8668b71e5c205cbdf1cd
TLSH
T149F027AB030270752B61971410B524E2A7F602C9255A880E116898496B2EC3D81BD136
MD5 SHA1 SHA512 TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\dbghelp.dll
Size 1.2MB
SHA256 c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f
MD5 4003e34416ebd25e4c115d49dc15e1a7
SHA1 faf95ec65cde5bd833ce610bb8523363310ec4ad
SHA512 88f5d417377cd62bde417640a79b6ac493e80f0c8b1f63a99378a2a67695ef8e4a541cedb91acfa296ed608e821fee466983806f0d082ed2e74b0cd93eb4fb84
SSDEEP 24576:9AkmijauMug/iyFzb2DfsPV8A4C2vNI1cPdf8xZLGNfav9T:9WiOuRg/iyFzb2QN83XfeYaZ
TLSH
T12D453B31E641817DCCE731F656BD323D266CAAB2130422C722C81FF99B666E17E3459B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kbase.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kbase.dll
Size 290KB
SHA256 8f2e14188b7049e4aa82f0091fff676b8080b8784552137334b72f7bbe124473
MD5 dec1d7924d84582a4e2eb7963bf0345d
SHA1 3716166df97a4309086393a924846a6cff36f6b4
SHA512 da30ba09d7f1906468d01cf59c5df6c130b353a592afa29a89b6ccae392f97a8abae577a6548e8e17446fdd99719cf99721aaa3979cf9128d5eb8d11aaf14dcb
SSDEEP 6144:+rSL9e1KkQnzx47D5Hc1CCHXeA6iITcebI+irswuCz:+mLk1KHac1BHXJ7IK+xwuCz
TLSH
T133547D727606853AC9CF02B0182D87BED47586A52F77C0C3F3986D6D6A229D30F35D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdesign.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kdesign.dll
Size 907KB
SHA256 a82d5eedd4f7c155b926fdb27fbd88e6ae53f1d24a48f49ce35662755fde0bb1
MD5 0f7c59e14ac1dbfddd86ab14adbafda7
SHA1 09578ea2da19409108e0eac568642deed485b793
SHA512 c149c090623f3f0d6d3114a0bd235f065b23e8d2ef2e0a989fc9aef0242d3e7c11f76988420dff9bf195d8eebb24cb18242b4f3ab771bf03bef4f616e25814a0
SSDEEP 24576:EuGEvB3uAugKM5ax0ZmvOnGUV4M9KSsSOlD1ExppJ0:ii3uAugKM5ax0ZmvOGUV4M9KSJKD1EpG
TLSH
T14C157D23EE068379D7FD933009C44355E3BADC2106A2475FB94DFBA925B96E38A19343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kprometheus.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kprometheus.dll
Size 8.8MB
SHA256 5b0e7e084b225a3fbdbc2f289524f68771201225f1159abe5b24f90023ae0fbf
MD5 94e46c4f70fe5932a97eae283f9e52f7
SHA1 51b3ef051704238349e451297a2fd75f9cba85ae
SHA512 775e83b92b70c86821e37234d5f0739815635dadd76bcc12d9bda9f8e3216e33d90d9a97bcec7a3bb83930aa8afc3a93b9b394638db8d4d585df98afd5110a75
SSDEEP 98304:w1hr8lZ8WtgZhVkEJV1CkAcZiempQNU14m3Ozm/j4WYSehPD7:w4v8UOPVJV1CYMDpQmr+q/7YZ7
TLSH
T197964CA3AF098239E0ED5378492867B6905C88E42B7E11D7B1966BED1430DC78B3DF17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krt.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\krt.dll
Size 1.2MB
SHA256 332e4117eaa6bc0d86f58d880cb413639d140d3fffac02f55ccfc9c35b1db145
MD5 745c19b9bba7f5a57d4201c75b7b9d2a
SHA1 49cc5ebf80605a65cfc792f8312ca54184e611e8
SHA512 81d95379879d49679f35dcaa1a482ff5a3fea14c93b43d3fed61ce3041ce8f19034b2460b75c647b1b0fad45e14eaaaeef63ab6b419373a4aad8f59249472a30
SSDEEP 24576:QjNVOq2t11Ss7voSQP57I76FY/Z5Wv6iWwG89Mij48:Agq2t11lotP57RY/Z5Wv6iWwGNij48
TLSH
T1FC456C33BA2DE237E75C24B07928679B502D9C74077653D7AA883AA934341C36773E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kshell.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kshell.dll
Size 24.4MB
SHA256 69ebabdfbde0101af884be1d663bb23292feeda5a41be5ff64ecf7cda3b056aa
MD5 afe2f4ad5018ba55eaf3bcbf3642a862
SHA1 adbe2f3ea4960f5b614e7b43d28f95c8947ebd04
SHA512 04f57d9703dfb7a7ea43a20276039811618ed918587235eb85bce23c7c773c6f43ae7d84b81330c3f4eac97edd629e9b7a3ef5d77a2d9b1544a413cded0aca3a
SSDEEP 786432:ggFI9EFYQmruoo6KcepStuFfk3D0U0jk5:ggFoEFYQm6oo6Kc4StuFfE0jg
TLSH
T1D2475B337774C63AE5A951F85928ABEA801CBCE10B6356C3E254FB9B28705C75B34B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kso.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kso.dll
Size 25.0MB
SHA256 e07a7977016d1d0e06ba699d62133b1f217cf867f0fc22c77837f74ab94a5611
MD5 88c15161edb31953b287ca0c1829fa43
SHA1 5a8f0a1292777dfd5bedc163fcfa8b6bfd8db2ab
SHA512 28d161163c77b3272063f065e77a9fe2503580b104cb5f8fd1cee8453ca9a940f3f89725a6d6c24f95cb3db32f3c244ad9b552ca8616eadef3b85c6a722f9511
SSDEEP 196608:D/UKxliN3LbNSSGIYszu8pIAVAQEWSGYg97+pKbohgqBr+ZAqLNUEU4KTGt:QKxkN3A832QEWSGYHpKMeqBZqbKTk
TLSH
T10F478E32B356C275DCA54170887E6F6F992D9E610B3985C7A6492F2D0C709D32F3AB0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksolite.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksolite.dll
Size 10.7MB
SHA256 3176c8729945ff3fadcdcf1556590c2f78f3211bf50a7dd036e01b75b3d74117
MD5 3c64bbd1b2c644ebf440b02c52458633
SHA1 d7d175c48a371634e66f33d228b2b2c8b97d48f5
SHA512 54fe07eb9a74344e2547c5d73b233579adbcd3517a163d5d70bace4b95383d99c1c75657f01ce2b63d2032151a8f0748a745b55f981432ec5ae22570b3e186fd
SSDEEP 98304:Sbd7PPI9BlmG0mvrn+M7pj2bKXgomvKY3cmASCA9sgRf3nsJiwH6j8BpRPqcL:ShbIwG0mvrn+GpjwKXgomvKY3vPh8nth
TLSH
T10FB64C637B098336F7DF31784C28A7E6501CDCAA0B2501D3F2AC6E6A55B05E71AB7613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksomisc.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksomisc.exe
Size 3.4MB
SHA256 c4f99e39b7fc705eec256e095d5f03576def4dd6f4ca177c852021ea3755e1de
MD5 832a0c181a0b9ef431da655bb1659ac1
SHA1 7f779c117de8d3fe3cdf2ed0ccbf49ab7440fe60
SHA512 d4ef24609ca02900cdc12622178d2d5cac1ef473003e93fdacd63070c0fbdd013e0425093abc1bc4d10473b514ba205068fb37155dbde7471fa0492b7d721199
SSDEEP 98304:yBi6Jt14pw6e8uFUtd0hYWigHEgUAESeW7++gxUjyMZeXoAL:B6JL4p3uFUQKWx7PTZG
TLSH
T14EF56BA6F70D8135E971D1745A78ABA7803CBC38DB6A42C7B1843F9E15705C2A931E3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksouil.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\ksouil.dll
Size 1.9MB
SHA256 ac709618f1fdd7b84ccf222edd09085e3e7eba93d868b54da2f4943f9567d3af
MD5 165de2b4f543be01c329545db11df05c
SHA1 1e22847cc38611058b0ad3cc6ffeff9c24a11596
SHA512 6552efae46d3348d8af48bde6913431a2292faab599c26774c94e80a07a1c424fb8793cfd8345e42411af7293be104f6d087a47a96c656acdb422a8f9d34199e
SSDEEP 24576:Y+jQzVFERdSmywsi+i5PItPs3VOEZjLvnNCsIZWLlzozS55t2su14sp7pAT2x:YjZF+si+kck3V9ZjLPcsIEoskp7pATi
TLSH
T157957D227796C535C89D81708E29FBBE512DAFB5076401CB72987F1A19B02D36F39E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kwinappinstaller.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\kwinappinstaller.exe
Size 28KB
SHA256 265479ebaaffc0e48fc0227c2e8049bf0486fbddca27c16aad2e993969ef8f74
MD5 42a06dbccd9f65dd8f2ef99eba5dbfbc
SHA1 24d6d461cf7144957eca71198549800709675302
SHA512 fbd7c62bec536aaa677dd181e6335f01c279c079ae0910d3f43debaf4ea18aebddaca914bf5dd9f40e793e2d62a71f51d189fd0bdb5b486ea7f9e451ebec1720
SSDEEP 384:XdQkIrZiZvsYdE5TD5xdNyEIYi2mL4/y8Rl/az5oLXsYzDIYio/azNgTy8RbmL4I:tMDziYiDLk5P/ssXfzsYio/sqT5ALR
TLSH
T1A1D27D93CAE45C01DD6BAD30B8D95131BEB2B3A55991C2D7324CC14A8F527812FEE2F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ent_background_2019_wpsoffice.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\mui\ja_JP\resource\splash\hdpi\2x\ent_background_2019_wpsoffice.png
Size 236KB
SHA256 5e7ba996d2331f37b9799767c0fa806cab9a39fea434796ab08dcaf39096e334
MD5 c5ad1903526a9ca4c2f55cfea1e22778
SHA1 9c7b9ba9100a919cad272fb85ff95c4cde45de9f
SHA512 e482142e81fbe71666b40f7a2c53702b4278436a0240e0f56200443cf4235d9942cccc3545cc01486d53a0972be553cbf93442e8b05de7b4fcd1fe8a4ec16bb4
SSDEEP 6144:VP27xIj3rgLFbuLG0QxhCi5+sfi/32bGY1ZR:QmjSqLG0Qb/+oi/32bGY1b
TLSH
T1DA340107CAF664D76412125C83C6C4A2150C14BEE560CFFBE5A7DDEF26913A12EA2C9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsprintersupport.dll

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\qt\plugins\printsupport\windowsprintersupport.dll
Size 71KB
SHA256 6d7e642ab312956b8532282234910020cac46bbc49c1ef6853a8186bfa30d436
MD5 358db8de9b6a9f63edee941df6b72a5b
SHA1 6811f90543303d0d09124b870b69976648e7aecb
SHA512 de0ad7104a8e965fb2f772c2f8b400a0e21b8737e0d3337537cb63d25da005c7f0ef1c1cb3a7e6b51ccf26ec2134041aded44cb06bbde5721f2dbf210b6e2e8a
SSDEEP 1536:IbcV5m/XHwbs+1jZhDUTVwIXtIf28CQlet5NLg9g7ak76Q:ScV8/3wdUBwIIf28CQlet5Bg9gWkWQ
TLSH
T140636CC3D9004166EA97813125D9A316E53AB5600BE1C3C7774FA9C58E213D3FEBD39A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpscloudsvr.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\office6\wpscloudsvr.exe
Size 1.0MB
SHA256 8592de1b80efd075d731d526f8400cc779fb5a02f09debc72cf4f3b1b10028ce
MD5 ceb2a8aed1e5d66c9979fee5c0c9a2cb
SHA1 3ac6a49f1d5a5cb32ccb2af009185e5d2d8df640
SHA512 f039525c7f1730ec7546bac05ed7490d70e5d85ea8e751fcd85397cc07bab0b49aa7f64ecc1b3b1761499c6214c1cc6c3ff7e874210331c3089ba393ba8d5183
SSDEEP 24576:GGRoNSYb9Bo/YIV7cz6G7B1hMnJAJaQ0ox1MZiY4v+lM:2boYPz6G7B1SnJAT0oxOZiYDlM
TLSH
T1CD358E607356D232D46180B20DB9EFAAA16CED295F7206CFA3C42F3D56356D22B31E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.23196\utility\install.ini
Size 499B
SHA256 514656186e18e09dbe3efcf8c38934803b1eca3cdb39847809e51e441bcbcaa1
MD5 0714d37ce4fc179602d83b687b6a6ae7
SHA1 5f1fb78fe8a479016fde988be224613ef2bcecd5
SHA512 668801e71484fb6a4fdc07056133c9885a7568a7889c8048958b4d6df6b0e039e2916ef4764b5e64b2540b1e506f91ad79b19de3c485a1d405cd51418c470295
TLSH
T1A5F0590A0D94C66E35282298B0E3D6C1AAAF8E25194CA410D2D36E17FC03D2E117E05E
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.1p2voy9k0g28knrjkoo5andge.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.1p2voy9k0g28knrjkoo5andge.tmp
Size 10KB
SHA256 c4146f729a762ae6aa2d30a328b4fb2bd593bd6ec42e4ca269804d14273eba86
MD5 d869900f80314875ad17c8e015d06c12
SHA1 c861eb7a7549ab53b08f4698e647e7cbd55ead44
SHA512 ca1fb4a5f968d2a24328ce2d5dcdc2ee62e3a4e4a6947a89a641da6887a1d26caed194446433e9fe45789438832b68720fc2ccd8bd5420219be934a2df28f19f
SSDEEP 192:DWIYiYF86/zzSzYYULc8pq8RuwdmL4pUQrNyZ1l:DWIYio/azYty8RbmL4nNyZ1l
TLSH
T1F8225CA789906C01ED07AC40B4C8A936FEB2B6D95AD0D1D3725CC1698B917823BDE1FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.4hrbbg0my7yirnk3yq73mmwf.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.4hrbbg0my7yirnk3yq73mmwf.tmp
Size 3KB
SHA256 111e96addd5f2439f3fe66bdcda33360145291e23f4dd93d2ab9075855f611eb
MD5 6e14177adc3eeb43e098d8dd8c7f0b25
SHA1 586464b3e475c2c6112a2b6901673517c108828a
SHA512 71b16fa49102066c368579bfe63ebf73645df75f055ff36e3079e58a08079d070436a7ccfd375984ad6115cca2f8e8493c5a1cb7b33b3f93366fa9036d61471a
TLSH
T1ED81034A98E805D08234882593A7E251AF0D4FA717CD80DCF9DCD95D3BC62A795376EC
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.5h4sdj4d_w5v_k31_uspo9jmb.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.5h4sdj4d_w5v_k31_uspo9jmb.tmp
Size 712B
SHA256 a888030e674a65f2bb753dca08738c019a40f1a3574db3f6aa191b7a072dbe3c
MD5 d74d44f130aa5e9e0c5b9c507d38361f
SHA1 7acac470fa0b64d1307e321ceb4a642d03a37cd4
SHA512 a2830b1079eeae1457fe78f679b7b5b80351e0d879c6ecfa887f5967031fdde1df2fd9c8abf1d5365e1a0a0c6f74af6307333439ac961d69bc690814c0d87396
TLSH
T15201FE2CA31DBE3546788FAA0BBEFA403C02915B1317195FACCA897A085B0912B671C9
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.8paln4y4s5drzj4li2uqwc00h.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.8paln4y4s5drzj4li2uqwc00h.tmp
Size 3KB
SHA256 53218d297143af472ae9d3513b9fa2270c36334e3cbf4f8f9804e53a23c9fda9
MD5 90c5b31605d7a81fa3bc5c7fac89ce54
SHA1 36a3de6ccc303bc529eb92aa19e7a1375ee841ec
SHA512 f7c722b2ce797399dc7722d8e502f53f23b62760ad152376c2287bbce2fd26b993dbaffeb4aff9778fe41384b25de12982b2b444e647e513afeba929010a4ec2
TLSH
T16881024AA8E805D082348829936BE251AF0D5FA717CD80DCF9DCDA5D3BC53A791376AC
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.bxs8cltb9lcgfxyfk2b44spj.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.bxs8cltb9lcgfxyfk2b44spj.tmp
Size 3KB
SHA256 390e5f943e8f16927545cfd6b6f539c5aef600898432864885b2ca1978208641
MD5 2f833b74d151868a7a960c7f63d4b802
SHA1 3e4b436fa46ef5149c193111f02bd84bb071266a
SHA512 8252a79f16e07c42e947843842a7b68e1f5a4c322e47fe6379ee9201d20080bacfe88c71832508dffd0af213ebb35b824db0f26d70510122794e73634a874d7e
TLSH
T1C981128A98E805E0823488259367E251AF0D4FE717CD80DCF9DCDA6D3BC52A791376AC
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.cvgo64cq7lh80s165cta6t26e.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.cvgo64cq7lh80s165cta6t26e.tmp
Size 712B
SHA256 84a8228b2d8da7fc41690cedb278a2c3dd1821252af1f3efb0c12b2e71de00b8
MD5 f8774f98ecdc8f75a24a0e2ceebf4154
SHA1 b4ab100bb606482b053d2cd0a39b8d4064656912
SHA512 24f58995a25e10ac41e4d22e9240e7c1c5e8a52bc9e82f22efcd0bc475dc2ec4c2182f31a5cdc6ad9dbcafa29c779ae9031a53c055ddfbbafedd48b9667df4f1
TLSH
T1F901F4249319BD39477C4FEA0BFDB9403C02916B2317196A5CD6C9B544570911E571D5
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.kn1gmdw92mfvkvagnr96xrz5f.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.kn1gmdw92mfvkvagnr96xrz5f.tmp
Size 10KB
SHA256 0cfa87ef1bf94a90fb77a3c7571a9bc66f979ac84f54a82e4f053cd9e33767f7
MD5 545736f67458ef1890ae47f043bc9fdf
SHA1 65b1c8b8d648230dfd9c0ad655aa79b258178b68
SHA512 3015f16829ef99ed6598e6847cee7f9bf2c6f8d413e9720251f68f409d8c504395eb4bba2c2b31e85df9194950c8eb775111b2e589f2e494c86b26be15bdd3bb
SSDEEP 192:xLIYiYF86/zzSzkOWINULc8pq8RuwdmL4pUQrNyq/eLC:xLIYio/azkPy8RbmL4nNyq/YC
TLSH
T18A222AB388946C05DD1BAD50B4C8AA36FDB6B2E969D0D1D3321CC1598B923823BDD1FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.ozxb9vuzai28tbmgla8wthz5b.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.ozxb9vuzai28tbmgla8wthz5b.tmp
Size 712B
SHA256 2dcf5c5b7e9af5073007db09187e2b8af1e96eee38d0d859ae45f49b844ff37b
MD5 67213d51a54528554463ed3efdc3269d
SHA1 e7b8bded0b1a400e7c55bc983994b460cda6f8c0
SHA512 83691e803e84b2d7865babfd03b0a3faf2a3508493327632f677805f0feef0136e12d5b21ddf0672c6f4e01091b37c1fe3e28b60f81323dad6bd0ff3b62b814b
TLSH
T11A012834A31DBD35477C5FAA0F7DF5003C0245671317595B5CD78972445B0D11A672C5
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.p51qdkcxxj9q1lvo0h9enc7de.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.p51qdkcxxj9q1lvo0h9enc7de.tmp
Size 10KB
SHA256 c32b47398e1ae881a2e6659c8edcdd7e984666802fc164f8e1040319eb3fcff2
MD5 16eb09bf8566acee30c581d18f02397f
SHA1 d638d4c4056cdbb2327b0aeb4702bd3c7ccd0f2c
SHA512 f01d44b54a7ab9f33dc7cd38c01ba754714d2bdd4959ef155e07face8fd8f0ecd62713c73a83e305e8c0cfe8f8f10fc58945a1b40481b6fd8619666c4c3395d9
SSDEEP 192:xIYiYF86/zzSzuaOpuNULc8pq8RuwdmL4pUQrNysKDO:xIYio/azuacy8RbmL4nNysKy
TLSH
T1DC224AA3CCA46C01DD179D10B4C89A36EFB672A959C0D1D33259C2998B913823BDE1FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5CoreKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2973\CONTROL\office6\Qt5CoreKso.dll
Size 5.1MB
SHA256 df7da12c96aef17ae7640ff38ee11d13b746eccaf7bfe53cd1956af9398f3169
MD5 b91d084c8772fff1c377f5e8ae3a948f
SHA1 a33f37613ac9cf4faf55e457f614e020d3b4bb34
SHA512 151db064fea8ad69f32ac43126ad1ebf04e0d15d1d39fbd9dd6935977252a9491580c0e9687c34963a4ca9b97a34c490f8906135217aaebbe9473498fc0a84d4
SSDEEP 98304:zmHBCG066jN+53hrUQ7kxJsv6tWKFdu9Cnvnl4rX+uHi8v:zWBCGN6o5evxJsv6tWKFdu9CnCa8v
TLSH
T1D9367DA2FE43C23EEEA54231C9FDAA9F4115AC15072202C76B9C771859759E13B3B34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5GuiKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2973\CONTROL\office6\Qt5GuiKso.dll
Size 5.3MB
SHA256 c161c1a91ee9f07d1fc47d1b414057e555530d31cb54c538e08189401afe9bb0
MD5 56ac894f103b109dae1fb4d7eedf7ae4
SHA1 cd1e7e9175ad385d6c64ea71490f32d4a63eee98
SHA512 8f014aa3c229da3c7e3285fa1c112d550594375da5fc1364bd3062787126aef9de7189e953371b2e8fe0d82c81f7ea8c9ef42bed37d812128255e95cc9d3fa5d
SSDEEP 98304:oAne3f7gtUxvI0ISCR3b5y7Jdc+sy5yZP:LYfctU1I0r+5qJdYy5yZP
TLSH
T1B7462A91EC40732AD9B2A2B687DF15AF70A69D52C31483C3BD447B4485346FB1B3BA87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5SvgKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2973\CONTROL\office6\Qt5SvgKso.dll
Size 392KB
SHA256 04e25b6feb73c3a3a2ae654b75c2a3887cd5f79799c248c7537515cec34ea31e
MD5 d1159a9b494fb44c560e635bfd1946ff
SHA1 c7b1dfdc84499626e13557916261752fa6e84416
SHA512 acccb90bcd4a67359903dadf5042bdd38e5ff01f66ffb1852dca3083dca05ae40497390f0aecb2d29a3dbc74feab2216632d9eeb6883d39c80a8acb7f42c0963
SSDEEP 12288:5BnQdgnrpfxSyn6U3GqHSg1nqg6vIDsiSrGjyMsjgBij1hmN7BKetQsIM1jgwKJ/:5BnQdgrNxH3u
TLSH
T112842B63F90D432DF042B33485AC369A553EC92093F983D77659BB2618786E35A37B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WidgetsKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2973\CONTROL\office6\Qt5WidgetsKso.dll
Size 4.5MB
SHA256 4d4dd82c4b92ca239f2d6c2d988ddf3f378c308ea59b8f425eab9ccc5e2dc309
MD5 e46a6644c5cbd269a57ddb149396ae1f
SHA1 94c5cc3a11d828914a30bca57eb470969be7777b
SHA512 ad65798b2613a366b966e0708e897e95c24e5681cfd34a8c87dce7419a1074b31add99ec467411347f05e6db5396f7cfd64450dbfc602680beccf21694ad7e23
SSDEEP 49152:Sw99OhkJADjEKlP6qwsRGBYNQ0aFoy7Nrisqve9wbzhkafulJcgSnb+nJhgJ:Swh4AKlP6q9GvU3GafAcihk
TLSH
T19F265B23F94D8329E5D691338DEC6796A029DC15C73A53C77688BF1519B42E23A3F283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WinExtrasKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2973\CONTROL\office6\Qt5WinExtrasKso.dll
Size 217KB
SHA256 03bf44f6fbdefa9c504dd57fe72086712f6686a56440acd6a12d1be15de662b3
MD5 aff2d3cf11639967d5476f24286ab582
SHA1 239a48597647c994c30111235069805b02b25dfc
SHA512 39235874cfc9f11ab54837b16273e66e6389478b2db6f6e311f60336e5816789bb9f7dc2817070cb8d98923040daf54055b5cd2bad5f8e80734039504f33c222
SSDEEP 3072:8S0mxfK+6LPq3jGdIVJwtoRaETHvAO2hcj7Z9BQWcWm:8Z8fh6TsjpVJbX7vAENlm
TLSH
T128240F4478DA933DF45174BD4FCAE2D8A21FB5F04BC24ABF396B534F42646422A3A871
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kpacketui.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2973\CONTROL\office6\kpacketui.dll
Size 2.9MB
SHA256 f3a116361e08baad8f70f5fc1643f53658ef21276c67b13144d0b40751e5da29
MD5 7220c6122217d18b122595e4fc26cabb
SHA1 4f283922f60854f1d292a91b16bda1c215c3000b
SHA512 cbf837b8eeb12026f1a5900e71a8468d139bcc14dbc7e4db04e2cea5dc738d463312f8f45c5918fe5e6f2ca4090065f0b539e7309fee9966c96ad8f15803ffc0
SSDEEP 49152:o0sCS4MS5HgjfCXcecTNXp6sHBqST77qD2Ns:f
TLSH
T1BEE52361534882BEF15CC33C64B55592F1273CEEA76283C7B24CBB7669246C28D3E693
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2973\CONTROL\office6\msvcp140.dll
Size 427KB
SHA256 5a6dfa5e1ffb6c1e7fc76bd121c6c91305e10dd75fc2124f79fee291a9dd9e86
MD5 db1e9807b717b91ac6df6262141bd99f
SHA1 f55b0a6b2142c210bbfeebf1bac78134acc383b2
SHA512 f0621977d20989d21ae14b66c1a7a6c752bfd6d7ccc2c4c4ec1c70ba6756e642fb7f9b1c6a94afadd0f8a05d3c377792e4aa4c1a771d833c40a6f46b90cbe7c3
SSDEEP 12288:X3xU+0XySH2CyKSPRBb22umbyghUgiW6QR7t5s03Ooc8dHkC2es8Y45:HxUwSH2CyKaBb22umbY03Ooc8dHkC2ex
TLSH
T139943932BB464DF1E48913B971C9472193FAFC610362E3C397DAF1262F166C6A633A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2973\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
Size 61KB
SHA256 7102bb7e8846473f29de1cf1012e4aa19b2ed01834044ae6e328764e933afae3
MD5 71b9d538fd2cf63e13ae4f1fa7847f40
SHA1 11daa516a60760e7eb39de3723c2029f995d641d
SHA512 dd0e92e2b9f9f43a0f09519d5112efe0b17bab22d3c5f3602c633a8bb80b7d6981a9bc274be46c71a42af4f6ac6221b0cd612b33b0e3ff36f2b32599e6f48996
SSDEEP 768:jthvo/KfnJjKWESUyx6u5cZhLaQSbAD6i9YgFJYiDLk5P/ssYio/sc65ALC:B1jjjUE6NaUWi9YgFJ7aN76Hk
TLSH
T19D536D53D80146BAE567A53078D89A7ADB79FC5007D083E7B72BE1740AA03D23A7D287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2973\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
Size 41KB
SHA256 9859a8df89fd3e7fec559db651e090a02f4adf2ec75eaf600939a24be4fab41d
MD5 ccee43aa4cffa082c1eb766614d51d0b
SHA1 5be9891903cf6aaf69a6de903cab1c3432718b38
SHA512 85de8c60315e093c6ac7aa8ea5af2cca8978ec6ae6e17370ac84718cfd91c328a8bddbd5836a53bf3824c1c3c5b2b0a68f86e4060c1b67a22aeabdec29443290
SSDEEP 768:b/07OUoOfo/KYWp3pVJ8YiDLk5P/s3LYio/s05ALtH:b0OUoz/KYWp3pVJ87aeL76CH
TLSH
T10F138D53DE105C65DE1F567078C4D63BF97ABA600AD0C3C37A0AD2281BA43D23EB9399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qdirect2d.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2973\CONTROL\office6\qt\plugins\platforms\qdirect2d.dll
Size 1.4MB
SHA256 223e4f650d17a2881ff6fefdcf4bfbb110dfabe3570dda9e0a7207bdd687ab14
MD5 0c4473b9df3e5a75e0d6101855cd85dc
SHA1 02f9a3035af5a4d5b3d4310568e1efafeb9d8a6d
SHA512 65b051231561eaff95c8d03d07efe6b106aa2f47b130c650844ef676d3d5fca17c98fffa2a42fd4d779d43d28ea4051dd6235a763112b33a8e3840805c39659c
SSDEEP 24576:mImA2jwYaSqYQyVjLTKXkgWKr2su6buVKtZvmDbh1N7HAZeABWF:mRLjwYDQOjLTKUgWKr2GbuV+vON7aoF
TLSH
T1C7659E13F94181E5E4D20071C6EDABB2492C8A310B2642CB76D8ADADF9346F7773A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2973\CONTROL\office6\qt\plugins\platforms\qwindows.dll
Size 1.3MB
SHA256 bc0e285559e229fca74479304b6d8c7596fff1aa8b25d77b25642341a3e4ab28
MD5 569261817c3391efc4848cc219229438
SHA1 d60e48a59fb19a3b040bdea9e1c639a3e0bf24b0
SHA512 70862005e6efe65e7d437b1e71b07b45a182a7e7217f6cc4d811fffd553f40133e5de43e2f862d73ea2e17b14aebc74bd4f3166f022e5857c4f5f5ca89caa8c0
SSDEEP 24576:Rh8p5xTJf4kLS1yGhg8EIMAlZ79DbCuG7xuZST:RhQfGyWEIMAH7VG75T
TLSH
T12155AE23F90081E5E0D20A7182EFBB7A9D2C9A31072742C375D86D59E9745EB7B39387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2973\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
Size 145KB
SHA256 b68d4d903ffe525506c4a7527df19225d03e80103777876578e6cb33523c0076
MD5 0738b9436e8d286f26a0c6955aa10e7c
SHA1 058ee73c3ba807255be0f5c6ba0ba86cc66e6b64
SHA512 64198c0451018e967f11bb5db0659f93e69a30ff67ebeaa4b2a92dad247fbe416bef6a624be76a3bc4d5eed15512da9aba7841c7ad6272a18286eccf12fe1e9c
SSDEEP 3072:t1XlaZUvCCE8y+gUqx42/WavP/r9+qxQOugMKXLP6CQpCozkpHl2WpI6qythwrQL:Zv9u5/1vC4PdBpI6qythwEAFw
TLSH
T1ADE35A52FA455326F082117C2488D7D2F137EE3046B593D3FF91A66939752E3AE2A383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2973\CONTROL\office6\ucrtbase.dll
Size 1.1MB
SHA256 2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359
MD5 2040cdcd779bbebad36d36035c675d99
SHA1 918bc19f55e656f6d6b1e4713604483eb997ea15
SHA512 83dc3c7e35f0f83e1224505d04cdbaee12b7ea37a2c3367cb4fccc4fff3e5923cf8a79dd513c33a667d8231b1cc6cfb1e33f957d92e195892060a22f53c7532f
SSDEEP 24576:tCjjeiNFnAp+O+R2l2WDPc/9qHrX0cJ/gAp0ei5mcvIZPoy4aVvFjDp:4jyuRR2l2WD6I/bp0erVL
TLSH
T1F4454A117A09C2F6DDD931B97379B12214BCF5D08F24ECC3BB8466E95A243C079366EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2973\CONTROL\office6\vcruntime140.dll
Size 75KB
SHA256 f1fd5f6ec1cfe0cc3b66b5322ac97568bc63b19c1e415b99aad7c69ddbafa33c
MD5 8fdb26199d64ae926509f5606460f573
SHA1 7d7d8849e7c77af3042a6f54bdf2bb303d7cd678
SHA512 f56bf11d4259dbf5d4d1f9fc2ad60ff609cddb21278999e9fa55fe5d74552e8a01ddc55cfdc9bf4b09b3e3130a1356142a24a7db8ec5ea19344de617dc9fa99f
SSDEEP 1536:AyH1qvERANBw6qntn64lqVwhNDyUZXRqtn5EecbC9E0tT7+zn:AyHMMRANK6qtnsVON7JY+ecbC9EyK
TLSH
T1DD73AE5278C48272C1AE49B9017AF612663DAA204FD15FDB7FD8598C9F79AC1EF30213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2973\CONTROL\pl_PL\style.xml
Size 3KB
SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
MD5 034f37e6536c1430d55f64168b7e9f05
SHA1 dd08c0ef0d086dfbe59797990a74dab14fc850e2
SHA512 0e1911c882152a4e1059a3ce1880d7fb2aed1e1e36cbd37055de2e2a1333acb2a0233ba2a4d969ccebbef1e77809aa5e78807aa9239545beae8c548c0f8f35c0
TLSH
T1E381CA80A610BD0AC563F51573AB7509762CB36383ECCFC4F0EE2E698753652644B63E
MD5 SHA1 SHA512 TLSH

Submit Download

product.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2973\CONTROL\product.dat
Size 49KB
SHA256 737821b96941c073cfac485cf7e08616ed63a6c732ff37f1735acaec9878e0c3
MD5 09dfd5db212927d1259aff9e48e8a2d4
SHA1 6c19e099ace3cd42350035bc51b8ce30f6a3f605
SHA512 76204171034a95a49102f9accd392f60878bc27536fcc94e35bdc88e5ed40be8cdac4cdcb1e18895805c492a161d0ad5012b2ce6e8828e86f2fd8e274ed8e4a9
SSDEEP 768:rjZ5+qkjhJieQUzb32by4CrMfHvD4LTc+Ms57u+QUz/4da+7wFmXyfjonN:vZ5+qkDieQUf2WQUeWroN
TLSH
T1DD336DFB7E1E2EE55CCF221A9D7B281CA6F54915354A6888B2D2E958EC1C0B33CD6508
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product_new.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2973\CONTROL\product_new.dat
Size 602KB
SHA256 30e66afb9e9b4ffe7316ea1c9689f49ee4ac9d20a9e221cdfa1489d09fd7a106
MD5 f36acb8e058788b11e3d41a82669ffa9
SHA1 ee17ba3e097cf2ab947b51139adc5125739d62b7
SHA512 dd2d224d078ef6db48040cc9c9f0f30588c5b3e9f124262fbadd9620e2e28e2520aedc543ca1c276bc5689045a07b116e0033705c62ed25a7dd777eeb456b39b
SSDEEP 12288:nKDU+911nSo3ra3aZQN2NJ6x2myZKK2o2WV3TiZckNt4:nsUo1v3FtNA2mL0VtKt4
TLSH
T13BD4C684CFE81DBC44067BB92EE33A451FB3AE5760D9A29C87234C3CE99975D44412EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 387B
SHA256 72204e4f61bb796b0618531d35644f66ec68b474c4448705851687915c654fbd
MD5 33d2a9536a37b465529e5f9063f8f456
SHA1 83f0a000ef069208815827bf11dba82c88896b2d
SHA512 4bb2d3ea8df0f67fc3454b9e8f467f6012b7a8d672d975980df921264cbc52a62743a1e72d949ae34b503a5f52a1c07218973961e0c79d230d883f7016f24e74
TLSH
T11CE09B1BE8D1B0ABDEB302F9C897DD54BEC03D9A066D13147762940D3C32918FB41D65
MD5 SHA1 SHA512 TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 433B
SHA256 b7d70693201ccf0e31c73d1262aefee43bc029da7797c250cfbe2cad26b16733
MD5 420de6ff3159c2e3d110364b920e5574
SHA1 c7c4c2c7d3f14c5c4fa99c30af9decd0b0551faf
SHA512 141fad9e8f32217c24bc8eaa9414e9f3735ba6346228c934846df57bc58c03bb19847e76144d4a3193c07d6ce3e6f723628419fd73204d1feda4d88689a344af
TLSH
T153E0540FE891B0679D7302F4C8E39C007AC03E95055D1214373184093C32A14FB81D59
MD5 SHA1 SHA512 TLSH

Submit Download

configure2

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\configs\configure2
Size 224B
SHA256 ab73955342e2071363d4bf2f681f8a3ea889023bd9270e385142df36ead5689c
MD5 4f6b401346cffb4a8b6f4b07c09c83c2
SHA1 a27b82bee6bb24dc0ace9a098d5cadbbcef01a70
SHA512 43d1bce106f2da282247aa84a09ff56bba21b3cc6d75d9a80f61fbe835982ca78460238eaadec495ee91f689a5ea6f52b2c891e40c96dcfe2169b20185fc1ea8
TLSH
T18CD023A855D570700F83ED837252D688514B94FC57155BC45544B5F89417741554D20D
MD5 SHA1 SHA512 TLSH

Submit Download

ksomisc_2026_08_27.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_08_27.log
Size 6KB
SHA256 d8db5b614d74ad4237252072cdbbe77c2807a3b067ca27059c38b4df5d8a0d0f
MD5 58e6b5040dc2f390ebae19e168f4a116
SHA1 cca47a0ecbc09cb12378db661ce02fcc8a930893
SHA512 0bcba44f9cafe6c7296bb7265ad7a3949042641f3888622018267863f0f6d630c37edd159858121cc9cefda59c6ee425b4a54d69dfdba0645b5f8ebbeceeed27
SSDEEP 192:hRYQpidZdBtLnyCRY+PZdddr6L9yeRYQrddv:IRyLno3K
TLSH
T10CD1556A6AF94105FBB79F4394F604238E39BDD79C30C90A1895030989A7E92FD7073B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 11KB
SHA256 bd4610d6d2144beb61306ad0001f83e466f1eb9161bd30d6f7d712058a5b9a93
MD5 759e3945c31bc724e0f6f449e8ed56f7
SHA1 d0abb56e2de1a8859c02d03c6add21ed92e78d8d
SHA512 43eba48d6c52c7b22220462757ff90ac4b7e1d720a56d40f7c969af8ce8a1e22c0b4e5e5ffc16f9c0c21dd4784dc40bc22f2ceb8e417c954efad8ebecfc575f7
SSDEEP 96:nYmUOOQH32MBt2K71fN1Cr1Ch1CyL1Ce1Ci1C11CF21C/1CxG2S1CsM1CI1CA+1+:xPR2h3YI73rh
TLSH
T13D325B63149E465C1FBA0B3923618D883E897888734579E83FB3DFD3A7DF450819E668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 12KB
SHA256 158a85f2f9a2de06e67102fb9fe829b4973abd6c9ef9a018a31154c3e748011c
MD5 96a94c647f8c7a0e4feb9f044c921a56
SHA1 cb63164c1f454e40c40ecdef9f294c67ddd69941
SHA512 c41cb58706d27275cef831c80f42650e255524c56f83071ab023e5906e27b90278e69ebb78e0009aadff32b6e2769d355e58851bb58e3840615e167119e32ba4
SSDEEP 96:nYmUOOQH32MBt2K71fN1Cr1Ch1CyL1Ce1Ci1C11CF21C/1CxG2S1CsM1CI1CA+1h:xPR2h3YI73rIMVC
TLSH
T128425C63149E465C0FBA0A3923608D893D897988734539E83F73DFD3ABDF550819E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 896B
SHA256 edc1e2189453a61ec7dd52758e19b857d34545c784b2a0d84a81f30e0e857e04
MD5 fa1fcfafbe8d6ad5db38514e216dfc6b
SHA1 51ec8e082208084cb3972988bd32322927460ae3
SHA512 615ed6c759240974c03693eaa84db64a861cbfd871e4acd7a2e3361093d959845dc32011c6fd75c13c1f5177c8924aa52a8f7c711668d22981c103ba33296805
TLSH
T1D71108E1188D82149AFA491C4230CAC5345F66A020A87D75FF7247EBBFCA8C4895DF6D
MD5 SHA1 SHA512 TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 26KB
SHA256 73b515c0560a5552bf1a3695c313bef418176f733d0fe26e399625d7699b1ca1
MD5 fef2d7813c5717cdc7927cf50b1ef446
SHA1 cdde28b2cb53206371072183d78a1c104db79685
SHA512 6dda8962aaf78a4aadf288c7495ec4e3c88ae61b7b55fdad3591fbecbf5a29a59e332ee69f60e886fa133856bd5ff1ffa2d817767bc21d43290bcacb4d582440
SSDEEP 192:xPR2h3YI73rIMVSaDLthP5xcKlbAm0lKSV2w6qpocmIaHTY9vh8+:QoI730FV
TLSH
T13DC27B92145D810C0EEF9BA51270CE9D358B2B9D732935A13FB3DBE355DBA4086ECA1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 63KB
SHA256 75a9b212caa2d7220e54ce7dbe99e1efacfb0296698beb7f9672a5e691a2fcf0
MD5 4c402e3a765208d1689eb162e32772c3
SHA1 24b9a74a2a54fbf7ac64da68c0cb8918b91a34f6
SHA512 c5fca95d5e7ff24f608de0723c74e5dcfc8ab7c2f7b4498ab4f0921795f2aea49b5566aad29b8162e9a9d43ef163e3d22a7630b4bfe77eccc4a23e7992189a57
SSDEEP 768:QoI730F7+qM/5P5zWSQJ++uBbyr1Vp3JuVoACWLDt7:TIT0F7q
TLSH
T13253E0D20C1D81185EFF87604271CE89344B6699323839653FF39BE36ACB9018AEDB5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 63KB
SHA256 0ee9e0811d5adc087a9af08001b469aa6f32ccb6838df445264088cc0c6ab2eb
MD5 098b65c0fcf880020efd06a16831db89
SHA1 930f4866def143131f820a242da41cb62363d1ef
SHA512 e3561ff3ed29e9fd0eea3711d912487292c0e42af59ce602cb5a7caf586b412a56a85cc523899faf085e5dd3378d5294b6aedf986739c5b31223ebb110da8907
SSDEEP 768:QoI730F7+qM/5P5zWSQJ++uBbyr1Vp3JuVoACWLDtVq:TIT0F71
TLSH
T15D53E0D20C1D81185EFF87604271CE89344B6699323839653FF39BE36ACB9418AEDB5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 52KB
SHA256 372f62391ab521a12a9c80a6bb4b2d2a53a32463f3d24555d9f17ba8fb51a19a
MD5 59c4104a1bbf577f7a0b825fcc0bd775
SHA1 761cf08a218d182d5dd183564eaab30150844e96
SHA512 3926349bc2f75d2a3cd53cfe5878ac10a11fdcbe6583dc52d9d66d6dbabd8b88e21e7b4e466130895a9aaf00a3a100c4318b5ae2b5252af8007a83450aa04b14
SSDEEP 192:xPR2h3YI73rIMVSaDLthP5xcKlbAm0lKSV2w6qpocmIaHTY9vh8mr/9V/b47UIFB:QoI730Fhp9aaNGqdeiOKp8dqf4zP
TLSH
T17033BED20C1D81185EFFC76002718E59384B669D322839653FF39BE369DB6018AEDB5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdbx.dat

Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-i386\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat
Size 64KB
SHA256 db7c806bab9f9b44613b3eb4e0bfe204ab11fe92341a4fadab9021007fb362ba
MD5 2a2bedee81347d6783158a939b3060cf
SHA1 5c3594bac7d26ce77ca987b76b482a6e81069055
SHA512 d1c0fef4d4074d8183a9366464cbb4e2831bce563c96affe789a3a77dbb66854b9bfb47fe5feade764b92be9009b578f26043b3f8978bde2fccfbd4fe6d96a43
SSDEEP 12:VIx61kX5wXJk7jkf79ID86WAkruOGyJFrXG1sLs3I9pDcIXn6buOGyJF/gSY:VKwX9xCAJFIsaIManXAJF/
TLSH
T1F6538C22DA45CD2AC8D4823CEC62C1F363228CC46F6367833165B30A2D736A469E269C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1544-5284-0x0000000002E80000-0x0000000002F46000-memory.dmp

Download

memory/1544-5259-0x000000006F960000-0x00000000711E4000-memory.dmp

Download

memory/1544-5258-0x000000006B7D0000-0x000000006C0B3000-memory.dmp

Download

memory/1544-5260-0x000000006ED60000-0x000000006F821000-memory.dmp

Download

memory/1732-5227-0x000000006B7D0000-0x000000006C0B3000-memory.dmp

Download

memory/1732-5228-0x000000006F960000-0x00000000711E4000-memory.dmp

Download

memory/1732-5253-0x0000000003580000-0x0000000003646000-memory.dmp

Download

memory/1732-5229-0x000000006ED60000-0x000000006F821000-memory.dmp

Download

memory/2620-5125-0x0000000003040000-0x0000000003106000-memory.dmp

Download

memory/2620-5103-0x000000006F960000-0x00000000711E4000-memory.dmp

Download

memory/2620-5104-0x000000006ED60000-0x000000006F821000-memory.dmp

Download

memory/2620-5102-0x000000006B7D0000-0x000000006C0B3000-memory.dmp

Download

memory/2672-5171-0x000000006F960000-0x00000000711E4000-memory.dmp

Download

memory/2672-5170-0x000000006B7D0000-0x000000006C0B3000-memory.dmp

Download

memory/2672-5169-0x000000006ED60000-0x000000006F821000-memory.dmp

Download

memory/2672-5192-0x0000000003970000-0x0000000003A36000-memory.dmp

Download

memory/3500-5322-0x000000006B7D0000-0x000000006C0B3000-memory.dmp

Download

memory/3500-5324-0x000000006F960000-0x00000000711E4000-memory.dmp

Download

memory/3500-5323-0x000000006ED60000-0x000000006F821000-memory.dmp

Download

memory/3500-5346-0x0000000003120000-0x00000000031E6000-memory.dmp

Download

memory/4000-5161-0x0000000003050000-0x0000000003116000-memory.dmp

Download

memory/4000-5129-0x000000006B7D0000-0x000000006C0B3000-memory.dmp

Download

memory/4000-5131-0x000000006ED60000-0x000000006F821000-memory.dmp

Download

memory/4000-5130-0x000000006F960000-0x00000000711E4000-memory.dmp

Download

memory/4164-5091-0x0000000003250000-0x0000000003316000-memory.dmp

Download

memory/4164-4986-0x000000006ED60000-0x000000006F821000-memory.dmp

Download

memory/4164-4987-0x000000006F960000-0x00000000711E4000-memory.dmp

Download

memory/4164-4985-0x000000006B7D0000-0x000000006C0B3000-memory.dmp

Download

memory/4420-5198-0x000000006B7D0000-0x000000006C0B3000-memory.dmp

Download

memory/4420-5196-0x000000006F960000-0x00000000711E4000-memory.dmp

Download

memory/4420-5222-0x00000000037C0000-0x0000000003886000-memory.dmp

Download

memory/4420-5197-0x000000006ED60000-0x000000006F821000-memory.dmp

Download

memory/4444-5069-0x000000006F960000-0x00000000711E4000-memory.dmp

Download

memory/4444-5067-0x000000006ED60000-0x000000006F821000-memory.dmp

Download

memory/4444-5068-0x000000006B7D0000-0x000000006C0B3000-memory.dmp

Download

memory/4444-5098-0x0000000003080000-0x0000000003146000-memory.dmp

Download

memory/4520-4929-0x000000006B350000-0x000000006B360000-memory.dmp

Download

memory/4520-4931-0x000000006B350000-0x000000006B360000-memory.dmp

Download

memory/4520-4928-0x000000006B360000-0x000000006B370000-memory.dmp

Download

memory/4520-4927-0x000000006E380000-0x000000006FC04000-memory.dmp

Download

memory/4520-4934-0x000000006B350000-0x000000006B360000-memory.dmp

Download

memory/4520-4933-0x000000006B350000-0x000000006B360000-memory.dmp

Download

memory/4520-4932-0x000000006B350000-0x000000006B360000-memory.dmp

Download

memory/4520-4926-0x000000006B390000-0x000000006BC73000-memory.dmp

Download

memory/4520-4952-0x00000000032C0000-0x0000000003386000-memory.dmp

Download

memory/4520-4942-0x00000000032C0000-0x0000000003386000-memory.dmp

Download

memory/4520-4938-0x000000006B350000-0x000000006B360000-memory.dmp

Download

memory/4520-4925-0x0000000070090000-0x0000000070B51000-memory.dmp

Download

memory/4520-4937-0x000000006B350000-0x000000006B360000-memory.dmp

Download

memory/4520-4936-0x000000006B350000-0x000000006B360000-memory.dmp

Download

memory/4520-4935-0x000000006B350000-0x000000006B360000-memory.dmp

Download

memory/4520-4930-0x000000006B350000-0x000000006B360000-memory.dmp

Download

memory/4808-5551-0x0000000000CF0000-0x0000000000CF8000-memory.dmp

Download

memory/4808-5552-0x0000000003400000-0x000000000340A000-memory.dmp

Download

memory/4808-5553-0x0000000003470000-0x0000000003496000-memory.dmp

Download

memory/5368-4956-0x000000006ED60000-0x000000006F821000-memory.dmp

Download

memory/5368-4958-0x000000006B7D0000-0x000000006C0B3000-memory.dmp

Download

memory/5368-4957-0x000000006F960000-0x00000000711E4000-memory.dmp

Download

memory/5368-5004-0x0000000003810000-0x00000000038D6000-memory.dmp

Download

memory/5612-5291-0x000000006ED60000-0x000000006F821000-memory.dmp

Download

memory/5612-5317-0x0000000003810000-0x00000000038D6000-memory.dmp

Download

memory/5612-5290-0x000000006F960000-0x00000000711E4000-memory.dmp

Download

memory/5612-5289-0x000000006B7D0000-0x000000006C0B3000-memory.dmp

Download

memory/5896-5034-0x000000006ED60000-0x000000006F821000-memory.dmp

Download

memory/5896-5035-0x000000006B7D0000-0x000000006C0B3000-memory.dmp

Download

memory/5896-5033-0x000000006F960000-0x00000000711E4000-memory.dmp

Download

memory/5896-5063-0x0000000002C60000-0x0000000002D26000-memory.dmp

Download