Analysis
- user interaction
yes - max time kernel
900s - max time network
903s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
26/09/2026, 17:35
General
- Target rackeldevs.exe
- Size 34.8MB
- Sample260926-v6c19sfe53
- SHA256 94d15295e9aff5160291a4980fdf4a1b4b32f74d30f979a9a3ad488d73f0a561
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 26 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 4 IoCs
- Unexpected DNS network traffic destination 41 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Writes a Windows system DLL name to a user directory 2 TTPs 2 IoCs
A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 5 IoCs
- Drops file in Program Files directory 24 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 1 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 43 IoCs
- Suspicious use of SendNotifyMessage 10 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rackeldevs.exe"C:\Users\Admin\AppData\Local\Temp\rackeldevs.exe"2⤵
- Modifies trusted root certificate store through registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1386.exe"C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1386.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -installMsoAddin -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5E367F -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5e32f5\2⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -setlng en_US3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -getonlineparam 00601.00001386 -forceperusermode3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -getabtest -forceperusermode3⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -fixoldversionassostatus3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -setservers3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -register3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regprogid true3⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -assowordexcelpowerpnt 1 1 1 -source=13⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\openwith.exe"C:\Windows\System32\openwith.exe"4⤵
-
-
C:\Windows\System32\openwith.exe"C:\Windows\System32\openwith.exe"4⤵
-
-
C:\Windows\System32\openwith.exe"C:\Windows\System32\openwith.exe"4⤵
-
-
C:\Windows\System32\openwith.exe"C:\Windows\System32\openwith.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -compatiblemso -source=13⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -checkcompatiblemso3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -saveas_mso3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -distsrc 00601.000013863⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode -source=13⤵
- Checks computer location settings
- Executes dropped EXE
- Network Service Discovery
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk" 53864⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -addcontextmenushellnew3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regvascontextmenushellnew3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\wtoolex\wpsupdate.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\wtoolex\wpsupdate.exe" /from:setup3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -collectfileassoinfo -module=1;2;4;8 -daily -source=14⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\wtoolex\wpsupdate.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\wtoolex\wpsupdate.exe" -createtask3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kdesktopshellext\kdesktopshellext.dll"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kdesktopshellext\kdesktopshellext.dll"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regyunpanfornew -forceperusermode3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u /n /i:overlayicon "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u /n /i:contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -setup_assopdf -source=13⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\System32\openwith.exe"C:\Windows\System32\openwith.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -assofdf -source=13⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -externaltask create -forceperusermode3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe" Run "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\ktaskschdtool\ktaskschdtool.dll" /task=wpsexternal /createtask4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe" CheckService5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe" Run -User=Admin -Entry=EntryPoint "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6/addons/ktaskschdtool/ktaskschdtool.dll" /user=Admin /task=wpsexternal /cleantask /pid=8652 /prv5⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -createsubmodulelink desktop prometheus -source=13⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -createsubmodulelink startmenu prometheus -source=13⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -assoofd -source=13⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -assoopg -source=13⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regcadfileasso3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regemailfileasso3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regarchivefileasso3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regmarkdownfileasso3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -installbrowserextensionhost3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regvideoeditsetupfileasso3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regemmxfileasso3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regeddxfileasso3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regposfileasso3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regxmindfileasso3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regvsdfileasso3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -repair3rdlink3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -createexternstartmenu "WPS Office"3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -rebuildicon3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -addJsapiCert3⤵
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -updateskiaconfig3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -createsubmodulelink desktop pdf -source=13⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -createsubmodulelink startmenu pdf -source=13⤵
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -createsubmodulelink startmenu wps -source=13⤵
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -createsubmodulelink startmenu et -source=13⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -createsubmodulelink startmenu wpp -source=13⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -createsubmodulelink desktop pdf -source=13⤵
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regpersistprintmenu3⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -pintostartscreen -source=13⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kstartscreenpinchecker64.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kstartscreenpinchecker64.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Office.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPSÂ Docs.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Slides.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Sheets.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk"4⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Office.lnk" 516094⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk" 516094⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPSÂ Docs.lnk" 516094⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Slides.lnk" 516094⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Sheets.lnk" 516094⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk" 516094⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPSÂ Docs.lnk" 516064⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Slides.lnk" 516064⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Sheets.lnk" 516064⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk" 516064⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,18063004832471283439,17832568288404915131,524288 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5360 /prefetch:81⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --metrics-shmem-handle=5380,i,16094647889815267886,10695111017935499668,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5656 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --metrics-shmem-handle=4732,i,7721547554230765609,4508289425654218850,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5384 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,3937848177348259819,17354173329136972763,524288 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4616 /prefetch:81⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,14558793373489609143,3508009124471858352,524288 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6044 /prefetch:81⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4660,i,10301862732883748991,11526665136021469530,524288 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6048 /prefetch:81⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6040,i,11830882617083660493,16970673274191218870,524288 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6116 /prefetch:81⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --metrics-shmem-handle=4712,i,8960328292185216808,10106404397289600677,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1556 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3416,i,10081275351214084613,5349802931256756617,262144 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3336 /prefetch:81⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --metrics-shmem-handle=3404,i,9400528203143233773,14207656988548173365,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3496 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --metrics-shmem-handle=5728,i,16441847671700039493,7325504282753461948,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5700 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --metrics-shmem-handle=3504,i,778987886712977074,3699950619730631251,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4620 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3452,i,7147609669963372653,14875795700325689364,524288 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=240 /prefetch:81⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3124,i,18409341676228813338,4376635298750552337,524288 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6176 /prefetch:81⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --metrics-shmem-handle=6304,i,8900416744565998262,8902974515300193821,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6324 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --metrics-shmem-handle=6300,i,942996647837078739,12816593979974464787,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6512 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --metrics-shmem-handle=3304,i,17647561586297370635,17629253310785036148,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3480 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7032,i,14508922346191559478,16426602247054913758,524288 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7016 /prefetch:81⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --metrics-shmem-handle=7116,i,13540457711658271674,11673387769041593700,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7156 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --metrics-shmem-handle=7288,i,14293893676760588707,1673006356219235277,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7268 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --metrics-shmem-handle=7264,i,7868616029929605423,18312663992008034604,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7460 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --metrics-shmem-handle=7596,i,9536052112690081209,2543471371539036730,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7572 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --metrics-shmem-handle=7196,i,10451257053550795501,11288804993098141229,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7248 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --metrics-shmem-handle=7540,i,6803415387868757664,9491477806447156244,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7776 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --metrics-shmem-handle=6640,i,4070374516580850406,16433866511292747756,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6052 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --metrics-shmem-handle=6388,i,17603661658438821293,7086425101060086126,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7232 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --metrics-shmem-handle=7868,i,11539600992054672894,14716152498291729636,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7884 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --metrics-shmem-handle=6828,i,14400240462614588365,5664994865266656809,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6808 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --metrics-shmem-handle=6788,i,4871924223139473974,10574252570839537828,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7448 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --metrics-shmem-handle=6772,i,2390938485660687977,5175544976869023730,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6744 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --metrics-shmem-handle=7904,i,885713220974346815,9706708646717460138,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7700 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --metrics-shmem-handle=7724,i,18054541403410998670,10502624995936795398,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7972 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --metrics-shmem-handle=7484,i,9109205998216605466,8554602365206520695,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7836 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --metrics-shmem-handle=7956,i,15314290253541946969,5711870135274018617,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7604 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --metrics-shmem-handle=8168,i,4806437981445235283,14316938275804684113,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7532 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --metrics-shmem-handle=7688,i,5129979835389791906,12377474442283542141,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6372 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --metrics-shmem-handle=6064,i,4717096348772443793,16970866806078182908,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7928 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --metrics-shmem-handle=7924,i,10612735554354494423,5590395901279633330,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6860 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --metrics-shmem-handle=7916,i,17021553955589410506,11819775569171576643,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7116 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --metrics-shmem-handle=8176,i,6783777744960410361,5590849582713320727,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7452 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --metrics-shmem-handle=5720,i,2768742261210995417,9792662775247942849,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7520 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --metrics-shmem-handle=7940,i,8666653032613509023,6775837522738520221,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6340 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --metrics-shmem-handle=7132,i,12411904122733014975,9328317016861196738,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7340 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --metrics-shmem-handle=6008,i,1014383699464929253,13201479780201589524,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7676 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --metrics-shmem-handle=7496,i,7859371360515839751,15539605945468832036,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7836 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6444,i,8074260569016092202,5780422164178529138,524288 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6084 /prefetch:81⤵
-
C:\Users\Admin\Downloads\wps_wid.cid-767471633.1790444491.exe"C:\Users\Admin\Downloads\wps_wid.cid-767471633.1790444491.exe"1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1386.exe"C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1386.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -installMsoAddin -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes a Windows system DLL name to a user directory
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -checkInstallEnvironment3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Kingsoft\office6\wpscloudsvr.exe"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -addFirewallRule3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpsoffice.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpsoffice.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=klangmanager -dll_name=klangmanager.dll downloadlang en_US3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regmtfont3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\\office6\ksomisc.exe" -setappcap3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -sendinstalldyn 53⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regPreviewHandler wps.exe et.exe wpp.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\\office6\ksomisc.exe" -registerqingshellext 13⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingshellext64.dll"4⤵
- Modifies system executable filetype association
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regkwpsshellext admin3⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kwpsshellext64.dll"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regqingdriveshellext_install3⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*install "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*thumbnail "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"4⤵
- Modifies registry class
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*drivebho "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"4⤵
- Installs/modifies Browser Helper Object
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"4⤵
- Modifies system executable filetype association
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*onlinefile "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regpdfwspv3⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\pdfwspv\pdfwspv.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\pdfwspv\pdfwspv.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\pdfwspv\pdfwspv.dll"4⤵
- Modifies registry class
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\\office6\ksomisc.exe" -setappcap3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\\office6\ksomisc.exe" -assoepub -source=13⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -clearmso2pdfplugins3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -uninstalldatarecover3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -collectmsoinfo 53⤵
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\\office6\ksomisc.exe" -assopic_whitelist -type=setup3⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regPreviewHandler wps.exe et.exe wpp.exe3⤵
- Checks computer location settings
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kvprinter\Kvpins64.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kvprinter\Kvpins64.exe" /i "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kvprinter\Kvpins64.inf" /s3⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kvprinter\kvpvbsext.dll",_X86ScriptHostEntry VBScript 3854E6B99CA64B60AFCD46F2BD68ACE5 1 Uninstall /_X64Cast4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kvprinter\kvpvbsext.dll",_X86ScriptHostEntry VBScript 7E791AF0604640AD809C97CBB42D42D9 1 Install /_X64Cast4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\spool\DRIVERS\x64\3\kvpet.exeC:\Windows\system32\spool\DRIVERS\x64\3\kvpet.exe pdf_virtualprinter_install 0x268, 0x684⤵
- Reads the TCP/IP host and domain name from the registry
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\\office6\ksomisc.exe" -defragment3⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -unregisterwpsphotoautoasso3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://global.wps.com/activity/web/pc/install-success?activity_flag=aff68d4f3474ee257&page_flag=p6a720ee9e863df96?device_id=22304886d5c0faee024e7fd2c0855548&app_version=12.1.0.28485&channel=601.1386&platform=windows2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://global.wps.com/activity/web/pc/install-success?activity_flag=aff68d4f3474ee257&page_flag=p6a720ee9e863df96?device_id=22304886d5c0faee024e7fd2c0855548&app_version=12.1.0.28485&channel=601.1386&platform=windows3⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffc54d8c188,0x7ffc54d8c194,0x7ffc54d8c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,18420352384537233350,10501082750552514611,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,1863917235148993485,29722816684166244,262144 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,15418449339989178645,9160739893840831837,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=1400 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,9139720253902307818,1638884608007606369,2097152 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,6408525003959017779,16169346775750979231,2097152 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,5180682882918587556,11980154796285323724,2097152 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4488,i,13176774360943102185,14885221589624808073,2097152 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,10589978055876773680,11498812085087833638,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,3581735274837722320,9160727622268907285,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,15053464786570757942,4818434196824143560,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,15506340041975730065,5928795379752689110,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,322120826894794384,17858522928627775979,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,322120826894794384,17858522928627775979,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,15090324014568896033,4121082393076109880,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,14154636373610667370,5458291748138892048,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,2539326054492632045,17254540635905618124,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4592,i,14699961031085807276,15086818107688705667,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,108583242784623292,11468711011593362403,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,2330577784058096692,9287147395138699364,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,14057375696636840404,2860052604051404006,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,8169128133273115612,9168618220708897644,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3148,i,17418096796994382794,3535047336857033892,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,8559714943911709293,15585837806395069061,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5624,i,7150138031110066417,4632394210712227375,262144 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,1430881018000484946,12862670024149161262,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,2103901826040880630,10240865372570750204,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,16428387973634669867,7591883548344625056,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,11541825233203211919,6961436183077065663,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1308,i,8611220816781134370,14366218224108756299,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,4484751404089554145,10584463575179906736,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,14514562995028148039,15699299979025523860,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,15966950903725409390,6990194025995507018,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,12469641966812500317,7801449784050006929,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,8120275341248345604,8473768760941250610,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,8409067439956464566,7451931389807507431,524288 --field-trial-handle=2024,i,7433441706837697306,6809360273188826195,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:84⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe" /prometheus /download_lang_on_start /lang=en_US /from=get_start_with_wps_after_install_onlinesetup2⤵
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe" /prometheus /download_lang_on_start /lang=en_US /from=get_start_with_wps_after_install_onlinesetup3⤵
- Unexpected DNS network traffic destination
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscloudsvr.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscloudsvr.exe" /qingbangong /start_from=qingipc /qingbangong /start_from=kstartpage silentautologin4⤵
- Unexpected DNS network traffic destination
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -getabtest -forceperusermode5⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -getonlineparam -forceperusermode5⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe" /messagepush /PushType=mipush /From=Qing5⤵
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscloudsvr.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscloudsvr.exe" /messagepush /PushType=mipush /From=Qing6⤵
- Unexpected DNS network traffic destination
- Reads the TCP/IP host and domain name from the registry
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe" /krecentfile /init /From=Qing5⤵
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscloudsvr.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscloudsvr.exe" /krecentfile /init /From=Qing6⤵
- Unexpected DNS network traffic destination
- Reads the TCP/IP host and domain name from the registry
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe" Run -User=Admin "\"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kwinappinstaller.exe\"" -u "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\systemshareext" ksystemsharehostzhCN ksystemsharehostenUS ksystemsharehostzhHK ksystemsharehostjaJP5⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kwinappinstaller.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kwinappinstaller.exe" -u "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\systemshareext" ksystemsharehostzhCN ksystemsharehostenUS ksystemsharehostzhHK ksystemsharehostjaJP5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe" Run -User=Admin "\"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kwinappinstaller.exe\"" -u "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6" ksystemsharehostzhCN ksystemsharehostenUS ksystemsharehostzhHK ksystemsharehostjaJP5⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kwinappinstaller.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kwinappinstaller.exe" -u "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6" ksystemsharehostzhCN ksystemsharehostenUS ksystemsharehostzhHK ksystemsharehostjaJP5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kwinappinstaller.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kwinappinstaller.exe" -i "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\systemshareext" ksystemsharehostenUS5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe" Run /InstanceId=kdevops -Entry=EntryPoint "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons/kdevops/kdevops.dll" -time=1790444711102 -uuid={d674e1f3-6896-43fb-b73b-c013de2492de}5⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscenter.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscenter.exe" Run /InstanceId=kmsosidebar -Entry=EntryPoint C:\Users\Admin\AppData\Roaming\Kingsoft\wps_intl\addons\pool\win-x64/kmsosidebar_3.1.0.3023/kmsosidebar64.dll5⤵
- Checks computer location settings
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\wps_intl\addons\pool\win-x64\kmsosidebar_3.1.0.3023\kmsosidebar64.dll"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe" Run -Entry=EntryPoint C:\Users\Admin\AppData\Roaming\Kingsoft\wps_intl\addons\pool\win-x64/aspcenter_3.1.0.575/aspcenter.dll --host5⤵
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe" Run -User=Admin C:/Users/Admin/AppData/Roaming/Kingsoft/wps_intl/addons/pool/win-x64/aspcenter_3.1.0.575\aspcenter.dll --register-shell-ext6⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe" Run -User=Admin "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -unregwpscompresspv5⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscenter.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscenter.exe" Run /InstanceId=wpsbubble -Entry=EntryPoint C:\Users\Admin\AppData\Roaming\Kingsoft\wps_intl\addons\pool\win-x64/kwpsbubble_3.1.0.3254/kwpsbubble_xa.dll5⤵
- Modifies system certificate store
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscenter.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscenter.exe" Run /InstanceId=kboostlab -Entry=EntryPoint C:\Users\Admin\AppData\Roaming\Kingsoft\wps_intl\addons\pool\win-x64/kboostlab_3.1.0.3506/kboostlab.dll5⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
-
-
C:\Users\Admin\AppData\Roaming\Kingsoft\wps_intl\addons\pool\win-x64\chromehost_3.1.0.3044\chromelauncher.exeC:\Users\Admin\AppData\Roaming\Kingsoft\wps_intl\addons\pool\win-x64\chromehost_3.1.0.3044\chromelauncher.exe install5⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe" Run -User=Admin "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regpdfwspv5⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe" Run C:\Users\Admin\AppData\Roaming\Kingsoft\wps_intl\addons\pool\win-x64/upetmain260824_3.1.0.1/repsvr.dll -upoffice5⤵
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -sendDc ZmVhdHVyZV9yZXBzdnJfaW5mbzphY3Rpb258dXBvZmZpY2VjaGVjaztleHRfcDB8MTA7ZXh0X3AxfGN1cnJlbnQgcGx1Z2luIGFscmVhZHkgcnVuIHN1Y2Nlc3M7ZXh0X3AyfDA7ZXh0X3AzfDA7cGx1Z2luX25hbWV8dXBldG1haW4yNjA4MjRfMy4xLjAuMQ== 0 06⤵
- Reads the TCP/IP host and domain name from the registry
-
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe" Run -Entry=EntryPoint "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6/addons/kcef/jsapibrowser.dll" --server=browser.a3ba19ec797144349ea5dbc1b742aca1.28485.e3afed0047b08059.high.dpi1.pipe --from=wpsoffice4⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\promecefpluginhost.exe"C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6\promecefpluginhost.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=zh-CN --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\debug.log" --mojo-platform-channel-handle=1896 --field-trial-handle=2168,i,16071700222322850743,2146567439314172655,131072 --disable-features=TSFImeSupport /prefetch:25⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\promecefpluginhost.exe"C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6\promecefpluginhost.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=zh-CN --service-sandbox-type=none --no-sandbox --log-severity=disable --lang=zh-CN --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\debug.log" --mojo-platform-channel-handle=2340 --field-trial-handle=2168,i,16071700222322850743,2146567439314172655,131072 --disable-features=TSFImeSupport /prefetch:85⤵
- Unexpected DNS network traffic destination
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6404 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.28485.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\debug.log" --js-flags=--expose-gc --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=2168,i,16071700222322850743,2146567439314172655,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6404 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.28485.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\debug.log" --js-flags=--expose-gc --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3000 --field-trial-handle=2168,i,16071700222322850743,2146567439314172655,131072 --disable-features=TSFImeSupport /prefetch:15⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6404 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.28485.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3188 --field-trial-handle=2168,i,16071700222322850743,2146567439314172655,131072 --disable-features=TSFImeSupport /prefetch:15⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6404 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.28485.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3196 --field-trial-handle=2168,i,16071700222322850743,2146567439314172655,131072 --disable-features=TSFImeSupport /prefetch:15⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6404 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.28485.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3200 --field-trial-handle=2168,i,16071700222322850743,2146567439314172655,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6404 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.28485.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3316 --field-trial-handle=2168,i,16071700222322850743,2146567439314172655,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6404 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.28485.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3324 --field-trial-handle=2168,i,16071700222322850743,2146567439314172655,131072 --disable-features=TSFImeSupport /prefetch:15⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6404 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.28485.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3436 --field-trial-handle=2168,i,16071700222322850743,2146567439314172655,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6404 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.28485.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3328 --field-trial-handle=2168,i,16071700222322850743,2146567439314172655,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6404 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.28485.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3920 --field-trial-handle=2168,i,16071700222322850743,2146567439314172655,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6404 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.28485.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3976 --field-trial-handle=2168,i,16071700222322850743,2146567439314172655,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6404 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.28485.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4036 --field-trial-handle=2168,i,16071700222322850743,2146567439314172655,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6404 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.28485.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4064 --field-trial-handle=2168,i,16071700222322850743,2146567439314172655,131072 --disable-features=TSFImeSupport /prefetch:15⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.284\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yODQ4NVxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=6404 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.28485.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3408 --field-trial-handle=2168,i,16071700222322850743,2146567439314172655,131072 --disable-features=TSFImeSupport /prefetch:15⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\promecefpluginhost.exe"C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.28485/office6\promecefpluginhost.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox --log-severity=disable --lang=zh-CN --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=UAAAAAAAAADoACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\debug.log" --mojo-platform-channel-handle=3044 --field-trial-handle=2168,i,16071700222322850743,2146567439314172655,131072 --disable-features=TSFImeSupport /prefetch:25⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe" Run C:\Users\Admin\AppData\Roaming\Kingsoft\wps_intl\addons\pool\win-x64/upetmain260824_3.1.0.1/repsvr.dll -upoffice4⤵
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe" Run -User=Admin "C:\Users\Admin\AppData\Roaming\Kingsoft\wps_intl\addons\pool\win-x64\upetmain260824_3.1.0.1\repsvr.dll" "-upoffice" -high5⤵
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -sendDc ZmVhdHVyZV9yZXBzdnJfaW5mbzphY3Rpb258dXBvZmZpY2VjaGVjaztleHRfcDB8MDtleHRfcDF8O2V4dF9wMnwxO2V4dF9wM3wxO3BsdWdpbl9uYW1lfHVwZXRtYWluMjYwODI0XzMuMS4wLjE= 0 06⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -sendDc ZmVhdHVyZV9yZXBzdnJfaW5mbzphY3Rpb258dXBvZmZpY2ViYWNrdXA7ZXh0X3AwfDE7ZXh0X3AxfDA7ZXh0X3AyfDE7ZXh0X3AzfDtleHRfcDR8MDtleHRfcDV8MTU7cGx1Z2luX25hbWV8dXBldG1haW4yNjA4MjRfMy4xLjAuMQ== 0 06⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -sendDc ZmVhdHVyZV9yZXBzdnJfaW5mbzphY3Rpb258dXBvZmZpY2Vjb3B5ZmlsZXRyYW5zYWN0aW9uO2V4dF9wMHwwO2V4dF9wMXwwO2V4dF9wMnw7ZXh0X3AzfDE7ZXh0X3A0fDEzMTI7ZXh0X3A1fG9mZmljZTZcZXRtYWluLmRsbDtleHRfcDZ8b2ZmaWNlNlxldG1haW4uZGxsO3BsdWdpbl9uYW1lfHVwZXRtYWluMjYwODI0XzMuMS4wLjE= 0 06⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -sendDc ZmVhdHVyZV9yZXBzdnJfaW5mbzphY3Rpb258dXBvZmZpY2V1cHByaXZpbGVkZ2U7ZXh0X3AwfDE7ZXh0X3AxfHN1Y2Nlc3M7ZXh0X3AyfGZhbHNlO3BsdWdpbl9uYW1lfHVwZXRtYWluMjYwODI0XzMuMS4wLjE= 0 05⤵
- Reads the TCP/IP host and domain name from the registry
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --metrics-shmem-handle=6676,i,13431459285622339102,4790689360940844887,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3512 /prefetch:11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --metrics-shmem-handle=7192,i,16395746510016667849,16761504023860859895,2097152 --field-trial-handle=2004,i,8652226492472017575,3088895384575086001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7180 /prefetch:11⤵
-
C:\Program Files\Kingsoft\office6\wpscloudsvr.exe"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wps.exe"2⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscloudsvr.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscloudsvr.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kvprinter\kvpins64.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kvprinter\Kvpins64.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Kingsoft\office6\wpscloudsvr.exe"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService1⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -unregwpscompresspv2⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Program Files\Kingsoft\office6\wpscloudsvr.exe"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService1⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regpdfwspv2⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\wps_intl\addons\pool\win-x64\pdfwspv_3.1.0.10568\pdfwspv.dll"3⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\wps_intl\addons\pool\win-x64\pdfwspv_3.1.0.10568\pdfwspv.dll"3⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\wps_intl\addons\pool\win-x64\pdfwspv_3.1.0.10568\pdfwspv.dll"3⤵
-
-
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Browser Extensions
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Hijack Execution Flow
1DLL Search Order Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Hijack Execution Flow
1DLL Search Order Hijacking
1Defense Evasion
Hijack Execution Flow
1DLL Search Order Hijacking
1Masquerading
1Match Legitimate Name or Location
1Modify Registry
3Pre-OS Boot
1Bootkit
1Subvert Trust Controls
2Install Root Certificate
2Discovery
Browser Information Discovery
1Network Service Discovery
1Peripheral Device Discovery
1Query Registry
6System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Qt5NetworkKso.dll
Everything-KingSoft-wpsdesktop.ini
Everything-KingSoft.ini
run.ini
kcoworkdockpanel.qm
kcoworkdockpanel.qm
index.html
index.js
logo-small.png
logo.png
errPage.html
favicon.ico
run.ini
close-secondary.svg
kwpsaibasetypo.qm
kwpsaibasetypo.qm
element-icons.ttf
element-icons.woff
app.css
chunk-vendors.css
app.js
chunk-vendors.js
chunk-vendors.js
index.js
index.js
index.js
apm-init.js
default_ava.svg
desk-sync.svg
loading.svg
setup.cfg
setup.cfg
etmain.dll
kdesign.dll
krt.dll
kshell.dll
ksolite.dll
ksomisc.exe
kvpins64.exe
libcrypto-kso-1_1-x64.dll
error-net-72.png
presetLayout_16.pptx
qingnse.dll
qingnse64.dll
qingshellext.dll
qingshellext64.dll
qskia.dll
wpscloudsvr.exe
wpsoffice.exe
install.ini
install.ini
blocklist
protocols.json
settings.dat
settings.dat
LOG.old
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe60cc3d.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe64f09a.TMP
index.txt
sync_diagnostic.log
bda279e2-e5f1-46d3-bce2-d210c44b5343.tmp
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
keys.json
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
28f9b752-a9ea-44e6-a336-82a1583367bc.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
iconcache_idx.db
iconcache_idx.db
Inter.ttf
12804801-d858-4174-bf47-e263c56d7b37.tmp
APPX.9zq3n46_rcb46w_r2l5gz948e.tmp
APPX.t_chr5k3n865ax1wmgwrbo4mg.tmp
APPX.y20f6nfauu_v6ttxsv7g_l96g.tmp
Tmp9267.tmp
Tmp92A8.tmp
dce223a6-bac5-4a74-a800-4389e40d5f28.tmp
2ab7c525-0db9-489c-872a-e4c7dead12ab.tmp
content_new.js
weibo.svg
manifest.js
vendor.js
index.html
run.ini
run.ini
Qt5CoreKso.dll
Qt5GuiKso.dll
Qt5SvgKso.dll
Qt5WidgetsKso.dll
Qt5WinExtrasKso.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
dbghelp.dll
kbaseconfigcenter.dll
kpacketui.dll
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
qsvgicon.dll
qsvg.dll
qwindows.dll
windowsprintersupport.dll
qwindowsvistastyle.dll
ucrtbase.dll
vccorlib140.dll
vcruntime140.dll
vcruntime140_1.dll
vcruntime140_threads.dll
style.xml
product.dat
product_new.dat
style.xml
tempinstall.ini
tempinstall.ini
WPS Office.lnk
73b548de20df7f5a13684ebb0d11ffc6.prog.tmp
7f08aa3879872a1c24b2bead860ab369.prog.tmp
onlineconfig.data
25a355448d733f0bfadfe69265753986.svg
4e4df5d3322d880f582f3c95b6f2ae88.svg
50c4d3b6ffa860908c73643d2a9fe37b.svg
8e2c18164ccef1cf945648e9bd5c1991.svg
aac1856207f372d91bf9c10d624d5905.svg
e2bc5e2f6c4f468fc9922914b3b46427.svg
ids_v3_lang_60.ini
klogindex
ksomisc_2026_09_26.log
ksomisc_2026_09_26.log
wpssetup.log
wpssetup.log
wpssetup.log
wpssetup.log
wpssetup.log
wpssetup.log
wpssetup.log
mdbx.dat
mdbx.dat
mdbx.dat
dcsdk_dpv3.data
dcsdk_dpv3.data
temp-index
the-real-index
000001.dbtmp
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
MANIFEST-000001
Network Persistent State
Network Persistent State
kmsosidebar_3.1.0.3023.ini
upetmain260824_3.1.0.1.ini.lock
upetmain260824_3.1.0.1.ini.lock
download.7z
run.ini
chromelauncher.exe
download.7z
run.ini
download.7z
download.7z
download.7z
run.ini
download.7z
download.7z
download.7z.kdtmp
kcopilotentrylite.dll
kcopilotentrylite.qm
kcopilotentrylite.qm
icons_svg.data
kcopilotentrylite.kuip
kcopilotentrylite.qm
kcopilotentrylite.qm
kcopilotentrylite.qm
kcopilotentrylite.qm
kcopilotentrylite.qm
kcopilotentrylite.qm
kcopilotentrylite.qm
kcopilotentrylite.qm
kcopilotentrylite.qm
kcopilotentrylite.qm
kcopilotentrylite.qm
kcopilotentrylite.qm
kcopilotentrylite.qm
kcopilotentrylite.qm
kcopilotentrylite.qm
kcopilotentrylite.qm
kcopilotentrylite.qm
kcopilotentrylite.qm
plugin-provider.json
download.7z
kiconrecovery.dll
run.ini
download.7z
download.7z
run.ini
download.7z
download.7z
download.7z
manifest.js
app.css
mac_hero.png
pc_hero.png
pro.png
success.svg
app.js
chunk-vendors.js
icon-banner-close.svg
icon-close.svg
loading.gif
chunk-vendors.js
download.7z
download.7z
kpromeaccountpanel.dll
kpromeaccountpanel.qm
kpromeaccountpanel.qm
index.html
app.css
chunk-vendors.css
icon-mac-docer.svg
tiance_error.png
tiance_error_larger.png
weibo-dark.svg
app.js
chunk-vendors.js
index.html
app.css
app.js
index.html
load-apm.js
app.css
iconfont.ttf
iconfont.woff
iconfont.woff2
Group.svg
abnormal-dark.svg
abnormal.svg
arrow-1.svg
basic.webp
bell_flat.svg
certified.svg
common-icon.svg
company-admin.svg
company-priv.svg
default-avatar-dark.svg
default-avatar.svg
default_loginmode.svg
default_loginmode_dark.svg
dingding-dark.svg
dingding.svg
email-dark.svg
email.svg
enterprise-member.svg
expired.svg
feedback-icon.svg
icon-corp.svg
icon-dark-corp.svg
info.svg
message-gray.svg
notcertified.svg
paided.webp
people-single.svg
phone-dark.svg
phone.svg
qq-dark.svg
qq.svg
remove.svg
third-party-dark.svg
third-party.svg
warning-ico.svg
warning.svg
wechat-dark.svg
wechat.svg
wps-dark.svg
wps.svg
xiaomi-dark.svg
xiaomi.svg
xmianban.png
app.js
index.js
chunk-vendors.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
app.css
app.js
app.css
app.js
index.html
app.css
weibo-dark.svg
weibo.svg
app.js
chunk-vendors.js
app.css
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.html
app.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
icons.data
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
download.7z
kpromeextic.dll
run.ini
download.7z
kpromeforceclosedlg.qm
kpromeforceclosedlg.qm
download.7z
loading.svg
download.7z
download.7z
download.7z
empty.svg
download.7z
download.7z
kwpsaiwordtool.dll
kwpsaiwordtool.qm
kwpsaiwordtool.qm
icons.data
kwpsaiwordtool.qm
kwpsaiwordtool.qm
kwpsaiwordtool.qm
kwpsaiwordtool.qm
kwpsaiwordtool.qm
kwpsaiwordtool.qm
kwpsaiwordtool.qm
kwpsaiwordtool.qm
kwpsaiwordtool.qm
kwpsaiwordtool.qm
kwpsaiwordtool.qm
kwpsaiwordtool.qm
kwpsaiwordtool.qm
kwpsaiwordtool.qm
kwpsaiwordtool.qm
kwpsaiwordtool.qm
kwpsaiwordtool.qm
kwpsaiwordtool.qm
download.7z
run.ini
download.7z
kwpsinco.dll
run.ini
download.7z
download.7z
tr.xml
tr.xml
download.7z
download.7z
pdfwspvreg.dll
run.ini
download.7z
perfmon.dll
run.ini
download.7z
download.7z
download.7z
repsvr.dll_repsvr
run.ini
download.7z
memory/2548-52-0x000000001FA30000-0x000000001FA40000-memory.dmp
memory/2548-16-0x000000001FA30000-0x000000001FA40000-memory.dmp
memory/2548-0-0x0000000000D70000-0x0000000003042000-memory.dmp
memory/2548-51-0x000000001FA30000-0x000000001FA40000-memory.dmp
memory/2548-50-0x000000001FA30000-0x000000001FA40000-memory.dmp
memory/2548-49-0x000000001FA30000-0x000000001FA40000-memory.dmp
memory/2548-45-0x0000000024300000-0x0000000024312000-memory.dmp
memory/2548-42-0x000000001FA30000-0x000000001FA40000-memory.dmp
memory/2548-29-0x000000001FA30000-0x000000001FA40000-memory.dmp
memory/2548-1-0x000000001FA30000-0x000000001FA40000-memory.dmp
memory/4052-13960-0x0000000002B50000-0x0000000002B5A000-memory.dmp
memory/4052-13961-0x0000000005010000-0x0000000005036000-memory.dmp
memory/5720-9637-0x000001CD568B0000-0x000001CD56F1E000-memory.dmp
memory/5720-9708-0x000001CD568B0000-0x000001CD56F1E000-memory.dmp
memory/5720-1195-0x000001CD568B0000-0x000001CD56F1E000-memory.dmp
memory/5720-528-0x00007FFC54160000-0x00007FFC546EE000-memory.dmp
memory/5720-9603-0x000001CD568B0000-0x000001CD56F1E000-memory.dmp
memory/6208-9741-0x00007FFC4E800000-0x00007FFC4F3A4000-memory.dmp
memory/6208-9745-0x00007FFC31DC0000-0x00007FFC33BA5000-memory.dmp
memory/6208-9743-0x00007FFC4E270000-0x00007FFC4E7FE000-memory.dmp
memory/6208-9740-0x00007FFC33BB0000-0x00007FFC356F5000-memory.dmp
memory/6208-9739-0x00007FF7D2DD0000-0x00007FF7D3197000-memory.dmp
memory/6208-9742-0x00007FFC53540000-0x00007FFC53685000-memory.dmp
memory/6208-9746-0x00007FFC47F90000-0x00007FFC48A16000-memory.dmp
memory/6932-9783-0x00007FFC47F90000-0x00007FFC48A16000-memory.dmp
memory/6932-9777-0x00007FF7D2DD0000-0x00007FF7D3197000-memory.dmp
memory/6932-9780-0x00007FFC53540000-0x00007FFC53685000-memory.dmp
memory/6932-9778-0x00007FFC33BB0000-0x00007FFC356F5000-memory.dmp
memory/6932-9781-0x00007FFC4E270000-0x00007FFC4E7FE000-memory.dmp
memory/6932-9779-0x00007FFC4E800000-0x00007FFC4F3A4000-memory.dmp
memory/6964-13951-0x00000000009C0000-0x00000000009C8000-memory.dmp
memory/8204-9551-0x00007FFC35930000-0x00007FFC35940000-memory.dmp
memory/8204-9550-0x00007FFC33BB0000-0x00007FFC356F5000-memory.dmp
memory/8204-9549-0x00007FFC4CAF0000-0x00007FFC4D576000-memory.dmp
memory/8204-9547-0x00007FF7D2DD0000-0x00007FF7D3197000-memory.dmp
memory/8204-9548-0x00007FFC31DC0000-0x00007FFC33BA5000-memory.dmp
memory/8204-9544-0x00007FFC53540000-0x00007FFC53685000-memory.dmp
memory/8204-9546-0x00007FFC4E800000-0x00007FFC4F3A4000-memory.dmp
memory/8204-9561-0x00007FFC31DB0000-0x00007FFC31DC0000-memory.dmp
memory/8204-9560-0x00007FFC31DB0000-0x00007FFC31DC0000-memory.dmp
memory/8204-9559-0x00007FFC31DB0000-0x00007FFC31DC0000-memory.dmp
memory/8204-9545-0x00007FFC4E270000-0x00007FFC4E7FE000-memory.dmp
memory/8204-9558-0x00007FFC31DB0000-0x00007FFC31DC0000-memory.dmp
memory/8204-9552-0x00007FFC31DB0000-0x00007FFC31DC0000-memory.dmp
memory/8204-9553-0x00007FFC31DB0000-0x00007FFC31DC0000-memory.dmp
memory/8204-9554-0x00007FFC31DB0000-0x00007FFC31DC0000-memory.dmp
memory/8204-9555-0x00007FFC31DB0000-0x00007FFC31DC0000-memory.dmp
memory/8204-9556-0x00007FFC31DB0000-0x00007FFC31DC0000-memory.dmp
memory/8204-9557-0x00007FFC31DB0000-0x00007FFC31DC0000-memory.dmp
memory/8588-9642-0x00007FFC47F90000-0x00007FFC48A16000-memory.dmp
memory/8588-9638-0x00007FFC4E800000-0x00007FFC4F3A4000-memory.dmp
memory/8588-9640-0x00007FFC4E270000-0x00007FFC4E7FE000-memory.dmp
memory/8588-9641-0x00007FFC31DC0000-0x00007FFC33BA5000-memory.dmp
memory/8588-9636-0x00007FFC33BB0000-0x00007FFC356F5000-memory.dmp
memory/8588-9639-0x00007FFC53540000-0x00007FFC53685000-memory.dmp
memory/8588-9635-0x00007FF7D2DD0000-0x00007FF7D3197000-memory.dmp
memory/8728-9611-0x00007FFC4E270000-0x00007FFC4E7FE000-memory.dmp
memory/8728-9609-0x00007FFC4E800000-0x00007FFC4F3A4000-memory.dmp
memory/8728-9613-0x00007FFC31DC0000-0x00007FFC33BA5000-memory.dmp
memory/8728-9608-0x00007FF7D2DD0000-0x00007FF7D3197000-memory.dmp
memory/8728-9612-0x00007FFC33BB0000-0x00007FFC356F5000-memory.dmp
memory/8728-9610-0x00007FFC53540000-0x00007FFC53685000-memory.dmp
memory/8728-9614-0x00007FFC47F90000-0x00007FFC48A16000-memory.dmp
memory/8988-9577-0x00007FFC53540000-0x00007FFC53685000-memory.dmp
memory/8988-9574-0x00007FF7D2DD0000-0x00007FF7D3197000-memory.dmp
memory/8988-9580-0x00007FFC47F90000-0x00007FFC48A16000-memory.dmp
memory/8988-9579-0x00007FFC31DC0000-0x00007FFC33BA5000-memory.dmp
memory/8988-9575-0x00007FFC33BB0000-0x00007FFC356F5000-memory.dmp
memory/8988-9578-0x00007FFC4E270000-0x00007FFC4E7FE000-memory.dmp
memory/8988-9576-0x00007FFC4E800000-0x00007FFC4F3A4000-memory.dmp
memory/9124-9678-0x00007FFC47F90000-0x00007FFC48A16000-memory.dmp
memory/9124-9676-0x00007FFC4E270000-0x00007FFC4E7FE000-memory.dmp
memory/9124-9675-0x00007FFC53540000-0x00007FFC53685000-memory.dmp
memory/9124-9677-0x00007FFC31DC0000-0x00007FFC33BA5000-memory.dmp
memory/9124-9669-0x00007FF7D2DD0000-0x00007FF7D3197000-memory.dmp
memory/9124-9674-0x00007FFC4E800000-0x00007FFC4F3A4000-memory.dmp
memory/9124-9670-0x00007FFC33BB0000-0x00007FFC356F5000-memory.dmp