e840c3951c277830a37b59c497c9ee72bd70337c34a9dc804726e523743925d2

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Oct-27 15:35:25
Detected languages Chinese - PRC
English - United States
Debug artifacts H:\rc_v12_onl_i18_202606\Build\Release\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb
CompanyName Zhuhai Kingsoft Office Software Co.,Ltd
FileDescription WPS Office Setup
FileVersion 12,1,0,25872
InternalName konlinesetup_xa
LegalCopyright Copyright©2026 Kingsoft Corporation. All rights reserved.
OriginalFilename konlinesetup_xa.exe
ProductName WPS Office
ProductVersion 12,1,0,25872

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • sc.exe
 Contains references to internet browsers:
  • chrome.exe
 Tries to detect virtualized environments:
  • HARDWARE\DESCRIPTION\System
  • SYSTEM\CurrentControlSet\Control\SystemInformation
 Looks for VMWare presence:
  • 00-50-56
 May have dropper capabilities:
  • CurrentControlSet\Services
 Accesses the WMI:
  • ROOT\CIMV2
 Contains domain names:
  • analytics.com
  • ap-dw-collect.ksord.com
  • ap-dw-parameters.ksord.com
  • ap.wps.com
  • api-wps-param-us-test.4wps.net
  • cache.wpscdn.com
  • clients2.google.com
  • cloudfront.net
  • collect.ksord.com
  • d3gg3mr5cqyp84.cloudfront.net
  • dw-collect.ksord.com
  • dw-parameters.ksord.com
  • example.com
  • global.wps.com
  • google-analytics.com
  • google.com
  • https://ap-dw-collect.ksord.com
  • https://ap-dw-parameters.ksord.com
  • https://ap.wps.com
  • https://ap.wps.com/tiance/dce/exec/api/market/activity
  • https://api-wps-param-us-test.4wps.net
  • https://api-wps-param-us-test.4wps.net/api/map/online_params/onlinesetup_config/onlineParamByFunc?funcName
  • https://clients2.google.com
  • https://clients2.google.com/service/update2/crx
  • https://curl.se
  • https://d3gg3mr5cqyp84.cloudfront.net
  • https://d3gg3mr5cqyp84.cloudfront.net/
  • https://global.wps.com
  • https://global.wps.com/activity/union/report
  • https://global.wps.com/office/commons/kapm
  • https://global.wps.com/privacy/policies/eula/wpsoffice
  • https://global.wps.com/privacy/policies/privacy/wpsoffice
  • https://params.wps.com
  • https://params.wps.com/api/map/online_params/onlinesetup_config/onlineParamByFunc?funcName
  • https://s.wps.com
  • https://wdl1.pcfg.cache.wpscdn.com
  • https://wdl1.pcfg.cache.wpscdn.com/wpsdl/wpsoffice/onlinesetup/distsrc/
  • https://wdl1.pcfg.cache.wpscdn.com/wpsdl/wpsoffice/onlinesetup/package/
  • https://website-prod.cache.wpscdn.com
  • https://website-prod.cache.wpscdn.com/pkgs/win/setup_XA_mui_Free.exe
  • https://www.google-analytics.com
  • https://www.google-analytics.com/mp/collect
  • https://www.google-analytics.com/mp/collect?
  • https://www.wps.com
  • https://www.wps.com/eula
  • ksord.com
  • openssl.org
  • param-us-test.4wps.net
  • parameters.ksord.com
  • params.wps.com
  • pcfg.cache.wpscdn.com
  • prod.cache.wpscdn.com
  • s.wps.com
  • test.4wps.net
  • us-test.4wps.net
  • wdl1.pcfg.cache.wpscdn.com
  • website-prod.cache.wpscdn.com
  • wps-param-us-test.4wps.net
  • wpscdn.com
  • www.google-analytics.com
  • www.wps.com
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Uses constants related to Blowfish
Uses known Diffie-Helman primes
Uses known Mersenne Twister constants
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryW
  • LoadLibraryA
  • LoadLibraryExA
  • LoadLibraryExW
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
  • CreateFileA
 Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualProtect
 Has Internet access capabilities:
  • InternetCloseHandle
  • InternetConnectA
  • InternetReadFile
  • InternetOpenA
 Enumerates local disk drives:
  • GetDriveTypeW
  • GetVolumeInformationW
 Manipulates other processes:
  • OpenProcess
  • ReadProcessMemory
  • Process32FirstW
  • Process32NextW
Info The PE is digitally signed. Signer: WPS SOFTWARE PTE. LTD.
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Suspicious VirusTotal score: 1/70 (Scanned on 2026-11-14 16:51:42) ESET-NOD32: Win32/KingSoft.Z potentially unwanted application

Hashes

MD5 0ff3ad407502eb41b9cd06954fd24a65 🔍
SHA1 9a705c540494c116ba06e6e1b51f7ceb9f6e7c80 🔍
SHA256 e840c3951c277830a37b59c497c9ee72bd70337c34a9dc804726e523743925d2 🔍
SHA3 8e883d46dec7b2b0618754680d7cb34c9cb758b346db411e5fc0d4a798266fd9 🔍
SSDeep 98304:ATokqTTe4T5LbbyBNDxJgHObQtdnxNaznXhjND/Lmh:DkqGkJbWBcRxNcXhJzLc 🔍
Imports Hash 4c540952693fca33a13ed40cafc8a5b6 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x138

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2026-Oct-27 15:35:25
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x39bc00
SizeOfInitializedData 0x1b0a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0030B4E7 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x39d000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0x558000
SizeOfHeaders 0x400
Checksum 0x556185
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 02148b4b71eec25f32d28b363fce9832 🔍
SHA1 915f030bac68b2fef5e34463c0ae67e34ef45ba2 🔍
SHA256 df2db8199e34a48389de5c8c6ce4566e4297131638bf2ae03096f399fe97eff1 🔍
SHA3 9dc111d6e1f30250eae0ed94e4d5144687941218f9c58107ce36cef2f72df221 🔍
VirtualSize 0x39bbf6
VirtualAddress 0x1000
SizeOfRawData 0x39bc00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.7196

.rdata

MD5 9351676b9d0ae23e8f3cc1df9d469632 🔍
SHA1 74ea01bb7da2d06e4e8b6bff87adc6ec98754d80 🔍
SHA256 48018b2bf0c467fb1cfa4886cf6f8b4b5e8a849d10700b99d22ba7b02f89d5fe 🔍
SHA3 bded50fc26200cd41d2ab3cc5aa606effa52178646170b5306f98719fe8db54b 🔍
VirtualSize 0xdc62a
VirtualAddress 0x39d000
SizeOfRawData 0xdc800
PointerToRawData 0x39c000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.80532

.data

MD5 f0e47598a45ae87e93b1df36436cbf5b 🔍
SHA1 394c88ab1ea9ecaca284d041f7f592849ea14759 🔍
SHA256 e33a7caf0bb74f6a32525e55d78bf748c11cb048fcaff85075048736002b7ae6 🔍
SHA3 2a7248971126aa5b91ff2f1e4813b8e9c64803e0f15998f2cd6f6bd74c2e9c80 🔍
VirtualSize 0x14544
VirtualAddress 0x47a000
SizeOfRawData 0xc400
PointerToRawData 0x478800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.93299

.rsrc

MD5 5c5516677e08df8326d0ce6bc512b029 🔍
SHA1 1bb067993c1c81b026531b595ec3d0bfc06cbf8f 🔍
SHA256 c89de238b5eb1eab66fdead137d8fac051211270c8688bd4f8a80f7466f21084 🔍
SHA3 57a2deaf11b7cad857ad77ab939c4ab7ea810af76c9e0b95acaab12c9b45494c 🔍
VirtualSize 0x9f5e8
VirtualAddress 0x48f000
SizeOfRawData 0x9f600
PointerToRawData 0x484c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.45735

.reloc

MD5 57698746e226a170f491803533d0a190 🔍
SHA1 a4a4cb9b913def4ce0b4bea4534e19b7aba0b347 🔍
SHA256 28dc40dc1bc9722d9e2b6a13ea036c98352433db38750c08e139de79322171cd 🔍
SHA3 a8b9fe140095a22d5e1c03e452e1321f4beac462eea4283897e8b1f0c2f6256b 🔍
VirtualSize 0x287a0
VirtualAddress 0x52f000
SizeOfRawData 0x28800
PointerToRawData 0x524200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.60354

Imports

KERNEL32.dll SetEnvironmentVariableW
SetUnhandledExceptionFilter
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetSystemDirectoryW
GetWindowsDirectoryW
FindResourceExW
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadResource
LockResource
SizeofResource
FindResourceW
LoadLibraryW
SetDllDirectoryW
GetFileAttributesW
CloseHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
Sleep
GetTickCount
VerSetConditionMask
GetCommandLineW
ExpandEnvironmentStringsA
CreateDirectoryW
CreateFileW
DeleteFileW
GetDiskFreeSpaceExW
GetDriveTypeW
GetFileAttributesExW
GetShortPathNameW
GetTempFileNameW
SetFileTime
WriteFile
GetTempPathW
OutputDebugStringA
GetLastError
SetLastError
CreateMutexW
OpenMutexW
TerminateProcess
GetExitCodeProcess
OpenProcess
GetSystemTime
GetSystemTimeAsFileTime
GetNativeSystemInfo
ReadProcessMemory
GetModuleHandleA
GetModuleHandleExW
lstrlenW
VerifyVersionInfoW
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
MultiByteToWideChar
WideCharToMultiByte
GetLocaleInfoW
GetGeoInfoW
GetUserGeoID
GetUserDefaultUILanguage
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCurrentProcessId
GetSystemWow64DirectoryW
GetSystemPowerStatus
GetSystemDefaultLCID
GetUserDefaultLCID
GetCurrentProcess
GetCurrentThread
LocalFree
GetFileSizeEx
GetCurrentThreadId
GetProcessId
GlobalMemoryStatusEx
GetFileInformationByHandle
GetFileSize
ReadFile
SetFilePointer
GetLocalTime
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FileTimeToSystemTime
SystemTimeToFileTime
VirtualAlloc
SetEvent
CreateEventW
ExitProcess
FreeResource
MulDiv
FindClose
FindFirstFileW
FindNextFileW
RemoveDirectoryW
CopyFileW
FileTimeToLocalFileTime
GetVolumeInformationW
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
CreateFileA
DeviceIoControl
CreateThread
ExpandEnvironmentStringsW
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
GetEnvironmentVariableW
CreateProcessW
GetPrivateProfileStringW
GetLongPathNameW
ResetEvent
ReleaseSemaphore
CreateSemaphoreW
SystemTimeToTzSpecificLocalTime
ReleaseMutex
WaitForMultipleObjects
VirtualQuery
OpenFileMappingW
OutputDebugStringW
GetProcessTimes
GetStdHandle
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
FormatMessageW
QueryPerformanceCounter
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryA
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
QueryPerformanceFrequency
GetSystemDirectoryA
SleepEx
GetFullPathNameW
MoveFileExA
GetEnvironmentVariableA
CompareFileTime
PeekNamedPipe
InitializeConditionVariable
WakeAllConditionVariable
CreateEventA
RegisterWaitForSingleObject
UnregisterWait
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
SetFileCompletionNotificationModes
GetACP
GetCurrentDirectoryW
GlobalAlloc
GlobalUnlock
GlobalLock
DuplicateHandle
DosDateTimeToFileTime
GetEnvironmentStringsW
GetSystemInfo
VirtualProtect
LoadLibraryExA
IsDebuggerPresent
GetStringTypeW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
FindFirstFileExW
SetEndOfFile
SetFilePointerEx
MoveFileExW
GetLocaleInfoEx
InitOnceBeginInitialize
InitOnceComplete
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
WaitForSingleObjectEx
InitializeSListHead
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
RtlUnwind
InterlockedPushEntrySList
LoadLibraryExW
GetCommandLineA
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
WriteConsoleW
GetConsoleCP
CompareStringW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
FlushFileBuffers
SetStdHandle
IsValidCodePage
GetOEMCP
FreeEnvironmentStringsW
WININET.dll (delay-loaded) HttpSendRequestA
InternetCloseHandle
InternetConnectA
InternetReadFile
HttpOpenRequestA
HttpAddRequestHeadersA
InternetOpenA

Delayed Imports

Attributes 0x1
Name WININET.dll
ModuleHandle 0x4892b4
DelayImportAddressTable 0x486194
DelayImportNameTable 0x475f8c
BoundDelayImportTable 0x477bac
UnloadDelayImportTable 0
TimeStamp 1970-Jan-01 00:00:00

101

Type ZIPRES
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x6b01f
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98205
Detected Filetype Zip Compressed Archive
MD5 dc93778ef8a9a15962ae04366c35c1d7 🔍
SHA1 ad92ccbd17ed649a2e3aec24ade50f46b6b0e95b 🔍
SHA256 24c87f2e3c2719640e5bbeb93dc0f7e89442b215458a4bef4cce240f181be625 🔍
SHA3 467a548c0d1e865f4093fd5b2871c27d948483ea37a8173a18f15b152e5888f5 🔍

1

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x6b72
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.97056
Detected Filetype PNG graphic file
MD5 d0f0f96c9cb4f684fa89abcccf1fff70 🔍
SHA1 9494e872c31389ee76f942fa1fe949f1f1bcc482 🔍
SHA256 e377b072e30c60c4bccb5a0a1d9273f7d3aaad9bce26e95586ebaaf1fa4ce08b 🔍
SHA3 042ccfb36086e2857edbe95a2eaf9338ca10c27c400ab2c92b68fc140c9caf8b 🔍

2

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.16635
MD5 4bb36999a3b78bc63124a7dbbfdc60b1 🔍
SHA1 f63e1e68092ff704aed842b75d764da144cf691c 🔍
SHA256 fe87fcd18123a06782f265649e6223bd9fb45d8978632fa14010ae3c47d4eb50 🔍
SHA3 eeb1015f33b414b502e72ede167f002ce5845521112c666363c5dc72805c3862 🔍

3

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.21424
MD5 354ae9d22be3f6ed82f3ca8428085f83 🔍
SHA1 e49ad9c77dd24a7cbdc1370d936d476fc2dc9af0 🔍
SHA256 c9d1d7b726669ca3a51f8546761c1ecd0ded31aec5da65ac75dfd87c44d1a847 🔍
SHA3 2b105ab57c80b8ca4264eb58086a3d14421e48abbd6dac19f98c4423d4aa29d9 🔍

4

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.43466
MD5 895841b5ab29483ef79baccaaf34e7dc 🔍
SHA1 c0b19e813133046f233f02bba489f616f3188bb7 🔍
SHA256 864d7b886b3801d8aa1e9c6dcc6c1be6ed71f124e45c79bbeb2a4615bab02588 🔍
SHA3 b37e85eb34f8c9930f4069e94a1521a35f7c08626976fe6ba2f354ca6f3cf47f 🔍

5

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.46225
MD5 94fbe6298bc869f2bc33b97dfb099168 🔍
SHA1 30d5781aba6948ef227cea8e86b8cda7b9c67d9c 🔍
SHA256 6b5287e80044e835ae798b122e4667ac4e91458c14b0d438476d6ff3f609304f 🔍
SHA3 9572b08e83c19ebba828ee5a6833c178666513fc17b0bc9ec7ee5cef8081ff3e 🔍

6

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.70335
MD5 758b0d71922362c21b79298f3750c702 🔍
SHA1 0a34816fbf7e467c670afd8698063b6418a02195 🔍
SHA256 860e71b3ab6350af27ad861187ab1e7235071cdb8f46b25b98fcd09c3f6327ca 🔍
SHA3 5e07a206e92caae8ddf96390fc7bacdb6a0224e7603c390b8992738f925fafda 🔍

7

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.83778
MD5 60c17da58947127387aa55343d243e35 🔍
SHA1 e0d311bd8bfa52f28b5ce5d351f4ffdc9fb1db9b 🔍
SHA256 55c96ea7b6d2ec26e72c33b5a45adc47b7800f96f4b1ec0e3c066f79ac98ca4f 🔍
SHA3 be7883472b03e7813f955fe498169898a57a2bda99aae58542dd2657b6933709 🔍

8

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.23684
MD5 5ff52e7734c90d969f3debb0e2812898 🔍
SHA1 b4a6ad23838ff07adf686ab5a9d82133a300b7db 🔍
SHA256 af5d25f7c46757ed016cc9bddf828bcd2cbba5da4dbb5b396f0837f72137670c 🔍
SHA3 8ef78ac238e71b5d40682adda3a28741246e335279411a649c807f630d494e37 🔍

1 (#2)

Type RT_STRING
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x78
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.88904
MD5 045f1240fd59c2d737ad1d746c64d705 🔍
SHA1 c31a07900441ee9ece47bf71a65657373fd1ade9 🔍
SHA256 f42c8df3a0a75a931e4a208b752793e4ad509fda135131703a1378f4f047710a 🔍
SHA3 e3ab6c91db757816df2d35072f6a1b84b24ccb9a068af4bfbfdded9fa068775c 🔍

2 (#2)

Type RT_STRING
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x6e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.70642
MD5 9c60d3d1fa447b443335845fce569127 🔍
SHA1 7560df722a41be09b51308b6cbc58029b502783e 🔍
SHA256 8b53c65a225c686266f09e1e0ff4f97551ca13c7b42f5464b5ffd557fbf7b1c1 🔍
SHA3 0b00c652445efddc6e6ab09d28b2c3bc3be53216fe7d7078c6a0edbec1348210 🔍

3 (#2)

Type RT_STRING
Language Chinese - PRC
Codepage UNKNOWN
Size 0x3a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.61289
MD5 9209816dbbb7f5577d776821e12a1ff0 🔍
SHA1 d6304b71c57ab1304f1bd91e0f5bce8809705f10 🔍
SHA256 4194a9269b48a71c2d359b6e5b796d85e00c6659d589fd9015a13622e2563db1 🔍
SHA3 77f02e97e07fb6d54c1cee03afb50704970d6763780832cda412f52f56f0156f 🔍

104

Type RT_RCDATA
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0xa68e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.29596
MD5 3b289bd32a4ce27a05b03c25dcf38c0c 🔍
SHA1 482b141a2d1a704037fb3019c86b470676c70d10 🔍
SHA256 311b70370bf1df44607e3278aad3ff149d0cae01e24b9524994de44eeda2b8f6 🔍
SHA3 966872611fa20d4008b383793b654670cf69d360e67cea781f3aabc60969a39c 🔍

102

Type RT_GROUP_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x76
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.97321
Detected Filetype Icon file
MD5 39682e92762ed7bafa1384e40e68818e 🔍
SHA1 492951ff5aa25157f80c9a76ee0f90fef776e998 🔍
SHA256 ebb87d7d26290d022559462f3b8d9ff0565422cb126d56cbd35dbbe4fbb481a6 🔍
SHA3 31029efe4273ce62e7af0c785c3151bbb9d9851e215925f83753795d8b4cf71b 🔍

1 (#3)

Type RT_VERSION
Language English - United States
Codepage Latin 1 / Western European
Size 0x38c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.49795
MD5 aba00d9c8af5bdfde84ae5f095ed0c1b 🔍
SHA1 d5c5e9a2e5116af8bc270e1c0187fd8a3df7380c 🔍
SHA256 5b7a6def7e450cf61accf606cc88c4b224f00397c61347100cef43909716d5ba 🔍
SHA3 7c3e3505a6dd2084d96976a2f467ef20061327260cc03ac4bc9777b755b67b74 🔍

1 (#4)

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x79c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.12656
MD5 846438a58cb09f43c6958f48e8e50f0b 🔍
SHA1 a8758b29a709fee3fce625df10f4dae3439c8cf9 🔍
SHA256 80570a460131ad39055163823b5609f9e1e74569e556db234aca2d773379ff8f 🔍
SHA3 244e2cf89cdab26da22b849aba4f43f2be5e2358e25e866986d4a09899ed24b5 🔍

String Table contents

601.1294
TRUE
601.1294
Exchange
-notautostartwps
G-NPNNQVBGNR|OQRAqO4BR9ex8MbwSfLC3Q
TRUE
261027-UUQF40

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 12.1.0.25872
ProductVersion 12.1.0.25872
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_UNKNOWN
Language UNKNOWN
CompanyName Zhuhai Kingsoft Office Software Co.,Ltd
FileDescription WPS Office Setup
FileVersion (#2) 12,1,0,25872
InternalName konlinesetup_xa
LegalCopyright Copyright©2026 Kingsoft Corporation. All rights reserved.
OriginalFilename konlinesetup_xa.exe
ProductName WPS Office
ProductVersion (#2) 12,1,0,25872
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Oct-27 15:35:25
Version 0.0
SizeofData 124
AddressOfRawData 0x45dd0c
PointerToRawData 0x45cd0c
Referenced File H:\rc_v12_onl_i18_202606\Build\Release\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Oct-27 15:35:25
Version 0.0
SizeofData 1076
AddressOfRawData 0x45dd88
PointerToRawData 0x45cd88

TLS Callbacks

StartAddressOfRawData 0x85e1cc
EndAddressOfRawData 0x85e1d4
AddressOfIndex 0x88d7d0
AddressOfCallbacks 0x79d4bc
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0xbc
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x87c3b4
SEHandlerTable 0
SEHandlerCount 0

RICH Header

XOR Key 0x1608dca5
Unmarked objects 0
ASM objects (VS2017 v14.15 compiler 26715) 25
C++ objects (VS2017 v14.15 compiler 26715) 217
253 (28518) 14
C objects (30034) 19
ASM objects (30034) 25
253 (23601) 2
C++ objects (30034) 105
C objects (VS2017 v14.15 compiler 26715) 31
Imports (VS2017 v14.15 compiler 26715) 3
Unmarked objects (#2) 21
C objects (30154) 782
C objects (CVTCIL) (VS2017 v14.15 compiler 26715) 3
C++ objects (CVTCIL) (VS2017 v14.15 compiler 26715) 2
Total imports 680
C++ objects (30154) 173
Resource objects (30154) 1
151 2
Linker (30154) 1

Errors

Leave a comment

No comments yet.