From 07b35de84450c68e59ee726fb529204d9853e795 Mon Sep 17 00:00:00 2001
From: Still Hsu <dev@stillu.cc>
Date: Sat, 9 Nov 2024 12:03:39 +0800
Subject: [PATCH] Add krpt.dll

Signed-off-by: Still Hsu <dev@stillu.cc>
---
 yml/3rd_party/kingsoft/krpt.yml | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 yml/3rd_party/kingsoft/krpt.yml

diff --git a/yml/3rd_party/kingsoft/krpt.yml b/yml/3rd_party/kingsoft/krpt.yml
new file mode 100644
index 0000000..3c50e17
--- /dev/null
+++ b/yml/3rd_party/kingsoft/krpt.yml
@@ -0,0 +1,23 @@
+---
+Name: krpt.dll
+Author: Still Hsu
+Created: 2024-11-09
+Vendor: Kingsoft
+ExpectedLocations:
+- '%ProgramFiles(x86)%\Kingsoft\WPS Office\%VERSION%\office6'
+VulnerableExecutables:
+- Path: '%ProgramFiles(x86)%\Kingsoft\WPS Office\%VERSION%\office6\wpp.exe'
+  Type: Sideloading
+  ExpectedVersionInformation:
+  - FileDescription: WPS Presentation
+    OriginalFilename: wpp.exe
+    ProductName: WPS Office
+  ExpectedSignatureInformation:
+  - Subject:  CN="Zhuhai Kingsoft Office Software Co., Ltd.", O="Zhuhai Kingsoft Office Software Co., Ltd.", L=Zhuhai, S=Guangdong, C=CN
+    Issuer: CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US
+    Type: Authenticode
+Resources:
+  - https://www.virustotal.com/gui/file/4957a62e019c30c0a79e4d2d4dd854f6e8f6e0aadb606e157525d98ee0ac5096
+Acknowledgements:
+  - Name: Still Hsu
+    Twitter: '@AzakaSekai_'