Analysis
-
max time kernel
72s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2025, 14:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://kso.page.link/wps
Resource
win10v2004-20250314-en
General
-
Target
https://kso.page.link/wps
Malware Config
Signatures
-
Downloads MZ/PE file 1 IoCs
flow pid Process 154 2944 msedge.exe -
Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation ksomisc.exe Key value queried \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation ksomisc.exe Key value queried \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation ksomisc.exe Key value queried \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation ksomisc.exe Key value queried \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key value queried \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation wps_wid.cid-825576317.1743172881.exe Key value queried \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation ksomisc.exe Key value queried \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation ksomisc.exe Key value queried \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation ksomisc.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 32 IoCs
pid Process 5300 wps_wid.cid-825576317.1743172881.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 4188 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 5432 ksomisc.exe 3688 ksomisc.exe 5236 ksomisc.exe 1100 wpscloudsvr.exe 1904 ksomisc.exe 4560 ksomisc.exe 3972 ksomisc.exe 4444 ksomisc.exe 2816 ksomisc.exe 2284 ksomisc.exe 4104 ksomisc.exe 6084 ksomisc.exe 3948 ksomisc.exe 4704 ksomisc.exe 3984 ksomisc.exe 3240 ksomisc.exe 4316 ksomisc.exe 4396 pinTaskbar.exe 4392 ksomisc.exe 3052 wps.exe 5272 wps.exe 3516 wps.exe 5748 ksomisc.exe 2832 ksomisc.exe 1124 ksomisc.exe 2664 ksomisc.exe 1788 ksomisc.exe 3456 ksomisc.exe 5604 ksomisc.exe -
Loads dropped DLL 64 IoCs
pid Process 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe -
Modifies system executable filetype association 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\lnkfile\ShellEx\ContextMenuHandlers\ kwpsshellext regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ kwpsshellext\ = "{28A80003-18FD-411D-B0A3-3C81F618E22B}" regsvr32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wpscloudsvr.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 wps_wid.cid-825576317.1743172881.exe File opened for modification \??\PhysicalDrive0 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe File opened for modification \??\PhysicalDrive0 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe File opened for modification \??\PhysicalDrive0 ksomisc.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\hy\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\gu\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\bn\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\mr\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\uk\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\fa\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_metadata\verified_contents.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\manifest.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\ja\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\de\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\lo\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\ne\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\az\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\fr_CA\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\lt\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\sv\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\mn\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\cy\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\fil\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\vi\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\en_CA\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\fi\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\af\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\am\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\it\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\id\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\fr\messages.json msedge.exe File created C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe File created C:\Program Files\msedge_url_fetcher_2524_866994858\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\dasherSettingSchema.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\te\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\km\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\eu\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\hu\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\gl\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\ta\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\pl\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\nl\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\en_US\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\si\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\ms\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\ca\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\sl\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\sk\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\ur\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\offscreendocument.html msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\ko\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\bg\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\no\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\ka\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\zh_TW\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\tr\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\iw\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\ml\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\et\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\ar\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\hi\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\es\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\is\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\es_419\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\lv\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\sr\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\my\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2524_1625975372\_locales\da\messages.json msedge.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 5396 7552 WerFault.exe 232 6416 7552 WerFault.exe 232 -
System Location Discovery: System Language Discovery 1 TTPs 35 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openwith.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wps_wid.cid-825576317.1743172881.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpscloudsvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksomisc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{AC0714F7-3D04-11D1-AE7D-00A0C90F26F4}\Compatibility Flags = "1024" ksomisc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{AC0714F7-3D04-11D1-AE7D-00A0C90F26F4}\AlternateCLSID = "{AB5357A7-3179-47F9-A705-966B8B936D5E}" ksomisc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{AC0714F6-3D04-11D1-AE7D-00A0C90F26F4} ksomisc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{AC0714F6-3D04-11D1-AE7D-00A0C90F26F4}\Compatibility Flags = "1024" ksomisc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{AC0714F6-3D04-11D1-AE7D-00A0C90F26F4}\AlternateCLSID = "{E436987E-F427-4AD7-8738-6D0895A3E93F}" ksomisc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{AC0714F7-3D04-11D1-AE7D-00A0C90F26F4} ksomisc.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133876464844615088" msedge.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{000C0382-0000-0000-C000-000000000046} ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{000C0396-0000-0000-C000-000000000046}\TypeLib ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{91493494-5A91-11CF-8700-00AA0060263B} ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{9149349A-5A91-11CF-8700-00AA0060263B}\TypeLib ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{92D41A75-F07E-4CA4-AF6F-BEF486AA4E6F} ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{92D41A75-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WPS.Doc.6\shell\print\ = "&Print" ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{000C1710-0000-0000-C000-000000000046}\TypeLib ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{000208A7-0000-0000-C000-000000000046}\TypeLib\Version = "3.0" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{000C0358-0000-0000-C000-000000000046}\ = "HTMLProjectItem" ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{000209A9-0000-0000-C000-000000000046} ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{BCE49BBA-D8D1-4A2A-910E-99FB75DB2443}\TypeLib\ = "{D626EB73-B7C0-45EF-922D-0CDDAEDE12FA}" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{0002085D-0000-0000-C000-000000000046}\ = "Toolbars" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{6FFA84BB-A350-4442-BB53-A43653459A84}\ = "Chart" ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{C4A02049-024C-4273-8934-E48CC21479A9}\ProxyStubClsid32 ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{92D41A77-F07E-4CA4-AF6F-BEF486AA4E6F} ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{92D41A6E-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{914934EE-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{000209E9-0000-0000-C000-000000000046}\TypeLib\Version = "3.0" ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{0C6FA8CA-E65F-4FC7-AB8F-20729EECBB14} ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{3D2F865B-E2DB-4896-BC35-6A006DF896DC}\ = "Guide" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{9149345A-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{000C031F-0000-0000-C000-000000000046}\TypeLib\ = "{45541000-5750-5300-4B49-4E47534F4655}" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{0002442C-0000-0000-C000-000000000046}\TypeLib\ = "{45541000-5750-5300-4B49-4E47534F4655}" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{000209CB-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{0002097D-0000-0000-C000-000000000046}\TypeLib\Version = "3.0" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{E598E358-2852-42D4-8775-160BD91B7244}\ = "UndoRecord" ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\.dpsx\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f} ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WPP.SLDM.6\shell\ = "open" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{5DAA8BB6-054E-48F6-BEAC-EAAD02BE0CC7}\TypeLib\Version = "3.0" ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{0002097B-0000-0000-C000-000000000046}\TypeLib ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{91493485-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{000C1727-0000-0000-C000-000000000046} ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{000CDB03-0000-0000-C000-000000000046} ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{000209C5-0000-0000-C000-000000000046}\TypeLib\Version = "3.0" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{DD947D72-F33C-4198-9BDF-F86181D05E41}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{2432F529-514B-4575-AA71-1754C74A13D6}\ProxyStubClsid32 ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{00020845-0000-0000-C000-000000000046}\TypeLib ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{FD1AEC82-85C4-4FFE-9259-E061915FEC9D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ksomisc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSAddnDr.AddInDesigner.1\CLSID\ = "{AC0714F6-3D04-11D1-AE7D-00A0C90F26F4}" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{000C038C-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{00020972-0000-0000-C000-000000000046}\TypeLib\ = "{00020905-0000-4B30-A977-D214852036FF}" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{00020921-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WPP.PPTX.6\shell\open\ = "&Open" ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{000C0352-0000-0000-C000-000000000046} ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{00020951-0000-0000-C000-000000000046}\TypeLib ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{000209DB-0000-0000-C000-000000000046}\ProxyStubClsid32 ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\KWPP.Presentation.12\shell\print\ = "&Print" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{000244EA-0000-0000-C000-000000000046}\ = "ModelMeasureNames" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{000208AD-0000-0000-C000-000000000046}\ = "Module" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{000C172C-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{000209B6-0000-0000-C000-000000000046}\TypeLib ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{3E061A7E-67AD-4EAA-BC1E-55057D5E596F} ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{00024432-0000-0000-C000-000000000046}\TypeLib\ = "{45541000-5750-5300-4B49-4E47534F4655}" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{000208C2-0000-0000-C000-000000000046}\TypeLib\ = "{45541000-5750-5300-4B49-4E47534F4655}" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{00024487-0000-0000-C000-000000000046}\ = "WorksheetView" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{000C03CF-0000-0000-C000-000000000046}\TypeLib\Version = "63.1" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{000CDB0E-0000-0000-C000-000000000046}\ = "CustomXMLValidationError" ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{000209CD-0000-0000-C000-000000000046}\TypeLib ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{5D7F6C15-36CE-44CC-9692-5A1F8B8C906D} ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\WOW6432Node\Interface\{00020945-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{5F3AC089-677E-42FD-A11A-A773C06E560B}\TypeLib\ = "{D626EB73-B7C0-45EF-922D-0CDDAEDE12FA}" ksomisc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{0002089A-0000-0000-C000-000000000046}\TypeLib\ = "{45541000-5750-5300-4B49-4E47534F4655}" ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Interface\{00020882-0000-0000-C000-000000000046} ksomisc.exe -
Modifies system certificate store 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs wps_wid.cid-825576317.1743172881.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CTLs ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CRLs 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CTLs wps_wid.cid-825576317.1743172881.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CTLs 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates wps_wid.cid-825576317.1743172881.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\SystemCertificates\FlightRoot 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CTLs ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates wps_wid.cid-825576317.1743172881.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\Certificates 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CRLs 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates wps_wid.cid-825576317.1743172881.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CRLs ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CRLs wps_wid.cid-825576317.1743172881.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot wps_wid.cid-825576317.1743172881.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CTLs ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates wps_wid.cid-825576317.1743172881.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CTLs ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\SystemCertificates\TestSignRoot ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\SystemCertificates\FlightRoot wps_wid.cid-825576317.1743172881.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CRLs ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs wps_wid.cid-825576317.1743172881.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\SystemCertificates\TrustedDevices wps_wid.cid-825576317.1743172881.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer wps_wid.cid-825576317.1743172881.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\SystemCertificates\FlightRoot ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\SystemCertificates\TestSignRoot ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CRLs 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\SystemCertificates\TestSignRoot ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs ksomisc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs wps_wid.cid-825576317.1743172881.exe -
Suspicious behavior: AddClipboardFormatListener 25 IoCs
pid Process 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 5432 ksomisc.exe 3688 ksomisc.exe 5236 ksomisc.exe 1904 ksomisc.exe 4560 ksomisc.exe 3972 ksomisc.exe 4444 ksomisc.exe 2816 ksomisc.exe 2284 ksomisc.exe 4104 ksomisc.exe 6084 ksomisc.exe 3948 ksomisc.exe 4704 ksomisc.exe 3984 ksomisc.exe 3240 ksomisc.exe 4316 ksomisc.exe 4392 ksomisc.exe 5748 ksomisc.exe 2832 ksomisc.exe 1124 ksomisc.exe 2664 ksomisc.exe 1788 ksomisc.exe 3456 ksomisc.exe 5604 ksomisc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5300 wps_wid.cid-825576317.1743172881.exe 5300 wps_wid.cid-825576317.1743172881.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 4188 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 4188 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 4188 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 4188 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 4188 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 4188 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 5432 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe 5236 ksomisc.exe 5236 ksomisc.exe 5236 ksomisc.exe 5236 ksomisc.exe 5236 ksomisc.exe 5236 ksomisc.exe 5236 ksomisc.exe 5236 ksomisc.exe 1100 wpscloudsvr.exe 1100 wpscloudsvr.exe 1904 ksomisc.exe 1904 ksomisc.exe 1904 ksomisc.exe 1904 ksomisc.exe 1904 ksomisc.exe 1904 ksomisc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Token: SeRestorePrivilege 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Token: SeRestorePrivilege 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Token: SeRestorePrivilege 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Token: SeRestorePrivilege 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe Token: SeDebugPrivilege 5432 ksomisc.exe Token: SeLockMemoryPrivilege 5432 ksomisc.exe Token: SeDebugPrivilege 3688 ksomisc.exe Token: SeLockMemoryPrivilege 3688 ksomisc.exe Token: SeDebugPrivilege 5236 ksomisc.exe Token: SeLockMemoryPrivilege 5236 ksomisc.exe Token: SeDebugPrivilege 1904 ksomisc.exe Token: SeLockMemoryPrivilege 1904 ksomisc.exe Token: SeDebugPrivilege 4560 ksomisc.exe Token: SeLockMemoryPrivilege 4560 ksomisc.exe Token: SeDebugPrivilege 3972 ksomisc.exe Token: SeLockMemoryPrivilege 3972 ksomisc.exe Token: SeDebugPrivilege 4444 ksomisc.exe Token: SeLockMemoryPrivilege 4444 ksomisc.exe Token: SeDebugPrivilege 2816 ksomisc.exe Token: SeLockMemoryPrivilege 2816 ksomisc.exe Token: SeDebugPrivilege 2284 ksomisc.exe Token: SeLockMemoryPrivilege 2284 ksomisc.exe Token: SeDebugPrivilege 4104 ksomisc.exe Token: SeLockMemoryPrivilege 4104 ksomisc.exe Token: SeDebugPrivilege 6084 ksomisc.exe Token: SeLockMemoryPrivilege 6084 ksomisc.exe Token: SeDebugPrivilege 3948 ksomisc.exe Token: SeLockMemoryPrivilege 3948 ksomisc.exe Token: SeDebugPrivilege 4704 ksomisc.exe Token: SeLockMemoryPrivilege 4704 ksomisc.exe Token: SeDebugPrivilege 3984 ksomisc.exe Token: SeLockMemoryPrivilege 3984 ksomisc.exe Token: SeDebugPrivilege 3240 ksomisc.exe Token: SeLockMemoryPrivilege 3240 ksomisc.exe Token: SeDebugPrivilege 4316 ksomisc.exe Token: SeLockMemoryPrivilege 4316 ksomisc.exe Token: SeShutdownPrivilege 3428 Explorer.EXE Token: SeCreatePagefilePrivilege 3428 Explorer.EXE Token: SeShutdownPrivilege 3428 Explorer.EXE Token: SeCreatePagefilePrivilege 3428 Explorer.EXE Token: SeShutdownPrivilege 3428 Explorer.EXE Token: SeCreatePagefilePrivilege 3428 Explorer.EXE Token: SeDebugPrivilege 4392 ksomisc.exe Token: SeLockMemoryPrivilege 4392 ksomisc.exe Token: SeShutdownPrivilege 3428 Explorer.EXE Token: SeCreatePagefilePrivilege 3428 Explorer.EXE Token: SeShutdownPrivilege 3428 Explorer.EXE Token: SeCreatePagefilePrivilege 3428 Explorer.EXE Token: SeShutdownPrivilege 3428 Explorer.EXE Token: SeCreatePagefilePrivilege 3428 Explorer.EXE Token: SeShutdownPrivilege 3428 Explorer.EXE Token: SeCreatePagefilePrivilege 3428 Explorer.EXE Token: SeDebugPrivilege 5748 ksomisc.exe Token: SeLockMemoryPrivilege 5748 ksomisc.exe Token: SeShutdownPrivilege 3428 Explorer.EXE Token: SeCreatePagefilePrivilege 3428 Explorer.EXE Token: SeShutdownPrivilege 3428 Explorer.EXE Token: SeCreatePagefilePrivilege 3428 Explorer.EXE Token: SeShutdownPrivilege 3428 Explorer.EXE Token: SeCreatePagefilePrivilege 3428 Explorer.EXE Token: SeDebugPrivilege 2832 ksomisc.exe Token: SeLockMemoryPrivilege 2832 ksomisc.exe Token: SeShutdownPrivilege 3428 Explorer.EXE -
Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 3428 Explorer.EXE -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe -
Suspicious use of SetWindowsHookEx 59 IoCs
pid Process 3724 2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe 5432 ksomisc.exe 5432 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe 3688 ksomisc.exe 5236 ksomisc.exe 5236 ksomisc.exe 5236 ksomisc.exe 5236 ksomisc.exe 1904 ksomisc.exe 1904 ksomisc.exe 4560 ksomisc.exe 4560 ksomisc.exe 3972 ksomisc.exe 3972 ksomisc.exe 4444 ksomisc.exe 4444 ksomisc.exe 2816 ksomisc.exe 2816 ksomisc.exe 2816 ksomisc.exe 2816 ksomisc.exe 2284 ksomisc.exe 2284 ksomisc.exe 2284 ksomisc.exe 2284 ksomisc.exe 4104 ksomisc.exe 4104 ksomisc.exe 4104 ksomisc.exe 4104 ksomisc.exe 6084 ksomisc.exe 6084 ksomisc.exe 3948 ksomisc.exe 3948 ksomisc.exe 4704 ksomisc.exe 4704 ksomisc.exe 3984 ksomisc.exe 3984 ksomisc.exe 3240 ksomisc.exe 3240 ksomisc.exe 4316 ksomisc.exe 4316 ksomisc.exe 4392 ksomisc.exe 4392 ksomisc.exe 5748 ksomisc.exe 5748 ksomisc.exe 2832 ksomisc.exe 2832 ksomisc.exe 1124 ksomisc.exe 1124 ksomisc.exe 2664 ksomisc.exe 2664 ksomisc.exe 1788 ksomisc.exe 1788 ksomisc.exe 3456 ksomisc.exe 3456 ksomisc.exe 5604 ksomisc.exe 5604 ksomisc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 4020 2524 msedge.exe 85 PID 2524 wrote to memory of 4020 2524 msedge.exe 85 PID 2524 wrote to memory of 2944 2524 msedge.exe 86 PID 2524 wrote to memory of 2944 2524 msedge.exe 86 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 4768 2524 msedge.exe 87 PID 2524 wrote to memory of 5956 2524 msedge.exe 88 PID 2524 wrote to memory of 5956 2524 msedge.exe 88 PID 2524 wrote to memory of 5956 2524 msedge.exe 88 PID 2524 wrote to memory of 5956 2524 msedge.exe 88 PID 2524 wrote to memory of 5956 2524 msedge.exe 88 PID 2524 wrote to memory of 5956 2524 msedge.exe 88 PID 2524 wrote to memory of 5956 2524 msedge.exe 88 PID 2524 wrote to memory of 5956 2524 msedge.exe 88 PID 2524 wrote to memory of 5956 2524 msedge.exe 88
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3428 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://kso.page.link/wps2⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7ff982bbf208,0x7ff982bbf214,0x7ff982bbf2203⤵PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1956,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:33⤵
- Downloads MZ/PE file
PID:2944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2248,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:23⤵PID:4768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2412,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:83⤵PID:5956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3484,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:13⤵PID:3884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3492,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:13⤵PID:5108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5036,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:13⤵PID:3692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4920,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:13⤵PID:3780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5284,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:13⤵PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4848,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:83⤵PID:1928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5388,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:83⤵PID:3876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6008,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:83⤵PID:3688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6160,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:83⤵PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6160,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:83⤵PID:6072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6012,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:83⤵PID:4720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6440,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:13⤵PID:4592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7160,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:83⤵PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7216,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:83⤵PID:3956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7212,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:83⤵PID:3472
-
-
C:\Users\Admin\Downloads\wps_wid.cid-825576317.1743172881.exe"C:\Users\Admin\Downloads\wps_wid.cid-825576317.1743172881.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:5300 -
C:\Users\Admin\Downloads\wps_download\2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe"C:\Users\Admin\Downloads\wps_download\2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3724 -
C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe"C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" InstallService5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1100
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -regmtfont5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3972
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\\office6\ksomisc.exe" -setappcap5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4444
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\\office6\ksomisc.exe" -assoepub -source=15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5604 -
C:\Windows\SysWOW64\openwith.exe"C:\Windows\SysWOW64\openwith.exe"6⤵PID:3364
-
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\SysWOW64\openwith.exe"6⤵PID:4996
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\\office6\ksomisc.exe" -registerqingshellext 15⤵PID:876
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\addons\html2pdf\html2pdf.dll"5⤵PID:1676
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -regmso2pdfplugins5⤵PID:6044
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\kmso2pdfplugins.dll"6⤵PID:1788
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\kmso2pdfplugins64.dll"6⤵PID:1372
-
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\kmso2pdfplugins64.dll"7⤵PID:4052
-
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -regPreviewHandler5⤵PID:3420
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\\office6\ksomisc.exe" -assopic_setup5⤵PID:5272
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\\office6\ksomisc.exe" -defragment5⤵PID:5248
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe" /prometheus /download_lang_on_start /lang=en_US /from=get_start_with_wps_after_install_onlinesetup4⤵PID:5604
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wps.exe" /prometheus /download_lang_on_start /lang=en_US /from=get_start_with_wps_after_install_onlinesetup5⤵PID:3804
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpscloudsvr.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpscloudsvr.exe" /qingbangong /start_from=qingipc /qingbangong /start_from=kstartpage silentautologin6⤵PID:3052
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -getabtest -forceperusermode7⤵PID:1532
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -getonlineparam -forceperusermode7⤵PID:6008
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe" /krecentfile /init /From=Qing7⤵PID:5500
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpscloudsvr.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpscloudsvr.exe" /krecentfile /init /From=Qing8⤵PID:5716
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe" /messagepush /PushType=mipush /From=Qing7⤵PID:3676
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpscloudsvr.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpscloudsvr.exe" /messagepush /PushType=mipush /From=Qing8⤵PID:1928
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\kwpswnsserver.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\kwpswnsserver.exe" checkrt7⤵PID:7024
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpscenter.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpscenter.exe" Run -Entry=EntryPoint C:\Users\Admin\AppData\Roaming\Kingsoft\wps\addons\pool\win-i386/kdocreminder_1.1.2021.220/kdocreminder.dll7⤵PID:5672
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpscenter.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpscenter.exe" Run /InstanceId=wpsbubble -Entry=EntryPoint C:\Users\Admin\AppData\Roaming\Kingsoft\wps\addons\pool\win-i386/kwpsbubble_1.0.2024.95/kwpsbubble_xa.dll7⤵PID:3648
-
-
C:\Users\Admin\AppData\Roaming\Kingsoft\wps\addons\pool\win-i386\chromehost_1.0.2024.93\chromelauncher.exeC:\Users\Admin\AppData\Roaming\Kingsoft\wps\addons\pool\win-i386\chromehost_1.0.2024.93\chromelauncher.exe install7⤵PID:6380
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wps.exe" Run -User=Admin "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -regpdfwspv7⤵PID:6652
-
-
C:\Users\Admin\AppData\Roaming\Kingsoft\office6\wns\windowsappruntimeinstall.exeC:\Users\Admin\AppData\Roaming\Kingsoft\office6\wns\windowsappruntimeinstall.exe --quiet7⤵PID:6768
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\kwpswnsserver.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\kwpswnsserver.exe" checkrt7⤵PID:7412
-
C:\Program Files\WindowsApps\Microsoft.WinAppRuntime.DDLM.5001.373.1736.0-x8_5001.373.1736.0_x86__8wekyb3d8bbwe\DynamicDependencyLifetimeManagerShadow.exe"C:\Program Files\WindowsApps\Microsoft.WinAppRuntime.DDLM.5001.373.1736.0-x8_5001.373.1736.0_x86__8wekyb3d8bbwe\DynamicDependencyLifetimeManagerShadow.exe" 7412;Microsoft.WinAppRuntime.DDLM.5001.373.1736.0-x8_5001.373.1736.0_x86__8wekyb3d8bbwe;{05488cf2-24bc-4f3d-a0f0-6af9032c3481}8⤵PID:7496
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\kwpswnsserver.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\kwpswnsserver.exe" cmd=YXp1cmVfaWQ9NzNjZjk1ZjItMTE3OS00ZjVjLTllZTktNTUxMDg1ZmJmM2E0JnRpbWVzdGFtcD0xNzQzMTcyOTgw&token=4550eb1d6246918f848fb09c05a0305e7⤵PID:7552
-
C:\Program Files\WindowsApps\Microsoft.WinAppRuntime.DDLM.5001.373.1736.0-x8_5001.373.1736.0_x86__8wekyb3d8bbwe\DynamicDependencyLifetimeManagerShadow.exe"C:\Program Files\WindowsApps\Microsoft.WinAppRuntime.DDLM.5001.373.1736.0-x8_5001.373.1736.0_x86__8wekyb3d8bbwe\DynamicDependencyLifetimeManagerShadow.exe" 7552;Microsoft.WinAppRuntime.DDLM.5001.373.1736.0-x8_5001.373.1736.0_x86__8wekyb3d8bbwe;{988a7136-2d26-443e-90b0-f478ae6a8306}8⤵PID:8040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7552 -s 14488⤵
- Program crash
PID:5396
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7552 -s 14568⤵
- Program crash
PID:6416
-
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wps.exe" Run "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.20326/office6/addons/kcef/jsapibrowser.dll" --server=browser.a3ba19ec797144349ea5dbc1b742aca1.20326.high.dpi1.pipe --rendererswitchflag=06⤵PID:3232
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\promecefpluginhost.exe"C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.20326/office6\promecefpluginhost.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\debug.log" --mojo-platform-channel-handle=1948 --field-trial-handle=2096,i,12996612383413008642,17411132928907511407,131072 --disable-features=TSFImeSupport /prefetch:27⤵PID:3904
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\promecefpluginhost.exe"C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.20326/office6\promecefpluginhost.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\debug.log" --mojo-platform-channel-handle=2608 --field-trial-handle=2096,i,12996612383413008642,17411132928907511407,131072 --disable-features=TSFImeSupport /prefetch:87⤵PID:5544
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.203\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.203\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=3232 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.20326/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.20326.high.dpi1.pipe --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\debug.log" --js-flags=--expose-gc --lang=en-US --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3032 --field-trial-handle=2096,i,12996612383413008642,17411132928907511407,131072 --disable-features=TSFImeSupport /prefetch:17⤵PID:5912
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.203\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.203\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=3232 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.20326/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.20326.high.dpi1.pipe --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\debug.log" --js-flags=--expose-gc --lang=en-US --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3292 --field-trial-handle=2096,i,12996612383413008642,17411132928907511407,131072 --disable-features=TSFImeSupport /prefetch:17⤵PID:2168
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.203\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.203\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=3232 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.20326/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.20326.high.dpi1.pipe --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\debug.log" --js-flags=--expose-gc --lang=en-US --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3324 --field-trial-handle=2096,i,12996612383413008642,17411132928907511407,131072 --disable-features=TSFImeSupport /prefetch:17⤵PID:2024
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.203\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.203\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=3232 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.20326/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.20326.high.dpi1.pipe --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\debug.log" --js-flags=--expose-gc --lang=en-US --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3376 --field-trial-handle=2096,i,12996612383413008642,17411132928907511407,131072 --disable-features=TSFImeSupport /prefetch:17⤵PID:5520
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.203\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.203\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=3232 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.20326/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.20326.high.dpi1.pipe --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\debug.log" --js-flags=--expose-gc --lang=en-US --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3372 --field-trial-handle=2096,i,12996612383413008642,17411132928907511407,131072 --disable-features=TSFImeSupport /prefetch:17⤵PID:6156
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.203\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.203\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=3232 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.20326/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.20326.high.dpi1.pipe --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\debug.log" --js-flags=--expose-gc --lang=en-US --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3908 --field-trial-handle=2096,i,12996612383413008642,17411132928907511407,131072 --disable-features=TSFImeSupport /prefetch:17⤵PID:6728
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.203\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1220~1.203\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjIuMC4yMDMyNlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=3232 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.20326/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.20326.high.dpi1.pipe --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\debug.log" --js-flags=--expose-gc --lang=en-US --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4132 --field-trial-handle=2096,i,12996612383413008642,17411132928907511407,131072 --disable-features=TSFImeSupport /prefetch:17⤵PID:6740
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpscenter.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpscenter.exe" Run -Entry=EntryPoint C:\Users\Admin\AppData\Roaming\Kingsoft\wps\addons\pool\win-i386/kdocreminder_1.1.2021.220/kdocreminder.dll6⤵PID:6260
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpp.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpp.exe" /wpp /from_prome /prome-pipe-token=kprometheus.3804.736.124736⤵PID:6324
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpscenter.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpscenter.exe" Run -Entry=EntryPoint C:\Users\Admin\AppData\Roaming\Kingsoft\wps\addons\pool\win-i386/kdocreminder_1.1.2021.220/kdocreminder.dll7⤵PID:5672
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=564,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:83⤵PID:5896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7028,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:83⤵PID:4508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6232,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:83⤵PID:1692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5720,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:83⤵PID:5900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5380,i,6671552937218335871,17621246728838299325,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:83⤵PID:6392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start2⤵PID:5104
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start3⤵PID:5344
-
-
-
C:\Users\Admin\Downloads\wps_download\2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe"C:\Users\Admin\Downloads\wps_download\2bbf0d71eec412cc1ab1d5f9969c87d3-15_setup_XA_mui_Free.exe.500.2083.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E57C69C -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e57c38e\2⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:4188 -
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -setlng en_US3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5432
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -getonlineparam 00500.00002083 -forceperusermode3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3688
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -getabtest -forceperusermode3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5236
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -setservers3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1904
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -register3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4560 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\kmso2pdfplugins.dll"4⤵
- System Location Discovery: System Language Discovery
PID:5644
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\kmso2pdfplugins64.dll"4⤵
- System Location Discovery: System Language Discovery
PID:2172 -
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\kmso2pdfplugins64.dll"5⤵PID:3676
-
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -assoword3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2816
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -assoexcel3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2284
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -assopowerpnt3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4104
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -compatiblemso -source=13⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6084
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -checkcompatiblemso3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3948
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -saveas_mso3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4704
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -distsrc 00500.000020833⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3984
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -sendinstalldyn 53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3240
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4316 -
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk" 53864⤵
- Executes dropped EXE
PID:4396
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -externaltask create -forceperusermode3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4392 -
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wps.exe" Run "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\addons\ktaskschdtool\ktaskschdtool.dll" /task=wpsexternal /createtask4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3052 -
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wps.exe" CheckService5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5272
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wps.exe" Run -User=Admin -Entry=EntryPoint "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.20326/office6/addons/ktaskschdtool/ktaskschdtool.dll" /user=Admin /task=wpsexternal /cleantask /pid=3052 /prv5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3516
-
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -createsubmodulelink startmenu prometheus3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5748
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -createsubmodulelink startmenu pdf3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2832
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -createsubmodulelink desktop pdf3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1124
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -createsubmodulelink desktop prometheus3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2664
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -createCustomDestList3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1788
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\kwpsmenushellext64.dll"3⤵
- System Location Discovery: System Language Discovery
PID:4316 -
C:\Windows\system32\regsvr32.exe/s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\kwpsmenushellext64.dll"4⤵
- Modifies system executable filetype association
PID:3972
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -setup_assopdf -source=13⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3456 -
C:\Windows\SysWOW64\openwith.exe"C:\Windows\SysWOW64\openwith.exe"4⤵
- System Location Discovery: System Language Discovery
PID:3516
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpsupdate.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpsupdate.exe" /from:setup3⤵PID:4220
-
C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe"C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" CheckService4⤵PID:2056
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpsupdate.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\wpsupdate.exe" -createtask3⤵PID:3084
-
C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe"C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" CheckService4⤵PID:1672
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -createexternstartmenu "WPS Office"3⤵PID:624
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -rebuildicon3⤵PID:5688
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -reportAssoInfo -forceperusermode3⤵PID:5628
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵PID:3524
-
C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe"C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" LocalService1⤵PID:6380
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\ksomisc.exe" -regpdfwspv2⤵PID:6436
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\wps\addons\pool\win-i386\pdfwspv_1.0.2024.81\pdfwspv.dll"3⤵PID:6748
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵PID:6488
-
C:\Program Files\WindowsApps\MicrosoftCorporationII.WinAppRuntime.Singleton_5001.373.1736.0_x64__8wekyb3d8bbwe\PushNotificationsLongRunningTask.exe"C:\Program Files\WindowsApps\MicrosoftCorporationII.WinAppRuntime.Singleton_5001.373.1736.0_x64__8wekyb3d8bbwe\PushNotificationsLongRunningTask.exe" -Embedding1⤵PID:8092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7552 -ip 75521⤵PID:8180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 7552 -ip 75521⤵PID:4508
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
3Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134B
MD5049c307f30407da557545d34db8ced16
SHA1f10b86ebfe8d30d0dc36210939ca7fa7a819d494
SHA256c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54
SHA51214f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780
-
Filesize
4KB
MD5d056cec3b05d6a863ddfa7ee4c1c9f0c
SHA1dcd15b46dea9d234f13d7f04c739a2c516c973f1
SHA256ff702ca753a7e3b75f9d9850cc9343e28e8d60f8005a2c955c8ac2105532b2c9
SHA512751274949b04c7cdc5e8f5f20fd062bfe130f1415eee524d9d83bcf1a448fbfb4b82dff8bbf7495250a852779c3d11ac87e33275508a4064f9d52417f4ca230f
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
-
Filesize
1.1MB
MD5f31bf7d0dbfac9b5f0b772456ff06ecc
SHA17f3ebcd4c69a1a9832450e9338021d41465a117f
SHA2566be2d9a21d92aa94e7c8505f72cbeaffd08e8e118bb20ca47bcded4366525ac8
SHA51231ba5097eb3664c79e7ab982e54a9014b3fa79fe13eee5503fcbc99c007e7b505b22b1db67818c7b9fc7cbe356e4b477c1e1856c30ea546d21d41fcf0ded9cb7
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\addons\ksearchpanel\mui\pt_BR\ksearchpanel.qm
Filesize334B
MD52b42be10ddde43a0b6c2e461beae293a
SHA153888c4798bc04fdfc5a266587b8dc1c4e0103f3
SHA256984ebeef80f6f50907afb92e5b5ae72df49fce045552c118a77a8887cc98e19b
SHA512be3ebd02d37de367200696351fb5f9cd0ec4c206c3a33f281cb8b62386457a30a899322798c63a0d495577393e47258994feb7f8e2445645f552c2b7a2de6778
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\addons\kstartpage\mui\default\html\run.ini
Filesize171B
MD5b30cb271e143eace0f55ea2e562e1e9f
SHA19d97dbf24931cfc114384c3f4dbbae21c9e51be5
SHA2563ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
SHA512dc593185fa63b458024c3a913c558e5686806154181dea67eec786ada50595c53bab822833ad1e76c9acdf21be3eba50631391b7e575d7f1f6409ceccf966535
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\addons\qing\mui\default_xa\res\clouddiskhomepage\static\js\default\history.js
Filesize198KB
MD5d79cca3c379636510ddd6adc09a31d51
SHA16470c9569dcbd7b2ef0c75549799ef3c93fbf523
SHA256632f2d1136280eaed004b7231ae90ed76bbd06c25f73d900873abc1c6ae71769
SHA5121f066715066c6125e7556455f67eccdafcfb0a15642c25425c865c6def6ea3dae819018fa8d2abdcf9eca53de94c49f1310bd1c7883247f84a6043df03e1f80d
-
Filesize
434B
MD56c24204c36a331b30eccb1005e21a045
SHA156bb9642a5cf586f9e4152daaaa1275be587015b
SHA256537cbec4f9ad460713cbe55caaf847ca5c010f84fc43628ddd7bf57a4902a07c
SHA512664a361febf744963099950cab56f7f7a61308203787c99c924a388aaec64aabd8f6a7c405a2c9c964ad3ac83aa21a531ed351b6fa5d51f1aa72022a6ba1c80a
-
Filesize
23.3MB
MD5f815cbd1bb53158d5c0efb8b93f775c1
SHA1e699c86d2e742f2178e76f6470f70bc45571b589
SHA256741585755d3898635ad5cdf6daef8d035cc4ac8ab7096393a0a81c9bd5603900
SHA51200ebd5ac585581d5dd4dd04d4a3d27237cd7f10c82d83e22e4efd725fcc6bbc2a622dd97cd3b2574c80712d5126ce4c47be76a85223ac5dfc1bc25e84be66244
-
Filesize
10.3MB
MD5cdd0406872cb3437df2e37b612d683d6
SHA16baf1b48709cea3dd247565a2a48a56d48112132
SHA256adc5066cc2743caf68231cd96d728c339cde74cf173dd3ea3c9817880f49892b
SHA512770a50c56e7d514c392730e7166bc875cc1e0dfe3e570888b3bbe4708f4af7f1dbe651128cc590aef2eb52cf3abbebe6be54ec39a4db5f874a27a147ee541af1
-
Filesize
3.2MB
MD53e847ef339f4e4fe66c7fc4d1ab17616
SHA197d9e7e2ae261d97693ef3f823cb5be4d871c58a
SHA256b18dcd36be3a14602e002887d0ffa4f71bb2205edaa4d6309edd955cb789a008
SHA5129ced85cc661fdfe611a8b261760a44697c4cad46e7622fd6e8ebbd1ee74c28c76366adf8eca4a2800398044bbd285686c9049b0a90cf82fc722b25fc2c9fe21c
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\mui\ja_JP\resource\splash\hdpi\2x\ent_background_2019_wpsoffice.png
Filesize236KB
MD5c5ad1903526a9ca4c2f55cfea1e22778
SHA19c7b9ba9100a919cad272fb85ff95c4cde45de9f
SHA2565e7ba996d2331f37b9799767c0fa806cab9a39fea434796ab08dcaf39096e334
SHA512e482142e81fbe71666b40f7a2c53702b4278436a0240e0f56200443cf4235d9942cccc3545cc01486d53a0972be553cbf93442e8b05de7b4fcd1fe8a4ec16bb4
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.20326\office6\qt\plugins\platforms\qdirect2d.dll
Filesize1.4MB
MD58b5a5abb3b262e789c4f8f7d9d25ff8c
SHA196b498e8fd235bc36e8e232376c51449b462a060
SHA256cb0c8a75f596b18d33387d0290de6fc67a48e3688ab66cb159d2490884b1a8bd
SHA5129c70928ea6e743025f0b4fef9dd63589f29d49bd30bb2099bf065f07bdf98b62ad1af64ca461180b2b726388a4b8f03c0a916364f2a2791f23b3084a8f8247bb
-
Filesize
914KB
MD502f351fb717db99f937a3ea2f8bdc832
SHA1a38ade8f14b993c67c219a18b83efbc269bbcdd4
SHA256485dc6b53f144e4aa63eba4470a8c1fcd3e1ca93bf22bec9a35b4e66a8f3c6f4
SHA5127726607d040919b5a932fd0757c261d614952a0cde7b8f83206a0a58b5b922ff8402bd9d549a67836e5a87e7198ee5928c056cf184d409cf0b34f78702a57ad1
-
Filesize
499B
MD5183330feb3b9701fec096dcbfd8e67e4
SHA12f43379fefa868319a2baae7998cc62dc2fc201d
SHA256ac4f26a184114522200169c5f57a0af4498a20d19b7ec6def14dd2c6413eb475
SHA512643cc197456f15da6ddd6eb904f2b25ad4236a24310d575958c0c8e457a33167e748d21184162502a295fa466c031a837511d4d5348fd67499ede1b60065c471
-
Filesize
666B
MD5dffe861dcbe80b13b64e68d417c6f23d
SHA113ec8b10243c3dd1e07e7a2b52b846123dc9ff34
SHA2564964daaee8c1d529338df042742966400cba2711976db5d0744f9bcc5c3cc5f0
SHA512e9668333204f1eb21620ce2ec374a8e525bb08f679de98d57b226035a19fb57511ca1083a5610f72c5c174f4262372ce566b11fc8e12870d38dd736567e34a32
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json
Filesize3KB
MD5f9fd82b572ef4ce41a3d1075acc52d22
SHA1fdded5eef95391be440cc15f84ded0480c0141e3
SHA2565f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6
SHA51217084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339
-
Filesize
280B
MD560d40d2b37759323c10800b75df359b8
SHA1f5890e7d8fc1976fe036fea293832d2e9968c05c
SHA256c3a2f26d5aef8b5ed1d23b59ed6fce952b48194bed69e108a48f78aec72126e0
SHA5120c339563594cc9f930a64903281589886308d4412ee267e976520a58d86b2c339d7b2320e1b3fd6fbf81f092ff1735f0710c669af2986ea5b63d2c1e0a6df902
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD5c7adc559bc1a8acb6b37b47133a4a0f3
SHA188db31d3fc2d0e9dfbb17028c892d3e0873bb268
SHA256d7b12721d6435ddc1cf3c015105fcf780395938195e897103983d4c196a3f565
SHA512a91923b6d35c0fc0c46c1ebef17fb4d624469c0caaddacf04965ec1dcbd648fa95c4ddaf5dd35a587d1c47d24e6616c002d2ea00663c95e6ff828f796902153a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57bd55.TMP
Filesize3KB
MD53ba807272c096e5710fcdd4dd0fc741b
SHA1ae6ede519d83757491965f04475cd7c5bfda29fb
SHA2563301bfd655cec798a5e809f7c76bd514a507970348c6f3727da35b0b9aecb30d
SHA51213165c16838da7961da32bfbc02345a992ba358680520bfb2e81e9886f800c7153e0606d7623258ba757ac3aee8c0512e3baedf9b283f46a3fca7d386e02bd6a
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
107KB
MD540e2018187b61af5be8caf035fb72882
SHA172a0b7bcb454b6b727bf90da35879b3e9a70621e
SHA256b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5
SHA512a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.wps.com_0.indexeddb.leveldb\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
4KB
MD5c0665030a6b8b79be6cb1bd94f7052b9
SHA1349fdd11547d6a1ed0779e699310ee38a512a0a1
SHA2565f9db46819d6edd1a12a206fc656b2dd27d0c7fcbc2a84535cf28dd9faa24647
SHA512f05b551c90f66ea7d1851d03f32eb2e7a8d58b6357ffa455bb1c4ead2048ea8f227b26c405fe53594f2308e123de46ce1bd8933121930990cc166869e6cb4343
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
16KB
MD521d661d66cfe9f99726833be6e974fe1
SHA16818e77e001ccebc2d88d1cc0e3ecba4a1ddd7ff
SHA2564a757e298abd46e532e4bdc575a2b465066dd27eb9124d7d243b9b738f47fab6
SHA51258921a6792be30291f8e09fb810ac013c0a82f9ab05bf520af691d7374d970b94bd603b3e1170b7f14389941939c25775b17db9c59a3b245ecbf8c29d03305f2
-
Filesize
36KB
MD5f5d2bbaef6a934eb4b050cbcdd5ff749
SHA1acba98ae51061d009920fe9d1d2983c22897fb88
SHA25644a88a7eefd8dde805a1b71b8b52c816b7098fce306801989511f8e5016d0b48
SHA51273bbdabe1c51c061bd99022bc5c9686f56b0f8ea4dbf253889f842b7dad3cca5a2c8f5a29a7a6fdf1866f048f574e8d52175c1442c872e828b0c6d756ff87ab4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b98637bb7ae2171a737905d5907291f63b4218a2\4992a78c-b321-455f-bac3-997951203cbe\index-dir\the-real-index
Filesize96B
MD59922a8f30b4af90aed5196dc227bbeed
SHA19b86de647e4116fcfbcf3221938cc5ea6803aedd
SHA2561d523642d3aa3615b00d2d1a27728b76d0eaf041753bcb20e030a24165f9e052
SHA5125a0772e27b30f44f337e51168f6ec3e00be9c710e59ca3c26a933089b72c8cc20f7939aec6aef346bd1d6cdff8a115c07a72b3bb9558f3fa850f292c7738b964
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b98637bb7ae2171a737905d5907291f63b4218a2\4992a78c-b321-455f-bac3-997951203cbe\index-dir\the-real-index~RFe57a98e.TMP
Filesize48B
MD5fca0a26d07971a904907e0f909e6e255
SHA179761d9a10760d23923559a9323eb5053eaeab90
SHA256d3de3bf49e994a09d2dde0604f7f30c67a7d64f90b8c9eb42114c10750a855c1
SHA512c02ba8d8c7d3896edefa31efd352af262315ca5e10fae96a8b5b10729290d6cb3e1170dd9dd68658ac5cb9874e29e9606fd0364dd769197bc60b5a02da47361a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b98637bb7ae2171a737905d5907291f63b4218a2\index.txt
Filesize104B
MD5a1be9e52e9e086cda4e1e259727f6e5b
SHA103126d2c8079ef9211c6d88cb51d21cbc2055fc7
SHA256e2b8d00d332314af8bb53125220691fe634a1f7e88a4623af09de6a9d46df6e5
SHA5129189b14dd745ce0f05955c42d20b739304480739a0ea0d9abc35d717d6a0a51091e55c1f1ca6354e942817af6ef29680f60b6447c9580ed55f49fba9c53da16d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b98637bb7ae2171a737905d5907291f63b4218a2\index.txt~RFe57a9bd.TMP
Filesize110B
MD5172a282a941350d16455ff0241ca0090
SHA1896c8e3f925f6dd78903c8ac32ab73f44c5ce603
SHA256064973fc210430f1a8e00c4b16949feea393b3bb83a59b6db1cea33e52e877e7
SHA51212c1c1d9b63cf8dfe5186bfad605f36acdfdfd7c07451b81579a175e3d13af06c24d43d29b5b760b97f57b4d027e4fcf95951ad58d4bcd00ff646016d43292ea
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD5b61218c46bf1635b7c9605c6cdb3ce2d
SHA15cf5487f5a59b2cb83514ff817c94dd8dffcf986
SHA256676355b92cf592ce99597ada9119f309a0cb96a93afa55afce3adce9b9439a72
SHA51293941796a80e5836bb5fdbe2c87109c10f8ef1d1453ab2eeacdc32886d5c3465f87400b4ecbc3a451688f0e33f22cb93c4ddbaa3559860e86a6516c477eb38f2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a940.TMP
Filesize48B
MD59450ec7a8f518d614a4ae25260631227
SHA11eb80832fd27e5d374b6a48db62a4b28c67b1e83
SHA256e630c8047b687692fa0113645c4cf5c5d95bea155dbbbcaa070b8a0b1696d03f
SHA512d6baded1bacdb40f756ea13b8e7c6b77ce5721e98b7d43fc33f95e19e2dd8ae8b0e729b83dba25cefa85e9eaabe05d382bac3436530586e156b1e63260ec4295
-
Filesize
22KB
MD572a3621c8c057bb8ab4844965e1373e1
SHA1e34714c6fdf059af1feef35579a5f8262a338d36
SHA2568289758dda1397489ee7101de133dfa5dbdf32ff61ae44ca2af8ebfaf5e27be3
SHA512ebf94a2161a6e7a4bece2245699b860771681d9ca63c5b4bf964d48c16edbedf1cef3a84a34ae8b348bec7e46251696bc658317f441a77cb9799a9307b6019c1
-
Filesize
904B
MD56695e9afd9a36486d254cf24c7dad174
SHA18b2a1c3657f55eaf3307754d45e7cb82bbcf66e1
SHA256a3be589074e72457d9aef00a6404efb923ae5c24f5fc38f0ab6b8ea130dd38a9
SHA512ee9c09b710184090f8bb92abf6f20ee86ecb672e1706934933572e362e04bd0cb4ff7b4c13ece94623306a5531ad175ff55bf68b5cdc4cb8807371c517c05b09
-
Filesize
469B
MD506c4d93e6c9d128df6cc7d857f2e5c8f
SHA15826ef7fa1e2be67bdc6ebf4ee78988cc4a11809
SHA2564a1484fe294fc0b2ef0797ad81558c844609321d99e81e7d4e849ce9a0d23096
SHA512f97d1bdd6e670713533886bc03d2526490631bb180a2f15d0f39e3f8872730114efff373fccd63dee5310094b54e127fc9707f1f8ed2c4777569ee4e1e9cd97e
-
Filesize
23KB
MD5d7c03e598e596108a277a3755f360db5
SHA1100b0a9b3633ab5639a0bddc89a21cff680fb8fc
SHA256ca300201eecee23d9ecebbf198a9e7c2711c505364b2af09e95a770839ab1f2e
SHA512e024e870bedb643e4526a5ba7dc9ad70c2e9b8bd254152be089a1ac3aa5ad261df66eaa4ecc1fad1250e60b17a341374e064e1d7d1b70d4cf62bbeee31c6de0e
-
Filesize
19KB
MD541c1930548d8b99ff1dbb64ba7fecb3d
SHA1d8acfeaf7c74e2b289be37687f886f50c01d4f2f
SHA25616cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502
SHA512a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75
-
Filesize
40KB
MD5acf56ccf44053f70d154b4b7290e3152
SHA18545f9bca695a8cce48e33541ae8a66b7cac819f
SHA256d76f126f13392a0741bc1a793323ac3a3cb88d08d66683267f005c1d04fca692
SHA512e5f20b91bbaa6804275e3360000c1e414d25ed60653b7ccbca11ed5c25655c835c14bdcb947c252bf5d60603a7030d8f08ccf7cb08362242b3b60d247fa10065
-
Filesize
40KB
MD5ae7221d4efdeccad8b0e858d20948bf8
SHA103dce7df63e3ad7092b3b997e86865b3e9ba8088
SHA256e9fbd20116091f6688a87b46306f4e4c95072f746fc134157e1b1b368dc1d078
SHA512329add4ed1d1876dc2de98c7685db287abc227655e2c8d3a645c24a873d93e88254e944792a2ba3a7c25723b0d7079d5ac07377240fe3c71835dfc02c623fcdd
-
Filesize
54KB
MD51a0615c252b022fdc2af23066df73044
SHA14c12f321d97f35ca4bf652c3bfaeaa543c194ab3
SHA256e59020600ec6af60b298b0b325b33bd3a21f5d9d1586ba95e8d591b3bf86d5fd
SHA512527b51c15f503f1432767699b1ed3e6663c7ce88a19e4e7923c31e08103348b6b0d6ecbd0c8afaae7b9942dedd009cac227f9f77b3e9c51bdab2c4f72187a234
-
Filesize
49KB
MD5c2b50b366b69af12a8532720263d2431
SHA1a120b2850eaffe53895047b70fced27feb93d43a
SHA256fcf9655d1c3f115632f35eec43038808045067d87f70cce4ec4a0332dc8daf5b
SHA5124037e876b28c0b3b1771b5ec4f9fad00cb2cbbc1a2543f2433ebabcc71b6e152849ad4ead574d9a316b898d7ca432d723741a8436421d1cb01590049b1766020
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72
Filesize152KB
MD5dd9bf8448d3ddcfd067967f01e8bf6d7
SHA1d7829475b2bd6a3baa8fabfaf39af57c6439b35e
SHA256fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72
SHA51265347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de
-
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Filesize2KB
MD5245eabe664aed5f862f469f7ad2ba2ee
SHA19e7bb8da28efa2bd7b05c91e21e7f0d9ba76784b
SHA2567a0c1071b7588e73a12ca49183096c4f5c5ccfd049ba71b7aec0612993ce6790
SHA51296ae358866ecdda45a385ded9f4edf548cddd36b2ec2fb00a89c25abb8d6da0217791028406b7cf322e3450974f20f284b5f95ae3e315ac67f94837db8bd64b1
-
Filesize
2KB
MD5779b51c6ed5557a9b9122e6594bf4cb3
SHA1e19ddc8075a48c69c2c27fe2854dd8b756e2b996
SHA256ba594ae3521ffedeb17e92d5b0b473a59d871b2866d1c2c876761d418fc5a2ff
SHA512c4932688fed0b561d9c80453c480a356facdda3ab0a1ad417a6cae85d98d621fa20fd40260c54aeaede4a4b236f56e4343f1fd83be12806452eaaf1f500fe6ae
-
Filesize
772B
MD57bc8fed14870159b4770d2b43b95776b
SHA14393c3a14661f655849f4de93b40e28d72b39830
SHA256aa12205b108750cf9fa0978461a6d8881e4e80da20a846d824da4069d9c91847
SHA5127e943b672700edd55bfd2627f4f02eb62eee283e29f777f6660fbdbf04f900757272c5fb8a0c8744c197a53eadacd943598b131fa2d9594d39e20baa2a9b79f1
-
Filesize
1KB
MD583e0e58d0752ff7c3f888e6406413b84
SHA114a8981e4355301bb3073db6d7ffb337ef8482e3
SHA25664e01bc292ba2ea1699576fcc445367047520ee895e290ccee20c24c9336d8ef
SHA512fc772bd3d6ac64110562aaca7d320f49ffba4e1f9ac2e10456fcb75e172d086d3ce8996cfc64b33b2ecdf4f6b96e38905e671c1e6ba5205fede9af4a183812c4
-
Filesize
2KB
MD5c825621044e4d5c504404dae9752285c
SHA168c1e29daf042487cb76629abcdc03f16fccc92a
SHA25647652115cbb912907f405992fcfc64f987642158f0cb35c9d6e0d4742d833802
SHA5124aef3e7a747e290be8ba10e22e670c1c2dc653d4311020a4fd3060205fd88bb5d13d9edf388fc18919abe353c62d6841a4ef87e38064430299e52ca16c81941e
-
Filesize
1KB
MD5c603747b8578c1324dd262565f643e06
SHA15cd18bb971af007d9a589377a662688daafe7519
SHA256614470da3c5034ace649f1786beaaad2c94f4475bcc8858390b721f06fb7bf64
SHA51259a5b29459e6a10628ab95ed620ab159dacde2d98dc2c3dc7949d0e5e253f2be7a21cb13f0ee8ae0e2f85191a520c9daf797fd93b27c39f53b1faa8aef1b706a
-
Filesize
3KB
MD5361b516edf253851044dae6bad6d9d6f
SHA1d64c297cf1977cd8ad5c57d9b0a985a4de4fd54b
SHA25622bc37b47ce8a832f39701641dc358357676e9be187a93a4c5d4b016e29238ae
SHA512b2614c53e93e705a93b82db9fcf5259ca44b10b5e5237967a34f68607ab2380ea0c8e5df4ffd941d914617fa3538fd40c18df7d3c9808c5f652852f01e214c77
-
Filesize
2KB
MD5b1101fac65ce2faa3702e70fd88957d2
SHA106ebd889fad9ee2d5d5083b10abf7b2a4d0e1724
SHA2563e3ceaa214d8079b02c9c941635f5d45e621236d9c3f82e06ac604f0772670e8
SHA512398d03bd3b51e2789d0573f5e4792c13193c36539e8fa35261bc3b9a991a155635e6d44a9999b42d3dfa264e3fc329e11dd65d6e1408c4076a49576e7e5ef4ff
-
Filesize
843B
MD5fbb841a2982166239d68907361f41f61
SHA14a8d76a6fe1bb111fdbdfd42d1af0019a97fc540
SHA256de6d7b7c2427ec4e738407d7834b71941f69166b030355e00f325ff1391df5a1
SHA5128db540b4c9e250d3781797238b1d16ad820c568edc563bfb912872ab99950def7e89ee432c696ba9876e3d7b24a4e4c26fa5b0fa9e76a54e11ae63996e02a561
-
Filesize
953B
MD548663a88dcf0ef6c9fade9bee4935b91
SHA1af7cad1498bb4b0f05c1468abe3563d0182a97b4
SHA2565a701d67910ba6c7ccedc26e02fa707cc86a1be57cd7d36290a3d268732a42c7
SHA5123c3e5b9e56535efe1e20d6024b6fa46d3ea969c971d5ec8f5af1c933c1feb75d25e7f26c9e2bb8d200bca70ea1f1bd7e93e4e1c09dbc447340cdbeefa91cc33f
-
Filesize
764B
MD50e451c9c8453577e513aabf630c275f2
SHA15912cc58aa82bc75691540c8aeaca7c68641539e
SHA25694cddb998c2c5ab40b6f074c359a60e6eebaaa2d52a9649c22f4ea4c1b9936f2
SHA512a89dcc1ec8c79e7cf702692e20ebc952907b2fb1d76a3beef60d7415baee24e055e2988b55e12ce00bc112c115ddd9d46d63bf0a1c511fffb041da7054391f80
-
Filesize
927B
MD55daf77ae7d2b7dbef44c5cf7e19805ee
SHA148c06099aee249dd05b268749836e3021e27cfb5
SHA25622e2828bfdbb9c340e7806894ae0442bd6c8934f85fbb964295edad79fd27528
SHA512b9fe759ba6a447ebf560e3ac6c79359e0ad25afca1c97da90f729dcd7af131f43c1f4bfcb2cd4fe379fff2108322cf0849a32995b50188b52258bfff9e5ca34d
-
Filesize
3KB
MD532886978ef4b5231f921eb54e683eb10
SHA19e2626e158cbd26a2a24a50e4e8cfd98a49984e9
SHA256728d8cbd71263680a4e41399db65b3f2b8175d50ca630afd30643ced9ffe831f
SHA512416832f007470bf4d9d915410b62bd8159029d5ddabed23d2bbc297e4bbae46f4346feb68c54163428a6932c537967ae9ef430b9fac111f15cfb001a480799b3
-
Filesize
708B
MD5c4e77421f3361277f7e3aa3472b5eb10
SHA1f8ddd7cd0cce742e68443d173196471e8a23bd83
SHA256c7255e9b784c4b8df7df7b78f33a5737a9ab7382f73465351597b1da9b3d5fe7
SHA5126c11cccbfa6e841d90fa5b41f46de5489359335dd59ccb06d5148e7d2ce3af1422b93eb574360be4695e69d851befed8a2588dd411a7b0a553cb621238d474d4
-
Filesize
1KB
MD564eaeb92cb15bf128429c2354ef22977
SHA145ec549acaa1fda7c664d3906835ced6295ee752
SHA2564f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c
SHA512f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def
-
Filesize
878B
MD559cb3a9999dfbd19c3e3098f3b067634
SHA1bcfdf1c9c7f5d0ce35d7918060ce704a99803bf4
SHA25602168993a23e074e0800cbb338fe279f99ef420e326bf92916ffed83c1f06533
SHA5129968acb9821bfff6f427aabfcde3023f5a6f588bbfc0efd2275f201930ec5e16d64ff228c76f77958d36091a3dbd510e95385f0cb99a3e4dde693f34e9e3ebf5
-
Filesize
880B
MD594bc2d5609f6d670e181e1ff0d041869
SHA158d2c17878e7b6e73daa544b8ca7774e5d902a17
SHA256e848603b7a73a88e3fe7bffa20e83397f5d1e93e77babb31473cc99e654a27b7
SHA51204bf79f675888c79b270c82e3a0e7a07e24205e2159e2d98eb4585aee5c0d14c6be3a3d169d4ea702a74a76f9e622e70a181dcd9ae0cb9f2472550fb33e9565e
-
Filesize
914B
MD5b18007bfc2b55d2f5839a8912110b98d
SHA1842ecac418424b2fff4db81e4385d59e098b65de
SHA2567ccc7b17bfe01c3c7dd33eff8f80d0b57fc9b175815e766c9c1c1e893725e20f
SHA512166937891553597d585d17fda2e7ff2bffbd3731841ea6cdcb7add528a55aa7c257fc191d029dd1f57afd4349194c0cc7413c3752641e8217d465674b62b8ae0
-
Filesize
2KB
MD5e578e08ee604158d674982ba060396fd
SHA1fd601092203317fe9f576fbfd675e274001efa80
SHA256e758273c25fbad804fe884584e2797caefbbd1c2877dfd6f87ab1340cd25252e
SHA512131c75cdbc4a40068cf97d7becad08f49e77a9bda3fb1cc50501b0007273ee5c6eae2f84047d97f72b6fd9f28f65ae544eb807057a54a6e009b9bd8fb8ca4df1
-
Filesize
840B
MD51d4778e02337674d7d0664b5e7dfcbbe
SHA1fe1763ac0a903a47446a5896a2d12cce5d343522
SHA256a822b0e66d04644d1cfbd2517736728438743162c3213f15d986e2db85bd0213
SHA512771c7ba7f93a6e9db94593897d495e190e58a9b9c490523cc410059e72538005e2de96864dbbed8bd1f01eaa4d1cd022443dddbf759a606e2903c9ddecac43fe
-
Filesize
799B
MD5f954b2e970dc96e5889499db7392fd59
SHA139f56f0ebfe92c96e8bf91f82cc4fddbed1e0aaf
SHA25641ce6a7b18364efecced0419b42165d4f86c43643bbe1043014d4142cf86186a
SHA51223610477834ff51e93fe9467df997f9aeee63ce3a8a51464b87b1828dce25d50e0bf2f28df139ec59e6c6425b81613258de211735ab2e470dc63c9cb5a1860e0
-
Filesize
902B
MD585718fe4820c674c5305d33dfb5cbddc
SHA1d4170743349f3e037718fde17bc63a369c2e218a
SHA2566713b69b6c9e80b03e0a9d4a7d158197b0c7ec8a853c64c0af0b1a05ce54d74c
SHA512678e934f8d4a1bf0b98844b796eaa2471a78911d4020bf755871650dd0adad6bf7b475d9e5bf68b6a911ed330308a08698706d9460df003648b612d97848e652
-
Filesize
901B
MD5681422e3fcf8711af8eefbb75a607c8e
SHA13d3576a989c8010a397888429476f2800052e79a
SHA256af889c1deb6f9248961c2f8ba4307a8206d7163616a5b7455d17cead00068317
SHA5122546c274749a75c09e8255b6fa53a080a14bb141c748a55ebd530b6f2ac8adca3111320511628d4eec2b39a8710578ff16929b06ffb1f9c2093d3f1ee4c6f601
-
Filesize
927B
MD5cc31777e68b20f10a394162ee3cee03a
SHA1969f7a9caf86ebaa82484fbf0837010ad3fd34d7
SHA2569890710df0fbf1db41bce41fe2f62424a3bd39d755d29e829744ed3da0c2ce1d
SHA5128215a6e50c6acf8045d97c0d4d422c0caacb7f09d136e73e34dba48903bb4c85a25d6875b56e192993f48a428d3a85ba041e0e61e4277b7d3a70f38d01f68aab
-
Filesize
2KB
MD586de754c2d6b550048c9d914e55b5ff0
SHA15b6654101b3596742be06b18ef2a5d81da569ee5
SHA256cc3e9077fcc9bd0dfc5dd3924c6c48b8345f32cee24fccc508c279f45b2abe61
SHA5123a8d326b91141b18cb569a93bcd295075e94a0488f2ffe5afb80a4cb36e4523e28c87d91a64ed255445470ad6c8a34948fe091e709e8097dcdd06eba1cc52887
-
Filesize
2KB
MD54a9c9f947b479e5d89c38752af3c70ea
SHA1799c5c0ba3e11ad535fa465ab87007c36b466c6a
SHA25614895bf43ce9b76c0ff4f9aef93dbe8bb6ca496894870cf0c007b189e0cef00e
SHA512293d9fd5b207c14d1ffc7945f80d3c2dc2d5450bdf1e7b7962767b8d330c9255da16dfa677234198569f4ddfd00bce82d70086df974afe512769597039e21cf9
-
Filesize
863B
MD5eb6c5133c1fe7f9e8e4449a917d185d9
SHA19be42ac75487a77dfbbf01ea2098886e69956356
SHA256985976b776e729835e047c81d3d731a6c488a6459aa8918dbc8ec808c0bf73a1
SHA5121aba115b30c99e786845c137ecb8beec4b5162c59d10724dcc083ff6b91a47af45ca850fc0b3072d44be189b31abb67423c88369171b0c411ccf7ae884fd831e
-
Filesize
1KB
MD5fb8d08676aa88683f27a2759c5837529
SHA180badd0de6a8d87a8e14232f71fbcbe231eee443
SHA256cf26310b073b0891996ecd761c6cb53f00193dee524213a9fb34225d636ec4b7
SHA5125c4307b653cd841af14a4b57f225938be54d718c979fa4008513461fa6f8409bc82e050f0b32e587f8e52d5580aa7c6d667aa94b30a588cb87de585b015fe176
-
Filesize
718B
MD53fefe403f5f537d9a2d28ab36b2c1a94
SHA1dd674520092f333aff63138f660987fbd8fa51e0
SHA25635872a3343d4b4768fe4702a8dc18b749933e81210db13466ad172bd2880f6eb
SHA51245182775ac13b1f9406bc9595e822f24a9d8b854254e0d71514e1d99625b12b9cd8bc3226f04b1dfc79248f786f925b9b88a70e0d57bdf9a8dc48d79175ec60d
-
Filesize
756B
MD588a9acd41521d1d00b870e2da3044a88
SHA136716937ce047463dbfa5cf1f5ef4277fe354d9e
SHA2563377a873db531113d79919e7a89369a79a602bac6ae09b9864b9378dc285f345
SHA512a56ffa200c5f8b312d8ed77ea40df931b86074adf1577941726d184497531d1c89d77382983f01797604e6a5c34029fa88f3aae0d52c368e2046c0c6f21cd956
-
Filesize
1KB
MD5113a674f2e4c66cc4d2a9c66ed77adea
SHA1f5d38b743efa022d6f886bacd3afa850557e2762
SHA256c1094a1d8457e782f229910b70fc7aece356aa779a423e869104946814660d35
SHA512e7cd847d87dfea3228a1899aab7f27f59d7ba2919e81520501a9236c55fcdea418f1d29c3c9eb36e34cdfba3278e3bbd149ddf324c94295e029031fcd5a75677
-
Filesize
3KB
MD5f55ce2e64a06806b43816ab17d8ee623
SHA127affcf13c15913761d0811b7ae1143e39f9eea4
SHA2565fa00c465c1c5eed4bea860ceb78da9419ea115347ba543ddb0076e5c188feed
SHA512a0e7d0f7beeca175c67a783adf5ff614c8e3b731311f82bc24eb0f0798938d79f15a5cfa012b3cf06d7a138d88e6f78eb3d3d57a3edebb60116de2dc706e2b0f
-
Filesize
1KB
MD5e71a91fe65dd32cac3925ce639441675
SHA191c981f572497a540c0c2c1d5fb28156d7e49416
SHA25657f81a5fcbd1fefd6ec3cdd525a85b707b4eead532c1b3092daafd88ee9268ec
SHA5122b89c97470bae1d55a40f7f1224930480d33c58968f67345ca26e188ff08cf8b2f1e5c5b38ecfdbf7ebfd9970be0327cbfc391cf5e95e7c311868a8a9689dfb6
-
Filesize
1002B
MD58047409dcc27bfcc97b3abce6dab20ef
SHA1d85f7a7a3d16c441560d95ce094428973cbad725
SHA256b42ebfe071ef0ec4b4b6553abf3a2c36b19792c238080a6fbc19d804d1acb61c
SHA5124dffe23b4168a0825dc14ed781c3c0910702e8c2b496a8b86ca72fdbba242f34fe430d6b2a219c4a189907e92b1a7b02ce2b4b9a54088222f5af49878e385aa4
-
Filesize
959B
MD520fa89ba92628f56d36ae5bd0909cb15
SHA152d19152e2d5848ebaf0103d164de028efecdbb7
SHA25680d64f03dc2cc5283faf1354e05d3c3cb8f0cc54b3e76fdae3ad8a09c9d5f267
SHA5125cb534fdba0f66a259d164040265c0e8a9586bb41a32309f30b4aab17e6a99f17baf4dada62a93e34cc83d5ec6449dd28800ee41c2936631484cc95133e3956f
-
Filesize
3KB
MD5ce70315e2aaeda0999da38cc9fe65281
SHA1d47fc92d30ec36dcc102d5957bb47a6c5b1cd121
SHA256907f2709d1d3c8fa26294938f4080bc477e62281c4c50a082c22db0195cda663
SHA512af5c78feaacb689d9d50d0196ba9428e4f02b07876995e8b77e3bc0fee7fbf43f3ad2848d58940f193966c54f13652476e1fcfd6a827465caad32b0b2d3f97e2
-
Filesize
2KB
MD534ce3fa84e699bce78e026d0f0a0c705
SHA15c56d09af53d521fe4224a77aa66e61a3b0165ca
SHA256275e7fadb93a810328e3adead8754dd0a19a062d5d20a872f7471ffab47aa7b3
SHA5123a6cd2ea06b664689f089d35fcfa41b36c22b1d77cf78f66d0f5dcdc52a6bb29f7566d377b81edce6001b71cb7f1e1247d3d71965baa2e8ea9e6deaa208cf25b
-
Filesize
796B
MD5db4d49231c88c11e8d8c3d71a9b7d3d4
SHA14829115ace32c4e769255cf10807f3bdb1766f44
SHA2569b32c491d0bfebdca1455f73c3c6f71796d433a39818c06c353da588de650f81
SHA512c8b4a982abf61eabb1b7280f3e10fdf1350b20f38ca9878f33ddaf979fd617ca8e5ff4df6099c395fbae86c8affbae77653ba9cb736af22466e3cb85d4d92e56
-
Filesize
3KB
MD5065eb4de2319a4094f7c1c381ac753a0
SHA16324108a1ad968cb3aec83316c6f12d51456c464
SHA256160e1cd593c901c7291ea4ecba735191d793ddfd7e9646a0560498627f61da6f
SHA5128b3e970a2beb8b6b193ad6ab9baa0fd8e1147cb5b9e64d76a6d3f104d636481621be52c2d72c588adf444e136a9b1350ac767255d2e680df44e9a1fb75e4c898
-
Filesize
771B
MD5d448e11801349ab5704df8446fe3fa4c
SHA16e299363c264fa84710d6dbeaedc3b41b7fe0e42
SHA256e98c5cfe277a338a938e7277deec132f5ea82a53ebdb65ff10e8a2ff548ac198
SHA51249c2c05207c16f1c9393f9473cc77fd28e1b1f47686ae1eeb757676019a0ad4a6478e5a76004911f4ae299b3b7331cb6dfdca3eed2078baa5da901ea44cc4668
-
Filesize
758B
MD566439ba3ed5ba0c702ef94793e15de83
SHA12b3ca2c2be15207deae55e1d667c9dcdc9241c74
SHA256b3ece279943b28c8d855ec86ac1ce53bdfb6a709240d653508764493a75f7518
SHA5128b393f3be96020181a12a16fafdae9df555b09a7b03cc855009b26a48b0c7d583476a72bb28224e419d300013fe272316c2cb35de8d67dbab454b7cae8df6b94
-
Filesize
978B
MD510ba7fe4cab38642419be8fef9e78178
SHA1fddd00441dccff459f8abca12ba1856b9b1e299b
SHA2566538f562bd1baa828c0ef0adc5f7c96b4a0eb7814e6b9a2b585e4d3b92b0e61d
SHA51207e490d44f8f8a2bdc2d4ad15753ad16e39d17693219418b02820d26558fbe3fce8a8583bae0ed876acc6326080867d05a732cd9a4c24b620753b84bda4ac031
-
Filesize
832B
MD58e24ec937237f48ac98b27f47b688c90
SHA1bf47d23436a890b31799fff14a1d251720eced00
SHA256a6ad5d5fb7c90736e04f898970d2cc9d423415b54b8e572f18c05d6ebaf46f68
SHA512060f9713be6cd4262e0c490e50198a33026b00a80c8a3c7c87f2b05893280e1b32d1df2536054f4544f7a014ecbaf5f2e299b49dd6f45705cabfff068ef50d31
-
Filesize
855B
MD5aa431ec252b4339a49d172c6b9292ba3
SHA126fd7003368d5342620464a53af547ddea7c7328
SHA256156fc7ba9b5728908e1a74950b97474f73d8f58933d345c8eeea8284565c8357
SHA512c47c2e530ee2dd0bcc1ed1c2f8c54aeea3dcfac277bd85026dcc6c07e2da693b35577bac4924c45bb8423ad9aaecba324eec74291ef5cf2586a8b0b9f0084cba
-
Filesize
930B
MD5ee122cf26ebe1ad0cc733b117a89ff3b
SHA1a7c21e40ab7c934b35d725b3e21e4cb8ea85bc1e
SHA2564ecedb9c1f3dd0d0e3aeb86146561b3d7e58656cbdbed1a39b91737b52ec7f2c
SHA5124866fbea6c8698eb3c8923b9875186c800519488784683c18e5e6523681c52429e7ba38a304e0d1b17a3997a2f4c8c3a5e9fb518466a910b119f65d7dd62b77d
-
Filesize
2KB
MD5f70662272a8fc9141a295a54002f644f
SHA123397edad4bcc4a1bb8f43f9c2d1f08a7e3332b0
SHA256df379187b7f6de700e5c53420336e6b31b7dc31015f77b2b256256bcf9be54b7
SHA512b6ca9a8f1a83c71ed8eb8f46a102662d22eb13700660cf5c8841e5fe92dcad11a252555f169ffc4d6a97c399dd514cdeacbbcc27fe39da784bd9c1ebe85f4508
-
Filesize
947B
MD5a46e08b45be0532e461e007e894b94f4
SHA1387b703c55af0cf77874a1b340969ece79c2705e
SHA2565e886e7b616fbff3671dab632d1b6d8dceeff9004218485f1b911dcd8c9694a3
SHA512388992752bd1efaebbd420fd5a8f2c6c775f2be4c61d690b46a418c72abaffe44ff8a4c332b45a8b75a243ae8d61f3d6da6e55fa768d17d2635079b03442a55f
-
Filesize
855B
MD59cdfa5371f28427f129d200338c47494
SHA119653347e92967564bd8df14fde2eea2dc87bceb
SHA25675d018cc8525605ddc591f6bfe5bdaa2efb164934e9d5438972651f8c818d581
SHA512e6122fd5c8d387a999ef57c877bb70c896c1012b592333bcf2b93e44f7e8ba487f264e83cdefbbde972040cf6dc8f14a4a9e0e0bca85cf1f9eaa35b817dd2869
-
Filesize
2KB
MD5c2026342237e7686b1932af5b54f8110
SHA15af235b29947c7f770070f0a693979d9191fadb5
SHA256a3eb276fbd19dce2b00db6937578b214b9e33d67487659fe0bf21a86225ece73
SHA5122ce6fffa4ea16aac65acc8b5c1c9952eae1ac8891589266735c3ef0a0d20e2fa76940e6401d86eef5c87a1d24c1cc9a1caaf1c66819c56505b0b2860bfe5acfe
-
Filesize
800B
MD5f008f729147f028a91e700008130da52
SHA1643fff3dc0694fd28749768314150b30572caa54
SHA2565f4229d18e5606330146ee13bdf726e10c1e06cbb15368c47f1ae68abe9ce4ba
SHA512f5890cc08a9a40366cfffbbdb9b14e8083897a2950deb4bb23566d641dd4b06ab02479a2b83bd5001c179abff889506a3292cd92e31a6b92cad917dff760ab27
-
Filesize
840B
MD584eb1d6e827e40c578469eaab778e368
SHA13f53de16ab05f7e03ae6c8605c2339043c1a385f
SHA2562c6b42d122943dc0ca92a33074d1a607351d3bc7f9768e174617fa7011a3de9f
SHA5127a7ce81fa8be309d347ae0975fd6fcd904bc1ee86342dc0e88e789e7cf5967edd0ddccb9ba156510e74b025a23d479b6058101ffbb648c5d30c311f5ba1dfc6b
-
Filesize
3KB
MD524626ad7b8058866033738380776f59b
SHA1a6abd9ab8ba022ea6619252df8422bf5f73b6a24
SHA2563fc7f56f6d6d514b32547509b39f6380fc786efbcca4b9859f204456ca2e7957
SHA5124fa2f084175d71923ae3186c8195781e1946f6c19b1a4bf659d3ae2dc45f1ac2f84d794b4487ec5e030ea899ee1decf07b3cdd3eb0d3dda996c5ff8a272cf97a
-
Filesize
3KB
MD550ab4deabad394d13c265b8b80d9f9c3
SHA1ce9c786cc92359ca34483bd57ce121f699920ddb
SHA25690868a8a4a4dbf48770c14a161faea406ef9a453b75f4cb7a53c1b4e96a88599
SHA5123ba6498cde1fe4c8f012a75ee546e9793b812cb7306c927054427fc697cb729549196f8e45db1a7a7dd1e485e6a3d3950168e33b03b669f5d4676c372f519a6f
-
Filesize
2KB
MD50875b0bad81161ccf2c16e13ee49af9d
SHA1686663983a022689dedf5ba22c0f169e1a654e64
SHA256d299aa0c4f29c5c8248a1c51afdb7439f4cf7bc28ee02408a598f8aad9f70810
SHA512d569dfda9f0851fb0d5b2b8454704461e0185b573f3839416f3237f2d89c372e58fdce7d871f44f6f3777c7f4177009bb1fd3cdbe2f4f3d62015bd130851e8ae
-
Filesize
1KB
MD53104bcd0d4ad6b47fe36f36c1b5aa333
SHA136ec46c7230487c0d26e185aa82f340d8312a265
SHA256ac2894cea6332450095a7f8fc9b97550da87e4b4b6e6fb95df1a1f49f25e0e35
SHA512873a8e1ec1eb2b482794c51dbfdd5b96cb9e8e2b5a74db3c3b54ae78a396585faec402a054ff332551b5ebcfc4a57bfc5bd92d08f9f73acb433efe9a18d89cd3
-
Filesize
2KB
MD5ae938164f7ac0e7c7f120742de2beb1e
SHA1fc49041249eaef40632f27faa8561582d510d4e3
SHA25608978a1425dec304483bbb7dd0e55a7d850c4561abd41bac1be5d93d70465174
SHA512b3f252885f9d7e4d74a5880b5fa60447511d4e2dce64db8ede5bd1b144f0f09a3c784649c2e1623a034ddd50b6b7ff990a3a6fc58c3ae124646c31f35b0b20fd
-
Filesize
2KB
MD5f6e8fca4fd1a7af320d4d30d6055fa6d
SHA11c4aae49c08a0e4ee3544063c10fe86e7fdab05e
SHA256504549057a6a182a404c36112d2450864a6cb4574cd0e8f435ca556fac52ab0a
SHA512241e8505658e09d5559ec3a91fc6d1a88ba61f1b714d3cfc0e498e13908ba45aed8b63b483ecc5008a5ab07b24e1d123192fbd90b4a2289d52ad7bef4a71c9e7
-
Filesize
1KB
MD51e54afbacca335be3a050920ddfbe863
SHA1fabd5e9d6bda46c9708a0ee26302156ca413a1dc
SHA256f1da95e1d58e933050cd8a4fea12f3d1b9a2759479ffdb74fdc1cfbf89568327
SHA512dfe60c51c043da92dec81fedb250dc60bcd97daba831261de92cdee35c0760610c1d436d04d74b65ef0a22e8cdf5201e3dde176cd9b7d5ccf1cc1ff9c884870c
-
Filesize
1KB
MD5e910d3f03f0349f5c8a6a541107375d5
SHA12f3482194c98ecbd58a42bd29bb853267c49a39a
SHA2563893c066a36fe95f06f3c49091a20290d4e071183755f40af05455660beda2dc
SHA512387ca0727ad0869041296182f17555f55552245d38284a1d5d2652b72959cc94dd345f8a1d6d15f7f5477817df9afa045f2267269d0d66938c7d401b4ca2eb4b
-
Filesize
1KB
MD5b571e4cefd96a2651ffb6621c4d3d1b4
SHA19fce97192139d1ec0885fd62a059fa81e473f9c5
SHA25616b8f7be42b982d5ad9f638e71da38d134394b9bab9255f73cf514abbfaaf146
SHA5126a315031b7c3e7b2cdee7a835aaad7fceb07d2889e4401e3be6b3a8c6492a47a9a065aab85fe2a69a1eca6bfe4a733f8ccfe8c5ec2fef681aadb77c9f5e57eff
-
Filesize
854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
66B
MD5015da6c5ba421643a8b70f607769bdcb
SHA13b0803a9c69a41be2a07d1c85fd0daa77b3e6fb8
SHA256fcbe092bb1f107fdd3fcd5b611994c65db5818f11c76a63fd79a67db09c5cb72
SHA512c57d19088f0b46a483b86246ad2090905308327ae86ec9815588291b0baf0e0af94f3aace885be4b94d0189fd672a4c8e512a188cb0e2bbb6d0dea46805c2f01
-
Filesize
1KB
MD52a738ca67be8dd698c70974c9d4bb21b
SHA145a4086c876d276954ffce187af2ebe3dc667b5f
SHA256b08d566a5705247ddc9abf5e970fc93034970b02cf4cb3d5ccc90e1a1f8c816e
SHA512f72b9190f9f2b1acc52f7fbb920d48797a96e62dfc0659c418edbbc0299dccf1931f6c508b86c940b976016745b9877f88f2ee081d3e3d5dcdcc2cc7e7884492
-
Filesize
5.1MB
MD571b4e7ca85a286039c5ffd8d051d0389
SHA18a95e0099b7e0d06d775e6c9cee15ec203dd35a4
SHA256f164a74d5bbac341f6468002836338a77570830832f16160925bb09b916a4098
SHA512f056aa1969f18f0438516261addf6250e18cb9955cbffc4d98dc63a61c033a9fe388089d15e735d6eadea6024b7ee9f2e1ba3c93ac251995a9bde56b8f18ed90
-
Filesize
5.3MB
MD55aae2422f4e1e26f31afa4235fa0335e
SHA18e3427c16581d50b9185a5cfbf25b04d5deca6e0
SHA25697595c2ec54d3fdfaed460630a3b40212c51c5b8b0621f2716a1e4165c7b5013
SHA512d22fa19def1c537b20a4f246d6a6609767eff482eba11793a1525d750f9ecae2dbee8063b3638739ac628f8f87eedb8535a7203368185c9bbaf376f4cebd4477
-
Filesize
392KB
MD588a46a74d1c54b6e24343952ea84b2e4
SHA12c55e886513fba0ee8c00f4e5696037183406841
SHA256042852572e6481b29bb20aac3f912172bad2df7fb62f9adf18c2bb375397c66b
SHA51244543b127d27a63e7529fd9a70983ffb492e70857ee6acff30cc4f8489d06c7e502778cd729750198a3c12e0aa4273bb1a377132b86059561a81ed3019170f3e
-
Filesize
4.5MB
MD55c8512fc5fa68f0d9250e885e075fb9c
SHA1ede941a739e8d939b88ff4d7c51e8dfbf6dc9ab1
SHA25632d14be19271a5fbd1ad8b9c15ded3a5ea0f83328501dd46bc617a0e0dc53d45
SHA512bbe3f5065056c32732abb9f477f4f15e748d13f402ac9925e42af139d451074480f1d094fe3a5ef2c11de856fcbc49a35624b1d56458fe5ae6615695f3b82554
-
Filesize
217KB
MD538d7ba1486407c7881d4f5f7559f6bc0
SHA1bec1abe46eaa69bfb5c9f45cf3666209f486139f
SHA256de114548ded37cd2ec3f36ca10ca526b6e8ac697256d6de0ccd0386f9056e6e4
SHA51241503f18588bbb584a9378df5b4c69facc2e7392fb39b371320c7887fba4f3ad72f7a1970bd9ba36057a83fca6cc2a91698ff5001523529417de262049d38e3c
-
Filesize
1.2MB
MD556d017aef6a7c74cd136f2390b8ea6d3
SHA146cc837c64abe4e757e66a24ece56e3f975e9ef6
SHA256900da3e0ea1b4f94773689b41d3f00b28b0fad0f6390da3aec3a9f84a3f85920
SHA5127b5573461693c6125df7ff9040afb6f4fa818a68add9073071a3317767216dd9a6cf25704f3189f3923ead36751fa830e9899eb79f9b6cad3be405262bf53f49
-
Filesize
2.9MB
MD5ccfb65811e667bd7cd24330698eee4ff
SHA17bdb45a1cd5517816ef1dc74f118f0b66b2dec21
SHA256693a27dc378fcab57e604b88de86242deb2f8873651b526360b0bae25d085d05
SHA5128167fe60806f324da8564d0187f6b49f35cabedbae83384d2d3730e6045159cc58028fedbf4a2ebf020cf5aeb8249ea648e6e5bb3edf25ed1ddbdb5fa189042b
-
Filesize
427KB
MD5db1e9807b717b91ac6df6262141bd99f
SHA1f55b0a6b2142c210bbfeebf1bac78134acc383b2
SHA2565a6dfa5e1ffb6c1e7fc76bd121c6c91305e10dd75fc2124f79fee291a9dd9e86
SHA512f0621977d20989d21ae14b66c1a7a6c752bfd6d7ccc2c4c4ec1c70ba6756e642fb7f9b1c6a94afadd0f8a05d3c377792e4aa4c1a771d833c40a6f46b90cbe7c3
-
Filesize
61KB
MD5304808600a9acaeee45b9fad21fdd3ec
SHA14280554486ed18c973ce9bd42c465aedb0c1f88f
SHA256682627fbff84bfb713ddb66c1b7a0f0f8ad5b0c9cb70bb6a15196063a074af25
SHA512e6ef540032f389feff24bdef1b8798fe43568809346de5058172e95d7d1e8da5410fe6f3a754181a5990303300a7ef77fe6db3e07e4490c6793ae84afb58ca27
-
Filesize
41KB
MD574e38c4452a33394dc8cbd0feaca28a4
SHA119fbecf437339c2bb9d3ba85347d65719aad7efa
SHA2568164c94194e27865e0321b049eb8d7f1110ef6f75205ba0bf93ba6abc2955391
SHA5120a88b77aec9854285cee96038e18c216f878c04711e5b84e0da23f748dc8c267d99765121f3a7fe16cc865e462958e6e82bf7814cc2f65173a3822b8ad4e5653
-
Filesize
1.3MB
MD546258dfdb49b107d36f98848c76c5458
SHA12411ffa67f2a0071c50d65eae9647a5e85a3d001
SHA2567704cf5e018397af594f7e23becc1f6d7d97a7b864396e8b6eeef7598267f34f
SHA512c8cf3775230d01f54f866baf3b91430af1cf85275499af29b1cc9b200e211831343a6e665dbf6b0fa7172b3dc05d79f049b13001a7bf70da5c8665862a281ee7
-
C:\Users\Admin\AppData\Local\Temp\wps\~e57c38e\CONTROL\office6\qt\plugins\printsupport\windowsprintersupport.dll
Filesize71KB
MD52b14303439bb7fbff1223c7892a2978c
SHA15c95e9b614b8448956ca39d5ec5438f392ed8125
SHA25611a12e72350068331d22c8967412768135fa29a8c70741aaf7f0cee9bf0b649e
SHA51218a2e90ed3ef55f13f33ee7f614aee40a57b9e7a7dc531009f83b4d5de204b3cb8f2693c3afb1d16e29725360be2b5afa70ffa99936e9df6bba0c73ba20ef39a
-
C:\Users\Admin\AppData\Local\Temp\wps\~e57c38e\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
Filesize145KB
MD50f5c8b1c2ddb3ed8269b3af87ce137b1
SHA17275ab3dbff0e61f2e5a0d30d7e71c444632d540
SHA256af6b9c0f7d81d90677b504ee5dd78a8b656d09e566e5264dcb6ea45965ac7aaf
SHA5121d62ce171bd0f57ef2d5a98939a9697a343b3c4806d6eaa4184021ed852aac0758d2ffaaf5d73777fcb95e18f6dc55b42e7c68111f37f06f6352818b7dccf29d
-
Filesize
1.1MB
MD52040cdcd779bbebad36d36035c675d99
SHA1918bc19f55e656f6d6b1e4713604483eb997ea15
SHA2562ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359
SHA51283dc3c7e35f0f83e1224505d04cdbaee12b7ea37a2c3367cb4fccc4fff3e5923cf8a79dd513c33a667d8231b1cc6cfb1e33f957d92e195892060a22f53c7532f
-
Filesize
75KB
MD58fdb26199d64ae926509f5606460f573
SHA17d7d8849e7c77af3042a6f54bdf2bb303d7cd678
SHA256f1fd5f6ec1cfe0cc3b66b5322ac97568bc63b19c1e415b99aad7c69ddbafa33c
SHA512f56bf11d4259dbf5d4d1f9fc2ad60ff609cddb21278999e9fa55fe5d74552e8a01ddc55cfdc9bf4b09b3e3130a1356142a24a7db8ec5ea19344de617dc9fa99f
-
Filesize
3KB
MD5034f37e6536c1430d55f64168b7e9f05
SHA1dd08c0ef0d086dfbe59797990a74dab14fc850e2
SHA256183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
SHA5120e1911c882152a4e1059a3ce1880d7fb2aed1e1e36cbd37055de2e2a1333acb2a0233ba2a4d969ccebbef1e77809aa5e78807aa9239545beae8c548c0f8f35c0
-
Filesize
136KB
MD53765f1b1b58b1b3663e6ede39991db43
SHA11854e9b89074317a23389daa09df9366b17e5c7c
SHA256a2eec34052179a9f891e5ca949c73e83564be2907d0a4ae999d5a7495e3d1e44
SHA5120e6a7841214c703efa52292fc68f66e3b69068d9a6431ae1e55385ab6b0e7d92a6cd2fd4f8ceebd2c1c94e4519296a9ed24ed00534e1282337c813c4918b6a61
-
Filesize
387B
MD5c38481658f9149eba0b9b8fcbcb16708
SHA1f16a40af74c0a04a331f7833251e3958d033d4da
SHA256d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
SHA5128f98d62f88442b8ef94aa10074e35aa8d9494f3c76ce8b143ca0bf7fa0d917f3175212fbcd6e7b0597fd0ec0e1b2827f157135512fb01c88218d36e2f7dd73ce
-
Filesize
433B
MD5a9519168ca6299588edf9bd39c10828a
SHA19f0635e39d50d15af39f5e2c52ad240a428b5636
SHA2569e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
SHA5120607eb1f5598320961fbd8ef75beeb1b6dc1af3cae7eeb5ba352f3e2a2edb25e1d9e68fb46c24e4299957352c0c906314c889c2d1092437eccc1d1a0485f3557
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XQ4O384N9UF5XIR9TDQS.temp
Filesize8KB
MD5877e5f9fbe0c1e6f621b88b933c4634a
SHA1079c844b0d5240988bebcaf19a80b51cd868c5f8
SHA256e0d091fd52d33130a412e2e9fb922b41f31ecb2c7d0a8d5dcebf00d76bb0ec8b
SHA51253eef667cd2c53d611720c2c4f61e9e6934c64725a30513b619e2faa1ecca6b307f3a03ea967a9534a1d77f95bc758adf2696ea0d2108db4fd397b73f82292ca
-
Filesize
85KB
MD571b14486793963437fc8293b271a6b7f
SHA1311639c893091ee6b8a1df4fece848445165a289
SHA256b58a367f5b231eea98b6ef3390c86ee6ce492622236a0512272a487a12490c06
SHA5126bfb931fcc6d05ca59ecc7709c4f3f2168aab0d928bddf06d571e3cfe0b3c0239d56feacf7fde3d907bade7646cbe0af1f417dbb2177aee19a5b80d612623ee1
-
Filesize
108KB
MD5db3301c120f4d9a8dbd17a4741669ee2
SHA1fe3c137f8858581e46c9f483545bd92e513e72ff
SHA2560b91a14dc00354eea6b6503864bb6408c66f75b1163150b403820fd4cc410749
SHA512365680251dac49df2dd2634a8934a786487efbfd1c3b0b9b0b556f5d5e806d66317dc7ca809e996918e3503e7888ad063531558d1eb22a93ca951106f5579f4a
-
Filesize
224B
MD5b5174d070de62cb5bed0af3957ff14e9
SHA1063a50ccf57e318166007ddecdabc2aaf6703e6d
SHA256c4b1b092164cfa1391ef1a9bdbb690190bd5bb6b7776e8834f107e170eda2013
SHA5122be574ed107ff6ba62907953c0c3e95f12919fdc8c47c24d4f7516cfec1f3a10d083eb406dc898231b29d121d89c13071b6b9f37b827751ed35ab0ce13a05872
-
Filesize
5KB
MD5d91cd891a5cda465b7cb087e354fd556
SHA145c37b478bac256c8e0ed063c341545ddf644f45
SHA256d12540e70f33859fe7973ba845fb1c633ca56d96ff9d1a7902ceb09aafa9cd2f
SHA5123b93c908a77114fe174f743f867bd75801763d0a962f9ab968b0c75b020584175526579c9a11b94037d2a67d588363fb0e4297ad28ab8fb37845f7908aa8fe5a
-
Filesize
10KB
MD53f46676927e051afaabb5a818664874f
SHA1ecfad80747ca6334006b26b991b5149d5b0217d6
SHA25621e8250761a7bc1e11b1c2c7f39839c35f9678aa08872dcc7cb11933b2604ed2
SHA512cc716e6c4075b0b6700dd0bb7cc42f9df2483198cd7dba66e6f473e3b809315c128d7d70acce78c15e119f91968e486e742e2e49d33acd1a97bc4d5cbe699cf4
-
Filesize
11KB
MD52d5513da11fed52a86d2ce3a6e97cbc3
SHA13d902f248f24cca08bdb3b343801d1558dfa7924
SHA2566972f274f7b668a18715ffa70723eb92c01f2f9d9f588e74e46766e335117ef1
SHA512d401a4ce7b7436af6f9d4e7e240e363f3d5e1f514eb34100b8403ff683e4c18815828bd35bb0fb2dddc8d73b2b052ac27784e26fad0441f5394c9e141cddd9b2
-
Filesize
25KB
MD5720aa4cc22fa758330efaf8dc2e7ff7a
SHA12308da3dcdab2d65eee2598430770027ffc6ef99
SHA256df9a2c399a1ba08fc205a6b29886c68f99ba50d120a8beac1015b594bca982fc
SHA51262207be5c21e9fa40fc29c7cbbff4b628bb270b566451958f036e86da45ba939f0d04a26a716415a0d90f7d7e90a5d429b3e14218c5f26f6e9bedf4c994f0152
-
Filesize
41KB
MD59589818c601341e0f283b83f1d373f78
SHA1dd6bc9c3b59b167dcbb5c9fafe526209ae3f1726
SHA256687224bc477549c6bf1c0a7907c7c5b6727c82a480f8c6f2ca2b15c3339f7aad
SHA5129805a4ef49aaeef450c63f8a438bc7567ea9f1ad8c972b6c205bf26bacb0dededdacb2340a74da124eaeefc978f282b3fbf6fc8070cec7763773f8540bdee2b2
-
Filesize
41KB
MD546fa3ca2d2d63465fcf04794e9077a95
SHA11aab89473312b393aa9f999f3dd4f25024ab9713
SHA256b2e682f2fd66de41f0b613e6c5e1b0f9dbdf9b30d310b30b415d74c7e878e7f4
SHA5120c21f72e63b6b83b90da86432c6f9f17f562ea49dff26360be47406a5e1cee1abfd581544c50d2af8ba428167964768c24fb1b06dac4800f75e541bbd32fd3e6
-
Filesize
49KB
MD5a9f48e65f75e51d49f403c821e528728
SHA1fa4ee41b9c7b2b9a466a70526bcf8a3527b01006
SHA256e30302861bcd2a9a3edecf149594de98445f9e5796ba63a8f8803736b7293c77
SHA5120c22f7635b4903b7fbc890635492586b06a0a60401cc113c139449daa872751c73553128418100244e567411fb744ed6c97e66ddea46943f12d344581e578e82
-
Filesize
49KB
MD5b29a36800d73b4d4243a47503c320a5d
SHA1853811fcda0b3223809ef63e1a20ee64af4a1549
SHA256a68256f9e8cae12f09f69a031042a83cca2a3972e35de5cc6475db02567d8a88
SHA5121c79f0bb12010d0084d8576e040a3f38206586defc1f7e108c694012385e55700f27341831071340014284c42378f3532ddfc8ceea056428075dfd439a0d5767
-
Filesize
1.8MB
MD5c9d26278011584282ce019ac3b2d8f90
SHA1e6ce56f950ca002ac83d5106cf65ab0c2a1dd547
SHA256d505e9c1d7c656dd5154744dd49f2ca0961a339b918b6cd9dc0ba2d4c3abaf5d
SHA5125497d1ce107cb2936e356a03f556e1b999f9781c46efc7f73bb8b06e02b24c15633894db408c83c5d27187b8038bb42d254ac4071106035be3dfe8b27d9fb6d6
-
C:\Users\Admin\AppData\Roaming\kingsoft\office6\startpage\documents\WPS Sheets Quick Start Guide.xlsx
Filesize1.5MB
MD572ef0cab0914dd657dfcbe87ddcf3cfe
SHA18db133b42679f44977ee5fc23e2350cc7cc73030
SHA2566f3c2c1d90a7f8cc36699d57c594dae2b9c9c1395153532d1705b18c4f572c60
SHA512089440fada09f5951e72394d18a5a3d453ad7c91175f51996c7873b95c39fd3ad643ed74ad2ea0693a210ddfa2bcc021738d269a387f91ea2d9a5e96f79f6571
-
C:\Users\Admin\AppData\Roaming\kingsoft\office6\startpage\documents\WPS Slides Quick Start Guide.pptx
Filesize817KB
MD579a58639847101235f88137010909eb3
SHA1f1db11a7d964159ce87c3d301efa37f6e21aa304
SHA2566353fc0db85d8809daa62ce309ff834150e2549589692738f92f1b0ca542374b
SHA512b7caafc711d6d1d916a96353fe1b4d4863129033cae32337fd5fa6ae01ff7347daabf6cd08c18fae0a99e8c7075faeba5db5bc05a557ef0c43fbdc97c186a9a6
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-i386\cef_high\1\cache\Code Cache\js\index-dir\the-real-index
Filesize48B
MD5b282e59f70f15aed61a45d3c1e1c6cfc
SHA1595814987fdbdc8655bcecc49869f73a93c05a55
SHA256640fea7d094c2d4c2443983de043c85eead2467c0e16c8c7414a3485af456111
SHA51260d1d50facbc7b1c57a5fe991a5aa790aa94e85498c7b0d1488fd7dd759fac0f738d19421b3fc487e5076e3ee79c1a2d2b70563fccd9facb7009b431cb3bc97a
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-i386\cef_high\1\cache\Code Cache\js\index-dir\the-real-index
Filesize192B
MD5a375d79551160ccf0f1add0e8f0eb536
SHA18a46add985cc6910595d37b099c027b933639b22
SHA2561ab5fac926136808f93b04d1a546d48ee0c839ca51ee7db55d1489da8fad1515
SHA5122e60477c7caa6be4255dd488b157c3400dd2e4572971261ed9b363793f75ec0885341ef135e83da183f75538fda3b17d0b4ae9b19a5dd5648a6f4a8a7c3f1cf3
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-i386\cef_high\1\cache\Network\TransportSecurity
Filesize537B
MD55e0a92d8361b0238958eeee16a74cfc0
SHA1064f07b5fb67cb58c7acdb9eee60a3b1cc20b133
SHA25625830e4c540d440fc90a3895f2b4346ad3d026543e77b696de78c0d73d8e8638
SHA512e94a2adff138e38435cebb46b5b20139fceeb50b3711becd54d548c7cd40a19722505da0a1a400f24872ddc79b3b80120d82a1f2358f2ba3804877953d422cba
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-i386\cef_high\1\cache\Network\TransportSecurity~RFe58c147.TMP
Filesize370B
MD571145be49280fba9ad69662f9db3c535
SHA1a8e9f42efe55d00cf74f8d15bb751f3bef7a2bc6
SHA256c8c237cc35cb03a920eaf971044443c1b6cd29b2b5795b2fd62f3d85ff2397ee
SHA512a7f6683af40dea2781a7faf5ee02c60cd3d2d9b501afafa65bc00dfd046e594cfe8d65e6c3ad8a316c23806b2c2ae96089ba3220a19271668aaaa93127b9398e
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-i386\cef_high\1\kwebstartup_commercialize\Code Cache\wasm\index
Filesize24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-i386\cef_high\1\kwebstartup_commercialize\Local Storage\leveldb\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-i386\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat
Filesize64KB
MD5931c0ad65171597f2d7072fe5f71a4f3
SHA1f07812df188d9504f9718e375d2a110f10954e6d
SHA256c286d5735a4b8845fce8929bc1b2755755a47506a9f54736bcc861437f80d416
SHA51263ca8825e9874edd89ebd668424a2b02469b3ef78219712fef168103e5f60e38640da92ee9c1e58bd1400ccec30a8e49efdf472851004d1708d88f3c8ca84ac7
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\list\win-i386\12.2.0.20326\chromeguide\plugin.plg
Filesize728B
MD573ffc2521cc349c13ba04291ae0d0561
SHA1129d27440eb6898e9519c6d24c6c72d35c29af99
SHA256c88693dfce2293e6dec17954444ecedfea8a03886e0ba680e552ab62504f32b9
SHA512245ab6fde45f6dba7f2db84ec951474519f0609791e025d7a677ccf966ca98dbd4959ece0e431f2dbbb3fa4b7b7c16c8e2923eb80d56a7f743b6cc64fb3559a0
-
Filesize
17KB
MD54491826706d4b2b3236a7409c75e2f49
SHA1f1eea59b3bd8abb65ac73ea2acec550bb696f593
SHA256129cfd5a7bfbab4372a2fc0796d1a86ebf98316c1ca24e1e9a5a87afb721f9b1
SHA512bc54de75d4bc9ad3158d42713cde520134881a550a1ff463ab5ecf67eaa8753a0b2376cf5a0a21e9a6f4b247a8944471dc309d2faa9627deac49256fe5d730ff
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\list\win-i386\12.2.0.20326\kappframework\plugin.plg
Filesize4KB
MD5f914dc230cadab2231ac9a074bbd4f06
SHA1c906f4d47623875dce29d170545bfded6d7f6686
SHA25647f3b8a714c3ace751991f931e846dadf3daac91eb880e7652a42ee79e1a3df4
SHA512622e0a8b73cefecd6e0d051f9e734eac800b803c10912661fc8c83466fc6e74113f85d37bbf344110a01fb8c383819f9c002c64b04ae91b3e6111a8de5384dc7
-
Filesize
760B
MD5987290dde62e7310d88c047432f2b229
SHA1daec68ccc920a05f4e1725c83a1cad84c30c7fa7
SHA256043b1eb4fc0a0eedff93cf05061f49e8931d99473aaf6f1fd7158a2590060a94
SHA5121b2934e8a9d3110139f95f12b2c431da480b2879f90ac38b5b876ce0e24ad658a88267196a65a425b75af5b05217278cb03fe472e16e760c96c581da016bfcd9
-
Filesize
8KB
MD59536a7f6e388280e4830571e09472612
SHA1bead1c683b77155c319133d5c988b578e561790f
SHA256eb4e799fe25ffb5a1e34bfcf26217d54f1eaac44ebad512adadcc77310f58bb2
SHA5122d2cdcd47f9be0f9a0fe07c21b0efaafc754e116feafb51c187a0a47d7400d915f8eb90f217b3eada4c817a33eebbb3aab1d76044aaf96dbd902ffd42b54a147
-
Filesize
4KB
MD52955e54f4f23fe4ef35bc65a5e5871e0
SHA197b270314fadbb9e58e25f0f82a2bab94729c283
SHA25615b092da03a2a314a31d6e0b059d7d38a7ddfec35c38d755425e2513c32cae37
SHA512a850a77c2e858383179275a44df90a7efe6adade9de6b011c93a2c90bb22eb4cbb54b17e8926e44d0d7c7f07f047b88bf271019785274dc496e5a183a692aef2
-
Filesize
8KB
MD58234f60e0d18218842024afdc7457617
SHA10c68389360b77ce377e8055b39c2e61a989b054d
SHA25641bf21e3b2931f53541beded0a88bf732b6902131434cdb9397a3ccddf94d955
SHA5126b9425403ae6c552cfb828bbd7d7c516688353032307aa1879cb800c434411e6c7c6faa9585dff15228c36f5b121551f74e49c932c328b582e37ab319cc78709
-
Filesize
8KB
MD5c4a41c9976541f56a296547bbac73c49
SHA18cf439e8c5db4aae1e235a3a56ec883bbcd536b5
SHA256fc15f89f93b6980fe127879fdfcee56374fe71470b778e7351aba96d4aa3e142
SHA512eb755cccb7c4744ae42a939e3f9d8d511caa636d7ed223ad580d51bf4d99f78fc876d3288a60a1ef334f827de6acd4cc0149499f44ec77db43fb0042f81da287
-
Filesize
18KB
MD5b824244e598e606dd3de30eb01cea280
SHA19952d63458ea32831cadabcf93ba7b0e79fd5545
SHA25632719841941ddb11cbd73350e904f625e6477f0c50a2068dee8a149663531d89
SHA5129b6994423014707ceeaaa35d0649bf80f1f4e4362b9f9682e127ad777cf0eccf61184d553137153af709abd07f9ab16c9c1b7e091375c841b796b91d31cefc2a
-
Filesize
18KB
MD5e0807b72eaafdfcddecbd08b14e6678a
SHA1d3f54992ae56cbb46225f6dad65164c1771490c2
SHA25617a334ab2458913eadbbea86ab11e84546ea6af0cc8f1467af84749eab1398c7
SHA5123da2767771176190b2db123afe8504a2eb1a1a106d12b451921329e5e92b50e0f484356057232dbe12bfeb058bbc5cf7f5572760bcfac63482276f54cc4f0b83
-
Filesize
776B
MD58e630aad35b7993670e0f66093f65057
SHA134ba1bfc422c0e09df2f208ef11bd0cc1276538a
SHA256bdc41b699e108d01645046baf328724541ec6d1ee6cefb978b74067e3ddc4c69
SHA51272341360a75ce60c0483241ed01396a55e40b851a236859ac10ab79d6ef4867e233f06b4502eb951f4f7540923efcec8ab30a937f17f0634efdb089c8871d0de
-
Filesize
7KB
MD52cb291e7ad6ccf0063ccb8f33e1ccfae
SHA1357d9df1f8562c4654444f36be2eba08d0fde836
SHA256c299c2f6b2ebe9d8324c3f4d08da5573196d9a62932880a283ec30f4878cc84e
SHA5126ef8112a4ecf9fd58f13644ef343017a81839db4d301cb0e4efc780f1c7796a1f63ccb55a830ebe54aa0201e63bf0ef146b557d50148986718c0d0f9683ee829
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\MsoBuiltinIcon_1.1.2019.8\download.7z
Filesize137KB
MD5c81d8a9e85e5cad1c770123b66b8d3f9
SHA19345601d369f0fa1c9aa52bfe3f97e377be8f892
SHA2562913697b57a9906365bc1ce3765c172103bde6f23eec0ceb9f795101120e546a
SHA512cdb6d54b6e601a67796b14673f8b14ae77adccbd4436028436afe59593888d4b4e1004a170961866f6867d51c3cdc2937c1593073ac665ef59639a1a98703ad4
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\chromehost_1.0.2024.93\chromelauncher.exe
Filesize111KB
MD5416319f41502a87076aa0369da03a8a2
SHA1433982cef3594f74a531b884fa231fda5624e670
SHA25648d18dda6d435e202b1d9f4264ab60759e0049f32bafa9a4ed65991d2a0e19f2
SHA512e685810d3fc9aad11e58fde29d022343d59a4368b766cc36cbc28ffddc6d350548e79eff4fe78f47f05c71f74e3d7128160511c4bc0fd84b915a7a1b342c3f16
-
Filesize
2.2MB
MD534b00e2613827b414f52131a9d64ec0a
SHA1981342b0b3a1f3c70546de6394f033d0ea89ab9f
SHA2564f7c2da2b435ebb48d44cd0637df2fc9100808d595e593ed671734a2db0a035c
SHA5122dcf5ceb166644351cc932669042fee5c5d7e7c550b4a316ef7e8f1a3fda1bc70af1440910e7e2fb25a10bad7efb733b9dee464b0f1a4ad08efba3994c487f73
-
Filesize
443B
MD54e1aecfb8f941521e3a16cbbcf1e3418
SHA1d61831a61049424ce80f5076e91be965d764e32e
SHA256bbc30b97c2d501333061f4f77439a2da8e8454b8cf5602467af260c9bebb6b18
SHA512ee74b3eba02b80ca9032d1c1afc5b436031e57ac4a7a52924185b2c8eabae81f3309a089fb9f23864b43363d9d3587a7338da2c4e1c33991d5648ec361c9a9ef
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kbackupcenter_1.1.2019.1313\download.7z
Filesize993KB
MD55f842c6e9a183e21389112887725d559
SHA1cf4958f0f9a6531b2147c35b620f6e51d444ff11
SHA256ce244f099cef530051b4d5b2fbf6229e4c731127338c6d84542b59bae170ea3e
SHA512291d72209aa9b029b69c0e6a1324d8f2ce40090a0754db44f8390b585a13c611181d1d40f3b3de5705abdfd595676fadd739eb3c9c157eee942119026b95c1fd
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kdiagnostictool_1.1.2022.202\download.7z
Filesize326KB
MD57c4ee39cdee113b4b08aa821efc85aa8
SHA1da8348d9a020cc8074253fadfcc0c270aa36e8f5
SHA256a8ca5711d8f131984844c56f07051590f746ad555f9cd88716d99bd3fdcc669e
SHA512318a56c5e55778ba255a73e281e50650ed4b7206b90ef41113f8fb4a3d4208981a3d1f5a45ba9c4b36677d2fbbe11e15f1cab6294e58b4fc4526d3e904788fc4
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kdiagnostictool_1.1.2022.202\mui\es_MX\kdiagnostictool.qm
Filesize3KB
MD55afc7d8ba894df59c2b3f44726cfc2db
SHA1a21a7a8fd943455fa47cc5d950603bf1bc5a145a
SHA2564824e414e29358d0011ad1195059bda195a90cedfbd4c0f07f8cdeb0e84dc2be
SHA512a9a040e0f3555f61094b42202581a262d29377d414dc6a87596a2bbe4daea8fa3bf2eb10ac52fa6d94a522d54f404e247ee7b272cb41acda898ed6734c8ed639
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kdiagnostictool_1.1.2022.202\mui\fr_FR\kdiagnostictool.qm
Filesize3KB
MD562f3720e184f094c874fe0eab7f0f598
SHA1cdd858a80bbd1268e7c5278ebe19c35659871d2b
SHA256bdf3b27cc070b3cd9deb9a5e2bea450382d6851723c266eb0d5f3db4798f5a14
SHA51214f532053b0272fe0c614de9b56bfd9ac85aee11e878e099531250b00f667d2428789e81b5ded64cbe51dc8e3e8e19d7cea8dc08314b1c0274de15fca17b92b6
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kdocreminder_1.1.2021.220\download.7z
Filesize144KB
MD5abb3f45352fb78ebb161d62d1de9f159
SHA1c932265633b631bf2e6a7e5a761e8a4915b1a304
SHA25615b3be5436e1beb30a4e3a4916dd05e86135daad3a9bc95b3206812999ab3d2c
SHA51261cda8cca18c788c0d8c45798c3fff0cd906fd9901f810f0e4f812c041625913037b1d37fda6e8fbc8f8cc23295aa48969596af53565caf42b15857a9a03c902
-
Filesize
292B
MD5da4b75c3d70c08be415e7b25abdc11cf
SHA1c84dfbb528a3c8ce94d068dfc5fbdf7d621d0225
SHA256e93c62beee030970bf56bf0a3aa372ab0b155c1c3436173617c8c735024e8f36
SHA5120fa811055deed42a6cbc0f16f93da173718f4169ebf8d4ea125276c6225ba033c7644a68ee010250379b67a057e17e5cba6351deca067850ab318c505f49e491
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kinsertlatex_1.1.2022.181\download.7z
Filesize750KB
MD5f0aaf093338cae434a9e2e16fd0d91c8
SHA109640d3f73fd7d64aa32c49ec3cb28bb4147b621
SHA25651317a75189c8b97e72c7d85832f773910b40809c0954cb8e3efe939b1455e32
SHA5127fbeddd9ab001109f10fe53ace2ec4d52e44cead5c05409e65405f8f2b682e90d09913370448e447715d03c1c8896b26dce10fab57219d3adc7ffb84ee3e2df2
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kinsertlatex_1.1.2022.181\kinsertlatex.dll
Filesize186KB
MD578cb43f723a6aef6aee832c90854edc1
SHA16ac19b3449d450ad331fc6633b5973d8f74cd67e
SHA2560038630e7ba218f3cd91b8761145d89b9db0951615dd5ffd10d83601aef8c275
SHA512249621e5b0f089390121612562030a3db015eb4aa3488fc4fd68541de1d46908d40f196b2c1d412b5c392dd2ce99ef8462581b87f79bc8bfaabd265129bfe010
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\knewstylewebwidget_1.0.2024.78\download.7z
Filesize32KB
MD5799f7fe810b93f30ec8fbc4b520d0e49
SHA15fbb1d4addf7cf0f469fe742a91a165258ee63f2
SHA256e10a87579d8a2a5b937a4a7f56ccb6a26a441ccd243a0d621a784d4462cadcda
SHA512e86d1dd1b5c317c49983f00b8da5cb13fe3e9fbea911316adb6cb83a5ec929721794783f9d8fdcc2f08a097fdc2c11c3f6e52c66e2a39e2e7a9130daa0a08be2
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\konlinedocer_xa_1.0.0.273\download.7z
Filesize368KB
MD50476a3973d88e5eee310e2eab4181916
SHA1321c66ec1d65cbc2870dacffab013ede6a21d8de
SHA256c032f342c56f29f2b3e6b1f0022f0854d2cab773f6fc48c38dcff1034e03ab47
SHA512c21ad08d81eb2ec00834686019091e97dca2dfdba517b2e52d0ff3df8572f601cc49f4b894f441b41d6d1c0b123c29407d1849d390253c7f3848640f08648137
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\konlinedocer_xa_1.0.0.273\res\window\img\empty.png
Filesize15KB
MD5ea89751583a811b9197cb633d151af5b
SHA185d5b8eb79f0ab38ff2f6767089ce56c361627b5
SHA25608c8d21bccfa80d5f12b0e238589b4f63f283d17c68db519fef900e53eaebd4e
SHA512ff918bff988b8f2931c9026ab7cc272e7a8b6e0e8c78a743fe30383d3f702b13470367112c5d2741527d3916f7f80d342085405eab3e90f8cbdb3443dea141cc
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\konlinedocer_xa_1.0.0.273\res\window\img\network-error.png
Filesize13KB
MD5e0099731cabf1e253635fb566f49be8f
SHA1195e51ef767d69b40550e7b179d1625b737c1bc7
SHA256238699ec3a56029278a0d0e9490191168eb59fb3e9024527a0d27df37f2bc5cb
SHA512a1d1468e64961a83fae7bbddcd9292b0b1e6bfeb41554676be752bd9f8e0f948f8a2afe767593f4b052cf4e1226eae021640e3e3e0efbbc2cc52d031ad45ae40
-
Filesize
85KB
MD5db7a627fca9f4415967bde591b49e95d
SHA177cf9b9faa4b2ee601cf165969f428a76a225fa3
SHA2563a220e744bb10bdde6fe902e38ffdbf35fd3837b95b23c0f7e7d49a66bfd2355
SHA5124963c050dd997896b5fc8fa41c9be5c1651da418bca089901c5e82bacbe61082e67dd6c6089f481e0f83eadd35e98ea7c75d8a61a80cd2add8faa45e043728af
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kqingaccountsdk_1.1.2024.51\download.7z
Filesize2.7MB
MD5adec128c10d7b21456ec0f54c7fa526b
SHA1df0455c96fe5334c7011c43603706a3d5f7a27d0
SHA2560f4a44c5852c7a871fbf6d52f3ced2d633ab0e04d0db83cd0719218f69f4bd1f
SHA5123ae3607edc919cf0381187d5486771710ead06d84d3375e234d9ae3f07ce0345cc0112a94c5de204b3e36facdccf44561d07b1ea4b6560e58ebb4e393724e612
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kqingaccountsdk_1.1.2024.51\resource\premiumcode\element-icons.ttf
Filesize54KB
MD5732389ded34cb9c52dd88271f1345af9
SHA18058fc55ef8432832d0b3033680c73702562de0f
SHA256a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
SHA512e8971ae48f5287d252f5b0a2d0516091bef0d2febf7d01fd7b435e426d106fea251037439ec42c2937e934b66f38e5eb43d00a213cdf334f482f4a06b1817f9c
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kqingaccountsdk_1.1.2024.51\resource\premiumcode\element-icons.woff
Filesize27KB
MD5535877f50039c0cb49a6196a5b7517cd
SHA10000c4e27d38f9f8bbe4e58b5ce2477e589507a7
SHA256ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
SHA512da269b20f13fb5b0bb4628b75ec29e69bb2d36999e94b61a846cb58db679287a13d0aa38cdf64b2893558d183c4cc5df8da770e5a5b2a3288622cd4bd0e1c87b
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kqingaccountsdk_1.1.2024.51\resource\vippayment\main\img\loading.svg
Filesize1KB
MD5544223e85768fd134633a1af9d5bf536
SHA15536a0023ddbfb2ab67e9ad8ca4d38c60f413b9a
SHA256a3df9710c7e09fd8cffc14bfe45f5a1576deb1846ced44e5050b34caf5527049
SHA512a5cacba054d41af8efd607074c02f36ab731b5d6bc9ffd3bd7ce6b09a4af09b31e29359eb965728d2a00849467b1af66e16186a0c07b4415b3b423a5ea4f68ca
-
Filesize
1KB
MD5e70c324fa11c0ec0c62d734672810381
SHA1ab19c58917a059a3efbcb4b72e4dcd943a665212
SHA2567af6c5ceb290ff91fdd9d2d756dd728b61925da67465e102c530e76ef8dc6ad3
SHA512810f5ac81a0be2390402d994da56ea2ae1ee0cd2c46f892bad4a082601b31d75d328b5941fd4a9574d49d4bde7f58a8bca9171fc0928a772d39976e4b81c9a38
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\ksavepopuptip_1.0.2023.133\download.7z
Filesize198KB
MD57972fa19373bafe06c005fcefd4f5f04
SHA1c454d125f01e747b00d402e9af7ae0e8475c0022
SHA256c85daab429808dd27dbc1c64cdd7063b021cd33430d5ee1f6316cb4ddd00b00d
SHA512fcc2346bfd6302b4a55aa98c07723d732c5f1699a685c3996998d9f1e2172389aab0db3e3fa41858848612b865e01ece7f335ee025c3cd2c7e48bf724047711d
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\ksavepopuptip_1.0.2023.133\mui\default\icons_svg.data
Filesize39KB
MD5847478e8dad6992c81f53bc4e6dbceee
SHA1157d13564593fcfe92a5813f49abf48cf7aedba9
SHA2569e383c7978e34d710bebd753e3e135e3dde445c74830bf01f6ec175d429f943d
SHA512df145df25e167875f40f9641fc110a803809a1ddeb63610e32268dcb336071351ba1fd4f7f42c8846416f4a121c9ba2aa9053fd1900d42fa3a839e812081d647
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kscreengrabapp_1.0.2020.277\download.7z
Filesize22KB
MD56f316d600e4c69f6c1e80406eadcf296
SHA1cd63373c843749eafc4778731d53db786e7c58b7
SHA256cfa29b7fb7f2a27cdc81f6048b14cfc16c5d10bd312584deffa485bc9102d100
SHA512f5963b7fdd099411366fbed20ad6070f7bc1ff574bdf4f1f28f9e0c6d4826e3231e2651c387286b8bbe2d5289829ee7ff0815ec8931528728f69d3d3fd0cb2c2
-
Filesize
4.9MB
MD5f2fa4154ae36239ceb6a02e822e2aba8
SHA1b5e7e38dc304dc7f4ef72b5604cbd331e19e32e9
SHA256915d4c13e8ec8b811541b9a2929e5cf2b003910e31388906d142bf6109543926
SHA512afee8e8f7031628f60c1fa32c5ae8938f322e199146f000c2c99e287d060d70275e8b501fe4e6ca76e95cfe26536f91cf717d94683ab0c237b8a6694f59de995
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kstartguide_1.1.2025.6\mui\default\WPS Docs Quick Start Guide.docx
Filesize1.3MB
MD576889feb35682ae87fa8c7d348c73d45
SHA1d0be5bef285eb4766c63113ddd9137fc9a10355d
SHA2568e9054b01459a422b4ba0ac2436cb0c878cf584dab83e911f128a6231389ace1
SHA51225127cb55d3f966b82748f303eafc42ecfb209526219a09f2fda5d1784d2ffe8e6911895ebae7d9f4d73a6166349e27e02163b83acd09b95121638f57d462c60
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kwebstartup_commercialize_1.0.2024.6\download.7z
Filesize19KB
MD5f77d45f841faa297beecb94c0b64479b
SHA152ff585e16c2307f3559d41be351a4e67522ae25
SHA2565440ecb3d0a924c412e502c739db9e78bcdab38867d6f2340b493b79ef67c6ae
SHA5128048a6cf450c7ccdbbb0822ecb07796c27c604a511963b30722ae75be09e81bd6000f2def895da9364e3933b3c116b0a4b3339504a0a47cbef71a49d4e526dac
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\kwebstartup_commercialize_1.0.2024.6\run.ini
Filesize303B
MD5c646b8698a216d20e84200150b24eb0f
SHA1d6c9929f7197d6d9a7406df5ea28f04d36fb0ed4
SHA2569378a1ea8baddf207fa68aff55acf14f68e348c6dba6bc800e25da37b84a740f
SHA5128c2e63b2bac753a285ee0181cb8fd3e27e21771fc3ce9a28f158b43dd1c377945fda17652bc742b30e573cfd45660db642e68db49680bb812d9df1eeb9b2656e
-
Filesize
71KB
MD59c4277122594cafd8c5bd4f77be68a9e
SHA10ae16aadfb14bce093194ceb6836ed25fc16e894
SHA2569ae2eb0fcb51c30d35cb51fba635df367f39605402ef1f1799821c00f7f0b7d9
SHA512a6c8b1983ac5dd287b4a9d8f7196159e7d13dc05a92c9a4c2b58f5f2e67e0225e1e49338cc7f5b09a4dc5f802ece9c2f46ddff603c34e97348893da08ddf27a0
-
Filesize
311B
MD5236e5baf01686e858f69fca4cabf90cf
SHA15247a8fe0e59ead62affd63a9f8e9c4f13f05def
SHA256226e9b2204745d5b685d0d22a6a3eed8b7f2374d0aeee799f4320cb500235df3
SHA512ad3b13639da06cd30ff18e3c4cf2b5a470d28fd63ab8ea84a50c10ff5b4cd0a7d8a6344c5e3a501a8f5da351a5164326b157a1bfa742c1a65ccf3972c3814854
-
Filesize
5.7MB
MD5e7a4f4990dbf88bcf35b185a8ec3dde7
SHA16497ac4d69a81d3809b6a11747c838abe1f8c31e
SHA25628cb1eaeb4a26072da4e6e10396ca8d9ab8b0bb14b39739fcf988b4188cd192c
SHA5125945fd8f498226a59a5d1f9edac74800800e4f32c2f1f65dfe345d13d75fe1d6fad9df044fb1c8a4947ad72561ee6d044e1cbfe241e7e647e997fe9bd158f3d4
-
Filesize
414KB
MD53a1ce0c85535b9a4693e19390580ae78
SHA15db80085d38036784b492c29bd0bea013f777a1b
SHA2560490fb128550aafd00f0b589c2332c8f7853b4574aa4ce78f243df9741cdeb0d
SHA512cfec30f56946cf16e8f4e3557f368d38bcbebe1a4fd3be0d67ea1e4d705b2a72fab1a50f8f241d91fdbc5fea66f0b0298e55ef90680196070853e566dd33b973
-
Filesize
23KB
MD5f013b7c4b11e39b695025a283cd2afa5
SHA1e343f95fd5ab0c8834e654459ae0fa67152ce966
SHA256c9a124f9a4cf55f3ce27714b0e31fcaa29d3c12d25cf60215dc49429dda2e00a
SHA5120d6e41a2ff4777068c8fd0b7294a6fb4ec07061bf9e713eb517b1304015ed2e72f827145c3950c4f70420bd7c95e21df207187cc1b19d1d77ff6e4ec7148bd03
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\pdfwspvreg_1.0.2024.81\pdfwspvreg.dll
Filesize55KB
MD54e8d83effdd04b9a8fea4853d84cee3c
SHA156950f40d0008c21cfa396dfb53d1a3e9a7c5d42
SHA2569e00062b12454d9ffe208001b9eacf880d82ccf3cbf5b54cff469f913eff5555
SHA512a6986fa6614f7a3b5baaa29f29dd87ca04cecdf510a1d662665e083d767b4501db26b964d0acba02465d6ad8a7eec3a64e76d239b245efbccf5de7bfb7221052
-
Filesize
253B
MD50d914e316c8fc542e5685b1598899979
SHA152e575fc0c66b60cd79d29ae4486944cf06995b0
SHA256484e6146403c96eaeead06a97a8ed86d67334a9185bf009a44f7b1cbe5402e2a
SHA51277ca461895bc65f31dd8fc5182dbed383804b4d3315e210bf65195776510bf9c09c11d87589796ec1bd272f67762e5ba28be4d64b8a58f2577cb6da79dbd7319
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\photo2pdfentry_1.1.2019.319\download.7z
Filesize87KB
MD54674716a77e88510fe34f4c81e5f99b0
SHA11edd08a558cb1b688916de5ea43c39f040597d7b
SHA25639814df86fdde15d7d4b09e88ffe8d607bd9e087e9c5727a30e711c0411bdc63
SHA5126b4efb837d7e756cec543d343869c908601abaf56e17c826688937615d050d51fe3f42e0384c259f5196972b2440817ed4e308d6d708a1b73969925a0f63d64b
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\photo2pdfentry_1.1.2019.319\mui\pt_PT\photo2pdfentry.qm
Filesize410B
MD5ed4e02e0df05e8b3325e4d21efba2111
SHA12bb24ca5d97b2ca32f62c0c6a684169fbabd37a1
SHA256551fece5bcf3ec6e0ddb2536ec145719269258c75c96445358568d08b03a0061
SHA5129b1b1d118d6997c03f1d5a3dbeffa146527672dea6f482ef593ae9a41c27b76515cee42cd1cac7c5921459e000c3eb958b36d6c98e1316e3b88d7f340d51830c
-
Filesize
7.9MB
MD5e5d13348c12b057e3c859b14fd7188c0
SHA19fe15b7f600f4e563f4b526ca536088921b633ca
SHA2567b24aeda7c904257f47dfb3f440ece9f1773d022e77bb3505e4eab1d654c6d52
SHA51210610e252ad491c3f2b4b627cd9e3e2f54bbec7abb7ba8af7cc87e4c662e1cfd6e5c5fde98351d37f76c801fc58d6412c5d2bbb24f8f5f245bff49e3d12861a7
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\photo_1.1.2025.15\mui\html_loginmenu\static\js\manifest.js
Filesize800B
MD58def9f056a8244b677dbd42be7bfc987
SHA1460f4946c829d43aea3d731b2fc2babb81ed4b71
SHA25677b87f2e8468b07df6dcb7c12fe7cedc619153bb8489b20e12fb5092136cc948
SHA5122d00b432a7b8f2245f600dac1a90052e6baae8e89c5766015d65120917d94c8cfe3684f86c2f5a3af4af31d635c081fe714c2a1ec6873801edd0793ebb4eb918
-
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\pool\win-i386\spellcheckset_list_1.1.2019.20\download.7z
Filesize1KB
MD53f61462ce941a4eff91f7bf9b08bf0a7
SHA1ebb3e20b7c535086fba1af6b19d667681bd6eff2
SHA256a5e376742fe589cefe15411a99069a7423803baf199a1763bcfb77a33ba591da
SHA512e78c57741bcc1a303f385117196774ea70f90d7913ca97c9ca4dbce6599430dc2a8242ebbce6c83c845dc1250b5fda941f4af1b5df6c7b0f4fcd4e6ec60aeacf
-
Filesize
590KB
MD57e182da5a92d673e1cfd11faab6d4ed9
SHA1ce93e2659d82f4708c69c5c2ddbdafa9e206dd30
SHA2562dda4de5a89dfb5753a1f1f7f537223d111cd44c7b44cdbebde33248aff7f1b1
SHA5128963a9c6ddec81dbe62ab48e8993f1c94f2610d300804ded9a2a1cc6e8b4782e2aa10860d4754d692c5851dea5afbbd7ffc9836c28586070a67d7b28fcc63f5d
-
Filesize
5.3MB
MD5389c195400178563d002df985b170501
SHA135342e3caa507bd7927bd8ed6a7a5a2b278bbaa4
SHA256c3612683feb1cc1fa4f6cdc5a23e3cdab7ef84c185ffc107e2837453f5046cbb
SHA512ed8e6eb1b7103f2afb45b79792d7f2e6067f9ba30e56aba427b583d961c71b12fdf8b02af45689e9719defcde3bd0d1bd0a05438b28bbd5139b7347f311d3a69