Overview

overview

7

Static

static

3

2026-07-02...ca.exe

windows10-2004-x64

7

2026-07-02...ca.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    68s
  • max time network
    156s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 15:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-02_5b43ba19c434b53d3a22fdfe766d6818_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
  • Size 5.7MB
  • Sample260702-semqaadx5p
  • SHA256 2ccd7f7294de08792703590028590cddbd0f48583a493252d42eee6fc93d6bfd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdefense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 12 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unexpected DNS network traffic destination 22 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 40 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_5b43ba19c434b53d3a22fdfe766d6818_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-02_5b43ba19c434b53d3a22fdfe766d6818_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
      "C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      PID:1348
      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -checkInstallEnvironment
        3⤵
          PID:1680
        • C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
          "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService
          3⤵
            PID:5844
          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -addFirewallRule
            3⤵
              PID:5324
            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpsoffice.exe
              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpsoffice.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=klangmanager -dll_name=klangmanager.dll downloadlang en_US
              3⤵
                PID:5992
              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regmtfont
                3⤵
                  PID:5872
                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\\office6\ksomisc.exe" -setappcap
                  3⤵
                    PID:1468
                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -sendinstalldyn 5
                    3⤵
                      PID:1756
                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regPreviewHandler wps.exe et.exe wpp.exe
                      3⤵
                        PID:1456
                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\\office6\ksomisc.exe" -registerqingshellext 1
                        3⤵
                          PID:4712
                          • C:\Windows\system32\regsvr32.exe
                            "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingshellext64.dll"
                            4⤵
                              PID:1376
                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regkwpsshellext admin
                            3⤵
                              PID:3860
                              • C:\Windows\system32\regsvr32.exe
                                "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\kwpsshellext64.dll"
                                4⤵
                                  PID:900
                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\kwinappinstaller.exe
                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\kwinappinstaller.exe" -i "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\menuext" wpsappext1 wpsappext2 wpsappext3
                                3⤵
                                  PID:3496
                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regqingdriveshellext_install
                                  3⤵
                                    PID:2652
                                    • C:\Windows\system32\regsvr32.exe
                                      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*install "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
                                      4⤵
                                        PID:1140
                                      • C:\Windows\system32\regsvr32.exe
                                        "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*thumbnail "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
                                        4⤵
                                          PID:4644
                                        • C:\Windows\system32\regsvr32.exe
                                          "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*drivebho "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
                                          4⤵
                                            PID:2656
                                          • C:\Windows\system32\regsvr32.exe
                                            "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
                                            4⤵
                                              PID:1516
                                            • C:\Windows\system32\regsvr32.exe
                                              "C:\Windows\system32\regsvr32.exe" /s /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
                                              4⤵
                                                PID:5132
                                              • C:\Windows\system32\regsvr32.exe
                                                "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*onlinefile "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
                                                4⤵
                                                  PID:8
                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regpdfwspv
                                                3⤵
                                                  PID:1456
                                                  • C:\Windows\system32\regsvr32.exe
                                                    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\pdfwspv\pdfwspv.dll"
                                                    4⤵
                                                      PID:2768
                                                    • C:\Windows\system32\regsvr32.exe
                                                      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\pdfwspv\pdfwspv.dll"
                                                      4⤵
                                                        PID:5012
                                                      • C:\Windows\system32\regsvr32.exe
                                                        "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\pdfwspv\pdfwspv.dll"
                                                        4⤵
                                                          PID:1108
                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\\office6\ksomisc.exe" -setappcap
                                                        3⤵
                                                          PID:5340
                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\\office6\ksomisc.exe" -assoepub -source=1
                                                          3⤵
                                                            PID:2056
                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -clearmso2pdfplugins
                                                            3⤵
                                                              PID:5872
                                                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Drops file in System32 directory
                                                          PID:5432
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:3928
                                                        • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                          "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          PID:544
                                                        • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                          "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:1988
                                                        • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                          C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:5076
                                                        • C:\Windows\SysWow64\perfhost.exe
                                                          C:\Windows\SysWow64\perfhost.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:1876
                                                        • C:\Windows\System32\ReFsDedupSvc.exe
                                                          C:\Windows\System32\ReFsDedupSvc.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Checks processor information in registry
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1104
                                                        • C:\Windows\System32\SensorDataService.exe
                                                          C:\Windows\System32\SensorDataService.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Drops file in System32 directory
                                                          • Checks SCSI registry key(s)
                                                          PID:5316
                                                        • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                          C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:6008
                                                        • C:\Windows\system32\AgentService.exe
                                                          C:\Windows\system32\AgentService.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:5420
                                                        • C:\Windows\system32\SearchIndexer.exe
                                                          C:\Windows\system32\SearchIndexer.exe /Embedding
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Enumerates connected drives
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5932
                                                          • C:\Windows\System32\SearchProtocolHost.exe
                                                            "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3704578903-1610922810-1098216751-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3704578903-1610922810-1098216751-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                            2⤵
                                                              PID:1632
                                                            • C:\Windows\System32\SearchProtocolHost.exe
                                                              "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                              2⤵
                                                              • Modifies data under HKEY_USERS
                                                              PID:3124
                                                            • C:\Windows\System32\SearchFilterHost.exe
                                                              "C:\Windows\System32\SearchFilterHost.exe" 944 1708 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
                                                              2⤵
                                                              • Modifies data under HKEY_USERS
                                                              PID:2628
                                                            • C:\Windows\System32\SearchFilterHost.exe
                                                              "C:\Windows\System32\SearchFilterHost.exe" 944 1668 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
                                                              2⤵
                                                              • Modifies data under HKEY_USERS
                                                              PID:2128
                                                          • C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
                                                            "C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5A011A -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\
                                                            1⤵
                                                              PID:472
                                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -setlng en_US
                                                                2⤵
                                                                  PID:5264
                                                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -getonlineparam 00601.00001304 -forceperusermode
                                                                  2⤵
                                                                    PID:4404
                                                                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -getabtest -forceperusermode
                                                                    2⤵
                                                                      PID:2372
                                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -fixoldversionassostatus
                                                                      2⤵
                                                                        PID:1676
                                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -setservers
                                                                        2⤵
                                                                          PID:5412
                                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -register
                                                                          2⤵
                                                                            PID:4048
                                                                            • C:\Windows\system32\regsvr32.exe
                                                                              "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
                                                                              3⤵
                                                                                PID:3232
                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                  /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
                                                                                  4⤵
                                                                                    PID:6128
                                                                                • C:\Windows\system32\regsvr32.exe
                                                                                  "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
                                                                                  3⤵
                                                                                    PID:5672
                                                                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regprogid true
                                                                                  2⤵
                                                                                    PID:4864
                                                                                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -assowordexcelpowerpnt 1 1 1 -source=1
                                                                                    2⤵
                                                                                      PID:1780
                                                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -compatiblemso -source=1
                                                                                      2⤵
                                                                                        PID:1588
                                                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -checkcompatiblemso
                                                                                        2⤵
                                                                                          PID:5612
                                                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -saveas_mso
                                                                                          2⤵
                                                                                            PID:5948
                                                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -distsrc 00601.00001304
                                                                                            2⤵
                                                                                              PID:3296
                                                                                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode -source=1
                                                                                              2⤵
                                                                                              • Network Service Discovery
                                                                                              PID:3936
                                                                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\pinTaskbar.exe
                                                                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk" 5386
                                                                                                3⤵
                                                                                                  PID:4988
                                                                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -addcontextmenushellnew
                                                                                                2⤵
                                                                                                  PID:2212
                                                                                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regvascontextmenushellnew
                                                                                                  2⤵
                                                                                                    PID:1668
                                                                                                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\wtoolex\wpsupdate.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\wtoolex\wpsupdate.exe" /from:setup
                                                                                                    2⤵
                                                                                                      PID:256
                                                                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -collectfileassoinfo -module=1;2;4;8 -daily -source=1
                                                                                                        3⤵
                                                                                                          PID:5208
                                                                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\wtoolex\wpsupdate.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\wtoolex\wpsupdate.exe" -createtask
                                                                                                        2⤵
                                                                                                          PID:5656
                                                                                                        • C:\Windows\system32\regsvr32.exe
                                                                                                          "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kdesktopshellext\kdesktopshellext.dll"
                                                                                                          2⤵
                                                                                                            PID:1964
                                                                                                            • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                              /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kdesktopshellext\kdesktopshellext.dll"
                                                                                                              3⤵
                                                                                                                PID:2536
                                                                                                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regyunpanfornew -forceperusermode
                                                                                                              2⤵
                                                                                                                PID:2996
                                                                                                                • C:\Windows\system32\regsvr32.exe
                                                                                                                  "C:\Windows\system32\regsvr32.exe" /s /u /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
                                                                                                                  3⤵
                                                                                                                    PID:3884
                                                                                                                  • C:\Windows\system32\regsvr32.exe
                                                                                                                    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:overlayicon "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
                                                                                                                    3⤵
                                                                                                                      PID:4248
                                                                                                                    • C:\Windows\system32\regsvr32.exe
                                                                                                                      "C:\Windows\system32\regsvr32.exe" /s /u /n /i:contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
                                                                                                                      3⤵
                                                                                                                        PID:5536
                                                                                                                      • C:\Windows\system32\regsvr32.exe
                                                                                                                        "C:\Windows\system32\regsvr32.exe" /s /u /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\qingnse64.dll"
                                                                                                                        3⤵
                                                                                                                          PID:3808
                                                                                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -setup_assopdf -source=1
                                                                                                                        2⤵
                                                                                                                          PID:5692
                                                                                                                          • C:\Windows\System32\openwith.exe
                                                                                                                            "C:\Windows\System32\openwith.exe"
                                                                                                                            3⤵
                                                                                                                              PID:8
                                                                                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -assofdf -source=1
                                                                                                                            2⤵
                                                                                                                              PID:1936
                                                                                                                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -externaltask create -forceperusermode
                                                                                                                              2⤵
                                                                                                                                PID:5132
                                                                                                                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe" Run "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\ktaskschdtool\ktaskschdtool.dll" /task=wpsexternal /createtask
                                                                                                                                  3⤵
                                                                                                                                    PID:2752
                                                                                                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe" CheckService
                                                                                                                                      4⤵
                                                                                                                                        PID:2656
                                                                                                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe" Run -User=Admin -Entry=EntryPoint "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.26880/office6/addons/ktaskschdtool/ktaskschdtool.dll" /user=Admin /task=wpsexternal /cleantask /pid=2752 /prv
                                                                                                                                        4⤵
                                                                                                                                          PID:3420
                                                                                                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -createsubmodulelink desktop prometheus -source=1
                                                                                                                                      2⤵
                                                                                                                                        PID:5152
                                                                                                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -createsubmodulelink startmenu prometheus -source=1
                                                                                                                                        2⤵
                                                                                                                                          PID:5908
                                                                                                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -assoofd -source=1
                                                                                                                                          2⤵
                                                                                                                                            PID:4940
                                                                                                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -assoopg -source=1
                                                                                                                                            2⤵
                                                                                                                                              PID:5736
                                                                                                                                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regcadfileasso
                                                                                                                                              2⤵
                                                                                                                                                PID:5628
                                                                                                                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regemailfileasso
                                                                                                                                                2⤵
                                                                                                                                                  PID:2660
                                                                                                                                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -regarchivefileasso
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4700
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -installbrowserextensionhost
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3396
                                                                                                                                                  • C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
                                                                                                                                                    "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
                                                                                                                                                    1⤵
                                                                                                                                                      PID:1340
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"
                                                                                                                                                      1⤵
                                                                                                                                                        PID:420
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wps.exe"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:2584
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpscloudsvr.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpscloudsvr.exe"
                                                                                                                                                          1⤵
                                                                                                                                                            PID:4668

                                                                                                                                                          Network

                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                Replay Monitor

                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                Downloads

                                                                                                                                                                elevation_service.exe
                                                                                                                                                                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                • Size 2.7MB
                                                                                                                                                                • SHA256 e2ed775c4a1a63877b59734da2edd49c61028852b865b722c9789abe707c240a
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                maintenanceservice.exe
                                                                                                                                                                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                                • Size 1.4MB
                                                                                                                                                                • SHA256 5d32a0c7f42c62027fcb5ace5c702ac6ed460bf5c0e22eac6c1b27870e87671d
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                7z.exe
                                                                                                                                                                • Path C:\Program Files\7-Zip\7z.exe
                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                • SHA256 612015b4cde6c702f5ea3c1ace91189cccc4edff9f95e638b2373928444fef24
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                7zFM.exe
                                                                                                                                                                • Path C:\Program Files\7-Zip\7zFM.exe
                                                                                                                                                                • Size 1.5MB
                                                                                                                                                                • SHA256 e536e66c82270a712af0bc972c9272f989f42c89ee7860c58ad82a380cbb00f8
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                7zG.exe
                                                                                                                                                                • Path C:\Program Files\7-Zip\7zG.exe
                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                • SHA256 04faa3102916268fc39789cb483fb2f2d16e331d58d7aed1adf769bd2853a0cb
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Uninstall.exe
                                                                                                                                                                • Path C:\Program Files\7-Zip\Uninstall.exe
                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                • SHA256 bedcc63f5ff6b7ff928cf5e0bd8f53da82d89a1bc7f75094a4450cbcb8c34af6
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                OSE.EXE
                                                                                                                                                                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                                                                                                • Size 1.4MB
                                                                                                                                                                • SHA256 a4cd5b59fcb3cfe5de9ad90cdb1ab566d67559ed0b45f850fc110558779d45bc
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                elevation_service.exe
                                                                                                                                                                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                • Size 2.8MB
                                                                                                                                                                • SHA256 1ee7ebf0fc1cbf46fb9566c8ad20c255597c809ed4a1a1f4ae22fbf36e3ef777
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                MsSense.exe
                                                                                                                                                                • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 ad9966c2e376176283108108d3c4f990005be5bc138e62cca4fdf24ec457cd06
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                NisSrv.exe
                                                                                                                                                                • Path C:\Program Files\Windows Defender\NisSrv.exe
                                                                                                                                                                • Size 3.5MB
                                                                                                                                                                • SHA256 bd2fd558bb70652ef0b9118141205229721ff0bad9c35bc6483d602ce0612bfd
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                wmpnetwk.exe
                                                                                                                                                                • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                                                • Size 1.4MB
                                                                                                                                                                • SHA256 4c329bc1dd193a98bb10ae17bda041d2382af7b29bd4e53a24b0bd9605fcdf99
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Windows.db
                                                                                                                                                                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                                                                                                                                                                • Size 1.1MB
                                                                                                                                                                • SHA256 da787ca3ca2d3a35e7b1d86cec89afafd64a808102bef5003d5898b795164e21
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Windows.db-wal
                                                                                                                                                                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                                                                                                                                                                • Size 329KB
                                                                                                                                                                • SHA256 019f8e582635c113be1ade551e529309f3f0b07d08389c1210d83b0ca6dbeb71
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                                • Size 471B
                                                                                                                                                                • SHA256 a6fa82dc7dead9cb4cce05ef7fa0bf3d4212da6ff2195ce91d238d9fdf424800
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                                                                • Size 727B
                                                                                                                                                                • SHA256 ba930829141a4e06da50ffb7c09e80b45a264d805b3adce85fc59ac15daf286d
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                • Size 727B
                                                                                                                                                                • SHA256 82ee0d22beb0ebeea5661d46957bb61c4f81fff7abe6550fd974f0f57953684b
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                                • Size 400B
                                                                                                                                                                • SHA256 72fc2703c9e5396654d9e73f8c2e9777669038b1b5613210f1a55c334119dd7b
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                                                                • Size 404B
                                                                                                                                                                • SHA256 740735187c52ad465f95a2b115002c22aa41bef3461420a44f17fc9cec84c6f8
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                • Size 412B
                                                                                                                                                                • SHA256 8b36bafed3ea9fb9ddc48cea428a3e7adafb464dd80b6df45279f8da3bfeb808
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                logo-small.png
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\StartScreenTile\ksolaunch\logo-small.png
                                                                                                                                                                • Size 6KB
                                                                                                                                                                • SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                logo.png
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\StartScreenTile\ksolaunch\logo.png
                                                                                                                                                                • Size 12KB
                                                                                                                                                                • SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                run.ini
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\ketaidataanalysis\webview\run.ini
                                                                                                                                                                • Size 171B
                                                                                                                                                                • SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                index.html
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kpubaigcbox\res\dist\index.html
                                                                                                                                                                • Size 636B
                                                                                                                                                                • SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                index.js
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kpubaigcbox\res\dist\index.js
                                                                                                                                                                • Size 2KB
                                                                                                                                                                • SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                errPage.html
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
                                                                                                                                                                • Size 7KB
                                                                                                                                                                • SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                favicon.ico
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
                                                                                                                                                                • Size 4KB
                                                                                                                                                                • SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                run.ini
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwebpromehelp\run.ini
                                                                                                                                                                • Size 226B
                                                                                                                                                                • SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                close-secondary.svg
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
                                                                                                                                                                • Size 216B
                                                                                                                                                                • SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                kwpsaibasetypo.qm
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
                                                                                                                                                                • Size 334B
                                                                                                                                                                • SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                kwpsaibasetypo.qm
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
                                                                                                                                                                • Size 327B
                                                                                                                                                                • SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                element-icons.ttf
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
                                                                                                                                                                • Size 54KB
                                                                                                                                                                • SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                element-icons.woff
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
                                                                                                                                                                • Size 27KB
                                                                                                                                                                • SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                app.css
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
                                                                                                                                                                • Size 107KB
                                                                                                                                                                • SHA256 c9c5602e26393532e59391d5944a578716f3b6cad104ae20ac8caac805e52f86
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                chunk-vendors.css
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
                                                                                                                                                                • Size 279KB
                                                                                                                                                                • SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                app.js
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
                                                                                                                                                                • Size 380KB
                                                                                                                                                                • SHA256 f1bd1ffaba49fd0c0040f182231f739000b0e4bc762900ecacab4980f743b203
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                chunk-vendors.js
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
                                                                                                                                                                • Size 249KB
                                                                                                                                                                • SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                chunk-vendors.js
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
                                                                                                                                                                • Size 424KB
                                                                                                                                                                • SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                index.js
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
                                                                                                                                                                • Size 10KB
                                                                                                                                                                • SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                index.js
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
                                                                                                                                                                • Size 13KB
                                                                                                                                                                • SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                index.js
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
                                                                                                                                                                • Size 14KB
                                                                                                                                                                • SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                apm-init.js
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
                                                                                                                                                                • Size 57B
                                                                                                                                                                • SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                default_ava.svg
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
                                                                                                                                                                • Size 906B
                                                                                                                                                                • SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                desk-sync.svg
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                loading.svg
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                setup.cfg
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\cfgs\setup.cfg
                                                                                                                                                                • Size 449B
                                                                                                                                                                • SHA256 62b60d2fba63532572d6ba8301351b60af331a287bd66c40fe2095a710738094
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                ksomisc.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                                                                                                                                                                • Size 3.7MB
                                                                                                                                                                • SHA256 3342f9691125a2214c37b2a5b5fcf43ea3320d838bedd5d6343a22788c25644d
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                kwinappinstaller.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\kwinappinstaller.exe
                                                                                                                                                                • Size 29KB
                                                                                                                                                                • SHA256 3fc338363884ae614fb457c2cee699994fe097f3350271b3288915cba956aa33
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                error-net-72.png
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                presetLayout_16.pptx
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
                                                                                                                                                                • Size 41KB
                                                                                                                                                                • SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                wpscloudsvr.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpscloudsvr.exe
                                                                                                                                                                • Size 1.1MB
                                                                                                                                                                • SHA256 f5726c54eabfa893b1cebeba9c9b9731715faec9e01d137d705f70150375fdf8
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                wpsoffice.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpsoffice.exe
                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                • SHA256 c70e66e699cf1b6a61ee1c77360203cbcd4cb5f401fa390cc8eda7b7c8fa9b6b
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                install.ini
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\utility\install.ini
                                                                                                                                                                • Size 462B
                                                                                                                                                                • SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                APPX.0rnmgbxndhjxdm96ldlr_js1d.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\APPX.0rnmgbxndhjxdm96ldlr_js1d.tmp
                                                                                                                                                                • Size 4KB
                                                                                                                                                                • SHA256 322a6bbe4151c8c0d85b94a20e1566a69e7e19532fe6bb7ee4b5d806daea5366
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                APPX.0t57adw15mk685r174cqi9r8c.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\APPX.0t57adw15mk685r174cqi9r8c.tmp
                                                                                                                                                                • Size 10KB
                                                                                                                                                                • SHA256 4ffbe02e04c899246680c09ede8656f120990f57dd5172892cbc05444d9e25b3
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                APPX.5t6yyofunvu2xvbfgaortn96.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\APPX.5t6yyofunvu2xvbfgaortn96.tmp
                                                                                                                                                                • Size 712B
                                                                                                                                                                • SHA256 40206cc446612c3c79d0aae7d80976f941e05a4f31112819b7342716bae98233
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                APPX.9ogev0iq2xpnxtr4wgg772hve.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\APPX.9ogev0iq2xpnxtr4wgg772hve.tmp
                                                                                                                                                                • Size 10KB
                                                                                                                                                                • SHA256 cec20a7d5151fefc82fd0b1dd679524bf70c1015580db00eaccd95b93c303c5e
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                APPX.dh67armbvomlz01qqnt0ahscf.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\APPX.dh67armbvomlz01qqnt0ahscf.tmp
                                                                                                                                                                • Size 10KB
                                                                                                                                                                • SHA256 366478aa06db9582293152d2f1dcdc59776d2457c46299fd5652155e218bafca
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                APPX.k1i027733ct4t7tqn_418p7uh.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\APPX.k1i027733ct4t7tqn_418p7uh.tmp
                                                                                                                                                                • Size 712B
                                                                                                                                                                • SHA256 a3ca9aae4ba31a89982b18f1b929accb9db7d06a8d786f433ef5ccc667409b1d
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                APPX.ng10y5rqiv6tftq97ul3391vd.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\APPX.ng10y5rqiv6tftq97ul3391vd.tmp
                                                                                                                                                                • Size 712B
                                                                                                                                                                • SHA256 7310eb8c9a5115a236fe0f5b2a40386c478b4a1c8de6c16aa20363d4beaa2659
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                APPX.o4vj4oqqw8up939gfzfzkipxd.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\APPX.o4vj4oqqw8up939gfzfzkipxd.tmp
                                                                                                                                                                • Size 4KB
                                                                                                                                                                • SHA256 9d2f34f1b17536dd689db858d42c85a78cb48ccf24f55fd578699dd1cbd7c930
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                APPX.whnuyq18i3027tofc_jalxvad.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\APPX.whnuyq18i3027tofc_jalxvad.tmp
                                                                                                                                                                • Size 4KB
                                                                                                                                                                • SHA256 81c968c375f69d9e4666901fd4c14a6ce4b738639ff78488562e2c79f8fb14d8
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Qt5CoreKso.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\CONTROL\office6\Qt5CoreKso.dll
                                                                                                                                                                • Size 5.7MB
                                                                                                                                                                • SHA256 ae105320fafecbdf6e26a3c2ac51bff164ed60e2c80d7c2a909f7c8abf350d21
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Qt5GuiKso.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\CONTROL\office6\Qt5GuiKso.dll
                                                                                                                                                                • Size 6.4MB
                                                                                                                                                                • SHA256 62bb5bae4f0cd7cd7776471bf93cb00601badaded78a1d6978b085a38d9a5ac7
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Qt5SvgKso.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\CONTROL\office6\Qt5SvgKso.dll
                                                                                                                                                                • Size 503KB
                                                                                                                                                                • SHA256 399cd93775185a1a0db67abebd302d8f227e3e17f8e42836a297ba148d4a6ec9
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Qt5WidgetsKso.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\CONTROL\office6\Qt5WidgetsKso.dll
                                                                                                                                                                • Size 5.6MB
                                                                                                                                                                • SHA256 44cd4abc65e8c79047182c2f1846cc554acd01836445b3e3ce51483bab103c86
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Qt5WinExtrasKso.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\CONTROL\office6\Qt5WinExtrasKso.dll
                                                                                                                                                                • Size 251KB
                                                                                                                                                                • SHA256 ac783be33b205c69a7d77191bc5f4af8aae1ec0e86ac861e1ee2649a06cf0e5a
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                kpacketui.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\CONTROL\office6\kpacketui.dll
                                                                                                                                                                • Size 699KB
                                                                                                                                                                • SHA256 64037be52e7e91ed511e278834867fd3f5481efd8620f88d94ad6371f021d5e5
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                msvcp140.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\CONTROL\office6\msvcp140.dll
                                                                                                                                                                • Size 544KB
                                                                                                                                                                • SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                qsvgicon.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
                                                                                                                                                                • Size 75KB
                                                                                                                                                                • SHA256 49c19cd06a911fc42ed256d1691243e20dde7596fc9a19ea71a29f261d1f823a
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                qsvg.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
                                                                                                                                                                • Size 46KB
                                                                                                                                                                • SHA256 a81f7b0fcde9820fe96471746854a7a1f5100f53adb71da30e6c14fe35f5774d
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                qskia.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\CONTROL\office6\qt\plugins\platforms\qskia.dll
                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                • SHA256 ed2434466d697329e29941aea13b87bf104679652c7c33bd1b358b6fd623ae67
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                qwindows.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\CONTROL\office6\qt\plugins\platforms\qwindows.dll
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 85a5998534e16d1eba7f151395e8e892c16a4c30468236a636e1da213d27e37d
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                qwindowsvistastyle.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
                                                                                                                                                                • Size 159KB
                                                                                                                                                                • SHA256 28b753795101ece7c933d4d47130f51f2b7de8635ba154eaa03ebc82f8cc9f78
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                ucrtbase.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\CONTROL\office6\ucrtbase.dll
                                                                                                                                                                • Size 987KB
                                                                                                                                                                • SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                vcruntime140.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\CONTROL\office6\vcruntime140.dll
                                                                                                                                                                • Size 121KB
                                                                                                                                                                • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                vcruntime140_1.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\CONTROL\office6\vcruntime140_1.dll
                                                                                                                                                                • Size 48KB
                                                                                                                                                                • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                style.xml
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\CONTROL\pl_PL\style.xml
                                                                                                                                                                • Size 3KB
                                                                                                                                                                • SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                product.dat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\CONTROL\product.dat
                                                                                                                                                                • Size 79KB
                                                                                                                                                                • SHA256 864381c3016e55b25aea9ae26d8fffdef73765fd46f4236be41362d6f65a7f3e
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                product_new.dat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\CONTROL\product_new.dat
                                                                                                                                                                • Size 72KB
                                                                                                                                                                • SHA256 8b8908a5a2964c840f954bbfd59679fb684c3bc3aee98332b28d5eda76bd5db7
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                style.xml
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e59fc29\CONTROL\vi_VN\style.xml
                                                                                                                                                                • Size 4KB
                                                                                                                                                                • SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                tempinstall.ini
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                                                                                                                                                                • Size 387B
                                                                                                                                                                • SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                tempinstall.ini
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                                                                                                                                                                • Size 433B
                                                                                                                                                                • SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                ksomisc_2026_07_02.log
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_07_02.log
                                                                                                                                                                • Size 3KB
                                                                                                                                                                • SHA256 3c3b12756c01a0cec77e19a70c3c8e110ee4e9a58f1e4e0fce7606d6eb8ef012
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                ksomisc_2026_07_02.log
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_07_02.log
                                                                                                                                                                • Size 5KB
                                                                                                                                                                • SHA256 91d5b3ee59ca9bcf558d28430d9ed6955a90304f373da963157b92918d9010e1
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                wpssetup.log
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                                                • Size 10KB
                                                                                                                                                                • SHA256 99490fd41bcfcfe31096cd7cd8cf5f89cca34d742caed8f276ca9bf08049970b
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                wpssetup.log
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                                                • Size 11KB
                                                                                                                                                                • SHA256 f2e0f594e55f91b09e0506acdd7dfa918bed86f41e4b671d76be39ee8518c4f3
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                wpssetup.log
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                                                • Size 26KB
                                                                                                                                                                • SHA256 47f75e38b3be8b32b63aa89c3ce75c8d9fa30e0db762579f58191d830690322b
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                wpssetup.log
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                                                • Size 59KB
                                                                                                                                                                • SHA256 c288237dd389828439f6ee84ecdf45747ad794b76f04490585838dcee553f7d4
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                mdbx.dat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-x64\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat
                                                                                                                                                                • Size 64KB
                                                                                                                                                                • SHA256 04b02494cb0280c0b1c279d7582a1f21419fdc1e7ec71c5fd02c972a9ecba1c6
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                dcsdk_dpv3.data
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
                                                                                                                                                                • Size 41KB
                                                                                                                                                                • SHA256 311b70370bf1df44607e3278aad3ff149d0cae01e24b9524994de44eeda2b8f6
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                dcsdk_dpv3.data
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
                                                                                                                                                                • Size 41KB
                                                                                                                                                                • SHA256 fbfdd2422191cb900c9a4a804f67901ebb467644eb1e19bf1cca04e362a6fd68
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                download.7z
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kqingaccountsdk_3.1.0.590\download.7z
                                                                                                                                                                • Size 2.8MB
                                                                                                                                                                • SHA256 453d89bcaaf3a286e964ebe65ac8fe3f42cadf2ece863a95e2b7a9eb8d75b947
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                close.png
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kqingaccountsdk_3.1.0.590\resource\vippayment\assist\close.png
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 bcd8c6d489d395d55c672d71d63670c683299d7b909373a18fc8ad239118874c
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                json2.js
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kqingaccountsdk_3.1.0.590\resource\vippayment\assist\json2.js
                                                                                                                                                                • Size 17KB
                                                                                                                                                                • SHA256 7e35a128a3995615056c6cf0ac6acdd8c573d311ea7eb77944a38b0cc249a48c
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                loading.gif
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kqingaccountsdk_3.1.0.590\resource\vippayment\assist\loading.gif
                                                                                                                                                                • Size 2KB
                                                                                                                                                                • SHA256 9a437409d5a4393137aaa5e4152e4737e0df91354bd574afa13cfa9c2940d6d6
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                loading.svg
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps_intl\addons\pool\win-x64\kqingaccountsdk_3.1.0.590\resource\vippayment\main\img\loading.svg
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 a3df9710c7e09fd8cffc14bfe45f5a1576deb1846ced44e5050b34caf5527049
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                perfhost.exe
                                                                                                                                                                • Path C:\Windows\SysWOW64\perfhost.exe
                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                • SHA256 4ff25b220b8b61298689e51edefa91a6ef03980c46c29b2645f0924adbdde80c
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                AgentService.exe
                                                                                                                                                                • Path C:\Windows\System32\AgentService.exe
                                                                                                                                                                • Size 1.4MB
                                                                                                                                                                • SHA256 00b3656d70e5dfa02d280a0c6ef8a202e3404cf8cd57fb3879e7c975eb85d778
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                ssh-agent.exe
                                                                                                                                                                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                • SHA256 84065a6064a932ed73fbe53f95b1732fa49b3d594079f808eab6830bd2954480
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                PerceptionSimulationService.exe
                                                                                                                                                                • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                                                                                                                                                • Size 1.4MB
                                                                                                                                                                • SHA256 e89d929c52c5bd599af222bb9df2ea612a7524d33403bc488c0015c11e048e76
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                ReFsDedupSvc.exe
                                                                                                                                                                • Path C:\Windows\System32\ReFsDedupSvc.exe
                                                                                                                                                                • Size 2.6MB
                                                                                                                                                                • SHA256 e3b718cc1e12bcef920c13940bc815368ddfc8567adb167b27ec6023d520e6aa
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                SearchIndexer.exe
                                                                                                                                                                • Path C:\Windows\System32\SearchIndexer.exe
                                                                                                                                                                • Size 1.4MB
                                                                                                                                                                • SHA256 7dee3b2d228f8f67a227924c06b8ebb0c1955f98484d85c53bb250300f24eb86
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                SensorDataService.exe
                                                                                                                                                                • Path C:\Windows\System32\SensorDataService.exe
                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                • SHA256 3faa5af47e370cd277975a2aedeb28246ac12c9a5b66869d2f87e049c649e36d
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                AppVClient.exe
                                                                                                                                                                • Path C:\Windows\system32\AppVClient.exe
                                                                                                                                                                • Size 1.3MB
                                                                                                                                                                • SHA256 06de73e3c36b1aba7a17c68e96a0ce9984c38e0d2213465f4f30f33068d9c3cf
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                SgrmBroker.exe
                                                                                                                                                                • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 77436b9126746c8849f4cd15476afdafa50e86189d2c06c05d09373dde0ba20f
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                memory/544-59-0x0000000000CE0000-0x0000000000D40000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/544-63-0x0000000140000000-0x0000000140214000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/544-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/544-40-0x0000000140000000-0x0000000140214000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1104-277-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1104-316-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1104-82-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1104-89-0x0000000000730000-0x0000000000790000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1104-83-0x0000000000730000-0x0000000000790000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1104-315-0x0000000000730000-0x0000000000790000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1104-314-0x0000000000730000-0x0000000000790000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1348-872-0x00007FF844C40000-0x00007FF8451CE000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1676-8664-0x00007FF842CB0000-0x00007FF842DF4000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1676-8665-0x00007FF8423B0000-0x00007FF84293E000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1676-8663-0x00007FF842E00000-0x00007FF843A4E000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1676-8662-0x00007FF63B080000-0x00007FF63B42E000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1680-8558-0x00007FF8277B0000-0x00007FF8277C0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1680-8561-0x00007FF8277B0000-0x00007FF8277C0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1680-8564-0x00007FF8277B0000-0x00007FF8277C0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1680-8556-0x00007FF8277B0000-0x00007FF8277C0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1680-8557-0x00007FF8277B0000-0x00007FF8277C0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1680-8559-0x00007FF8277B0000-0x00007FF8277C0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1680-8560-0x00007FF8277B0000-0x00007FF8277C0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1680-8562-0x00007FF8277B0000-0x00007FF8277C0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1680-8563-0x00007FF8277B0000-0x00007FF8277C0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1680-8565-0x00007FF8277B0000-0x00007FF8277C0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1680-8555-0x00007FF829960000-0x00007FF829970000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1680-8554-0x00007FF63B080000-0x00007FF63B42E000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1680-8553-0x00007FF8423B0000-0x00007FF842FFE000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1680-8552-0x00007FF843370000-0x00007FF8438FE000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1680-8551-0x00007FF843900000-0x00007FF843A44000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1876-260-0x0000000000400000-0x00000000005D6000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1876-79-0x0000000000400000-0x00000000005D6000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1988-53-0x0000000000870000-0x00000000008D0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1988-51-0x0000000140000000-0x000000014020E000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1988-61-0x0000000000870000-0x00000000008D0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1988-187-0x0000000140000000-0x000000014020E000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2372-8633-0x00007FF63B080000-0x00007FF63B42E000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2372-8636-0x00007FF8423B0000-0x00007FF84293E000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2372-8667-0x00007FF83A490000-0x00007FF83BF27000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2372-8635-0x00007FF842CB0000-0x00007FF842DF4000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2372-8634-0x00007FF842E00000-0x00007FF843A4E000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2372-8654-0x00007FF83BF30000-0x00007FF83DC30000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2372-8669-0x00007FF838B10000-0x00007FF839529000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3496-9395-0x0000000002A90000-0x0000000002A9A000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3496-9396-0x0000000002C10000-0x0000000002C36000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3496-9375-0x00000000006D0000-0x00000000006D8000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3928-35-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3928-36-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3928-29-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3928-28-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3928-135-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4404-8611-0x00007FF842E00000-0x00007FF843A4E000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4404-8669-0x00007FF838B10000-0x00007FF839529000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4404-8610-0x00007FF842CB0000-0x00007FF842DF4000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4404-8613-0x00007FF63B080000-0x00007FF63B42E000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4404-8612-0x00007FF8423B0000-0x00007FF84293E000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4404-8668-0x00007FF83A490000-0x00007FF83BF27000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4404-8638-0x00007FF83BF30000-0x00007FF83DC30000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4768-7-0x0000000000E70000-0x0000000000ED7000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4768-6-0x0000000000E70000-0x0000000000ED7000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4768-5-0x0000000000400000-0x00000000009C1000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4768-78-0x0000000000400000-0x00000000009C1000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4768-0-0x0000000000E70000-0x0000000000ED7000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5076-74-0x0000000000780000-0x00000000007E0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5076-66-0x0000000140000000-0x000000014020A000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5076-68-0x0000000000780000-0x00000000007E0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5076-225-0x0000000140000000-0x000000014020A000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5264-8582-0x00007FF842CB0000-0x00007FF842DF4000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5264-8598-0x00007FF83BF30000-0x00007FF83DC30000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5264-8583-0x00007FF8423B0000-0x00007FF84293E000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5264-8581-0x00007FF842E00000-0x00007FF843A4E000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5264-8580-0x00007FF63B080000-0x00007FF63B42E000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5316-310-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5316-96-0x00000000007B0000-0x0000000000810000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5316-102-0x00000000007B0000-0x0000000000810000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5316-95-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5316-292-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5316-309-0x00000000007B0000-0x0000000000810000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5420-121-0x0000000000BF0000-0x0000000000C50000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5420-131-0x0000000000BF0000-0x0000000000C50000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5420-127-0x0000000000BF0000-0x0000000000C50000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5420-133-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5420-120-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5432-15-0x0000000000CE0000-0x0000000000D40000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5432-94-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5432-23-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5432-24-0x0000000000CE0000-0x0000000000D40000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5932-144-0x0000000000620000-0x0000000000680000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5932-138-0x0000000000620000-0x0000000000680000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5932-137-0x0000000140000000-0x0000000140172000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5932-311-0x0000000140000000-0x0000000140172000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/6008-115-0x0000000000C40000-0x0000000000CA0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/6008-304-0x0000000140000000-0x000000014027D000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/6008-109-0x0000000000C40000-0x0000000000CA0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/6008-107-0x0000000140000000-0x000000014027D000-memory.dmp
                                                                                                                                                                Download