Overview

overview

7

Static

static

3

2026-07-05...ca.exe

windows10-2004-x64

7

2026-07-05...ca.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    92s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 13:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_97e2c437b93e125ea7067006fa7617c6_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
  • Size 5.7MB
  • Sample260705-qagblacw5s
  • SHA256 a58b42241f1a8bd88f19242beb3e74fa72b24b4507bce86e3745aaa84eaee940
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdefense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 44 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 2 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 41 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 64 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 26 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 63 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3700
      • C:\Users\Admin\AppData\Local\Temp\2026-07-05_97e2c437b93e125ea7067006fa7617c6_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-07-05_97e2c437b93e125ea7067006fa7617c6_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"
        2⤵
        • Writes to the Master Boot Record (MBR)
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3676
        • C:\ProgramData\WPS\Installers\34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1304.exe
          "C:\ProgramData\WPS\Installers\34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1304.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Writes to the Master Boot Record (MBR)
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2940
          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -checkInstallEnvironment
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            PID:12672
          • C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
            "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService
            4⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            PID:7996
          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -addFirewallRule
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:4560
          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wpsoffice.exe
            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wpsoffice.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=klangmanager -dll_name=klangmanager.dll downloadlang en_US
            4⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:6196
          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regmtfont
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:7200
          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\\office6\ksomisc.exe" -setappcap
            4⤵
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:7560
          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -sendinstalldyn 5
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:13956
          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regPreviewHandler wps.exe et.exe wpp.exe
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:13992
          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\\office6\ksomisc.exe" -registerqingshellext 1
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:12836
            • C:\Windows\system32\regsvr32.exe
              "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingshellext64.dll"
              5⤵
              • Modifies system executable filetype association
              PID:8776
          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regkwpsshellext admin
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:8912
            • C:\Windows\system32\regsvr32.exe
              "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\kwpsshellext64.dll"
              5⤵
                PID:9312
            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\kwinappinstaller.exe
              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\kwinappinstaller.exe" -i "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\menuext" wpsappext1 wpsappext2 wpsappext3
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:9508
            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regqingdriveshellext_install
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious use of SetWindowsHookEx
              PID:10528
              • C:\Windows\system32\regsvr32.exe
                "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*install "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
                5⤵
                  PID:4556
                • C:\Windows\system32\regsvr32.exe
                  "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*thumbnail "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
                  5⤵
                    PID:10828
                  • C:\Windows\system32\regsvr32.exe
                    "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*drivebho "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
                    5⤵
                      PID:10884
                    • C:\Windows\system32\regsvr32.exe
                      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
                      5⤵
                        PID:5304
                      • C:\Windows\system32\regsvr32.exe
                        "C:\Windows\system32\regsvr32.exe" /s /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
                        5⤵
                          PID:11064
                        • C:\Windows\system32\regsvr32.exe
                          "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*onlinefile "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
                          5⤵
                            PID:10180
                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regpdfwspv
                          4⤵
                            PID:9136
                            • C:\Windows\system32\regsvr32.exe
                              "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\pdfwspv\pdfwspv.dll"
                              5⤵
                                PID:3864
                              • C:\Windows\system32\regsvr32.exe
                                "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\pdfwspv\pdfwspv.dll"
                                5⤵
                                  PID:5520
                                • C:\Windows\system32\regsvr32.exe
                                  "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\pdfwspv\pdfwspv.dll"
                                  5⤵
                                    PID:6252
                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\\office6\ksomisc.exe" -setappcap
                                  4⤵
                                    PID:9156
                                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\\office6\ksomisc.exe" -assoepub -source=1
                                    4⤵
                                      PID:5060
                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -clearmso2pdfplugins
                                      4⤵
                                        PID:6924
                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -uninstalldatarecover
                                        4⤵
                                          PID:9552
                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -collectmsoinfo 5
                                          4⤵
                                            PID:11644
                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\\office6\ksomisc.exe" -assopic_whitelist -type=setup
                                            4⤵
                                              PID:1104
                                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regmso2pdfplugins
                                              4⤵
                                                PID:9188
                                                • C:\Windows\system32\regsvr32.exe
                                                  "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
                                                  5⤵
                                                    PID:7252
                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                      /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
                                                      6⤵
                                                        PID:12164
                                                    • C:\Windows\system32\regsvr32.exe
                                                      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
                                                      5⤵
                                                        PID:1936
                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regPreviewHandler wps.exe et.exe wpp.exe
                                                      4⤵
                                                        PID:6636
                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\\office6\ksomisc.exe" -defragment
                                                        4⤵
                                                          PID:10852
                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -unregisterwpsphotoautoasso
                                                          4⤵
                                                            PID:14100
                                                      • C:\ProgramData\WPS\Installers\34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1304.exe
                                                        "C:\ProgramData\WPS\Installers\34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1304.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E591F75 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Writes to the Master Boot Record (MBR)
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2544
                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -setlng en_US
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Modifies system certificate store
                                                          • Suspicious behavior: AddClipboardFormatListener
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:12908
                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -getonlineparam 00601.00001304 -forceperusermode
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Writes to the Master Boot Record (MBR)
                                                          • Modifies system certificate store
                                                          • Suspicious behavior: AddClipboardFormatListener
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3356
                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -getabtest -forceperusermode
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Modifies system certificate store
                                                          • Suspicious behavior: AddClipboardFormatListener
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:8884
                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -fixoldversionassostatus
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Suspicious behavior: AddClipboardFormatListener
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:9324
                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -setservers
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Suspicious behavior: AddClipboardFormatListener
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3192
                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -register
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Modifies registry class
                                                          • Suspicious behavior: AddClipboardFormatListener
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of SetWindowsHookEx
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:6216
                                                          • C:\Windows\system32\regsvr32.exe
                                                            "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
                                                            4⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:12056
                                                            • C:\Windows\SysWOW64\regsvr32.exe
                                                              /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
                                                              5⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2000
                                                          • C:\Windows\system32\regsvr32.exe
                                                            "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
                                                            4⤵
                                                              PID:6876
                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regprogid true
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Modifies registry class
                                                            • Suspicious behavior: AddClipboardFormatListener
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1868
                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -assowordexcelpowerpnt 1 1 1 -source=1
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Modifies registry class
                                                            • Suspicious behavior: AddClipboardFormatListener
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:8084
                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -compatiblemso -source=1
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Modifies registry class
                                                            • Suspicious behavior: AddClipboardFormatListener
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:7872
                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -checkcompatiblemso
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Suspicious behavior: AddClipboardFormatListener
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:9436
                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -saveas_mso
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Suspicious behavior: AddClipboardFormatListener
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:9924
                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -distsrc 00601.00001304
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Suspicious behavior: AddClipboardFormatListener
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:13548
                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode -source=1
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Network Service Discovery
                                                            • Suspicious behavior: AddClipboardFormatListener
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of SetWindowsHookEx
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:13964
                                                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
                                                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk" 5386
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:10288
                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -addcontextmenushellnew
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Suspicious behavior: AddClipboardFormatListener
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:14008
                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regvascontextmenushellnew
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Suspicious behavior: AddClipboardFormatListener
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:14156
                                                          • C:\Windows\system32\regsvr32.exe
                                                            "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kdesktopshellext\kdesktopshellext.dll"
                                                            3⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:9568
                                                            • C:\Windows\SysWOW64\regsvr32.exe
                                                              /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kdesktopshellext\kdesktopshellext.dll"
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:9600
                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regyunpanfornew -forceperusermode
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Suspicious behavior: AddClipboardFormatListener
                                                            • Suspicious use of SetWindowsHookEx
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:9632
                                                            • C:\Windows\system32\regsvr32.exe
                                                              "C:\Windows\system32\regsvr32.exe" /s /u /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
                                                              4⤵
                                                                PID:10008
                                                              • C:\Windows\system32\regsvr32.exe
                                                                "C:\Windows\system32\regsvr32.exe" /s /u /n /i:overlayicon "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
                                                                4⤵
                                                                  PID:10080
                                                                • C:\Windows\system32\regsvr32.exe
                                                                  "C:\Windows\system32\regsvr32.exe" /s /u /n /i:contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
                                                                  4⤵
                                                                    PID:10100
                                                                  • C:\Windows\system32\regsvr32.exe
                                                                    "C:\Windows\system32\regsvr32.exe" /s /u /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"
                                                                    4⤵
                                                                      PID:10260
                                                                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -setup_assopdf -source=1
                                                                    3⤵
                                                                      PID:13884
                                                                      • C:\Windows\System32\openwith.exe
                                                                        "C:\Windows\System32\openwith.exe"
                                                                        4⤵
                                                                          PID:13104
                                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -assofdf -source=1
                                                                        3⤵
                                                                          PID:5768
                                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -externaltask create -forceperusermode
                                                                          3⤵
                                                                            PID:3780
                                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createsubmodulelink desktop prometheus -source=1
                                                                            3⤵
                                                                              PID:6536
                                                                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createsubmodulelink startmenu prometheus -source=1
                                                                              3⤵
                                                                                PID:6920
                                                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -assoofd -source=1
                                                                                3⤵
                                                                                  PID:6584
                                                                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -assoopg -source=1
                                                                                  3⤵
                                                                                    PID:7668
                                                                                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regcadfileasso
                                                                                    3⤵
                                                                                      PID:2616
                                                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regemailfileasso
                                                                                      3⤵
                                                                                        PID:8104
                                                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regarchivefileasso
                                                                                        3⤵
                                                                                          PID:7988
                                                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -installbrowserextensionhost
                                                                                          3⤵
                                                                                            PID:4280
                                                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regvideoeditsetupfileasso
                                                                                            3⤵
                                                                                              PID:4424
                                                                                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regemmxfileasso
                                                                                              3⤵
                                                                                                PID:13484
                                                                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regeddxfileasso
                                                                                                3⤵
                                                                                                  PID:10320
                                                                                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regposfileasso
                                                                                                  3⤵
                                                                                                    PID:13820
                                                                                                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regxmindfileasso
                                                                                                    3⤵
                                                                                                      PID:1232
                                                                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regvsdfileasso
                                                                                                      3⤵
                                                                                                        PID:10700
                                                                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -repair3rdlink
                                                                                                        3⤵
                                                                                                          PID:11040
                                                                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createexternstartmenu "WPS Office"
                                                                                                          3⤵
                                                                                                            PID:10952
                                                                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -rebuildicon
                                                                                                            3⤵
                                                                                                              PID:10896
                                                                                                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -addJsapiCert
                                                                                                              3⤵
                                                                                                                PID:12328
                                                                                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -updateskiaconfig
                                                                                                                3⤵
                                                                                                                  PID:9788
                                                                                                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createsubmodulelink desktop pdf -source=1
                                                                                                                  3⤵
                                                                                                                    PID:1080
                                                                                                                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createsubmodulelink startmenu pdf -source=1
                                                                                                                    3⤵
                                                                                                                      PID:7372
                                                                                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createsubmodulelink startmenu wps -source=1
                                                                                                                      3⤵
                                                                                                                        PID:9044
                                                                                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createsubmodulelink startmenu et -source=1
                                                                                                                        3⤵
                                                                                                                          PID:6764
                                                                                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createsubmodulelink startmenu wpp -source=1
                                                                                                                          3⤵
                                                                                                                            PID:7028
                                                                                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createsubmodulelink desktop pdf -source=1
                                                                                                                            3⤵
                                                                                                                              PID:12232
                                                                                                                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regpersistprintmenu
                                                                                                                              3⤵
                                                                                                                                PID:6340
                                                                                                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -pintostartscreen -source=1
                                                                                                                                3⤵
                                                                                                                                  PID:6528
                                                                                                                                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Office.lnk" 51609
                                                                                                                                    4⤵
                                                                                                                                      PID:6488
                                                                                                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk" 51609
                                                                                                                                      4⤵
                                                                                                                                        PID:11444
                                                                                                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Docs.lnk" 51609
                                                                                                                                        4⤵
                                                                                                                                          PID:4164
                                                                                                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Slides.lnk" 51609
                                                                                                                                          4⤵
                                                                                                                                            PID:4772
                                                                                                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Sheets.lnk" 51609
                                                                                                                                            4⤵
                                                                                                                                              PID:2712
                                                                                                                                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk" 51609
                                                                                                                                              4⤵
                                                                                                                                                PID:8008
                                                                                                                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Docs.lnk" 51606
                                                                                                                                                4⤵
                                                                                                                                                  PID:8108
                                                                                                                                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Slides.lnk" 51606
                                                                                                                                                  4⤵
                                                                                                                                                    PID:3880
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Sheets.lnk" 51606
                                                                                                                                                    4⤵
                                                                                                                                                      PID:4132
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk" 51606
                                                                                                                                                      4⤵
                                                                                                                                                        PID:9920
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:5972
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:4112
                                                                                                                                                • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                  "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:3840
                                                                                                                                                • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                                                                                  "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:3944
                                                                                                                                                • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                                                                                                                  C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:4876
                                                                                                                                                • C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                  C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:1748
                                                                                                                                                • C:\Windows\System32\ReFsDedupSvc.exe
                                                                                                                                                  C:\Windows\System32\ReFsDedupSvc.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:5796
                                                                                                                                                • C:\Windows\System32\SensorDataService.exe
                                                                                                                                                  C:\Windows\System32\SensorDataService.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                  PID:2444
                                                                                                                                                • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                                                                                                                  C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:2856
                                                                                                                                                • C:\Windows\system32\AgentService.exe
                                                                                                                                                  C:\Windows\system32\AgentService.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:4416
                                                                                                                                                • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                                  C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                  PID:2636
                                                                                                                                                  • C:\Windows\System32\SearchProtocolHost.exe
                                                                                                                                                    "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3865087520-2734723108-1233268525-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3865087520-2734723108-1233268525-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3116
                                                                                                                                                    • C:\Windows\System32\SearchProtocolHost.exe
                                                                                                                                                      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                                      2⤵
                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                      PID:4108
                                                                                                                                                    • C:\Windows\System32\SearchFilterHost.exe
                                                                                                                                                      "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2852 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
                                                                                                                                                      2⤵
                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                      PID:6112
                                                                                                                                                    • C:\Windows\System32\SearchFilterHost.exe
                                                                                                                                                      "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2912 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
                                                                                                                                                      2⤵
                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                      PID:2688
                                                                                                                                                  • C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
                                                                                                                                                    "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
                                                                                                                                                    1⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:6584
                                                                                                                                                  • C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
                                                                                                                                                    "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
                                                                                                                                                    1⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:9536
                                                                                                                                                  • C:\Windows\system32\userinit.exe
                                                                                                                                                    C:\Windows\system32\userinit.exe
                                                                                                                                                    1⤵
                                                                                                                                                      PID:10972
                                                                                                                                                      • C:\Windows\Explorer.EXE
                                                                                                                                                        C:\Windows\Explorer.EXE
                                                                                                                                                        2⤵
                                                                                                                                                          PID:10628
                                                                                                                                                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                        1⤵
                                                                                                                                                          PID:2228
                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                          1⤵
                                                                                                                                                            PID:11464
                                                                                                                                                          • C:\Windows\system32\userinit.exe
                                                                                                                                                            C:\Windows\system32\userinit.exe
                                                                                                                                                            1⤵
                                                                                                                                                              PID:2852
                                                                                                                                                              • C:\Windows\Explorer.EXE
                                                                                                                                                                C:\Windows\Explorer.EXE
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:2040
                                                                                                                                                              • C:\Windows\system32\userinit.exe
                                                                                                                                                                C:\Windows\system32\userinit.exe
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:8052
                                                                                                                                                                  • C:\Windows\Explorer.EXE
                                                                                                                                                                    C:\Windows\Explorer.EXE
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:7760
                                                                                                                                                                  • C:\Windows\system32\userinit.exe
                                                                                                                                                                    C:\Windows\system32\userinit.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:5824
                                                                                                                                                                      • C:\Windows\Explorer.EXE
                                                                                                                                                                        C:\Windows\Explorer.EXE
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:9976

                                                                                                                                                                      Network

                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                            Reconnaissance

                                                                                                                                                                            Resource Development

                                                                                                                                                                            Initial Access

                                                                                                                                                                            Execution

                                                                                                                                                                            Persistence

                                                                                                                                                                            Event Triggered Execution

                                                                                                                                                                            2
                                                                                                                                                                            T1546

                                                                                                                                                                            Change Default File Association

                                                                                                                                                                            1
                                                                                                                                                                            T1546.001

                                                                                                                                                                            Component Object Model Hijacking

                                                                                                                                                                            1
                                                                                                                                                                            T1546.015

                                                                                                                                                                            Pre-OS Boot

                                                                                                                                                                            1
                                                                                                                                                                            T1542

                                                                                                                                                                            Bootkit

                                                                                                                                                                            1
                                                                                                                                                                            T1542.003

                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                            Event Triggered Execution

                                                                                                                                                                            2
                                                                                                                                                                            T1546

                                                                                                                                                                            Change Default File Association

                                                                                                                                                                            1
                                                                                                                                                                            T1546.001

                                                                                                                                                                            Component Object Model Hijacking

                                                                                                                                                                            1
                                                                                                                                                                            T1546.015

                                                                                                                                                                            Defense Evasion

                                                                                                                                                                            Modify Registry

                                                                                                                                                                            2
                                                                                                                                                                            T1112

                                                                                                                                                                            Pre-OS Boot

                                                                                                                                                                            1
                                                                                                                                                                            T1542

                                                                                                                                                                            Bootkit

                                                                                                                                                                            1
                                                                                                                                                                            T1542.003

                                                                                                                                                                            Subvert Trust Controls

                                                                                                                                                                            1
                                                                                                                                                                            T1553

                                                                                                                                                                            Install Root Certificate

                                                                                                                                                                            1
                                                                                                                                                                            T1553.004

                                                                                                                                                                            Credential Access

                                                                                                                                                                            Credentials from Password Stores

                                                                                                                                                                            1
                                                                                                                                                                            T1555

                                                                                                                                                                            Credentials from Web Browsers

                                                                                                                                                                            1
                                                                                                                                                                            T1555.003

                                                                                                                                                                            Unsecured Credentials

                                                                                                                                                                            1
                                                                                                                                                                            T1552

                                                                                                                                                                            Credentials In Files

                                                                                                                                                                            1
                                                                                                                                                                            T1552.001

                                                                                                                                                                            Discovery

                                                                                                                                                                            Network Service Discovery

                                                                                                                                                                            1
                                                                                                                                                                            T1046

                                                                                                                                                                            Peripheral Device Discovery

                                                                                                                                                                            2
                                                                                                                                                                            T1120

                                                                                                                                                                            Query Registry

                                                                                                                                                                            4
                                                                                                                                                                            T1012

                                                                                                                                                                            System Information Discovery

                                                                                                                                                                            5
                                                                                                                                                                            T1082

                                                                                                                                                                            System Location Discovery

                                                                                                                                                                            1
                                                                                                                                                                            T1614

                                                                                                                                                                            System Language Discovery

                                                                                                                                                                            1
                                                                                                                                                                            T1614.001

                                                                                                                                                                            Lateral Movement

                                                                                                                                                                            Collection

                                                                                                                                                                            Data from Local System

                                                                                                                                                                            1
                                                                                                                                                                            T1005

                                                                                                                                                                            Command and Control

                                                                                                                                                                            Exfiltration

                                                                                                                                                                            Impact

                                                                                                                                                                            Replay Monitor

                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                            Downloads

                                                                                                                                                                            elevation_service.exe
                                                                                                                                                                            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                            • Size 2.7MB
                                                                                                                                                                            • SHA256 2efd38edb04481bdec688b9d962aab89adb1f413a415e8ee336928bc8a79d088
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            maintenanceservice.exe
                                                                                                                                                                            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                                            • Size 1.4MB
                                                                                                                                                                            • SHA256 cd8cc9e49edc0861c037752a2cd40befb8bf18a4d56c99a9c6838ecb078991b2
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            OSE.EXE
                                                                                                                                                                            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                                                                                                            • Size 1.4MB
                                                                                                                                                                            • SHA256 89ae2da74fa361c66015067e0650af4c6527643fda16d3df5c59a11f8b8ba084
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            elevation_service.exe
                                                                                                                                                                            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                            • Size 2.8MB
                                                                                                                                                                            • SHA256 87ebd2ed0008bca4bf02be8301df1ffd70315d2a088531d0eba37a333f238215
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Windows.db
                                                                                                                                                                            • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                                                                                                                                                                            • Size 1.2MB
                                                                                                                                                                            • SHA256 6e8825856121d7ae06a7364725e623caf423821d44ce13a407a17e158cdff1a1
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Windows.db-wal
                                                                                                                                                                            • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                                                                                                                                                                            • Size 325KB
                                                                                                                                                                            • SHA256 a9e5ceef0b1408229c2e1a991c0df305e11f8c678ab72e134e27499a333d028d
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                                                                            • Size 727B
                                                                                                                                                                            • SHA256 c989977210ee00da435c45ebe3f20465ee27a90e8e8eefbc2139ed7e33ff6c92
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                            • Size 727B
                                                                                                                                                                            • SHA256 6c763e720f5cb77044eeabb5c55a774dd33b41361a7094a7242576c775c39b8b
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                                                                            • Size 404B
                                                                                                                                                                            • SHA256 4bfd3902597d68b5c70063b57becc1848729c4e8780f2d5caf2722decfada2b2
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                            • Size 412B
                                                                                                                                                                            • SHA256 17aa5c6ebd0204a3d36814b5912a939325db165e0844596b34f3646ee8226fdb
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Qt5NetworkKso.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\Qt5NetworkKso.dll
                                                                                                                                                                            • Size 1.4MB
                                                                                                                                                                            • SHA256 3a0a4fdf72e953e2d7712da7506c45bfbf1ca1ead3f1e3c1ea8d1983f82f2ccd
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            logo-small.png
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\StartScreenTile\ksolaunch\logo-small.png
                                                                                                                                                                            • Size 6KB
                                                                                                                                                                            • SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            logo.png
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\StartScreenTile\ksolaunch\logo.png
                                                                                                                                                                            • Size 12KB
                                                                                                                                                                            • SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            run.ini
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\ketaidataanalysis\webview\run.ini
                                                                                                                                                                            • Size 171B
                                                                                                                                                                            • SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            index.html
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kpubaigcbox\res\dist\index.html
                                                                                                                                                                            • Size 636B
                                                                                                                                                                            • SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            index.js
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kpubaigcbox\res\dist\index.js
                                                                                                                                                                            • Size 2KB
                                                                                                                                                                            • SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            errPage.html
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
                                                                                                                                                                            • Size 7KB
                                                                                                                                                                            • SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            favicon.ico
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            run.ini
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kwebpromehelp\run.ini
                                                                                                                                                                            • Size 226B
                                                                                                                                                                            • SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            close-secondary.svg
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
                                                                                                                                                                            • Size 216B
                                                                                                                                                                            • SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            kwpsaibasetypo.qm
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
                                                                                                                                                                            • Size 334B
                                                                                                                                                                            • SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            kwpsaibasetypo.qm
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
                                                                                                                                                                            • Size 327B
                                                                                                                                                                            • SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                            Submit Download

                                                                                                                                                                            element-icons.ttf
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
                                                                                                                                                                            • Size 54KB
                                                                                                                                                                            • SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            element-icons.woff
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
                                                                                                                                                                            • Size 27KB
                                                                                                                                                                            • SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            app.css
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
                                                                                                                                                                            • Size 107KB
                                                                                                                                                                            • SHA256 c9c5602e26393532e59391d5944a578716f3b6cad104ae20ac8caac805e52f86
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            chunk-vendors.css
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
                                                                                                                                                                            • Size 279KB
                                                                                                                                                                            • SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            app.js
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
                                                                                                                                                                            • Size 380KB
                                                                                                                                                                            • SHA256 f1bd1ffaba49fd0c0040f182231f739000b0e4bc762900ecacab4980f743b203
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            chunk-vendors.js
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
                                                                                                                                                                            • Size 249KB
                                                                                                                                                                            • SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            chunk-vendors.js
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
                                                                                                                                                                            • Size 424KB
                                                                                                                                                                            • SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            index.js
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
                                                                                                                                                                            • Size 10KB
                                                                                                                                                                            • SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            index.js
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
                                                                                                                                                                            • Size 13KB
                                                                                                                                                                            • SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            index.js
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
                                                                                                                                                                            • Size 14KB
                                                                                                                                                                            • SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            apm-init.js
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
                                                                                                                                                                            • Size 57B
                                                                                                                                                                            • SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            default_ava.svg
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
                                                                                                                                                                            • Size 906B
                                                                                                                                                                            • SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            desk-sync.svg
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
                                                                                                                                                                            • Size 1KB
                                                                                                                                                                            • SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            loading.svg
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
                                                                                                                                                                            • Size 1KB
                                                                                                                                                                            • SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            setup.cfg
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\cfgs\setup.cfg
                                                                                                                                                                            • Size 449B
                                                                                                                                                                            • SHA256 82f87a27f1ba7a594e884c8a0421556550400ac4830a1d302f87f488f825b179
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            kdesign.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\kdesign.dll
                                                                                                                                                                            • Size 1.3MB
                                                                                                                                                                            • SHA256 4072fbac904f3f734cc6eee3ee45414903795fbc2297459ba87272959f32798e
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            krt.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\krt.dll
                                                                                                                                                                            • Size 1.3MB
                                                                                                                                                                            • SHA256 bda1e9176fe2bba2386781750ef5e3b3467620eeca9860703969fa3d39d57f9e
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            ksolite.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksolite.dll
                                                                                                                                                                            • Size 12.3MB
                                                                                                                                                                            • SHA256 011db4b8073a9e732f6d3eb4e9de3a2296efb195e5d87de04c1c4535e8a54e09
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            ksomisc.exe
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe
                                                                                                                                                                            • Size 3.7MB
                                                                                                                                                                            • SHA256 9d71d0e9daf7fbd9fe3ec176b8c63ea8fe568770ffa2a7e59620fea0cab35f1c
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            libcrypto-kso-1_1-x64.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\libcrypto-kso-1_1-x64.dll
                                                                                                                                                                            • Size 3.4MB
                                                                                                                                                                            • SHA256 e09f4377c19802677433467d1078efff457a6a14424410608188a5d3deb6a9a3
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            error-net-72.png
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
                                                                                                                                                                            • Size 1KB
                                                                                                                                                                            • SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            presetLayout_16.pptx
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
                                                                                                                                                                            • Size 41KB
                                                                                                                                                                            • SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            wpscloudsvr.exe
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wpscloudsvr.exe
                                                                                                                                                                            • Size 1.1MB
                                                                                                                                                                            • SHA256 ab1d3b24149d6be428a92620cb36f00f8a7ac732eb1537949f38a70e23e3b3a6
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            wpsoffice.exe
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wpsoffice.exe
                                                                                                                                                                            • Size 1.2MB
                                                                                                                                                                            • SHA256 7590159e451ab812e134d1479f42f77da57d5d77bf75451e4b484cad3c31d268
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            install.ini
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\utility\install.ini
                                                                                                                                                                            • Size 610B
                                                                                                                                                                            • SHA256 53dbf3ecbd7d6a37961533271989b884b170314b0c839595d60bf7cf4401c8d0
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            install.ini
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\utility\install.ini
                                                                                                                                                                            • Size 462B
                                                                                                                                                                            • SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                            • Size 607B
                                                                                                                                                                            • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            APPX.76r7p221dkgqkjnmrxxsg6_fc.tmp
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\APPX.76r7p221dkgqkjnmrxxsg6_fc.tmp
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 9d2f34f1b17536dd689db858d42c85a78cb48ccf24f55fd578699dd1cbd7c930
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            APPX.9zxpr4b6b0c1qzryyu8z4s4oe.tmp
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\APPX.9zxpr4b6b0c1qzryyu8z4s4oe.tmp
                                                                                                                                                                            • Size 712B
                                                                                                                                                                            • SHA256 7310eb8c9a5115a236fe0f5b2a40386c478b4a1c8de6c16aa20363d4beaa2659
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            APPX._pdekzd2vvscvtrhr3awg43cc.tmp
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\APPX._pdekzd2vvscvtrhr3awg43cc.tmp
                                                                                                                                                                            • Size 10KB
                                                                                                                                                                            • SHA256 6a4d990b0be7003b95bc575b5ad238994d031b2c69526448cabd29b4921213a8
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            APPX.aj4og7057o_31m9wdcmjaqz2d.tmp
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\APPX.aj4og7057o_31m9wdcmjaqz2d.tmp
                                                                                                                                                                            • Size 712B
                                                                                                                                                                            • SHA256 c4cbc1fe8ab082b7e179d5d73115ba2580cb1170e38f98ba559c61bbc8bed882
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            APPX.dv2z804s9b09y0r73t6uku5yg.tmp
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\APPX.dv2z804s9b09y0r73t6uku5yg.tmp
                                                                                                                                                                            • Size 10KB
                                                                                                                                                                            • SHA256 73987e8a6a801a931993acb02080747b188fc99ad2afda42c910ec282f721c78
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            APPX.lplhehzer61divy2yy3hs6ade.tmp
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\APPX.lplhehzer61divy2yy3hs6ade.tmp
                                                                                                                                                                            • Size 10KB
                                                                                                                                                                            • SHA256 cb6e5f191043debcfd241bcaab6604c2640e3b74496a9cd5df3053363c67504e
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            APPX.tjeii1px__qa3mdthtl30dc4f.tmp
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\APPX.tjeii1px__qa3mdthtl30dc4f.tmp
                                                                                                                                                                            • Size 712B
                                                                                                                                                                            • SHA256 a3ca9aae4ba31a89982b18f1b929accb9db7d06a8d786f433ef5ccc667409b1d
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            APPX.viu80_q1j3d2_qo_121nbm7mf.tmp
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\APPX.viu80_q1j3d2_qo_121nbm7mf.tmp
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 81c968c375f69d9e4666901fd4c14a6ce4b738639ff78488562e2c79f8fb14d8
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            APPX.xn3sw4c7ztfll2a6wh9t2juhg.tmp
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\APPX.xn3sw4c7ztfll2a6wh9t2juhg.tmp
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 322a6bbe4151c8c0d85b94a20e1566a69e7e19532fe6bb7ee4b5d806daea5366
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            WPS Office.lnk
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk
                                                                                                                                                                            • Size 2KB
                                                                                                                                                                            • SHA256 5b9be44b83305ea48ce79a44fd2301716461c532570f61b7226fbc0edb1ddf07
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Qt5CoreKso.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\Qt5CoreKso.dll
                                                                                                                                                                            • Size 5.7MB
                                                                                                                                                                            • SHA256 65d137a523877290b1f6ff9b91e1af2af59abbe73d777d29f1104363f4b8e7b9
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Qt5GuiKso.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\Qt5GuiKso.dll
                                                                                                                                                                            • Size 6.4MB
                                                                                                                                                                            • SHA256 8d7df941af0ffed8773b7c309c09c4eb7880d730e9adb5851218969536fa83b9
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Qt5SvgKso.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\Qt5SvgKso.dll
                                                                                                                                                                            • Size 503KB
                                                                                                                                                                            • SHA256 a9d535ef73d2ecb8a65548c6fa33ef2ab1821f222e2e441e50ed042cfe56b5cc
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Qt5WidgetsKso.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\Qt5WidgetsKso.dll
                                                                                                                                                                            • Size 5.6MB
                                                                                                                                                                            • SHA256 0cdd865ee6e8929e84d588ca36510ab78099402e4d51831954e7fca5a77de905
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            Qt5WinExtrasKso.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\Qt5WinExtrasKso.dll
                                                                                                                                                                            • Size 251KB
                                                                                                                                                                            • SHA256 7d37dddac87b495479b8e0e99eee847efe5a73969b42a707f8d2a9598187aefd
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-console-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-console-l1-1-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 2afbfa1d77969d0f4cee4547870355498d5c1da81d241e09556d0bd1d6230f8c
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-console-l1-2-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-console-l1-2-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 00942431c2d3193061c7f4dc340e8446bfdbf792a7489f60349299dff689c2f9
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-datetime-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-datetime-l1-1-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 77577f35d3a61217ea70f21398e178f8749455689db52a2b35a85f9b54c79638
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-debug-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-debug-l1-1-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 45e48320abe6e3c6079f3f6b84636920a367989a88f9ba6847f88c210d972cf1
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-errorhandling-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-errorhandling-l1-1-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 accdd7455fb6d02fe298b987ad412e00d0b8e6f5fb10b52826367e7358ae1187
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-file-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-file-l1-1-0.dll
                                                                                                                                                                            • Size 14KB
                                                                                                                                                                            • SHA256 7cb0396229c3da434482a5ef929d3a2c392791712242c9693f06baa78948ef66
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-file-l1-2-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-file-l1-2-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 7a3c5167731238cf262f749aa46ab3bfb2ae1b22191b76e28e1d7499d28c24b7
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-file-l2-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-file-l2-1-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 349a79fa1572e3538dfbb942610d8c47d03e8a41b98897bc02ec7e897d05237e
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-handle-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-handle-l1-1-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 c78a1217f8dcb157d1a66b80348da48ebdbbedcea1d487fc393191c05aad476d
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-heap-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-heap-l1-1-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 2e981ee04f35c0e0b7c58282b70dcc9fc0318f20f900607dae7a0d40b36e80af
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-interlocked-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-interlocked-l1-1-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 b02324c49dd039fa889b4647331aa9ac65e5adc0cc06b26f9f086e2654ff9f08
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-libraryloader-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-libraryloader-l1-1-0.dll
                                                                                                                                                                            • Size 12KB
                                                                                                                                                                            • SHA256 08484ed55e43584068c337281e2c577cf984bb504871b3156de11c7cc1eec38f
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-localization-l1-2-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-localization-l1-2-0.dll
                                                                                                                                                                            • Size 13KB
                                                                                                                                                                            • SHA256 059cb23fdcf4d80b92e3da29e9ef4c322edf6fba9a1837978fd983e9bdfc7413
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-memory-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-memory-l1-1-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 dadbd2204b015e81f94c537ac7a36cd39f82d7c366c193062210c7288baa19e3
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-namedpipe-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-namedpipe-l1-1-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 b57e70798af248f91c8c46a3f3b2952effae92ca8ef9640c952467bc6726f363
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-processenvironment-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-processenvironment-l1-1-0.dll
                                                                                                                                                                            • Size 12KB
                                                                                                                                                                            • SHA256 aa415db99828f30a396cbd4e53c94096db89756c88a19d8564f0eed0674add43
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-processthreads-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-processthreads-l1-1-0.dll
                                                                                                                                                                            • Size 13KB
                                                                                                                                                                            • SHA256 c9a686030e073975009f993485d362cc31c7f79b683def713e667d13e9605a14
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-processthreads-l1-1-1.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-processthreads-l1-1-1.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 25a99bdf8bf4d16077dc30dd9ffef7bb5a2ceaf9afcee7cf52ad408355239d40
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-profile-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-profile-l1-1-0.dll
                                                                                                                                                                            • Size 10KB
                                                                                                                                                                            • SHA256 42f4e84073cf876bbab9dd42fd87124a4ba10bb0b59d2c3031cb2b2da7140594
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-rtlsupport-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-rtlsupport-l1-1-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 02d987eba4a65509a2df8ed5dd0b1a0578966e624fcf5806614ece88a817499f
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-string-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-string-l1-1-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 9447218cc4ab1a2c012629aaae8d1c8a428a99184b011bcc766792af5891e234
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-synch-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-synch-l1-1-0.dll
                                                                                                                                                                            • Size 13KB
                                                                                                                                                                            • SHA256 a31a15bed26232a178ba7ecb8c8aa9487c3287bb7909952fc06ed0d2c795db26
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-synch-l1-2-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-synch-l1-2-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 1c72ac404781a9986d8edeb0ee5dd39d2c27ce505683ca3324c0eccd6193610a
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-sysinfo-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-sysinfo-l1-1-0.dll
                                                                                                                                                                            • Size 12KB
                                                                                                                                                                            • SHA256 19c78ef5ba470c5b295dddee9244cbd07d0368c5743b02a16d375bfb494d3328
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-timezone-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-timezone-l1-1-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 3d798b9c345a507e142e8dacd7fb6c17528cc1453abfef2ffa9710d2fa9e032c
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-core-util-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-core-util-l1-1-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 5eb724c51eecba9ac7b8a53861a1d029bf2e6c62251d00f61ac7e2a5f813aaa3
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-crt-conio-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-crt-conio-l1-1-0.dll
                                                                                                                                                                            • Size 12KB
                                                                                                                                                                            • SHA256 b119adad588ebca7f9c88628010d47d68bf6e7dc6050b7e4b787559f131f5ede
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-crt-convert-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-crt-convert-l1-1-0.dll
                                                                                                                                                                            • Size 15KB
                                                                                                                                                                            • SHA256 6c008be766c44bf968c9e91cddc5b472110beffee3106a99532e68c605c78d44
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-crt-environment-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-crt-environment-l1-1-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 aa3e3e99964d7f9b89f288dbe30ff18cbc960ee5add533ec1b8326fe63787aa3
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-crt-filesystem-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-crt-filesystem-l1-1-0.dll
                                                                                                                                                                            • Size 13KB
                                                                                                                                                                            • SHA256 974af1f1a38c02869073b4e7ec4b2a47a6ce8339fa62c549da6b20668de6798c
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-crt-heap-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-crt-heap-l1-1-0.dll
                                                                                                                                                                            • Size 12KB
                                                                                                                                                                            • SHA256 8166321f14d5804ce76f172f290a6f39ce81373257887d9897a6cf3925d47989
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-crt-locale-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-crt-locale-l1-1-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 edc1699e9995f98826df06d2c45beb9e02aa7817bae3e61373096ae7f6fa06e0
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-crt-math-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-crt-math-l1-1-0.dll
                                                                                                                                                                            • Size 20KB
                                                                                                                                                                            • SHA256 f6a93fe6b57a54aac46229f2ed14a0a979bf60416adb2b2cfc672386ccb2b42e
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-crt-multibyte-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-crt-multibyte-l1-1-0.dll
                                                                                                                                                                            • Size 19KB
                                                                                                                                                                            • SHA256 5b3e29116383ba48a2f46594402246264b4cb001023237ebbf28e7e9292cdb92
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-crt-private-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-crt-private-l1-1-0.dll
                                                                                                                                                                            • Size 62KB
                                                                                                                                                                            • SHA256 55bc91a549d22b160ae4704485e19dee955c7c2534e7447afb84801ee629639b
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-crt-process-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-crt-process-l1-1-0.dll
                                                                                                                                                                            • Size 12KB
                                                                                                                                                                            • SHA256 191f53988c7f02dd888c4fbf7c1d3351570f3b641146fae6d60acdae544771ae
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-crt-runtime-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-crt-runtime-l1-1-0.dll
                                                                                                                                                                            • Size 15KB
                                                                                                                                                                            • SHA256 4390c389bbbf9ec7215d12d22723efd77beb4cd83311c75ffe215725ecfd55dc
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-crt-stdio-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-crt-stdio-l1-1-0.dll
                                                                                                                                                                            • Size 17KB
                                                                                                                                                                            • SHA256 6f6f6e857b347f70ecc669b4df73c32e42199b834fe009641d7b41a0b1c210af
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-crt-string-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-crt-string-l1-1-0.dll
                                                                                                                                                                            • Size 17KB
                                                                                                                                                                            • SHA256 45e0835b1d3b446fe2c347bd87922c53cfb6dd826499e19a1d977bf4c11b0e4a
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-crt-time-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-crt-time-l1-1-0.dll
                                                                                                                                                                            • Size 13KB
                                                                                                                                                                            • SHA256 b48310b0837027f756d62c37ea91af988baa403cbcbd01cb26b6fdae21ea96a2
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            api-ms-win-crt-utility-l1-1-0.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\api-ms-win-crt-utility-l1-1-0.dll
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 c81c4bba4e5f205359ad145963f6fbd074879047c66569f52b6d66711108e1ed
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            concrt140.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\concrt140.dll
                                                                                                                                                                            • Size 316KB
                                                                                                                                                                            • SHA256 2405355f0a58067b258f8df33c327e3a3d716eaac5a3a5aebb757842d85bd376
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            dbghelp.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\dbghelp.dll
                                                                                                                                                                            • Size 1.5MB
                                                                                                                                                                            • SHA256 13f0c74845318b52b76e6000564b1a99c37de48422b44ac74d034fa222c65a23
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            kbaseconfigcenter.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\kbaseconfigcenter.dll
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 e2785634529a41fc6f48e9648ce9b0165fd4733b6c24dee4cbd8b8f8bdf4ec1a
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            kpacketui.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\kpacketui.dll
                                                                                                                                                                            • Size 699KB
                                                                                                                                                                            • SHA256 6ba7f8b833b3cf4ec43b96094fa1418d23833f570007f6183f7f1c1bf24a8e4c
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            msvcp140.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\msvcp140.dll
                                                                                                                                                                            • Size 544KB
                                                                                                                                                                            • SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            qsvgicon.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
                                                                                                                                                                            • Size 75KB
                                                                                                                                                                            • SHA256 0953c0bab57e0c177f9dfc5da781d7b0577a4323c98f786277717f33e228476d
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            qsvg.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
                                                                                                                                                                            • Size 46KB
                                                                                                                                                                            • SHA256 08d40ed7b384e8ee7cbb6f0b46f51bf692272e3c963e5ecf745b7830c9fa3d1e
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            qskia.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\qt\plugins\platforms\qskia.dll
                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                            • SHA256 c622017322fa4442e4e7521d5a00642f66eaea46c1995562a6688fa4803dde1b
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            qwindows.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\qt\plugins\platforms\qwindows.dll
                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                            • SHA256 eb39b42dbe225a92aed40c31d881788be2e33ee137c043741e081cfb6598a7e6
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            qwindowsvistastyle.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
                                                                                                                                                                            • Size 159KB
                                                                                                                                                                            • SHA256 ba708eb228d11c7ed86aedcf01a313fd3bb58dc2ae9478d8e5bb969cfa629cb6
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            ucrtbase.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\ucrtbase.dll
                                                                                                                                                                            • Size 987KB
                                                                                                                                                                            • SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            vcruntime140.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\vcruntime140.dll
                                                                                                                                                                            • Size 121KB
                                                                                                                                                                            • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            vcruntime140_1.dll
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\office6\vcruntime140_1.dll
                                                                                                                                                                            • Size 48KB
                                                                                                                                                                            • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            style.xml
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\pl_PL\style.xml
                                                                                                                                                                            • Size 3KB
                                                                                                                                                                            • SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            product.dat
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\product.dat
                                                                                                                                                                            • Size 79KB
                                                                                                                                                                            • SHA256 864381c3016e55b25aea9ae26d8fffdef73765fd46f4236be41362d6f65a7f3e
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            product_new.dat
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\product_new.dat
                                                                                                                                                                            • Size 72KB
                                                                                                                                                                            • SHA256 ceac182427191b7baf9fb1041c946353d5be8294b4c792027dc6a65f89e19451
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            style.xml
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e591bcb\CONTROL\vi_VN\style.xml
                                                                                                                                                                            • Size 4KB
                                                                                                                                                                            • SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            tempinstall.ini
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                                                                                                                                                                            • Size 387B
                                                                                                                                                                            • SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            tempinstall.ini
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                                                                                                                                                                            • Size 433B
                                                                                                                                                                            • SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            5f495c40c234747f57cbcaf29f2f3725.prog.tmp
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cache\skia\sksl\120\angle\1414_008c\5f495c40c234747f57cbcaf29f2f3725.prog.tmp
                                                                                                                                                                            • Size 15KB
                                                                                                                                                                            • SHA256 865adbc3d44637fcd84fba1606c54f9f50a42bf8fc316372b6a28d57cb0a5f2d
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            73b548de20df7f5a13684ebb0d11ffc6.prog.tmp
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cache\skia\sksl\120\angle\1414_008c\73b548de20df7f5a13684ebb0d11ffc6.prog.tmp
                                                                                                                                                                            • Size 12KB
                                                                                                                                                                            • SHA256 01a6a0c8f44c5b03846714ec49e2437bafe8b89e61f86803c31d077f41dd3bcd
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            ksomisc_2026_07_05.log
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_07_05.log
                                                                                                                                                                            • Size 3KB
                                                                                                                                                                            • SHA256 2d33589907733a1f7bb2ec4d9e633e5080390a157fb50eda2dd24d0fe79a575c
                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            ksomisc_2026_07_05.log
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_07_05.log
                                                                                                                                                                            • Size 5KB
                                                                                                                                                                            • SHA256 0dedf4c3568dd09cd76b3e4fac3ecf9e883a42988c3a7b934f744015d8b02cb4
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            wpssetup.log
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                                                            • Size 10KB
                                                                                                                                                                            • SHA256 ac20ece51e3eb077efbcbe4a92b4cabaf915786b6b6b7aeeb05147c534950169
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            wpssetup.log
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                                                            • Size 11KB
                                                                                                                                                                            • SHA256 c744c8fd42339031c6c27fda866c813566ac370323d72052c358baba96b7bc9a
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            wpssetup.log
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                                                            • Size 26KB
                                                                                                                                                                            • SHA256 5b1ce45aea098b020f827259e39793950da0d55a64cde95faa25538ead24d8df
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            wpssetup.log
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                                                            • Size 65KB
                                                                                                                                                                            • SHA256 83e86e42de8f42e4bc12fcba3f8acbbd66f9edfc37154f35aefed4997b030a23
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            wpssetup.log
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                                                            • Size 65KB
                                                                                                                                                                            • SHA256 ef9c38376acc88123de4f1ac9d98f5b7c1a0b64ece1d817822aaac77127fbdff
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            wpssetup.log
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                                                            • Size 59KB
                                                                                                                                                                            • SHA256 570f0e24b270e0714ce0ccf89ee37ecd14446e5fb75f4e5a461ee8d85bbe50bb
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            mdbx.dat
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-x64\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat
                                                                                                                                                                            • Size 64KB
                                                                                                                                                                            • SHA256 3ff87e4197b6bfea21a6e1ceaa98591a4bf649bec2ba8e7c30e29e0448ee692d
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            dcsdk_dpv3.data
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
                                                                                                                                                                            • Size 41KB
                                                                                                                                                                            • SHA256 751bfdcfbb3a8d7fbe1c6624e2f043a54714f0cdd9268753bba948966528a8bd
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            dcsdk_dpv3.data
                                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
                                                                                                                                                                            • Size 41KB
                                                                                                                                                                            • SHA256 fbfdd2422191cb900c9a4a804f67901ebb467644eb1e19bf1cca04e362a6fd68
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            perfhost.exe
                                                                                                                                                                            • Path C:\Windows\SysWOW64\perfhost.exe
                                                                                                                                                                            • Size 1.2MB
                                                                                                                                                                            • SHA256 fb2ad7b78fab448da869e10eac0367b5af9bbb9c504a3605338ce7db7857b256
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            AgentService.exe
                                                                                                                                                                            • Path C:\Windows\System32\AgentService.exe
                                                                                                                                                                            • Size 1.4MB
                                                                                                                                                                            • SHA256 3288ce8bed9e7ed08978af6e13dcb40524dbd53cb1151638767f040c273b8bdd
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            ssh-agent.exe
                                                                                                                                                                            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 2587a814713f7696554c94efa5135d974db1a4de77c8f557d98bdfc53d94b1e4
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            PerceptionSimulationService.exe
                                                                                                                                                                            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                                                                                                                                                            • Size 1.4MB
                                                                                                                                                                            • SHA256 13f72c37c898d3b73e5925ef84f0aef4fdba90addb27a6c9ec955e44401d5402
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            ReFsDedupSvc.exe
                                                                                                                                                                            • Path C:\Windows\System32\ReFsDedupSvc.exe
                                                                                                                                                                            • Size 2.6MB
                                                                                                                                                                            • SHA256 a8bbc04b89af8441ff843c722632ac7faa6f7276a454d3b4f6bd11d01738969c
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            SearchIndexer.exe
                                                                                                                                                                            • Path C:\Windows\System32\SearchIndexer.exe
                                                                                                                                                                            • Size 1.4MB
                                                                                                                                                                            • SHA256 d102141a34166b9f776341ed5fa901837efd749920440041ba625eb792c8ae53
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            SensorDataService.exe
                                                                                                                                                                            • Path C:\Windows\System32\SensorDataService.exe
                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                            • SHA256 6ebc28c60dbd87367e6eb87848eab9601b29ff8f88859ac7c8dbb1fa5470eaeb
                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                            Submit Download

                                                                                                                                                                            memory/1748-302-0x0000000000400000-0x00000000005D6000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/1748-80-0x0000000000400000-0x00000000005D6000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2444-95-0x00000000006A0000-0x0000000000700000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2444-309-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2444-307-0x00000000006A0000-0x0000000000700000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2444-305-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2444-102-0x00000000006A0000-0x0000000000700000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2444-101-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2636-145-0x00000000006A0000-0x0000000000700000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2636-310-0x0000000140000000-0x0000000140172000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2636-138-0x0000000140000000-0x0000000140172000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2712-11560-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2712-11565-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2856-116-0x0000000000C60000-0x0000000000CC0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2856-115-0x0000000140000000-0x000000014027D000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2856-109-0x0000000000C60000-0x0000000000CC0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2856-306-0x0000000140000000-0x000000014027D000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/2940-801-0x00007FF84C950000-0x00007FF84CEDE000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3356-8536-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3356-8532-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3356-8534-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3356-8537-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3356-8525-0x00007FF84A4E0000-0x00007FF84AA6E000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3356-8535-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3356-8526-0x00007FF76ECE0000-0x00007FF76F08E000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3356-8531-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3356-8530-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3356-8533-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3676-5-0x0000000000E10000-0x0000000000E77000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3676-7-0x0000000000400000-0x00000000009C1000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3676-0-0x0000000000E10000-0x0000000000E77000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3676-79-0x0000000000400000-0x00000000009C1000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3840-42-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3840-41-0x0000000140000000-0x0000000140214000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3840-53-0x0000000140000000-0x0000000140214000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3840-51-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3840-48-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3880-11604-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3880-11591-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3944-56-0x0000000000860000-0x00000000008C0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3944-64-0x0000000140000000-0x000000014020E000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3944-62-0x0000000000860000-0x00000000008C0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/3944-263-0x0000000140000000-0x000000014020E000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4112-38-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4112-29-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4112-137-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4112-30-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4132-11611-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4132-11616-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4164-11541-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4164-11530-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4416-130-0x0000000000C90000-0x0000000000CF0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4416-121-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4416-132-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4416-122-0x0000000000C90000-0x0000000000CF0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4416-128-0x0000000000C90000-0x0000000000CF0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4772-11553-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4772-11542-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4876-69-0x0000000000750000-0x00000000007B0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4876-75-0x0000000000750000-0x00000000007B0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4876-286-0x0000000140000000-0x000000014020A000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/4876-67-0x0000000140000000-0x000000014020A000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5796-323-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5796-84-0x00000000007B0000-0x0000000000810000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5796-90-0x00000000007B0000-0x0000000000810000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5796-83-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5796-304-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5796-321-0x00000000007B0000-0x0000000000810000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5972-108-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5972-15-0x0000000000F00000-0x0000000000F60000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5972-23-0x0000000000F00000-0x0000000000F60000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/5972-14-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/6488-11502-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/6488-11515-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/8008-11566-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/8008-11577-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/8108-11579-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/8108-11590-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/9508-9353-0x0000000004FB0000-0x0000000004FD6000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/9508-9348-0x0000000002AF0000-0x0000000002AFA000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/9508-9326-0x00000000004D0000-0x00000000004D8000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/9536-9420-0x0000000140000000-0x00000001401AD000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/9536-8776-0x0000000140000000-0x00000001401AD000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/9920-11617-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/9920-11628-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/10288-9365-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/10288-9271-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/11444-11529-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/11444-11516-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12672-8477-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12672-8470-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12672-8471-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12672-8472-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12672-8473-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12672-8474-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12672-8475-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12672-8476-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12672-8465-0x00007FF849C60000-0x00007FF84A1EE000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12672-8478-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12672-8468-0x00007FF84A910000-0x00007FF84B55E000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12672-8467-0x00007FF76ECE0000-0x00007FF76F08E000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12672-8466-0x00007FF84BB90000-0x00007FF84BCD4000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12672-8469-0x00007FF8314A0000-0x00007FF8314B0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12672-8479-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12908-8501-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12908-8495-0x00007FF84ADD0000-0x00007FF84BA1E000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12908-8503-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12908-8504-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12908-8505-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12908-8506-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12908-8507-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12908-8502-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12908-8508-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12908-8496-0x00007FF84AC80000-0x00007FF84ADC4000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12908-8500-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12908-8499-0x00007FF8303D0000-0x00007FF8303E0000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12908-8497-0x00007FF84A380000-0x00007FF84A90E000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12908-8494-0x00007FF76ECE0000-0x00007FF76F08E000-memory.dmp
                                                                                                                                                                            Download

                                                                                                                                                                            memory/12908-8512-0x00007FF841C40000-0x00007FF843940000-memory.dmp
                                                                                                                                                                            Download