Overview

overview

7

Static

static

3

2026-07-30...ca.exe

windows10-2004-x64

7

2026-07-30...ca.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    63s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 17:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_78455230fe1d43383bba0a68942a26de_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
  • Size 5.7MB
  • Sample260730-v1s6astbnd
  • SHA256 a32d7a127889270330a4b11a98850a728fe8644ffee32c52f5976bf49a9acc9d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdefense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 40 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_78455230fe1d43383bba0a68942a26de_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_78455230fe1d43383bba0a68942a26de_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4608
    • C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
      "C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
      2⤵
        PID:4668
        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -checkInstallEnvironment
          3⤵
            PID:4512
          • C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
            "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService
            3⤵
              PID:7580
            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -addFirewallRule
              3⤵
                PID:7764
              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wpsoffice.exe
                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wpsoffice.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=klangmanager -dll_name=klangmanager.dll downloadlang en_US
                3⤵
                  PID:8560
                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -regmtfont
                  3⤵
                    PID:9156
              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                1⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                PID:3720
              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                1⤵
                • Executes dropped EXE
                PID:1820
              • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                1⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                PID:3144
              • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                1⤵
                • Executes dropped EXE
                PID:996
              • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                1⤵
                • Executes dropped EXE
                PID:4372
              • C:\Windows\SysWow64\perfhost.exe
                C:\Windows\SysWow64\perfhost.exe
                1⤵
                • Executes dropped EXE
                PID:2580
              • C:\Windows\System32\ReFsDedupSvc.exe
                C:\Windows\System32\ReFsDedupSvc.exe
                1⤵
                • Executes dropped EXE
                • Checks processor information in registry
                • Suspicious use of AdjustPrivilegeToken
                PID:5444
              • C:\Windows\System32\SensorDataService.exe
                C:\Windows\System32\SensorDataService.exe
                1⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Checks SCSI registry key(s)
                PID:4660
              • C:\Windows\System32\OpenSSH\ssh-agent.exe
                C:\Windows\System32\OpenSSH\ssh-agent.exe
                1⤵
                • Executes dropped EXE
                PID:5044
              • C:\Windows\system32\AgentService.exe
                C:\Windows\system32\AgentService.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:4616
              • C:\Windows\system32\SearchIndexer.exe
                C:\Windows\system32\SearchIndexer.exe /Embedding
                1⤵
                • Executes dropped EXE
                • Enumerates connected drives
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3068
                • C:\Windows\System32\SearchProtocolHost.exe
                  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                  2⤵
                  • Modifies data under HKEY_USERS
                  PID:5220
                • C:\Windows\System32\SearchProtocolHost.exe
                  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                  2⤵
                    PID:4316
                  • C:\Windows\System32\SearchFilterHost.exe
                    "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3000 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
                    2⤵
                    • Modifies data under HKEY_USERS
                    PID:2404
                  • C:\Windows\System32\SearchFilterHost.exe
                    "C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
                    2⤵
                    • Modifies data under HKEY_USERS
                    PID:3148
                  • C:\Windows\System32\SearchProtocolHost.exe
                    "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                    2⤵
                      PID:7116
                    • C:\Windows\System32\SearchFilterHost.exe
                      "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3000 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
                      2⤵
                        PID:6648
                      • C:\Windows\System32\SearchFilterHost.exe
                        "C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
                        2⤵
                          PID:6968
                      • C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
                        "C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5A6F84 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\
                        1⤵
                          PID:4572
                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -setlng en_US
                            2⤵
                              PID:6368
                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -getonlineparam 00601.00001304 -forceperusermode
                              2⤵
                                PID:6756
                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -getabtest -forceperusermode
                                2⤵
                                  PID:4344
                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -fixoldversionassostatus
                                  2⤵
                                    PID:7436
                                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -setservers
                                    2⤵
                                      PID:8048
                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -register
                                      2⤵
                                        PID:2576
                                        • C:\Windows\system32\regsvr32.exe
                                          "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
                                          3⤵
                                            PID:9012
                                            • C:\Windows\SysWOW64\regsvr32.exe
                                              /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
                                              4⤵
                                                PID:9144
                                            • C:\Windows\system32\regsvr32.exe
                                              "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
                                              3⤵
                                                PID:8972
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k GPSvcGroup
                                            1⤵
                                              PID:8500
                                            • C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
                                              "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
                                              1⤵
                                                PID:7868

                                              Network

                                                    MITRE ATT&CK Enterprise v16

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    elevation_service.exe
                                                    • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                    • Size 2.7MB
                                                    • SHA256 5b1991cc16ccd81e508d1017334e083bd23f01828c5e40cfddc13664cebf49a2
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    maintenanceservice.exe
                                                    • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                    • Size 1.4MB
                                                    • SHA256 bc12b568047cb412f60e9610a621caebbb8ab757667c2750c623c5a8a3d96802
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    7z.exe
                                                    • Path C:\Program Files\7-Zip\7z.exe
                                                    • Size 1.7MB
                                                    • SHA256 810537ba0089584bbcab1ea9cb8e9365c531bc068ec98b6492a4a0b222f1e2f2
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    7zFM.exe
                                                    • Path C:\Program Files\7-Zip\7zFM.exe
                                                    • Size 1.5MB
                                                    • SHA256 85058bcf2594445de7c919be99cb240d3fd546570b1b93a0e1f2a990e647b70d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    7zG.exe
                                                    • Path C:\Program Files\7-Zip\7zG.exe
                                                    • Size 1.2MB
                                                    • SHA256 1d7ca8d08a3e3924b21a2d009c912caa41ad07aa54a1e78125120fa3259e8a41
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Uninstall.exe
                                                    • Path C:\Program Files\7-Zip\Uninstall.exe
                                                    • Size 1.2MB
                                                    • SHA256 47164cbf6f7667fd6bd9d211a57c43d308dbe54133ccd806b5908938d59c7cf5
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    OSE.EXE
                                                    • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                    • Size 1.4MB
                                                    • SHA256 592bf1cc3fb782713175f317ab865a7a193efe3230cfdcb1ef0c1fb35e617f31
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    elevation_service.exe
                                                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                    • Size 2.8MB
                                                    • SHA256 b140e5b23176f1574e5d3560199166379d9c56abbff2d879253f04fa44a5288a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    MsSense.exe
                                                    • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                                                    • Size 1.6MB
                                                    • SHA256 bbd08d2761ad17d3315014e32eef2e0daf46834fd132785d31ca1578bb3c8fc7
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    NisSrv.exe
                                                    • Path C:\Program Files\Windows Defender\NisSrv.exe
                                                    • Size 3.5MB
                                                    • SHA256 02d59211300fcab07a4609d64d1c17a4f5d80f30915bb4fa3643434ecbeece89
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    wmpnetwk.exe
                                                    • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                    • Size 1.4MB
                                                    • SHA256 3b516962c7ca422a0754ecb9d746486cddc3abb5721ff28532e315dbe1d0eddd
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                    • Size 471B
                                                    • SHA256 b6370e40beec453b472e64045b4033fc9e4caa08a5916d0908da56399875f33c
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                    • Size 727B
                                                    • SHA256 e0365868125950f2397d2d53988206575d6debf622700afd3432cc4d1452b2d1
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                    • Size 727B
                                                    • SHA256 a2e9b12f0ffcc945f012a85aab9f606f8851f1dbcd29be7cc2c7b97dccb98ea5
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                    • Size 400B
                                                    • SHA256 4b6057b380297ed7aab4c72c3432df19d8ca690c9fee264de51fd14d58bec13a
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                    • Size 404B
                                                    • SHA256 b314d5565d1fbe6c30396f1732118306d26ce716c6931ceb2640eb0b4379ba59
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                    • Size 412B
                                                    • SHA256 c7e865e9e326c4ee8978adbc02b97bcefeb9bbed6a20e4c6af979dc37867defe
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    logo-small.png
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\StartScreenTile\ksolaunch\logo-small.png
                                                    • Size 6KB
                                                    • SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    logo.png
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\StartScreenTile\ksolaunch\logo.png
                                                    • Size 12KB
                                                    • SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Everything-KingSoft-Read-Only.ini
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\everythingsearch\everythingbinary\Everything-KingSoft-Read-Only.ini
                                                    • Size 404B
                                                    • SHA256 b5980cd1122d2ad4727bc06806e3d2a6598b7d67b6eb3d2732938d08c6deedbb
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    run.ini
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\karticlewebcloudsummary\mui\dist\run.ini
                                                    • Size 171B
                                                    • SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    kcoworkdockpanel.qm
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kcoworkdockpanel\mui\es_MX\kcoworkdockpanel.qm
                                                    • Size 846B
                                                    • SHA256 8f0de81b05e2ce8a22432406009084933f0cf410e6efb534aafd71699651120c
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    kcoworkdockpanel.qm
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kcoworkdockpanel\mui\vi_VN\kcoworkdockpanel.qm
                                                    • Size 839B
                                                    • SHA256 ad5549bf1c748909f191eba6e08caccfb31dbe1a2ce4bfafcb1e41702f40c95f
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    index.html
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kpdfcorporateglossary\res\dist\index.html
                                                    • Size 636B
                                                    • SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    index.js
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kpdfcorporateglossary\res\dist\index.js
                                                    • Size 2KB
                                                    • SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    errPage.html
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
                                                    • Size 7KB
                                                    • SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    favicon.ico
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
                                                    • Size 4KB
                                                    • SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    run.ini
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebpromehelp\run.ini
                                                    • Size 226B
                                                    • SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    close-secondary.svg
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
                                                    • Size 216B
                                                    • SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    kwpsaibasetypo.qm
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
                                                    • Size 334B
                                                    • SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    kwpsaibasetypo.qm
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
                                                    • Size 327B
                                                    • SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    element-icons.ttf
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
                                                    • Size 54KB
                                                    • SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    element-icons.woff
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
                                                    • Size 27KB
                                                    • SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    app.css
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
                                                    • Size 107KB
                                                    • SHA256 907d1f5ee046fae72b52eaf99508ddb6b48d47b803076db0e9a86b0e21a54ba9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    chunk-vendors.css
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
                                                    • Size 279KB
                                                    • SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    app.js
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
                                                    • Size 380KB
                                                    • SHA256 fd9dcbe72da3477714bf68b8987db4718e4be32f313d09bfefbd4d78aa051a84
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    chunk-vendors.js
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
                                                    • Size 249KB
                                                    • SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    chunk-vendors.js
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
                                                    • Size 424KB
                                                    • SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    index.js
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
                                                    • Size 10KB
                                                    • SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    index.js
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
                                                    • Size 13KB
                                                    • SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    index.js
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
                                                    • Size 14KB
                                                    • SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    apm-init.js
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
                                                    • Size 57B
                                                    • SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    default_ava.svg
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
                                                    • Size 906B
                                                    • SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    desk-sync.svg
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
                                                    • Size 1KB
                                                    • SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    loading.svg
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
                                                    • Size 1KB
                                                    • SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    setup.cfg
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\cfgs\setup.cfg
                                                    • Size 449B
                                                    • SHA256 45a9cbbacd1a5a9ef690f4b0d8978d908cf12fc423254b3b591b00a7231aa5bd
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    ksomisc.exe
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                    • Size 3.7MB
                                                    • SHA256 9555ca85ef085b11d92dd2fa4c901d4fa3c72865df5e7a6bfeee6cc7c8a8f3b0
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    error-net-72.png
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
                                                    • Size 1KB
                                                    • SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    presetLayout_16.pptx
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
                                                    • Size 41KB
                                                    • SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    wpscloudsvr.exe
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wpscloudsvr.exe
                                                    • Size 1.1MB
                                                    • SHA256 0f455a3cc797ff1b5f6c947285649203ac4ccc0a1d0f900a0b7e43435d41eeb0
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    wpsoffice.exe
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wpsoffice.exe
                                                    • Size 1.2MB
                                                    • SHA256 4937dc6011b827af8acf4625d5b8cd3fec1b9f310e78024542830bcc2d5c7b04
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    install.ini
                                                    • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\utility\install.ini
                                                    • Size 462B
                                                    • SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    Qt5CoreKso.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\CONTROL\office6\Qt5CoreKso.dll
                                                    • Size 5.7MB
                                                    • SHA256 d76ce35aa1a6d2d9ee025bbb2e8743c401039cd4161058dc4f379588057a5b94
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Qt5GuiKso.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\CONTROL\office6\Qt5GuiKso.dll
                                                    • Size 6.4MB
                                                    • SHA256 c3a2de3161f7cc03dccd2c375cb10aeda109069c13689c105ba161f39c2a35d4
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Qt5SvgKso.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\CONTROL\office6\Qt5SvgKso.dll
                                                    • Size 503KB
                                                    • SHA256 bc68fc65d3620fd0e31e625ac359ce68d0c26bc45f68d5ada1e4cb4df9852978
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Qt5WidgetsKso.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\CONTROL\office6\Qt5WidgetsKso.dll
                                                    • Size 5.6MB
                                                    • SHA256 70eeb2b38bd9e4b17d49e62a1a8c5040a0ba309205224d500a89b20480ff4886
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Qt5WinExtrasKso.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\CONTROL\office6\Qt5WinExtrasKso.dll
                                                    • Size 251KB
                                                    • SHA256 5f55c44db9c677781b79f5c0527fc5ec81dad8e4fbfac6076a45f1d0d747e24e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    kpacketui.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\CONTROL\office6\kpacketui.dll
                                                    • Size 836KB
                                                    • SHA256 e0db71f3a34e740fad2e39f52a63272340d3bb719e2f60294bf0520fa3cf6dae
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    msvcp140.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\CONTROL\office6\msvcp140.dll
                                                    • Size 544KB
                                                    • SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qsvgicon.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
                                                    • Size 75KB
                                                    • SHA256 dcf5212ec3fe7746f8b26a504687be3bb29954294b7f448c4940b413fb04c527
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qsvg.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
                                                    • Size 46KB
                                                    • SHA256 524e279aa876ea45ac1205c4f4210c226aded2298d96b4ba46f3e7c4faec499a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qskia.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\CONTROL\office6\qt\plugins\platforms\qskia.dll
                                                    • Size 1.9MB
                                                    • SHA256 6daafb39daca277e272ba56a115eed0235b45d5d820fa9b315f78005e048e6e6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qwindows.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\CONTROL\office6\qt\plugins\platforms\qwindows.dll
                                                    • Size 1.6MB
                                                    • SHA256 8a87eb5fad6e90294115e7b3df56971dd278a48456344b4bf2ea15a3055c56af
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qwindowsvistastyle.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
                                                    • Size 159KB
                                                    • SHA256 a4c3bb047f8d6d9240d5b020de80ee53585ed5029fec341ce2bab300b615a586
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ucrtbase.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\CONTROL\office6\ucrtbase.dll
                                                    • Size 987KB
                                                    • SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    vcruntime140.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\CONTROL\office6\vcruntime140.dll
                                                    • Size 121KB
                                                    • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    vcruntime140_1.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\CONTROL\office6\vcruntime140_1.dll
                                                    • Size 48KB
                                                    • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    style.xml
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\CONTROL\pl_PL\style.xml
                                                    • Size 3KB
                                                    • SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    product.dat
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\CONTROL\product.dat
                                                    • Size 97KB
                                                    • SHA256 2e844013324b6d0b45e0f68706c289221de46dcb231c45a52cdbfce80bcac54c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    product_new.dat
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\CONTROL\product_new.dat
                                                    • Size 83KB
                                                    • SHA256 53a97ea8fd5bde7018db62835a7aaf4ec5689e175224e7cdb18bf070357de113
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    style.xml
                                                    • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a69f6\CONTROL\vi_VN\style.xml
                                                    • Size 4KB
                                                    • SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    tempinstall.ini
                                                    • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                                                    • Size 387B
                                                    • SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    tempinstall.ini
                                                    • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                                                    • Size 433B
                                                    • SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    ksomisc_2026_07_30.log
                                                    • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_07_30.log
                                                    • Size 3KB
                                                    • SHA256 28edc5fc8736c25016a8fee37196b95f840e11489326cd99e8fde8aa979fc3f9
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    ksomisc_2026_07_30.log
                                                    • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_07_30.log
                                                    • Size 5KB
                                                    • SHA256 541d7f617d891fb60461526c02a2cb3ae3c51102088ff06c3c2b159d462eb896
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    wpssetup.log
                                                    • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                    • Size 10KB
                                                    • SHA256 3c3aea47c8d1516049b05505b740fb4781349a28cac70efb20cce6e0e7506593
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    wpssetup.log
                                                    • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                    • Size 11KB
                                                    • SHA256 d833f9c031ccf68545d7bd3468c051f4210002d5199581d07851929be639778d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    wpssetup.log
                                                    • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                    • Size 27KB
                                                    • SHA256 eda59422172d5ad7dd0b0ae73a992c09881f49e80535cf8425a73bec8aa0d1f4
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    wpssetup.log
                                                    • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                    • Size 61KB
                                                    • SHA256 84bcc1c90a8fc0da7a58b6bf3bf81729f2359cb85782535dd96ed27d479c7464
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    mdbx.dat
                                                    • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-x64\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat
                                                    • Size 64KB
                                                    • SHA256 eba277e0baaaa6ed2842fda8ee51ece35e99c9eef6cddda0e8dd6a8abf12d32e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    dcsdk_dpv3.data
                                                    • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
                                                    • Size 42KB
                                                    • SHA256 208b135e2da07faf0072fcfc6eb9700406392f60d097159ea5ed3fd32f2ac208
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    dcsdk_dpv3.data
                                                    • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
                                                    • Size 36KB
                                                    • SHA256 57bd34669428c94f149a3ceaff07eaf86e79125af1c4e2f79d6a800f428a62aa
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    perfhost.exe
                                                    • Path C:\Windows\SysWOW64\perfhost.exe
                                                    • Size 1.2MB
                                                    • SHA256 0e4666712fa6e3d6a18f0f28e21a8d1453c098be30eade003c0fadeb7741550e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    AgentService.exe
                                                    • Path C:\Windows\System32\AgentService.exe
                                                    • Size 1.4MB
                                                    • SHA256 aac5e15d5cdd5b35168883789eacef2068def68ad8aaddabea6b4e894831d066
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ssh-agent.exe
                                                    • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                    • Size 1.7MB
                                                    • SHA256 6bcb8f3e1cf73555599c554db469e68e5ded2b23f3a3755de53be68c342aec79
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    PerceptionSimulationService.exe
                                                    • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                                    • Size 1.4MB
                                                    • SHA256 00fb4e6abc8626cf5b2cfdc3a216ab5c146fee21b09c8af4d18f62f19e249cb9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ReFsDedupSvc.exe
                                                    • Path C:\Windows\System32\ReFsDedupSvc.exe
                                                    • Size 2.6MB
                                                    • SHA256 03d1d81036f0eb8416e5af6752993598ccf11fa031e8c681918807446593e3a2
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SearchIndexer.exe
                                                    • Path C:\Windows\System32\SearchIndexer.exe
                                                    • Size 1.4MB
                                                    • SHA256 c34e0cc47b8e44624e7b54b47d71ab65c36fbdd06184b339aecca5e980207827
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SensorDataService.exe
                                                    • Path C:\Windows\System32\SensorDataService.exe
                                                    • Size 1.7MB
                                                    • SHA256 319269569000f57d1089c39027e27977442ed27e331ce047c6a01f306a35b368
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    AppVClient.exe
                                                    • Path C:\Windows\system32\AppVClient.exe
                                                    • Size 1.3MB
                                                    • SHA256 a6b5d4c7364e023cb242f9d172a872324a6c38e93e7b2064cbfe8828fddcf6f4
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SgrmBroker.exe
                                                    • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                                                    • Size 1.6MB
                                                    • SHA256 f8e517095dcc8321f0b3aa58b0c0c196d2fc94ce57f31c91f551c5f77a9f5588
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    memory/996-57-0x0000000140000000-0x000000014020E000-memory.dmp
                                                    Download

                                                    memory/996-173-0x0000000140000000-0x000000014020E000-memory.dmp
                                                    Download

                                                    memory/996-58-0x00000000007A0000-0x0000000000800000-memory.dmp
                                                    Download

                                                    memory/996-64-0x00000000007A0000-0x0000000000800000-memory.dmp
                                                    Download

                                                    memory/1820-28-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                    Download

                                                    memory/1820-121-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                    Download

                                                    memory/1820-34-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                    Download

                                                    memory/1820-35-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                    Download

                                                    memory/1820-38-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                    Download

                                                    memory/2580-235-0x0000000000400000-0x00000000005D6000-memory.dmp
                                                    Download

                                                    memory/2580-80-0x0000000000400000-0x00000000005D6000-memory.dmp
                                                    Download

                                                    memory/3068-146-0x0000000000620000-0x0000000000680000-memory.dmp
                                                    Download

                                                    memory/3068-298-0x0000000140000000-0x0000000140172000-memory.dmp
                                                    Download

                                                    memory/3068-139-0x0000000140000000-0x0000000140172000-memory.dmp
                                                    Download

                                                    memory/3068-140-0x0000000000620000-0x0000000000680000-memory.dmp
                                                    Download

                                                    memory/3144-55-0x0000000140000000-0x0000000140214000-memory.dmp
                                                    Download

                                                    memory/3144-53-0x0000000000CE0000-0x0000000000D40000-memory.dmp
                                                    Download

                                                    memory/3144-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp
                                                    Download

                                                    memory/3144-42-0x0000000140000000-0x0000000140214000-memory.dmp
                                                    Download

                                                    memory/3144-43-0x0000000000CE0000-0x0000000000D40000-memory.dmp
                                                    Download

                                                    memory/3148-316-0x00000283607C0000-0x000002836098A000-memory.dmp
                                                    Download

                                                    memory/3720-15-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                    Download

                                                    memory/3720-22-0x0000000000D50000-0x0000000000DB0000-memory.dmp
                                                    Download

                                                    memory/3720-16-0x0000000000D50000-0x0000000000DB0000-memory.dmp
                                                    Download

                                                    memory/3720-23-0x0000000000D50000-0x0000000000DB0000-memory.dmp
                                                    Download

                                                    memory/3720-108-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                    Download

                                                    memory/4344-9541-0x00007FF685590000-0x00007FF685951000-memory.dmp
                                                    Download

                                                    memory/4344-9545-0x00007FFE4CA80000-0x00007FFE4D00E000-memory.dmp
                                                    Download

                                                    memory/4344-9547-0x00007FFE4B3E0000-0x00007FFE4BE4D000-memory.dmp
                                                    Download

                                                    memory/4344-9544-0x00007FFE52090000-0x00007FFE521D5000-memory.dmp
                                                    Download

                                                    memory/4344-9543-0x00007FFE4D010000-0x00007FFE4DC80000-memory.dmp
                                                    Download

                                                    memory/4372-70-0x0000000000C70000-0x0000000000CD0000-memory.dmp
                                                    Download

                                                    memory/4372-76-0x0000000000C70000-0x0000000000CD0000-memory.dmp
                                                    Download

                                                    memory/4372-68-0x0000000140000000-0x000000014020A000-memory.dmp
                                                    Download

                                                    memory/4372-202-0x0000000140000000-0x000000014020A000-memory.dmp
                                                    Download

                                                    memory/4512-9459-0x00007FFE33600000-0x00007FFE33610000-memory.dmp
                                                    Download

                                                    memory/4512-9447-0x00007FFE4E3B0000-0x00007FFE4E4F5000-memory.dmp
                                                    Download

                                                    memory/4512-9455-0x00007FFE33600000-0x00007FFE33610000-memory.dmp
                                                    Download

                                                    memory/4512-9456-0x00007FFE33600000-0x00007FFE33610000-memory.dmp
                                                    Download

                                                    memory/4512-9457-0x00007FFE33600000-0x00007FFE33610000-memory.dmp
                                                    Download

                                                    memory/4512-9458-0x00007FFE33600000-0x00007FFE33610000-memory.dmp
                                                    Download

                                                    memory/4512-9460-0x00007FFE33600000-0x00007FFE33610000-memory.dmp
                                                    Download

                                                    memory/4512-9461-0x00007FFE33600000-0x00007FFE33610000-memory.dmp
                                                    Download

                                                    memory/4512-9462-0x00007FFE33600000-0x00007FFE33610000-memory.dmp
                                                    Download

                                                    memory/4512-9453-0x00007FFE4C880000-0x00007FFE4E3A6000-memory.dmp
                                                    Download

                                                    memory/4512-9452-0x00007FFE4E500000-0x00007FFE4F170000-memory.dmp
                                                    Download

                                                    memory/4512-9449-0x00007FFE4A130000-0x00007FFE4AB9D000-memory.dmp
                                                    Download

                                                    memory/4512-9463-0x00007FFE33600000-0x00007FFE33610000-memory.dmp
                                                    Download

                                                    memory/4512-9451-0x00007FF685590000-0x00007FF685951000-memory.dmp
                                                    Download

                                                    memory/4512-9464-0x00007FFE33600000-0x00007FFE33610000-memory.dmp
                                                    Download

                                                    memory/4512-9454-0x00007FFE34840000-0x00007FFE34850000-memory.dmp
                                                    Download

                                                    memory/4512-9450-0x00007FFE45840000-0x00007FFE475EE000-memory.dmp
                                                    Download

                                                    memory/4512-9448-0x00007FFE4BC80000-0x00007FFE4C20E000-memory.dmp
                                                    Download

                                                    memory/4608-0-0x0000000000400000-0x00000000009C1000-memory.dmp
                                                    Download

                                                    memory/4608-1-0x0000000000E00000-0x0000000000E67000-memory.dmp
                                                    Download

                                                    memory/4608-8-0x0000000000E00000-0x0000000000E67000-memory.dmp
                                                    Download

                                                    memory/4608-83-0x0000000000400000-0x00000000009C1000-memory.dmp
                                                    Download

                                                    memory/4616-137-0x0000000140000000-0x0000000140168000-memory.dmp
                                                    Download

                                                    memory/4616-122-0x0000000140000000-0x0000000140168000-memory.dmp
                                                    Download

                                                    memory/4616-135-0x0000000000C60000-0x0000000000CC0000-memory.dmp
                                                    Download

                                                    memory/4616-123-0x0000000000C60000-0x0000000000CC0000-memory.dmp
                                                    Download

                                                    memory/4616-129-0x0000000000C60000-0x0000000000CC0000-memory.dmp
                                                    Download

                                                    memory/4660-281-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                    Download

                                                    memory/4660-103-0x00000000007A0000-0x0000000000800000-memory.dmp
                                                    Download

                                                    memory/4660-96-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                    Download

                                                    memory/4660-279-0x00000000007A0000-0x0000000000800000-memory.dmp
                                                    Download

                                                    memory/4660-277-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                    Download

                                                    memory/4668-2006-0x0000025B6D3B0000-0x0000025B6D57A000-memory.dmp
                                                    Download

                                                    memory/4668-813-0x00007FFE50070000-0x00007FFE505FE000-memory.dmp
                                                    Download

                                                    memory/5044-109-0x0000000140000000-0x000000014027D000-memory.dmp
                                                    Download

                                                    memory/5044-111-0x0000000000D40000-0x0000000000DA0000-memory.dmp
                                                    Download

                                                    memory/5044-117-0x0000000000D40000-0x0000000000DA0000-memory.dmp
                                                    Download

                                                    memory/5044-283-0x0000000140000000-0x000000014027D000-memory.dmp
                                                    Download

                                                    memory/5444-91-0x00000000004E0000-0x0000000000540000-memory.dmp
                                                    Download

                                                    memory/5444-90-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                    Download

                                                    memory/5444-84-0x00000000004E0000-0x0000000000540000-memory.dmp
                                                    Download

                                                    memory/5444-317-0x00000000004E0000-0x0000000000540000-memory.dmp
                                                    Download

                                                    memory/5444-255-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                    Download

                                                    memory/5444-319-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                    Download

                                                    memory/6368-9480-0x00007FFE4D010000-0x00007FFE4DC80000-memory.dmp
                                                    Download

                                                    memory/6368-9481-0x00007FFE52090000-0x00007FFE521D5000-memory.dmp
                                                    Download

                                                    memory/6368-9479-0x00007FF685590000-0x00007FF685951000-memory.dmp
                                                    Download

                                                    memory/6368-9484-0x00007FFE4B3E0000-0x00007FFE4BE4D000-memory.dmp
                                                    Download

                                                    memory/6368-9483-0x00007FFE45840000-0x00007FFE475EE000-memory.dmp
                                                    Download

                                                    memory/6368-9485-0x00007FFE4DC80000-0x00007FFE4F7A6000-memory.dmp
                                                    Download

                                                    memory/6368-9482-0x00007FFE4CA80000-0x00007FFE4D00E000-memory.dmp
                                                    Download

                                                    memory/6756-9517-0x00007FFE45840000-0x00007FFE475EE000-memory.dmp
                                                    Download

                                                    memory/6756-9513-0x00007FF685590000-0x00007FF685951000-memory.dmp
                                                    Download

                                                    memory/6756-9515-0x00007FFE52090000-0x00007FFE521D5000-memory.dmp
                                                    Download

                                                    memory/6756-9518-0x00007FFE4DC80000-0x00007FFE4F7A6000-memory.dmp
                                                    Download

                                                    memory/6756-9519-0x00007FFE4B3E0000-0x00007FFE4BE4D000-memory.dmp
                                                    Download

                                                    memory/6756-9516-0x00007FFE4CA80000-0x00007FFE4D00E000-memory.dmp
                                                    Download

                                                    memory/6756-9514-0x00007FFE4D010000-0x00007FFE4DC80000-memory.dmp
                                                    Download