Overview

overview

7

Static

static

3

2026-08-02...ca.exe

windows10-2004-x64

7

2026-08-02...ca.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    111s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 08:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_543edff963e53523148c836f6015d99c_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
  • Size 6.1MB
  • Sample260802-kl4ndafg59
  • SHA256 c70d3b7dbc61e560134a7dc0f97a2748930d894eccef88c6045913da77896b89
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdefense_evasiondiscoverypersistencespywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 16 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies system certificate store 2 TTPs 64 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_543edff963e53523148c836f6015d99c_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_543edff963e53523148c836f6015d99c_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"
    1⤵
    • Unexpected DNS network traffic destination
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4288
    • C:\ProgramData\WPS\Installers\724493adb267049b3ff521cc24bc725f_setup_XA_mui_12.9.0.21549_Free.exe.601.1161.exe
      "C:\ProgramData\WPS\Installers\724493adb267049b3ff521cc24bc725f_setup_XA_mui_12.9.0.21549_Free.exe.601.1161.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5792
      • C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe
        "C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" InstallService
        3⤵
          PID:3296
    • C:\ProgramData\WPS\Installers\724493adb267049b3ff521cc24bc725f_setup_XA_mui_12.9.0.21549_Free.exe.601.1161.exe
      "C:\ProgramData\WPS\Installers\724493adb267049b3ff521cc24bc725f_setup_XA_mui_12.9.0.21549_Free.exe.601.1161.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5B5F43 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5b5986\
      1⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      PID:1156
      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -setlng en_US
        2⤵
          PID:4468
        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -getonlineparam 00601.00001161 -forceperusermode
          2⤵
            PID:6020
          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -getabtest -forceperusermode
            2⤵
              PID:5004
            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -setservers
              2⤵
                PID:3252
              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -register
                2⤵
                  PID:768
              • C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe
                "C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" LocalService
                1⤵
                  PID:2716

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                      • Size 471B
                      • SHA256 fe97c3f89c4204d7aff528addbb02355efdcc9cbc71158f75570cf9e664fa0f6
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      8EC9B1D0ABBD7F98B401D425828828CE_660CACFBF957CBCC19C054A0402E41C3
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_660CACFBF957CBCC19C054A0402E41C3
                      • Size 727B
                      • SHA256 81ff4f43f3528dc0b04b7d80a49a57c85617ef57aab41eff7dd9d36b83e556cf
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                      • Size 727B
                      • SHA256 7f440831c5281e43c4f018985666168b7917cdf4e9551a345615b37c0c1cc43c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                      • Size 400B
                      • SHA256 3d44fb66a2484704ae31f4f0bc874f45d6a94087b86069332c0d8cf0b9637b8e
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      8EC9B1D0ABBD7F98B401D425828828CE_660CACFBF957CBCC19C054A0402E41C3
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_660CACFBF957CBCC19C054A0402E41C3
                      • Size 404B
                      • SHA256 24d0b231b8dfee41ff06b5856de2af345df1d63b98655b946e7829d1de19b861
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                      • Size 412B
                      • SHA256 e211c93e74867cf389da34a5caa5cfca658bc5efa60cf02e4910f521cad0e078
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Qt5NetworkKso.dll
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\Qt5NetworkKso.dll
                      • Size 1.1MB
                      • SHA256 3606498a2acb722a6162519c917bd83de51786fdca122b5342f200dc026d4758
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Qt5PrintSupportKso.dll
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\Qt5PrintSupportKso.dll
                      • Size 325KB
                      • SHA256 a24bb5fc3045f5e00f52f0bd6c08b0763e558365f2b4248d768ba4e7d7034c52
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Qt5XmlKso.dll
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\Qt5XmlKso.dll
                      • Size 170KB
                      • SHA256 d0b27892ae5003944e2af7859a1695b23be8eb0ed8e5640be05fcb5d4c582565
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      run.ini
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\addons\kstartpage\mui\default\productkey\html\run.ini
                      • Size 171B
                      • SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      kwppcopilotentry.qm
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\addons\kwppcopilotentry\mui\pt_BR\kwppcopilotentry.qm
                      • Size 334B
                      • SHA256 984ebeef80f6f50907afb92e5b5ae72df49fce045552c118a77a8887cc98e19b
                      • MD5 SHA1 SHA512
                      Submit Download

                      history.js
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\addons\qing\mui\default_xa\res\clouddiskhomepage\static\js\default\history.js
                      • Size 198KB
                      • SHA256 632f2d1136280eaed004b7231ae90ed76bbd06c25f73d900873abc1c6ae71769
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      setup.cfg
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\cfgs\setup.cfg
                      • Size 434B
                      • SHA256 1c35e8cc33fc0ec5975d4b16233deb6c10de3237efc5fbdae0236286cdcebc19
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      dbghelp.dll
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\dbghelp.dll
                      • Size 1.2MB
                      • SHA256 c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kbase.dll
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\kbase.dll
                      • Size 193KB
                      • SHA256 7317b4952d6d36d40ec7cb2b8b3c62c6c867986d5b1d5bfdb588b73f555bd2a3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kdownload.dll
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\kdownload.dll
                      • Size 433KB
                      • SHA256 92e2e4b1f6e96b6bfd2a2f682c2f7275501eefc2b3f9dc70c1ab5768b3cdaa48
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kprometheus.dll
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\kprometheus.dll
                      • Size 8.6MB
                      • SHA256 209d3e63ca17c4fe3cd5446ffa534e51e4512823de6e900817a79e3d5583cc83
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      krt.dll
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\krt.dll
                      • Size 1.2MB
                      • SHA256 a163823354751850ce0a41b6fb9645c5e5c00ee1ae5817436f5f7584f0eb0a40
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kshell.dll
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\kshell.dll
                      • Size 16.6MB
                      • SHA256 a2f7e6754fd1dae2525db81cc35afe75d461807cfab1df5383c679c539ed7111
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kshell.dll
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\kshell.dll
                      • Size 11.8MB
                      • SHA256 cfe0032ca74d91f67420d592c239e7c960973e20005ff520790012db778a4dc1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kso.dll
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\kso.dll
                      • Size 11.4MB
                      • SHA256 a38eb75163e91ae85edee94b13ff43db8750d1b9eb198bc99b0a9a8424745df4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ksolite.dll
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksolite.dll
                      • Size 10.4MB
                      • SHA256 d8f491383484c4d04f35335f3b5afd299a6d2710e66c925c14c8c2b7172c931b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ksomisc.exe
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                      • Size 3.3MB
                      • SHA256 59da110563de13621b533d11497da0e9a113accbab979f12e35c44b9ac0f36ef
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ksouil.dll
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksouil.dll
                      • Size 1.9MB
                      • SHA256 1cacf89acb12d59aa2905ef4afc6164983d8e3efcf3e8346f5d7d73a6c07263a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ent_background_2019_wpsoffice.png
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\mui\ja_JP\resource\splash\hdpi\2x\ent_background_2019_wpsoffice.png
                      • Size 236KB
                      • SHA256 5e7ba996d2331f37b9799767c0fa806cab9a39fea434796ab08dcaf39096e334
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      windowsprintersupport.dll
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\qt\plugins\printsupport\windowsprintersupport.dll
                      • Size 71KB
                      • SHA256 cbb6023c80df6901a4095aae79802a3b01d3813f00d792057f8665e687a92767
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wpscloudsvr.exe
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\wpscloudsvr.exe
                      • Size 923KB
                      • SHA256 31c528140cc00dc4fa3dda5c897090ee6efc44b069fd8af9cd9933087732c05f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      install.ini
                      • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\utility\install.ini
                      • Size 499B
                      • SHA256 ac4f26a184114522200169c5f57a0af4498a20d19b7ec6def14dd2c6413eb475
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Qt5CoreKso.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b5986\CONTROL\office6\Qt5CoreKso.dll
                      • Size 5.1MB
                      • SHA256 f439479d4d5c92c4b61dc6170974f7dc5fb4b60c52970d481d526f3560bbfac0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Qt5GuiKso.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b5986\CONTROL\office6\Qt5GuiKso.dll
                      • Size 5.3MB
                      • SHA256 04505182a6c27d451b4ef368fb790f3c57183e7f3d692abd96421f2ef7b05079
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Qt5SvgKso.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b5986\CONTROL\office6\Qt5SvgKso.dll
                      • Size 392KB
                      • SHA256 52ef87b1bc358dd1cf08bca05915e98a0c4e86feee565f40d6b518fc65302b44
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Qt5WidgetsKso.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b5986\CONTROL\office6\Qt5WidgetsKso.dll
                      • Size 4.5MB
                      • SHA256 0fc7689b019d8c71d33c9624e76c7890a8851a7c8d01de789ce78e166263ec35
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Qt5WinExtrasKso.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b5986\CONTROL\office6\Qt5WinExtrasKso.dll
                      • Size 217KB
                      • SHA256 048ed658567c60b191229ab9d0bcb8f3a1bf5fd55b935dc831c385255d9a821d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kpacketui.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b5986\CONTROL\office6\kpacketui.dll
                      • Size 2.9MB
                      • SHA256 f751256bcad8ca27481cb5f7ab0413a566ea0a4e91fd5f5f6cbc2b77b38aacec
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      msvcp140.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b5986\CONTROL\office6\msvcp140.dll
                      • Size 427KB
                      • SHA256 5a6dfa5e1ffb6c1e7fc76bd121c6c91305e10dd75fc2124f79fee291a9dd9e86
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qsvgicon.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b5986\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
                      • Size 61KB
                      • SHA256 78d08a3fc054d42be1378152081d8dfda71dfc8e0075b7c9b216eef1e9777b36
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qsvg.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b5986\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
                      • Size 41KB
                      • SHA256 c3729d3cb3e0abc4c201543706041f21b91eac8bb65827311e1609edda2e16a0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qdirect2d.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b5986\CONTROL\office6\qt\plugins\platforms\qdirect2d.dll
                      • Size 1.4MB
                      • SHA256 c81c70a133d214630565b7bf8f20ab0db7fa3a6fe8bc0ccd9e05f6d3aecea241
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qwindows.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b5986\CONTROL\office6\qt\plugins\platforms\qwindows.dll
                      • Size 1.3MB
                      • SHA256 2d5097e989f8f1b40cc9ecc2f62d0f6df87a84e9d8621f527f8848c9809053b0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qwindowsvistastyle.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b5986\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
                      • Size 145KB
                      • SHA256 4f28424f62e0f1f912d598c58359bc9f76b07428293f9458d157a52994c7ca6e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ucrtbase.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b5986\CONTROL\office6\ucrtbase.dll
                      • Size 1.1MB
                      • SHA256 2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      vcruntime140.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b5986\CONTROL\office6\vcruntime140.dll
                      • Size 75KB
                      • SHA256 f1fd5f6ec1cfe0cc3b66b5322ac97568bc63b19c1e415b99aad7c69ddbafa33c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      style.xml
                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b5986\CONTROL\pl_PL\style.xml
                      • Size 3KB
                      • SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      product.dat
                      • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b5986\CONTROL\product.dat
                      • Size 148KB
                      • SHA256 23a3d90868d28fc7c3813be0499dc6f4cee7e06feb31f91746360f19c8338441
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      tempinstall.ini
                      • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                      • Size 387B
                      • SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      tempinstall.ini
                      • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                      • Size 433B
                      • SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      ksomisc_2026_08_02.log
                      • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_08_02.log
                      • Size 5KB
                      • SHA256 e52a9839bcf51227a4090503139894474befab3eab7769fd466e26c41bedbf7b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wpssetup.log
                      • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                      • Size 10KB
                      • SHA256 cb439ed2c9afa5fe8d2c6b493ce1b155327bf33a436db444da1a137bae93d532
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wpssetup.log
                      • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                      • Size 11KB
                      • SHA256 3f0fea0e74262c67f81f3b4380b354b74cd5254c0464f1fd786d95692533c02d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wpssetup.log
                      • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                      • Size 25KB
                      • SHA256 cf52c72d52f9b12b5eeb133a995439de3a9ae92ba3706288782b30b940e72e15
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wpssetup.log
                      • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                      • Size 58KB
                      • SHA256 f52b18f42c0091c3305b9a4f1d4a4790157c261375d4c6c179a890874eeb47a8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wpssetup.log
                      • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                      • Size 58KB
                      • SHA256 e0f650ed7012b7f8937c7c39ca8578ae8b0164fe09d881c1a17d57dd4c0d6e61
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wpssetup.log
                      • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                      • Size 49KB
                      • SHA256 b0f1cbc5664869889ca319d5fa9914c18e1acc1676b26ab5a2f9a36ad06a2e17
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/768-4722-0x000000006EDF0000-0x000000007059F000-memory.dmp
                      Download

                      memory/768-4723-0x000000006B2B0000-0x000000006BB48000-memory.dmp
                      Download

                      memory/768-4729-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/768-4728-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/768-4727-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/768-4726-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/768-4725-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/3252-4691-0x000000006EDF0000-0x000000007059F000-memory.dmp
                      Download

                      memory/3252-4697-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/3252-4702-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/3252-4700-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/3252-4699-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/3252-4692-0x000000006E370000-0x000000006EDE7000-memory.dmp
                      Download

                      memory/3252-4698-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/3252-4701-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/3252-4696-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/3252-4695-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/3252-4693-0x000000006B2B0000-0x000000006BB48000-memory.dmp
                      Download

                      memory/3252-4717-0x00000000010A0000-0x00000000010B7000-memory.dmp
                      Download

                      memory/3252-4703-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/3252-4704-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/4288-0-0x0000000000400000-0x0000000000A18000-memory.dmp
                      Download

                      memory/4288-1-0x0000000000400000-0x0000000000A18000-memory.dmp
                      Download

                      memory/4468-4593-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/4468-4588-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/4468-4607-0x0000000002F20000-0x0000000002F37000-memory.dmp
                      Download

                      memory/4468-4590-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/4468-4591-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/4468-4592-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/4468-4573-0x000000006F6A0000-0x0000000070117000-memory.dmp
                      Download

                      memory/4468-4587-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/4468-4589-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/4468-4594-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/4468-4583-0x000000006D470000-0x000000006EC1F000-memory.dmp
                      Download

                      memory/4468-4584-0x000000006AC40000-0x000000006AC50000-memory.dmp
                      Download

                      memory/4468-4582-0x000000006AC50000-0x000000006B4E8000-memory.dmp
                      Download

                      memory/4468-4585-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/4468-4586-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/5004-4651-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/5004-4644-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/5004-4645-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/5004-4646-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/5004-4647-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/5004-4682-0x0000000002ED0000-0x0000000002EE7000-memory.dmp
                      Download

                      memory/5004-4637-0x000000006EDF0000-0x000000007059F000-memory.dmp
                      Download

                      memory/5004-4648-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/5004-4649-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/5004-4650-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/5004-4652-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/5004-4653-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/5004-4636-0x000000006E370000-0x000000006EDE7000-memory.dmp
                      Download

                      memory/5004-4638-0x000000006B2B0000-0x000000006BB48000-memory.dmp
                      Download

                      memory/6020-4614-0x000000006B2B0000-0x000000006BB48000-memory.dmp
                      Download

                      memory/6020-4624-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/6020-4625-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/6020-4623-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/6020-4612-0x000000006E370000-0x000000006EDE7000-memory.dmp
                      Download

                      memory/6020-4622-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/6020-4621-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/6020-4620-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/6020-4619-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/6020-4618-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/6020-4617-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/6020-4616-0x000000006AC30000-0x000000006AC40000-memory.dmp
                      Download

                      memory/6020-4613-0x000000006EDF0000-0x000000007059F000-memory.dmp
                      Download

                      memory/6020-4662-0x0000000001310000-0x0000000001327000-memory.dmp
                      Download