Overview

overview

7

Static

static

3

9ca59c3e39...97.exe

windows10-2004-x64

7

9ca59c3e39...97.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    59s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/08/2026, 08:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9ca59c3e39dbbbefd5d5ae20280d961e66989dd2ba01575f8f6cbfbaf77a6f97.exe
  • Size 5.7MB
  • Sample260825-kghv4sfr7x
  • SHA256 9ca59c3e39dbbbefd5d5ae20280d961e66989dd2ba01575f8f6cbfbaf77a6f97
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdefense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 12 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 40 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ca59c3e39dbbbefd5d5ae20280d961e66989dd2ba01575f8f6cbfbaf77a6f97.exe
    "C:\Users\Admin\AppData\Local\Temp\9ca59c3e39dbbbefd5d5ae20280d961e66989dd2ba01575f8f6cbfbaf77a6f97.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4124
    • C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1266.exe
      "C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1266.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      PID:2812
      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -checkInstallEnvironment
        3⤵
          PID:2044
        • C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
          "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService
          3⤵
            PID:3004
          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -addFirewallRule
            3⤵
              PID:4684
            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -regmtfont
              3⤵
                PID:4284
              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\\office6\ksomisc.exe" -setappcap
                3⤵
                  PID:7688
                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -sendinstalldyn 5
                  3⤵
                    PID:1700
                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -regPreviewHandler wps.exe et.exe wpp.exe
                    3⤵
                      PID:7744
                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\\office6\ksomisc.exe" -registerqingshellext 1
                      3⤵
                        PID:7252
                        • C:\Windows\system32\regsvr32.exe
                          "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingshellext64.dll"
                          4⤵
                            PID:7264
                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -regkwpsshellext admin
                          3⤵
                            PID:888
                            • C:\Windows\system32\regsvr32.exe
                              "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\kwpsshellext64.dll"
                              4⤵
                                PID:7596
                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\kwinappinstaller.exe
                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\kwinappinstaller.exe" -i "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\menuext" wpsappext1 wpsappext2 wpsappext3
                              3⤵
                                PID:7680
                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -regqingdriveshellext_install
                                3⤵
                                  PID:3792
                                  • C:\Windows\system32\regsvr32.exe
                                    "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*install "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
                                    4⤵
                                      PID:7064
                                    • C:\Windows\system32\regsvr32.exe
                                      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*thumbnail "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
                                      4⤵
                                        PID:6136
                                      • C:\Windows\system32\regsvr32.exe
                                        "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*drivebho "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
                                        4⤵
                                          PID:3484
                                        • C:\Windows\system32\regsvr32.exe
                                          "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
                                          4⤵
                                            PID:2780
                                          • C:\Windows\system32\regsvr32.exe
                                            "C:\Windows\system32\regsvr32.exe" /s /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
                                            4⤵
                                              PID:4948
                                            • C:\Windows\system32\regsvr32.exe
                                              "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*onlinefile "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
                                              4⤵
                                                PID:7636
                                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -regpdfwspv
                                              3⤵
                                                PID:2136
                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\\office6\ksomisc.exe" -setappcap
                                                3⤵
                                                  PID:4848
                                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\\office6\ksomisc.exe" -assoepub -source=1
                                                  3⤵
                                                    PID:5888
                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                • Drops file in System32 directory
                                                PID:4328
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                PID:3296
                                              • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                PID:4824
                                              • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                1⤵
                                                • Executes dropped EXE
                                                PID:252
                                              • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                1⤵
                                                • Executes dropped EXE
                                                PID:2584
                                              • C:\Windows\SysWow64\perfhost.exe
                                                C:\Windows\SysWow64\perfhost.exe
                                                1⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:1516
                                              • C:\Windows\System32\ReFsDedupSvc.exe
                                                C:\Windows\System32\ReFsDedupSvc.exe
                                                1⤵
                                                • Executes dropped EXE
                                                • Checks processor information in registry
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3740
                                              • C:\Windows\System32\SensorDataService.exe
                                                C:\Windows\System32\SensorDataService.exe
                                                1⤵
                                                • Executes dropped EXE
                                                • Drops file in System32 directory
                                                • Checks SCSI registry key(s)
                                                PID:1336
                                              • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                1⤵
                                                • Executes dropped EXE
                                                PID:2476
                                              • C:\Windows\system32\AgentService.exe
                                                C:\Windows\system32\AgentService.exe
                                                1⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5216
                                              • C:\Windows\system32\SearchIndexer.exe
                                                C:\Windows\system32\SearchIndexer.exe /Embedding
                                                1⤵
                                                • Executes dropped EXE
                                                • Enumerates connected drives
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of WriteProcessMemory
                                                PID:4612
                                                • C:\Windows\System32\SearchProtocolHost.exe
                                                  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                  2⤵
                                                    PID:1132
                                                  • C:\Windows\System32\SearchProtocolHost.exe
                                                    "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                    2⤵
                                                    • Modifies data under HKEY_USERS
                                                    PID:1940
                                                  • C:\Windows\System32\SearchFilterHost.exe
                                                    "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
                                                    2⤵
                                                    • Modifies data under HKEY_USERS
                                                    PID:3768
                                                  • C:\Windows\System32\SearchFilterHost.exe
                                                    "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2952 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
                                                    2⤵
                                                    • Modifies data under HKEY_USERS
                                                    PID:5812
                                                • C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1266.exe
                                                  "C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1266.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5A3346 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\
                                                  1⤵
                                                    PID:4552
                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -setlng en_US
                                                      2⤵
                                                        PID:6544
                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -getonlineparam 00601.00001266 -forceperusermode
                                                        2⤵
                                                          PID:2640
                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -getabtest -forceperusermode
                                                          2⤵
                                                            PID:4416
                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -fixoldversionassostatus
                                                            2⤵
                                                              PID:972
                                                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -setservers
                                                              2⤵
                                                                PID:6540
                                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -register
                                                                2⤵
                                                                  PID:3764
                                                                  • C:\Windows\system32\regsvr32.exe
                                                                    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
                                                                    3⤵
                                                                      PID:3476
                                                                      • C:\Windows\SysWOW64\regsvr32.exe
                                                                        /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
                                                                        4⤵
                                                                          PID:5072
                                                                      • C:\Windows\system32\regsvr32.exe
                                                                        "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
                                                                        3⤵
                                                                          PID:7236
                                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -regprogid true
                                                                        2⤵
                                                                          PID:7488
                                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -assowordexcelpowerpnt 1 1 1 -source=1
                                                                          2⤵
                                                                            PID:7632
                                                                            • C:\Windows\System32\openwith.exe
                                                                              "C:\Windows\System32\openwith.exe"
                                                                              3⤵
                                                                                PID:8096
                                                                              • C:\Windows\System32\openwith.exe
                                                                                "C:\Windows\System32\openwith.exe"
                                                                                3⤵
                                                                                  PID:2000
                                                                                • C:\Windows\System32\openwith.exe
                                                                                  "C:\Windows\System32\openwith.exe"
                                                                                  3⤵
                                                                                    PID:1888
                                                                                  • C:\Windows\System32\openwith.exe
                                                                                    "C:\Windows\System32\openwith.exe"
                                                                                    3⤵
                                                                                      PID:4476
                                                                                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                                                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -compatiblemso -source=1
                                                                                    2⤵
                                                                                      PID:3900
                                                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -checkcompatiblemso
                                                                                      2⤵
                                                                                        PID:6652
                                                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -saveas_mso
                                                                                        2⤵
                                                                                          PID:6372
                                                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -distsrc 00601.00001266
                                                                                          2⤵
                                                                                            PID:2664
                                                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode -source=1
                                                                                            2⤵
                                                                                            • Network Service Discovery
                                                                                            PID:3268
                                                                                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\pinTaskbar.exe
                                                                                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk" 5386
                                                                                              3⤵
                                                                                                PID:3604
                                                                                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                                                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -addcontextmenushellnew
                                                                                              2⤵
                                                                                                PID:7720
                                                                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -regvascontextmenushellnew
                                                                                                2⤵
                                                                                                  PID:6932
                                                                                                • C:\Windows\system32\regsvr32.exe
                                                                                                  "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kdesktopshellext\kdesktopshellext.dll"
                                                                                                  2⤵
                                                                                                    PID:7868
                                                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                      /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kdesktopshellext\kdesktopshellext.dll"
                                                                                                      3⤵
                                                                                                        PID:7812
                                                                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -regyunpanfornew -forceperusermode
                                                                                                      2⤵
                                                                                                        PID:7572
                                                                                                        • C:\Windows\system32\regsvr32.exe
                                                                                                          "C:\Windows\system32\regsvr32.exe" /s /u /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
                                                                                                          3⤵
                                                                                                            PID:7920
                                                                                                          • C:\Windows\system32\regsvr32.exe
                                                                                                            "C:\Windows\system32\regsvr32.exe" /s /u /n /i:overlayicon "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
                                                                                                            3⤵
                                                                                                              PID:7628
                                                                                                            • C:\Windows\system32\regsvr32.exe
                                                                                                              "C:\Windows\system32\regsvr32.exe" /s /u /n /i:contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
                                                                                                              3⤵
                                                                                                                PID:7704
                                                                                                              • C:\Windows\system32\regsvr32.exe
                                                                                                                "C:\Windows\system32\regsvr32.exe" /s /u /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\qingnse64.dll"
                                                                                                                3⤵
                                                                                                                  PID:8120
                                                                                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -setup_assopdf -source=1
                                                                                                                2⤵
                                                                                                                  PID:7984
                                                                                                                  • C:\Windows\System32\openwith.exe
                                                                                                                    "C:\Windows\System32\openwith.exe"
                                                                                                                    3⤵
                                                                                                                      PID:6624
                                                                                                                • C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
                                                                                                                  "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
                                                                                                                  1⤵
                                                                                                                    PID:6904
                                                                                                                  • C:\Windows\system32\userinit.exe
                                                                                                                    C:\Windows\system32\userinit.exe
                                                                                                                    1⤵
                                                                                                                      PID:6072
                                                                                                                      • C:\Windows\Explorer.EXE
                                                                                                                        C:\Windows\Explorer.EXE
                                                                                                                        2⤵
                                                                                                                          PID:8052
                                                                                                                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                        1⤵
                                                                                                                          PID:236
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                          1⤵
                                                                                                                            PID:6732

                                                                                                                          Network

                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                elevation_service.exe
                                                                                                                                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                • Size 2.7MB
                                                                                                                                • SHA256 7fd8293330fc111e5b4a684f89f33e3fb7e474495dd55ccf41655a376a8e78f8
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                maintenanceservice.exe
                                                                                                                                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                • Size 1.5MB
                                                                                                                                • SHA256 d359fb288b3805b06d45e6d3545b1fc0f0a56db21e79509c83a3aead24b1466d
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                OSE.EXE
                                                                                                                                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                                                                • Size 1.5MB
                                                                                                                                • SHA256 a95c2365560d4ac67a8adeb10f9b844b2b5a0c9acc716cd606620bd0cf07270e
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                elevation_service.exe
                                                                                                                                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                • Size 2.8MB
                                                                                                                                • SHA256 f2479c514d1707789e188943654140cb1cd1b7a02986febe32142a591cac1aa9
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Windows.db
                                                                                                                                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                                                                                                                                • Size 1.0MB
                                                                                                                                • SHA256 3beeef633387581df97556316154b835daab0c60fe562822186a6d97e7780293
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Windows.db-wal
                                                                                                                                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                                                                                                                                • Size 317KB
                                                                                                                                • SHA256 fe4fea538ca83d93ff6ed56018c0ffc5ee641934866e7a3bc0e47ed7fb5d0a0b
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                616AD1AB067CFD351D6C0EF6F3E12F40
                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 d0d68bca590ca729a8834cfce52cf09acdc32cc99a1412d4f29aca6a06cbb804
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                                • Size 727B
                                                                                                                                • SHA256 dc681afcab2dc20617c3ec9c1952dce7bb475cb10abe62027e4ac811517d5375
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                • Size 727B
                                                                                                                                • SHA256 60d282be67b221691c3c4576f80f343441d03c1f598935e34b015668592b09ef
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                616AD1AB067CFD351D6C0EF6F3E12F40
                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40
                                                                                                                                • Size 252B
                                                                                                                                • SHA256 e23a14f6eef56715562b365ca741e1cd7d1b8b59c41d2975b4eb046dbb614fca
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                                • Size 404B
                                                                                                                                • SHA256 8247d317813b9320a6590088a28b02afa25f36754af417e34fe19eebab24fd7a
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                • Size 412B
                                                                                                                                • SHA256 ca9a9af004ebad6b3abc3d3b247de6eb13597f99d3e04705a8c942763d150d43
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                Qt5NetworkKso.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\Qt5NetworkKso.dll
                                                                                                                                • Size 1.4MB
                                                                                                                                • SHA256 77586248b2db8ecd9951a9d7e624999178cec189f5565d2e13f9ec933fad107d
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                logo-small.png
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\StartScreenTile\ksolaunch\logo-small.png
                                                                                                                                • Size 6KB
                                                                                                                                • SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                logo.png
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\StartScreenTile\ksolaunch\logo.png
                                                                                                                                • Size 12KB
                                                                                                                                • SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Everything-KingSoft-Read-Only.ini
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\everythingsearch\everythingbinary\Everything-KingSoft-Read-Only.ini
                                                                                                                                • Size 404B
                                                                                                                                • SHA256 b5980cd1122d2ad4727bc06806e3d2a6598b7d67b6eb3d2732938d08c6deedbb
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                run.ini
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\karticlewebcloudsummary\mui\dist\run.ini
                                                                                                                                • Size 171B
                                                                                                                                • SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                kcoworkdockpanel.qm
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kcoworkdockpanel\mui\es_MX\kcoworkdockpanel.qm
                                                                                                                                • Size 846B
                                                                                                                                • SHA256 8f0de81b05e2ce8a22432406009084933f0cf410e6efb534aafd71699651120c
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                kcoworkdockpanel.qm
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kcoworkdockpanel\mui\vi_VN\kcoworkdockpanel.qm
                                                                                                                                • Size 839B
                                                                                                                                • SHA256 ad5549bf1c748909f191eba6e08caccfb31dbe1a2ce4bfafcb1e41702f40c95f
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                index.html
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kpdfcorporateglossary\res\dist\index.html
                                                                                                                                • Size 636B
                                                                                                                                • SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                index.js
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kpdfcorporateglossary\res\dist\index.js
                                                                                                                                • Size 2KB
                                                                                                                                • SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                errPage.html
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
                                                                                                                                • Size 7KB
                                                                                                                                • SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                favicon.ico
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
                                                                                                                                • Size 4KB
                                                                                                                                • SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                run.ini
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebpromehelp\run.ini
                                                                                                                                • Size 226B
                                                                                                                                • SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                close-secondary.svg
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
                                                                                                                                • Size 216B
                                                                                                                                • SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                kwpsaibasetypo.qm
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
                                                                                                                                • Size 334B
                                                                                                                                • SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                kwpsaibasetypo.qm
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
                                                                                                                                • Size 327B
                                                                                                                                • SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                element-icons.ttf
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
                                                                                                                                • Size 54KB
                                                                                                                                • SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                element-icons.woff
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
                                                                                                                                • Size 27KB
                                                                                                                                • SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                app.css
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
                                                                                                                                • Size 107KB
                                                                                                                                • SHA256 907d1f5ee046fae72b52eaf99508ddb6b48d47b803076db0e9a86b0e21a54ba9
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                chunk-vendors.css
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
                                                                                                                                • Size 279KB
                                                                                                                                • SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                app.js
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
                                                                                                                                • Size 380KB
                                                                                                                                • SHA256 fd9dcbe72da3477714bf68b8987db4718e4be32f313d09bfefbd4d78aa051a84
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                chunk-vendors.js
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
                                                                                                                                • Size 249KB
                                                                                                                                • SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                chunk-vendors.js
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
                                                                                                                                • Size 424KB
                                                                                                                                • SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                index.js
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
                                                                                                                                • Size 10KB
                                                                                                                                • SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                index.js
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
                                                                                                                                • Size 13KB
                                                                                                                                • SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                index.js
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
                                                                                                                                • Size 14KB
                                                                                                                                • SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                apm-init.js
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
                                                                                                                                • Size 57B
                                                                                                                                • SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                default_ava.svg
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
                                                                                                                                • Size 906B
                                                                                                                                • SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                desk-sync.svg
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                loading.svg
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                kdesign.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\kdesign.dll
                                                                                                                                • Size 1.3MB
                                                                                                                                • SHA256 027df5dd563cfc2dcd95b2799cd6e4b2e29f3953d3b0726f6b1f11eeb0c602eb
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                krt.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\krt.dll
                                                                                                                                • Size 1.4MB
                                                                                                                                • SHA256 3691f73fb7fbef11cc75dbab0de195f9edf51dd33bd61ef784dc6abdf00b25ca
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                kshell.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\kshell.dll
                                                                                                                                • Size 27.0MB
                                                                                                                                • SHA256 21a0b5fb9aaa6674589dfa30f6cbc22b2a6ecd896e7bc2095971f13d204b926b
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                ksolite.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksolite.dll
                                                                                                                                • Size 12.4MB
                                                                                                                                • SHA256 ca5bd7244b5136c9901963bc2cd11d5aa919e6363fa3a13fb7685d5bffea12e2
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                ksomisc.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                                                                                                                                • Size 3.7MB
                                                                                                                                • SHA256 9555ca85ef085b11d92dd2fa4c901d4fa3c72865df5e7a6bfeee6cc7c8a8f3b0
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                libcrypto-kso-1_1-x64.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\libcrypto-kso-1_1-x64.dll
                                                                                                                                • Size 3.4MB
                                                                                                                                • SHA256 367a50ae0ab3f5f04259e190cb837ae169517190f2a8da6efa5f776412111464
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                error-net-72.png
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                presetLayout_16.pptx
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
                                                                                                                                • Size 41KB
                                                                                                                                • SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                install.ini
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\utility\install.ini
                                                                                                                                • Size 462B
                                                                                                                                • SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                prep_Activatable Class_Hermes_perf.cache
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                • Size 603B
                                                                                                                                • SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                prep_Activatable Class_Hermes_perf.cache
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                • Size 599B
                                                                                                                                • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                APPX.66rgav_fj2ba3zsu12n2p3gfe.tmp
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\APPX.66rgav_fj2ba3zsu12n2p3gfe.tmp
                                                                                                                                • Size 4KB
                                                                                                                                • SHA256 81c968c375f69d9e4666901fd4c14a6ce4b738639ff78488562e2c79f8fb14d8
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                APPX.83b1lzkek0dz492gyyfqg12oc.tmp
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\APPX.83b1lzkek0dz492gyyfqg12oc.tmp
                                                                                                                                • Size 712B
                                                                                                                                • SHA256 a3ca9aae4ba31a89982b18f1b929accb9db7d06a8d786f433ef5ccc667409b1d
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                APPX.9t0knerw3ash_0yhdyvurpqab.tmp
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\APPX.9t0knerw3ash_0yhdyvurpqab.tmp
                                                                                                                                • Size 4KB
                                                                                                                                • SHA256 9d2f34f1b17536dd689db858d42c85a78cb48ccf24f55fd578699dd1cbd7c930
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                APPX.fy72k1vfqv4pvhjlvojqxyj3.tmp
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\APPX.fy72k1vfqv4pvhjlvojqxyj3.tmp
                                                                                                                                • Size 712B
                                                                                                                                • SHA256 7310eb8c9a5115a236fe0f5b2a40386c478b4a1c8de6c16aa20363d4beaa2659
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                APPX.in6eomxw6s4qttv3l66qir32.tmp
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\APPX.in6eomxw6s4qttv3l66qir32.tmp
                                                                                                                                • Size 4KB
                                                                                                                                • SHA256 322a6bbe4151c8c0d85b94a20e1566a69e7e19532fe6bb7ee4b5d806daea5366
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                APPX.k_m1y63q814bzazi6agdgd20g.tmp
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\APPX.k_m1y63q814bzazi6agdgd20g.tmp
                                                                                                                                • Size 712B
                                                                                                                                • SHA256 c4cbc1fe8ab082b7e179d5d73115ba2580cb1170e38f98ba559c61bbc8bed882
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                APPX.v5mszi83yxa1mxj4p0qv5o7bd.tmp
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\APPX.v5mszi83yxa1mxj4p0qv5o7bd.tmp
                                                                                                                                • Size 10KB
                                                                                                                                • SHA256 275c03a752ffa7c962279b0145bdbe4c179e235f524081b8543642e895d86f0c
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                APPX.xw8pi4ftkbn0k1wfisbgpw5pe.tmp
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\APPX.xw8pi4ftkbn0k1wfisbgpw5pe.tmp
                                                                                                                                • Size 10KB
                                                                                                                                • SHA256 ff76515e3de2646c2f9a29ef3070d5344102a26d1e5cfcf0b4dc9d330cf4b3fc
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                APPX.xxd6hecb7p2zlq5grb6z8jsod.tmp
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\APPX.xxd6hecb7p2zlq5grb6z8jsod.tmp
                                                                                                                                • Size 10KB
                                                                                                                                • SHA256 b40d28e789ecfc7dd669f7c6f4850de9750c2d9e04c1339f1940a45511b1b809
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Qt5CoreKso.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\CONTROL\office6\Qt5CoreKso.dll
                                                                                                                                • Size 5.7MB
                                                                                                                                • SHA256 d76ce35aa1a6d2d9ee025bbb2e8743c401039cd4161058dc4f379588057a5b94
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Qt5GuiKso.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\CONTROL\office6\Qt5GuiKso.dll
                                                                                                                                • Size 6.4MB
                                                                                                                                • SHA256 c3a2de3161f7cc03dccd2c375cb10aeda109069c13689c105ba161f39c2a35d4
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Qt5SvgKso.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\CONTROL\office6\Qt5SvgKso.dll
                                                                                                                                • Size 503KB
                                                                                                                                • SHA256 bc68fc65d3620fd0e31e625ac359ce68d0c26bc45f68d5ada1e4cb4df9852978
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Qt5WidgetsKso.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\CONTROL\office6\Qt5WidgetsKso.dll
                                                                                                                                • Size 5.6MB
                                                                                                                                • SHA256 70eeb2b38bd9e4b17d49e62a1a8c5040a0ba309205224d500a89b20480ff4886
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Qt5WinExtrasKso.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\CONTROL\office6\Qt5WinExtrasKso.dll
                                                                                                                                • Size 251KB
                                                                                                                                • SHA256 5f55c44db9c677781b79f5c0527fc5ec81dad8e4fbfac6076a45f1d0d747e24e
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                kpacketui.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\CONTROL\office6\kpacketui.dll
                                                                                                                                • Size 836KB
                                                                                                                                • SHA256 e0db71f3a34e740fad2e39f52a63272340d3bb719e2f60294bf0520fa3cf6dae
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                msvcp140.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\CONTROL\office6\msvcp140.dll
                                                                                                                                • Size 544KB
                                                                                                                                • SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                qsvgicon.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
                                                                                                                                • Size 75KB
                                                                                                                                • SHA256 dcf5212ec3fe7746f8b26a504687be3bb29954294b7f448c4940b413fb04c527
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                qsvg.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
                                                                                                                                • Size 46KB
                                                                                                                                • SHA256 524e279aa876ea45ac1205c4f4210c226aded2298d96b4ba46f3e7c4faec499a
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                qskia.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\CONTROL\office6\qt\plugins\platforms\qskia.dll
                                                                                                                                • Size 1.9MB
                                                                                                                                • SHA256 6daafb39daca277e272ba56a115eed0235b45d5d820fa9b315f78005e048e6e6
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                qwindows.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\CONTROL\office6\qt\plugins\platforms\qwindows.dll
                                                                                                                                • Size 1.6MB
                                                                                                                                • SHA256 8a87eb5fad6e90294115e7b3df56971dd278a48456344b4bf2ea15a3055c56af
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                qwindowsvistastyle.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
                                                                                                                                • Size 159KB
                                                                                                                                • SHA256 a4c3bb047f8d6d9240d5b020de80ee53585ed5029fec341ce2bab300b615a586
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                ucrtbase.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\CONTROL\office6\ucrtbase.dll
                                                                                                                                • Size 987KB
                                                                                                                                • SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                vcruntime140.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\CONTROL\office6\vcruntime140.dll
                                                                                                                                • Size 121KB
                                                                                                                                • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                vcruntime140_1.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\CONTROL\office6\vcruntime140_1.dll
                                                                                                                                • Size 48KB
                                                                                                                                • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                style.xml
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\CONTROL\pl_PL\style.xml
                                                                                                                                • Size 3KB
                                                                                                                                • SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                product.dat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\CONTROL\product.dat
                                                                                                                                • Size 97KB
                                                                                                                                • SHA256 2e844013324b6d0b45e0f68706c289221de46dcb231c45a52cdbfce80bcac54c
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                product_new.dat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\CONTROL\product_new.dat
                                                                                                                                • Size 83KB
                                                                                                                                • SHA256 53a97ea8fd5bde7018db62835a7aaf4ec5689e175224e7cdb18bf070357de113
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                style.xml
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a2d99\CONTROL\vi_VN\style.xml
                                                                                                                                • Size 4KB
                                                                                                                                • SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                tempinstall.ini
                                                                                                                                • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                                                                                                                                • Size 387B
                                                                                                                                • SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                tempinstall.ini
                                                                                                                                • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                                                                                                                                • Size 433B
                                                                                                                                • SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                ksomisc_2026_08_25.log
                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_08_25.log
                                                                                                                                • Size 3KB
                                                                                                                                • SHA256 c3a64dae32c489d520c7bb38bbf53a577b517e890a56540fc6b4c14b9eb7f6e3
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                ksomisc_2026_08_25.log
                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_08_25.log
                                                                                                                                • Size 5KB
                                                                                                                                • SHA256 e86723619c0088d96821f8f053dcdf6791920164e1f715da787b9ca1b8f4755d
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                wpssetup.log
                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                • Size 10KB
                                                                                                                                • SHA256 86833c6701df0c6c3a8d71a0fbe5d2583b1469025f5ae076bea0604636c24df7
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                wpssetup.log
                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                • Size 11KB
                                                                                                                                • SHA256 ae5b6f9fc6b36f3e49d884b434f257df6ef74e31ba452cdd584a67c87bbf6d7f
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                wpssetup.log
                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                • Size 27KB
                                                                                                                                • SHA256 b3cda9415636ad3c8363454e68514c477d9026a6eef63873d3204e3c67dce1a4
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                wpssetup.log
                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                • Size 61KB
                                                                                                                                • SHA256 38ceb69cc91215d91d35ff0404e85b0e28b973984ffa0a90b238a573cf6d5d72
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                wpssetup.log
                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                • Size 67KB
                                                                                                                                • SHA256 c91680f42d933ee22946b3ee68fdfc863723ec078d4997f1b9ed314c18771439
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                mdbx.dat
                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-x64\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat
                                                                                                                                • Size 64KB
                                                                                                                                • SHA256 b781af0c0af27155d79e84a62bdd6d83e76159a76e0cdcfed7a2dc25c5ae2616
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                mdbx.dat
                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-x64\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat
                                                                                                                                • Size 64KB
                                                                                                                                • SHA256 4300478c7d12b62f0f397035439021559d1ac7e22bce6a5c260bb97b1cd83686
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                dcsdk_dpv3.data
                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
                                                                                                                                • Size 44KB
                                                                                                                                • SHA256 90cffe47cb5c364ffe00f60946df5476ac8c47f7f82b015ef6034b72324633a7
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                dcsdk_dpv3.data
                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
                                                                                                                                • Size 38KB
                                                                                                                                • SHA256 c971e9d7a211544208b43f04247d169663821f6093dfb959be8030bc1b3b5590
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                perfhost.exe
                                                                                                                                • Path C:\Windows\SysWOW64\perfhost.exe
                                                                                                                                • Size 1.3MB
                                                                                                                                • SHA256 7721da89020d838282a64db137f62e457bd1d77fb0a3a119fd25eaf076e6db3d
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                AgentService.exe
                                                                                                                                • Path C:\Windows\System32\AgentService.exe
                                                                                                                                • Size 1.4MB
                                                                                                                                • SHA256 8790fb825c4fec4fd537e0a119621aedfb13c26188826e1ec26e6f14e587139a
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                ssh-agent.exe
                                                                                                                                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                                                                                                • Size 1.8MB
                                                                                                                                • SHA256 557ac52a4697a4237d35c4d89bf4f90ee5ce84d77b16ddd635658fa6c5653e25
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                ReFsDedupSvc.exe
                                                                                                                                • Path C:\Windows\System32\ReFsDedupSvc.exe
                                                                                                                                • Size 2.6MB
                                                                                                                                • SHA256 50b5683640de4b5a50f5a90117d1461baa32ad018c30bb8ce51bcc5d7701e81d
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                SearchIndexer.exe
                                                                                                                                • Path C:\Windows\System32\SearchIndexer.exe
                                                                                                                                • Size 1.4MB
                                                                                                                                • SHA256 362f9500f33b9ac905e3dcb8b1a7b677467f78561dcb76b34d020a827629da4f
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                SensorDataService.exe
                                                                                                                                • Path C:\Windows\System32\SensorDataService.exe
                                                                                                                                • Size 1.7MB
                                                                                                                                • SHA256 587ad2987be5816cf4a762255702705b88302f0bd9ad4dc217a9848355eb4623
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                PerceptionSimulationService.exe
                                                                                                                                • Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                                                                                                • Size 1.5MB
                                                                                                                                • SHA256 6ca7ab30e4a1228ac89a9bfe3e7a403fbc1324809cae94de3a10a7fcfe45ca6a
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                memory/252-57-0x0000000000890000-0x00000000008F0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/252-56-0x0000000140000000-0x0000000140238000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/252-63-0x0000000000890000-0x00000000008F0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/252-311-0x0000000140000000-0x0000000140238000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1336-109-0x00000000006A0000-0x0000000000700000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1336-303-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1336-288-0x00000000006A0000-0x0000000000700000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1336-103-0x00000000006A0000-0x0000000000700000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1336-102-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1516-80-0x0000000000400000-0x0000000000600000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1516-86-0x0000000000A60000-0x0000000000AC6000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1516-313-0x0000000000400000-0x0000000000600000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1516-81-0x0000000000A60000-0x0000000000AC6000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2044-9444-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2044-9448-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2044-9442-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2044-9441-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2044-9434-0x00007FFA9AD50000-0x00007FFA9B7BD000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2044-9445-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2044-9440-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2044-9439-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2044-9432-0x00007FFAA2E30000-0x00007FFAA33BE000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2044-9446-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2044-9447-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2044-9443-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2044-9438-0x00007FFA88EA0000-0x00007FFA88EB0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2044-9437-0x00007FFA9FCB0000-0x00007FFAA17D6000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2044-9436-0x00007FF79D230000-0x00007FF79D5F1000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2044-9435-0x00007FFA98FA0000-0x00007FFA9AD4E000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2044-9431-0x00007FFAA33C0000-0x00007FFAA3505000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2044-9433-0x00007FFAA21C0000-0x00007FFAA2E30000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2476-121-0x0000000000D40000-0x0000000000DA0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2476-260-0x0000000140000000-0x00000001402A7000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2476-115-0x0000000000D40000-0x0000000000DA0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2584-75-0x00000000006B0000-0x0000000000710000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2584-312-0x0000000140000000-0x0000000140234000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2584-67-0x0000000140000000-0x0000000140234000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2584-69-0x00000000006B0000-0x0000000000710000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2640-9524-0x00007FF79D230000-0x00007FF79D5F1000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2640-9527-0x00007FFAA0C20000-0x00007FFAA0D65000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2640-9525-0x00007FFAA0D70000-0x00007FFAA19E0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2812-801-0x00007FFAA3980000-0x00007FFAA3F0E000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3004-9637-0x0000000140000000-0x00000001401AE000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3004-9626-0x0000000140000000-0x00000001401AE000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3296-38-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3296-262-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3296-30-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3296-29-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3604-10211-0x0000000140000000-0x0000000140216000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3604-10337-0x0000000140000000-0x0000000140216000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3740-90-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3740-91-0x0000000000560000-0x00000000005C0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3740-314-0x0000000000560000-0x00000000005C0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3740-97-0x0000000000560000-0x00000000005C0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3740-316-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4124-0-0x0000000000E00000-0x0000000000E66000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4124-79-0x0000000000400000-0x00000000009C1000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4124-7-0x0000000000400000-0x00000000009C1000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4124-5-0x0000000000E00000-0x0000000000E66000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4328-14-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4328-22-0x0000000000DA0000-0x0000000000E00000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4328-21-0x0000000000DA0000-0x0000000000E00000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4328-168-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4612-327-0x0000000140000000-0x0000000140172000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4612-261-0x0000000140000000-0x0000000140172000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4612-147-0x00000000006A0000-0x0000000000700000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4824-54-0x0000000140000000-0x000000014023E000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4824-41-0x0000000140000000-0x000000014023E000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4824-48-0x0000000001E20000-0x0000000001E80000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4824-42-0x0000000001E20000-0x0000000001E80000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4824-52-0x0000000001E20000-0x0000000001E80000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5216-139-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5216-137-0x0000000000D10000-0x0000000000D70000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5216-132-0x0000000000D10000-0x0000000000D70000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5216-126-0x0000000000D10000-0x0000000000D70000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6544-9477-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6544-9475-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6544-9472-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6544-9471-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6544-9480-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6544-9469-0x00007FFA99A10000-0x00007FFA9B7BE000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6544-9464-0x00007FFAA0C20000-0x00007FFAA0D65000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6544-9463-0x00007FF79D230000-0x00007FF79D5F1000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6544-9474-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6544-9466-0x00007FFAA1B50000-0x00007FFAA3676000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6544-9479-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6544-9478-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6544-9473-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6544-9476-0x00007FFA87DC0000-0x00007FFA87DD0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6544-9467-0x00007FFAA0320000-0x00007FFAA08AE000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6544-9468-0x00007FFA98FA0000-0x00007FFA99A0D000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6544-9465-0x00007FFAA0D70000-0x00007FFAA19E0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6904-9717-0x0000000140000000-0x00000001401AE000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6904-9703-0x0000000140000000-0x00000001401AE000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/7680-10299-0x0000000005280000-0x000000000528A000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/7680-10300-0x0000000005310000-0x0000000005336000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/7680-10289-0x0000000000970000-0x0000000000978000-memory.dmp
                                                                                                                                Download