Overview

overview

7

Static

static

3

2026-09-28...ca.exe

windows10-2004-x64

7

2026-09-28...ca.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    59s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/09/2026, 11:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-28_c98ae53e15a78a3b86fbba1c3b5cd67d_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
  • Size 5.7MB
  • Sample260928-n1ymfstyc1
  • SHA256 4e1a1465dd763a2b98ee9d1cfed202a14a8decf1774f6e287b5a836b43b9de40
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdefense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 12 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes a Windows system DLL name to a user directory 2 TTPs 1 IoCs

    A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

    defense_evasion
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 32 IoCs
  • Modifies system certificate store 2 TTPs 40 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-28_c98ae53e15a78a3b86fbba1c3b5cd67d_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-28_c98ae53e15a78a3b86fbba1c3b5cd67d_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"
    1⤵
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4556
    • C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1074.exe
      "C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1074.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
      2⤵
      • Executes dropped EXE
      • Writes a Windows system DLL name to a user directory
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      PID:1868
      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -checkInstallEnvironment
        3⤵
          PID:9588
        • C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
          "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService
          3⤵
            PID:4080
          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -addFirewallRule
            3⤵
              PID:1288
            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpsoffice.exe
              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpsoffice.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=klangmanager -dll_name=klangmanager.dll downloadlang en_US
              3⤵
                PID:6224
              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regmtfont
                3⤵
                  PID:6060
                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\\office6\ksomisc.exe" -setappcap
                  3⤵
                    PID:7272
                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -sendinstalldyn 5
                    3⤵
                      PID:9108
                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regPreviewHandler wps.exe et.exe wpp.exe
                      3⤵
                        PID:9208
                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\\office6\ksomisc.exe" -registerqingshellext 1
                        3⤵
                          PID:2284
                          • C:\Windows\system32\regsvr32.exe
                            "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingshellext64.dll"
                            4⤵
                              PID:4776
                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regkwpsshellext admin
                            3⤵
                              PID:6420
                              • C:\Windows\system32\regsvr32.exe
                                "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kwpsshellext64.dll"
                                4⤵
                                  PID:1092
                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kwinappinstaller.exe
                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kwinappinstaller.exe" -i "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\menuext" wpsappext1 wpsappext2 wpsappext3
                                3⤵
                                  PID:4356
                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regqingdriveshellext_install
                                  3⤵
                                    PID:6712
                                    • C:\Windows\system32\regsvr32.exe
                                      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*install "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                      4⤵
                                        PID:7808
                                      • C:\Windows\system32\regsvr32.exe
                                        "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*thumbnail "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                        4⤵
                                          PID:8512
                                        • C:\Windows\system32\regsvr32.exe
                                          "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*drivebho "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                          4⤵
                                            PID:3492
                                          • C:\Windows\system32\regsvr32.exe
                                            "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                            4⤵
                                              PID:8688
                                            • C:\Windows\system32\regsvr32.exe
                                              "C:\Windows\system32\regsvr32.exe" /s /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                              4⤵
                                                PID:8792
                                              • C:\Windows\system32\regsvr32.exe
                                                "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*onlinefile "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                                4⤵
                                                  PID:8788
                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regpdfwspv
                                                3⤵
                                                  PID:9896
                                                  • C:\Windows\system32\regsvr32.exe
                                                    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\pdfwspv\pdfwspv.dll"
                                                    4⤵
                                                      PID:984
                                                    • C:\Windows\system32\regsvr32.exe
                                                      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\pdfwspv\pdfwspv.dll"
                                                      4⤵
                                                        PID:6360
                                                      • C:\Windows\system32\regsvr32.exe
                                                        "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\pdfwspv\pdfwspv.dll"
                                                        4⤵
                                                          PID:3512
                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\\office6\ksomisc.exe" -setappcap
                                                        3⤵
                                                          PID:9824
                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\\office6\ksomisc.exe" -assoepub -source=1
                                                          3⤵
                                                            PID:9928
                                                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Reads the TCP/IP host and domain name from the registry
                                                        PID:5728
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:6092
                                                      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:4436
                                                      • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                        "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:1912
                                                      • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                        C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:1052
                                                      • C:\Windows\SysWow64\perfhost.exe
                                                        C:\Windows\SysWow64\perfhost.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:4472
                                                      • C:\Windows\System32\ReFsDedupSvc.exe
                                                        C:\Windows\System32\ReFsDedupSvc.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Checks processor information in registry
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4252
                                                      • C:\Windows\System32\SensorDataService.exe
                                                        C:\Windows\System32\SensorDataService.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Checks SCSI registry key(s)
                                                        PID:3968
                                                      • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                        C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:1524
                                                      • C:\Windows\system32\AgentService.exe
                                                        C:\Windows\system32\AgentService.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3352
                                                      • C:\Windows\system32\SearchIndexer.exe
                                                        C:\Windows\system32\SearchIndexer.exe /Embedding
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Enumerates connected drives
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3912
                                                        • C:\Windows\System32\SearchProtocolHost.exe
                                                          "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                          2⤵
                                                          • Modifies data under HKEY_USERS
                                                          PID:2212
                                                        • C:\Windows\System32\SearchProtocolHost.exe
                                                          "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                          2⤵
                                                            PID:2784
                                                          • C:\Windows\System32\SearchFilterHost.exe
                                                            "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
                                                            2⤵
                                                              PID:4620
                                                            • C:\Windows\System32\SearchFilterHost.exe
                                                              "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
                                                              2⤵
                                                                PID:3336
                                                            • C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1074.exe
                                                              "C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1074.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5AA922 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\
                                                              1⤵
                                                                PID:1712
                                                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -setlng en_US
                                                                  2⤵
                                                                    PID:9864
                                                                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -getonlineparam 00601.00001074 -forceperusermode
                                                                    2⤵
                                                                      PID:10212
                                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -getabtest -forceperusermode
                                                                      2⤵
                                                                        PID:6844
                                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -fixoldversionassostatus
                                                                        2⤵
                                                                          PID:4736
                                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -setservers
                                                                          2⤵
                                                                            PID:1548
                                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -register
                                                                            2⤵
                                                                              PID:6472
                                                                              • C:\Windows\system32\regsvr32.exe
                                                                                "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
                                                                                3⤵
                                                                                  PID:6964
                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                    /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
                                                                                    4⤵
                                                                                      PID:7016
                                                                                  • C:\Windows\system32\regsvr32.exe
                                                                                    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
                                                                                    3⤵
                                                                                      PID:7156
                                                                                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regprogid true
                                                                                    2⤵
                                                                                      PID:7548
                                                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -assowordexcelpowerpnt 1 1 1 -source=1
                                                                                      2⤵
                                                                                        PID:7724
                                                                                        • C:\Windows\System32\openwith.exe
                                                                                          "C:\Windows\System32\openwith.exe"
                                                                                          3⤵
                                                                                            PID:8140
                                                                                          • C:\Windows\System32\openwith.exe
                                                                                            "C:\Windows\System32\openwith.exe"
                                                                                            3⤵
                                                                                              PID:6660
                                                                                            • C:\Windows\System32\openwith.exe
                                                                                              "C:\Windows\System32\openwith.exe"
                                                                                              3⤵
                                                                                                PID:3048
                                                                                              • C:\Windows\System32\openwith.exe
                                                                                                "C:\Windows\System32\openwith.exe"
                                                                                                3⤵
                                                                                                  PID:8164
                                                                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -compatiblemso -source=1
                                                                                                2⤵
                                                                                                  PID:8428
                                                                                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -checkcompatiblemso
                                                                                                  2⤵
                                                                                                    PID:6492
                                                                                                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -saveas_mso
                                                                                                    2⤵
                                                                                                      PID:8604
                                                                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -distsrc 00601.00001074
                                                                                                      2⤵
                                                                                                        PID:9036
                                                                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode -source=1
                                                                                                        2⤵
                                                                                                        • Network Service Discovery
                                                                                                        PID:9192
                                                                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk" 5386
                                                                                                          3⤵
                                                                                                            PID:10052
                                                                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -addcontextmenushellnew
                                                                                                          2⤵
                                                                                                            PID:4068
                                                                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regvascontextmenushellnew
                                                                                                            2⤵
                                                                                                              PID:9768
                                                                                                            • C:\Windows\system32\regsvr32.exe
                                                                                                              "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kdesktopshellext\kdesktopshellext.dll"
                                                                                                              2⤵
                                                                                                                PID:2668
                                                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                  /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kdesktopshellext\kdesktopshellext.dll"
                                                                                                                  3⤵
                                                                                                                    PID:4880
                                                                                                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regyunpanfornew -forceperusermode
                                                                                                                  2⤵
                                                                                                                    PID:3060
                                                                                                                    • C:\Windows\system32\regsvr32.exe
                                                                                                                      "C:\Windows\system32\regsvr32.exe" /s /u /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                                                                                                      3⤵
                                                                                                                        PID:2724
                                                                                                                      • C:\Windows\system32\regsvr32.exe
                                                                                                                        "C:\Windows\system32\regsvr32.exe" /s /u /n /i:overlayicon "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                                                                                                        3⤵
                                                                                                                          PID:2400
                                                                                                                        • C:\Windows\system32\regsvr32.exe
                                                                                                                          "C:\Windows\system32\regsvr32.exe" /s /u /n /i:contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                                                                                                          3⤵
                                                                                                                            PID:5856
                                                                                                                          • C:\Windows\system32\regsvr32.exe
                                                                                                                            "C:\Windows\system32\regsvr32.exe" /s /u /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                                                                                                            3⤵
                                                                                                                              PID:6384
                                                                                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -setup_assopdf -source=1
                                                                                                                            2⤵
                                                                                                                              PID:9080
                                                                                                                              • C:\Windows\System32\openwith.exe
                                                                                                                                "C:\Windows\System32\openwith.exe"
                                                                                                                                3⤵
                                                                                                                                  PID:9528
                                                                                                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -assofdf -source=1
                                                                                                                                2⤵
                                                                                                                                  PID:9756
                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                                1⤵
                                                                                                                                  PID:1380
                                                                                                                                • C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
                                                                                                                                  "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
                                                                                                                                  1⤵
                                                                                                                                    PID:5268
                                                                                                                                  • C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
                                                                                                                                    "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
                                                                                                                                    1⤵
                                                                                                                                      PID:6868
                                                                                                                                    • C:\Windows\system32\userinit.exe
                                                                                                                                      C:\Windows\system32\userinit.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:5268
                                                                                                                                        • C:\Windows\Explorer.EXE
                                                                                                                                          C:\Windows\Explorer.EXE
                                                                                                                                          2⤵
                                                                                                                                            PID:5700
                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                          1⤵
                                                                                                                                            PID:6952
                                                                                                                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                            1⤵
                                                                                                                                              PID:6856

                                                                                                                                            Network

                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                  Reconnaissance

                                                                                                                                                  Resource Development

                                                                                                                                                  Initial Access

                                                                                                                                                  Execution

                                                                                                                                                  Persistence

                                                                                                                                                  Hijack Execution Flow

                                                                                                                                                  1
                                                                                                                                                  T1574

                                                                                                                                                  DLL Search Order Hijacking

                                                                                                                                                  1
                                                                                                                                                  T1574.001

                                                                                                                                                  Pre-OS Boot

                                                                                                                                                  1
                                                                                                                                                  T1542

                                                                                                                                                  Bootkit

                                                                                                                                                  1
                                                                                                                                                  T1542.003

                                                                                                                                                  Privilege Escalation

                                                                                                                                                  Hijack Execution Flow

                                                                                                                                                  1
                                                                                                                                                  T1574

                                                                                                                                                  DLL Search Order Hijacking

                                                                                                                                                  1
                                                                                                                                                  T1574.001

                                                                                                                                                  Defense Evasion

                                                                                                                                                  Hijack Execution Flow

                                                                                                                                                  1
                                                                                                                                                  T1574

                                                                                                                                                  DLL Search Order Hijacking

                                                                                                                                                  1
                                                                                                                                                  T1574.001

                                                                                                                                                  Masquerading

                                                                                                                                                  1
                                                                                                                                                  T1036

                                                                                                                                                  Match Legitimate Name or Location

                                                                                                                                                  1
                                                                                                                                                  T1036.005

                                                                                                                                                  Modify Registry

                                                                                                                                                  1
                                                                                                                                                  T1112

                                                                                                                                                  Pre-OS Boot

                                                                                                                                                  1
                                                                                                                                                  T1542

                                                                                                                                                  Bootkit

                                                                                                                                                  1
                                                                                                                                                  T1542.003

                                                                                                                                                  Subvert Trust Controls

                                                                                                                                                  1
                                                                                                                                                  T1553

                                                                                                                                                  Install Root Certificate

                                                                                                                                                  1
                                                                                                                                                  T1553.004

                                                                                                                                                  Credential Access

                                                                                                                                                  Credentials from Password Stores

                                                                                                                                                  1
                                                                                                                                                  T1555

                                                                                                                                                  Credentials from Web Browsers

                                                                                                                                                  1
                                                                                                                                                  T1555.003

                                                                                                                                                  Unsecured Credentials

                                                                                                                                                  1
                                                                                                                                                  T1552

                                                                                                                                                  Credentials In Files

                                                                                                                                                  1
                                                                                                                                                  T1552.001

                                                                                                                                                  Discovery

                                                                                                                                                  Network Service Discovery

                                                                                                                                                  1
                                                                                                                                                  T1046

                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                  2
                                                                                                                                                  T1120

                                                                                                                                                  Query Registry

                                                                                                                                                  3
                                                                                                                                                  T1012

                                                                                                                                                  System Information Discovery

                                                                                                                                                  4
                                                                                                                                                  T1082

                                                                                                                                                  System Location Discovery

                                                                                                                                                  1
                                                                                                                                                  T1614

                                                                                                                                                  System Language Discovery

                                                                                                                                                  1
                                                                                                                                                  T1614.001

                                                                                                                                                  System Network Configuration Discovery

                                                                                                                                                  1
                                                                                                                                                  T1016

                                                                                                                                                  Lateral Movement

                                                                                                                                                  Collection

                                                                                                                                                  Data from Local System

                                                                                                                                                  1
                                                                                                                                                  T1005

                                                                                                                                                  Command and Control

                                                                                                                                                  Exfiltration

                                                                                                                                                  Impact

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  elevation_service.exe
                                                                                                                                                  • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                  • Size 2.7MB
                                                                                                                                                  • SHA256 ba702b597110bbf9f122b317af59c0df869d873bc29fcbd5e37c1e2b0fb0a9ce
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  maintenanceservice.exe
                                                                                                                                                  • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                  • Size 1.4MB
                                                                                                                                                  • SHA256 31e46364f90d5b6b5a7d2727793c52784dfaff24976f8744b7ed4824951113fe
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  OSE.EXE
                                                                                                                                                  • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                                                                                  • Size 1.4MB
                                                                                                                                                  • SHA256 11e3bad2d19c58da0f7e2314db35c9a0c6b81175896bf3388de8b367635c4ec0
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  elevation_service.exe
                                                                                                                                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                  • Size 2.8MB
                                                                                                                                                  • SHA256 457a4838d7c4139f7ec8aa591925d08fafb248d125ed7423f8040fc17256f5dd
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Windows.db
                                                                                                                                                  • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                                                                                                                                                  • Size 1.2MB
                                                                                                                                                  • SHA256 7ae105b3d46273284ce622b96499408d56371266046df6ce8083f1553db53a65
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Windows.db-wal
                                                                                                                                                  • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                                                                                                                                                  • Size 333KB
                                                                                                                                                  • SHA256 6be3c759afa27f4c2b5c9b8a3157f88a3430dfeb550c19d3d52bbb2c63418ea5
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                  • Size 471B
                                                                                                                                                  • SHA256 4d68a2f030db35a5051e52b9a041770c5fafb1cbcee1c127a8f82605ed4a943b
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                                                  • Size 727B
                                                                                                                                                  • SHA256 da3c4e38a5b1e1125b6e03cc1c0ade3928ea2ced3750b8622723bdd1adce6e52
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                  • Size 727B
                                                                                                                                                  • SHA256 95f159be75de03795da292ccd094b926db1a117d2f54fa4bb0db84d09fdc0a98
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                  • Size 400B
                                                                                                                                                  • SHA256 c13b228ab7c553f194c6eb4f06e6062acfb24e2c240f5ca26ab69b918c340c74
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                                                  • Size 404B
                                                                                                                                                  • SHA256 4c6ade6ef4fafc5445ff02894e843425082464c9bb719a86dcbaf66176f13d38
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                  • Size 412B
                                                                                                                                                  • SHA256 be666fd524064cfee1915f0ce7f612bde04288e2947dd5626d70d80598e07d24
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Qt5NetworkKso.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\Qt5NetworkKso.dll
                                                                                                                                                  • Size 1.4MB
                                                                                                                                                  • SHA256 e800493d5f4a4d0d0bce523c4228fc28507db20f6940c741bc49000e7575f227
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  logo-small.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\StartScreenTile\ksolaunch\logo-small.png
                                                                                                                                                  • Size 6KB
                                                                                                                                                  • SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  logo.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\StartScreenTile\ksolaunch\logo.png
                                                                                                                                                  • Size 12KB
                                                                                                                                                  • SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Everything-KingSoft-Read-Only.ini
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\everythingsearch\everythingbinary\Everything-KingSoft-Read-Only.ini
                                                                                                                                                  • Size 404B
                                                                                                                                                  • SHA256 b5980cd1122d2ad4727bc06806e3d2a6598b7d67b6eb3d2732938d08c6deedbb
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  run.ini
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\karticlewebcloudsummary\mui\dist\run.ini
                                                                                                                                                  • Size 171B
                                                                                                                                                  • SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  kcoworkdockpanel.qm
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kcoworkdockpanel\mui\es_MX\kcoworkdockpanel.qm
                                                                                                                                                  • Size 846B
                                                                                                                                                  • SHA256 8f0de81b05e2ce8a22432406009084933f0cf410e6efb534aafd71699651120c
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  kcoworkdockpanel.qm
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kcoworkdockpanel\mui\vi_VN\kcoworkdockpanel.qm
                                                                                                                                                  • Size 839B
                                                                                                                                                  • SHA256 ad5549bf1c748909f191eba6e08caccfb31dbe1a2ce4bfafcb1e41702f40c95f
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  index.html
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kpdfcorporateglossary\res\dist\index.html
                                                                                                                                                  • Size 636B
                                                                                                                                                  • SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  index.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kpdfcorporateglossary\res\dist\index.js
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  errPage.html
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
                                                                                                                                                  • Size 7KB
                                                                                                                                                  • SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  favicon.ico
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
                                                                                                                                                  • Size 4KB
                                                                                                                                                  • SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  run.ini
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kwebpromehelp\run.ini
                                                                                                                                                  • Size 226B
                                                                                                                                                  • SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  close-secondary.svg
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
                                                                                                                                                  • Size 216B
                                                                                                                                                  • SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  kwpsaibasetypo.qm
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
                                                                                                                                                  • Size 334B
                                                                                                                                                  • SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  kwpsaibasetypo.qm
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
                                                                                                                                                  • Size 327B
                                                                                                                                                  • SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  element-icons.ttf
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
                                                                                                                                                  • Size 54KB
                                                                                                                                                  • SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  element-icons.woff
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
                                                                                                                                                  • Size 27KB
                                                                                                                                                  • SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  app.css
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
                                                                                                                                                  • Size 107KB
                                                                                                                                                  • SHA256 907d1f5ee046fae72b52eaf99508ddb6b48d47b803076db0e9a86b0e21a54ba9
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  chunk-vendors.css
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
                                                                                                                                                  • Size 279KB
                                                                                                                                                  • SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  app.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
                                                                                                                                                  • Size 380KB
                                                                                                                                                  • SHA256 fd9dcbe72da3477714bf68b8987db4718e4be32f313d09bfefbd4d78aa051a84
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  chunk-vendors.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
                                                                                                                                                  • Size 249KB
                                                                                                                                                  • SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  chunk-vendors.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
                                                                                                                                                  • Size 424KB
                                                                                                                                                  • SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  index.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
                                                                                                                                                  • Size 10KB
                                                                                                                                                  • SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  index.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
                                                                                                                                                  • Size 13KB
                                                                                                                                                  • SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  index.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
                                                                                                                                                  • Size 14KB
                                                                                                                                                  • SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  apm-init.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
                                                                                                                                                  • Size 57B
                                                                                                                                                  • SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  default_ava.svg
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
                                                                                                                                                  • Size 906B
                                                                                                                                                  • SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  desk-sync.svg
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  loading.svg
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  setup.cfg
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\cfgs\setup.cfg
                                                                                                                                                  • Size 449B
                                                                                                                                                  • SHA256 81b8cc8d1affd6d91a8ffec9810868a1200e4c4d9586383c7a89d4c4755b0e7b
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  kdesign.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kdesign.dll
                                                                                                                                                  • Size 1.3MB
                                                                                                                                                  • SHA256 ffcf491a7a575ef1a9a34bd74348ba724ac0a7bdd386c0c33f4c6c0c4584e9c6
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  krt.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\krt.dll
                                                                                                                                                  • Size 1.3MB
                                                                                                                                                  • SHA256 147a0720be09be772ee513e958849d73f8dede61e077c9cd13b27f3e353b2c8a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  kshell.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kshell.dll
                                                                                                                                                  • Size 27.1MB
                                                                                                                                                  • SHA256 010bbd735adc686c5fa2a5575d8fff97056c8f7d4c3739be994e22f43ecfde55
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ksolite.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksolite.dll
                                                                                                                                                  • Size 11.6MB
                                                                                                                                                  • SHA256 bab2dd2ec926b20337f6bbb8d8f8455696c83d34c881bff8e650336281610f42
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ksomisc.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                                                                                  • Size 3.7MB
                                                                                                                                                  • SHA256 a1839da0804ad31b5e262afc44f77617b0c710b9de7550e5d0039c65f8541e15
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  libcrypto-kso-1_1-x64.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\libcrypto-kso-1_1-x64.dll
                                                                                                                                                  • Size 3.4MB
                                                                                                                                                  • SHA256 09d8cfa187a21c7172736889c41b47d87955c27721939e7c4e0d9bc24a1d8783
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  error-net-72.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  presetLayout_16.pptx
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
                                                                                                                                                  • Size 41KB
                                                                                                                                                  • SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  wpscloudsvr.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscloudsvr.exe
                                                                                                                                                  • Size 1.1MB
                                                                                                                                                  • SHA256 5d2b4a3bedf86b4c58fcdbca99481f83d1dec309923c26794c1b4d9f8761d470
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  wpsoffice.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpsoffice.exe
                                                                                                                                                  • Size 1.2MB
                                                                                                                                                  • SHA256 79654a15c88175633251bac8348fdd2181d017d3ecb2bb102e6b979f76a43b05
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  install.ini
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\utility\install.ini
                                                                                                                                                  • Size 462B
                                                                                                                                                  • SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                  • Size 591B
                                                                                                                                                  • SHA256 dc216c11d6381abdcb6a4b927fd9ea68d336ff63c88639e4a242acf037f90c68
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                  • Size 595B
                                                                                                                                                  • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  APPX.24avo4bjdd8u3n4kt3oli99kh.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\APPX.24avo4bjdd8u3n4kt3oli99kh.tmp
                                                                                                                                                  • Size 10KB
                                                                                                                                                  • SHA256 575e5ab758445707fecbb56317f72927014a1f5a12188af932279aa157aedfac
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  APPX.31xb8w691rkse2qgzc1a3nayh.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\APPX.31xb8w691rkse2qgzc1a3nayh.tmp
                                                                                                                                                  • Size 4KB
                                                                                                                                                  • SHA256 322a6bbe4151c8c0d85b94a20e1566a69e7e19532fe6bb7ee4b5d806daea5366
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  APPX.fil_5warbom1bik8by7ltj33h.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\APPX.fil_5warbom1bik8by7ltj33h.tmp
                                                                                                                                                  • Size 712B
                                                                                                                                                  • SHA256 5d3a68b91b773660c9e58606782baaf5ba7a691919364373ad559fe8d0d47572
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  APPX.hipgrsa2nk3oxg458ihdom8rh.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\APPX.hipgrsa2nk3oxg458ihdom8rh.tmp
                                                                                                                                                  • Size 712B
                                                                                                                                                  • SHA256 7310eb8c9a5115a236fe0f5b2a40386c478b4a1c8de6c16aa20363d4beaa2659
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  APPX.ju9yywr6oyft22b6x9syspffg.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\APPX.ju9yywr6oyft22b6x9syspffg.tmp
                                                                                                                                                  • Size 10KB
                                                                                                                                                  • SHA256 5d32f24f2f89aabf70de201faf88f9bd8827ca638353f14a64bea38e1c5a3f63
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  APPX.ov5iw6_fltvcg0e9548v_er9d.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\APPX.ov5iw6_fltvcg0e9548v_er9d.tmp
                                                                                                                                                  • Size 10KB
                                                                                                                                                  • SHA256 fd3f98ca032876c26d2d15849a9505b36364f5f26d3186e8382d5e3332ecce8a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  APPX.owdamx4nxgbqlxgp3t5_m4dzf.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\APPX.owdamx4nxgbqlxgp3t5_m4dzf.tmp
                                                                                                                                                  • Size 4KB
                                                                                                                                                  • SHA256 9d2f34f1b17536dd689db858d42c85a78cb48ccf24f55fd578699dd1cbd7c930
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  APPX.r3tfpohhkw074nbnxfhia893.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\APPX.r3tfpohhkw074nbnxfhia893.tmp
                                                                                                                                                  • Size 712B
                                                                                                                                                  • SHA256 40206cc446612c3c79d0aae7d80976f941e05a4f31112819b7342716bae98233
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  APPX.rrwp_iu54h49gx6hhb_n79kng.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\APPX.rrwp_iu54h49gx6hhb_n79kng.tmp
                                                                                                                                                  • Size 4KB
                                                                                                                                                  • SHA256 81c968c375f69d9e4666901fd4c14a6ce4b738639ff78488562e2c79f8fb14d8
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Qt5CoreKso.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\CONTROL\office6\Qt5CoreKso.dll
                                                                                                                                                  • Size 5.7MB
                                                                                                                                                  • SHA256 cc232fce14f26b48e69205eadbd75d9c480c328dbe64b5ca72b9e5b0711bebc1
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Qt5GuiKso.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\CONTROL\office6\Qt5GuiKso.dll
                                                                                                                                                  • Size 6.4MB
                                                                                                                                                  • SHA256 0b577ba30dcced8f1d2ea41e21dc26095c372559999a31f92a0a7ab40cc3dec3
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Qt5SvgKso.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\CONTROL\office6\Qt5SvgKso.dll
                                                                                                                                                  • Size 503KB
                                                                                                                                                  • SHA256 e879d108fc57815f07dbebf4a94114ab46d41ae1058aae7368ef0f575c7f7b5e
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Qt5WidgetsKso.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\CONTROL\office6\Qt5WidgetsKso.dll
                                                                                                                                                  • Size 5.6MB
                                                                                                                                                  • SHA256 558f41cd447c3e2a25f3823ca5bc9f06142044acb05e6877486d9ad1c85ffc60
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Qt5WinExtrasKso.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\CONTROL\office6\Qt5WinExtrasKso.dll
                                                                                                                                                  • Size 251KB
                                                                                                                                                  • SHA256 8d4e3c1a0e767477432e276cd064e74cb13fbc4114ecf59dd1df3918089ac42d
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  kpacketui.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\CONTROL\office6\kpacketui.dll
                                                                                                                                                  • Size 870KB
                                                                                                                                                  • SHA256 9b8b1ffaf8e441f6c7da585141da83eb2ae063d07fcae103843b2f72099171fd
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  msvcp140.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\CONTROL\office6\msvcp140.dll
                                                                                                                                                  • Size 544KB
                                                                                                                                                  • SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  qsvgicon.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
                                                                                                                                                  • Size 75KB
                                                                                                                                                  • SHA256 4038b28981414c886b556c8e11e4045d4a8dcacd1ee762941c4c189129b7fa96
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  qsvg.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
                                                                                                                                                  • Size 46KB
                                                                                                                                                  • SHA256 f89f816cc55e3219b33787ff34921e5848c4a1625497e30825e1d9cfafb98285
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  qskia.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\CONTROL\office6\qt\plugins\platforms\qskia.dll
                                                                                                                                                  • Size 1.9MB
                                                                                                                                                  • SHA256 fb9bbb486da8b22248f5235fed71455913b3a237701c43847910034697b75ae9
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  qwindows.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\CONTROL\office6\qt\plugins\platforms\qwindows.dll
                                                                                                                                                  • Size 1.6MB
                                                                                                                                                  • SHA256 b0f0847499ecaa2d88cf6675acf0b000ac619a2cc6ecfb6bc31da796d3e76e5f
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  qwindowsvistastyle.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
                                                                                                                                                  • Size 159KB
                                                                                                                                                  • SHA256 cf4257b456d0954611ee0d3937aedbb696a367fda2e12aa81e9db8bdce2a974a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ucrtbase.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\CONTROL\office6\ucrtbase.dll
                                                                                                                                                  • Size 987KB
                                                                                                                                                  • SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  vcruntime140.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\CONTROL\office6\vcruntime140.dll
                                                                                                                                                  • Size 121KB
                                                                                                                                                  • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  vcruntime140_1.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\CONTROL\office6\vcruntime140_1.dll
                                                                                                                                                  • Size 48KB
                                                                                                                                                  • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  style.xml
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\CONTROL\pl_PL\style.xml
                                                                                                                                                  • Size 3KB
                                                                                                                                                  • SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  product.dat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\CONTROL\product.dat
                                                                                                                                                  • Size 97KB
                                                                                                                                                  • SHA256 2e844013324b6d0b45e0f68706c289221de46dcb231c45a52cdbfce80bcac54c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  product_new.dat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\CONTROL\product_new.dat
                                                                                                                                                  • Size 85KB
                                                                                                                                                  • SHA256 91f7b5037c07e9e6f555e6ca8a1ab34674cce9726f90186364e6d6f89b64a10a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  style.xml
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aa3c3\CONTROL\vi_VN\style.xml
                                                                                                                                                  • Size 4KB
                                                                                                                                                  • SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  tempinstall.ini
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                                                                                                                                                  • Size 387B
                                                                                                                                                  • SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  tempinstall.ini
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                                                                                                                                                  • Size 433B
                                                                                                                                                  • SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ksomisc_2026_09_28.log
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_09_28.log
                                                                                                                                                  • Size 3KB
                                                                                                                                                  • SHA256 863b01b456d65620af1a5284eaa50b6b568a21fef8ab5dcc7e62b315652b6c20
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ksomisc_2026_09_28.log
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_09_28.log
                                                                                                                                                  • Size 5KB
                                                                                                                                                  • SHA256 47ba317be96ac83ef75d7917b05a7182849e9a96a19387d88c8d15a76bf83380
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  wpssetup.log
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                                  • Size 10KB
                                                                                                                                                  • SHA256 7801205938089fae6f3f04c2d436054a4d9ac4ad3f0d2550ed97e609ad05f9d2
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  wpssetup.log
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                                  • Size 11KB
                                                                                                                                                  • SHA256 7f245bd1d1b2eb639ec59fc5478d47b382780a866921b364fed98e1bf95b9f3a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  wpssetup.log
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                                  • Size 27KB
                                                                                                                                                  • SHA256 e34411221cb4c3e4d830950c15c3d2f8a0f8008d917f88b333efb09d850b3dc2
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  wpssetup.log
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                                  • Size 60KB
                                                                                                                                                  • SHA256 bd8ad29b5bdb6a6eb5d08199afd84d0d53f3d7e7354cc07e268964c57ba57f0b
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  wpssetup.log
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                                  • Size 67KB
                                                                                                                                                  • SHA256 39a19a16b7160235141f04c346a3aa9c063bee5e775380324704d1ed9a17c3b9
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  wpssetup.log
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                                                  • Size 67KB
                                                                                                                                                  • SHA256 5f394cd376af0566bcf2287bf268f84f3152295281ee672075a70f2ae4a979c6
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  mdbx.dat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-x64\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat
                                                                                                                                                  • Size 64KB
                                                                                                                                                  • SHA256 ab025ad21f29169669d69cbaf63c0eed85676e53557c1d3d96eb9e33aee07fad
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  dcsdk_dpv3.data
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
                                                                                                                                                  • Size 45KB
                                                                                                                                                  • SHA256 37422910054af57057e722742c137bed784d3ab89854fa6a32f723262d615ab1
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  dcsdk_dpv3.data
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
                                                                                                                                                  • Size 40KB
                                                                                                                                                  • SHA256 7cedb07137f055fe8fc4746805bce5f4d4695f12c0f5a94f0cea1b32388dce5b
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  perfhost.exe
                                                                                                                                                  • Path C:\Windows\SysWOW64\perfhost.exe
                                                                                                                                                  • Size 1.2MB
                                                                                                                                                  • SHA256 a0e7f0ee6c5001c308bffd1917e2ad076afaed665327bd83fd1148a6d019175d
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  AgentService.exe
                                                                                                                                                  • Path C:\Windows\System32\AgentService.exe
                                                                                                                                                  • Size 1.4MB
                                                                                                                                                  • SHA256 e2fac67dc79f2a1299e753e860e33871fa97b8808b42da2f42d2212a0f1333cc
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssh-agent.exe
                                                                                                                                                  • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                                                                                                                  • Size 1.7MB
                                                                                                                                                  • SHA256 2e88575338fa249fc89b1ae15d87849bd93e8411c2d55acb9cbc68b2108d8898
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  PerceptionSimulationService.exe
                                                                                                                                                  • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                                                                                                                                  • Size 1.4MB
                                                                                                                                                  • SHA256 0971f33b833def0c27632b6fe811738347511c9d238d4441f376596480f78843
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ReFsDedupSvc.exe
                                                                                                                                                  • Path C:\Windows\System32\ReFsDedupSvc.exe
                                                                                                                                                  • Size 2.6MB
                                                                                                                                                  • SHA256 656b8f34c2983d6a1977effc7d013ff20b19628e008818d5962ec35777742f54
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  SearchIndexer.exe
                                                                                                                                                  • Path C:\Windows\System32\SearchIndexer.exe
                                                                                                                                                  • Size 1.4MB
                                                                                                                                                  • SHA256 708fbe74856ec8e3fca2b3e85558414247ef8d6b0dc6b457f9c879a60f3d0185
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  SensorDataService.exe
                                                                                                                                                  • Path C:\Windows\System32\SensorDataService.exe
                                                                                                                                                  • Size 1.7MB
                                                                                                                                                  • SHA256 08734aed12de76f4f2644c51b3ff8bffba58a5430c0bf66fd5cc98c7673169e7
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  memory/1052-288-0x0000000140000000-0x000000014020A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1052-70-0x0000000000BB0000-0x0000000000C10000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1052-76-0x0000000000BB0000-0x0000000000C10000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1052-68-0x0000000140000000-0x000000014020A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1524-118-0x0000000000990000-0x00000000009F0000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1524-323-0x0000000140000000-0x000000014027D000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1524-110-0x0000000140000000-0x000000014027D000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1524-112-0x0000000000990000-0x00000000009F0000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1868-9748-0x000001F136290000-0x000001F136848000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1868-7342-0x000001F136290000-0x000001F136848000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1868-792-0x00007FFDBEC90000-0x00007FFDBF21E000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1868-9343-0x000001F136290000-0x000001F136848000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1868-9126-0x000001F136290000-0x000001F136848000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1868-2493-0x000001F136290000-0x000001F136848000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1912-57-0x0000000000870000-0x00000000008D0000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1912-282-0x0000000140000000-0x000000014020E000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1912-64-0x0000000000870000-0x00000000008D0000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1912-63-0x0000000140000000-0x000000014020E000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3352-135-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3352-123-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3352-137-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3352-130-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3912-337-0x0000000140000000-0x0000000140172000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3912-146-0x00000000006A0000-0x0000000000700000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3912-139-0x0000000140000000-0x0000000140172000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3912-140-0x00000000006A0000-0x0000000000700000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3968-98-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3968-293-0x0000000000770000-0x00000000007D0000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3968-105-0x0000000000770000-0x00000000007D0000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3968-99-0x0000000000770000-0x00000000007D0000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3968-295-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4252-311-0x00000000007D0000-0x0000000000830000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4252-86-0x00000000007D0000-0x0000000000830000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4252-85-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4252-310-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4252-313-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4252-92-0x00000000007D0000-0x0000000000830000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4356-10597-0x0000000000F80000-0x0000000000F88000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4356-10601-0x0000000005920000-0x0000000005946000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4356-10599-0x00000000058B0000-0x00000000058BA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4436-40-0x0000000140000000-0x0000000140214000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4436-53-0x0000000140000000-0x0000000140214000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4436-47-0x00000000017C0000-0x0000000001820000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4436-51-0x00000000017C0000-0x0000000001820000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4436-41-0x00000000017C0000-0x0000000001820000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4472-294-0x0000000000400000-0x00000000005D6000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4472-81-0x0000000000400000-0x00000000005D6000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4556-1-0x0000000000E50000-0x0000000000EB7000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4556-80-0x0000000000400000-0x00000000009C1000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4556-0-0x0000000000400000-0x00000000009C1000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4556-8-0x0000000000E50000-0x0000000000EB7000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5728-15-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5728-83-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5728-23-0x0000000000D20000-0x0000000000D80000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5728-17-0x0000000000D20000-0x0000000000D80000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5728-22-0x0000000000D20000-0x0000000000D80000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6092-35-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6092-34-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6092-28-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6092-97-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6092-36-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6868-10520-0x0000000140000000-0x00000001401AF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6868-9988-0x0000000140000000-0x00000001401AF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9588-9686-0x00007FFDA21C0000-0x00007FFDA21D0000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9588-9694-0x00007FFDA0A10000-0x00007FFDA0A20000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9588-9687-0x00007FFDA0A10000-0x00007FFDA0A20000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9588-9688-0x00007FFDA0A10000-0x00007FFDA0A20000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9588-9681-0x00007FFDBC030000-0x00007FFDBCBD4000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9588-9680-0x00007FFDBBAA0000-0x00007FFDBC02E000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9588-9679-0x00007FFDBCBE0000-0x00007FFDBCD25000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9588-9682-0x00007FFDB4D20000-0x00007FFDB57A6000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9588-9684-0x00007FF6CE8B0000-0x00007FF6CEC77000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9588-9683-0x00007FFDB2F30000-0x00007FFDB4D15000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9588-9690-0x00007FFDA0A10000-0x00007FFDA0A20000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9588-9696-0x00007FFDA0A10000-0x00007FFDA0A20000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9588-9695-0x00007FFDA0A10000-0x00007FFDA0A20000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9588-9689-0x00007FFDA0A10000-0x00007FFDA0A20000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9588-9685-0x00007FFDB9570000-0x00007FFDBB0B5000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9588-9691-0x00007FFDA0A10000-0x00007FFDA0A20000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9588-9692-0x00007FFDA0A10000-0x00007FFDA0A20000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9588-9693-0x00007FFDA0A10000-0x00007FFDA0A20000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9864-9711-0x00007FF6CE8B0000-0x00007FF6CEC77000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9864-9716-0x00007FFDBB340000-0x00007FFDBCE85000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9864-9714-0x00007FFDB9BE0000-0x00007FFDBA16E000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9864-9713-0x00007FFDBA4E0000-0x00007FFDBA625000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9864-9712-0x00007FFDBA630000-0x00007FFDBB1D4000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9864-9715-0x00007FFDB39C0000-0x00007FFDB57A5000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/9864-9717-0x00007FFDB2F30000-0x00007FFDB39B6000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/10052-10522-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/10052-10633-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/10212-9761-0x00007FFDA0A10000-0x00007FFDA0A20000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/10212-9760-0x00007FFDA0A10000-0x00007FFDA0A20000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/10212-9762-0x00007FFDA0A10000-0x00007FFDA0A20000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/10212-9752-0x00007FF6CE8B0000-0x00007FF6CEC77000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/10212-9753-0x00007FFDBA640000-0x00007FFDBA785000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/10212-9763-0x00007FFDA0A10000-0x00007FFDA0A20000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/10212-9764-0x00007FFDA0A10000-0x00007FFDA0A20000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/10212-9756-0x00007FFDBA790000-0x00007FFDBB334000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/10212-9754-0x00007FFDB9D40000-0x00007FFDBA2CE000-memory.dmp
                                                                                                                                                  Download