Overview

overview

10

Static

static

3

2026-10-01...ca.exe

windows10-2004-x64

10

2026-10-01...ca.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    64s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 04:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-01_bc502723446438049186bde1a356d350_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
  • Size 5.7MB
  • Sample261002-eztgnsgh97
  • SHA256 a70b140ff79b5cc1d4c156acec55f6743e28e3b04e2c647967fe956df8c52c7b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdefense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 13 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes a Windows system DLL name to a user directory 2 TTPs 1 IoCs

    A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

    defense_evasion
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 14 IoCs
  • Modifies system certificate store 2 TTPs 40 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_bc502723446438049186bde1a356d350_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_bc502723446438049186bde1a356d350_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"
    1⤵
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1304.exe
      "C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1304.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
      2⤵
      • Executes dropped EXE
      • Writes a Windows system DLL name to a user directory
      • Writes to the Master Boot Record (MBR)
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      PID:4960
      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -checkInstallEnvironment
        3⤵
          PID:6004
        • C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
          "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService
          3⤵
            PID:3352
          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -addFirewallRule
            3⤵
              PID:2496
            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpsoffice.exe
              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpsoffice.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=klangmanager -dll_name=klangmanager.dll downloadlang en_US
              3⤵
                PID:2936
              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regmtfont
                3⤵
                  PID:3360
                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\\office6\ksomisc.exe" -setappcap
                  3⤵
                    PID:3084
                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -sendinstalldyn 5
                    3⤵
                      PID:1700
                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regPreviewHandler wps.exe et.exe wpp.exe
                      3⤵
                        PID:3000
                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\\office6\ksomisc.exe" -registerqingshellext 1
                        3⤵
                          PID:5528
                          • C:\Windows\system32\regsvr32.exe
                            "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingshellext64.dll"
                            4⤵
                              PID:5104
                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regkwpsshellext admin
                            3⤵
                              PID:3736
                              • C:\Windows\system32\regsvr32.exe
                                "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kwpsshellext64.dll"
                                4⤵
                                  PID:2368
                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kwinappinstaller.exe
                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kwinappinstaller.exe" -i "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\menuext" wpsappext1 wpsappext2 wpsappext3
                                3⤵
                                  PID:1836
                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regqingdriveshellext_install
                                  3⤵
                                    PID:668
                                    • C:\Windows\system32\regsvr32.exe
                                      "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*install "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                      4⤵
                                        PID:1772
                                      • C:\Windows\system32\regsvr32.exe
                                        "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*thumbnail "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                        4⤵
                                          PID:692
                                        • C:\Windows\system32\regsvr32.exe
                                          "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*drivebho "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                          4⤵
                                            PID:552
                                          • C:\Windows\system32\regsvr32.exe
                                            "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                            4⤵
                                              PID:3120
                                            • C:\Windows\system32\regsvr32.exe
                                              "C:\Windows\system32\regsvr32.exe" /s /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                              4⤵
                                                PID:5264
                                              • C:\Windows\system32\regsvr32.exe
                                                "C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*onlinefile "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                                4⤵
                                                  PID:3544
                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            • Drops file in System32 directory
                                            • Reads the TCP/IP host and domain name from the registry
                                            PID:5568
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            PID:5560
                                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                            "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            PID:432
                                          • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                            "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                            1⤵
                                            • Executes dropped EXE
                                            PID:1912
                                          • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                            C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                            1⤵
                                            • Executes dropped EXE
                                            PID:2624
                                          • C:\Windows\SysWow64\perfhost.exe
                                            C:\Windows\SysWow64\perfhost.exe
                                            1⤵
                                            • Executes dropped EXE
                                            PID:940
                                          • C:\Windows\System32\ReFsDedupSvc.exe
                                            C:\Windows\System32\ReFsDedupSvc.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Checks processor information in registry
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3320
                                          • C:\Windows\System32\SensorDataService.exe
                                            C:\Windows\System32\SensorDataService.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Drops file in System32 directory
                                            • Checks SCSI registry key(s)
                                            PID:3500
                                          • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                            C:\Windows\System32\OpenSSH\ssh-agent.exe
                                            1⤵
                                            • Executes dropped EXE
                                            PID:1696
                                          • C:\Windows\system32\AgentService.exe
                                            C:\Windows\system32\AgentService.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5564
                                          • C:\Windows\system32\SearchIndexer.exe
                                            C:\Windows\system32\SearchIndexer.exe /Embedding
                                            1⤵
                                            • Executes dropped EXE
                                            • Enumerates connected drives
                                            • Modifies data under HKEY_USERS
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            PID:3512
                                            • C:\Windows\System32\SearchProtocolHost.exe
                                              "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                              2⤵
                                              • Modifies data under HKEY_USERS
                                              PID:2128
                                            • C:\Windows\System32\SearchProtocolHost.exe
                                              "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                              2⤵
                                                PID:1748
                                              • C:\Windows\System32\SearchFilterHost.exe
                                                "C:\Windows\System32\SearchFilterHost.exe" 952 2380 1896 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
                                                2⤵
                                                  PID:1460
                                                • C:\Windows\System32\SearchFilterHost.exe
                                                  "C:\Windows\System32\SearchFilterHost.exe" 952 2904 2936 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
                                                  2⤵
                                                    PID:4432
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                  1⤵
                                                    PID:4088
                                                  • C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1304.exe
                                                    "C:\ProgramData\WPS\Installers\dba86f7fd05f7cbe7866e2880ceea839_Personal_Office_i18n_Free.exe.601.1304.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5AA48E -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Writes to the Master Boot Record (MBR)
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4668
                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -setlng en_US
                                                      2⤵
                                                        PID:2636
                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -getonlineparam 00601.00001304 -forceperusermode
                                                        2⤵
                                                          PID:1904
                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -getabtest -forceperusermode
                                                          2⤵
                                                            PID:1752
                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -fixoldversionassostatus
                                                            2⤵
                                                              PID:564
                                                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -setservers
                                                              2⤵
                                                                PID:4240
                                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -register
                                                                2⤵
                                                                  PID:2428
                                                                  • C:\Windows\system32\regsvr32.exe
                                                                    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
                                                                    3⤵
                                                                      PID:5872
                                                                      • C:\Windows\SysWOW64\regsvr32.exe
                                                                        /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"
                                                                        4⤵
                                                                          PID:1304
                                                                      • C:\Windows\system32\regsvr32.exe
                                                                        "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"
                                                                        3⤵
                                                                          PID:5816
                                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regprogid true
                                                                        2⤵
                                                                          PID:3672
                                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -assowordexcelpowerpnt 1 1 1 -source=1
                                                                          2⤵
                                                                            PID:2140
                                                                            • C:\Windows\System32\openwith.exe
                                                                              "C:\Windows\System32\openwith.exe"
                                                                              3⤵
                                                                                PID:3316
                                                                              • C:\Windows\System32\openwith.exe
                                                                                "C:\Windows\System32\openwith.exe"
                                                                                3⤵
                                                                                  PID:1012
                                                                                • C:\Windows\System32\openwith.exe
                                                                                  "C:\Windows\System32\openwith.exe"
                                                                                  3⤵
                                                                                    PID:4868
                                                                                  • C:\Windows\System32\openwith.exe
                                                                                    "C:\Windows\System32\openwith.exe"
                                                                                    3⤵
                                                                                      PID:2676
                                                                                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -compatiblemso -source=1
                                                                                    2⤵
                                                                                      PID:360
                                                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -checkcompatiblemso
                                                                                      2⤵
                                                                                        PID:2604
                                                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -saveas_mso
                                                                                        2⤵
                                                                                          PID:5536
                                                                                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -distsrc 00601.00001304
                                                                                          2⤵
                                                                                            PID:4928
                                                                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode -source=1
                                                                                            2⤵
                                                                                            • Network Service Discovery
                                                                                            PID:3696
                                                                                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe
                                                                                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk" 5386
                                                                                              3⤵
                                                                                                PID:1176
                                                                                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -addcontextmenushellnew
                                                                                              2⤵
                                                                                                PID:6076
                                                                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regvascontextmenushellnew
                                                                                                2⤵
                                                                                                  PID:1652
                                                                                                • C:\Windows\system32\regsvr32.exe
                                                                                                  "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kdesktopshellext\kdesktopshellext.dll"
                                                                                                  2⤵
                                                                                                    PID:1488
                                                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                      /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kdesktopshellext\kdesktopshellext.dll"
                                                                                                      3⤵
                                                                                                        PID:3016
                                                                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -regyunpanfornew -forceperusermode
                                                                                                      2⤵
                                                                                                        PID:5400
                                                                                                        • C:\Windows\system32\regsvr32.exe
                                                                                                          "C:\Windows\system32\regsvr32.exe" /s /u /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                                                                                          3⤵
                                                                                                            PID:3272
                                                                                                          • C:\Windows\system32\regsvr32.exe
                                                                                                            "C:\Windows\system32\regsvr32.exe" /s /u /n /i:overlayicon "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                                                                                            3⤵
                                                                                                              PID:1432
                                                                                                            • C:\Windows\system32\regsvr32.exe
                                                                                                              "C:\Windows\system32\regsvr32.exe" /s /u /n /i:contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                                                                                              3⤵
                                                                                                                PID:4608
                                                                                                              • C:\Windows\system32\regsvr32.exe
                                                                                                                "C:\Windows\system32\regsvr32.exe" /s /u /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll"
                                                                                                                3⤵
                                                                                                                  PID:1020
                                                                                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe" -setup_assopdf -source=1
                                                                                                                2⤵
                                                                                                                  PID:2672
                                                                                                              • C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
                                                                                                                "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
                                                                                                                1⤵
                                                                                                                  PID:5128
                                                                                                                • C:\Windows\system32\userinit.exe
                                                                                                                  C:\Windows\system32\userinit.exe
                                                                                                                  1⤵
                                                                                                                    PID:4184
                                                                                                                    • C:\Windows\Explorer.EXE
                                                                                                                      C:\Windows\Explorer.EXE
                                                                                                                      2⤵
                                                                                                                        PID:5144
                                                                                                                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                      1⤵
                                                                                                                        PID:1904
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                        1⤵
                                                                                                                          PID:4748

                                                                                                                        Network

                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                              Reconnaissance

                                                                                                                              Resource Development

                                                                                                                              Initial Access

                                                                                                                              Execution

                                                                                                                              Persistence

                                                                                                                              Hijack Execution Flow

                                                                                                                              1
                                                                                                                              T1574

                                                                                                                              DLL Search Order Hijacking

                                                                                                                              1
                                                                                                                              T1574.001

                                                                                                                              Pre-OS Boot

                                                                                                                              1
                                                                                                                              T1542

                                                                                                                              Bootkit

                                                                                                                              1
                                                                                                                              T1542.003

                                                                                                                              Privilege Escalation

                                                                                                                              Hijack Execution Flow

                                                                                                                              1
                                                                                                                              T1574

                                                                                                                              DLL Search Order Hijacking

                                                                                                                              1
                                                                                                                              T1574.001

                                                                                                                              Defense Evasion

                                                                                                                              Hijack Execution Flow

                                                                                                                              1
                                                                                                                              T1574

                                                                                                                              DLL Search Order Hijacking

                                                                                                                              1
                                                                                                                              T1574.001

                                                                                                                              Masquerading

                                                                                                                              1
                                                                                                                              T1036

                                                                                                                              Match Legitimate Name or Location

                                                                                                                              1
                                                                                                                              T1036.005

                                                                                                                              Modify Registry

                                                                                                                              1
                                                                                                                              T1112

                                                                                                                              Pre-OS Boot

                                                                                                                              1
                                                                                                                              T1542

                                                                                                                              Bootkit

                                                                                                                              1
                                                                                                                              T1542.003

                                                                                                                              Subvert Trust Controls

                                                                                                                              1
                                                                                                                              T1553

                                                                                                                              Install Root Certificate

                                                                                                                              1
                                                                                                                              T1553.004

                                                                                                                              Credential Access

                                                                                                                              Credentials from Password Stores

                                                                                                                              1
                                                                                                                              T1555

                                                                                                                              Credentials from Web Browsers

                                                                                                                              1
                                                                                                                              T1555.003

                                                                                                                              Unsecured Credentials

                                                                                                                              1
                                                                                                                              T1552

                                                                                                                              Credentials In Files

                                                                                                                              1
                                                                                                                              T1552.001

                                                                                                                              Discovery

                                                                                                                              Network Service Discovery

                                                                                                                              1
                                                                                                                              T1046

                                                                                                                              Peripheral Device Discovery

                                                                                                                              2
                                                                                                                              T1120

                                                                                                                              Query Registry

                                                                                                                              3
                                                                                                                              T1012

                                                                                                                              System Information Discovery

                                                                                                                              4
                                                                                                                              T1082

                                                                                                                              System Location Discovery

                                                                                                                              1
                                                                                                                              T1614

                                                                                                                              System Language Discovery

                                                                                                                              1
                                                                                                                              T1614.001

                                                                                                                              System Network Configuration Discovery

                                                                                                                              1
                                                                                                                              T1016

                                                                                                                              Lateral Movement

                                                                                                                              Collection

                                                                                                                              Data from Local System

                                                                                                                              1
                                                                                                                              T1005

                                                                                                                              Command and Control

                                                                                                                              Exfiltration

                                                                                                                              Impact

                                                                                                                              Replay Monitor

                                                                                                                              Loading Replay Monitor...

                                                                                                                              Downloads

                                                                                                                              elevation_service.exe
                                                                                                                              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                              • Size 2.7MB
                                                                                                                              • SHA256 d8ff015aa9b3b7fd59af7fc5fa78d39a03b4de0dd18879b1512da786a4b69f6a
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              maintenanceservice.exe
                                                                                                                              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                              • Size 1.4MB
                                                                                                                              • SHA256 b5f44b783dfcad94f1a24819a777d03bf94e90f99bee980b14f56cb7a5dc675e
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              OSE.EXE
                                                                                                                              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                                                              • Size 1.4MB
                                                                                                                              • SHA256 2cc542b91f46e9af2ad7cf91a80cca92c616867810025b66012596bbece312c0
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              elevation_service.exe
                                                                                                                              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                              • Size 2.8MB
                                                                                                                              • SHA256 aa88ef484c572796a94b2c2799c009c895dfe383779cdd4c582de41922d98fe8
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                              • Size 471B
                                                                                                                              • SHA256 d475a1b94d137b1e5251dd180cea4a11cc05ab5689b62357ea3905f19609212b
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                              • Size 727B
                                                                                                                              • SHA256 e95beb46cd397e2c58edfa04d417573ae60bce4839ed939389ce3b4b08c5a909
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                              • Size 727B
                                                                                                                              • SHA256 307db0fb56225eedd300dafb363d7b91db4e02c6c5d308c0b36c7bcb06d67d90
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                              • Size 400B
                                                                                                                              • SHA256 b46408121c33560a1d25036bc48d409e7f1403bb035131e4c8be91d30e3382c0
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                                                                                                                              • Size 404B
                                                                                                                              • SHA256 3f2a7f6dbb5f6fb64f5133eec765ddc4b7ee17654e854dd1b235ba76dc7b2628
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                              • Size 412B
                                                                                                                              • SHA256 d4e5c5b1792bb654ab6e333ae5cf77baeb1f781b634cea67eecbb1cad25888e5
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              Qt5NetworkKso.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\Qt5NetworkKso.dll
                                                                                                                              • Size 1.4MB
                                                                                                                              • SHA256 e800493d5f4a4d0d0bce523c4228fc28507db20f6940c741bc49000e7575f227
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Everything-KingSoft.ini
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\everythingsearch\everythingbinary\Everything-KingSoft.ini
                                                                                                                              • Size 404B
                                                                                                                              • SHA256 b5980cd1122d2ad4727bc06806e3d2a6598b7d67b6eb3d2732938d08c6deedbb
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              run.ini
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kappessframework\mui\default\html_unified\run.ini
                                                                                                                              • Size 171B
                                                                                                                              • SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              kcoworkdockpanel.qm
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kcoworkdockpanel\mui\es_ES\kcoworkdockpanel.qm
                                                                                                                              • Size 846B
                                                                                                                              • SHA256 8f0de81b05e2ce8a22432406009084933f0cf410e6efb534aafd71699651120c
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              kcoworkdockpanel.qm
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kcoworkdockpanel\mui\tr_TR\kcoworkdockpanel.qm
                                                                                                                              • Size 839B
                                                                                                                              • SHA256 ad5549bf1c748909f191eba6e08caccfb31dbe1a2ce4bfafcb1e41702f40c95f
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              error-net-72.png
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kdocercore\mui\zh_CN\res\web\common\img\error-net-72.png
                                                                                                                              • Size 1KB
                                                                                                                              • SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              theme_template_download_close.png
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kdocercore\mui\zh_CN\res\web\common\img\theme_template_download_close.png
                                                                                                                              • Size 1KB
                                                                                                                              • SHA256 16a8f8609355a2ece290608c88b6275a9177a941a72ba614ad3e61d8b47ddbe6
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              index.html
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kpdfaigcbox\res\dist\index.html
                                                                                                                              • Size 636B
                                                                                                                              • SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              index.js
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kpdfaigcbox\res\dist\index.js
                                                                                                                              • Size 2KB
                                                                                                                              • SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              logo-small.png
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kskincenter\ksolaunch\normal\logo-small.png
                                                                                                                              • Size 6KB
                                                                                                                              • SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              logo.png
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kskincenter\ksolaunch\normal\logo.png
                                                                                                                              • Size 12KB
                                                                                                                              • SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              ktaskpanelcopilot.qm
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\ktaskpanelcopilot\mui\zh_TW\ktaskpanelcopilot.qm
                                                                                                                              • Size 327B
                                                                                                                              • SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              IndexPage-c453f6ef.js
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\ktemplatepage\mui\default\kwebpcerrorpage\assets\IndexPage-c453f6ef.js
                                                                                                                              • Size 144B
                                                                                                                              • SHA256 6dc181d0b8f796944afec08717183a3956b1e2ecdefc6cefca020786c370db84
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              favicon.ico
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kwebclouddrivesetting\entry\favicon.ico
                                                                                                                              • Size 4KB
                                                                                                                              • SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              run.ini
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kwebonlinetaskpane\run.ini
                                                                                                                              • Size 226B
                                                                                                                              • SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              harmony_close.svg
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kweboptioncenter\entry\static\img\harmony_close.svg
                                                                                                                              • Size 216B
                                                                                                                              • SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              kwpsaibasetypo.qm
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\kwpsaibasetypo\mui\es_ES\kwpsaibasetypo.qm
                                                                                                                              • Size 334B
                                                                                                                              • SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              fail.png
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\officespace\mui\zh_CN\resource\usersecurecenter\fail.png
                                                                                                                              • Size 4KB
                                                                                                                              • SHA256 380b4e765b27129c1aad722d99295fb1db5dc91352087b7035b3443ebf150b43
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              ferrPage_timeout.html
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\qing\mui\zh_CN\res\qingaccount\ferrPage_timeout.html
                                                                                                                              • Size 7KB
                                                                                                                              • SHA256 eb5dc549d839abd9dd7fb725629198959c7e5b0322454cf3c3bac89c57f53ca9
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              element-icons.ttf
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\wpsbox\mui\default\html\folderselector\dist\static\fonts\element-icons.ttf
                                                                                                                              • Size 54KB
                                                                                                                              • SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              sync-folder.svg
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\wpsbox\mui\default\html\syncassistant\smarter\img\sync-folder.svg
                                                                                                                              • Size 1KB
                                                                                                                              • SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              element-icons.woff
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\wpsbox\mui\default\html\wpsclouddisk\dist\static\fonts\element-icons.woff
                                                                                                                              • Size 27KB
                                                                                                                              • SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              chunk-vendors.css
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\cloudsettingsdlg\dist\static\css\chunk-vendors.css
                                                                                                                              • Size 945B
                                                                                                                              • SHA256 dcbbe47d67a84ca5330ae6addfc5f541b0888ab06b7555e0f29b3816df8758b3
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              chunk-vendors.js
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\cloudsettingsdlg\dist\wps-i18n\chunk-vendors.js
                                                                                                                              • Size 314KB
                                                                                                                              • SHA256 5eeb347ded468ab8d168c51adbc559aaa0d5f33d4135b096293bde65499f015b
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              index.js
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\cloudsettingsdlg\dist\wps-i18n\en-us\index.js
                                                                                                                              • Size 7KB
                                                                                                                              • SHA256 f54d8fb11b54ed02402f0ea7c39e8e3f051140d828d39bc17957e6a05d72f03c
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              index.js
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\cloudsettingsdlg\dist\wps-i18n\es-mx\index.js
                                                                                                                              • Size 9KB
                                                                                                                              • SHA256 6b267516d1b0d7a46d6e679610ac3cf7dab8167390cbd8015fa0907b6752b4e4
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              index.js
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\cloudsettingsdlg\dist\wps-i18n\ja-jp\index.js
                                                                                                                              • Size 9KB
                                                                                                                              • SHA256 8f3e93d42df0ada663d904486d895c30607b780ff7e2a135eb878aae1e33d226
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              apm-init.js
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\settings\apm-init.js
                                                                                                                              • Size 57B
                                                                                                                              • SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              default_ava.svg
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\settings\img\default_ava.svg
                                                                                                                              • Size 906B
                                                                                                                              • SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              loading.svg
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\settings\img\loading.svg
                                                                                                                              • Size 1KB
                                                                                                                              • SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              weibo.svg
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\settings\img\weibo.svg
                                                                                                                              • Size 2KB
                                                                                                                              • SHA256 13fe846f5d050decd03d9eef4f40e497995ad8b23e48a2f8eb339f97319f51bf
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              app.css
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\qing\static\css\app.css
                                                                                                                              • Size 107KB
                                                                                                                              • SHA256 907d1f5ee046fae72b52eaf99508ddb6b48d47b803076db0e9a86b0e21a54ba9
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              chunk-vendors.css
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\qing\static\css\chunk-vendors.css
                                                                                                                              • Size 279KB
                                                                                                                              • SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              app.js
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\qing\static\js\app.js
                                                                                                                              • Size 380KB
                                                                                                                              • SHA256 be3f894d6d251cfa3fa29ab67d0a80ec3cbc374b66a010a30ee42c2475577ba3
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              chunk-vendors.js
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\qing\static\js\chunk-vendors.js
                                                                                                                              • Size 249KB
                                                                                                                              • SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              chunk-vendors.js
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\qing\wps-i18n\chunk-vendors.js
                                                                                                                              • Size 424KB
                                                                                                                              • SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              index.js
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\qing\wps-i18n\en-us\index.js
                                                                                                                              • Size 10KB
                                                                                                                              • SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              index.js
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\qing\wps-i18n\es-mx\index.js
                                                                                                                              • Size 13KB
                                                                                                                              • SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              index.js
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\syncfolder\qing\wps-i18n\ja-jp\index.js
                                                                                                                              • Size 14KB
                                                                                                                              • SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              logo_new_1.svg
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\addons\yunbox\mui\default\html\transfer\img\logo_new_1.svg
                                                                                                                              • Size 3KB
                                                                                                                              • SHA256 7745db01242b975e980c02a5b5e21f86c3991842d14399af5b710e7042f6b133
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              setup.cfg
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\cfgs\setup.cfg
                                                                                                                              • Size 449B
                                                                                                                              • SHA256 81b8cc8d1affd6d91a8ffec9810868a1200e4c4d9586383c7a89d4c4755b0e7b
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              kdesign.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kdesign.dll
                                                                                                                              • Size 1.3MB
                                                                                                                              • SHA256 ffcf491a7a575ef1a9a34bd74348ba724ac0a7bdd386c0c33f4c6c0c4584e9c6
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              krt.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\krt.dll
                                                                                                                              • Size 1.3MB
                                                                                                                              • SHA256 147a0720be09be772ee513e958849d73f8dede61e077c9cd13b27f3e353b2c8a
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              kshell.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\kshell.dll
                                                                                                                              • Size 27.1MB
                                                                                                                              • SHA256 010bbd735adc686c5fa2a5575d8fff97056c8f7d4c3739be994e22f43ecfde55
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              ksolite.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksolite.dll
                                                                                                                              • Size 11.6MB
                                                                                                                              • SHA256 bab2dd2ec926b20337f6bbb8d8f8455696c83d34c881bff8e650336281610f42
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              ksomisc.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\ksomisc.exe
                                                                                                                              • Size 3.7MB
                                                                                                                              • SHA256 a1839da0804ad31b5e262afc44f77617b0c710b9de7550e5d0039c65f8541e15
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              addwatermark_buildin_wps.doc
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\mui\zh_CN\resource\watermark\information\user_defined\addwatermark_buildin_wps.doc
                                                                                                                              • Size 9KB
                                                                                                                              • SHA256 43add80bf7f6495384fa15757101998fcef1688702830c538976dbf7a26d229c
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              presetLayout_16.pptx
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
                                                                                                                              • Size 41KB
                                                                                                                              • SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              qingnse.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse.dll
                                                                                                                              • Size 16.5MB
                                                                                                                              • SHA256 cb02773b6291ae8cc4002fe021e5d0833c9f2a1a45ca9c208e00e55da27143a4
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              qingnse64.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingnse64.dll
                                                                                                                              • Size 17.8MB
                                                                                                                              • SHA256 c628432cfa1ffccc717333b1e520cb591aa74478474d9eb3cc80e218f2b4f13d
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              qingshellext.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingshellext.dll
                                                                                                                              • Size 732KB
                                                                                                                              • SHA256 b355b7629c697225ba5c1b5e5b48af7f311fe9de6aa3c583bc7963e7ca322126
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              qingshellext64.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\qingshellext64.dll
                                                                                                                              • Size 847KB
                                                                                                                              • SHA256 6754552582c153b6ad931f9b9956683ce0af2d8c574d0efe920515dda7a5a4c3
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              wpscloudsvr.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpscloudsvr.exe
                                                                                                                              • Size 1.1MB
                                                                                                                              • SHA256 5d2b4a3bedf86b4c58fcdbca99481f83d1dec309923c26794c1b4d9f8761d470
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              wpsoffice.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\office6\wpsoffice.exe
                                                                                                                              • Size 1.2MB
                                                                                                                              • SHA256 79654a15c88175633251bac8348fdd2181d017d3ecb2bb102e6b979f76a43b05
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              install.ini
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\utility\install.ini
                                                                                                                              • Size 462B
                                                                                                                              • SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              install.ini
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28485\utility\install.ini
                                                                                                                              • Size 462B
                                                                                                                              • SHA256 dcaa6bd82f0368506a18c0823626ca6b8b793bf1eca1068f8654c051b35bbfe9
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              prep_Activatable Class_Hermes_perf.cache
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                              • Size 599B
                                                                                                                              • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              APPX.2yvd0ask_e9fvrro9ou27220h.tmp
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\APPX.2yvd0ask_e9fvrro9ou27220h.tmp
                                                                                                                              • Size 10KB
                                                                                                                              • SHA256 5d32f24f2f89aabf70de201faf88f9bd8827ca638353f14a64bea38e1c5a3f63
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              APPX.5aowmcn451up0jffjlqxs3vxe.tmp
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\APPX.5aowmcn451up0jffjlqxs3vxe.tmp
                                                                                                                              • Size 4KB
                                                                                                                              • SHA256 9d2f34f1b17536dd689db858d42c85a78cb48ccf24f55fd578699dd1cbd7c930
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              APPX.5zfkx901g20hrp_i4vaesmq6e.tmp
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\APPX.5zfkx901g20hrp_i4vaesmq6e.tmp
                                                                                                                              • Size 712B
                                                                                                                              • SHA256 7310eb8c9a5115a236fe0f5b2a40386c478b4a1c8de6c16aa20363d4beaa2659
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              APPX.6lhgcu1b7sx51nxmubp7fsxsb.tmp
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\APPX.6lhgcu1b7sx51nxmubp7fsxsb.tmp
                                                                                                                              • Size 10KB
                                                                                                                              • SHA256 575e5ab758445707fecbb56317f72927014a1f5a12188af932279aa157aedfac
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              APPX.78zk_x6toaptdksjtl7em1z4b.tmp
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\APPX.78zk_x6toaptdksjtl7em1z4b.tmp
                                                                                                                              • Size 10KB
                                                                                                                              • SHA256 fd3f98ca032876c26d2d15849a9505b36364f5f26d3186e8382d5e3332ecce8a
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              APPX._sf2x4hmvpwshhx_g81ci4smg.tmp
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\APPX._sf2x4hmvpwshhx_g81ci4smg.tmp
                                                                                                                              • Size 4KB
                                                                                                                              • SHA256 81c968c375f69d9e4666901fd4c14a6ce4b738639ff78488562e2c79f8fb14d8
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              APPX.c7ssxd5e54jwcjtut5354yhaf.tmp
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\APPX.c7ssxd5e54jwcjtut5354yhaf.tmp
                                                                                                                              • Size 712B
                                                                                                                              • SHA256 40206cc446612c3c79d0aae7d80976f941e05a4f31112819b7342716bae98233
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              APPX.fvgirrkxjvoc85mjrlfxt_yjc.tmp
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\APPX.fvgirrkxjvoc85mjrlfxt_yjc.tmp
                                                                                                                              • Size 712B
                                                                                                                              • SHA256 5d3a68b91b773660c9e58606782baaf5ba7a691919364373ad559fe8d0d47572
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              APPX.uuv4l58v1sbjlc5llscql7nh.tmp
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\APPX.uuv4l58v1sbjlc5llscql7nh.tmp
                                                                                                                              • Size 4KB
                                                                                                                              • SHA256 322a6bbe4151c8c0d85b94a20e1566a69e7e19532fe6bb7ee4b5d806daea5366
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              style.xml
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\id_ID\style.xml
                                                                                                                              • Size 3KB
                                                                                                                              • SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              style.xml
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\ms_MY\style.xml
                                                                                                                              • Size 4KB
                                                                                                                              • SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Qt5CoreKso.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\Qt5CoreKso.dll
                                                                                                                              • Size 5.7MB
                                                                                                                              • SHA256 cc232fce14f26b48e69205eadbd75d9c480c328dbe64b5ca72b9e5b0711bebc1
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Qt5GuiKso.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\Qt5GuiKso.dll
                                                                                                                              • Size 6.4MB
                                                                                                                              • SHA256 0b577ba30dcced8f1d2ea41e21dc26095c372559999a31f92a0a7ab40cc3dec3
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Qt5SvgKso.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\Qt5SvgKso.dll
                                                                                                                              • Size 503KB
                                                                                                                              • SHA256 e879d108fc57815f07dbebf4a94114ab46d41ae1058aae7368ef0f575c7f7b5e
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Qt5WidgetsKso.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\Qt5WidgetsKso.dll
                                                                                                                              • Size 5.6MB
                                                                                                                              • SHA256 558f41cd447c3e2a25f3823ca5bc9f06142044acb05e6877486d9ad1c85ffc60
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Qt5WinExtrasKso.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\Qt5WinExtrasKso.dll
                                                                                                                              • Size 251KB
                                                                                                                              • SHA256 8d4e3c1a0e767477432e276cd064e74cb13fbc4114ecf59dd1df3918089ac42d
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-console-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-console-l1-1-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 2afbfa1d77969d0f4cee4547870355498d5c1da81d241e09556d0bd1d6230f8c
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-console-l1-2-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-console-l1-2-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 00942431c2d3193061c7f4dc340e8446bfdbf792a7489f60349299dff689c2f9
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-datetime-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-datetime-l1-1-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 77577f35d3a61217ea70f21398e178f8749455689db52a2b35a85f9b54c79638
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-debug-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-debug-l1-1-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 45e48320abe6e3c6079f3f6b84636920a367989a88f9ba6847f88c210d972cf1
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-errorhandling-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-errorhandling-l1-1-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 accdd7455fb6d02fe298b987ad412e00d0b8e6f5fb10b52826367e7358ae1187
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-file-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-file-l1-1-0.dll
                                                                                                                              • Size 14KB
                                                                                                                              • SHA256 7cb0396229c3da434482a5ef929d3a2c392791712242c9693f06baa78948ef66
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-file-l1-2-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-file-l1-2-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 7a3c5167731238cf262f749aa46ab3bfb2ae1b22191b76e28e1d7499d28c24b7
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-file-l2-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-file-l2-1-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 349a79fa1572e3538dfbb942610d8c47d03e8a41b98897bc02ec7e897d05237e
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-handle-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-handle-l1-1-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 c78a1217f8dcb157d1a66b80348da48ebdbbedcea1d487fc393191c05aad476d
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-heap-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-heap-l1-1-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 2e981ee04f35c0e0b7c58282b70dcc9fc0318f20f900607dae7a0d40b36e80af
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-interlocked-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-interlocked-l1-1-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 b02324c49dd039fa889b4647331aa9ac65e5adc0cc06b26f9f086e2654ff9f08
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-libraryloader-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-libraryloader-l1-1-0.dll
                                                                                                                              • Size 12KB
                                                                                                                              • SHA256 08484ed55e43584068c337281e2c577cf984bb504871b3156de11c7cc1eec38f
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-localization-l1-2-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-localization-l1-2-0.dll
                                                                                                                              • Size 13KB
                                                                                                                              • SHA256 059cb23fdcf4d80b92e3da29e9ef4c322edf6fba9a1837978fd983e9bdfc7413
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-memory-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-memory-l1-1-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 dadbd2204b015e81f94c537ac7a36cd39f82d7c366c193062210c7288baa19e3
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-namedpipe-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-namedpipe-l1-1-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 b57e70798af248f91c8c46a3f3b2952effae92ca8ef9640c952467bc6726f363
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-processenvironment-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-processenvironment-l1-1-0.dll
                                                                                                                              • Size 12KB
                                                                                                                              • SHA256 aa415db99828f30a396cbd4e53c94096db89756c88a19d8564f0eed0674add43
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-processthreads-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-processthreads-l1-1-0.dll
                                                                                                                              • Size 13KB
                                                                                                                              • SHA256 c9a686030e073975009f993485d362cc31c7f79b683def713e667d13e9605a14
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-processthreads-l1-1-1.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-processthreads-l1-1-1.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 25a99bdf8bf4d16077dc30dd9ffef7bb5a2ceaf9afcee7cf52ad408355239d40
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-profile-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-profile-l1-1-0.dll
                                                                                                                              • Size 10KB
                                                                                                                              • SHA256 42f4e84073cf876bbab9dd42fd87124a4ba10bb0b59d2c3031cb2b2da7140594
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-rtlsupport-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-rtlsupport-l1-1-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 02d987eba4a65509a2df8ed5dd0b1a0578966e624fcf5806614ece88a817499f
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-string-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-string-l1-1-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 9447218cc4ab1a2c012629aaae8d1c8a428a99184b011bcc766792af5891e234
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-synch-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-synch-l1-1-0.dll
                                                                                                                              • Size 13KB
                                                                                                                              • SHA256 a31a15bed26232a178ba7ecb8c8aa9487c3287bb7909952fc06ed0d2c795db26
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-synch-l1-2-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-synch-l1-2-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 1c72ac404781a9986d8edeb0ee5dd39d2c27ce505683ca3324c0eccd6193610a
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-sysinfo-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-sysinfo-l1-1-0.dll
                                                                                                                              • Size 12KB
                                                                                                                              • SHA256 19c78ef5ba470c5b295dddee9244cbd07d0368c5743b02a16d375bfb494d3328
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-timezone-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-timezone-l1-1-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 3d798b9c345a507e142e8dacd7fb6c17528cc1453abfef2ffa9710d2fa9e032c
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-core-util-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-core-util-l1-1-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 5eb724c51eecba9ac7b8a53861a1d029bf2e6c62251d00f61ac7e2a5f813aaa3
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-crt-conio-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-crt-conio-l1-1-0.dll
                                                                                                                              • Size 12KB
                                                                                                                              • SHA256 b119adad588ebca7f9c88628010d47d68bf6e7dc6050b7e4b787559f131f5ede
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-crt-convert-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-crt-convert-l1-1-0.dll
                                                                                                                              • Size 15KB
                                                                                                                              • SHA256 6c008be766c44bf968c9e91cddc5b472110beffee3106a99532e68c605c78d44
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-crt-environment-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-crt-environment-l1-1-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 aa3e3e99964d7f9b89f288dbe30ff18cbc960ee5add533ec1b8326fe63787aa3
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-crt-filesystem-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-crt-filesystem-l1-1-0.dll
                                                                                                                              • Size 13KB
                                                                                                                              • SHA256 974af1f1a38c02869073b4e7ec4b2a47a6ce8339fa62c549da6b20668de6798c
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-crt-heap-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-crt-heap-l1-1-0.dll
                                                                                                                              • Size 12KB
                                                                                                                              • SHA256 8166321f14d5804ce76f172f290a6f39ce81373257887d9897a6cf3925d47989
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-crt-locale-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-crt-locale-l1-1-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 edc1699e9995f98826df06d2c45beb9e02aa7817bae3e61373096ae7f6fa06e0
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-crt-math-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-crt-math-l1-1-0.dll
                                                                                                                              • Size 20KB
                                                                                                                              • SHA256 f6a93fe6b57a54aac46229f2ed14a0a979bf60416adb2b2cfc672386ccb2b42e
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-crt-multibyte-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-crt-multibyte-l1-1-0.dll
                                                                                                                              • Size 19KB
                                                                                                                              • SHA256 5b3e29116383ba48a2f46594402246264b4cb001023237ebbf28e7e9292cdb92
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-crt-private-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-crt-private-l1-1-0.dll
                                                                                                                              • Size 62KB
                                                                                                                              • SHA256 55bc91a549d22b160ae4704485e19dee955c7c2534e7447afb84801ee629639b
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-crt-process-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-crt-process-l1-1-0.dll
                                                                                                                              • Size 12KB
                                                                                                                              • SHA256 191f53988c7f02dd888c4fbf7c1d3351570f3b641146fae6d60acdae544771ae
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-crt-runtime-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-crt-runtime-l1-1-0.dll
                                                                                                                              • Size 15KB
                                                                                                                              • SHA256 4390c389bbbf9ec7215d12d22723efd77beb4cd83311c75ffe215725ecfd55dc
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-crt-stdio-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-crt-stdio-l1-1-0.dll
                                                                                                                              • Size 17KB
                                                                                                                              • SHA256 6f6f6e857b347f70ecc669b4df73c32e42199b834fe009641d7b41a0b1c210af
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-crt-string-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-crt-string-l1-1-0.dll
                                                                                                                              • Size 17KB
                                                                                                                              • SHA256 45e0835b1d3b446fe2c347bd87922c53cfb6dd826499e19a1d977bf4c11b0e4a
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-crt-time-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-crt-time-l1-1-0.dll
                                                                                                                              • Size 13KB
                                                                                                                              • SHA256 b48310b0837027f756d62c37ea91af988baa403cbcbd01cb26b6fdae21ea96a2
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              api-ms-win-crt-utility-l1-1-0.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\api-ms-win-crt-utility-l1-1-0.dll
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 c81c4bba4e5f205359ad145963f6fbd074879047c66569f52b6d66711108e1ed
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              concrt140.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\concrt140.dll
                                                                                                                              • Size 316KB
                                                                                                                              • SHA256 2405355f0a58067b258f8df33c327e3a3d716eaac5a3a5aebb757842d85bd376
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              dbghelp.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\dbghelp.dll
                                                                                                                              • Size 1.5MB
                                                                                                                              • SHA256 13f0c74845318b52b76e6000564b1a99c37de48422b44ac74d034fa222c65a23
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              kbaseconfigcenter.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\kbaseconfigcenter.dll
                                                                                                                              • Size 1.7MB
                                                                                                                              • SHA256 38eeb8a0600cffbdbc37ba2970f73613245f4812dd09e2a2826672f11d17689a
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              kpacketui.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\kpacketui.dll
                                                                                                                              • Size 870KB
                                                                                                                              • SHA256 9b8b1ffaf8e441f6c7da585141da83eb2ae063d07fcae103843b2f72099171fd
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              msvcp140.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\msvcp140.dll
                                                                                                                              • Size 544KB
                                                                                                                              • SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              msvcp140_1.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\msvcp140_1.dll
                                                                                                                              • Size 35KB
                                                                                                                              • SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              msvcp140_2.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\msvcp140_2.dll
                                                                                                                              • Size 273KB
                                                                                                                              • SHA256 3ea06f0ee098b4823cb79599df3780e7f23cce52c19aac31d2a0d47efe33a5e9
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              msvcp140_atomic_wait.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\msvcp140_atomic_wait.dll
                                                                                                                              • Size 49KB
                                                                                                                              • SHA256 640b2aefced484d0368eea5bdd06addd0658a3a70a49256e560d6923b404a479
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              msvcp140_codecvt_ids.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\msvcp140_codecvt_ids.dll
                                                                                                                              • Size 31KB
                                                                                                                              • SHA256 f2069a52880ec885ee7f0511186100eb7fada0411a2b4948fafea7735b878a18
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              qsvgicon.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
                                                                                                                              • Size 75KB
                                                                                                                              • SHA256 4038b28981414c886b556c8e11e4045d4a8dcacd1ee762941c4c189129b7fa96
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              qsvg.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
                                                                                                                              • Size 46KB
                                                                                                                              • SHA256 f89f816cc55e3219b33787ff34921e5848c4a1625497e30825e1d9cfafb98285
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              qskia.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\qt\plugins\platforms\qskia.dll
                                                                                                                              • Size 1.9MB
                                                                                                                              • SHA256 fb9bbb486da8b22248f5235fed71455913b3a237701c43847910034697b75ae9
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              qwindows.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\qt\plugins\platforms\qwindows.dll
                                                                                                                              • Size 1.6MB
                                                                                                                              • SHA256 b0f0847499ecaa2d88cf6675acf0b000ac619a2cc6ecfb6bc31da796d3e76e5f
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              windowsprintersupport.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\qt\plugins\printsupport\windowsprintersupport.dll
                                                                                                                              • Size 88KB
                                                                                                                              • SHA256 1cd1843672079a7599b0987857380f908eb346a25a9a9c7ec297cd8e9479b645
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              qwindowsvistastyle.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
                                                                                                                              • Size 159KB
                                                                                                                              • SHA256 cf4257b456d0954611ee0d3937aedbb696a367fda2e12aa81e9db8bdce2a974a
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              ucrtbase.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\ucrtbase.dll
                                                                                                                              • Size 987KB
                                                                                                                              • SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              vccorlib140.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\vccorlib140.dll
                                                                                                                              • Size 344KB
                                                                                                                              • SHA256 19839407c3fdbc824e5bce189bf68ddf8097f12ec28b757797ffa0415c144ddd
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              vcruntime140.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\vcruntime140.dll
                                                                                                                              • Size 121KB
                                                                                                                              • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              vcruntime140_1.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\vcruntime140_1.dll
                                                                                                                              • Size 48KB
                                                                                                                              • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              vcruntime140_threads.dll
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\office6\vcruntime140_threads.dll
                                                                                                                              • Size 37KB
                                                                                                                              • SHA256 219915cf20822f34d5e7c1fdd4e21ae7f3396881096c51036225fb8f84b47afa
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              product.dat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\product.dat
                                                                                                                              • Size 97KB
                                                                                                                              • SHA256 2e844013324b6d0b45e0f68706c289221de46dcb231c45a52cdbfce80bcac54c
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              product_new.dat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a9e83\CONTROL\product_new.dat
                                                                                                                              • Size 85KB
                                                                                                                              • SHA256 91f7b5037c07e9e6f555e6ca8a1ab34674cce9726f90186364e6d6f89b64a10a
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              tempinstall.ini
                                                                                                                              • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                                                                                                                              • Size 387B
                                                                                                                              • SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              tempinstall.ini
                                                                                                                              • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                                                                                                                              • Size 433B
                                                                                                                              • SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              ids_v3_lang_128.ini
                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\kfpccomb\ids_v3_lang_128.ini
                                                                                                                              • Size 2KB
                                                                                                                              • SHA256 d49baaabe84ad9b812fff3fccd882ec584e147582216cc8278cfccd6d32bc27a
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              ids_v3_lang_60.ini
                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\kfpccomb\ids_v3_lang_60.ini
                                                                                                                              • Size 6KB
                                                                                                                              • SHA256 dc981bf55853311c980bd4fdbd21bca28e341afeb6126e115b444301c4c2a276
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              ksomisc_2026_10_02.log
                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_10_02.log
                                                                                                                              • Size 3KB
                                                                                                                              • SHA256 d926cf65b717e711e02bdb5dc6ed1a66e8a865a588c73bb1e53d37babfe3fd1b
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              ksomisc_2026_10_02.log
                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_10_02.log
                                                                                                                              • Size 5KB
                                                                                                                              • SHA256 5f4fc3237dfb3e6dbd6f659e7557ab257a2bd4276bd741f1afab22c14cbb6bf6
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              wpssetup.log
                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                              • Size 897B
                                                                                                                              • SHA256 959c3ac325862c91077f4fb6815e7754845faf6b10e737c39bc8404a1ada1181
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              wpssetup.log
                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                              • Size 10KB
                                                                                                                              • SHA256 69712b8796c5812551ae532b495335fee9ff33b791a730ed77e13f2a0acc5fb2
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              wpssetup.log
                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 70a94b9eaf14dbf69e002e9145d029821783d2e3dbd49ef1842dcdde318fe31a
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              wpssetup.log
                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                              • Size 27KB
                                                                                                                              • SHA256 15241b4797a4fdbe1858b4f1731e3960883e086d7fedf63e9dc3ae5f47abfe19
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              wpssetup.log
                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                              • Size 60KB
                                                                                                                              • SHA256 6d1f1b509ec6f12ab776c846bf9b959ab1a5902fca610b760002c891d2ab5495
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              wpssetup.log
                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                                                                              • Size 66KB
                                                                                                                              • SHA256 0398341e526efe102a51e21cfd62f6a683d339d03c6771ee550019c5bee9e547
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              mdbx.dat
                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-x64\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat
                                                                                                                              • Size 64KB
                                                                                                                              • SHA256 c0841a2185a5008d1d2b6b0e9fe4d761d100e85826c04195477b95a810b81772
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              dcsdk_dpv3.data
                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
                                                                                                                              • Size 46KB
                                                                                                                              • SHA256 67104840c095176b88f649f306093a11eeb7922923435dce251eccd4c56b8611
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              dcsdk_dpv3.data
                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
                                                                                                                              • Size 40KB
                                                                                                                              • SHA256 ea547b6f9c7c0a1a0396991ff7a66bf6fdab856a6a8119bedc97d4ce8b42d730
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              .wps_rw_test_1790915059566.tmp
                                                                                                                              • Path C:\Users\Admin\WPS Cloud\.wps_rw_test_1790915059566.tmp
                                                                                                                              • Size 19B
                                                                                                                              • SHA256 c852b10799e8ea6f0e671e6f31badfdbd03ad4b5c1d50642e1d625dc89e1b910
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              perfhost.exe
                                                                                                                              • Path C:\Windows\SysWOW64\perfhost.exe
                                                                                                                              • Size 1.2MB
                                                                                                                              • SHA256 97640fecbda6c6151fd72499f43113a81ef5ad8161c1fcc9533409f15c1fa537
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              AgentService.exe
                                                                                                                              • Path C:\Windows\System32\AgentService.exe
                                                                                                                              • Size 1.4MB
                                                                                                                              • SHA256 2b0655abe636fd66866e26ab6b037cb03cd922e41f0533d755fbc6413ec9f12d
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              ssh-agent.exe
                                                                                                                              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                                                                                              • Size 1.7MB
                                                                                                                              • SHA256 a1e14865744a5fe5c5897b625d90b16a9f2ee7ef721fae04a9fdbd24c6ecb02a
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              PerceptionSimulationService.exe
                                                                                                                              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                                                                                                              • Size 1.4MB
                                                                                                                              • SHA256 18d7bd73cfc173f18bcac11434d0df9dab22793e1072ea8417cdbfe82280489e
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              ReFsDedupSvc.exe
                                                                                                                              • Path C:\Windows\System32\ReFsDedupSvc.exe
                                                                                                                              • Size 2.6MB
                                                                                                                              • SHA256 ca0ac4c6cced669df0b23b185d8ffd051a0000dc7cd1a53c3ba16c62168b36d3
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              SearchIndexer.exe
                                                                                                                              • Path C:\Windows\System32\SearchIndexer.exe
                                                                                                                              • Size 1.4MB
                                                                                                                              • SHA256 87c84684ce219534536d1aa929475913d48751941f3b6f7b57b78efe44ce59b1
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              SensorDataService.exe
                                                                                                                              • Path C:\Windows\System32\SensorDataService.exe
                                                                                                                              • Size 1.7MB
                                                                                                                              • SHA256 6c28fb2e83bc651a378967add9c6657fc615301a8b02cf47c09448d41e5e5e3a
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              memory/432-39-0x0000000140000000-0x0000000140214000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/432-54-0x0000000140000000-0x0000000140214000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/432-50-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/432-46-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/432-40-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/940-304-0x0000000000400000-0x00000000005D6000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/940-80-0x0000000000400000-0x00000000005D6000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1176-10641-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1176-10502-0x0000000140000000-0x00000001401EC000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1696-109-0x0000000140000000-0x000000014027D000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1696-111-0x0000000000DD0000-0x0000000000E30000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1696-117-0x0000000000DD0000-0x0000000000E30000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1696-310-0x0000000140000000-0x000000014027D000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1836-10591-0x0000000005900000-0x0000000005926000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1836-10590-0x0000000003370000-0x000000000337A000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1836-10589-0x0000000000F40000-0x0000000000F48000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1904-9764-0x00007FF6E6DE0000-0x00007FF6E71A7000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1904-9767-0x00007FFED9150000-0x00007FFED9295000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1912-271-0x0000000140000000-0x000000014020E000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1912-63-0x00000000008A0000-0x0000000000900000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1912-57-0x00000000008A0000-0x0000000000900000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1912-56-0x0000000140000000-0x000000014020E000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2624-69-0x0000000000C70000-0x0000000000CD0000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2624-289-0x0000000140000000-0x000000014020A000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2624-76-0x0000000000C70000-0x0000000000CD0000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2624-67-0x0000000140000000-0x000000014020A000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2636-9740-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2636-9744-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2636-9733-0x00007FFED9150000-0x00007FFED9295000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2636-9737-0x00007FFEC8BF0000-0x00007FFECA9D5000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2636-9739-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2636-9732-0x00007FF6E6DE0000-0x00007FF6E71A7000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2636-9741-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2636-9742-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2636-9743-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2636-9735-0x00007FFED03E0000-0x00007FFED0E66000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2636-9745-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2636-9746-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2636-9731-0x00007FFED10B0000-0x00007FFED2BF5000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2636-9747-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2636-9748-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2636-9734-0x00007FFED3A90000-0x00007FFED401E000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2636-9736-0x00007FFED45C0000-0x00007FFED5164000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3320-313-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3320-85-0x0000000000720000-0x0000000000780000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3320-308-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3320-311-0x0000000000720000-0x0000000000780000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3320-91-0x0000000000720000-0x0000000000780000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3320-84-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3500-290-0x0000000000770000-0x00000000007D0000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3500-292-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3500-103-0x0000000000770000-0x00000000007D0000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3500-97-0x0000000000770000-0x00000000007D0000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3500-96-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3512-322-0x0000000140000000-0x0000000140172000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3512-138-0x0000000140000000-0x0000000140172000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3512-139-0x0000000000620000-0x0000000000680000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3512-145-0x0000000000620000-0x0000000000680000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4460-75-0x0000000000400000-0x00000000009C1000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4460-6-0x0000000000E10000-0x0000000000E77000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4460-0-0x0000000000400000-0x00000000009C1000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4460-7-0x0000000000E10000-0x0000000000E77000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4460-2-0x0000000000E10000-0x0000000000E77000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4960-904-0x0000020315840000-0x00000203159D8000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4960-803-0x00007FFED5470000-0x00007FFED59FE000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5560-28-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5560-36-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5560-27-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5560-108-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5564-121-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5564-128-0x0000000000C90000-0x0000000000CF0000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5564-122-0x0000000000C90000-0x0000000000CF0000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5564-133-0x0000000000C90000-0x0000000000CF0000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5564-135-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5568-83-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5568-19-0x0000000000E20000-0x0000000000E80000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5568-22-0x0000000000E20000-0x0000000000E80000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5568-14-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6004-9716-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6004-9703-0x00007FF6E6DE0000-0x00007FF6E71A7000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6004-9715-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6004-9709-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6004-9708-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6004-9707-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6004-9711-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6004-9704-0x00007FFED0A40000-0x00007FFED2585000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6004-9706-0x00007FFEB8B40000-0x00007FFEB8B50000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6004-9714-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6004-9702-0x00007FFEC8BF0000-0x00007FFECA9D5000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6004-9700-0x00007FFED37E0000-0x00007FFED4384000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6004-9701-0x00007FFECFFB0000-0x00007FFED0A36000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6004-9699-0x00007FFED4710000-0x00007FFED4C9E000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6004-9698-0x00007FFED9150000-0x00007FFED9295000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6004-9713-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6004-9710-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6004-9712-0x00007FFEB7630000-0x00007FFEB7640000-memory.dmp
                                                                                                                              Download