Analysis
- max time kernel
49s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
01/11/2026, 05:48
General
- Target 2026-10-30_17644d1799248a331f11db3577bfd005_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
- Size 5.8MB
- Sample261101-ghvphsszhx
- SHA256 8bd72165f7a5bea897c55222c1485200ead512aabd3c1dede34c84226dce397e
Malware Config
Signatures
- Family: PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- Executes dropped EXE 24 IoCs
- Loads dropped DLL 19 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unexpected DNS network traffic destination 38 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Writes a Windows system DLL name to a user directory 2 TTPs 1 IoCs
A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 24 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 64 IoCs
- Modifies system certificate store 2 TTPs 36 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 47 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_17644d1799248a331f11db3577bfd005_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_17644d1799248a331f11db3577bfd005_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\WPS\Installers\87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1219.exe"C:\ProgramData\WPS\Installers\87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1219.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -installMsoAddin -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes a Windows system DLL name to a user directory
- Writes to the Master Boot Record (MBR)
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe" -installregister sharedMemory_message_E59F0713⤵
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingshellext64.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kwpsshellext64.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\pdfwspv\pdfwspv.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*install "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\pdfwspv\pdfwspv.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*thumbnail "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\pdfwspv\pdfwspv.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*drivebho "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*onlinefile "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe" -checkInstallEnvironment3⤵
-
-
C:\Program Files\Kingsoft\office6\wpscloudsvr.exe"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService3⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wpsoffice.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wpsoffice.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=klangmanager -dll_name=klangmanager.dll downloadlang en_US3⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe" -sendinstalldyn 53⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kvprinter\Kvpins64.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kvprinter\Kvpins64.exe" /i "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kvprinter\Kvpins64.inf" /s3⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kvprinter\kvpvbsext.dll",_X86ScriptHostEntry VBScript 645ABBF35FB84C8180FBC3FE21DB20A4 1 Uninstall /_X64Cast4⤵
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kvprinter\kvpvbsext.dll",_X86ScriptHostEntry VBScript A5AE15A6E4744EB6ADF3B2CAE4908E49 1 Install /_X64Cast4⤵
-
-
C:\Windows\system32\spool\DRIVERS\x64\3\kvpet.exeC:\Windows\system32\spool\DRIVERS\x64\3\kvpet.exe pdf_virtualprinter_install 0x3f0, 0x684⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\\office6\ksomisc.exe" -defragment3⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe" -unregisterwpsphotoautoasso3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://global.wps.com/activity/web/pc/install-success?activity_flag=aff68d4f3474ee257&page_flag=p6a720ee9e863df96?device_id=d0ae3195de714a46386b4292dfce9905&app_version=12.1.0.29162&channel=601.1219&platform=windows2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://global.wps.com/activity/web/pc/install-success?activity_flag=aff68d4f3474ee257&page_flag=p6a720ee9e863df96?device_id=d0ae3195de714a46386b4292dfce9905&app_version=12.1.0.29162&channel=601.1219&platform=windows3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2b4,0x7fffa4f7c188,0x7fffa4f7c194,0x7fffa4f7c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2068,i,11855492433447692574,7133800618762093690,524288 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1968,i,15152310146403997535,16558661781884011290,262144 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,18321612455051601503,12557276414106018195,524288 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,438762314481330608,9165423690236701057,2097152 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,3423873387213199341,18436683888695571617,2097152 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4364,i,18296926766392848281,7069305617393323288,2097152 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4516,i,13452027407792824130,3628372636811163503,2097152 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,7321450367274295493,2404657082860031182,524288 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,16923265247122556299,4307824535827460091,524288 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,11479333769911521007,5244469847460236960,524288 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,12420553051469440080,824214708390305120,524288 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,12420553051469440080,824214708390305120,524288 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,7212235433842423906,6913847668170693939,524288 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,12867309714843016769,4806071834530739623,524288 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,17300388645774057187,7792379130597645353,524288 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,13874245745546253697,17422782330358708467,524288 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,587748874394452169,12899447900767803240,524288 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,1212725997730676796,10381196301803474899,524288 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,15408191082527521350,10804919203417607679,524288 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,5623721803478228274,12727068573526755480,524288 --field-trial-handle=2132,i,4745130653496369904,17228690299044345286,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:84⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe" /prometheus /download_lang_on_start /lang=en_US /from=get_start_with_wps_after_install_onlinesetup2⤵
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe" /prometheus /download_lang_on_start /lang=en_US /from=get_start_with_wps_after_install_onlinesetup3⤵
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe" Run -Entry=EntryPoint "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6/addons/kcef/jsapibrowser.dll" --server=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --from=wpsoffice4⤵
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\promecefpluginhost.exe"C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=zh-CN --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --mojo-platform-channel-handle=1768 --field-trial-handle=2116,i,5561304247947989228,1134482912773298362,131072 --disable-features=TSFImeSupport /prefetch:25⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\promecefpluginhost.exe"C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=zh-CN --service-sandbox-type=none --no-sandbox --log-severity=disable --lang=zh-CN --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --mojo-platform-channel-handle=2344 --field-trial-handle=2116,i,5561304247947989228,1134482912773298362,131072 --disable-features=TSFImeSupport /prefetch:85⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=9504 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=2116,i,5561304247947989228,1134482912773298362,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=9504 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3092 --field-trial-handle=2116,i,5561304247947989228,1134482912773298362,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=9504 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3300 --field-trial-handle=2116,i,5561304247947989228,1134482912773298362,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=9504 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3308 --field-trial-handle=2116,i,5561304247947989228,1134482912773298362,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=9504 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3372 --field-trial-handle=2116,i,5561304247947989228,1134482912773298362,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=9504 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3448 --field-trial-handle=2116,i,5561304247947989228,1134482912773298362,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=9504 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3456 --field-trial-handle=2116,i,5561304247947989228,1134482912773298362,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=9504 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3480 --field-trial-handle=2116,i,5561304247947989228,1134482912773298362,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=9504 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4004 --field-trial-handle=2116,i,5561304247947989228,1134482912773298362,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=9504 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3636 --field-trial-handle=2116,i,5561304247947989228,1134482912773298362,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=9504 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4056 --field-trial-handle=2116,i,5561304247947989228,1134482912773298362,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=9504 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4088 --field-trial-handle=2116,i,5561304247947989228,1134482912773298362,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPSOFF~1\1210~1.291\office6\wps.exe" Run /AppUserModelID=Kingsoft.Office.cefhomepage -Entry=CefRenderEntryPoint -EncodePathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -EncodePath QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGtzb2pzY29yZS5kbGw= -CefPluginPathU8=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -CefPluginPath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xjZWY= -JSCefServicePath=QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxLaW5nc29mdFxXUFMgT2ZmaWNlXDEyLjEuMC4yOTE2MlxvZmZpY2U2XGFkZG9uc1xrY2VmXGpzY2Vmc2VydmljZS5kbGw= -CefParentID=9504 "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6\promecefpluginhost.exe" --type=renderer --log-severity=disable --disable-pdf-extension --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --jbserver=browser.a3ba19ec797144349ea5dbc1b742aca1.29162.e3afed0047b08059.high.dpi1.pipe --no-sandbox --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\debug.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=zh-CN --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4052 --field-trial-handle=2116,i,5561304247947989228,1134482912773298362,131072 --disable-features=TSFImeSupport /prefetch:15⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe" Run C:\Users\Admin\AppData\Roaming\Kingsoft\wps_intl\addons\pool\win-x64/upaeolus261012_3.1.0.2/repsvr.dll -upoffice4⤵
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe" Run -User=Admin "C:\Users\Admin\AppData\Roaming\Kingsoft\wps_intl\addons\pool\win-x64\upaeolus261012_3.1.0.2\repsvr.dll" "-upoffice" -high5⤵
-
-
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
-
-
C:\ProgramData\WPS\Installers\87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1219.exe"C:\ProgramData\WPS\Installers\87b0b99ff0585a1f5b4a6835065b14a9_Personal_Office_i18n_Free.exe.601.1219.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -installMsoAddin -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E596DC4 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e596807\1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode -source=12⤵
- Network Service Discovery
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk" 53863⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\wtoolex\wpsupdate.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\wtoolex\wpsupdate.exe" /from:setup2⤵
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe" -collectfileassoinfo -module=1;2;4;8;262144;524288;1048576 -daily -source=13⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\wtoolex\wpsupdate.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\wtoolex\wpsupdate.exe" -createtask2⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\kdesktopshellext\kdesktopshellext.dll"2⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\kdesktopshellext\kdesktopshellext.dll"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe" -regyunpanfornew -forceperusermode2⤵
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"3⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u /n /i:overlayicon "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"3⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u /n /i:contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"3⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\qingnse64.dll"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\ksomisc.exe" -installregister sharedMemory_message_E59F61E -forceperusermode1⤵
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"2⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"3⤵
-
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"2⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe" Run "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\addons\ktaskschdtool\ktaskschdtool.dll" /task=wpsexternal /createtask2⤵
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe" CheckService3⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe" Run -User=Admin -Entry=EntryPoint "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.1.0.29162/office6/addons/ktaskschdtool/ktaskschdtool.dll" /user=Admin /task=wpsexternal /cleantask /pid=11012 /prv3⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kstartscreenpinchecker64.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kstartscreenpinchecker64.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Office.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPSÂ Docs.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Slides.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Sheets.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk"2⤵
-
-
C:\Windows\System32\openwith.exe"C:\Windows\System32\openwith.exe"2⤵
-
-
C:\Windows\System32\openwith.exe"C:\Windows\System32\openwith.exe"2⤵
-
-
C:\Windows\System32\openwith.exe"C:\Windows\System32\openwith.exe"2⤵
-
-
C:\Windows\System32\openwith.exe"C:\Windows\System32\openwith.exe"2⤵
-
-
C:\Windows\System32\openwith.exe"C:\Windows\System32\openwith.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Office.lnk" 516092⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk" 516092⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPSÂ Docs.lnk" 516092⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Slides.lnk" 516092⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Sheets.lnk" 516092⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk" 516092⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPSÂ Docs.lnk" 516062⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Slides.lnk" 516062⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Sheets.lnk" 516062⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS PDF.lnk" 516062⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"1⤵
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wps.exe"2⤵
-
-
C:\Program Files\Kingsoft\office6\wpscloudsvr.exe"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService1⤵
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kvprinter\kvpins64.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\kvprinter\Kvpins64.exe"1⤵
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wpscloudsvr.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\wpscloudsvr.exe"1⤵
-
C:\Program Files\Kingsoft\office6\wpscloudsvr.exe"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Hijack Execution Flow
1DLL Search Order Hijacking
1Pre-OS Boot
1Bootkit
1Defense Evasion
Direct Volume Access
1Hijack Execution Flow
1DLL Search Order Hijacking
1Masquerading
1Match Legitimate Name or Location
1Modify Registry
1Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
KingsoftUE.ttf
WPSLingXiuHei.ttf
mtextra.ttf
698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Qt5NetworkKso.dll
icudtl.dat
v8_context_snapshot.bin
Everything-KingSoft-CloudSearch.ini
Everything.exe
run.ini
error-net-72.png
theme_template_download_close.png
blank_official.docx
normal.pptx
index.html
index.js
kpluginrunner.dll
logo-small.png
logo.png
ktaskpanelcopilot.qm
IndexPage-c453f6ef.js
favicon.ico
webshapenotices.txt
webshapenotices.txt
webshapenotices.txt
run.ini
harmony_close.svg
kwpsaibasetypo.qm
fail.png
ferrPage_timeout.html
element-icons.ttf
sync-folder.svg
element-icons.woff
chunk-vendors.css
chunk-vendors.js
index.js
index.js
index.js
apm-init.js
default_ava.svg
loading.svg
weibo.svg
app.css
chunk-vendors.css
app.js
chunk-vendors.js
chunk-vendors.js
index.js
index.js
index.js
logo_new_1.svg
aeocenter.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
repsvrsecurityTmp.dat
repsvrsecurityTmp.dat.tmp
setup.cfg
setup.cfg
setup.cfg
concrt140.dll
realword.txt
verify_hash_text.dat
dbghelp.dll
et.exe
kbaseconfigcenter.dll
kcrashdumper.exe
ksolaunch.VisualElementsManifest.xml
ksolaunch.exe
ksomisc.exe
kvpins64.exe
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
printTemplate.pdf
EqnEdit.exe
addwatermark_buildin_wps.doc
presetLayout_15.pptx
newchart.et
photolaunch.exe
qingnse.dll
qingnse64.dll
qingshellext.dll
qingshellext64.dll
windowsprintersupport.dll
refEdit.dll
watl.bin
transerr.exe
vccorlib140.dll
vcruntime140_threads.dll
wpp.exe
wps.exe
wpscloudsvr.exe
wpsoffice.exe
wpspdf.exe
Everything-KingSoft-wpsdesktop.ini_bk
Everything-KingSoft.ini_bk
logo-small.png_bk
logo.png_bk
aeocenter.dll_bk
install.ini
install.ini
install.ini
updatepolicy.exe
updateself.exe
wpsupdate.exe
1a46dbe1-5acd-405a-a247-13dd12165c22.tmp
4094e32b-fac2-481d-b496-1cda96261f9e.tmp
7a63503a-214f-438e-b916-bb6bacf11f9a.tmp
84416552-6222-4dc7-823b-0772b414585a.tmp
settings.dat
settings.dat
544491ba-432c-4f62-972f-25d5459e0597.tmp
8910a55f-f5b9-4ff7-a1c4-a7f1afdb5413.tmp
90a02f23-8596-4cd8-b742-1d360ca0c809.tmp
temp-index
the-real-index
470f69ad-599f-40ac-b413-eb24f83e6ccf.tmp
dasherSettingSchema.json
CURRENT
c6a45ffe-760f-45ac-8ca0-c5a07138d1da.tmp
d694cc2d-2ed8-4501-bccf-7c8f07877835.tmp
sync_diagnostic.log
ab5e0238-b34e-4ca5-b37f-a9cbe09b2e35.tmp
b09380e8-8f80-4c47-8718-355f4e44c73c.tmp
d05d79cb-32fc-46fe-80ce-9e616ca2a116.tmp
d553992d-7ebd-4663-8c6f-5993aa032532.tmp
46f1c2e7-c992-4c9a-92d8-bf6143ae9c18.tmp
fab70956-3c6f-493c-b1d4-bb1799eb10be.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
iconcache_idx.db
57ca4a3a-47d8-499b-9d8a-35b106dbce45.tmp
5b9df494-bf28-4e01-8891-d07fdfd30dc4.tmp
78ed5901-984b-40e3-864a-bffa76047095.tmp
content.js
messages.json
dingding.svg
third-party.svg
weibo-dark.svg
wps.svg
xiaomi.svg
diff_resource_file.json
functional-group-expand.css
pdfscreen.css
errPage.html
error-net.html
badge-boutique.svg
badge-professional.svg
ckt-all-color.png
icon-ai-imitation-of-style-dashed.svg
icon-ai-tool-dashed.svg
icon-grab.svg
icon-grabbing.svg
img-error.svg
loading-dark.gif
loading.gif
nologin.svg
pdf-migrate-batch-convert.svg
pdf-migrate-batch-create.svg
pdf-migrate-batch-extract-images.svg
pdf-migrate-batch-print.svg
pdf-migrate-compress.svg
pdf-migrate-create-blank.svg
pdf-migrate-create-file.svg
pdf-migrate-create-images.svg
pdf-migrate-create-open.svg
pdf-migrate-fill-sign.svg
pdf-migrate-full-edit.svg
pdf-migrate-image-to-pdf.svg
pdf-migrate-merge.svg
pdf-migrate-split.svg
pdf-migrate-to-excel.svg
pdf-migrate-to-image.svg
pdf-migrate-to-ppt.svg
pdf-migrate-to-word.svg
qrcode-bg.svg
Report_US_SS1.svg
Announcement_DS_LS1.svg
Approval_DS_SS1.svg
BlankText.svg
Bulletin_DS_1Seal.svg
Communique_DS_LS1.svg
Consult_US_5Seals.svg
Decision_DS_5Seals.svg
Motion_US_PS.svg
Notice_DS_LS1_HT.svg
Notification_DS_SS1_ATCM.svg
Opinion_DS_SS1.svg
Referral_US_1Seal.svg
Report_US_SS2.svg
Resolution_DS_SS3.svg
Summary.svg
config.ini
app.css
advertisement.svg
pdf2excel.svg
pdf2photo.svg
pdf2ppt.svg
pdf2word.svg
pdf_ad_icon.svg
pdf_combine.svg
pdf_new_blank_file.svg
pdf_new_file.svg
pdf_new_scan_file.svg
pdf_open_file.svg
pdf_split.svg
pdfcompress.svg
photo2pdf.svg
translateAll.svg
index.html
0.js
1.js
2.js
3.js
app.js
manifest.js
vendor.js
wps_perf_client.js
src_components_dbsheet-preview_index_js.css
src_components_preview-common_index_vue.css
company-avatar-badge.png
company-avatar-bg-dark.png
company-avatar-bg-light.png
company-avatar-privilege-dark.png
company-avatar-privilege-light.png
icon-dark-ai-tool-dashed.svg
Update.cfg
diff_resource_file.json
kprivilegeresource.bin2
diff_resource_file.json
manifest.js
vendor.js
index.html
run.ini
run.ini
index.js
app.css
kpromeaccountpanel.qm
diff_resource_file.json
ksyncengine.qm
ksyncengine.qm
bg-newwork-error.png
index.js
index.js
chunk-5a03ae44.css
icon-back.svg
icon-settings.svg
index.js
logo_i18n.png
login_failed_forceIntranet.html
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
chunk-vendors.css
index.js
wpsbox.qm
skin.ini
Update.cfg
diff_resource_file.json
aeocenter.bin2
style.xml
lang_list.json
style.xml
Qt5CoreKso.dll
Qt5GuiKso.dll
Qt5SvgKso.dll
Qt5WidgetsKso.dll
Qt5WinExtrasKso.dll
kbaseconfigcenter64.dll
kpacketui.dll
kpacketui.qm
msvcp140.dll
qsvgicon.dll
qsvg.dll
qskia.dll
qwindows.dll
qwindowsvistastyle.dll
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
product.dat
product_new.dat
style.xml
tempinstall.ini
tempinstall.ini
WPS Office.lnk
1811de1e478e9e4c1f616933fb4a4442.png
18510f23c370f9789fffff6b5073079d.png
58cb4e80e1a02f0139ca12e504b48e19.png
b7e918aacbc5a05f4062d38bbdf8fbd3.png
c8d153458553353b8277d893498206d8.png
503914768.values
08f92581a381c34eca30290b90995d56.prog.tmp
4bbfed7471133ca451ddb4afdfd1aa09.prog.tmp
5df7af200ba905f133e465dd14044045.prog.tmp
5f495c40c234747f57cbcaf29f2f3725.prog.tmp
65922b8a70c7f729626e398e389acb2c.prog.tmp
77ca6a25d670b047f637285312ec1ae8.prog.tmp
25a355448d733f0bfadfe69265753986.svg
4e4df5d3322d880f582f3c95b6f2ae88.svg
50c4d3b6ffa860908c73643d2a9fe37b.svg
8e2c18164ccef1cf945648e9bd5c1991.svg
aac1856207f372d91bf9c10d624d5905.svg
e2bc5e2f6c4f468fc9922914b3b46427.svg
ids_v3_lang_128.ini
ids_v3_lang_60.ini
ksomisc_2026_11_01.log
wpssetup.log
wpssetup.log
wpssetup.log
wpssetup.log
wpssetup.log
dcsdk_dpv3.data
dcsdk_dpv3.data
temp-index
index
temp-index
MANIFEST-000001
8dc628e9-576c-49d8-8062-0be25526f7e6.tmp
upaeolus261012_3.1.0.2.ini
upaeolus261012_3.1.0.2.ini.atQsXj
download.7z
controlcfg.json
privilegecfg.json
syscontrolids.json
download.7z
kiconrecovery.dll
run.ini
download.7z
download.7z
download.7z
icons_svg.data
knewdocs.kuip
knewdocs.qm
normal_black.pptx
normal_gray.pptx
config.ini
index.css
kdocs-655a72.css
main.css
newblank.css
report.css
screenmytpl.css
screensearch.css
src_views_screen_components_pm-recommend_vue.css
upload-error-tip.css
upload-finder.css
index.html
chunk-vendors.js
entry-theme.js
index.js
aietscreen.js
index.js
core-js-fb0bfc.js
index.js
index.js
index.js
index.js
index.js
index.js
functional-group-expand.js
index.js
index.js
index.js
kdocs-655a72.js
index.js
main.js
index.js
newblank.js
pdf-main.js
pdfscreen-969582.js
index.js
privilege-modal.js
index.js
index.js
report.js
index.js
runtime-env.js
screenmytpl.js
screensearch.js
src_common_svg-utils_util_js.js
src_components_dbsheet-preview_index_js.js
src_components_preview-common_index_vue.js
src_views_screen_components_pm-recommend_vue.js
svg-baker-runtime-383915.js
index.js
index.js
upload-error-tip.js
upload-finder.js
index.js
vue-loader-a98510.js
index.js
index.js
app.css
element-icons.ttf
img-error.png
loading-img-42.gif
loadingOutlines.gif
sprite.png
index.html
0.js
1.js
2.js
3.js
4.js
5.js
6.js
7.js
app.js
manifest.js
vendor.js
37.css
38.css
39.css
40.css
41.css
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.css
AI-logo-wpp.svg
version
knewdoctabbar.json
knewdoctabbar.kui
app.css
index.html
0.js
1.js
4.js
app.js
common.js
manifest.js
ai-filter-bar-d78fd3.css
ai-search-box-function-area-dbc0f7.css
enterprise.css
enterprisemytpl.css
main.css
ai-filter-bar-d78fd3.js
ai-search-box-function-area-dbc0f7.js
chunk-async-shared.js
main.js
runtime-env.js
src_common_utils_sentry_js.js
src_components_dbsheet-preview_index_js.js
src_components_preview-common_index_vue.js
src_views_enterprise_index_vue.js
template-supply-bbc2e4.js
runinfo.json
download.7z
kodfconverthelper.qm
kodfconverthelper.qm
kodfconverthelper.qm
kodfconverthelper.qm
download.7z
download.7z
app.css
homePage.css
error-net.svg
index.html
app.js
chunk-vendors.js
homePage.js
app.css
chunk-vendors.js
index.html
app.css
app.js
manifest.js
vendor.js
app.css
mac_hero.png
pc_hero.png
pro.png
success.svg
index.html
app.js
chunk-vendors.js
app.css
icon-banner-arrow.svg
icon-banner-close-dark.svg
icon-banner-close.svg
icon-close-hover.svg
icon-close.svg
icon-flash.svg
icon-pause.svg
icon-timer.svg
chunk-vendors.js
index.html
app.css
app.js
vendor.js
app.css
app.js
chunk-vendors.js
app.css
homePage.css
multiPage.css
icon-close.svg
loading.gif
chunk-vendors.js
homePage.js
multiPage.js
app.css
homePage.css
ai-switch-off.svg
ai-switch-on.svg
app.css
chunk-027b11da.css
guidePay.css
ai_parallel_translate.png
ai_photos.png
ai_premium_icon_white.svg
ai_slides_premium.png
ai_spell_check.png
ai_style_close_icon.svg
icon-ai.svg
icon-close.svg
icon-cloud.svg
icon-costs.svg
icon-discount.svg
icon-down.svg
icon-flash.svg
icon-multi.svg
icon-new.svg
icon-next.svg
icon-ocr.svg
icon-pdf-conver.svg
icon-pdf-edit.svg
icon-screen.svg
icon-setting.svg
icon-stable.svg
icon-template.svg
pdf_toolkit.png
popBg.png
upgrade_vip_img.png
index.html
app.js
chunk-027b11da.js
chunk-0e8c0775.js
chunk-vendors.js
guidePay.js
upgrade.js
meta_operation.json
meta.json
meta.json
meta_mac.json
meta.json
meta_mac.json
koperationstrategy.qm
koperationstrategy.qm
koperationstrategy.qm
koperationstrategy.qm
download.7z
download.7z
download.7z
download.7z
kpromeaccountpanel.dll
kpromeaccountpanel.qm
kpromeaccountpanel.qm
index.html
app.css
chunk-vendors.css
icon-mac-docer.svg
tiance_error.png
tiance_error_larger.png
app.js
chunk-vendors.js
index.html
app.css
app.js
index.html
load-apm.js
app.css
iconfont.ttf
iconfont.woff
iconfont.woff2
Group.svg
abnormal-dark.svg
abnormal.svg
arrow-1.svg
basic.webp
bell_flat.svg
certified.svg
common-icon.svg
company-admin.svg
company-priv.svg
default-avatar-dark.svg
default-avatar.svg
default_loginmode.svg
default_loginmode_dark.svg
dingding-dark.svg
email-dark.svg
email.svg
enterprise-member.svg
expired.svg
feedback-icon.svg
icon-corp.svg
icon-dark-corp.svg
info.svg
message-gray.svg
notcertified.svg
paided.webp
people-single.svg
phone-dark.svg
phone.svg
qq-dark.svg
qq.svg
remove.svg
third-party-dark.svg
warning-ico.svg
warning.svg
wechat-dark.svg
wechat.svg
wps-dark.svg
xiaomi-dark.svg
xmianban.png
app.js
index.js
chunk-vendors.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.html
app.css
app.js
app.css
app.js
app.css
app.js
index.html
app.css
weibo-dark.svg
weibo.svg
app.js
chunk-vendors.js
index.js
index.js
index.js
index.html
app.css
app.js
chunk-vendors.js
index.js
index.js
favicon.ico
index.html
chunk-473e4774.css
cloud-space.svg
cloud_icon.svg
ercode.png
clientpc.js
index.js
chunk-473e4774.js
chunk-79658f40.js
chunk-vendors.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.html
app.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
icons.data
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
kpromeaccountpanel.qm
download.7z
kpromeextic.dll
run.ini
download.7z
kpromeforceclosedlg.qm
kpromeforceclosedlg.qm
download.7z
icons_svg.data
index.html
kloginwelcome.data
kloginwelcome.kuip
app.css
banner-default.png
net-error.svg
app.js
manifest.js
vendor.js
app-main.js
index.js
index.js
logon.js
index.js
error.png
login_failed.html
wechat_error1.html
wechat_error2.html
wechat_error3.html
icons_svg.data
kloginwelcome.qm
qingaccount.data
banner-default-pro-2.png
banner-default-pro.png
banner-edu.png
quickrescode.svg
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
index.js
README.md
errPage.html
base64.js
common.js
errorPage.html
pcNetworkError-Buxsq0W-.css
favicon.ico
i18n-pcNetworkError-BpLF0DKO.js
ar-SA-C_xYSIym.js
de-DE-5r6NJUZf.js
es-ES-Dhg0WUUl.js
es-MX-YyE_ZFF2.js
fa-IR-DqdFAHfC.js
fil-PH-DmmkxZXn.js
fr-FR-k5ohZF4F.js
he-IL-BKlkgz5-.js
hi-IN-CtzwVMeF.js
id-ID-D-5bblER.js
it-IT-CYhGtsJp.js
ja-JP-CN8rrPJF.js
ko-KR-BFYxNeRK.js
ms-MY-DxbGYNwB.js
pl-PL-DsJuFQDl.js
pt-BR-CiaLRS3W.js
pt-PT-CEuQRoPB.js
ru-RU-DX6wJVG-.js
th-TH-BIY5BYPJ.js
tr-TR-ou68XEhN.js
uk-UA-B5FyG2N7.js
ur-IN-NIJ38grM.js
vi-VN-ClZ9ia6m.js
zh-CN-BqRf61SB.js
zh-HK-BFT9tbKb.js
zh-TW--cT5PTRv.js
pcNetworkError-BJlnt6sB.js
vue-vendor-YvFg7x4o.js
app.css
Alipay HK.svg
Boleto.svg
Boost.svg
DANA.svg
GCash.svg
Grabpay.svg
LINE Pay.svg
Maya.svg
Mercado Pago.svg
Nequi.svg
OXXO.svg
Pix-logo.svg
Stripe_2.gif
TNG.svg
TrueMoney.svg
UPI.svg
Yape.svg
add-more.svg
arrow-down.svg
card.svg
checked-box.svg
close-normal.svg
close-white.svg
co.svg
comma_down.svg
comma_up.svg
coupon-clock.svg
custom-loading.svg
cvc.svg
down.svg
ebanx-localcard.svg
error.png
exclamation_point_fill_shape.svg
family_success_icon.svg
google-pay.svg
googlePay.svg
group_skip_retain_close.svg
group_skip_retain_hero.png
icon-clear.svg
icon-tag-close.svg
icon-toast-fail.svg
icon-toast-hint.svg
icon-toast-success.svg
icon-toast-warn.svg
icon_arrow_left.svg
info-normal.svg
link.svg
loading.svg
mercadopago.svg
pay-icon.svg
payment-successful.png
paypal.svg
pe.svg
pix.svg
point_tip.svg
pub_menubar_more.svg
received-bg.svg
secure-lock.svg
selected_green.svg
success-icon-new.svg
up.svg
upi-qr-refresh.svg
validation-circle.svg
wallet-auth-clock.svg
warning.svg
yes.svg
bundle.js.LICENSE.txt
aegis.min.js
loading-wps.svg
skeleton.gif
version.tag
download.7z
download.7z
CT_NewHome.kuip
PopupMenu.kuip
CT_Design.kuip
CT_References.kuip
CT_TableTools.kuip
CT_WorkSpace.kuip
ProxyCommands.kuip
download.7z
download.7z
perfmon.dll
run.ini
download.7z
download.7z
download.7z
download.7z
repsvr.dll_repsvr
run.ini
download.7z
.wps_rw_test_1793512172730.tmp
perfhost.exe
AgentService.exe
DiagnosticsHub.StandardCollector.Service.exe
FXSSVC.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
SearchIndexer.exe
SensorDataService.exe
Spectrum.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
memory/396-142-0x0000000000C70000-0x0000000000CD0000-memory.dmp
memory/396-136-0x0000000000C70000-0x0000000000CD0000-memory.dmp
memory/396-362-0x0000000140000000-0x00000001401AE000-memory.dmp
memory/396-146-0x0000000140000000-0x00000001401AE000-memory.dmp
memory/632-54-0x0000000000C00000-0x0000000000C60000-memory.dmp
memory/632-60-0x0000000000C00000-0x0000000000C60000-memory.dmp
memory/632-65-0x0000000000C00000-0x0000000000C60000-memory.dmp
memory/632-67-0x0000000140000000-0x0000000140181000-memory.dmp
memory/632-63-0x0000000140000000-0x0000000140181000-memory.dmp
memory/852-169-0x0000000140000000-0x0000000140172000-memory.dmp
memory/852-832-0x0000000140000000-0x0000000140172000-memory.dmp
memory/876-511-0x0000000140000000-0x00000001401FC000-memory.dmp
memory/876-160-0x0000000140000000-0x00000001401FC000-memory.dmp
memory/1136-164-0x0000000140000000-0x0000000140216000-memory.dmp
memory/1136-638-0x0000000140000000-0x0000000140216000-memory.dmp
memory/1184-114-0x0000000140000000-0x0000000140141000-memory.dmp
memory/1184-168-0x0000000140000000-0x0000000140141000-memory.dmp
memory/1636-157-0x0000000140000000-0x0000000140147000-memory.dmp
memory/1636-382-0x0000000140000000-0x0000000140147000-memory.dmp
memory/1720-27-0x0000000140000000-0x0000000140155000-memory.dmp
memory/1720-17-0x00000000006B0000-0x0000000000710000-memory.dmp
memory/1720-23-0x00000000006B0000-0x0000000000710000-memory.dmp
memory/1724-149-0x0000000140000000-0x000000014018E000-memory.dmp
memory/1724-368-0x0000000140000000-0x000000014018E000-memory.dmp
memory/2216-121-0x0000000140000000-0x0000000140142000-memory.dmp
memory/2216-312-0x0000000140000000-0x0000000140142000-memory.dmp
memory/2556-445-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-738-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-941-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-943-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-944-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-942-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-930-0x000002725C610000-0x000002725C638000-memory.dmp
memory/2556-931-0x000002725CDC0000-0x000002725CFCC000-memory.dmp
memory/2556-733-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-734-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-735-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-736-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-737-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-739-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-741-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-742-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-740-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-731-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-732-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-730-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-729-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-728-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-727-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-443-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-444-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-446-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-447-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-448-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-449-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-442-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-441-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-440-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-437-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-438-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-439-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-436-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-435-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2556-434-0x000002725B300000-0x000002725B310000-memory.dmp
memory/2640-29-0x0000000140000000-0x0000000140135000-memory.dmp
memory/2640-73-0x0000000140000000-0x0000000140135000-memory.dmp
memory/2860-117-0x0000000140000000-0x00000001401D7000-memory.dmp
memory/2860-361-0x0000000140000000-0x00000001401D7000-memory.dmp
memory/2860-172-0x0000000140000000-0x00000001401D7000-memory.dmp
memory/2964-131-0x0000000140000000-0x00000001402E9000-memory.dmp
memory/2964-39-0x0000000000CB0000-0x0000000000D10000-memory.dmp
memory/2964-32-0x0000000140000000-0x00000001402E9000-memory.dmp
memory/2964-33-0x0000000000CB0000-0x0000000000D10000-memory.dmp
memory/3044-52-0x0000000140000000-0x00000001402D4000-memory.dmp
memory/3044-43-0x0000000000890000-0x00000000008F0000-memory.dmp
memory/3044-13039-0x0000000140000000-0x00000001402D4000-memory.dmp
memory/3044-145-0x0000000140000000-0x00000001402D4000-memory.dmp
memory/3044-49-0x0000000000890000-0x00000000008F0000-memory.dmp
memory/3360-337-0x0000000140000000-0x0000000140169000-memory.dmp
memory/3360-129-0x00000000005F0000-0x0000000000650000-memory.dmp
memory/3360-132-0x0000000140000000-0x0000000140169000-memory.dmp
memory/3360-123-0x00000000005F0000-0x0000000000650000-memory.dmp
memory/3504-274-0x0000000009E60000-0x0000000009E68000-memory.dmp
memory/3504-932-0x0000000140000000-0x0000000140179000-memory.dmp
memory/3504-173-0x0000000140000000-0x0000000140179000-memory.dmp
memory/3504-206-0x0000000001A20000-0x0000000001A30000-memory.dmp
memory/3504-190-0x0000000001770000-0x0000000001780000-memory.dmp
memory/3504-366-0x000000000CD10000-0x000000000CD18000-memory.dmp
memory/3804-900-0x00007FFFB48B0000-0x00007FFFB4E3E000-memory.dmp
memory/4028-0-0x0000000000B10000-0x0000000000B76000-memory.dmp
memory/4028-71-0x0000000000400000-0x00000000009D8000-memory.dmp
memory/4028-7-0x0000000000400000-0x00000000009D8000-memory.dmp
memory/4028-12313-0x0000000000400000-0x00000000009D8000-memory.dmp
memory/4028-6-0x0000000000B10000-0x0000000000B76000-memory.dmp
memory/4100-100-0x0000000000400000-0x0000000000543000-memory.dmp
memory/4100-163-0x0000000000400000-0x0000000000543000-memory.dmp
memory/4100-106-0x0000000000870000-0x00000000008D6000-memory.dmp
memory/4100-101-0x0000000000870000-0x00000000008D6000-memory.dmp
memory/4380-156-0x0000000140000000-0x000000014017B000-memory.dmp
memory/4380-83-0x0000000140000000-0x000000014017B000-memory.dmp
memory/4380-75-0x00000000007F0000-0x0000000000850000-memory.dmp
memory/4380-81-0x00000000007F0000-0x0000000000850000-memory.dmp
memory/4496-72-0x0000000140000000-0x0000000140165000-memory.dmp
memory/4532-99-0x0000000140000000-0x0000000140156000-memory.dmp
memory/4532-14-0x0000000140000000-0x0000000140156000-memory.dmp
memory/4608-159-0x0000000140000000-0x0000000140157000-memory.dmp
memory/4608-86-0x0000000000B40000-0x0000000000BA0000-memory.dmp
memory/4608-92-0x0000000140000000-0x0000000140157000-memory.dmp
memory/4608-93-0x0000000000B40000-0x0000000000BA0000-memory.dmp
memory/4700-153-0x0000000140000000-0x00000001401C0000-memory.dmp
memory/4700-151-0x0000000140000000-0x00000001401C0000-memory.dmp
memory/7456-12322-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/7456-13356-0x0000000140000000-0x00000001401AF000-memory.dmp
memory/10724-13497-0x0000000140000000-0x0000000140133000-memory.dmp
memory/10724-13192-0x0000000140000000-0x0000000140133000-memory.dmp
memory/11040-13207-0x0000000140000000-0x0000000140133000-memory.dmp
memory/11040-13498-0x0000000140000000-0x0000000140133000-memory.dmp