Overview

overview

10

Static

static

3

2026-07-02...ry.exe

windows10-2004-x64

10

2026-07-02...ry.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    82s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 13:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-02_2adadb6714e65d95745c9d427dba711b_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_stealc_swisyn_vidar_wannacry.exe
  • Size 7.4MB
  • Sample260702-qsaa1acv2r
  • SHA256 d58b6adf4cfc3ddd7cc16af774193906d8f98a60352307b32742d994fb782463
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
bootkitdefense_evasiondiscoverypersistencespywaretrojan

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Executes dropped EXE 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies system certificate store 2 TTPs 40 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_2adadb6714e65d95745c9d427dba711b_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_stealc_swisyn_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-02_2adadb6714e65d95745c9d427dba711b_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_stealc_swisyn_vidar_wannacry.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2896
    • \??\c:\users\admin\appdata\local\temp\2026-07-02_2adadb6714e65d95745c9d427dba711b_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_stealc_swisyn_vidar_wannacry.exe 
      c:\users\admin\appdata\local\temp\2026-07-02_2adadb6714e65d95745c9d427dba711b_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_stealc_swisyn_vidar_wannacry.exe 
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4808
      • C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1125.exe
        "C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1125.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        PID:3096
        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -checkInstallEnvironment
          4⤵
            PID:13728
          • C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
            "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService
            4⤵
              PID:4392
            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -addFirewallRule
              4⤵
                PID:2292
              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpsoffice.exe
                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpsoffice.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=klangmanager -dll_name=klangmanager.dll downloadlang en_US
                4⤵
                  PID:20000
            • C:\Windows\Resources\Themes\icsys.icn.exe
              C:\Windows\Resources\Themes\icsys.icn.exe
              2⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:5676
              • \??\c:\windows\resources\themes\explorer.exe
                c:\windows\resources\themes\explorer.exe
                3⤵
                • Modifies visibility of hidden/system files in Explorer
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in System32 directory
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:5564
                • \??\c:\windows\resources\spoolsv.exe
                  c:\windows\resources\spoolsv.exe SE
                  4⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:3452
                  • \??\c:\windows\resources\svchost.exe
                    c:\windows\resources\svchost.exe
                    5⤵
                    • Modifies visibility of hidden/system files in Explorer
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:1672
                    • \??\c:\windows\resources\spoolsv.exe
                      c:\windows\resources\spoolsv.exe PR
                      6⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:5888
          • C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1125.exe
            "C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1125.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5A3E23 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\
            1⤵
            • Executes dropped EXE
            • Writes to the Master Boot Record (MBR)
            PID:5176
            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -setlng en_US
              2⤵
                PID:15084
              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -getonlineparam 00601.00001125 -forceperusermode
                2⤵
                  PID:15292
                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -getabtest -forceperusermode
                  2⤵
                    PID:6264
                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -fixoldversionassostatus
                    2⤵
                      PID:18340
                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -setservers
                      2⤵
                        PID:1588
                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -register
                        2⤵
                          PID:20020
                      • C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
                        "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService
                        1⤵
                          PID:1028

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                              • Size 471B
                              • SHA256 a6fa82dc7dead9cb4cce05ef7fa0bf3d4212da6ff2195ce91d238d9fdf424800
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                              • Size 727B
                              • SHA256 ba930829141a4e06da50ffb7c09e80b45a264d805b3adce85fc59ac15daf286d
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                              • Size 727B
                              • SHA256 82ee0d22beb0ebeea5661d46957bb61c4f81fff7abe6550fd974f0f57953684b
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                              • Size 400B
                              • SHA256 7d8e3d0b64ddf12fa7f6b3b8c887a2a40ff02dcdca3fb45fdd465809dd98749e
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                              • Size 404B
                              • SHA256 88cb02044bc6b4231caeaf4a495e0804619035ca9138d9430cefd3698415ce2c
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                              • Size 412B
                              • SHA256 1bdd4886afc6884554726cfda743c23c88284038aabf99dba1f5490f223d492f
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Qt5NetworkKso.dll
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\Qt5NetworkKso.dll
                              • Size 1.4MB
                              • SHA256 c1c94dd44d134dee803d48c475ce6692aa8e16fe41c9c2f955e784d9695a3919
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              logo-small.png
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\StartScreenTile\ksolaunch\logo-small.png
                              • Size 6KB
                              • SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              logo.png
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\StartScreenTile\ksolaunch\logo.png
                              • Size 12KB
                              • SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              run.ini
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\ketaidataanalysis\webview\run.ini
                              • Size 171B
                              • SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              index.html
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kpubaigcbox\res\dist\index.html
                              • Size 636B
                              • SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              index.js
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kpubaigcbox\res\dist\index.js
                              • Size 2KB
                              • SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              errPage.html
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
                              • Size 7KB
                              • SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              favicon.ico
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
                              • Size 4KB
                              • SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              run.ini
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwebpromehelp\run.ini
                              • Size 226B
                              • SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              close-secondary.svg
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
                              • Size 216B
                              • SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              kwpsaibasetypo.qm
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
                              • Size 334B
                              • SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
                              • MD5 SHA1 SHA512
                              Submit Download

                              kwpsaibasetypo.qm
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
                              • Size 327B
                              • SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
                              • MD5 SHA1 SHA512
                              Submit Download

                              element-icons.ttf
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
                              • Size 54KB
                              • SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              element-icons.woff
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
                              • Size 27KB
                              • SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              app.css
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
                              • Size 107KB
                              • SHA256 c9c5602e26393532e59391d5944a578716f3b6cad104ae20ac8caac805e52f86
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              chunk-vendors.css
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
                              • Size 279KB
                              • SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              app.js
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
                              • Size 380KB
                              • SHA256 f1bd1ffaba49fd0c0040f182231f739000b0e4bc762900ecacab4980f743b203
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              chunk-vendors.js
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
                              • Size 249KB
                              • SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              chunk-vendors.js
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
                              • Size 424KB
                              • SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              index.js
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
                              • Size 10KB
                              • SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              index.js
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
                              • Size 13KB
                              • SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              index.js
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
                              • Size 14KB
                              • SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              apm-init.js
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
                              • Size 57B
                              • SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              default_ava.svg
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
                              • Size 906B
                              • SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              desk-sync.svg
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
                              • Size 1KB
                              • SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              loading.svg
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
                              • Size 1KB
                              • SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              setup.cfg
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\cfgs\setup.cfg
                              • Size 449B
                              • SHA256 62b60d2fba63532572d6ba8301351b60af331a287bd66c40fe2095a710738094
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              kdesign.dll
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\kdesign.dll
                              • Size 1.3MB
                              • SHA256 61151bf1372baf4401859b4f1b7cf256879c896ae381d13add602b9aae87068f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              krt.dll
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\krt.dll
                              • Size 1.3MB
                              • SHA256 573f2ac053ddf0ad023a0ba257d59fe9a37c29f383923c59afad34b8f89122eb
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ksolite.dll
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksolite.dll
                              • Size 12.3MB
                              • SHA256 fb5fee591d3b5c0f7092c72f3ae44ceb3078e2e42bda1d2edad1c1a00fbc19d9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ksomisc.exe
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
                              • Size 3.7MB
                              • SHA256 3342f9691125a2214c37b2a5b5fcf43ea3320d838bedd5d6343a22788c25644d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              libcrypto-kso-1_1-x64.dll
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\libcrypto-kso-1_1-x64.dll
                              • Size 3.4MB
                              • SHA256 958d72a1aa20d4f090cfdd00ef5f3711cbf7ef6ec7f1768ee4e335e93c3b3092
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              error-net-72.png
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
                              • Size 1KB
                              • SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              presetLayout_16.pptx
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
                              • Size 41KB
                              • SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              wpscloudsvr.exe
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpscloudsvr.exe
                              • Size 1.1MB
                              • SHA256 f5726c54eabfa893b1cebeba9c9b9731715faec9e01d137d705f70150375fdf8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              wpsoffice.exe
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpsoffice.exe
                              • Size 1.2MB
                              • SHA256 c70e66e699cf1b6a61ee1c77360203cbcd4cb5f401fa390cc8eda7b7c8fa9b6b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              install.ini
                              • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\utility\install.ini
                              • Size 462B
                              • SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              2026-07-02_2adadb6714e65d95745c9d427dba711b_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_stealc_swisyn_vidar_wannacry.exe 
                              • Path C:\Users\Admin\AppData\Local\Temp\2026-07-02_2adadb6714e65d95745c9d427dba711b_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_stealc_swisyn_vidar_wannacry.exe 
                              • Size 7.3MB
                              • SHA256 87fc11b59229d78663f63a43406dc41c09963de653d69b5112563b4d3b003d79
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Qt5CoreKso.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\CONTROL\office6\Qt5CoreKso.dll
                              • Size 5.7MB
                              • SHA256 ae105320fafecbdf6e26a3c2ac51bff164ed60e2c80d7c2a909f7c8abf350d21
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Qt5GuiKso.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\CONTROL\office6\Qt5GuiKso.dll
                              • Size 6.4MB
                              • SHA256 62bb5bae4f0cd7cd7776471bf93cb00601badaded78a1d6978b085a38d9a5ac7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Qt5SvgKso.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\CONTROL\office6\Qt5SvgKso.dll
                              • Size 503KB
                              • SHA256 399cd93775185a1a0db67abebd302d8f227e3e17f8e42836a297ba148d4a6ec9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Qt5WidgetsKso.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\CONTROL\office6\Qt5WidgetsKso.dll
                              • Size 5.6MB
                              • SHA256 44cd4abc65e8c79047182c2f1846cc554acd01836445b3e3ce51483bab103c86
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Qt5WinExtrasKso.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\CONTROL\office6\Qt5WinExtrasKso.dll
                              • Size 251KB
                              • SHA256 ac783be33b205c69a7d77191bc5f4af8aae1ec0e86ac861e1ee2649a06cf0e5a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              kpacketui.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\CONTROL\office6\kpacketui.dll
                              • Size 699KB
                              • SHA256 64037be52e7e91ed511e278834867fd3f5481efd8620f88d94ad6371f021d5e5
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              msvcp140.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\CONTROL\office6\msvcp140.dll
                              • Size 544KB
                              • SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              qsvgicon.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
                              • Size 75KB
                              • SHA256 49c19cd06a911fc42ed256d1691243e20dde7596fc9a19ea71a29f261d1f823a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              qsvg.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
                              • Size 46KB
                              • SHA256 a81f7b0fcde9820fe96471746854a7a1f5100f53adb71da30e6c14fe35f5774d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              qskia.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\CONTROL\office6\qt\plugins\platforms\qskia.dll
                              • Size 1.9MB
                              • SHA256 ed2434466d697329e29941aea13b87bf104679652c7c33bd1b358b6fd623ae67
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              qwindows.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\CONTROL\office6\qt\plugins\platforms\qwindows.dll
                              • Size 1.6MB
                              • SHA256 85a5998534e16d1eba7f151395e8e892c16a4c30468236a636e1da213d27e37d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              qwindowsvistastyle.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
                              • Size 159KB
                              • SHA256 28b753795101ece7c933d4d47130f51f2b7de8635ba154eaa03ebc82f8cc9f78
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ucrtbase.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\CONTROL\office6\ucrtbase.dll
                              • Size 987KB
                              • SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              vcruntime140.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\CONTROL\office6\vcruntime140.dll
                              • Size 121KB
                              • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              vcruntime140_1.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\CONTROL\office6\vcruntime140_1.dll
                              • Size 48KB
                              • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              style.xml
                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\CONTROL\pl_PL\style.xml
                              • Size 3KB
                              • SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              product.dat
                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\CONTROL\product.dat
                              • Size 79KB
                              • SHA256 864381c3016e55b25aea9ae26d8fffdef73765fd46f4236be41362d6f65a7f3e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              product_new.dat
                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\CONTROL\product_new.dat
                              • Size 72KB
                              • SHA256 8b8908a5a2964c840f954bbfd59679fb684c3bc3aee98332b28d5eda76bd5db7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              style.xml
                              • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a3913\CONTROL\vi_VN\style.xml
                              • Size 4KB
                              • SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              tempinstall.ini
                              • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                              • Size 387B
                              • SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              tempinstall.ini
                              • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                              • Size 433B
                              • SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              ksomisc_2026_07_02.log
                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_07_02.log
                              • Size 5KB
                              • SHA256 abaec6c82e45ac49d1bdc35c780a45d068f1e80925bbd5ce971d138742b17916
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              wpssetup.log
                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                              • Size 10KB
                              • SHA256 75798850cc3c20530f3615f313c1249408526fa191e6c84eb79d4d285eb8b9d1
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              wpssetup.log
                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                              • Size 11KB
                              • SHA256 d8861853bf9745d91b7fabfc3b311e61b31c544eb7641468176edb0c839422ed
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              wpssetup.log
                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                              • Size 26KB
                              • SHA256 ce10c306c8b14a680ab910fd2732c0bf9fbdc418e2c4bd4515492a6f00149ed2
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              wpssetup.log
                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                              • Size 59KB
                              • SHA256 1930f00ae86d81e646928d19d43f86cd44081304b67ef90a6adf85061d94da2f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              wpssetup.log
                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                              • Size 65KB
                              • SHA256 77db1e0a56295998a4b788847a72b757d7ac7ad6b70dcb4b65451465374c9a5c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dcsdk_dpv3.data
                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
                              • Size 41KB
                              • SHA256 554c67224327824731a2dea68961619fa2f68dd88722eeb85b11a5e3350c8a27
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dcsdk_dpv3.data
                              • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
                              • Size 41KB
                              • SHA256 fbfdd2422191cb900c9a4a804f67901ebb467644eb1e19bf1cca04e362a6fd68
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              explorer.exe
                              • Path C:\Windows\Resources\Themes\explorer.exe
                              • Size 135KB
                              • SHA256 ab6bbcaf86ec6335e4d0e480ee80c20a5a362977ae38aa6f3e11c6d634557d14
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              icsys.icn.exe
                              • Path C:\Windows\Resources\Themes\icsys.icn.exe
                              • Size 135KB
                              • SHA256 fba3b14dac4cb90990b95308e55b24854a6c7ba0085f428886943073a2a0a472
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              spoolsv.exe
                              • Path C:\Windows\Resources\spoolsv.exe
                              • Size 135KB
                              • SHA256 8649c8fde7a0f9a1fc2597d4ff1018ac6c1e52ba97e8d1eeb44cf3934e2efa22
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              svchost.exe
                              • Path C:\Windows\Resources\svchost.exe
                              • Size 135KB
                              • SHA256 40f41b62c93815ce290a8cd607e04289db1277113f823a1c4ff72ee24189a87c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              memory/1588-8394-0x00007FF70FB40000-0x00007FF70FEEE000-memory.dmp
                              Download

                              memory/1588-8411-0x00007FFBCB510000-0x00007FFBCD210000-memory.dmp
                              Download

                              memory/1588-8393-0x00007FFBCEE70000-0x00007FFBCF3FE000-memory.dmp
                              Download

                              memory/1588-8391-0x00007FFBCF8C0000-0x00007FFBD050E000-memory.dmp
                              Download

                              memory/1588-8392-0x00007FFBCF770000-0x00007FFBCF8B4000-memory.dmp
                              Download

                              memory/1672-7792-0x0000000000400000-0x000000000041F000-memory.dmp
                              Download

                              memory/2292-8366-0x00007FFBCB510000-0x00007FFBCD210000-memory.dmp
                              Download

                              memory/2292-8349-0x00007FFBCF8C0000-0x00007FFBD050E000-memory.dmp
                              Download

                              memory/2292-8351-0x00007FFBCF770000-0x00007FFBCF8B4000-memory.dmp
                              Download

                              memory/2292-8350-0x00007FFBCEE70000-0x00007FFBCF3FE000-memory.dmp
                              Download

                              memory/2292-8348-0x00007FF70FB40000-0x00007FF70FEEE000-memory.dmp
                              Download

                              memory/2896-0-0x0000000000400000-0x000000000041F000-memory.dmp
                              Download

                              memory/2896-51-0x0000000000400000-0x000000000041F000-memory.dmp
                              Download

                              memory/3096-518-0x00007FFBD0F30000-0x00007FFBD14BE000-memory.dmp
                              Download

                              memory/3096-7389-0x000002CC45A00000-0x000002CC45FB8000-memory.dmp
                              Download

                              memory/3096-8197-0x000002CC45A00000-0x000002CC45FB8000-memory.dmp
                              Download

                              memory/3096-8423-0x000002CC45A00000-0x000002CC45FB8000-memory.dmp
                              Download

                              memory/3096-1795-0x000002CC45A00000-0x000002CC45FB8000-memory.dmp
                              Download

                              memory/3096-7791-0x000002CC45A00000-0x000002CC45FB8000-memory.dmp
                              Download

                              memory/3452-49-0x0000000000400000-0x000000000041F000-memory.dmp
                              Download

                              memory/5564-7759-0x0000000000400000-0x000000000041F000-memory.dmp
                              Download

                              memory/5676-50-0x0000000000400000-0x000000000041F000-memory.dmp
                              Download

                              memory/5888-48-0x0000000000400000-0x000000000041F000-memory.dmp
                              Download

                              memory/6264-8276-0x00007FFBCF8C0000-0x00007FFBD050E000-memory.dmp
                              Download

                              memory/6264-8278-0x00007FF70FB40000-0x00007FF70FEEE000-memory.dmp
                              Download

                              memory/6264-8323-0x00007FFBC6040000-0x00007FFBC7AD7000-memory.dmp
                              Download

                              memory/6264-8324-0x00007FFBC8A70000-0x00007FFBC9489000-memory.dmp
                              Download

                              memory/6264-8296-0x00007FFBCB510000-0x00007FFBCD210000-memory.dmp
                              Download

                              memory/6264-8277-0x00007FFBCEE70000-0x00007FFBCF3FE000-memory.dmp
                              Download

                              memory/6264-8275-0x00007FFBCF770000-0x00007FFBCF8B4000-memory.dmp
                              Download

                              memory/13728-8201-0x00007FFBB2DE0000-0x00007FFBB2DF0000-memory.dmp
                              Download

                              memory/13728-8195-0x00007FF70FB40000-0x00007FF70FEEE000-memory.dmp
                              Download

                              memory/13728-8192-0x00007FFBD0050000-0x00007FFBD0194000-memory.dmp
                              Download

                              memory/13728-8193-0x00007FFBCEDE0000-0x00007FFBCF36E000-memory.dmp
                              Download

                              memory/13728-8194-0x00007FFBCF400000-0x00007FFBD004E000-memory.dmp
                              Download

                              memory/13728-8196-0x00007FFBB44E0000-0x00007FFBB44F0000-memory.dmp
                              Download

                              memory/13728-8200-0x00007FFBB2DE0000-0x00007FFBB2DF0000-memory.dmp
                              Download

                              memory/13728-8202-0x00007FFBB2DE0000-0x00007FFBB2DF0000-memory.dmp
                              Download

                              memory/13728-8198-0x00007FFBB2DE0000-0x00007FFBB2DF0000-memory.dmp
                              Download

                              memory/13728-8207-0x00007FFBB2DE0000-0x00007FFBB2DF0000-memory.dmp
                              Download

                              memory/13728-8206-0x00007FFBB2DE0000-0x00007FFBB2DF0000-memory.dmp
                              Download

                              memory/13728-8205-0x00007FFBB2DE0000-0x00007FFBB2DF0000-memory.dmp
                              Download

                              memory/13728-8204-0x00007FFBB2DE0000-0x00007FFBB2DF0000-memory.dmp
                              Download

                              memory/13728-8203-0x00007FFBB2DE0000-0x00007FFBB2DF0000-memory.dmp
                              Download

                              memory/13728-8199-0x00007FFBB2DE0000-0x00007FFBB2DF0000-memory.dmp
                              Download

                              memory/15084-8222-0x00007FFBCF8C0000-0x00007FFBD050E000-memory.dmp
                              Download

                              memory/15084-8224-0x00007FFBCEE70000-0x00007FFBCF3FE000-memory.dmp
                              Download

                              memory/15084-8223-0x00007FFBCF770000-0x00007FFBCF8B4000-memory.dmp
                              Download

                              memory/15084-8225-0x00007FF70FB40000-0x00007FF70FEEE000-memory.dmp
                              Download

                              memory/15084-8240-0x00007FFBCB510000-0x00007FFBCD210000-memory.dmp
                              Download

                              memory/15292-8254-0x00007FFBCF8C0000-0x00007FFBD050E000-memory.dmp
                              Download

                              memory/15292-8255-0x00007FFBCF770000-0x00007FFBCF8B4000-memory.dmp
                              Download

                              memory/15292-8253-0x00007FF70FB40000-0x00007FF70FEEE000-memory.dmp
                              Download

                              memory/15292-8370-0x00007FFBC6040000-0x00007FFBC7AD7000-memory.dmp
                              Download

                              memory/15292-8371-0x00007FFBC8A70000-0x00007FFBC9489000-memory.dmp
                              Download

                              memory/15292-8256-0x00007FFBCEE70000-0x00007FFBCF3FE000-memory.dmp
                              Download

                              memory/15292-8290-0x00007FFBCB510000-0x00007FFBCD210000-memory.dmp
                              Download

                              memory/18340-8305-0x00007FFBCF8C0000-0x00007FFBD050E000-memory.dmp
                              Download

                              memory/18340-8307-0x00007FFBCEE70000-0x00007FFBCF3FE000-memory.dmp
                              Download

                              memory/18340-8304-0x00007FF70FB40000-0x00007FF70FEEE000-memory.dmp
                              Download

                              memory/18340-8322-0x00007FFBCB510000-0x00007FFBCD210000-memory.dmp
                              Download

                              memory/18340-8306-0x00007FFBCF770000-0x00007FFBCF8B4000-memory.dmp
                              Download

                              memory/20000-8460-0x00007FFBCEE70000-0x00007FFBCF3FE000-memory.dmp
                              Download

                              memory/20000-8461-0x00007FFBCF8C0000-0x00007FFBD050E000-memory.dmp
                              Download

                              memory/20020-8447-0x00007FFBCF770000-0x00007FFBCF8B4000-memory.dmp
                              Download

                              memory/20020-8448-0x00007FFBCEE70000-0x00007FFBCF3FE000-memory.dmp
                              Download

                              memory/20020-8446-0x00007FFBCF8C0000-0x00007FFBD050E000-memory.dmp
                              Download

                              memory/20020-8435-0x00007FF70FB40000-0x00007FF70FEEE000-memory.dmp
                              Download