Overview

overview

7

Static

static

3

2026-08-01...ca.exe

windows10-2004-x64

7

2026-08-01...ca.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    87s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/08/2026, 17:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_0c155275ff2352403721bd9c5b5851c3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
  • Size 5.7MB
  • Sample260801-v6vlbasdrg
  • SHA256 9e0e9ab067a145442180c535628bca69490dcf58dc730a47da1dcea6d8e9fe32
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdefense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 13 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 40 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_0c155275ff2352403721bd9c5b5851c3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_0c155275ff2352403721bd9c5b5851c3_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5808
    • C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
      "C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      PID:4560
      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -checkInstallEnvironment
        3⤵
          PID:2480
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      PID:5616
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:6040
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:4892
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:1788
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:1940
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:5400
    • C:\Windows\System32\ReFsDedupSvc.exe
      C:\Windows\System32\ReFsDedupSvc.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2320
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks SCSI registry key(s)
      PID:2540
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:3408
    • C:\Windows\system32\AgentService.exe
      C:\Windows\system32\AgentService.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3284
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:580
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
        2⤵
          PID:4884
        • C:\Windows\System32\SearchProtocolHost.exe
          "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:1604
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2896 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
          2⤵
            PID:956
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
            2⤵
            • Modifies data under HKEY_USERS
            PID:3112
          • C:\Windows\System32\SearchProtocolHost.exe
            "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
              PID:5160
            • C:\Windows\System32\SearchFilterHost.exe
              "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
              2⤵
                PID:4364
              • C:\Windows\System32\SearchFilterHost.exe
                "C:\Windows\System32\SearchFilterHost.exe" 944 2896 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
                2⤵
                  PID:1532
              • C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
                "C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5A65A1 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\
                1⤵
                • Executes dropped EXE
                • Writes to the Master Boot Record (MBR)
                • Suspicious behavior: EnumeratesProcesses
                PID:4896
                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -setlng en_US
                  2⤵
                    PID:4156
                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -getonlineparam 00601.00001304 -forceperusermode
                    2⤵
                      PID:1752
                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -getabtest -forceperusermode
                      2⤵
                        PID:5836
                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -fixoldversionassostatus
                        2⤵
                          PID:5540

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            elevation_service.exe
                            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                            • Size 2.7MB
                            • SHA256 26b6d53e82c563913f153bcad3069b581b9045e23956c0d9b3c1ad1be3d73fe8
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            maintenanceservice.exe
                            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                            • Size 1.4MB
                            • SHA256 d1036dc107bf81634f8fbb175ef83529a8fcf22cac6d31579353dd183aefc9c6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            7z.exe
                            • Path C:\Program Files\7-Zip\7z.exe
                            • Size 1.7MB
                            • SHA256 1a6ef91fcf351736005cf822de4d84aee2dbfe437867540e1feb640ebf5b383b
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            7zFM.exe
                            • Path C:\Program Files\7-Zip\7zFM.exe
                            • Size 1.5MB
                            • SHA256 d6ea6eb65fe0b46461bf443b814e5503188efc2632a077d8b9cfd6dd3791bfc5
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            OSE.EXE
                            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                            • Size 1.4MB
                            • SHA256 05d7ad9f256e44e6856a8719163a6695eaeafce66b5676fdb26dfc465db39412
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            elevation_service.exe
                            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                            • Size 2.8MB
                            • SHA256 a74361aa18ecdb5f76a94561b07b538a6ca2b6c37cd8fdb05c109ec38d99c4f9
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            MsSense.exe
                            • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                            • Size 1.6MB
                            • SHA256 cb66ce078200b7cdc22106a63e145616db76590559c460c947fc6ebf49c2fc61
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            NisSrv.exe
                            • Path C:\Program Files\Windows Defender\NisSrv.exe
                            • Size 3.5MB
                            • SHA256 7d72ca5a612ad56ffb647e7f0ba41ff00bafd656b6b9d65700c9e7819ea53441
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            wmpnetwk.exe
                            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                            • Size 1.4MB
                            • SHA256 c91768af55022d244ef49e2430e151cb7f8bbc356177ec9befccc46d6985f945
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                            • Size 471B
                            • SHA256 66e27071f86fed925ac117f85b2fde1dd8d2f3282a6375b4aec2375ba84c4587
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                            • Size 727B
                            • SHA256 952ac1d69ee6733c57c20f9e2221a925976b7fc03c6dd017b6726b3653d0b864
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                            • Size 727B
                            • SHA256 7f440831c5281e43c4f018985666168b7917cdf4e9551a345615b37c0c1cc43c
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                            • Size 400B
                            • SHA256 d3256f78f24c53df47144ec437cb01cea40fefe0c3806ba64af1589fc3af4030
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
                            • Size 404B
                            • SHA256 a76bd03fd0352351014fb90fe21d44f3974cecec7074deb4345a7671b76b11f1
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                            • Size 412B
                            • SHA256 ed8badb1708e271c425adb1fb3d36e4ff9d27a80305a24872b4e5416d59b360a
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            logo-small.png
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\StartScreenTile\ksolaunch\logo-small.png
                            • Size 6KB
                            • SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            logo.png
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\StartScreenTile\ksolaunch\logo.png
                            • Size 12KB
                            • SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Everything-KingSoft-Read-Only.ini
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\everythingsearch\everythingbinary\Everything-KingSoft-Read-Only.ini
                            • Size 404B
                            • SHA256 b5980cd1122d2ad4727bc06806e3d2a6598b7d67b6eb3d2732938d08c6deedbb
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            run.ini
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\karticlewebcloudsummary\mui\dist\run.ini
                            • Size 171B
                            • SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            kcoworkdockpanel.qm
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kcoworkdockpanel\mui\es_MX\kcoworkdockpanel.qm
                            • Size 846B
                            • SHA256 8f0de81b05e2ce8a22432406009084933f0cf410e6efb534aafd71699651120c
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            kcoworkdockpanel.qm
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kcoworkdockpanel\mui\vi_VN\kcoworkdockpanel.qm
                            • Size 839B
                            • SHA256 ad5549bf1c748909f191eba6e08caccfb31dbe1a2ce4bfafcb1e41702f40c95f
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            index.html
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kpdfcorporateglossary\res\dist\index.html
                            • Size 636B
                            • SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            index.js
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kpdfcorporateglossary\res\dist\index.js
                            • Size 2KB
                            • SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            errPage.html
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
                            • Size 7KB
                            • SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            favicon.ico
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
                            • Size 4KB
                            • SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            run.ini
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebpromehelp\run.ini
                            • Size 226B
                            • SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            close-secondary.svg
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
                            • Size 216B
                            • SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            kwpsaibasetypo.qm
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
                            • Size 334B
                            • SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
                            • MD5 SHA1 SHA512
                            Submit Download

                            kwpsaibasetypo.qm
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
                            • Size 327B
                            • SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
                            • MD5 SHA1 SHA512
                            Submit Download

                            element-icons.ttf
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
                            • Size 54KB
                            • SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            element-icons.woff
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
                            • Size 27KB
                            • SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            app.css
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
                            • Size 107KB
                            • SHA256 907d1f5ee046fae72b52eaf99508ddb6b48d47b803076db0e9a86b0e21a54ba9
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            chunk-vendors.css
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
                            • Size 279KB
                            • SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            app.js
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
                            • Size 380KB
                            • SHA256 fd9dcbe72da3477714bf68b8987db4718e4be32f313d09bfefbd4d78aa051a84
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            chunk-vendors.js
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
                            • Size 249KB
                            • SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            chunk-vendors.js
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
                            • Size 424KB
                            • SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            index.js
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
                            • Size 10KB
                            • SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            index.js
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
                            • Size 13KB
                            • SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            index.js
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
                            • Size 14KB
                            • SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            apm-init.js
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
                            • Size 57B
                            • SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            default_ava.svg
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
                            • Size 906B
                            • SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            desk-sync.svg
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
                            • Size 1KB
                            • SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            loading.svg
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
                            • Size 1KB
                            • SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            setup.cfg
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\cfgs\setup.cfg
                            • Size 449B
                            • SHA256 45a9cbbacd1a5a9ef690f4b0d8978d908cf12fc423254b3b591b00a7231aa5bd
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            ksomisc.exe
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
                            • Size 3.7MB
                            • SHA256 9555ca85ef085b11d92dd2fa4c901d4fa3c72865df5e7a6bfeee6cc7c8a8f3b0
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            error-net-72.png
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
                            • Size 1KB
                            • SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            presetLayout_16.pptx
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
                            • Size 41KB
                            • SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            wpscloudsvr.exe
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\wpscloudsvr.exe
                            • Size 527KB
                            • SHA256 61197b53e1ba3b46a39dc7d302fc26beabb6d665f6e635f122a84b2a332af69e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            install.ini
                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\utility\install.ini
                            • Size 462B
                            • SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Qt5CoreKso.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\CONTROL\office6\Qt5CoreKso.dll
                            • Size 5.7MB
                            • SHA256 d76ce35aa1a6d2d9ee025bbb2e8743c401039cd4161058dc4f379588057a5b94
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Qt5GuiKso.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\CONTROL\office6\Qt5GuiKso.dll
                            • Size 6.4MB
                            • SHA256 c3a2de3161f7cc03dccd2c375cb10aeda109069c13689c105ba161f39c2a35d4
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Qt5SvgKso.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\CONTROL\office6\Qt5SvgKso.dll
                            • Size 503KB
                            • SHA256 bc68fc65d3620fd0e31e625ac359ce68d0c26bc45f68d5ada1e4cb4df9852978
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Qt5WidgetsKso.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\CONTROL\office6\Qt5WidgetsKso.dll
                            • Size 5.6MB
                            • SHA256 70eeb2b38bd9e4b17d49e62a1a8c5040a0ba309205224d500a89b20480ff4886
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Qt5WinExtrasKso.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\CONTROL\office6\Qt5WinExtrasKso.dll
                            • Size 251KB
                            • SHA256 5f55c44db9c677781b79f5c0527fc5ec81dad8e4fbfac6076a45f1d0d747e24e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            kpacketui.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\CONTROL\office6\kpacketui.dll
                            • Size 836KB
                            • SHA256 e0db71f3a34e740fad2e39f52a63272340d3bb719e2f60294bf0520fa3cf6dae
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            msvcp140.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\CONTROL\office6\msvcp140.dll
                            • Size 544KB
                            • SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            qsvgicon.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
                            • Size 75KB
                            • SHA256 dcf5212ec3fe7746f8b26a504687be3bb29954294b7f448c4940b413fb04c527
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            qsvg.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
                            • Size 46KB
                            • SHA256 524e279aa876ea45ac1205c4f4210c226aded2298d96b4ba46f3e7c4faec499a
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            qskia.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\CONTROL\office6\qt\plugins\platforms\qskia.dll
                            • Size 1.9MB
                            • SHA256 6daafb39daca277e272ba56a115eed0235b45d5d820fa9b315f78005e048e6e6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            qwindows.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\CONTROL\office6\qt\plugins\platforms\qwindows.dll
                            • Size 1.6MB
                            • SHA256 8a87eb5fad6e90294115e7b3df56971dd278a48456344b4bf2ea15a3055c56af
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            qwindowsvistastyle.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
                            • Size 159KB
                            • SHA256 a4c3bb047f8d6d9240d5b020de80ee53585ed5029fec341ce2bab300b615a586
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ucrtbase.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\CONTROL\office6\ucrtbase.dll
                            • Size 987KB
                            • SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            vcruntime140.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\CONTROL\office6\vcruntime140.dll
                            • Size 121KB
                            • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            vcruntime140_1.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\CONTROL\office6\vcruntime140_1.dll
                            • Size 48KB
                            • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            style.xml
                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\CONTROL\pl_PL\style.xml
                            • Size 3KB
                            • SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            product.dat
                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\CONTROL\product.dat
                            • Size 97KB
                            • SHA256 2e844013324b6d0b45e0f68706c289221de46dcb231c45a52cdbfce80bcac54c
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            product_new.dat
                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\CONTROL\product_new.dat
                            • Size 83KB
                            • SHA256 53a97ea8fd5bde7018db62835a7aaf4ec5689e175224e7cdb18bf070357de113
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            style.xml
                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a5fe4\CONTROL\vi_VN\style.xml
                            • Size 4KB
                            • SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            tempinstall.ini
                            • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                            • Size 387B
                            • SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            tempinstall.ini
                            • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                            • Size 433B
                            • SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            ksomisc_2026_08_01.log
                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_08_01.log
                            • Size 3KB
                            • SHA256 87f58f6e96d9b322fab9beb0b37e3e95ba881f962f622dbf5215612367a4b1da
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            ksomisc_2026_08_01.log
                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_08_01.log
                            • Size 5KB
                            • SHA256 5c6b9e06d48b3ad27d09405ac841bb23679d0de2a870a8bc22ebaf805dd813ff
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            wpssetup.log
                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                            • Size 10KB
                            • SHA256 1fef040dcf10a1723e83c19dbc9e33c7f631e06a49211d01c08deacbc78cd580
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            wpssetup.log
                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                            • Size 11KB
                            • SHA256 98b6860b93c9c5d7f212645acbe43987cc72f4ae65a0a8e82a4e7d3fd7dd3a18
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            wpssetup.log
                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                            • Size 27KB
                            • SHA256 32c806f5e1d82193235ba362210fbd7d2512db278d3520112a9819200f9adbb2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            wpssetup.log
                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                            • Size 61KB
                            • SHA256 b11147d652ca68484233aabf065a3fca1fcf7c2c791474f3abf353147cf18fe6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            dcsdk_dpv3.data
                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
                            • Size 41KB
                            • SHA256 311b70370bf1df44607e3278aad3ff149d0cae01e24b9524994de44eeda2b8f6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            dcsdk_dpv3.data
                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
                            • Size 43KB
                            • SHA256 472a08ee3f4357036e7001f3e25c86314d26a68cd3a81687cc6d407f0da19030
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            perfhost.exe
                            • Path C:\Windows\SysWOW64\perfhost.exe
                            • Size 1.2MB
                            • SHA256 43f9fb28530b7f4c0ce712cc0be50db359455561e3b3252a4c030544d6e40c25
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            AgentService.exe
                            • Path C:\Windows\System32\AgentService.exe
                            • Size 1.4MB
                            • SHA256 34adcf8ee631fdc25a1703086c38e74cebee6767b005cf11451662967d60c871
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ssh-agent.exe
                            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                            • Size 1.7MB
                            • SHA256 f856d8d271a4d57b0aab7224b04fce9d6c92c03c41ba540449e7b62a9eb6530e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ReFsDedupSvc.exe
                            • Path C:\Windows\System32\ReFsDedupSvc.exe
                            • Size 2.6MB
                            • SHA256 00fdaa15ff4a8c8c650e820efd8d74d286035243f82a3b5c50b823c9af44cda6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            SearchIndexer.exe
                            • Path C:\Windows\System32\SearchIndexer.exe
                            • Size 1.4MB
                            • SHA256 9c09f280d1fade3364f9e57ca244e8d7e1fe4c2faad57338dde13734f917ec12
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            SensorDataService.exe
                            • Path C:\Windows\System32\SensorDataService.exe
                            • Size 1.7MB
                            • SHA256 002d896657d429a1520d775dcff2ac5c6db3c817a83b9e080057d3efd8a823fd
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            AppVClient.exe
                            • Path C:\Windows\system32\AppVClient.exe
                            • Size 1.3MB
                            • SHA256 1f88c4f06963a2be07c82e2172e4f5bf5091c1e43ae2cadf973eac3956bd17d1
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            PerceptionSimulationService.exe
                            • Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                            • Size 1.4MB
                            • SHA256 5943d0bf5007241f116fea97ce04ab5c00aba3c6d8a59821c51af39582cb5264
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            SgrmBroker.exe
                            • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                            • Size 1.6MB
                            • SHA256 c194758aa31d02d63add7e6b8b3e8f7c05871616ef7257d78fc67dbd360a98c8
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            memory/580-142-0x0000000000620000-0x0000000000680000-memory.dmp
                            Download

                            memory/580-307-0x0000000140000000-0x0000000140172000-memory.dmp
                            Download

                            memory/580-136-0x0000000000620000-0x0000000000680000-memory.dmp
                            Download

                            memory/580-135-0x0000000140000000-0x0000000140172000-memory.dmp
                            Download

                            memory/1752-9510-0x00007FFCB6940000-0x00007FFCB6950000-memory.dmp
                            Download

                            memory/1752-9505-0x00007FFCB6940000-0x00007FFCB6950000-memory.dmp
                            Download

                            memory/1752-9501-0x00007FFCCE1C0000-0x00007FFCCEC2D000-memory.dmp
                            Download

                            memory/1752-9499-0x00007FFCD4060000-0x00007FFCD41A5000-memory.dmp
                            Download

                            memory/1752-9497-0x00007FF6630D0000-0x00007FF663491000-memory.dmp
                            Download

                            memory/1752-9511-0x00007FFCB6940000-0x00007FFCB6950000-memory.dmp
                            Download

                            memory/1752-9500-0x00007FFCCFA20000-0x00007FFCCFFAE000-memory.dmp
                            Download

                            memory/1752-9498-0x00007FFCD41B0000-0x00007FFCD4E20000-memory.dmp
                            Download

                            memory/1752-9509-0x00007FFCB6940000-0x00007FFCB6950000-memory.dmp
                            Download

                            memory/1752-9508-0x00007FFCB6940000-0x00007FFCB6950000-memory.dmp
                            Download

                            memory/1752-9507-0x00007FFCB6940000-0x00007FFCB6950000-memory.dmp
                            Download

                            memory/1752-9506-0x00007FFCB6940000-0x00007FFCB6950000-memory.dmp
                            Download

                            memory/1788-56-0x0000000000870000-0x00000000008D0000-memory.dmp
                            Download

                            memory/1788-173-0x0000000140000000-0x000000014020E000-memory.dmp
                            Download

                            memory/1788-49-0x0000000140000000-0x000000014020E000-memory.dmp
                            Download

                            memory/1788-50-0x0000000000870000-0x00000000008D0000-memory.dmp
                            Download

                            memory/1940-62-0x00000000007A0000-0x0000000000800000-memory.dmp
                            Download

                            memory/1940-201-0x0000000140000000-0x000000014020A000-memory.dmp
                            Download

                            memory/1940-60-0x0000000140000000-0x000000014020A000-memory.dmp
                            Download

                            memory/1940-68-0x00000000007A0000-0x0000000000800000-memory.dmp
                            Download

                            memory/2320-83-0x0000000000400000-0x0000000000460000-memory.dmp
                            Download

                            memory/2320-310-0x0000000000400000-0x0000000000460000-memory.dmp
                            Download

                            memory/2320-312-0x0000000140000000-0x00000001402C9000-memory.dmp
                            Download

                            memory/2320-260-0x0000000140000000-0x00000001402C9000-memory.dmp
                            Download

                            memory/2320-76-0x0000000140000000-0x00000001402C9000-memory.dmp
                            Download

                            memory/2320-77-0x0000000000400000-0x0000000000460000-memory.dmp
                            Download

                            memory/2480-9445-0x00007FFCB6940000-0x00007FFCB6950000-memory.dmp
                            Download

                            memory/2480-9437-0x00007FFCD3CF0000-0x00007FFCD4960000-memory.dmp
                            Download

                            memory/2480-9448-0x00007FFCB6940000-0x00007FFCB6950000-memory.dmp
                            Download

                            memory/2480-9450-0x00007FFCB6940000-0x00007FFCB6950000-memory.dmp
                            Download

                            memory/2480-9446-0x00007FFCB6940000-0x00007FFCB6950000-memory.dmp
                            Download

                            memory/2480-9439-0x00007FFCC8D40000-0x00007FFCCA866000-memory.dmp
                            Download

                            memory/2480-9440-0x00007FFCB78E0000-0x00007FFCB78F0000-memory.dmp
                            Download

                            memory/2480-9435-0x00007FFCC6F90000-0x00007FFCC8D3E000-memory.dmp
                            Download

                            memory/2480-9449-0x00007FFCB6940000-0x00007FFCB6950000-memory.dmp
                            Download

                            memory/2480-9438-0x00007FF6630D0000-0x00007FF663491000-memory.dmp
                            Download

                            memory/2480-9436-0x00007FFCCFEB0000-0x00007FFCD091D000-memory.dmp
                            Download

                            memory/2480-9434-0x00007FFCD0920000-0x00007FFCD0EAE000-memory.dmp
                            Download

                            memory/2480-9433-0x00007FFCD4CD0000-0x00007FFCD4E15000-memory.dmp
                            Download

                            memory/2480-9447-0x00007FFCB6940000-0x00007FFCB6950000-memory.dmp
                            Download

                            memory/2480-9444-0x00007FFCB6940000-0x00007FFCB6950000-memory.dmp
                            Download

                            memory/2480-9441-0x00007FFCB6940000-0x00007FFCB6950000-memory.dmp
                            Download

                            memory/2480-9442-0x00007FFCB6940000-0x00007FFCB6950000-memory.dmp
                            Download

                            memory/2480-9443-0x00007FFCB6940000-0x00007FFCB6950000-memory.dmp
                            Download

                            memory/2540-89-0x0000000000790000-0x00000000007F0000-memory.dmp
                            Download

                            memory/2540-95-0x0000000000790000-0x00000000007F0000-memory.dmp
                            Download

                            memory/2540-291-0x0000000000790000-0x00000000007F0000-memory.dmp
                            Download

                            memory/2540-293-0x0000000140000000-0x00000001401BA000-memory.dmp
                            Download

                            memory/2540-88-0x0000000140000000-0x00000001401BA000-memory.dmp
                            Download

                            memory/2540-274-0x0000000140000000-0x00000001401BA000-memory.dmp
                            Download

                            memory/3284-125-0x0000000000730000-0x0000000000790000-memory.dmp
                            Download

                            memory/3284-130-0x0000000000730000-0x0000000000790000-memory.dmp
                            Download

                            memory/3284-117-0x0000000140000000-0x0000000140168000-memory.dmp
                            Download

                            memory/3284-119-0x0000000000730000-0x0000000000790000-memory.dmp
                            Download

                            memory/3284-132-0x0000000140000000-0x0000000140168000-memory.dmp
                            Download

                            memory/3408-103-0x0000000000CF0000-0x0000000000D50000-memory.dmp
                            Download

                            memory/3408-110-0x0000000000CF0000-0x0000000000D50000-memory.dmp
                            Download

                            memory/3408-281-0x0000000140000000-0x000000014027D000-memory.dmp
                            Download

                            memory/3408-101-0x0000000140000000-0x000000014027D000-memory.dmp
                            Download

                            memory/4156-9466-0x00007FFCD4060000-0x00007FFCD41A5000-memory.dmp
                            Download

                            memory/4156-9468-0x00007FF6630D0000-0x00007FF663491000-memory.dmp
                            Download

                            memory/4156-9470-0x00007FFCC8AC0000-0x00007FFCCA86E000-memory.dmp
                            Download

                            memory/4156-9469-0x00007FFCCFFB0000-0x00007FFCD1AD6000-memory.dmp
                            Download

                            memory/4156-9467-0x00007FFCCFA20000-0x00007FFCCFFAE000-memory.dmp
                            Download

                            memory/4156-9465-0x00007FFCD41B0000-0x00007FFCD4E20000-memory.dmp
                            Download

                            memory/4156-9471-0x00007FFCCE1C0000-0x00007FFCCEC2D000-memory.dmp
                            Download

                            memory/4560-804-0x00007FFCD32E0000-0x00007FFCD386E000-memory.dmp
                            Download

                            memory/4892-45-0x0000000001B90000-0x0000000001BF0000-memory.dmp
                            Download

                            memory/4892-39-0x0000000001B90000-0x0000000001BF0000-memory.dmp
                            Download

                            memory/4892-115-0x0000000140000000-0x0000000140214000-memory.dmp
                            Download

                            memory/4892-112-0x0000000001B90000-0x0000000001BF0000-memory.dmp
                            Download

                            memory/4892-38-0x0000000140000000-0x0000000140214000-memory.dmp
                            Download

                            memory/5400-233-0x0000000000400000-0x00000000005D6000-memory.dmp
                            Download

                            memory/5400-73-0x0000000000400000-0x00000000005D6000-memory.dmp
                            Download

                            memory/5616-21-0x0000000000880000-0x00000000008E0000-memory.dmp
                            Download

                            memory/5616-22-0x0000000000880000-0x00000000008E0000-memory.dmp
                            Download

                            memory/5616-15-0x0000000000880000-0x00000000008E0000-memory.dmp
                            Download

                            memory/5616-14-0x0000000140000000-0x00000001402E9000-memory.dmp
                            Download

                            memory/5616-100-0x0000000140000000-0x00000001402E9000-memory.dmp
                            Download

                            memory/5808-0-0x0000000000B20000-0x0000000000B87000-memory.dmp
                            Download

                            memory/5808-6-0x0000000000B20000-0x0000000000B87000-memory.dmp
                            Download

                            memory/5808-72-0x0000000000400000-0x00000000009C1000-memory.dmp
                            Download

                            memory/5808-5-0x0000000000400000-0x00000000009C1000-memory.dmp
                            Download

                            memory/6040-34-0x00000000006E0000-0x0000000000740000-memory.dmp
                            Download

                            memory/6040-30-0x00000000006E0000-0x0000000000740000-memory.dmp
                            Download

                            memory/6040-27-0x0000000140000000-0x00000001402D4000-memory.dmp
                            Download

                            memory/6040-134-0x0000000140000000-0x00000001402D4000-memory.dmp
                            Download