Overview

overview

7

Static

static

3

2026-08-02...ca.exe

windows10-2004-x64

7

2026-08-02...ca.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    130s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 08:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_543edff963e53523148c836f6015d99c_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
  • Size 6.1MB
  • Sample260802-kl4ndafg59
  • SHA256 c70d3b7dbc61e560134a7dc0f97a2748930d894eccef88c6045913da77896b89
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarebootkitdefense_evasiondiscoverypersistenceprivilege_escalationspywaretrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 64 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_543edff963e53523148c836f6015d99c_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_543edff963e53523148c836f6015d99c_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"
    1⤵
    • Checks computer location settings
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\ProgramData\WPS\Installers\724493adb267049b3ff521cc24bc725f_setup_XA_mui_12.9.0.21549_Free.exe.601.1161.exe
      "C:\ProgramData\WPS\Installers\724493adb267049b3ff521cc24bc725f_setup_XA_mui_12.9.0.21549_Free.exe.601.1161.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4296
      • C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe
        "C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" InstallService
        3⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        PID:2680
      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -regmtfont
        3⤵
          PID:3076
        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\\office6\ksomisc.exe" -setappcap
          3⤵
            PID:4604
          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -sendinstalldyn 5
            3⤵
              PID:3400
            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\\office6\ksomisc.exe" -assoepub -source=1
              3⤵
                PID:4780
              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\\office6\ksomisc.exe" -registerqingshellext 1
                3⤵
                  PID:4684
            • C:\ProgramData\WPS\Installers\724493adb267049b3ff521cc24bc725f_setup_XA_mui_12.9.0.21549_Free.exe.601.1161.exe
              "C:\ProgramData\WPS\Installers\724493adb267049b3ff521cc24bc725f_setup_XA_mui_12.9.0.21549_Free.exe.601.1161.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E598207 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\
              1⤵
              • Executes dropped EXE
              • Writes to the Master Boot Record (MBR)
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1196
              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -setlng en_US
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Modifies system certificate store
                • Suspicious behavior: AddClipboardFormatListener
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:3132
              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -getonlineparam 00601.00001161 -forceperusermode
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Writes to the Master Boot Record (MBR)
                • System Location Discovery: System Language Discovery
                • Modifies system certificate store
                • Suspicious behavior: AddClipboardFormatListener
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:1280
              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -getabtest -forceperusermode
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies system certificate store
                • Suspicious behavior: AddClipboardFormatListener
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:4656
              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -setservers
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: AddClipboardFormatListener
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:1864
              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -register
                2⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious behavior: AddClipboardFormatListener
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:2368
                • C:\Windows\SysWOW64\regsvr32.exe
                  "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\kmso2pdfplugins.dll"
                  3⤵
                    PID:636
                  • C:\Windows\SysWOW64\regsvr32.exe
                    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\kmso2pdfplugins64.dll"
                    3⤵
                      PID:1084
                      • C:\Windows\system32\regsvr32.exe
                        /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\kmso2pdfplugins64.dll"
                        4⤵
                          PID:3780
                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -assoword
                      2⤵
                        PID:4872
                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -assoexcel
                        2⤵
                          PID:5088
                        • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                          "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -assopowerpnt
                          2⤵
                            PID:936
                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -compatiblemso -source=1
                            2⤵
                              PID:2556
                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -checkcompatiblemso
                              2⤵
                                PID:3384
                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -saveas_mso
                                2⤵
                                  PID:3224
                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -distsrc 00601.00001161
                                  2⤵
                                    PID:3240
                                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode
                                    2⤵
                                      PID:8
                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\pinTaskbar.exe
                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk" 5386
                                        3⤵
                                          PID:1468
                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -externaltask create -forceperusermode
                                        2⤵
                                          PID:4776
                                          • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\wps.exe
                                            "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\wps.exe" Run "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\addons\ktaskschdtool\ktaskschdtool.dll" /task=wpsexternal /createtask
                                            3⤵
                                              PID:768
                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\wps.exe
                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\wps.exe" CheckService
                                                4⤵
                                                  PID:2104
                                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\wps.exe
                                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\wps.exe" Run -User=Admin -Entry=EntryPoint "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.9.0.21555/office6/addons/ktaskschdtool/ktaskschdtool.dll" /user=Admin /task=wpsexternal /cleantask /pid=768 /prv
                                                  4⤵
                                                    PID:772
                                              • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                                                "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -createsubmodulelink startmenu prometheus
                                                2⤵
                                                  PID:3224
                                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -createsubmodulelink startmenu pdf
                                                  2⤵
                                                    PID:1404
                                                  • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                                                    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -createsubmodulelink desktop pdf
                                                    2⤵
                                                      PID:1704
                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -createsubmodulelink desktop prometheus
                                                      2⤵
                                                        PID:3940
                                                      • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                                                        "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -createCustomDestList
                                                        2⤵
                                                          PID:2488
                                                        • C:\Windows\SysWOW64\regsvr32.exe
                                                          "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\kwpsmenushellext64.dll"
                                                          2⤵
                                                            PID:3104
                                                            • C:\Windows\system32\regsvr32.exe
                                                              /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\kwpsmenushellext64.dll"
                                                              3⤵
                                                                PID:3512
                                                            • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                                                              "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe" -setup_assopdf -source=1
                                                              2⤵
                                                                PID:2452
                                                                • C:\Windows\SysWOW64\openwith.exe
                                                                  "C:\Windows\SysWOW64\openwith.exe"
                                                                  3⤵
                                                                    PID:1088
                                                                • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\wpsupdate.exe
                                                                  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\wpsupdate.exe" /from:setup
                                                                  2⤵
                                                                    PID:4520
                                                                    • C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe
                                                                      "C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" CheckService
                                                                      3⤵
                                                                        PID:2632
                                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\wpsupdate.exe
                                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\wpsupdate.exe" -createtask
                                                                      2⤵
                                                                        PID:4332
                                                                    • C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe
                                                                      "C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" LocalService
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3224
                                                                    • C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\wpscloudsvr.exe
                                                                      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\wpscloudsvr.exe"
                                                                      1⤵
                                                                        PID:4740

                                                                      Network

                                                                            MITRE ATT&CK Enterprise v16

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                            • Size 471B
                                                                            • SHA256 fe97c3f89c4204d7aff528addbb02355efdcc9cbc71158f75570cf9e664fa0f6
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            8EC9B1D0ABBD7F98B401D425828828CE_660CACFBF957CBCC19C054A0402E41C3
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_660CACFBF957CBCC19C054A0402E41C3
                                                                            • Size 727B
                                                                            • SHA256 81ff4f43f3528dc0b04b7d80a49a57c85617ef57aab41eff7dd9d36b83e556cf
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                            • Size 727B
                                                                            • SHA256 7f440831c5281e43c4f018985666168b7917cdf4e9551a345615b37c0c1cc43c
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                            • Size 400B
                                                                            • SHA256 3cd080ad025673c6412ed23fa0b7d1561059b915c75c4421b20cc70f0953a25f
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            8EC9B1D0ABBD7F98B401D425828828CE_660CACFBF957CBCC19C054A0402E41C3
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_660CACFBF957CBCC19C054A0402E41C3
                                                                            • Size 404B
                                                                            • SHA256 af7e651f247bce0e2f53113541a3e6e2e87060eab2a622cb4eff0b983952cf3d
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                            • Size 412B
                                                                            • SHA256 be4640b5fb8ab876e575fbce1c490b3dea93df738e12a6578f5237775271ec2a
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            Qt5NetworkKso.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\Qt5NetworkKso.dll
                                                                            • Size 1.1MB
                                                                            • SHA256 3606498a2acb722a6162519c917bd83de51786fdca122b5342f200dc026d4758
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Qt5PrintSupportKso.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\Qt5PrintSupportKso.dll
                                                                            • Size 325KB
                                                                            • SHA256 a24bb5fc3045f5e00f52f0bd6c08b0763e558365f2b4248d768ba4e7d7034c52
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Qt5XmlKso.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\Qt5XmlKso.dll
                                                                            • Size 170KB
                                                                            • SHA256 d0b27892ae5003944e2af7859a1695b23be8eb0ed8e5640be05fcb5d4c582565
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            run.ini
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\addons\kstartpage\mui\default\productkey\html\run.ini
                                                                            • Size 171B
                                                                            • SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            kwppcopilotentry.qm
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\addons\kwppcopilotentry\mui\pt_BR\kwppcopilotentry.qm
                                                                            • Size 334B
                                                                            • SHA256 984ebeef80f6f50907afb92e5b5ae72df49fce045552c118a77a8887cc98e19b
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            history.js
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\addons\qing\mui\default_xa\res\clouddiskhomepage\static\js\default\history.js
                                                                            • Size 198KB
                                                                            • SHA256 632f2d1136280eaed004b7231ae90ed76bbd06c25f73d900873abc1c6ae71769
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            setup.cfg
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\cfgs\setup.cfg
                                                                            • Size 434B
                                                                            • SHA256 1c35e8cc33fc0ec5975d4b16233deb6c10de3237efc5fbdae0236286cdcebc19
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            dbghelp.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\dbghelp.dll
                                                                            • Size 1.2MB
                                                                            • SHA256 c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            kbase.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\kbase.dll
                                                                            • Size 193KB
                                                                            • SHA256 7317b4952d6d36d40ec7cb2b8b3c62c6c867986d5b1d5bfdb588b73f555bd2a3
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            krt.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\krt.dll
                                                                            • Size 1.2MB
                                                                            • SHA256 a163823354751850ce0a41b6fb9645c5e5c00ee1ae5817436f5f7584f0eb0a40
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            kshell.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\kshell.dll
                                                                            • Size 23.6MB
                                                                            • SHA256 fc753be922e9dbdfac868f4d518a865a7d59157f04364836f9be3076202b59d4
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            kso.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\kso.dll
                                                                            • Size 24.9MB
                                                                            • SHA256 6e88d1c7d0ab4e7221ceda0bb698a3021cc4c86ef6526047833711fd73e3a312
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            ksolite.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksolite.dll
                                                                            • Size 10.4MB
                                                                            • SHA256 d8f491383484c4d04f35335f3b5afd299a6d2710e66c925c14c8c2b7172c931b
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            ksomisc.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksomisc.exe
                                                                            • Size 3.3MB
                                                                            • SHA256 59da110563de13621b533d11497da0e9a113accbab979f12e35c44b9ac0f36ef
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            ksouil.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\ksouil.dll
                                                                            • Size 1.9MB
                                                                            • SHA256 1cacf89acb12d59aa2905ef4afc6164983d8e3efcf3e8346f5d7d73a6c07263a
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            ent_background_2019_wpsoffice.png
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\mui\ja_JP\resource\splash\hdpi\2x\ent_background_2019_wpsoffice.png
                                                                            • Size 236KB
                                                                            • SHA256 5e7ba996d2331f37b9799767c0fa806cab9a39fea434796ab08dcaf39096e334
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            windowsprintersupport.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\qt\plugins\printsupport\windowsprintersupport.dll
                                                                            • Size 71KB
                                                                            • SHA256 cbb6023c80df6901a4095aae79802a3b01d3813f00d792057f8665e687a92767
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            wpscloudsvr.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\office6\wpscloudsvr.exe
                                                                            • Size 923KB
                                                                            • SHA256 31c528140cc00dc4fa3dda5c897090ee6efc44b069fd8af9cd9933087732c05f
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            install.ini
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\utility\install.ini
                                                                            • Size 453B
                                                                            • SHA256 5336a497c7e2613cc14a6185d75224955ab2256b2cd6ea9153ebfc2245c1d736
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            install.ini
                                                                            • Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.9.0.21555\utility\install.ini
                                                                            • Size 499B
                                                                            • SHA256 ac4f26a184114522200169c5f57a0af4498a20d19b7ec6def14dd2c6413eb475
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            API-MS-Win-core-xstate-l2-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\API-MS-Win-core-xstate-l2-1-0.dll
                                                                            • Size 10KB
                                                                            • SHA256 144eb756de343fcb063034e9708cded52fe7f83ac3c94244a8de9baf95fe954a
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Qt5CoreKso.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\Qt5CoreKso.dll
                                                                            • Size 5.1MB
                                                                            • SHA256 f439479d4d5c92c4b61dc6170974f7dc5fb4b60c52970d481d526f3560bbfac0
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Qt5GuiKso.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\Qt5GuiKso.dll
                                                                            • Size 5.3MB
                                                                            • SHA256 04505182a6c27d451b4ef368fb790f3c57183e7f3d692abd96421f2ef7b05079
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Qt5SvgKso.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\Qt5SvgKso.dll
                                                                            • Size 392KB
                                                                            • SHA256 52ef87b1bc358dd1cf08bca05915e98a0c4e86feee565f40d6b518fc65302b44
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Qt5WidgetsKso.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\Qt5WidgetsKso.dll
                                                                            • Size 4.5MB
                                                                            • SHA256 0fc7689b019d8c71d33c9624e76c7890a8851a7c8d01de789ce78e166263ec35
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Qt5WinExtrasKso.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\Qt5WinExtrasKso.dll
                                                                            • Size 217KB
                                                                            • SHA256 048ed658567c60b191229ab9d0bcb8f3a1bf5fd55b935dc831c385255d9a821d
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-console-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-console-l1-1-0.dll
                                                                            • Size 11KB
                                                                            • SHA256 1c057286bdf0cb90f7dd1fecf5e8afbcff1e27f2a94612967c0634ae639ca43d
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-console-l1-2-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-console-l1-2-0.dll
                                                                            • Size 11KB
                                                                            • SHA256 73e4264dd66696163fbbf868729841f2e9b86f5a59912e64fb9718a8c889a7aa
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-datetime-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-datetime-l1-1-0.dll
                                                                            • Size 10KB
                                                                            • SHA256 7ea1c2902a47fcd4a30180a4fe5ba5800fcad76b63da5ca4494e24954cea9bd3
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-debug-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-debug-l1-1-0.dll
                                                                            • Size 10KB
                                                                            • SHA256 273516d86d92975ba14f0f85bdce5b81f75f8ba76e08e33575c67f34d7236775
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-errorhandling-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-errorhandling-l1-1-0.dll
                                                                            • Size 10KB
                                                                            • SHA256 be330de7aa8f2f33bcdabf0cec2551399b4ea0f22335a0277ea9c3a7aa405bdd
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-file-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-file-l1-1-0.dll
                                                                            • Size 14KB
                                                                            • SHA256 50347ffd660720cb1f41691be2793d00b169c864f7260dba1966a8ce5c9da943
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-file-l1-2-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-file-l1-2-0.dll
                                                                            • Size 11KB
                                                                            • SHA256 676a6da661e0c02e72bea510f5a48cae71fdc4da0b1b089c24bff87651ec0141
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-file-l2-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-file-l2-1-0.dll
                                                                            • Size 10KB
                                                                            • SHA256 24ea638dfa9f40e2f395e26e36d308db2ab25ed1baa5c796ac2c560ad4c89d77
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-handle-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-handle-l1-1-0.dll
                                                                            • Size 10KB
                                                                            • SHA256 9f2c87a8f541fd2e563778208c51f1e1852d4874571b6c5218066c0d58f9539c
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-heap-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-heap-l1-1-0.dll
                                                                            • Size 11KB
                                                                            • SHA256 2e9a683aa69db2f8186ce9ac3e6a610fc727390155668b2680a728a6e6c67247
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-interlocked-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-interlocked-l1-1-0.dll
                                                                            • Size 11KB
                                                                            • SHA256 96509b560bc604a30af26e08d6181d24dde1d51bf3654a12cd663a4ba1a11eac
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-libraryloader-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-libraryloader-l1-1-0.dll
                                                                            • Size 11KB
                                                                            • SHA256 f378ed4e0a68ca5fefff824912a5ec14992a6a8859e088a50a6df6d632611834
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-localization-l1-2-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-localization-l1-2-0.dll
                                                                            • Size 13KB
                                                                            • SHA256 5fbd69186f414d1d99ac61c9c15a57390ff21fe995e5c01f1c4e14510b6fb9b1
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-memory-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-memory-l1-1-0.dll
                                                                            • Size 11KB
                                                                            • SHA256 7733252eb66a1f3ce0efc5c375fadd6fa20a596324658c72d4e707f67909a433
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-namedpipe-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-namedpipe-l1-1-0.dll
                                                                            • Size 10KB
                                                                            • SHA256 04532aed545a391a9e95d6103a816ec5d26df14af51f51dd0c649ddd57862e5c
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-processenvironment-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-processenvironment-l1-1-0.dll
                                                                            • Size 11KB
                                                                            • SHA256 ed755e302cc2a9f5d3cc38140a90697c6bb24965acc6cdaddb63e95c3d2cb9bd
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-processthreads-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-processthreads-l1-1-0.dll
                                                                            • Size 13KB
                                                                            • SHA256 6d298ae58e7651d23b75a4f6cc070794e716574fe497105fb4ef727ce9782779
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-processthreads-l1-1-1.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-processthreads-l1-1-1.dll
                                                                            • Size 11KB
                                                                            • SHA256 6c27ac0542281649ec8638602fbc24f246424ba550564fc7b290b683f79e712d
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-profile-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-profile-l1-1-0.dll
                                                                            • Size 10KB
                                                                            • SHA256 a99b485112b305623ec3c8ea0d4c9acfac0c5c66821d4a98cde7b43edb8b78fc
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-rtlsupport-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-rtlsupport-l1-1-0.dll
                                                                            • Size 10KB
                                                                            • SHA256 a45a7143971e7f8bbe4d5667927e3ba0fe5d0c025ef5d776ff8a5826341a99cf
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-string-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-string-l1-1-0.dll
                                                                            • Size 10KB
                                                                            • SHA256 0c1cbbb4630d38632ed6a5bae9ba7e06fe19433f2a5bd548f3d73f315359d79e
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-synch-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-synch-l1-1-0.dll
                                                                            • Size 12KB
                                                                            • SHA256 cc39ce8fe4a38a80c7b316a7191bd319efd99f9f7cb5b97fe8c3d65d2e788070
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-synch-l1-2-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-synch-l1-2-0.dll
                                                                            • Size 11KB
                                                                            • SHA256 148adef6a34269e403bb509f9d5260abe52f413a6c268e8bd9869841d5f2bd02
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-sysinfo-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-sysinfo-l1-1-0.dll
                                                                            • Size 11KB
                                                                            • SHA256 328dff5738e59b78e2951920efcc69e97548c8081f4714540b4e723443b8feb4
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-timezone-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-timezone-l1-1-0.dll
                                                                            • Size 11KB
                                                                            • SHA256 64eccd818f6ffc13f57a2ec5ca358b401ffbb1ca13b0c523d479ef5ee9eb44ab
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-core-util-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-core-util-l1-1-0.dll
                                                                            • Size 10KB
                                                                            • SHA256 e4e4e55abf599d1a9ef7b95da0d7fd37f23a6cf1d368a77f88390eb2e0c1340d
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-crt-conio-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-crt-conio-l1-1-0.dll
                                                                            • Size 11KB
                                                                            • SHA256 3181c520d7ab831c8ff330afe15ad717a5a1ed85b5d91b50b838be1e5c96d052
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-crt-convert-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-crt-convert-l1-1-0.dll
                                                                            • Size 14KB
                                                                            • SHA256 02c78781bf6cc5f22a0ecedc3847bfd20bed4065ac028c386d063dc2318c33cc
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-crt-environment-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-crt-environment-l1-1-0.dll
                                                                            • Size 11KB
                                                                            • SHA256 d5164aecde4523ffa2dcfd0315b49428ac220013132ad48422a8ea4ca2361257
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-crt-filesystem-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-crt-filesystem-l1-1-0.dll
                                                                            • Size 12KB
                                                                            • SHA256 162ccf78fa5a4a2ee380f72fbd54d17a73c929a76f6e3659f537fa8f42602362
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-crt-heap-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-crt-heap-l1-1-0.dll
                                                                            • Size 11KB
                                                                            • SHA256 150d32b77b2d7f49c8d4f44b64a90d7a0f9df0874a80fc925daf298b038a8e4c
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-crt-locale-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-crt-locale-l1-1-0.dll
                                                                            • Size 11KB
                                                                            • SHA256 db495c7c4ad2072d09b2d4506b3a50f04487ad8b27d656685ea3fa5d9653a21d
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-crt-math-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-crt-math-l1-1-0.dll
                                                                            • Size 21KB
                                                                            • SHA256 f9ce464b89dd8ea1d5e0b852369fe3a8322b4b9860e5ae401c9a3b797aed17bf
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-crt-multibyte-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-crt-multibyte-l1-1-0.dll
                                                                            • Size 18KB
                                                                            • SHA256 50752719a62627e7a8d2c26970fe59af839692d060c009fd0652325362752659
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-crt-private-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-crt-private-l1-1-0.dll
                                                                            • Size 64KB
                                                                            • SHA256 601ccd84d252fc6e024b1319902e48cf98bb922bf7799384a85640d5ce6f4a16
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-crt-process-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-crt-process-l1-1-0.dll
                                                                            • Size 11KB
                                                                            • SHA256 4c058e5b8f83ce395a7004d8c4043735526de01c5764242d4ce4f683dcf1425c
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-crt-runtime-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-crt-runtime-l1-1-0.dll
                                                                            • Size 15KB
                                                                            • SHA256 876bd768c8605056579dd8962e2fd7cc96306fab5759d904e8a24e46c25bd732
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-crt-stdio-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-crt-stdio-l1-1-0.dll
                                                                            • Size 16KB
                                                                            • SHA256 8f7ace43040fa86e972cc74649d3e643d21e4cad6cb86ba78d4c059ed35d95e4
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-crt-string-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-crt-string-l1-1-0.dll
                                                                            • Size 17KB
                                                                            • SHA256 a797c0d43a52e7c8205397225ac931638d73b567683f38dd803195da9d34eac2
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-crt-time-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-crt-time-l1-1-0.dll
                                                                            • Size 13KB
                                                                            • SHA256 fd44d833ea40d50981b3151535618eb57b5513ed824a9963251d07abff2baedf
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            api-ms-win-crt-utility-l1-1-0.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\api-ms-win-crt-utility-l1-1-0.dll
                                                                            • Size 11KB
                                                                            • SHA256 0cd6d0ff0ff5ecf973f545e98b68ac6038db5494a8990c3b77b8a95b664b6feb
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            concrt140.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\concrt140.dll
                                                                            • Size 238KB
                                                                            • SHA256 1cddacbfb0c61652fcd543fef1e72cf649e27f3ee8f0d1c0d3988c0b5093e74e
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            extensibility.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\extensibility.dll
                                                                            • Size 10KB
                                                                            • SHA256 39e9af87ed0eae0fa0c520088d7edc3e1edd3889f109ef1220467ffa0e425e36
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            gdiplus.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\gdiplus.dll
                                                                            • Size 1.4MB
                                                                            • SHA256 66732f097fe39d370410d85aec9a86f373638e7cac46473da799e9e666fc6c8b
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            kpacketui.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\kpacketui.dll
                                                                            • Size 2.9MB
                                                                            • SHA256 f751256bcad8ca27481cb5f7ab0413a566ea0a4e91fd5f5f6cbc2b77b38aacec
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            msaddndr.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\msaddndr.dll
                                                                            • Size 96KB
                                                                            • SHA256 561c909f76faedfd010fc049faa503e249f00cab16d6b57bff0fa74604345731
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            msvcp140.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\msvcp140.dll
                                                                            • Size 427KB
                                                                            • SHA256 5a6dfa5e1ffb6c1e7fc76bd121c6c91305e10dd75fc2124f79fee291a9dd9e86
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            msvcp140_1.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\msvcp140_1.dll
                                                                            • Size 21KB
                                                                            • SHA256 4e94f9c89188fba7cae4bde37cf824d654717731559d47985d2b0749cfb11aa6
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            msvcp140_2.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\msvcp140_2.dll
                                                                            • Size 163KB
                                                                            • SHA256 94a12bedb9a25393dc75fccde7243d5e90acf40b1f14406132a44ff42e220f2e
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            msvcp140_codecvt_ids.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\msvcp140_codecvt_ids.dll
                                                                            • Size 19KB
                                                                            • SHA256 74ee4398ae24c1b787af944d650aa345ba0e9787cd112542d782b714209e35cc
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            qsvgicon.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
                                                                            • Size 61KB
                                                                            • SHA256 78d08a3fc054d42be1378152081d8dfda71dfc8e0075b7c9b216eef1e9777b36
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            qsvg.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
                                                                            • Size 41KB
                                                                            • SHA256 c3729d3cb3e0abc4c201543706041f21b91eac8bb65827311e1609edda2e16a0
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            qdirect2d.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\qt\plugins\platforms\qdirect2d.dll
                                                                            • Size 1.4MB
                                                                            • SHA256 c81c70a133d214630565b7bf8f20ab0db7fa3a6fe8bc0ccd9e05f6d3aecea241
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            qwindows.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\qt\plugins\platforms\qwindows.dll
                                                                            • Size 1.3MB
                                                                            • SHA256 2d5097e989f8f1b40cc9ecc2f62d0f6df87a84e9d8621f527f8848c9809053b0
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            qwindowsvistastyle.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
                                                                            • Size 145KB
                                                                            • SHA256 4f28424f62e0f1f912d598c58359bc9f76b07428293f9458d157a52994c7ca6e
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            stdole.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\stdole.dll
                                                                            • Size 21KB
                                                                            • SHA256 8cc8b5f4aac936407520b2e792a2bff207ed80df60a316a52d569f9d248b5872
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            ucrtbase.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\ucrtbase.dll
                                                                            • Size 1.1MB
                                                                            • SHA256 2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            vccorlib140.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\vccorlib140.dll
                                                                            • Size 262KB
                                                                            • SHA256 d43812f712f02a50017128463c357eae8f78b665353f889848f59a9faefd8ff7
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            vcruntime140.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\office6\vcruntime140.dll
                                                                            • Size 75KB
                                                                            • SHA256 f1fd5f6ec1cfe0cc3b66b5322ac97568bc63b19c1e415b99aad7c69ddbafa33c
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            style.xml
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\pl_PL\style.xml
                                                                            • Size 3KB
                                                                            • SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            product.dat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e597d64\CONTROL\product.dat
                                                                            • Size 148KB
                                                                            • SHA256 23a3d90868d28fc7c3813be0499dc6f4cee7e06feb31f91746360f19c8338441
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            tempinstall.ini
                                                                            • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                                                                            • Size 387B
                                                                            • SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            tempinstall.ini
                                                                            • Path C:\Users\Admin\AppData\Local\tempinstall.ini
                                                                            • Size 433B
                                                                            • SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            WPS Office.lnk
                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\WPS Office.lnk
                                                                            • Size 2KB
                                                                            • SHA256 1620cce2a60356301e325640fab8cc33f33d826d5c6ffb2ffe4f6c2d2e3a083a
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            K45SKZ2MQ3H185YXNPK9.temp
                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K45SKZ2MQ3H185YXNPK9.temp
                                                                            • Size 8KB
                                                                            • SHA256 83bf30eec61aad5e4a00916306a4466e090c40b1069c27d7da71bb36216879e5
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            onlineconfig.data
                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\cfg\onlineconfig.data
                                                                            • Size 137KB
                                                                            • SHA256 72da6ba1d965661c5bc88380a8d96ac273ab77eaea8d15a207d32754b0ee6291
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            configure2
                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\configs\configure2
                                                                            • Size 224B
                                                                            • SHA256 389ccf291cec001ff2f7be6f7689af05204171c6f1958ca20786f3e28a59008c
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            ksomisc_2026_08_02.log
                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_08_02.log
                                                                            • Size 5KB
                                                                            • SHA256 39eb61388aa57438d6d6f18fbf4c0e137158d7f914285730217703a31e7c6156
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            wpssetup.log
                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                            • Size 10KB
                                                                            • SHA256 2f404a8a5c444ec59f5cb09671c32cd3bd9c70a9964a5a27977c22bdc5847cce
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            wpssetup.log
                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                            • Size 11KB
                                                                            • SHA256 90fdf88b3bd0e7be974e6dc6db82a12ebea9c49b6bdccf2b9aa1656c86c9ae22
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            wpssetup.log
                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                            • Size 25KB
                                                                            • SHA256 68821f418949d4e7e28457c765d286df3c48caae81740936ae774ac9c2ffaf6f
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            wpssetup.log
                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                            • Size 58KB
                                                                            • SHA256 7101a52200ab729d883375a84724814ba736086b9e20e5fc30c611dd1922c729
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            wpssetup.log
                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                            • Size 59KB
                                                                            • SHA256 9c625b86b33cf00b51dd69ee1cabd99decc30d4889daaf20f3727713c27e1c3c
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            wpssetup.log
                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                            • Size 49KB
                                                                            • SHA256 e343d1c8fd8c30e53ca1e24d5930532efa6b54339cf2855ed34cbcfc54b9651c
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            wpssetup.log
                                                                            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
                                                                            • Size 49KB
                                                                            • SHA256 199fe1c513b432c70b728413130498ace80c7d13c21ff6cedea31f6de76716b2
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            memory/1168-0-0x0000000000400000-0x0000000000A18000-memory.dmp
                                                                            Download

                                                                            memory/1168-1-0x0000000000400000-0x0000000000A18000-memory.dmp
                                                                            Download

                                                                            memory/1280-4732-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/1280-4724-0x000000006B2E0000-0x000000006BB78000-memory.dmp
                                                                            Download

                                                                            memory/1280-4726-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/1280-4728-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/1280-4729-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/1280-4730-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/1280-4731-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/1280-4727-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/1280-4733-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/1280-4734-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/1280-4735-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/1280-4723-0x000000006E710000-0x000000006F187000-memory.dmp
                                                                            Download

                                                                            memory/1280-4722-0x000000006F190000-0x000000007093F000-memory.dmp
                                                                            Download

                                                                            memory/1280-4752-0x0000000003520000-0x0000000003537000-memory.dmp
                                                                            Download

                                                                            memory/1864-4814-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/1864-4815-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/1864-4806-0x000000006E710000-0x000000006F187000-memory.dmp
                                                                            Download

                                                                            memory/1864-4807-0x000000006B2E0000-0x000000006BB78000-memory.dmp
                                                                            Download

                                                                            memory/1864-4835-0x0000000000AE0000-0x0000000000AF7000-memory.dmp
                                                                            Download

                                                                            memory/1864-4809-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/1864-4810-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/1864-4811-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/1864-4812-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/1864-4813-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/1864-4818-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/1864-4805-0x000000006F190000-0x000000007093F000-memory.dmp
                                                                            Download

                                                                            memory/1864-4816-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/1864-4817-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/2368-4846-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/2368-4845-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/2368-4847-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/2368-4844-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/2368-4841-0x000000006B2E0000-0x000000006BB78000-memory.dmp
                                                                            Download

                                                                            memory/2368-4843-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/2368-4840-0x000000006E710000-0x000000006F187000-memory.dmp
                                                                            Download

                                                                            memory/3132-4695-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/3132-4697-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/3132-4692-0x000000006B1A0000-0x000000006BA38000-memory.dmp
                                                                            Download

                                                                            memory/3132-4704-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/3132-4693-0x000000006E710000-0x000000006FEBF000-memory.dmp
                                                                            Download

                                                                            memory/3132-4694-0x000000006ACB0000-0x000000006ACC0000-memory.dmp
                                                                            Download

                                                                            memory/3132-4696-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/3132-4685-0x000000006FEC0000-0x0000000070937000-memory.dmp
                                                                            Download

                                                                            memory/3132-4698-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/3132-4699-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/3132-4700-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/3132-4701-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/3132-4702-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/3132-4717-0x0000000003970000-0x0000000003987000-memory.dmp
                                                                            Download

                                                                            memory/3132-4703-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/4656-4763-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/4656-4823-0x0000000003080000-0x0000000003097000-memory.dmp
                                                                            Download

                                                                            memory/4656-4764-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/4656-4765-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/4656-4766-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/4656-4767-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/4656-4768-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/4656-4769-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/4656-4770-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/4656-4757-0x000000006F190000-0x000000007093F000-memory.dmp
                                                                            Download

                                                                            memory/4656-4759-0x000000006B2E0000-0x000000006BB78000-memory.dmp
                                                                            Download

                                                                            memory/4656-4758-0x000000006E710000-0x000000006F187000-memory.dmp
                                                                            Download

                                                                            memory/4656-4762-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download

                                                                            memory/4656-4761-0x000000006ACA0000-0x000000006ACB0000-memory.dmp
                                                                            Download