Analysis
- max time kernel
136s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 22:40
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
36 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
- Size 4.3MB
- Sample260702-2lz4macx5j
- SHA256 3bb62d10d37b325029101b3cc2f487a8a8600f0fc965b48d7851576e1fd8b4df
- MD5 8989ff157409955b515697c289daf729
- SHA1 dc586efbbb3fea57f108cc1e3c2bb9f32cddd8e7
- SHA512 48ca5a1a60c6405703b2137a15b732cf674bad0a34362209c2087e19a9af59c4b3eedf278230fdf8537a7298e77b68d830cfbb232ffa2660f1324f9de996e0f7
- SSDEEP 98304:inNlRG0ySJDLe2U8EqQ2mOLXb9Ouu9u9x4Q5ZtZvaS:inDnFe2U6zOu9x4QntZvaS
- TLSH T11026C011FA8581B5F8B3017185285B7A8A7EED342778D4C3E79834694EB17C16B3F2A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 18 IoCs
resource yara_rule behavioral2/memory/3956-38-0x0000000010000000-0x000000001033A000-memory.dmp UPX behavioral2/memory/3956-44-0x0000000010000000-0x000000001033A000-memory.dmp UPX behavioral2/memory/3956-45-0x0000000010000000-0x000000001033A000-memory.dmp UPX behavioral2/memory/3956-108-0x0000000010000000-0x000000001033A000-memory.dmp UPX behavioral2/memory/3956-122-0x0000000010000000-0x000000001033A000-memory.dmp UPX behavioral2/memory/3956-165-0x0000000010000000-0x000000001033A000-memory.dmp UPX behavioral2/memory/3956-2902-0x0000000010000000-0x000000001033A000-memory.dmp UPX behavioral2/memory/3956-3369-0x0000000010000000-0x000000001033A000-memory.dmp UPX behavioral2/files/0x000a00000001c95f-3468.dat UPX behavioral2/memory/5084-3481-0x0000000071FE0000-0x0000000072350000-memory.dmp UPX behavioral2/memory/5064-3621-0x0000000071FE0000-0x0000000072350000-memory.dmp UPX behavioral2/memory/3956-3783-0x0000000010000000-0x000000001033A000-memory.dmp UPX behavioral2/memory/1084-4013-0x0000000071FE0000-0x0000000072350000-memory.dmp UPX behavioral2/memory/2076-4104-0x0000000071FE0000-0x0000000072350000-memory.dmp UPX behavioral2/memory/1784-4256-0x0000000071FE0000-0x0000000072350000-memory.dmp UPX behavioral2/memory/5084-4255-0x0000000071FE0000-0x0000000072350000-memory.dmp UPX behavioral2/memory/2076-4281-0x0000000071FE0000-0x0000000072350000-memory.dmp UPX behavioral2/memory/5064-4434-0x0000000071FE0000-0x0000000072350000-memory.dmp UPX - Drops file in Drivers directory 24 IoCs
description ioc Process File created C:\Windows\system32\drivers\kisknl64.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\kisknl64_arm.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\kisnetflt.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\kisnetmxp.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\kdhacker.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\ksapi64.sys kxetray.exe File created C:\Windows\system32\drivers\kavbootc.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\kisboot.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\kisnetm.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File opened for modification C:\Windows\SysWOW64\drivers\KAVBase.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\kisboot64.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\kiscore.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\kisnetflt64.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\kisnetflt64_arm.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\kisnetm64.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\ksapi64.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\ksapi64_arm.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\kusbquery.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\kusbquery64.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\kavbootc64.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\kdhacker64.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\ksskrpr.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\ksapi.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created C:\Windows\system32\drivers\kisknl.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000a00000001c95f-3468.dat acprotect - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kxesc = "\"c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kxetray.exe\" -autorun" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 41 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 28 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KXESCORE.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scomregsvrv8.exe 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavlog2.exe 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kisaddin.exe 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KISMAIN.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksignsp.exe 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KSIGNSP.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxetray.exe 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KRECYCLE.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KAVLOG2.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kdrvmgr.exe 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KDRVMGR.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krecycle.exe 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kscan.exe 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KSCAN.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KXETRAY.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kislive.exe 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KISLIVE.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxescore.exe 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SCOMREGSVRV8.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninst.exe 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\UNINST.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KISADDIN.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kiscall.exe 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KISCALL.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kismain.exe 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksetupwiz.exe 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KSETUPWIZ.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe -
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KAVLOG2.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KDRVMGR.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KISADDIN.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KISCALL.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KRECYCLE.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KSCAN.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KSIGNSP.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KXESCORE.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KISLIVE.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KISMAIN.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KSETUPWIZ.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KXETRAY.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SCOMREGSVRV8.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\UNINST.EXE 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5520 netsh.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
resource yara_rule behavioral2/memory/3956-38-0x0000000010000000-0x000000001033A000-memory.dmp upx behavioral2/memory/3956-44-0x0000000010000000-0x000000001033A000-memory.dmp upx behavioral2/memory/3956-45-0x0000000010000000-0x000000001033A000-memory.dmp upx behavioral2/memory/3956-108-0x0000000010000000-0x000000001033A000-memory.dmp upx behavioral2/memory/3956-122-0x0000000010000000-0x000000001033A000-memory.dmp upx behavioral2/memory/3956-165-0x0000000010000000-0x000000001033A000-memory.dmp upx behavioral2/memory/3956-2902-0x0000000010000000-0x000000001033A000-memory.dmp upx behavioral2/memory/3956-3369-0x0000000010000000-0x000000001033A000-memory.dmp upx behavioral2/files/0x000a00000001c95f-3468.dat upx behavioral2/memory/5084-3481-0x0000000071FE0000-0x0000000072350000-memory.dmp upx behavioral2/memory/5064-3621-0x0000000071FE0000-0x0000000072350000-memory.dmp upx behavioral2/memory/3956-3783-0x0000000010000000-0x000000001033A000-memory.dmp upx behavioral2/memory/1084-4013-0x0000000071FE0000-0x0000000072350000-memory.dmp upx behavioral2/memory/2076-4104-0x0000000071FE0000-0x0000000072350000-memory.dmp upx behavioral2/memory/1784-4256-0x0000000071FE0000-0x0000000072350000-memory.dmp upx behavioral2/memory/5084-4255-0x0000000071FE0000-0x0000000072350000-memory.dmp upx behavioral2/memory/2076-4281-0x0000000071FE0000-0x0000000072350000-memory.dmp upx behavioral2/memory/5064-4434-0x0000000071FE0000-0x0000000072350000-memory.dmp upx - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksg\ztfe6001.fsg 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kae\kaecorea.dat 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ktaskrcmdplugin.dll 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\qt5network.dll 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kavbootc.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisnetflt.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\instwrl.dat 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksg\ztf04001.fsg 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksg\ztvd8010.vsg 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksg\ztvdc00f.vsg 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksg\ztvf4004.vsg 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksoft.xml 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kdefendpop.dll 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksapi64.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\rcmdv2sp01\cfg\pic\rcmdv2_roundicon_orange_btn.png 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksg\ztvb7001.vsg 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\k2shmpg.dll.bak 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxecenter.exe 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\qt5core.dll 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\ksbwdet2.dll 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\ksysdoct\kdumpmodulecfg.dat 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\rcmdv2sp01\cfg\pic\wifi_subicon.png 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kdf.exe 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\krsctrl.dll 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\plugins\sqldrivers\qsqlite.dll 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\qt5svg.dll 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisknl64.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\cef\locales\zh-cn.pak 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\kpersonacfg.dat 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\kuefreq\kuefreq.dat 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksg\ztve5008.vsg 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\krcmdtool.dll 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kschext.exe 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\qt5winextras.dll 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\scom.dll 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\rcmdv2sp01\cfg\pic\chaodijiage-taobao.png 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\rcmdv2sp01\cfg\pic\rcmd_qq03.png 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\driver_manager.kid 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksg\ztffa000.fsg 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\delaydownloader.dat 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\thelnkcfg.ini 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kconditionengine.dll 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kdhacker.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksg\ztvd7009.vsg 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\bredirect.dat 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\rcmdv2sp01\cfg\pic\rcmdv2_juhuasuan_3_8.png 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksg\ztf09001.fsg 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksg\ztffc005.fsg 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\displaybanner_extra_resource.zip 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\api-ms-win-crt-runtime-l1-1-0.dll 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\keasyipcn.dll 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\netrule.krf 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\rcmdv2sp01\cfg\pic\rcmdv2_realtimeopt_tianmao_icon.png 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kspupwnd.dll 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kusbquery.sys 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\plugins\imageformats\qjpeg.dll 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\uni0nst.exe 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File opened for modification \??\c:\program files (x86)\kingsoft\kingsoft antivirus\log\kxetray.ktaskdispatch.dll.log kxetray.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\feedbackdatacfg.dat 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\floatskin\skinicon\defaultshrink_skin_img.png 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\rcmdv2sp01\cfg\pic\rcmdv2_normal_taobao1212_test1_sub1.png 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksg\ztvd9017.vsg 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksoftmgrengine.dll 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe File created \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\kplc.dat 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe - Executes dropped EXE 5 IoCs
pid Process 4380 InstallHelper.exe 5084 kxetray.exe 124 ksapi64.sys 600 kxescore.exe 1928 kavlog2.exe - Loads dropped DLL 26 IoCs
pid Process 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 5084 kxetray.exe 5084 kxetray.exe 5084 kxetray.exe 5084 kxetray.exe 5084 kxetray.exe 5084 kxetray.exe 5084 kxetray.exe 5084 kxetray.exe 5084 kxetray.exe 5084 kxetray.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 5084 kxetray.exe 5084 kxetray.exe 5084 kxetray.exe 5084 kxetray.exe 5084 kxetray.exe 5084 kxetray.exe 5084 kxetray.exe 600 kxescore.exe 600 kxescore.exe 5084 kxetray.exe 1928 kavlog2.exe 1928 kavlog2.exe 5084 kxetray.exe 600 kxescore.exe - Modifies system executable filetype association 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ duba_64bit 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ duba_32bit 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kxetray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kxescore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kavlog2.exe - Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.zzzktword 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Shellex\ContextMenuHandlers\ duba_64bit 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\ktword 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\ duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\ duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "r4eo7o9yzcd4jopg5fbmpvk5pecp" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\Shellex\ContextMenuHandlers\ duba_64bit 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ThreadingModel = "Apartment" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shellex\ContextMenuHandlers 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\ duba_32bit 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0} 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "358922bd4a219b98245d590a136b1324" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278} 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ktppt 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ duba_64bit 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5} kxetray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\ duba_64bit 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\ktppt 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ktexcel 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D} 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ duba_32bit 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E}\did = "449FE0B7F11879EC229048036B92F465" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51} 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shellex\ContextMenuHandlers\ duba_64bit 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5} 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.zzzktexcel 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\Shellex\ContextMenuHandlers\ duba_64bit 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\Shellex\ContextMenuHandlers\ duba_64bit 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4} 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu.dll" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E}\PacketPath_233_716_1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\duba_u23850015_sv1_83_23.dll" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zzzktword 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E} 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.000ktppt 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu64.dll" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shellex 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ duba_32bit 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.000ktppt 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shellex\ContextMenuHandlers\ duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\ duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\ duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zzzktexcel 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\ktexcel 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shellex\ContextMenuHandlers\ duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\ = "CKavMenuShell Class" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32\ThreadingModel = "Apartment" 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ duba_32bit 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 600 kxescore.exe 600 kxescore.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 816 Process not Found - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Token: SeDebugPrivilege 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Token: SeRestorePrivilege 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe Token: SeBackupPrivilege 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3956 wrote to memory of 4380 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 90 PID 3956 wrote to memory of 1928 3956 2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_8989ff157409955b515697c289daf729_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
- Indicator Removal: Clear Persistence
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Loads dropped DLL
- Modifies system executable filetype association
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\kantivirus\InstallHelper.exe"C:\Users\Admin\AppData\Local\Temp\kantivirus\InstallHelper.exe" -Pid:"3956" -LogFileName:"C:\Users\Admin\AppData\Local\Temp\kantivirus\semPacketDllLog.log" -InstallPath:"C:\Users\Admin\AppData\Local\Temp\kantivirus" -Tid1:"168" -Tid2:"100" -Tod1:"83" -Tod2:"23" -IId:"211542892" -UUID:"358922BD4A219B98245D590A136B1324" -TryNo:"1335" -SvrId:"2026.SP2.2" -StrategyList:"0;1;2;3;4|0;2;3;4" -Version:"3" -ProductInstalled:"0" -CompetitorMask:"0" -CompetitorInstalled:"0"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4380
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe" -install2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1928
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksoftmgr.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\ksoftmgr.exe" -preload2⤵PID:5324
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe" /start kxescore2⤵PID:1388
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe" /autorun /std /skipcs32⤵PID:3144
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksoftmgr.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\ksoftmgr.exe" -install:60000850 -src:106 -lenovoodd:lSuSIZA=2⤵PID:1784
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\rcmdhelper.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\rcmdhelper.exe" -updateliebaowifi3⤵PID:6060
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\rcmdhelper.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\rcmdhelper.exe" -updatetaguser3⤵PID:1896
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\rcmdhelper.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\rcmdhelper.exe" -kdeskcanrcmd3⤵PID:4448
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" firewall add allowedprogram "c:\program files (x86)\kingsoft\kingsoft antivirus\xlmodule\download\minithunderplatform.exe" "minithunderplatform" enable3⤵
- Modifies Windows Firewall
PID:5520
-
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe" /autorun /hidefloatwin /silentinstrcmd2⤵PID:2244
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe" -autorun1⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5084 -
C:\program files (x86)\kingsoft\kingsoft antivirus\kxemain.exe"C:\program files (x86)\kingsoft\kingsoft antivirus\kxemain.exe" authoritycontrol /noruntool /msgsender /noaddintoyytools2⤵PID:5064
-
C:\program files (x86)\kingsoft\kingsoft antivirus\rcmdhelper.exe"C:\program files (x86)\kingsoft\kingsoft antivirus\rcmdhelper.exe" -updateliebaowifi3⤵PID:5336
-
-
C:\program files (x86)\kingsoft\kingsoft antivirus\rcmdhelper.exe"C:\program files (x86)\kingsoft\kingsoft antivirus\rcmdhelper.exe" -updatetaguser3⤵PID:6088
-
-
C:\program files (x86)\kingsoft\kingsoft antivirus\rcmdhelper.exe"C:\program files (x86)\kingsoft\kingsoft antivirus\rcmdhelper.exe" -kdeskcanrcmd3⤵PID:1896
-
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\knewvip.exe"knewvip.exe" --open_opction=1 --from=1 --start2⤵PID:2564
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxecenter.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\kxecenter.exe"2⤵PID:5156
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kismain.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\kismain.exe" /ksoftmgr /create_virtualdisk3⤵PID:5772
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe" /kismain /ksoftmgr /create_virtualdisk4⤵PID:3004
-
-
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxemain.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\kxemain.exe" /kismain /ksoftmgr /create_virtualdisk2⤵PID:2076
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksoftmgr.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\\ksoftmgr.exe" /ksoftmgr /create_virtualdisk3⤵PID:5832
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\rcmdhelper.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\rcmdhelper.exe" -updateliebaowifi3⤵PID:4740
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\rcmdhelper.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\rcmdhelper.exe" -updatetaguser3⤵PID:2504
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\rcmdhelper.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\rcmdhelper.exe" -kdeskcanrcmd3⤵PID:5536
-
-
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kwsprotect64.exe"kwsprotect64.exe" (null)2⤵PID:5108
-
-
C:\Windows\system32\drivers\ksapi64.sysC:\Windows\system32\drivers\ksapi64.sys1⤵
- Executes dropped EXE
PID:124
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe" /service kxescore1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:600
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe" /service kxescore1⤵PID:1084
-
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kupdata.exe"c:\program files (x86)\kingsoft\kingsoft antivirus\kupdata.exe" -magiccube_update2⤵PID:3172
-
-
C:\Windows\system32\Drivers\kavbootc64.sysC:\Windows\system32\Drivers\KAVBootC64.sys1⤵PID:4204
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
1Clear Persistence
1Modify Registry
2Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\data\catrecord.json
- Size 1KB
- SHA256 23e47ea8ec54b5cdf97901c0cc1f012550266a7508b477f9f2e657d43b874ea3
- MD5 f49d701b0896de521c590b97daf672f1
- SHA1 efe948110fc7fd21a3a5a5358003310355c59d54
- SHA512 8f22aa210b3cf02150c675013c0e4d3d9310a27cacd1f70692ef9c775d640f66bd19c6f81f1428982375dc839745b533d2208266e0608e14278e25ed57170519
- TLSH T16731282AD9001E6E0079537D6FA98748F6A39F5F028B0E0B7EBC178C1F3811014A7BA9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\data\competing_pop_cloud_cfg.ini
- Size 336B
- SHA256 bb17e33e6de581672a3ce40eedc69fc899eadd49993c5aa96ef12a8e79d02736
- MD5 630c19f1dda2a3d946af7ac244639c30
- SHA1 9b25286e33f69d8696d5df1d77392758ed4932c2
- SHA512 b9756cde549f861508d84b0dd7df45ee9dfc1019bd91029c7efabd221673df77979dda398b8eca0b1c300acd26763debb1da5ed29f1fa14945ff0427271f3a57
- TLSH T1AFE02D0A76FD85FDB0A34F41C0B8A8A3163D7AE13428650DB7E492488CE46805823FEB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\data\floatskin\user.ini
- Size 80B
- SHA256 d1f1614c316eef5a259e250284be9bcf79230145a2d3a3f3ef6eb4a4f0926005
- MD5 25e7b49da666f24aed85042b977eabeb
- SHA1 0253b6385010b5c7cfa7ff28d0a0534c5a144354
- SHA512 1315885046bceb66781bc82026409eb7573eaf19b236359d4fb5db5da634a837e18915b01db2186c8abc620f044f9bc780db62380b87022a05c9e3e07171e007
- TLSH T16EA0123211ED002C184179502272744CD0C38D31D02A2060B0D0605C1420304023C600
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\data\floatwinsetting.ini
- Size 35B
- SHA256 9291a221a60ecc514b128cc063612599a29b939221dc16c0641c25739c0a4c8c
- MD5 feeac5d6fbee0b26a583bb2e0e4df453
- SHA1 bacdddb967627db6a37dcf13299ca36fcb7e1a61
- SHA512 7fd897d734b64517c0e450f3ad659c630759797d20c425a731add8752acfa4f9315b80036d9d05319fa589aabdd978112815584ae5ab00cd4641cd276bd27266
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\data\kclearak.dat.d
- Size 1KB
- SHA256 77b727cb6d8e404ecbe35cba42bcfa3794a1a3952b5957eb1b640a6557a12d30
- MD5 6405b24029728763c0680bc054db2ad8
- SHA1 e924cf1303f502335faac71a94fc7b1e4c6a465a
- SHA512 b6abbc39863e3d2265f8749f126dee91f9590227034ff20724a5de79b6e19db1e6667cf0d2ed878ae1fa1b1fdba6e95b88f115ec8a72877d25b72766d98e0584
- TLSH T16211CC186C72C51AB5E63AA0601F91BFB6FF4B9935D7568835DC8A418F0E1FE8102329
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\data\ksofticondownloader.dat
- Size 26B
- SHA256 294b9aaf2e3bcd5e4694d164f30e727d5653301887f8f63de5c9e4232115a011
- MD5 6565a7227042d878a6f35019de3c35c4
- SHA1 964b048d29f09f92c5882b3194b622f6312bf672
- SHA512 30d143a73529099b1e76a0630ca8e2798a6379ebcfc822b31617ba03e679ce969a14ee0e58e8a16c489238f059f20217f29014a59eece45de4b9fd9f5e34b085
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\data\ksoftmgr.ini
- Size 55B
- SHA256 3cda2c198c64df257cb1712c1d21715b552b962b2f0c549455591fbd8a86341c
- MD5 b093467a30320ae214ee17b8d8eb41ff
- SHA1 00fbd9ed4d1c4392d7e5016f1ff18aae14549696
- SHA512 f7f58d1e22b428e7526d526ef7ae4edad438710845d80f5466aff7b5bc9ae07ab612fdf499dc32f12ff58315db539c3ee1b7a79cfd9d18a6b489f90ef3a66914
- TLSH T1689002E001C00AA4D04000B8AA18772CA0B1AE2180A03A023000335306512DD22B6850
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\data\ksoftmgr.ini
- Size 258B
- SHA256 676260c26af177469b91d99f5e1f8e17b4d1303fb48864350d9f0e4d3b84c69f
- MD5 b2d8f7340c69de34876365c8e1895501
- SHA1 d729b7d9e72d633adbc9ad3a1218837210eea6ac
- SHA512 807cf411d41e9c1f0193ab6a1130f5171ad0773c8c8d7f64312b0cb6f12594c117397dae823ef5616dc780051d4b6d3d966a8854565ced9994c0aae0bcdd5f51
- TLSH T148D05EA911C9CEA09C9536F8BF74238D13F06B1409502E1964862AE28C88BDF19FA579
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\data\ksoftmgr.ini
- Size 258B
- SHA256 8326135b22b0878e5874014c5d76aa57b62a403e5dd66fdaf1b2faf1ba6353b9
- MD5 6f8eed4c5e00a199887e65de39eb7c3c
- SHA1 a6cbab54adfe21cd7f81aea7cac347275d08bb8d
- SHA512 e3e79e85c1f47d3c0596086706c165f38d9382c6f7860caaca0f2f53fa8cb64c1ef489b5adfa4a1e0fc4520faeac464a3ed7d24005fd0e7788b1f81dbe6d6307
- TLSH T1BAD05B6805C58DB0DCD536FCFF60138D13F06B1045501E2454853D9388947CF19FA475
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\data\kuserfeedback.ini
- Size 478B
- SHA256 666662a5d997252fd4ff64a2cfbf85468a111dc9ceb2692e3c78a7cc39b98be6
- MD5 bd9eeef5d551c8566cddae26072f19e6
- SHA1 30bd3ab3e58dc56014badb8046f568e8d2f90d2a
- SHA512 fa1163a44f7cbe38381c0454c9f0c1e9bddb614e3c6856d7657ffadd714f82639faff2aefd04dafacd681e43e8ab576abae65055c24a38a021366874bfcf9399
- TLSH T1D4F09710C44C81CD2651F1819C3E06F693DC3024AF49FFF56F06C8122E4C6A0A3687A9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\data\raw_record.dat
- Size 12KB
- SHA256 15a423ea011e8ad37aa555aba2b687d3735fa8e2d3a4ad3ba35c1baf944786f9
- MD5 37f44a32b5269b00bf0f9b08ddb10c90
- SHA1 ddefda0a216f1d1382b9ba0fc484518668e77b98
- SHA512 7420a95e268be58099542bc53e540e4000c6e597a055fa57297c8142751e6be8ef0c9d47584a108982206dbf3c2fda09cbc1a32b8f2a046aadb5a835b86d07b4
- SSDEEP 192:iRjD24AIyJ5koeNbZf3FWn8jc3O+smlG4sElg8Nw:iBD2Y657MV4nz3NsmlGKldC
- TLSH T1E142648BD0D58785581DCB3D9AAA97C48334AF83791E9F7AFC071CE926CB2556038C27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\data\rcmdv2sp01\push_type_record.dat
- Size 128B
- SHA256 1b1425cccef61633bf4577d5ee9164fc5fa37e97383258ed7ea29d37416cd761
- MD5 c9a2016671be0a012c637713f30e2262
- SHA1 4c741b07e8e61ab55a08ad4117888bb1373ef09f
- SHA512 5999e0d395ad88d6c221143ad9a235f3ce3688fb6964eef11b0ee531ff7bb145fd062e088e46bbdb960a013400525bc8138c3c5c39353d260d38e804824f1cd9
- TLSH T159B0921B35BC54384E2A28D8957A08229FF91A800DCE0002C2C00CDA8F05DE74D2F33C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\kadblock\kadblockcfg.ini
- Size 69B
- SHA256 536ad1032746f5125cb2e7cff99a42f0af1e96ed727c68e8024a2a6c224f7f7a
- MD5 b62a8a310c4d88d06b6469edaf9edb78
- SHA1 ee0106fb57240187141ee874bc6e8f7c5bd479c3
- SHA512 5aa03cc9f0e76fa377b667e15e2203f559f25449b874d6ff974c318e9f490f03e67b2ba714dc62593c88bb2f98d87a0693d720158af58a74f542e630f53e352f
- TLSH T174A0021B41108BFD70EF550DEB1DC0F0635493750031261D5AD09855FE4800D063814B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\kavmenu.dll
- Size 1.9MB
- SHA256 23d235c1f8220b1499f07b68e27b10ae991d4d948e848bb8bc57d88ca4a04997
- MD5 5730dfd065aeb4a2cc6f6e0e5cef8d07
- SHA1 62683b055c986b3f199c73c82218fd7f6484a4b2
- SHA512 0ccefe2542fd0f363f89586b3d100388a05bb84d4ae5d382480c7ae6506bb379a2a954aab2137de44b02e3668fa8aaf302a023cd18bd9ece5cef3454677a34a9
- SSDEEP 24576:nJpvNWNXcxQx/fgeDKIvYU8b3qgVlpb7qMesr6H6H381lC8v:JpANXcxQx/fghU4ZVHrqlVv
- TLSH T1C4956C153FC250B5FA621030582D4EE4A5BFBEE61461423B0B683DE9EEFDFC26711896
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\keasyipcn.dll
- Size 123KB
- SHA256 2b2342270bba33a16d66f7b89e4cf1c5562cac28c3b7e513142d2ef59c1c3880
- MD5 22fd9b262821526b167b8f996a127a71
- SHA1 6a8166f1a4b60ac977abf387dbdff61e4a60dbb4
- SHA512 413bc967e1eb44815a198d303e6929a069ca467d2ac39788c0edca93a18c07cec20fa918d484e3037672e161f0728091f6125666ae0d24349e83509a386017bd
- SSDEEP 3072:npbFpTFE539GHn5hKOWdZslEgRSzOAEdZQilQ0S:npbzxu9GHvBWSEgRSzOAEbhLS
- TLSH T15FC36E133BE881B6EE9F467D2856A73A93B7B5E0DEA44907B324470D6E743436D28307
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\kws.log
- Size 968B
- SHA256 d9b3340e9e5d56bac3b9b092f066c6be28da8be7175eb895c74900dcb3753a39
- MD5 595e5b978f3ac665990ebfe36fd9feb5
- SHA1 5e7bba1eb8c5e4c0426d0cbcc0437e29505eabe3
- SHA512 4c10f637aca29172e65247c029ab67722cfddb6d1d074c5ab58be78883376c16205460959cd31d31057f0975bce599437217e2633dcfd257b33286f78932cd89
- TLSH T1121127AE91F90D57F06AD70348F3911B27737ED32224EC4C51D60B880A9A940F1A6BB7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\kwsprotect64.log
- Size 90B
- SHA256 b0cf166d53030e5b9d76690a8f1b074b1fdc11b0eac4101ae2bfcf5555766766
- MD5 c2f92997c9eb1e8a611dfc6bac6bdc3d
- SHA1 d23f69080bc3b8b20d3db7174a897d711e8eb786
- SHA512 8b875b7faf89302063f642df914d9b676362803b4c3908d4659e4219a111bdbf2f69aa4aebd2b00a14b11e162481c2177d746c0c9bdf27fb7cbcf773d1691ad0
- TLSH T182B011AE2800003322B2CA0B00A20000AAA32E8B2C38CC0802C2030A00A8880FEA2B8A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\kxecom.kid
- Size 1B
- SHA256 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
- MD5 7215ee9c7d9dc229d2921a40e899ec5f
- SHA1 b858cb282617fb0956d960215c8e84d1ccf909c6
- SHA512 f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe
- Size 219KB
- SHA256 5e38ad04de84ec09e13e994e664683f488c0d5d44e0d722ca83b92561035b788
- MD5 1e88bfbf2675801c147ecdd0ef928cc6
- SHA1 c5135d480c658969ba4f13ce32a8ba33d5ca2972
- SHA512 c4c1c40e5fec0665ea79dfe9c3eb81a7d909efb9583db71c63b284764c171608be599f7fa096b84c3d81a13d9d4eaa61d850f01182fbb136c305128bc8a79042
- SSDEEP 6144:n5ecpIKnA3j2YOyNSdfHvXFA+gIvogb7/r:5LpItbNSpX6ggATr
- TLSH T1C2247C323FD4847BF5B30231A9A867F5E2B9B9641F62C5C393895B0C19715D0BB36A23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe
- Size 2.5MB
- SHA256 87802977bfaaffa1298ba2344bc088c1fdd795a35081dd7c1a3f3ef1c628dfc6
- MD5 4851931e4d43a05d828dca684ba332cd
- SHA1 42598fb374def551b68e5112b9ba6004921646b3
- SHA512 140c4bd4672d87931b744d15b7c5849117cd047ad8448e6dab3273977c630d89f5738bbd8c452662767dbc3671a9e63dd594fd7d182107dbbab2df8280e6058d
- SSDEEP 49152:KYzZqPDzFsGPhfABQxRpIzUtk5VDxRN0F8UtikmZ8ij8zu3++UJWYFFmS7/HYI1J:KYzZqPDzFvPhfABQxRpIzUtk5dTN0F8i
- TLSH T112C55A12E7D7F02DF6B3067C19F8EA2D8DAABDA00961C59F13C4364E99B49C14926733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\msvcp80.dll
- Size 549KB
- SHA256 b9bfb37c45a9abd36da98bf94476f7ea33b0a1cec5e58db99504b62371209681
- MD5 4b93629aa707c6f6ff61ca9c3b729c80
- SHA1 6abae5d7e9805b2c461cd595a18de5ce76159967
- SHA512 cc928427c7747be832f5ebbabb4e5be3a28039be2a0e487747fda7607c52b69833f47e02ff766f67249489e1d36ebe386c9ff949a554265cadb420807d9a3670
- SSDEEP 12288:91HyurvZ0JPjuTtSu86th1n/hUgiW6QR7t5j3Ooc8NHkC2eo2:91HyurvZ0liTwuhtjnj3Ooc8NHkC2eo2
- TLSH T192C4F82337438EF1E481B3F176C50322A7F7BC654625B31392DBE5252F9A3896573AA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\kismain.ini
- Size 84B
- SHA256 d4d0a2e02728d8491db32e5f278382d428f17165d4e181ecd727789f33674964
- MD5 bcd451444230e57ddf267e0988956b07
- SHA1 6cc86cc73c120992eb0e2bfca9b364f407eb3d61
- SHA512 3148688ec5ca6255684ce4193e1926d062ed6b83e9f2e0dc3957da261d10043ecf31803130d89c3ba28c37cf340981738b8acaa96654354e467c30fa4597b2b2
- TLSH T12BA002661A05FF3240F0A70C9A89F15157F90B4A58B34B2C64F033052F814DDD17D57D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\uplive.svr
- Size 25KB
- SHA256 81009d567ac552cea53764fbb6d2190c043e314d82ccfb97e19542e8f2e79e0e
- MD5 668c4b1d9cd2c4c269ec05881bc27938
- SHA1 0fdfed0d28551fdc7943bea692650dab5ae34e74
- SHA512 993fcd146be1f15bee8ebb0a73ec993d934e45eeec0a30a66796886c71e75d7f621a800ad44648c6504053b99ba19ae6b24533995d125abc3b6aba6a9f8e215b
- SSDEEP 768:I7mjctn6SBE91V7B3TpFYw4JV2PdnQuJX0pPH0hBR9wk3iKtKZ4+0s11hvKMaePV:I7mjctn6SBE91V7B3TpFYw4JV2PdnQu6
- TLSH T189C2679E851F45B88D7EB1EE36FD188AD297D5E1DEC2CC95CA9604B20BC71C4F2E8184
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\security\kavbootc.sys
- Size 57KB
- SHA256 da2b11e8b4bfd8e4bc799155211ae981a481e8344ed19bb93de53cdd6db1ddf4
- MD5 23a7687505c2ebb8389ac70619068852
- SHA1 53539dfbb41247534aa4648abf42b61b69fe358e
- SHA512 3f78b279319b1ec1df6d674ffdfee4daa13590a4c135ecb8e5ba9e5a568747c86c3942e94fadd498122daab6dc4d7086dd643f880a28abf696c6a0232485e32d
- SSDEEP 768:AcaJio/tr+cd2wdo1o7b703PI2y9ibPSz73:yio/tqcQwdoy7v0/HC73
- TLSH T129437D41AA290422EFD25A70ACE4E54F7D3FEB821F9540E3A1A0945C1DDA3D1BB3467F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisknl.sys
- Size 264KB
- SHA256 54ef11e0da401ff54b2e941a66fcdf1466166896b113c3768b93fc61d573b4c0
- MD5 fcccad26560ed604d512c94d96f40cb2
- SHA1 1e7cbfe5197cd15a096bf2019aa3894ed38bcee3
- SHA512 7c5c33b929e005131a8636a6edc1be6cefdc38ca3f065c760a9693684108fb9a13697b84392c6ca34540b91d96368d6eb48bdf6359f2fb61ced0b5e89b7a65e6
- SSDEEP 6144:vR5os1IwYby1D3GHXOuqxBZ3/6f+owSxkt0y9uOVZjO2RyAOfK0wCQB2JqT:puG02D3SXOuqxBZ3/6f+owSxkt0yo+EW
- TLSH T118448D63F9C04676FBA31974EE68776178BBEC310E1484CBD3B846582625AC2D73A317
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\kingsoft\kingsoft antivirus\vcruntime140.dll
- Size 74KB
- SHA256 657ab198c4035ec4b6ff6cf863c2ec99962593547af41b772593715de2df459c
- MD5 b8ae902fe1909c0c725ba669074292e2
- SHA1 46524eff65947cbef0e08f97c98a7b750d6077f3
- SHA512 4a70740da0d5cdbd6b3c3869bcf6141cb32c929cb73728bd2044dd16896a3a1cafa28b0714fadcdb265172b62fa113095d379f3a7c16a248e86c8f7f89ecd0f4
- SSDEEP 1536:LoHuqvERNjBwySXtVaSvrgOFw9RxKMnxecbC2nO+:LoHZMRNjKySdLcOiHxecbC2n1
- TLSH T17E739E0278C0C272D5BE4979057AF612663DAA204FD15FDB7F985888AF75AC1EF31213
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Kingsoft\KIS\hg.dat
- Size 53B
- SHA256 46b53c29bed93c467436ed2e4d6bc2d846d4e8db70c03d95363e75218eb3c8cb
- MD5 7a7b92ab0685155fe15c069bc7680260
- SHA1 b3c970abc188bab3b9b9ab818b21577c7f80a0bd
- SHA512 a6e25a5e06080f77a27f2949d76355ccad21b196d75e62da56c6fc44d3a553140e7bf25c63e7cb1ef050daf4a99fbe13c5849f010bcd047221355a50052c3910
- TLSH T15B900265950438AA899577A11225151A500CA441644054A08A0932915D49040D48B5EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\67XJC5IB\common[2].css
- Size 3KB
- SHA256 e21dea4c2e0c4e52a5c22c2e83bd0400b3727b2b05b29bb464cda14c51dd9c04
- MD5 d5e0182b594c06529165e48774c7b20c
- SHA1 6f0289ed6ca199eab38b00e1ff2cbb4df40177ee
- SHA512 3b7dd42facfaf537889ff1574fad316283c5d8c7573c66abf2be36ad461208cdc542cd59ba7cb38addd64180433d9336476cf137cc7bdce81f7bc588868cb523
- TLSH T1067123111671716DF8BBA222A8938B9E687FC007E95327DCB3147564C9CF4EF6323694
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\kantivirus\InstallHelper.exe
- Size 409KB
- SHA256 446ca743f9f5d6364bbb46f4dce62ab754878b593b285890edec1e501357c533
- MD5 39ce66cbf9cbf36472d3dec7332f0451
- SHA1 625ab0e27ebf28b49627c156f8c4595c979adbed
- SHA512 00a3750b9c4b11bfb220db4123dc100d1b6f1fe1321ccaf3a825aa4b1918cd6039467cae5109a2a3eee77e59f30685c49e3bd7af8a26cb6358ce63e9de90a268
- SSDEEP 12288:5G2vgvWi8KUKUBWFggKaquF6BnGtHQIfXfBL:0rUAFgd4F6gtHxN
- TLSH T17094DF12B5C2C472C1A341365D57CB3AAA77BAD51B2199C3ABE41E895F312E1FB3B301
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\kantivirus\kavsetup.log
- Size 4KB
- SHA256 407d74d54486f4cefa2cfa182b8179ee91940f865ec29d8c15415f5572071691
- MD5 872eb44d6e3f24673607dcc0938e97bc
- SHA1 5ab8a6a00fbeac0b1223e2e2aa2154c7d591b24d
- SHA512 3f33a38dc9d709b6028bd93bbc73f4c4b19b9d41377180e50a952cb7cee79d1cd08f8998308e30a8cc40e23d4c6f6ff1981937213f96130351fe4bd7c917a813
- SSDEEP 96:7xUSG7fP/sLHgLHgLHgLHgLHgLicLkJfbNfYitFc:7xUT7AUUUUfFc
- TLSH T1F19197A5D376725EF6E353488A5F6C4E207A8DCC280C20DDB67F754361C8422ED69175
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\kantivirus\semPacketDllLog.log
- Size 40KB
- SHA256 63000eea865f3311a31c52c0a666ad6f319be2bf634226f5acb3127a6fa92c7a
- MD5 0a0988e821c6c3389325f862434e7c88
- SHA1 f783904fec3b3e8898de233bed618e8c67cc0cb6
- SHA512 2853ee166fa391dc0fd57b45118261c539530b86c7df39cf73f7427639fcf4d501aaca3bf1be46fbdd1ae15e27c727ea8e75e4648e64fd1fadf1309902120d7c
- SSDEEP 192:EWhW5WhWxWtW9WroVAPWXWDW1WbWdWTWZW7WTWJW7WtWdWnWVWVWERehDWNWrWNR:3RehtoPAA
- TLSH T1DD136E582861A51B3453A93337AF9186AC70242EC2B7F11CBFC0F6D4F922D557D0BA6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\kinst.log
- Size 694B
- SHA256 14662823502558b966faf6808f1467a82c6894b24f39e2984ee4a993489104ba
- MD5 45421ee29f9d3fea33a794e211b811d0
- SHA1 4bc6ac20b7196e91d3eb220262e8ecfa7d4e9e20
- SHA512 41d9ce8609e55f810a5e211ec4abbe502215fb0b21ae50c18c06be55348e9d06656a9186e82feb91133aa8e1831613988a456bcba5a6401a2d3b4e88270b145f
- TLSH T10601DE81853C5109ABEA01181586092EFD6FD98C3725ECFD373F3E090A47C3A98BD80C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\kingsoft\duba\persona\persona.db
- Size 10KB
- SHA256 2d00e438c251e68cad9adc1db5402d966c6eb65ed58bef0c1a139073544d4c02
- MD5 84b9aa5788acd6f6683863f5c8316abd
- SHA1 c00f83bc6e332a7f2574e887a3151291c2be69d5
- SHA512 fe4e32d699ca1730e3012f93762c8e75e337eafab4a863ea7b1a8a4839cebc7f6058b4fe9efb06222ed6e4330cb8f771621bbc218096432e2162a361c3cf154b
- SSDEEP 192:iYmu9A8ZI63vO/eOylMQ5LPIUc3dDAsXb49T3/0xUcUyPEqeVT9b+UZ:QTKDvOGz3LPIUcWjDiU7qOT9bL
- TLSH T19422BF04A5F6D5D0E156FABC7A471EB271D4E1E0D4D7168E60C32BF8A7017BA03B1D60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\program files (x86)\kingsoft\kingsoft antivirus\kxemain.exe
- Size 5.7MB
- SHA256 faa95adc36cf977f346c1ed37e940357d0eaf1bc0f9018f522474942e51d6100
- MD5 bfd8a87d4cdcefee5ddcd694c6e91cec
- SHA1 92bbfbbc70bcee70f1dec801cdc6db07ea88b893
- SHA512 fba3a83f6bd747154f13b3b46fc1419d9c70243642b9cf771b936e22bc1087d33fdc6a0670ae058a06022fb04984e3d23a27baa226d07171559e831c544e96f8
- SSDEEP 98304:Xuh9O2JAZW4u2yB524ROUeeuRaR7IZtcaMUhSUqig+y0gwvw+UBX0jCc6BF7J5OR:XuRGZFUB524QUeeuER7IFSUzg+WhBwCq
- TLSH T17A569E216A97FC3EE273033945E8E65D9EE9BDB51B314E4B72DC360D1B708C05A26632
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\MSVCP140.dll
- Size 426KB
- SHA256 b9aefaf687812af08a5144ba4f0bc904c1adcd1ce8e84acf51bc830e74c967cc
- MD5 10d9438bd24f31a41583b846583b63fc
- SHA1 a3694496865cea9caf6c1089558edc1f5d9c529f
- SHA512 a3e26819f3d63bac366a7609079217bad5f756d9bf076c30529d1e03c67959a78997e65460d38247aaf46be32c0789130eef69a534380bfe310ad481c2ccc7ce
- SSDEEP 12288:igt0BGzePo6+J+4P0xYv7IQgkhUgiW6QR7t5s03Ooc8dHkC2esPYWKd:d01Po6+J+dxYv7IQgz03Ooc8dHkC2e6E
- TLSH T15E943932BB464DF1E48913B971C9472193F9FC610362E3C397DAF12A2F566C6A633A50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\MSVCR80.dll
- Size 625KB
- SHA256 7a61303cadc238cceb9ff3f03a7d9848d905e01734195b9a5ef354f3b773693a
- MD5 1bdf3a3737df9f160f45ca40dd3de9c4
- SHA1 b9c5aaa84e31e234c8fb4042d472c652f16a06df
- SHA512 0d068fc39ffca45d311c09883e829342a66eaf736f3619a62091862fdf8278cfc40a074f2c0a6edbb24984850214d0dda6ac7b3b3636ecc70f6f5a3b5a17ea76
- SSDEEP 12288:NFqi2VC1J7Zs7a5zchr46CIfsyZmGyYCqeCF:NUi2C1JdoiEdmGyYuI
- TLSH T19ED4CF11B5E3C473D0B201B5480ADB3A9A7BB950463898737BE60FCE5E787A1FB17252
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\kswitch.dat
- Size 37KB
- SHA256 c4971d66988b5e3cdcfe0d5c9102b802bcfb40a4876d9f88b1b9325db5da0f89
- MD5 acd829a376f5c0b527c08208e7ceafef
- SHA1 c9558076ff8d4d18a454d1eb67538c19765efd51
- SHA512 e5d4211a6148099848ed9307512560aeec98ef3e6866382a8258edaf68d12aa8d69c40b44ed35777c80818261868295d321b41cde417dfe46be51c424a305583
- SSDEEP 768:7M45qX86mOwiii3dmKqFoAHtOkq7uT7wQ:7M45qX86mOwiLmNHtOkq7uwQ
- TLSH T17303AA86E16453BADFFC0B6C06A51E0CD3ACC8E1693BB8E663E97794C2B37116D43548
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\ktaskcfg.dat
- Size 19KB
- SHA256 5a8432d84682884d382291fa8825ca7d1ba441c48680101fe25f786e57c7e5c7
- MD5 316b8dcc799af729eea4977fa14170a4
- SHA1 65f5b7719ee7f4da17ecb7bd739f10abc6dd94e1
- SHA512 3656d756119def066c97b068a4c29329d124376492fbda9f24ca9bfb20ca933d8c2cdce096753a58759e476d8de0b0eff313903d206eeb20a26be9d7ec67690a
- SSDEEP 384:XbwxBqxTVzcQxixkIMAKJ1a4ek7SZcz54xr99QL5UQhnnUUAefaaxJMNt6exFmc:LwxBqxRzcQxixkILKJg4eSSZm4xr99QE
- TLSH T1A39200C67181C7779E656DD40A293C2EC2B4FE817B2BBEF717AC395112B3E36A441212
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\pre_update.dat
- Size 1KB
- SHA256 24379bff1dad42301a608f224c12451a41aeb1318036466f2aaea1bfe0299fa3
- MD5 5e72735cda419219155e1bd0eb7d2ae4
- SHA1 b73050ec18e6f15538493adc34e1125c5437609e
- SHA512 8a1073af3e61d8a9f8b88a1c2de2759ae2088f1ddba51cc06a81420fd87d9039d9405258a35005a77a224fef54cb975e2b136e9a8a1b7fa3525d7e7a26b9c2d2
- TLSH T123214907D19B4CC646EB89A2C7B62B04E9609C0737080C3A9A443CEE22DF7773619E1A
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\framework.dll
- Size 2.5MB
- SHA256 612384b99c9c82eb3effd69596a27baf5d63023cb182912d091cadfe69ac5e86
- MD5 85d0b8d13f9221517102211893af9bb9
- SHA1 424c551b5b7b346f61197ce73d0060581d2497e4
- SHA512 e927ba505aa7cbbcd7a1e4caa1bbfa8764842f70b54566ed0451acaeed9da3f77afd21cc02557ff3c6f0090dcc9f2c1df5b00f98dfeec1cf390f9c8e62c3c48f
- SSDEEP 49152:FwfGZBkBzMCa7hrIWGH0gEa07a1o2U5qfhf/Z:FjZ6Bzq1IWj7a1oW
- TLSH T152C5E7213AE94739F6F70BB899BD6A56447ABC698F21C2DF0258540D0D30AD26E31F37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe
- Size 600KB
- SHA256 ba5a5e52c3730300306e858d7184689598ff4c9634bbac89b1d1ab72884c5657
- MD5 507650afcfe66dd30419cdd5f171de64
- SHA1 616cdb0df878a2f6cd13c8946146cbd872f4fa02
- SHA512 2cccedebaefed9e1392142fc930ad1b03b30c714c94b3b65f64bdc391e508908655ed10c6f9877e2047660cf3d7ca5b5a826305e444cb9731b5d94cad5c950bd
- SSDEEP 6144:Joe8iiWJOC6p6jIaC/cba1X8GIs4CV1e8GrOhJMHqSOnBq6/0XKHWOR3EMMSzM/0:JoetiN9A3IcbmMGBE8JCx6/RHHEMMT
- TLSH T190D49F13BAE27076D16312F01E699F6AD3B4B45267208A4773C4570A5FB1852EE3F3B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kcondition.dll
- Size 243KB
- SHA256 01ec0e4d85757fc0c3bcc25a6896eebb38b5f7d6e8bd89e15644154fef593806
- MD5 7972574bbf98902712dc6a7013d38df1
- SHA1 57050aa964fe21c8944344782d4bc69ba96abe04
- SHA512 b2bac22859f0b793dec23f229dbbebfee530a425e7d6764c3ab1e1e0ddc0e5feff410cfd4bb414b17572892cf6162227f0856a25571d11b7d935a8d811162ef9
- SSDEEP 6144:GO5DGVX1mAHc65sntJRiIK4xYM2Z1POt39ao:txGH865SPOPOco
- TLSH T1A7343A713A09C53ADA9D0271A96D9B6F51BCA7640F71D1C3F3D9AD680D62AC31B30E23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kdump.dll
- Size 285KB
- SHA256 e3a2b33a035ec21bcad3263078b6358d1428cb295b0083a498f24ee6df808426
- MD5 7a060e14ca7d69984e98411f3f5f4ef8
- SHA1 4793266571a7524be3ee55781357d634847cf686
- SHA512 63b497c649ff8c57d345a34e0c14afeb4585d462d27f3e63b6ac46c7e68813d326d584e71d5251261e17b7ca8e4512f2cacb0f7331c7006f3f4235b7babd9d2f
- SSDEEP 3072:S7mAEEnp4XUXzNBAoAuCRdM9ZR6ZjmDhTTBOFkDydWJS9IZtorYQiUepGSt:S7mA1ksBouCY9Z8Z0OLde9
- TLSH T133549E2239C5C871E5BF02769909E72863F979309670C613BBDC0E4DAE76683AE35347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kdumpcfg.dat
- Size 2KB
- SHA256 fe792bcac6a8073ff3bfa373ffe60bebd1b0283423c5300da306e274b01887ca
- MD5 97bf5952fd3d6c7a8d070a1d2a324d70
- SHA1 cde187156bfb1d952600e36d96e53b53913d6479
- SHA512 8fc86adf3500916ce40ab15a275349daf2b1598cef77c917d7d355035be679fdb5d4b33cb08d9b0ec56de3df65d775fe57f45578eebd02f82b7a6b30c0cc52f0
- TLSH T1AA418FC6CEB77299D6011429F2700ACD3A8B62546C7A43F1729E1DAE5E8ACDD03AC58C
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kmagiccube.dll
- Size 364KB
- SHA256 802b09190e1841c79f83c427b44df0f05c5917d976375e1f2cd6ae8569340806
- MD5 1b9664233cd039cde7d6154cc51745a8
- SHA1 0e00c44aaecc8e01d8803985918e55c1b089d8ee
- SHA512 b068b13c3e05658eff6f57d131d8ad6355cc058dba5198389768443340a28094276b88449abc0a97161d0aabea7434cdbaf1829976497b27dc0b1c7714461e29
- SSDEEP 6144:/V6bpwKcdu8Q4G1YK49GmE0vQm/AO4t7cTadVK:wFwKcdu8Q4G+L/COGdVK
- TLSH T1A884AD12B9D1C036E57F0634686496A01ABEB8711EB6C99F23D81D7F0E717C0AB24B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\knotifyinvoker.dll
- Size 246KB
- SHA256 3fbf6e9fa0d9ebf3937bf51a69bfb65152f70097ffcfe5efefb6a5988ac0f135
- MD5 f7909a9d71fb865543b761b44dbf5f5f
- SHA1 60fa9f181c530b252a786c0e6d87c29f755529ce
- SHA512 ea2ea90541b9f22eaee2dfa8d9c4ede4d5415794557d01f94d48f9bb0f48f7ebc50ce55e7bcabf182b0c525dc1d7c47a99b9725ed5d580414761168599d98dc7
- SSDEEP 6144:2BaDHo3MIrONzMVOPeUdNlgtg7gnUz0wBY4B98:24DHo9MMVOGUwcQ9YJy
- TLSH T1C7345C2237D8483DE2FF0335A85E966592FAF8701E62C18BA3E51E4D1D769C05E34B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksapi.dll
- Size 215KB
- SHA256 752cefc9d07d3e7b8f7b88533c1b6dda27d7c3ebfc5b53ae00800e0cbe6c3f08
- MD5 6ee67c442fab21c5708a932f89842047
- SHA1 4377ffad2e97a76833e15f7575b7ac5beb6356af
- SHA512 78b505cfca7b1ce1d009a11700d25862e52109e35ef49a42ab53083e00897f4dc9b3f954451801ed79c6b8855c3b9a9d3af23d04ee15c0f974c48b4c6c2dc31a
- SSDEEP 3072:CgggzNuOW76EHh4RbTvCexB89X1yXlF+SQv3UnEattcZ0j6L3hJMzLjkt8NyxPxq:3XWPhufvCMlF+eEate0/+8NsEmCr
- TLSH T171248F5079C2D472E6FF193049AFAF2E12BDEA644F3489CB23A40DB90E605D36B34957
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksapi64.dll
- Size 209KB
- SHA256 8d40a06eedd2e8bbada2793c28abc2da33c4b0a1c73379009741f386449da4f2
- MD5 22d3d227800aa754f5a62b53830834cb
- SHA1 63f943776072c045722e2a5da0927f38958f4a62
- SHA512 042747865e4898f6483bf8df0ef127ff8f2ed8584597ed305401cb2ffa147d79db379a6cea53ef4658855d91bdc0ebcdfcc2350260d8b3f8d21b810aefe425c4
- SSDEEP 3072:JxY8MZboRKMt3XLWhPxiNWNSpf8FONOOBii1DS1BCRAcdX+iRf+Ym3OuMp1hxkhL:vnRKMtMsPNhiimkSc91f7p1O3y
- TLSH T1CB248E51F8C2D0B2E9FF153045BF9F2617FCE6644B248DCB63985DAD1E203C1AA34A66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksapi64.sys
- Size 104KB
- SHA256 76c9a05e9846579bacf4c08098dfb97619ee1eb6ba3d8823bf33bcc8a1d540b9
- MD5 40a824974b834bc7dcd862d2c1ad2ffe
- SHA1 df1e925797eba40012bd162d6ca102ae58542277
- SHA512 6d83be594aa759aa2ae15e13f0419b933594a45391733c578bb2cb5552bbd04ceb075a762613eb37d69972cd1285e888f4d74e5be45b8eab08969f1288e15c70
- SSDEEP 1536:IIpA3w0hYgrmPMS7DJFrUKTo2Z3Mc/bmhxXGn6Tcr9uYTXuz2NqIGyZ:nJ0hYguMKDJFY3WDk+6Tcr9DyiBr
- TLSH T134A37C43F2A806EAE5BACAB1C59A9613FBB0B846175197CF0360C8591F137E07E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ktaskdispatch.dll
- Size 200KB
- SHA256 ecbf6f8fea9c109aa276f526738b2f2e78377b9625cfc690556d2b5c6b508a10
- MD5 7fdaca2466d1aa9c5d4fada32fff4d9d
- SHA1 b00e74792183460f9fa9274d40a77319aeba3917
- SHA512 bee45f0aaa28e7b9ff7b290d974b6cee02a5b753d634c48bcee2b5fa131b7832fca7b051feab4e61b663a7f1da496c4465793b68a21dac6b122bddb627d1969d
- SSDEEP 6144:MdJ8kqHDrkGcpwwbXi9NVW2KhgyYX2c9USTptSNXsIRp:+rbXi9NQdYGQX21Rp
- TLSH T139147C323B54843EF3BF1376689A2665A2B9F8B04F7282C793959E4C0E745C0AF75613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kwhrequestor.dll
- Size 500KB
- SHA256 1d23ca195ca248e9960f5ce7b9c27eec129fb23fec7549a20f2bad545d7631b1
- MD5 c8173294d2dd64f6e7d5785367c22ecd
- SHA1 610e5475338329c2ff958b29ee0dc4395b983e28
- SHA512 78e799fed2beea7f1f20844ff28c4939dd2493b2dcc0184487378c854216cc8dda4b2e4f61b00dbadae3a02fc0ff5a821bba008d1f83c74b33e97b6d14eebbcf
- SSDEEP 12288:vGApnCpBu/48OYHSG20cQLtZQDajJDAgZ:vGkn4Bu/48OCSG20cQRZQE9
- TLSH T169B48C323B89C135E17A0231292D576D52F9BAB24F7780CBABD51A5E1DB09C26B31F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore_sp.xcf
- Size 87B
- SHA256 eb09cf1094904f0d3038ce1e981fd4366eba4000c8b6f13a3dbbaefea4797e37
- MD5 47f61d0f7bd830f5bfe72c3b65941fde
- SHA1 d7f440877e23679fd2c480dff2b8f3219702d681
- SHA512 d234f17af1440aba1a4f6c2b24d04fdeb3a685f25f391cdc1ac048dfed1b470689bed5b21d7b3db94f9186445932982f462bbee8af919c1a957ab89bd69e68f5
- TLSH T1BAB00205D2D553FC3411207C6DC30450900E20D5C878A5425692181501D2A5A299F212
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\pegasus.dll
- Size 118KB
- SHA256 7a45efcc821f820daf4b64ac8ebcbf2958564b8f61be67c26d287c791eefd607
- MD5 0d458fad9b1327c663b4dcbddada4ab9
- SHA1 18fd89cfe1a67a5a25016310534d62c1ddf397d8
- SHA512 b8ca7f5cbfd0516881f6c79d249a7042b0ab674a192f04b3a53b1201c3bef1008c2574b8a6f110fc921fadd417a5497bc0b52202f85924db667f00ffca6d26b2
- SSDEEP 3072:Ik0vdAdIGEa0C+etaHhalKxGc7xbik22dFpAOgTPG:OvdAypanaHhsgGCGkRdrAOgTO
- TLSH T140C35A12B3E4403AF1FB277E68949B28E777F560AD7085036768438E2F387929D71653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\delaydownloader.dat
- Size 25KB
- SHA256 56e3ddcc77889a68303657691d59a50cead561cd4c4947a94257772ebd47435f
- MD5 5d5a9030f886fefa684f23e22666bfd9
- SHA1 a93bdf199c89e4d2eb5986381c9e20a306160556
- SHA512 c0b884d75fc702266d2e1d183e591e5cbfdf72db14ff93beae7ff72610a411bcd69aba054eef735ef3a2cc1a07c7791de97013d3304fd91f4c43f6399de664a1
- SSDEEP 384:uNe7HaEW3dx7pBOZ34dTGMXVutyAP6bl3m0jgP:oe7HaE2dppBO14dTGMXVutzP61m0jgP
- TLSH T163C203657C2A499705FD729CEC9C5F8E7DCF633B8815F94452E842E215E0AA232ACC39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kfccfg.ini
- Size 3KB
- SHA256 ca19b121b7f3827fc51c212dd59f6e177e0b128a5f18c9bae76ea8392551a0e5
- MD5 d6ac64098f33cdfc31b2e1244eebc501
- SHA1 f1a40359dfc48e490de276609a98799b89ee01f7
- SHA512 2dd74d071ed04e6f84c2a36d59564b45afb5d18ef9a6f0bd0a71aa0d5929f95eb9b912def84793270690b3347a8d534007e8c61ee2e3ba27c7c3a8c659abd51e
- TLSH T14C517C1F5F88E8D5D2B2CF93956E71B7C5AA0FED674033107E091426229310AB81C271
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kfcdetect.dll
- Size 1.7MB
- SHA256 5598962881c515bc1f17ef36bccab1db15e253722a173e175752dccf580b4eb1
- MD5 a4c1443cdad0af13cd9a98bd6c40fbdb
- SHA1 763ab39dc59f83c80b5f3a5619041919c830e342
- SHA512 8b5806b3ab07f32db0d66b1089e299bda105f850e6ef669ad394489ac68f540794af790230747a89a4b63ed77680ac5df2006507830f4248e107c37bdfa10438
- SSDEEP 24576:Az6b7t6q/ZYHawkwvB7Ak1D0TiraAegmAQuhsZ+n+5p3Xv7gwN1QQoMkyvNUMsk6:Amhjunm2wYCgm6LnQTgm1br7vNUMj2
- TLSH T1C6853343AC0B40FAF81986F9767672FA9D7ABD14AD744C42EAA47C8CC735D302D9940B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\ksbwdet2.dll
- Size 966KB
- SHA256 d98f3c2a4c5c1d10ab4d2e151dfe94b799de6f6cf5c5151aeb5f0303d52181b0
- MD5 82256fc418d33c76d66b407422827849
- SHA1 ee8383aecb4709395bd2f9e8b5852620813ef6c9
- SHA512 1f46a8a8dc3bc43dc65987743d5b79c52a1f1033baa81c35d74ec5ba3f2491734d852282787c50db7260b761fca643d78a7d2c901b3966b48594c2b0f6f74f76
- SSDEEP 24576:U3qlpfl9t/xZKcdzIkG23EmEgZGeT4KiP/F9:U3qnl9r4czkEGeT4KiP/r
- TLSH T108259D227EC5C439C69F23722D2DA36F76F7B1508B30894772E04B5E7B38A52DA35642
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\sqlite.dll
- Size 373KB
- SHA256 5f409db44c8ac37789588ba0532a62de71e2937ccf867912e2482e6662ec0478
- MD5 100aa4ebc2c39dae91a299ea826fa008
- SHA1 0a18933954044758eb0498f0da673a40566c9b7c
- SHA512 a15f28b367742be7228d109c4c2e9d6a5cca11f1af97091c71f879e02681f9d350c87e0fa1d035e40beabc608166432e042a33b7e5c95f23d83d181a3a90e399
- SSDEEP 6144:rJXZpOLicK3P7A4aAttan6zMvr8f8aokLNbTdsOPCr0iMDrSgdw4qqDLuOZ:3pOLi1A4un6zMRaNOOP4QdwdqnuO
- TLSH T16A84CF13B1D38032E4960471819B5FA65EFEBE116A7288E7DFC808498F216E5E73E357
- MD5 SHA1 SHA512 SSDEEP TLSH