8af63cef70db7c35f5e48fea62a99db9be03995995fa3e9d99e11d88e9c56f24

Analysis

max time kernel
104s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 15:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Size 5.7MB
Sample260702-sgesfsdy2m
SHA256 8af63cef70db7c35f5e48fea62a99db9be03995995fa3e9d99e11d88e9c56f24
MD5 4bb509347c8147f371e6a2e7927ab32e
SHA1 10784694ca6f778c3a1678107283fcdbc6d58574
SHA512 aa96e7020679ee4e188bf93df6a18d2d95a15a412da4d1c8ba6d8861dc7e9b5dec69ffeb17eefcf3a9bbb23df599eac3f454768b205f435fce6f9954c182fede
SSDEEP 98304:utSuMOINjO91x364DT+Tx4NVMFb/55PU/yO+0xTQWj:1MJtM9/5RwS0RQk
TLSH
T19656C001BB85C5F1E5D201B0597AAB7A983DBE28573088C7A7D11D2A88312D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
5136	elevation_service.exe
3664	elevation_service.exe
1312	maintenanceservice.exe
2356	OSE.EXE
5988	PerceptionSimulationService.exe
3336	perfhost.exe
5716	ReFsDedupSvc.exe
5724	SensorDataService.exe
5832	ssh-agent.exe
5436	AgentService.exe
3960	SearchIndexer.exe
4100	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
3564	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	\??\PhysicalDrive0	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
File opened for modification	\??\PhysicalDrive0	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b0be46c74a0960ed.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114578\javaws.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000066b3434c340add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8c5b64a340add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000073fda4c340add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000051a8754b340add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094762e4c340add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001599bc4a340add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf543d4c340add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 40 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\OemEsim	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\TestSignRoot	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\FlightRoot	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\TrustedDevices	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4100	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
4100	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
4100	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
4100	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
4100	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
4100	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
4100	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
4100	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
3564	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
3564	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
3564	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
3564	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
3564	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
3564	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
3564	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
3564	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
3564	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
3564	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
3564	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
3564	4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeAssignPrimaryTokenPrivilege	5436	AgentService.exe
Token: SeBackupPrivilege	5716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5716	ReFsDedupSvc.exe
Token: 33	3960	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3960	SearchIndexer.exe
Token: SeDebugPrivilege	2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 5748	3960	SearchIndexer.exe	99
PID 3960 wrote to memory of 6076	3960	SearchIndexer.exe	100
PID 3960 wrote to memory of 4400	3960	SearchIndexer.exe	101
PID 3960 wrote to memory of 4968	3960	SearchIndexer.exe	102
PID 2828 wrote to memory of 4100	2828	2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_4bb509347c8147f371e6a2e7927ab32e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828
- C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
  "C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  PID:4100
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -checkInstallEnvironment
    3⤵
    PID:11196
- - C:\Program Files\Kingsoft\office6\wpscloudsvr.exe
    "C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService
    3⤵
    PID:3692
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -addFirewallRule
    3⤵
    PID:11796

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3664

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1312

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2356

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5988

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3336

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5716

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5724

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5832

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5436

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5748
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2812 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:8068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2812 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:11432

C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe
"C:\ProgramData\WPS\Installers\4926780c5b21ffb906fee7e4a0326c2a-22_Personal_Office_i18n_Free.exe.601.1304.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5AE2B0 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5add23\
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:3564
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -setlng en_US
  2⤵
  PID:12340
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -getonlineparam 00601.00001304 -forceperusermode
  2⤵
  PID:9724
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -getabtest -forceperusermode
  2⤵
  PID:11016
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe" -fixoldversionassostatus
  2⤵
  PID:13892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c8a453f8233846e729f46e894da6545bdff96df25df9ad497f6c871b3e73ed87
MD5 c1f7c9b87aafc4796bd23b489371007b
SHA1 88ec9cbcb2e44c2a52b54b1b6fc8bf6ee4cef6d0
SHA512 7633cf5f7fb96bb419d94bd183faee5c4b8638cfdde09cf07e4f7fc8449910712e0e8924e4b3fa103596dfb02dfd3ff2521d1dfc54b8989023dbb34b283045cb
SSDEEP 49152:Eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnX95MdTAcQQfjP+:+3q6HjB60xTQWj
TLSH
T1C0D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 35fd221b51eea1f829cb6025b1cac9aea956c2a8d9f998b3f6ff72f7c8894ed0
MD5 ce80891780fc0d3d3fa2718cac8bd5f9
SHA1 6b7457caf7104ed15f7a8f11647b1bd88a3136ee
SHA512 5a4e17c4e63a6f0706a8426aaa927d155f68fd0efa00a7941a9271a426b4e4d1267d1edd6c609f63fbe28884caba908864762fbd9c0096e55aa10da3b17ec589
SSDEEP 24576:OXYfDtczAON94AMdTEvcQFuOjOP95Xdt5c:NtcV95MdTAcQQfjP+
TLSH
T16265F12877D508F9ED678278CCA18115EA33BC514B60E78B03E48A6A1F337D49E7EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5b4b1fe41f155b6b01501f83a0a09e65bd8ee7ddafac85adf758a45b0784de17
MD5 ca1de51a828f5404954eb087101feeb9
SHA1 789a0c7528fe0f8228c77b6e49931fcf51813ec3
SHA512 874ef2b3c447bd1f5f1b9618783b6982e8831359b616c8fff660f770d820f2733bdbf11083dc827c068763c36f0b35670e127f76ced7714c87fe7830a997d7d2
SSDEEP 24576:r0Le5ji0hmxirMpN94AMdTEvcQFuOjOP95Xdt5c:rPji0Acw95MdTAcQQfjP+
TLSH
T18C859E15F6788335D073C0B9C5D2A69EED7230825B308ACB4286D77C6E67AE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f1b96a0f97f7fb94832c1dd0cef2fd4c7a833896d999b1b4e33848074db7ec5e
MD5 726b57ded289f48f91234c1fc0e0abe1
SHA1 52e0d7130384abbcee67b6213cfb072993e862be
SHA512 a7edd64b81eef7b27f288830993c6bf96fa3daace7a9445ec028519e08efd24faa389600c5179e3c25c90b24fa5aedc067b40371918ba623ba6de522a62de3f0
SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWE6q8wyuPN94AMdTEvcQFuOjOP95Xdt5c:u/ezSC6vUzPvxHjyc95MdTAcQQfjP+
TLSH
T110755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 03760c65fecf422ac06169cfffed8670b47637525bd28390ef762447c4d5c8d5
MD5 13ca6108be28100bf500a60b426d15b6
SHA1 c2fa2d26ae27abd763f9cbb437b0fc355a37c890
SHA512 289519012a4201c84a7f4e5223866ad943831285fee81b0737c03f94165fa6edfedff610e1f056694bb9080939596e076eeb4fc2040dfb665cc43245d01d412c
SSDEEP 24576:VVbqPb88hv/l+6qN94AMdTEvcQFuOjOP95Xdt5c:VVO88hXl+L95MdTAcQQfjP+
TLSH
T138559E66F6748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 efa21e2d30649721458096a4ae7172a1811c05cc9ce8e59be1d6472744c567fb
MD5 6b814324b9cba3f0ac1ce67a0075556d
SHA1 f35e2fd43a7093a9b0d161679f2538702e0703d9
SHA512 e12a0318077a788ccf3d7594e172d5aa589f0c6803643950aa6ffd6eba247120ddf7e7fe45bf36b4fa0e19141d6b2863af4d7f0de45f54fa1e207a48e4e76c7d
SSDEEP 12288:jRFqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:jRFN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1444523653F8DD0BAF3E719B05CF880686D0B9F518E41964F53D25FAE89389C2D6E102E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f9e571209d310e9aa366eb6bcf6c845586646ef99ea7033394277dcfd3f81b4d
MD5 ca21c25890a9f362bdc82cf5a486bcf7
SHA1 36c01d6183a81b4f918fc078c696c28dc5a160e8
SHA512 4aaa12808d6999ed4706380facb4a5ee5a19f96e1b36f9632195f3284907e35761e0f15d02f9b9edfa4b7c181783a5aca97f5ae7d71f36c99e1ac97e5160537b
SSDEEP 12288:7eBNUbTVO86UiqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:7JIUiN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T15465CF3BAE28FCE2C27A5DB85A91C240E77278704F52A3CBD165830EDE235E15E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8a2f3e67760662b2100f6687a6042a2df16745655802d8c6eb30207ceb58b6ec
MD5 f542e9ab73d63838d024b0c074141fd9
SHA1 cb300b673110eb9df260d03651f6867419232a01
SHA512 466468710e714472910023a3cf0a14e67bfb32d381ebc17b53403c5e25860ab4f4e7931e04c014ab5d2c8e8b83d7d9e39903683f8b4aa46bb1e32f79c2e5a310
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THa:8QvGAdlCEL8c/yRNw5C10xTQWj
TLSH
T1EE266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 1b9aa590527e0b5cc2a31005adf12f8dbed49ad1d496c0610796e198d288e73b
MD5 ae6c6b0fcb0b167a511877dad0765701
SHA1 bda59b819fb99c038e3bef1c074e864ece709415
SHA512 eecf509d83b76e6acdbddef217649136dfee330595ed2b1b3236a76a82132b6006d29a647eab7ede0b419ec0aff109b8c977cfc44609a2d55d2b32db48ae8643
SSDEEP 24576:tdewsAjwN94AMdTEvcQFuOjOP95Xdt5c:DljA95MdTAcQQfjP+
TLSH
T1F775E031FE75E036C2BB0DB21B75C716182D7A204F511AC3E3E88E9E59342D267B6A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d04534d0d90a0a007f2c2b994f22ec5f07e472b15d67187c97beac23eccfd974
MD5 b0f708eb0bd9b29c670b445aaa5a4e2f
SHA1 528efaa19a0a22d38175b911a199c428f7f6cb59
SHA512 60068594446888235de4a661a959467f0d276141547e93c8be742df8eeaec299fe7069c7751c03830193747f7427257698e3b5c77eb9a4f0acb44ca084c42524
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHY0RQk:qUEtQevvqc2W1cpV2EI32Y0d
TLSH
T182474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a2af54c93f24f2e3baa54e2790d823b1b282bcc3b5043bbc15105b6ed7959d36
MD5 5cb8223838f543d9f2b68d46940ac57e
SHA1 87bbf2c4a757a80ed3d86ab82c292eddfa4b84fc
SHA512 84c54c9e4059f8d8cb7f3a5750d712ec3cc9a907ea1a7bcbf0e7ed011ca4d81180f2386552ac8900de9095228ae5b0266def922be06ff576719e6f619c4cb4b5
SSDEEP 49152:VCbRquA/m2yL5zTfFiV+XenmE3/zg95MdTAcQQfjP+:CoquVjnmx0xTQWj
TLSH
T1C8D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0c2749d21f92f687b24b4f9dc770f3e739373e245d2f16e1a681a900b4fc7f39
MD5 ea8ecdaa14b95e909e8fee378368fa31
SHA1 119c717c90bb14dda628960d54c2edbc36054a29
SHA512 c03e21f83c1b6ccc8b5a2dcba560f2aa46758280518779c7654528b4f5e43b2cac9ec38fd1ab79d8d0714428e51fcb628b8ab237d1e04d4660d9a59f26503cd7
SSDEEP 24576:7AhGLJIFoiwtA5l7S53zN94AMdTEvcQFuOjOP95Xdt5c:7AMyFoiq5B95MdTAcQQfjP+
TLSH
T1FE359D81EBF955D4F5B3AAB899B68171EA76BCA65E31C20F2150D11F0E33E809D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 d8d554d27cd2f6d8cfc5b9ca1cee792a097d04f5bb47b13b231154886aefa686
MD5 f6977aad6c06e6cbd2565a156f76559f
SHA1 04490efbcc45ddb38b5621c786f40be5cf7220fe
SHA512 99cd89d9aa9dbfdd4c7074bb91d0f96f6241bdad6eff7b63be5b5ca79fdf41f16d118c6262ba1c9e0f4909aaf9471810583c2e1eeac2bdd3dd16ce5d1ae787a3
SSDEEP 12288:8mw5HEjsChNVBFgl0WDm+CvqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJs:5wuoOWEN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T10F65F14937990CF9E9A786388597C136FBB2BC022A21D71F17A0C65F5F37361AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a470ad318a75a9052dbd826a1c799f60e615a5feb2338d8f472a944f497f565b
MD5 f30c176a42b8d39de4de9a66bc2b7531
SHA1 99784cfa090dcffb8cd53fc04636f4dc7ab68966
SHA512 8062ee48c618773137ef6507458346dd82ab0aea92be1bc3feb7b555dd23107ee3d8ebc87df2d750ebb5e7d5751f177d8be425251922fad6e7c4d496194d5871
SSDEEP 12288:DBZ1IygqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:tZuhN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1C65512593BD860FAE1A35278CCF48115EB727D525B3243CF13614AAE5F32AC29E75322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c18477d2b2c31eb22f1810ff7b4d37c621a61a2cdee7654718d4ae4a32e82750
MD5 09ddd34c57e59dad69edad24cce6098f
SHA1 27b58fb4cb5fc250121814cf176b827b5045873d
SHA512 eb846569007a9f05000f79be86fa14443b0f8823df92e58a7ea9721c8f6a01b38517c9a9b6c06c13ae7c7b956b8fc03c1e97b6370da46626fb29982bb3fbc567
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:jQRQyi36YOcPQLvw2gAf+PN3u0xTQWj
TLSH
T144667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8d56b700a3543e37afd70b0c9af0f6aaced57c9842b4b4fc499db2ca1778d547
MD5 45b7c5eab94e2844953aef46e42734ee
SHA1 077df70e3a8b110f7d82d04dbcf140486103c763
SHA512 2b67ddfee93053a8ff4398cf9267a3c92413d9ca6c56686997b681e33d7257b0b49229b5af728a0385a7860421d469cceaccd9e1349cbd1ff0e3d3dc1eca552c
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:YQRQyi36YOcPQLvw2gAf+PN3u0xTQWj
TLSH
T1DB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1f8c9f1a83c65e6dbe18f89815cf2aeb146949a1c7646dbece603c50c0f1b808
MD5 bde8ea90d53d157be3e7a27385bbf4a6
SHA1 92c0f60b8ea39088681c81d4df6ebb618f19ec90
SHA512 83d8b9c0eff754adf9332334525b31578d53071f94b640df4d109a6b9ad98d7ccb031ad5c70e9550381bcb2e5a1262d49aec6dfb9d576729a19daccf42686f8f
SSDEEP 49152:968Qg55nhheWu7PNU3/w95MdTAcQQfjP+:7thWRc/w0xTQWj
TLSH
T1CFB55A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bfab34a8e30d5205f11080ed5381a2e74f74196825eee28de288a9310430b626
MD5 1ca4bf8fba27bb37f7eae7d2053285a8
SHA1 fdb1192e5a5a7069338c4bb00ee28d0227a0c6c3
SHA512 6c40eb434ec106104dc27249ea386458965223aad7ee881d0235eeab3d36f0b70998446ac512ef8bb6996797bcfdada601c0564324fc0efa3c92235675f6a9a3
SSDEEP 49152:53aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99o:oy5112gYy5azzVvL69nLKnhZj0xTQWj
TLSH
T1FA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 06be4efd3f332beff4c57fc748bb4f1cc73cf77999f089c5812ba6abb1639579
MD5 6d111129484e542b7e9b75de473a928d
SHA1 b5d0107e6c5e0b2a422f3c572814a037a4ef6634
SHA512 18d459e87e302201d3aa60b8551bdd396164ad5213fff98c4fc74a1e7c1dfb8bad5a8ee0e25d3fdb2fd9bea782735b73a92902b03b136c9df71773852be49a6d
SSDEEP 49152:yB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl295MdTAcQQfjP+:Au6JmVxd2d20xTQWj
TLSH
T19FD59D13F1DA01E8D06ED478974A9233E962BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0062b4620983bd8c721f33dc523d91e226f7544d53adfbf1cd8e4f98f0b01a3e
MD5 15b6fc4158a38ae8020327d61c5d37da
SHA1 44c493455919acb9169c131741ab999a59ae5f4b
SHA512 06558a756b89887c60c3ea21f310e35c349089a6ba263c876b61a6bffca46d32f82ba21d7b8541cab4de94b0f3aaf7031e988a844a16ae72872c6ca6f5da2525
SSDEEP 49152:F1hpsNoJpF1A6UU44CwH7R4xy95MdTAcQQfjP+:FmifPbRx0xTQWj
TLSH
T15AB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 469b7a5c662b3649651cc392396615f7dbcff3caa75650828959c4ce6e020a35
MD5 2be02e874e04915fec5321efc24173d5
SHA1 88cd0c42034dc2eda2e328559010ae881233fe9f
SHA512 58900b534d46b9db6567d86554a34d36c6784f451864b7652f4804712de957d0f19b28a88bc16776dfebbb8d434cf17f6323140bac6b5f2023bd5662d807cdd5
SSDEEP 49152:lSuZQIY0Be2KRRVtOnks6NMHqn95MdTAcQQfjP+:r5dKTi61n0xTQWj
TLSH
T1AAC5BF13F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 68b484530aeb26c92d019f61ea8244271a32fcf4efa12ac73b81dcc278de1f90
MD5 e43ec78ba048110901086fe236c1ad19
SHA1 39c62a5de442a31bf55e0c63f7f6ce7c9e4f622f
SHA512 c6ee1266a9887c1eee3ed8ffbd4cfdacf1ef7e92a4b6423dba9c6d044d38d3489a8c34ac6244c2431d8ad8c5e72fc859b1f8342b739c4af11c973f72121e78d7
SSDEEP 49152:VhtSn8EApI0figngiDn0AP5wG95MdTAcQQfjP+:kX2iypht0xTQWj
TLSH
T1EB95BE13F2D900E8D05ED174C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7058af8c21c1b93e6d0ab0fdb685dd60645b38fb3e39ccd4ebdbec015b2fc501
MD5 5cd67d0f813bf9bf8cf3d19bf32bf722
SHA1 88cec0db786d02ae066148ae49bc599a772a558d
SHA512 abb402a17843bfb2ceb007b35ebea1dfb82f1cfecc985aef6ac6ecbd6bbd08f1f207acdf7260df7ee31574ac4ff7d688cce8d571797a413b4bf140d249671253
SSDEEP 12288:YdqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:YdN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1294523643F8EC1BFF18615B08CF88168AC0E5F56DF42528F63974E6E8A359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 edb915b3a8d79473c50b9cfc7a8d24868e6e11a0d40c8c2eaa6fe7895b2db9d5
MD5 ae48a0bb1434eb56863fc1d704cd0940
SHA1 ba521a12cc244958312bfc56e5146d982a597da3
SHA512 0730e61cb3ab16fbeadb57f1b272c0f0f087db7eebe7777fadb75f6a7875097449d2d35af0ad07f7c1a260b5ed21132175eb97f7215190c15252aeee10cc7f68
SSDEEP 12288:hsqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:hsN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1C74523643F8E81BFF18615B08CE48168AC0A5F57DF42528F63D74E6E8A349D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1f9dd71c34e6e499c276e7b81e0ad48aac924df288eb52e7edb9fecff52ae627
MD5 043c4c47900e3306f0b8272b96afdaec
SHA1 cac7bd3084d93a44e4ab1894a681620f1ec4df01
SHA512 3f9c817e9f07e168c7bed44490e6d254b26d8d7204de610bde5f7b836ca848c659690bc945771bbd20d798bb7e87354475a106e20d1d224feac6a05728855cf7
SSDEEP 12288:06qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:06N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1664523643F8EC1BFF18615B08CE88168AC0A5F57DF42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 aa8a107ec26fec3be3bd349ae9ff6ecc0a928d023937eabc12957e1907d169ea
MD5 ce73b260e6f5f57309726e3d7d7c6e94
SHA1 2b4e20d381bc91eb701bd2b56d6779eb578b5ec5
SHA512 aa9b8694adef9d8bbe9662df1347b823333873bf20da2af21fcdc6d0e6903936235bec990c86fe910b4ba19357091ffb381319448c060981c6de013e079f565f
SSDEEP 12288:UVTqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:GN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T13C4523553F8E80EAF4A696B0CCF48164ED6ABF929F12938F57420E5E4E317C1D9F0069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e7692e7171e2bbc07238fbf91602554f9c56b1ce7dd3eaeb56b75cac12be9942
MD5 d79a1dba92e1963fd66e7de91a8a94d2
SHA1 f01671a378bd16ec621ed8a0ec0cb63a651096f5
SHA512 dce345aae922640cad384123eb9e0724ccb53b793604cbfef656e773746d8d1abfad2d06660559010ddd8096b863fbee1aa8f3681c4325bd5b02858e7e329a4e
SSDEEP 12288:37qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:37N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T16D4523643F8EC1BFF18615B08CE48168AC0E5F579F42528F67D74E6E8A34AC2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 19b6b0b6b835ebec702a2cd2d8a2a4f3126b68ba2ea356062963252c564226d0
MD5 399d10407a1d36cba1da0d8e07517f10
SHA1 68f1f6acf8658d27fa2621fd0d011d8ca70f7f07
SHA512 6759f80556a88d281b08448f4efd043596572c39fa87869426460cc8754957b5a511409bf4665f0f203d0182e2ccdfb9eb15af5320220cc2f1ba6203b875b11c
SSDEEP 12288:6rIqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:6rIN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1554523643F8E81BFF18615B08CF48068AC0A5F57DF42528F67D74E6E8A34AC2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 cb030f8271017ed256a408b3b7e4002388eb6d4b7a52328d09ce26dcc554b6c8
MD5 dd620a9f13ad3a6dd1ce5de91d131032
SHA1 0385d9a61ef05d09e35069f6979b3c7381d46a07
SHA512 3e2c840af46eb4cf9c5f6f1028c850fac2935d864133fe2836321afbb5cf63e32d61fc1d79f3cce61749820b4c7b8c4e468e107259aa14699e28070f550ca624
SSDEEP 12288:PUqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:PUN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T13C4523643F8E81BFF18605B08CE48178AC0E5F57DF42528F67974E6E8A349D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 c494c98d0fb3f4cd6e95497fd214a7c4d705fd9e274420bcf382ba9522faaa79
MD5 42c2781c31febd4619f5b3103670d165
SHA1 600dd2817ae51945c1a2950fb14976e291f23673
SHA512 ca06580fa1fcb52c8f651539bfb309e05acb92fc4db6422d7c69639d3bdbcebd8b6fe3cb19cf5da8d32446514ea5cb4e94610cd9b878b9a2c028840c65f2311c
SSDEEP 24576:TZMSzFVSOMN94AMdTEvcQFuOjOP95Xdt5c:TZMSzf495MdTAcQQfjP+
TLSH
T1E76502A4779418F8ECA38139CC658915D6B27C5A0B60C60F03E4366B5F333E15D7EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b99e4d1cc9997d6459e070f1f45b47d17b924beb0a592b0f114bcdb23ec22060
MD5 d7e75c227c8a1a4b3e1bbd428ab669db
SHA1 d205bc1211a81031ba1e36e50c638ad8c281c818
SHA512 5a8cd7b0abc2ec690a4d9e3601f1a35ef55abf6ed43c0a6430738ffda2c629f095ce2839a46d15d10888067f006e7bea4fe11f2a6029646b461d7fc7a94ac77b
SSDEEP 12288:jRqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:jRN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1DC4523643F8EC1BFF19605B08CE48168AC0E5F579F42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 98d8213c2c11c017e610867425ef8f90c095e72ab7d1b55982a8f842e967a0f5
MD5 7382b0a347456bc2295e156bdac03127
SHA1 3b16adcc011590c55a8197770c49f4d7df533ac4
SHA512 11f5b99a5ed36b945552c9679b49dcb988b10b083a1eab5053f67dfa66c5d356626c88ee1854e776945bc85e0ac277290ba77f2cf4dd182872f9b065c65662c2
SSDEEP 12288:u1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:u1N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1944523653F8EC1BFF18605B08CE48168AC0E5F57DF42528F67974E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 26ca7afaacf95f4c43bdf6a6befa359660c17919d6927687b728f1e2d5896910
MD5 457cae78e6d7671313e9ee2a48d2dae3
SHA1 fcfbf91534f96674eecb188f7030f89ed899982c
SHA512 7371a8d2b6e3a9b9ba17979e6cc2c50b49bd0691e9fa27a52ff4fb90201ddd317fbd258950a5120fbd7f4da25b12e9de1e684ed41fe6a50f79f790533f80bc8d
SSDEEP 12288:FyPz5L8gqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:MzygN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T176550217379930FDE1679234C8A14615FB76BD324B208A9F13A00B7A1F376D19EBA760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 89a0c3c9efb5b355574564e67515d1aca7a16fb052bddd58b6486e82496f55f9
MD5 7f59a42750eeb3c1304c4682d7625125
SHA1 b751ae7fcf07eebec79e6c68efd10158bf59e8cd
SHA512 0de407063ffa217e137d08cf0d98039684a9d70192a3e5e77c9962e4b86abd33ae16654d1e953fba630db2d2d4fe4b498025c8c4000296c7fc889ec26d2635f5
SSDEEP 12288:uRqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:uRN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1554523653F8EC1BFF18605B08CE88168AC0E5F579F42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f4980d872bdc39237194947071f338ce84aea4a34feb10b40e1fde905a5ac09e
MD5 1d25bef47727b9be30703eb8ccbea8fd
SHA1 910d3ca4b1907e2d55faeda669535e65d0156db0
SHA512 4435551f186aed56f340d69399856b43a3279962bafb72b3a7afaa21b46fa7174a8a58b28fd4bdb47995c5e60e37f6844cd8a983043d39fbde04edfa33464a0f
SSDEEP 12288:2RqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:2RN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1004523643F8E81BFF18605B08CE48168AC0E5F57DF42528F67D74E6E8A399C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 50d0b2a3f85fcf4e05ea5f430d424e349716c90af013cc364f47124039761b54
MD5 d6915dd7c1494fdb65b46ee6b3c208bc
SHA1 5572a734e69403ad04f8bcab744f0ac86a9d193f
SHA512 fb02ab23a9febd24f8bd892bb39087ab6aa7effbd1a0ec86ec00dc4e0d2a901697d2ac567aff40d4c008c065f6413d9f4eed4def7b702c02cd10e4eef4473a2c
SSDEEP 12288:TyPz5L8gqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:ezygN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T112550217379930FDE1679234C8A14615FB76BD324B208A9F13A00B7A1F376D19EBA760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 537cf31727c6dc4e628296af88e39e31d28dcf55b1505580584948829aa29fd3
MD5 afc79700201718d915679f6aad72c0f3
SHA1 267788a4300a89fe3839867098533460cd2bf645
SHA512 dfdd94c32dac95bc6c8bbd79fe003c56d35a3b50f366da1340a5a4ced96203c68ae1a5ffa8f9e8b95ba78aa76b7ff4e6a2966dce8f1fcd864fee4612cce664e9
SSDEEP 24576:MTHaLl3z0zDKN94AMdTEvcQFuOjOP95Xdt5c:MT6Lljl95MdTAcQQfjP+
TLSH
T15D6502A4739418F8ECA7813ACC658516D6B27C5A0B60C60F03F4366B5F333A15D7DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 baf0d4c2d1142f82d7d03071c876e6a6dcc896cad3e4d965fd71a25ce2d86af2
MD5 4971b0b8f3c12a41cb352e7b91ef6b80
SHA1 db15b965cf0503edc605d831db5b783f0d54c2c9
SHA512 40583bca66f3de55473dec576cc3f4dfda9c98853ff9556e9ec8bd1b10aa65a63c1667990dc0fae2a7d17d604d844b0d9d4d7b1888b40eebf3d4479fc8f2f814
SSDEEP 24576:l37d9CHKy7GZGN94AMdTEvcQFuOjOP95Xdt5c:F7d9CHKya495MdTAcQQfjP+
TLSH
T17175CF90F7E810E8F0B79A35CD768511DA767C5A1B21DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9c6468c9c1ad5e80853c30d655c1f46cdbf0450ec03de466c54c295b95c66acf
MD5 2baa85823a9616715ac41f7cf451f6ab
SHA1 3249a33b12200a6abd0e1004569110b529f33b5e
SHA512 dea34eb0fb627063808edc1bbe9bc35974d4d10a201404e36fe2c6f90325a46200ac4906124c89b76fc012141cc1d6f4a752da9ced57999777d2679915d315ad
SSDEEP 12288:BaqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:BaN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1AA4523643F8EC1BFF18615B08CE88168AC0A5F57DF42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9fc2a67d867bd557c6898faba2a07a345f95d01e4bebef350982bc896768c436
MD5 7656f9e4ba3955b14e1bcd9ce2127df6
SHA1 4de2769f592999e3ae32ce03e0bdaf0945ac1df9
SHA512 ee54c8aae813fc4a05a21a294b6b60c3b5b882ee71a3c787a1bf56cbab073955515708b31b2a3dc5be4b5349e5ecf178e770f3de39aa002204c8871466883236
SSDEEP 12288:vAqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:vAN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1D34523643F8EC1BFF19605B04CF88168AC0A5F56DF42528F67D74D6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7350b8cbc1e12ce752027577cf302121e8b4861fcd9bae90a198cf81be89aaad
MD5 c79ae76a84ea37b6c0c69787e4742ba8
SHA1 25faf5bb184d194bf5ec66c2327dc2c83267fbf4
SHA512 3e846f8bb1c985157b92b3e97669703a7e577563e353280eba1eb953e0bb61b30187e12e4a89b61ecab99fb18f83b69534e56e43cd9407f0c5e9c8bbaf07cf4b
SSDEEP 12288:l3qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:l3N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1214523643F8E81BFF18615B08CE48168AC0E5F57DF42528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 8a7c8538ab3e1c6a9e95811cdde5fdfccdb5f66a26c090b53cdd56d465e4eebe
MD5 413c1365503b83ab5f1168f428f6d591
SHA1 d95e8594321569ae654daf7a84ddb9a224a34cb8
SHA512 2c42701dc6ae70731081298dffaa0560c3e7c5baa67ebec0d11bd4a1ce271435a443734b75a0407ddc986416a533518a975342169e14b07a5427065d0b8b2d9b
SSDEEP 12288:bRqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:bRN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T14D4523643F8EC1BFF18605B08CE48168AC0E5F579F42528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 ae2a46108cb425be2222eb8819e55fafcbdf141cf15a78db09633b722896c439
MD5 b84f51e2b5ebe57351ef31fdaa78b741
SHA1 cef3f24f8b24c63213c089477c73445c16283765
SHA512 6c426ebb29ad2bde13f005e9c1fece6e31346589e18e71fb861d58c14fb3faf18491d272176d4b81e5a09590701dc601bb63a2d1b177711b3affa98d7c1538e0
SSDEEP 12288:/aqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:/aN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1DB4523643F8EC1BFF18615B08CE88168AC0E5F579F42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8f4027954ee3a89ed3804f934fd1822c2cb95a7c7d92d5295445d1511d9a0d9b
MD5 66a182c1feb97e84aeb03c9018257bfe
SHA1 d5fce41dfcad746250dd558b0f2449b0bf218778
SHA512 dc0c09b656b061f4409e7db152b017324fe6f51f1a305a92291d6edd7b91b207e177ba0e64ba1839e128d7b8442186226aaf51054ea831b0b815ea783f6f0582
SSDEEP 12288:a5qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:a5N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1124523643F8E81BFF18605F08CE48178AC0E5F56DF42528F67974E6E8A389D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 1e54701cf87a23a615b06c4a7dbf3a27eb631e563eccfeaa61b26feb3f2577eb
MD5 02fb394247e6917309a0733afd78e985
SHA1 2a48a094e7d8586e6e9c6c92586ed4983e94085d
SHA512 6b66dc6801baf181d3d389a9df358550564b15bddf65e45777a89c3d9cb5750bb3aa2357e647274c78bff2530b6b07380e6ae97e2b8a9e619a604dc0b50d4cb2
SSDEEP 12288:k7qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:k7N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1F74523643F8EC1BFF18615B08CE48168AC0E5F579F42528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 3f3c89b0fabe9aeca8d4092b51e1da475efd1ef98510ff80e12a69c09703c4dc
MD5 7621f38794735346ad4ad025475242a6
SHA1 9fb7ef3b09d5d317466d559cfabd1b382d64804f
SHA512 dabbf62aad4e7980958495bc5aeb0bae75ce5bfdfa0f1b74678c2f7c508c33ba2a131cb1b111d5f5070ae7f2d7585148f3ff6a4aef6739432fc46d6bec772419
SSDEEP 24576:jfwvok9RX6wkyAIlN94AMdTEvcQFuOjOP95Xdt5c:FMnYID95MdTAcQQfjP+
TLSH
T1D385CF29EBDC44E5E1B7923C89B7460AF6B178591B31C2CF129A536D0E37ED09E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6df3c5529b3faafb088cba3d3b169879e11520e82537b3e95fc52d81e1dafe83
MD5 3ba5d337898fe3ed712d567d282d1bf3
SHA1 1be18e34e375243a9c0c1d8a2ad89bab88e66e2e
SHA512 2552d798d8e2816a2c467cd142a0bba15ec906b47ae06c98822bd35256fe32516f66fd6f6ea84124ceff16a10e9706b223977e442b6ecc57a0ea3d1faad78bc6
SSDEEP 49152:XYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0m95MdTAcQQfjG:zySzPO0xTQWj
TLSH
T165066C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9d7704f1ad57e106169d6e5960feb76b5fcf27ca9ad27f84afd310a8a4a59596
MD5 e1790c7fad91f3767199c44cdb4017aa
SHA1 0cdf395ac334279bd16251a1ab43ca1907162509
SHA512 22139c69b490b2602ffa920fe4bb6c9bc0ea799b6caf89c4035d26c9546fbc06905631d2e7a1e4965c4f4ae8fcdcb6e1768b0c4ad201ce6502b56e5e6a1ac52b
SSDEEP 24576:x47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY8N94AMdTEvcQFuOjOP95Xdt5c:x47JUQj1irIhCnDHUPfF/295MdTAcQQq
TLSH
T1FF65AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 f2c3bdb3779cf23b969e7993bfc738346e47a0bebb3d582824504a62345cde81
MD5 8c1c5e84ca3933626ed8c5ece03c8546
SHA1 d34b3be03844f16039a65ab1808096ff48613fd6
SHA512 e567147b5e9444a185db7e268dda961a9201a19b4af81455e1675258dc2e4fbb9cf282e5126c81aab925849f647b43a7ce32f8d8ed340d31153fbc43d0ae1c47
SSDEEP 12288:nNsfhqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:khN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1CB55F119E68842E9D0AE6270CB958640B7277D258BE1D3CF53D0F93E0F366D09DEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo-small.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\StartScreenTile\ksolaunch\logo-small.png
Size 6KB
SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
MD5 8d650fe389e3665607fdbf938c1a1722
SHA1 2e545f9555ff22313e4ce113995d8aa694e5cab8
SHA512 f116621bfecb602d02919eb1ee9d7dc92e82b313b8b54cda42ab48c5e7ec60b02005edcad763fff6b497ca4bc46e83cb0c9a249be791f245bb9c599950fdf015
SSDEEP 192:HSO0z+xgsZ7wNP+agwQznBm2KIvdgoeAtzpZb/D1:yMRoP+z5IIa8hD1
TLSH
T1CCD19EEE6F1CCE4F079D52F7500AC0A9DEA218AA905764D4D68E70B471FE6D120EC5C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\StartScreenTile\ksolaunch\logo.png
Size 12KB
SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
MD5 d58510dca6b659c6e4ba7a454d5b75ce
SHA1 e142de2dda3811a2e8bbbb2eb64d366e8eb9ea3c
SHA512 42409f9976ad08ecf1756d1c2915f3ffd17cdc78e9ff552c0a08bdfa2fda8960e408721bfc9de1a5ed9c9aca3e23b97adb721b3c51b6b3f0ed3ee4a4c780cf88
SSDEEP 192:ySLu8Kp8OtM5IirU31+5AejJ7D+N+QOtHQjrE9aTYpR8XnXrWjvyNTtLJci:NC8o8do1+5D+N+QPE9B2Xn7WrINJP
TLSH
T1BC42C08F68918EB2CE443C39F356115F1FE12A5E7E19A2CF2CE7944A239044ACE1591F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\ketaidataanalysis\webview\run.ini
Size 171B
SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
MD5 b30cb271e143eace0f55ea2e562e1e9f
SHA1 9d97dbf24931cfc114384c3f4dbbae21c9e51be5
SHA512 dc593185fa63b458024c3a913c558e5686806154181dea67eec786ada50595c53bab822833ad1e76c9acdf21be3eba50631391b7e575d7f1f6409ceccf966535
TLSH
T1AAC080D4D0256F97DC31C6B5ED54AF1A7560E700251C1EC3D530DC4E9E9696551C805D
MD5 SHA1 SHA512 TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kpubaigcbox\res\dist\index.html
Size 636B
SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
MD5 72cdeca808b16e794ec5b66bd02246bf
SHA1 e75b6c4e084efc8e60c9e4fbe9e9ae02bfbf4132
SHA512 6562ed498bae7f819caa5ebff9ba373b1bbeae3c92befacbc44a72419e6a3aedeee7fe43347d1bf8c46b9c90c8e515181a6dc50c4ad954a640cf6b2520269ed8
TLSH
T1E5F002EA3C25F055CB911EA43DF2F19E245E3AB29DB9DE942AF4513543C03694D0BF48
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kpubaigcbox\res\dist\index.js
Size 2KB
SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
MD5 67dde682d1968824023dd9773f9ec48b
SHA1 81e0a21a7ba2c05193ecc13672a3f537539e0699
SHA512 86bccae3d66df4dd552c12a42d1ed0d57d6cdb7b904caa1f89c874e506fb76412b2df45e3e5f673837cb72aa18b0ab2c1dfb489b1da37068d83d7ccb25d3d8ea
TLSH
T1FD5173C9F79E702209EAE136583F0006E17735596098A1C8B87ED8F16EB555E7077F38
MD5 SHA1 SHA512 TLSH

Submit Download

errPage.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
Size 7KB
SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
MD5 eb3b05c3a3fdef3b0c5c9020756ebb33
SHA1 27c5773e17f9c05f471ccd22db42015561b4e669
SHA512 9a511c6d0aad855448ae45130d7ed031062bb7e6881e68aa2406c7c122220318379c312bc13876599dd7fe88e2beac296adf5bcdc015ef4e0e3f362e76303ab0
SSDEEP 96:9uMJIMzvOcuq4v+nB1W1QjjaKhwc3Rgjfqqm8bm83:9lTgVv+B1W1Q6ywc3RgjfDm8bm83
TLSH
T141F15211D6925216603393B4DFA25719FB260023A3038A38BFECA2558F75C495B93FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicon.ico

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
Size 4KB
SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
MD5 1ba2ae710d927f13d483fd5d1e548c9b
SHA1 c0605efed936ee2600284e6480521d06fa64f872
SHA512 f933cd352eaba92f509b3863353ddfefadfada26a4152ecdc4727d450bbf35e7b10fb3038fe8db340d5c63d74e608c1560ec84d0f6ffc8ccd940c9e0d7533544
SSDEEP 48:i3H5R5hLOR4kt38PduMoglJrd6qTrp9hweFC0+6Ga:ipHFUs4MLBvuyCda
TLSH
T1EE9175DF61C388D9C1B1977F78C449A14F6FD951BA28351F55CF30622E5D75818C1C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwebpromehelp\run.ini
Size 226B
SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
MD5 abc3a6089b0ea76ffc960fbc9b6e66d1
SHA1 50ad0cb201c13799024de56cf45116cf65ff5569
SHA512 ec1e32b7bed882095b23e049a4e1a86acf0bf993e2f691105ffbd99d93ebf28faad4fbdd645ac1eefa74ede575854a3994c7c6d2bacc6f7a09a1991561b1a44b
TLSH
T157D09700C0B5658AC1254C827CA53DC411085B4B27608E02CCF0C34D508EBECE56B08A
MD5 SHA1 SHA512 TLSH

Submit Download

close-secondary.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
Size 216B
SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
MD5 07306930f7d374663bd13e38ea0e92a1
SHA1 12f877e8ab93d874b55d75eef6747615619dad4f
SHA512 4cc0517ed0b9d665df4db93fb3093067e90f64b34f1d41420ed975b4cec64d4cc0aede64092d79c610c04e1ecd9514a9ef48389d5c157b5bcf698fc33670db98
TLSH
T1D8D0223BB3CC8E1CF9224A22F35A713580AF41C3548942E4D8322032E4011CEB93B6E8
MD5 SHA1 SHA512 TLSH

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
Size 334B
SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
MD5 d36fe6147829a72b42e054a5db27d270
SHA1 80779a8eb37d8bb1d5fcc594576f80dbd61fac98
SHA512 94224816f757241b3a6d19788225378ae070fc62b4620e11e10a033e3be5d9cc858cd9e669cc275b1fa82e57094d0df13a6d9868cf00afaa17cf2ec0193acd74
MD5 SHA1 SHA512

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\kwpsaibasetypo\mui\ja_JP\kwpsaibasetypo.qm
Size 327B
SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
MD5 18770de3f96bac1e75e588015024fcf8
SHA1 e6254c054edef68f9c27059efd82eeaa69c863b5
SHA512 fcb76291a73d7f2e30f4266ea8f0dfa2d9e203cf9770fb7ffd73cc1994502992fabd0803224c1e1155c1e4b678b5af0e8b3aec114beb1f02299e8885d5a61d0a
MD5 SHA1 SHA512

Submit Download

element-icons.ttf

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
Size 54KB
SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
MD5 732389ded34cb9c52dd88271f1345af9
SHA1 8058fc55ef8432832d0b3033680c73702562de0f
SHA512 e8971ae48f5287d252f5b0a2d0516091bef0d2febf7d01fd7b435e426d106fea251037439ec42c2937e934b66f38e5eb43d00a213cdf334f482f4a06b1817f9c
SSDEEP 1536:qTIRCXXCwinqtuPM16hD2N3SUjbwaST4DCJe:39GEcgD2njb5ST4h
TLSH
T10A433B32436A9BE7F416047F5C1F55830A9F4F22F53DEA8B83A6192514162FD0864BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loading.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\wpsbox\mui\default\html\syncassistant\smarter\img\loading.svg
Size 1KB
SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
MD5 0620393a949b58f6af37b0accb79e32c
SHA1 0025e4da5ffb8695a8f9731a05b1b89f1a71bf24
SHA512 0d308c758f825d548874cf8b4b8ec20f3685b39c7232246697dd95e5e5f40da7cd21de7ba5faafd0d8a121b5e6b85c5aadc4232e3f0c943535e062ae449ef29e
TLSH
T1333142D111BD0116E11AC365D7FD7AC70B3EB4DB26E558BCB68C250FAB404DB0A9B219
MD5 SHA1 SHA512 TLSH

Submit Download

element-icons.woff

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
Size 27KB
SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
MD5 535877f50039c0cb49a6196a5b7517cd
SHA1 0000c4e27d38f9f8bbe4e58b5ce2477e589507a7
SHA512 da269b20f13fb5b0bb4628b75ec29e69bb2d36999e94b61a846cb58db679287a13d0aa38cdf64b2893558d183c4cc5df8da770e5a5b2a3288622cd4bd0e1c87b
SSDEEP 768:gOvv6ExpCVxUtrT6w8ClFd80EjPVerMKBaGXjAlEm:Hvv6xVWewtlFdGjPlkFjAlEm
TLSH
T1B9C2E13197213AE9D9824EF876E498FEF1651402290F390E8696ADB3A98D5C73E16831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
Size 107KB
SHA256 c9c5602e26393532e59391d5944a578716f3b6cad104ae20ac8caac805e52f86
MD5 d758ec835091abce0528909c5dadfe24
SHA1 07a9ffb19860ece3293780c707bc71f25a6e5d42
SHA512 74d869f2cc25b5a49adea778f52f59c6f4b7f2eca31c511f19250538d241136a6cbefedccb250a3773500bdc6b9caa57ae7cee40c0dc2d8753f2386e2f390cc4
SSDEEP 3072:KazzQ51KYGqMkYUl26MeCsAcdl6y7tqWD:mMQ/euD
TLSH
T13DB31B37214D132D383BDAA2E55D659A60C8F61BC01253F5FA247B1DCA837873A763AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
Size 279KB
SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
MD5 a3964e72421a1ef5fb60c6e17eb5d705
SHA1 5dd9584be5141e884a230c48746e1c88126b0a55
SHA512 4ce4119b7407b460969041809354c4ede587047ee643f2897eb0ecb9627608431f43fed27c54c70bacff3a6694eb32a85b535c7d6397ac22d7d28e260b0a5467
SSDEEP 1536:39eSBQG+dyAUlHj/8D0Q+SPxZztR+LCrwHFfyqHYb3PPV7BYUOf0I79lDxiRSL2Q:3zfZYKVxiW
TLSH
T14054B6229140212E702BDE3DF7C4EA4AE225C6B3C4125BFEF953651DC7C36AA117778A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
Size 380KB
SHA256 f1bd1ffaba49fd0c0040f182231f739000b0e4bc762900ecacab4980f743b203
MD5 bb8a0b01c0ac1190e643c4e9daf4b69e
SHA1 f0286c3ea896a359666be8f10a7519c767afb321
SHA512 da37ebedf1e5365df105b3bfb559d0dc6a75b2896ad29c844c6b987ac5388139fe88414cc6128144f6fa50086564ea67f257eec54941dd43b124be0b8b276573
SSDEEP 6144:5pK457wXrka10TbOXsEYpHBBs6Ve5NtXoqIpgznl87A6v0eX4AiDuViQbgQgILTv:64G0WtYpmiLlTD8QmIqU1NBqq
TLSH
T1E4846C4B758BBB5A1F35B66340DF3C88D01C6EC09812A5C9FABDD9D09144B9A32D63BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
Size 249KB
SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
MD5 6351ea268f992f52e0f4418a7028b91d
SHA1 5bb3cb88465c550a1fd033a079a8b2eba5e071b8
SHA512 44940d07abfdee6403e9400e596ac5e5eb234ba77a1c90c2fe4086878c12f4805c709eb84538071f21d5710d3569d342e7caea10061e2ab2661c5117c5966297
SSDEEP 3072:p+Xy2rHhkiTtcsuaIwK3zqDLW/ix3Iu7doNFBWgz/bwUzxqcG7gLEOhA:phKHhklsi3zpCdoNFBHz/bwAfG7cW
TLSH
T10A44F8CDB2D1B0A517EB61B4813F610BF27B6499B44E80D0E226E5D4BC7998E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
Size 424KB
SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
MD5 cf29fba214e7f43f2ca1b629109d126b
SHA1 d0dda9486528586af6943abe7a3afa319c790f25
SHA512 2ad7e4711f5917b8d13f861d4fb2688e6ce3951da43a89263a2d9743199e173429398ec1a9537b1df25593d3999dd34fb590e2d2a6e7a632ccc44265d93c3bca
SSDEEP 6144:z8KzCOcC0CXWsJvRekr0dgei/zJbBoCF7az2bzNM:zbzCODTWsJvRbw6zJbBfaz2bC
TLSH
T13694198DB2C1B0A517EB60B4913F610BF23B6469B44E80D4F266E5E57C7898E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
Size 10KB
SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
MD5 0f4634d4af8b73f882440c1181697d86
SHA1 748bb9a14c8a6c64fa060ddcb1b4baebfb3f6fd3
SHA512 eeff081cb256a44ff4557dae145c3d277ad936fef58674cb7d2949b6c302c3a746f05495daa6ccabf39c26bacf13c6fee3bab20de4f1d13810be0503787c89d5
SSDEEP 192:cyxPpQcKb2d4U1nE92Ui6OPl20b3G0qE7I2ByobYGeBv+x9qkgYbeO:zzFZr6OddG0q/yTh3UYx
TLSH
T1AC32C887B30483755A90E790F6C76DA5A93ED0EE73A4168A3CEE421812581DEB3E7CC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
Size 13KB
SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
MD5 dd59d31e84434c59c5c3735bd0b0dc3b
SHA1 c34473850d3749aae725856f68a262a0afebee00
SHA512 f3acd51920f945b49dceb56fd2a5a4ff170c4a5770665bef3d888f8497a288dc33bd15f24780cbe9b8ced585fbacb92a8700d1322a6d4acd2b6e5893370822ac
SSDEEP 192:GwSuCUHXDhEblYfhQ9GYSOqUr9b1AARAU0qWo3wYXVMojXiyaH:dCaXDhEK55YmUrLAgkqWo3RVhpQ
TLSH
T140523295F3C50E22B4991749BA03D57BF19558FAFC2CC18D5CF2D236136C9C986928C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
Size 14KB
SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
MD5 5cee0947c1ef6f00e18eb17cf77388af
SHA1 5a27bc625acfb46d2368a9a376d797ecab912a3a
SHA512 1bf91f08d2a2a446ef0e22df40fd09b090fa300f599bacdd5c698aa61a6fef12ad3d3e38299804a016e5a22a82ddfeb6840cdc7a79ea51244942cb22e659331e
SSDEEP 384:HTO1ksU66rAJGO+NedvSGdv+GfBgLj95LKn:zO1ksU66rAJG5NedKGdv+GfyLj2n
TLSH
T11D6230ACC3CD5C69C86183FA090B35C27836ED49FEA5AE7280EDF4202DA19DFD815674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apm-init.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
Size 57B
SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
MD5 b684f2b8022aaa97ede28f9d224c4db5
SHA1 2087206ddbfd6d6d71f843a132b58ed533d87169
SHA512 8d30da66bfdd99dab88c4b9766b692c39ecbc8dd725e9f858c95993d4f2bf46c37891a1f8f4f1eb6fe09bed7008b8df48d2a9b4f10d7caf20f823f121f6ebb40
TLSH
T19F9002E7F0A1707344616959630722AA35D11130017430010900487434A580FCD22F88
MD5 SHA1 SHA512 TLSH

Submit Download

default_ava.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
Size 906B
SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
MD5 c47a5cfed147c402538358294808e68a
SHA1 8aa499336bc4a50a70710735b67fc5da923fc61a
SHA512 a71831abb9393b6c0ad62feb29fefbb192e1706b08ab88dec0a8e6a9cf61b6a7e106454a7e6e518f69425cc91846036e8fe2956ea939625678f17b330860ba1b
TLSH
T15311E309934DC285960AD7B8563C1754347272DF9E1FD55CE7E633012D3C6AF185C27A
MD5 SHA1 SHA512 TLSH

Submit Download

desk-sync.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
Size 1KB
SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
MD5 c17417f321f52624ee0dc60ed76a31b6
SHA1 b64e19a5b03c92a931fa9a1eba899f491e669a1e
SHA512 bf160829598cf0b22ea48a5f7310adfbd26fbc1bbf23ea3cb8d9cebbeb92b5e81b914bd6021cd41df5984ef00698acb1c1151e134c714e0a1be7dcd439c78485
TLSH
T16D21F0ED57EE35C8644CD37028DA6079627B35F43969EF048914A9D1FE4205D499F9C0
MD5 SHA1 SHA512 TLSH

Submit Download

setup.cfg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\cfgs\setup.cfg
Size 449B
SHA256 62b60d2fba63532572d6ba8301351b60af331a287bd66c40fe2095a710738094
MD5 e7e17a564ebe4688b97e4ec4463e145a
SHA1 7e27b0d3777c9d6f4120bc09831a0f1d64e96a2c
SHA512 02e42bb89519d61927313fe8c7b9540ecacf1ad8f1e71eaec281e64808dc91665a535b76324339cf3ba51f3dba4ef4149e96e5803fb0911f8669b2f66dabd155
TLSH
T1A5F0AB6B0303B0745E21530010B914F2B3FB01C9101B840D256CA88D7B7EC3D86BF13E
MD5 SHA1 SHA512 TLSH

Submit Download

ksomisc.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\ksomisc.exe
Size 3.7MB
SHA256 3342f9691125a2214c37b2a5b5fcf43ea3320d838bedd5d6343a22788c25644d
MD5 62b99e1e6782787a026069fd3fbb5b21
SHA1 0db5c24c4c5376220624144ec59808563f326e0b
SHA512 c99253924b30389129d24a1cac05d526db30e370d8a8ba1e8dfafab174c5423965484e816944e30984f02b9b802491148157667e7b5fb3a245f3cdf416cdba3d
SSDEEP 49152:0qPmk0JH6yx1l6Nair+mq9mm4yaEPAD0T1pkBSPIU7BmckP0pPFj5+qa0skgNp+Q:r0JxTVb4ylEEpgYg2gZ
TLSH
T176067D5B62FA03ECE1BBC278D6965903E2B2390687315ADB11549E750F337E19E3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

error-net-72.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
Size 1KB
SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
MD5 66726a0fbd424ccb700cecb212a47007
SHA1 9795ae26acf0b942ab6a0cd06f206ba69eda18db
SHA512 30ddd2fa17517792a86bdb03827a0809ed362ab2dbd9a7baf194d1f47348c96e0ca8e64515c1a58d7a1740e85f53a3676b49ff6c699d598a27c234c14672604f
TLSH
T1E031C6CD318AC42FCC61D531F4D534156817D760BF928C74102BC5576E0F68E58C6662
MD5 SHA1 SHA512 TLSH

Submit Download

presetLayout_16.pptx

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
Size 41KB
SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
MD5 f41e909b0284949bdd3bea9393a6ff2f
SHA1 a41497f65f44368ad517f464eb0da4403aa700c0
SHA512 d800b9b807a72d19f17bf5bb923d2489328b2f8801c2146b0c67d3d4cd8c70d5f22decd6581ad14d5584f3895140180c8578ede4fa8df755ca742c18cbb3b67b
SSDEEP 768:lwQ75cI1zETv/7H0vFtZKSZTRomseFVEFqG5IphchDB8h/rW7oELmG1wvcG7GyGK:9qNTn81Romse8Fl5ahcVChjQmG1/sl+Q
TLSH
T114139F61D40A142FC263B3F6E478164F73FEE86248179797ACD51096282F97C2E9D38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpscloudsvr.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\office6\wpscloudsvr.exe
Size 1.1MB
SHA256 f5726c54eabfa893b1cebeba9c9b9731715faec9e01d137d705f70150375fdf8
MD5 ffbba1782f20a683a6e1c65e6ed54618
SHA1 fbd85ac9eb4586c48f191b79d9a5f7218cee2691
SHA512 85a50e430508255d1e48a94353ea43b40332b71a0b8b406e78cef5726c808b96b3cfc76bc08305a776994b593351bd85649e3c3ec06750e4c6228ee352719136
SSDEEP 24576:3GkDhWVvkc7xEItMad32IV0cZZl7KyfHGoiZYaYA:3BNHqSa12IVblHGZZYaT
TLSH
T1AF356B4A63B902FDE0ABE1798D525905E2B63C0607B05BCF079067771F7BAE95E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26880\utility\install.ini
Size 462B
SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
MD5 71e0a7ecd6bd2e91c04a3edf760c45d7
SHA1 e6cf872ce6def16bca98818ba289395580701292
SHA512 282b4c8be6abb97383d7dda8258fbf069fd668f4fad722582567cbc916b5c7da9a39a157a35511210306c19e46ef34c02af17f2af1ec7707bb3d84f3d529c3ca
TLSH
T178F097090C98C66E36282188B0D3C2C0A9ABCE260D0CE410E2D36E1BFC02E0A217E02D
MD5 SHA1 SHA512 TLSH

Submit Download

Qt5CoreKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5add23\CONTROL\office6\Qt5CoreKso.dll
Size 5.7MB
SHA256 ae105320fafecbdf6e26a3c2ac51bff164ed60e2c80d7c2a909f7c8abf350d21
MD5 0baefb9d5911265bcf18ac0bcc9064a3
SHA1 d1e47757851abed060119f9268ddb69bfcf1885a
SHA512 714751941292c12a640a9f6e29c4b17ddfa1df2263f89f90a146b86d8e3dae2e142e718212d254097c28ea0926969f95f222fc4138504e43257b332f0129aa57
SSDEEP 98304:hUri4dRGPsSlU3Jsv6tWKFdu9C39iSl4r3IscaL:hUe4dRHS4Jsv6tWKFdu9C39i4scaL
TLSH
T10E567C47FA960269D8B6C238C9D78117F673BC0147224BDF2298A3496A777F0293F359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5GuiKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5add23\CONTROL\office6\Qt5GuiKso.dll
Size 6.4MB
SHA256 62bb5bae4f0cd7cd7776471bf93cb00601badaded78a1d6978b085a38d9a5ac7
MD5 f4a22145f47c27bb6ead2a63413d2019
SHA1 0f236b06941198365616e17866f6192d1ba09a91
SHA512 686340df75da618260e5cd895346ffd1c4e38c9bb25e4462a00047a3c9ac55963ffd85418ccc278157c26b986a02ff918349907c0cd842cd2a18f311c9028a4b
SSDEEP 49152:tfwVgzsWrginPvS/6E4hNk3sbwIbapmRW63/LmkNuMdmboZAi073Wt0LcajSdTNB:9wVgzPUd8vLmTiy31LR8TXyZ2
TLSH
T1BC66F986EA466359C572D17987CB042FE1F37C4683524BC36C45AB490E237EA1B7FE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5SvgKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5add23\CONTROL\office6\Qt5SvgKso.dll
Size 503KB
SHA256 399cd93775185a1a0db67abebd302d8f227e3e17f8e42836a297ba148d4a6ec9
MD5 d6661626aa98972b7ffaa49888bb4a15
SHA1 042520dc91f31bf5d6e22d4020baf4232b887163
SHA512 9c69f5d6f4edf2a67dd97a09abc03074b06fa7f47bf16f83b8d665e64bdfc6ee6fdadb89e09472b8e74418409756cae3245c7cdc434658c67d27b61453f6364f
SSDEEP 12288:2eu0/Bj7pgf5fqNXGPRG8PFNBAVLEgZ/ABXH9a/vngheZB/XEnEsrnJpaymesGrh:2eu0/Yf5fM6RFP9binCn
TLSH
T1DAB44993FB520398D526D27CC8978812F273340443A39BDF6A5AEB651F236E1763E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WidgetsKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5add23\CONTROL\office6\Qt5WidgetsKso.dll
Size 5.6MB
SHA256 44cd4abc65e8c79047182c2f1846cc554acd01836445b3e3ce51483bab103c86
MD5 69e494161123658847a9553c0c19b030
SHA1 11492cf190a1ff6d19c502c085e6ab70ca26dbdf
SHA512 a7f68789fde8a40bd3bc6801fde08cac81fea7626b70b584d640ba1e42c93f9f8fef97dcfd6c683deb9463a73b8c0cc5de97d2459e292d5103d9ce9baee5b702
SSDEEP 49152:A3fqL/IkO1RNxuQ4Njz8MaCr+6CWpTkY9vTRC+WAGwczT9yVx80qi1QGoQXppdcm:0x4rRNTppdcpwj667olQXr
TLSH
T143466C47F7A50389C56BD23CCACB8613E6B2780047234BCB6559DB692F637E2197E780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WinExtrasKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5add23\CONTROL\office6\Qt5WinExtrasKso.dll
Size 251KB
SHA256 ac783be33b205c69a7d77191bc5f4af8aae1ec0e86ac861e1ee2649a06cf0e5a
MD5 9c9a516e1bba629418a607e63b1d152b
SHA1 a7cc7aecf75194ac172167acb1495951fc52fbb1
SHA512 137ac148ed5582c44ab755ab520a6fefff161a26a84aa08c464d6ab701ae10693e535f82df9771ffa2e77b64a279d7ba484b84aeb42c5a23eb0afd307287ff95
SSDEEP 3072:IF5o5cKUM7YLBwcJf1+6Ws2g1+xvN80L92M:IfpM/xvN8M
TLSH
T181449684B6DD9619F819B0B88FCCD199C223BAED8B47425F351EC39F4B619816E139F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5add23\CONTROL\office6\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5add23\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
Size 75KB
SHA256 49c19cd06a911fc42ed256d1691243e20dde7596fc9a19ea71a29f261d1f823a
MD5 2a9a0e490ed87340d31c835902f9030d
SHA1 368cfd9a6856e21557d5cfc2539b40d59067d358
SHA512 b683e2314497115521b2c11681cd6f9bebc722ad9ba0e229ce9ba1065a673365e7a4005727bb0d05598d1b0334b2df684b397c25c2e5f57103c215125ed5b3ba
SSDEEP 768:dXOzQ/DBnTQxkUtwZfVKFkYQJc19qTwz6NBvgUZSac6mWWr5YiDLk5C7DHYi777D:wjf8JNwz6NBxSac0+57b377T
TLSH
T1A0736B93DB441799E51B8634DAD58A1BE6B2784207A293CF6328E3680F733D2397D3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5add23\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
Size 46KB
SHA256 a81f7b0fcde9820fe96471746854a7a1f5100f53adb71da30e6c14fe35f5774d
MD5 3091ad2fae079b46dd38a11f9eb095a9
SHA1 19b9b0a0b44a00c0872fe0e28a7bfdbc2601c4c9
SHA512 2699be0deba1057a8e6b6c68bf9c562d54a7bec17c9032f63c682568604eb2ccddd0d15ecb2d7a821a1cf4212fccb8767dcc6e67a7c104aa5d03ec302dbcd2e0
SSDEEP 768:qnBLz7xcTbdofpkos+DVYiDLk5C7a5IfYi77l5AL1z:qh7xWofpkossV7bWIf77Gz
TLSH
T154235A93CE641809E923DA70B4C54926F972B8514B9283CF21A5D3694F973C23EBD3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qskia.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5add23\CONTROL\office6\qt\plugins\platforms\qskia.dll
Size 1.9MB
SHA256 ed2434466d697329e29941aea13b87bf104679652c7c33bd1b358b6fd623ae67
MD5 e4c5e812619ab113ac309244c200a37c
SHA1 8bdd28a1013215fff4191fe382e00aef938e862b
SHA512 6fa606ab52e8e0b75bc6384208babe90f07271b51dbbc17b72c0e4cff800b51de0a1be37a705e30837534b85abad2b7f75dcfbedb02f7e93096e03142ae245bd
SSDEEP 49152:v0rOoPmNWAG+mr9gb7jxSfL0FHYX52k2ik82a66kTcAjY:6mNWERY
TLSH
T1F1957C43E3B44299C2A7C13D869B8F0BE6B1740543619BDB2690CF59EF237E21A7E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5add23\CONTROL\office6\qt\plugins\platforms\qwindows.dll
Size 1.6MB
SHA256 85a5998534e16d1eba7f151395e8e892c16a4c30468236a636e1da213d27e37d
MD5 383f213649e7dca74389bc7717ecab07
SHA1 ab780df56eba236c2892570552e7117810138779
SHA512 9a636ff6713e3288e4cd897144dc68714507b1aed7b922bcc895b71da423dcf78bba3b3c985142acbfd18f367f69f39cbb780ba9bbd90847b9c1004982eb54c0
SSDEEP 24576:yA9T04p4/1MGXCrbBB376YStwHxDCWYkbJ3tYbZsZbpZ6:xT0IycbBxlowHx+eJTbpk
TLSH
T1F2757C43E3A44798C167C239C68B9A0BD77178050362ABDF25A08F59EF63BE3177A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5add23\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
Size 159KB
SHA256 28b753795101ece7c933d4d47130f51f2b7de8635ba154eaa03ebc82f8cc9f78
MD5 2fa56e927d91beb5e6996e60b6311b73
SHA1 67775975e2e2055590c93cfed03958a77d427727
SHA512 7fa1ea01a5477db7e312416f186291fa440dfe75d476be8654ec84845ace6dd9ea13133f693a013ce8e14e24ccae9589ce63cf1a7b088e80422d6d0a78472420
SSDEEP 3072:XSApjXbrT36b96bavsTHnbNgJUcJbgPHsLCncI2ojCZr:XX6b96bavqHnbNpXHsLCnc/
TLSH
T1BAF33913F65143D9C567D2B8C18E0512F3B37444436297AF25A6DBB82F533A2BD3EA82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5add23\CONTROL\office6\ucrtbase.dll
Size 987KB
SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
MD5 61eb0ad4c285b60732353a0cb5c9b2ab
SHA1 21a1bea01f6ca7e9828a522c696853706d0a457b
SHA512 44cd871f48b5193abb3b9664dbea8cdad19e72c47b6967c685cf1cc803bc9abb48a8a93009c972ef4936e7f78e3c92110828790aa0a9d26b80e6a523bbcd830d
SSDEEP 24576:xOPJ1g7mT6BNvwTOxNfoYotrz1111111r8SoKxmxvSZX0ypdNLh:xO1aNoaxNfo/+a
TLSH
T18D259E64F75C0AA6C17BE17CC95B550ED972340647608ACF03EA8BB97E2BBE91637310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5add23\CONTROL\office6\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5add23\CONTROL\office6\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5add23\CONTROL\pl_PL\style.xml
Size 3KB
SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
MD5 034f37e6536c1430d55f64168b7e9f05
SHA1 dd08c0ef0d086dfbe59797990a74dab14fc850e2
SHA512 0e1911c882152a4e1059a3ce1880d7fb2aed1e1e36cbd37055de2e2a1333acb2a0233ba2a4d969ccebbef1e77809aa5e78807aa9239545beae8c548c0f8f35c0
TLSH
T1E381CA80A610BD0AC563F51573AB7509762CB36383ECCFC4F0EE2E698753652644B63E
MD5 SHA1 SHA512 TLSH

Submit Download

product_new.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5add23\CONTROL\product_new.dat
Size 72KB
SHA256 8b8908a5a2964c840f954bbfd59679fb684c3bc3aee98332b28d5eda76bd5db7
MD5 dce25ef9e38d176ac64218dc2893eb7a
SHA1 4b98920088e6e12056d2059bc5fb618e26b84e11
SHA512 a95e331e650953fecd10f19dde0a1e1ff5d1fd0a79e2c43f42118f4d783151bd2d4f959a9c6a3e79b9eacf5cf53761545721e1ccb3648ecda596c7fa0ae3ed01
SSDEEP 1536:I3Vrh5eCifWIY/Q2pHggLLw52P/E/nNsB+e/zEy7m:2Vr/UdOAGN0FsBsV
TLSH
T1BA731B19DCE26DBD685056B91D376D8227B7DDD060DD30AC4B12AA0CFC3CF887B62A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5add23\CONTROL\vi_VN\style.xml
Size 4KB
SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
MD5 394488b30107bcebb84a97ed5d754cee
SHA1 69ebe17f7d577e9bf69c87cff45c3251f0bbc86e
SHA512 24a6bc7debbf7030c1261c69cb4ae7bf3cbb5c7fac315188163c6001e58dfbe2e634925cb767044da7ea0e6d08c709b2ade02f6e43930819e1bef6f7569cad5a
SSDEEP 96:gd6SmSZcFe9gSs8TcySCSi58VS5eQJ/gQkgQ0/Mw8CclQgYzdr/PwiCSeDeR3ciw:gdAh8Ax
TLSH
T13FA17780A610BD0AC563A51977AB7909B62C736383ECCFC4F0EE3E658753692644B63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 387B
SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
MD5 c38481658f9149eba0b9b8fcbcb16708
SHA1 f16a40af74c0a04a331f7833251e3958d033d4da
SHA512 8f98d62f88442b8ef94aa10074e35aa8d9494f3c76ce8b143ca0bf7fa0d917f3175212fbcd6e7b0597fd0ec0e1b2827f157135512fb01c88218d36e2f7dd73ce
TLSH
T1D4E09B1BA8D1B0ABDEB302E988979D54BAC03D9A066D23147762540D3D32918FB41D65
MD5 SHA1 SHA512 TLSH

Submit Download

ksomisc_2026_07_02.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_07_02.log
Size 3KB
SHA256 4486b2d5caf8c77466aa807183b9abe41c798bb19f036ea021e922effca390a7
MD5 719ce74b831a106de824fed49a698ebc
SHA1 d31fbded21dac9c6cbdf41a3d136c755a1ef27ba
SHA512 76a7d884f7cb1c10d86fad3474dc9b70616d767045abd230d810a1fd5c6bba3535f0398c9bca96357eeb2b991035f1852b891896a7658387474c537a6a56b1be
TLSH
T1F361B05967F94405F7B78F46ACF658A34E76BC82BD20D80A1990234E4872EA0FD7173B
MD5 SHA1 SHA512 TLSH

Submit Download

ksomisc_2026_07_02.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2026_07_02.log
Size 5KB
SHA256 e6a1abef4c5ec2dece5ff196d330afb73a95f3788a6c2967a111d9d88996c1ea
MD5 619bece92b92bb045fb37b6cb959de68
SHA1 29e8da45e32ea8659be98377496c1882c716957e
SHA512 ac37f057bd230bd13ff04f7eb9ab31c0e11b6d67691bb386e809b8b9a28dfa7d8ae01cfe1702ec3e71998814f8220a78e9779b4acc670a5d28bb4d01c9a09891
SSDEEP 96:rM1F6qYo1siWqM1yHGsi+HjM1yH6uzsi+HWM1yHGsi+H10M1yHVNAsi+HEjM1tcj:rORYqL5mWD5auzW25mWa5nAWkjOEbjgU
TLSH
T187C19F9926F94505F7B78F46A8F654A34E7ABC83AC30DC0A1990134D48B2E90FD7173B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 10KB
SHA256 c358a21b1950a2cc18942d5c9aa50c2ed5bca7285444f58aa90c477dbcb9defe
MD5 5e2bdb9fe7bea279cf1c519b42a873cb
SHA1 0d11e9d26c1fdf46170163b26276bd54d0efe9c0
SHA512 a0dcc525282bada8508a5867d90c920360ea7324f2d4fccf816858ddee2494115b4f1004ef73884c1cd14633c9916534cc736b9b8c99b9ce6cfa9b12ee448c1f
SSDEEP 96:xbHUvDDZPh8wmxzxf9vBVbqCZolS2Mog1IrE/WMowD22fT9bbQk8BEmvnIUPFy6K:xgqZdqVnl+QVNRcB
TLSH
T10E328F57966F0218067B0AA923F58D4839866EDD238524403FB7DF974BDF82243BF768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 808097588045d1d85c74576b3b5ba337cf8f86268bd9669d1553aa59a488df66
MD5 72b84fb8b826a9969f136207a1cd30c5
SHA1 49f88b43ef4b907ce4912b791b6bfda9c734db13
SHA512 0ad32840ee357c3fc163b40ef96d912df8cda2f2814c8f164add2ccb4ff6e8894a0c175f1829e4767922959305017054d506feaf2805211379838ea39b49b1a0
SSDEEP 12288:l07JqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:uJN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1F44523253F8DD56AF1B616B058E8C1386D0FBF658F0191CFA7824AAE89349C1DEF101E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f57210ae9e4465627e658f8c93e9e27ec163dae069ec6039275938626137bfba
MD5 9dbb1f3f9d37b51acc84848da855f191
SHA1 58fd98d460c3940c676230e57c5807b7b59ed8f6
SHA512 9c976167691a4d9e82e8f6a5dbf5cbe48436c23e997da6d8ca7d2473951e9c4bd10ff51650056135e045df34811106d758e39a43633273da1d4ac0eef05e9c88
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYPN94AMdTEvcQFuOjOP95Xdt5c:Cgb4mBIBhGFE95MdTAcQQfjP+
TLSH
T133659E1E22EC02F5E0FAD2B89DAA4417D6B278160731D2DF1251427D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 c67151267fe5e2e1e7a3dc6748a81ca3786e39ef6d93ad3ea48dc9a068320fc9
MD5 0e604ae58ee55311d73ef5631f0b1b99
SHA1 aef32ec47f2f5a47fb18deb969e6b954586499e0
SHA512 dfa7519b5321038f04c79134786039bbeeab183f3783914e03ca0f31dc0fc57fa02516a5795ded1104bbe86aad59fe6b44e5812a64ea2b2d46a9cde4cbe7383e
SSDEEP 24576:kG88u8FpJqH1bzria7/mMN94AMdTEvcQFuOjOP95Xdt5c:X7ZFPqVea7/d95MdTAcQQfjP+
TLSH
T19485016577E501F1D47BD13889864663FAB2B8210360EBDF07A88B551F23BE14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 d5fa4c1447eda657103bd3bed8f6ddba7c4adde4efa226965d408d2d6a437dc7
MD5 90a095c926d001704579a33f293ac665
SHA1 10e1ad063288e49407493c407d1d88e92f22c654
SHA512 35ef9ced689b636976e997d58f3510e3c2e91be625de0170748372afafbd3f1652b94488d3e32ed966efda2865be05968be4452f9a4cbf383365560f2b0c7e33
SSDEEP 24576:lPUr+NQ4N94AMdTEvcQFuOjOP95Xdt5c:lJQ495MdTAcQQfjP+
TLSH
T12265E12F36DD18E5F676A17C89868219F772B8620712D2CF02E1817E4F27ED4BD39624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 72a330c7e342bd1f50643929dd6ef735a7fa0b3391caffe202bc13ebd6e70696
MD5 d6cedc2171702d2894c9183af4ec74ca
SHA1 5951fed205e72a30fe4a6d1eae198f854256488b
SHA512 0451f3188f1c0b3af5c16d01ea0e0f8320bea8ca892e9ab1cddd78e61e0637e42ab2c21bb427a4e507e5537899b15877970e9423f9124abc2b225cc1e843e130
SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjo95MdTAcQQfjP+:gG05lO43bb0xTQWj
TLSH
T132D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c9f641eb5626077596b9c506268cb67bb524a1773cb165917294fd4745723bf0
MD5 fe9471f72a672694ea5e49a7d98e8a5f
SHA1 766fa377370f556e53e8027abc96cfd6f5b8aeac
SHA512 8770b09a00f68b94edabcf64829b72595d2c0f9958ebe8cc501b7dba57fe58b078ee5433623510dd86b990779d2a5d3a7f509a80654db8d195ba0717a6cc3bfb
SSDEEP 24576:ffa5POZ3dpFWVM50JicR2hG0lasx2+47eidnuN94AMdTEvcQFuOjOP95Xdt5c:na5POZ3+Jt2pasx2+mw95MdTAcQQfjP+
TLSH
T1E665AF5EA6EC01D5D5B9D17DC583861AF5B1342253329BCF022182BE3F27EE89E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3f0c407f49d65aa28b7d0d38b0f77943381e132fa85d1d2ac5c1178dd55787b5
MD5 e534f0214f0ea2bf2f5700244b12a482
SHA1 a8ee7ff3e0639bf389f3165b65e55dfeea33278a
SHA512 7eefee9564536768452dbaf70f3956ebf4aef18d23be106d668a59019fe9ab83478208469377faa1e6017823e7a969c5e0355220bf535f26f5a58d02b0a01730
SSDEEP 24576:aNcwHdjbyQ4nLC18lb/EOjowL7FkkN94AMdTEvcQFuOjOP95Xdt5c:aNc/zEOVHF995MdTAcQQfjP+
TLSH
T13D857B2623E901E4F1BBE1BE89779546FA71786517308ACF0291851F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 602af737a7d2269085c37ec2a3d9edeb2ca247ef9c5d1b3a85507a3611fd0d74
MD5 9c8601f617db4467c4f99ff2febceacb
SHA1 5cb606b68b80e0f592cf5dbf3d944e060c2e0904
SHA512 446e71ef65a44777998b5add513fb8d6cfdb0fbd4c95f9b099d90e0d988b3348e5926258396ca4d8f5f82484df6529a924f4eb71e53ff7b49e1b61f0450254d8
SSDEEP 24576:h8kNvNnaFeYhJNtmZBmSN94AMdTEvcQFuOjOP95Xdt5c:h8MwBtOmi95MdTAcQQfjP+
TLSH
T1AE55AF6E7AA846E4D1FEC6B4CD238512EA727861073293CB5390C13F4E279D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b461752f5cd9bdca71ccc3fe7431598df73d6a66b176a4a0f53b91794e33e2a5
MD5 e42fe972765e5ab7c210af6056720a8a
SHA1 64b2022d3b93879754f8fa9842684bcfcc655a61
SHA512 45de0bf760e709ecf716d7e5eb85315c221bc34f5f0e8573613241b5443191ed65a400e6f80677aec86e5732b3db8b9fa5a80e3b7b80e784ca91c4edd4a24f2e
SSDEEP 24576:mD3FHshBIYQgA9N94AMdTEvcQFuOjOP95Xdt5c:mDVHeBIAAr95MdTAcQQfjP+
TLSH
T1A975E17DEB9C00E4E57BD1BCCA638506E77138A9072256CB02D481BA5F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1312-42-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1312-41-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1312-52-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1312-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1312-54-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2356-232-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2356-56-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2356-63-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2356-57-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2828-5-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/2828-6-0x0000000000B20000-0x0000000000B87000-memory.dmp

Download

memory/2828-7-0x0000000000B20000-0x0000000000B87000-memory.dmp

Download

memory/2828-0-0x0000000000B20000-0x0000000000B87000-memory.dmp

Download

memory/2828-67-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/3336-276-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3336-80-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3664-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3664-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3664-136-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3664-30-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3960-139-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3960-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3960-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3960-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4100-824-0x00007FFC70FB0000-0x00007FFC7153E000-memory.dmp

Download

memory/4968-321-0x00000240A1D30000-0x00000240A1EFA000-memory.dmp

Download

memory/5136-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5136-107-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5136-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5136-24-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5436-127-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5436-132-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5436-121-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5436-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5436-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5716-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5716-293-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5716-84-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5716-323-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5716-83-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5716-90-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5724-294-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5724-96-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5724-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5724-292-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5724-102-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5832-309-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5832-116-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5832-110-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5832-108-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5988-75-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5988-69-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5988-76-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5988-264-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/9724-8541-0x00007FFC6D080000-0x00007FFC6ED80000-memory.dmp

Download

memory/9724-8598-0x00007FFC6A3C0000-0x00007FFC6ADD9000-memory.dmp

Download

memory/9724-8523-0x00007FF7263E0000-0x00007FF72678E000-memory.dmp

Download

memory/9724-8526-0x00007FFC72D60000-0x00007FFC739AE000-memory.dmp

Download

memory/9724-8525-0x00007FFC72460000-0x00007FFC729EE000-memory.dmp

Download

memory/9724-8524-0x00007FFC758D0000-0x00007FFC75A14000-memory.dmp

Download

memory/11016-8567-0x00007FFC6D080000-0x00007FFC6ED80000-memory.dmp

Download

memory/11016-8550-0x00007FFC72D60000-0x00007FFC739AE000-memory.dmp

Download

memory/11016-8551-0x00007FFC758D0000-0x00007FFC75A14000-memory.dmp

Download

memory/11016-8549-0x00007FF7263E0000-0x00007FF72678E000-memory.dmp

Download

memory/11016-8552-0x00007FFC72460000-0x00007FFC729EE000-memory.dmp

Download

memory/11016-8600-0x00007FFC6A3C0000-0x00007FFC6ADD9000-memory.dmp

Download

memory/11196-8470-0x00007FF7263E0000-0x00007FF72678E000-memory.dmp

Download

memory/11196-8479-0x00007FFC55A30000-0x00007FFC55A40000-memory.dmp

Download

memory/11196-8468-0x00007FFC72460000-0x00007FFC729EE000-memory.dmp

Download

memory/11196-8467-0x00007FFC758D0000-0x00007FFC75A14000-memory.dmp

Download

memory/11196-8469-0x00007FFC72D60000-0x00007FFC739AE000-memory.dmp

Download

memory/11196-8472-0x00007FFC55A30000-0x00007FFC55A40000-memory.dmp

Download

memory/11196-8471-0x00007FFC55FC0000-0x00007FFC55FD0000-memory.dmp

Download

memory/11196-8473-0x00007FFC55A30000-0x00007FFC55A40000-memory.dmp

Download

memory/11196-8474-0x00007FFC55A30000-0x00007FFC55A40000-memory.dmp

Download

memory/11196-8475-0x00007FFC55A30000-0x00007FFC55A40000-memory.dmp

Download

memory/11196-8476-0x00007FFC55A30000-0x00007FFC55A40000-memory.dmp

Download

memory/11196-8477-0x00007FFC55A30000-0x00007FFC55A40000-memory.dmp

Download

memory/11196-8478-0x00007FFC55A30000-0x00007FFC55A40000-memory.dmp

Download

memory/11196-8481-0x00007FFC55A30000-0x00007FFC55A40000-memory.dmp

Download

memory/11196-8480-0x00007FFC55A30000-0x00007FFC55A40000-memory.dmp

Download

memory/12340-8493-0x00007FF7263E0000-0x00007FF72678E000-memory.dmp

Download

memory/12340-8511-0x00007FFC6D080000-0x00007FFC6ED80000-memory.dmp

Download

memory/12340-8496-0x00007FFC72D60000-0x00007FFC739AE000-memory.dmp

Download

memory/12340-8495-0x00007FFC72460000-0x00007FFC729EE000-memory.dmp

Download

memory/12340-8494-0x00007FFC758D0000-0x00007FFC75A14000-memory.dmp

Download

memory/13892-8575-0x00007FF7263E0000-0x00007FF72678E000-memory.dmp

Download

memory/13892-8576-0x00007FFC758D0000-0x00007FFC75A14000-memory.dmp

Download

memory/13892-8578-0x00007FFC72D60000-0x00007FFC739AE000-memory.dmp

Download

memory/13892-8577-0x00007FFC72460000-0x00007FFC729EE000-memory.dmp

Download

memory/13892-8593-0x00007FFC6D080000-0x00007FFC6ED80000-memory.dmp

Download