Analysis
- max time kernel
117s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 23:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
- Size 5.7MB
- Sample260722-2z96rawfjf
- SHA256 f6b77745563728c433ca6bd0712f65f3b113d549e726f77f9180a4d1a957be09
- MD5 f735f67efd9c5f8c0222aa7750b1e39b
- SHA1 b6eaa0996c74f95f141809e0124fab5a4c78e6b5
- SHA512 2230f20bd1511e4d45fcba0d453cea84674f32539cd806bbc32c837f302f9c4aa95f9dfb436478a14aacdb488ce6bf28696d0ec937d7b081b5588547a81d9848
- SSDEEP 98304:wtS5drV2MeZ08RdazwPB4XqCc8br5MDG/5xJDJ:DXoDDCcmr5WqHT
- TLSH T17856BF01BB85C5B1F59201B0587AAB7A583EBE38573089C7A7D11E2A84312D37A37F5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 15 IoCs
pid Process 3104 elevation_service.exe 6120 elevation_service.exe 4232 maintenanceservice.exe 2504 OSE.EXE 5264 PerceptionSimulationService.exe 2176 perfhost.exe 1212 ReFsDedupSvc.exe 3760 SensorDataService.exe 3312 ssh-agent.exe 3028 AgentService.exe 3476 SearchIndexer.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 3188 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 2068 wpscloudsvr.exe 5048 kwinappinstaller.exe - Loads dropped DLL 21 IoCs
pid Process 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wpscloudsvr.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe - Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification \??\PhysicalDrive0 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe File opened for modification \??\PhysicalDrive0 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\32b04376238bf42.bin elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\7-Zip\7zG.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000984dd8372e1add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f95e29382e1add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000468481382e1add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d5454392e1add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee5117382e1add01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000414f0b392e1add01 SearchProtocolHost.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoapp\shell\ = "open" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksolink 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoWPSCloudSvr\shell\open\command 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksowps\shell\open\command 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoet\shell\open 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoWPSCloudSvr\shell\open 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoqing\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Kingsoft\\WPS Office\\ksolaunch.exe,4\"" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoet\shell 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoapp\shell\open\command 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoqing\DefaultIcon 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoqing\shell\ = "open" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksowpp\shell\open 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoWPSCloudSvr\DefaultIcon 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksolink\shell\ = "open" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksopdf\ = "PDF Protocol" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksopdf\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Kingsoft\\WPS Office\\ksolaunch.exe,4\"" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupWPS\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Kingsoft\\WPS Office\\ksolaunch.exe\" /wps \"%1\"" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupET\shell\open\command 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoCustomProtocol\shell\open\command 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoWPSCloudSvr\shell 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupWPS\shell 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoqing\shell\open\command 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksopdf\shell\open 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoCustomProtocol\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Kingsoft\\WPS Office\\ksolaunch.exe\" \"%1\"" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksopdf\shell 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoWPSCloudSvr\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Kingsoft\\WPS Office\\ksolaunch.exe,4\"" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupWPS\URL Protocol 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksolink\shell\open\command 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupET\shell\open 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoCustomProtocol\DefaultIcon 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupWPP\shell 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksowpp\shell 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupWPS 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupET\ = "ET WebStartUp Protocol" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupET\DefaultIcon 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksolink\ = "URL:qingbangong Protocol" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoapp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Kingsoft\\WPS Office\\ksolaunch.exe\" /qingbangong \"%1\"" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksowpp\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Kingsoft\\WPS Office\\ksolaunch.exe,4\"" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoWPSCloudSvr\ = "WPS Office" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupWPS\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Kingsoft\\WPS Office\\ksolaunch.exe,4\"" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksopdf\URL Protocol 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupET\shell 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupWPP\URL Protocol 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoet\shell\open\command 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupET 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoet\ = "ET Protocol" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoWPSCloudSvr\shell\ = "open" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksolink\shell\open 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoet\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Kingsoft\\WPS Office\\ksolaunch.exe,4\"" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksopdf\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Kingsoft\\WPS Office\\ksolaunch.exe\" /pdf \"%1\"" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksowpp\shell\ = "open" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoCustomProtocol\URL Protocol 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoCustomProtocol\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Kingsoft\\WPS Office\\ksolaunch.exe,4\"" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoCustomProtocol\shell 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoWPSCloudSvr\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Kingsoft\\WPS Office\\ksolaunch.exe\" /qingbangong \"%1\"" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupWPP\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Kingsoft\\WPS Office\\ksolaunch.exe,4\"" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupWPP\DefaultIcon 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ksoet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Kingsoft\\WPS Office\\ksolaunch.exe\" /et \"%1\"" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupWPS\ = "WPS WebStartUp Protocol" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupWPS\DefaultIcon 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupET\shell\ = "open" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupWPP 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupWPP\shell\open\command 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\KsoWebStartupWPP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Kingsoft\\WPS Office\\ksolaunch.exe\" /wpp \"%1\"" 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe - Modifies system certificate store 2 TTPs 40 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedDevices 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\OemEsim 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TestSignRoot 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\FlightRoot 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 3188 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 3188 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 3188 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 3188 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 3188 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 3188 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 3188 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 3188 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 3188 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 3188 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 3188 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 3188 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 828 Process not Found 828 Process not Found - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Token: SeBackupPrivilege 1212 ReFsDedupSvc.exe Token: SeRestorePrivilege 1212 ReFsDedupSvc.exe Token: SeBackupPrivilege 1212 ReFsDedupSvc.exe Token: SeRestorePrivilege 1212 ReFsDedupSvc.exe Token: SeBackupPrivilege 1212 ReFsDedupSvc.exe Token: SeRestorePrivilege 1212 ReFsDedupSvc.exe Token: SeBackupPrivilege 1212 ReFsDedupSvc.exe Token: SeRestorePrivilege 1212 ReFsDedupSvc.exe Token: SeBackupPrivilege 1212 ReFsDedupSvc.exe Token: SeRestorePrivilege 1212 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 3028 AgentService.exe Token: 33 3476 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3476 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3476 SearchIndexer.exe Token: SeDebugPrivilege 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Token: SeDebugPrivilege 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Token: SeDebugPrivilege 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Token: SeDebugPrivilege 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe Token: SeDebugPrivilege 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Token: SeRestorePrivilege 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Token: SeRestorePrivilege 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Token: SeRestorePrivilege 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe Token: SeRestorePrivilege 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3476 wrote to memory of 3396 3476 SearchIndexer.exe 100 PID 3476 wrote to memory of 2444 3476 SearchIndexer.exe 101 PID 3476 wrote to memory of 4260 3476 SearchIndexer.exe 102 PID 3476 wrote to memory of 2496 3476 SearchIndexer.exe 103 PID 4972 wrote to memory of 4180 4972 2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe 105 PID 4180 wrote to memory of 2068 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 107 PID 4180 wrote to memory of 5048 4180 5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_f735f67efd9c5f8c0222aa7750b1e39b_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\ProgramData\WPS\Installers\5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe"C:\ProgramData\WPS\Installers\5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Program Files\Kingsoft\office6\wpscloudsvr.exe"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:2068
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\kwinappinstaller.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\kwinappinstaller.exe" -i "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\menuext" wpsappext1 wpsappext2 wpsappext33⤵
- Executes dropped EXE
PID:5048
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe" /prometheus /download_lang_on_start /lang=en_US /from=get_start_with_wps_after_install_onlinesetup2⤵PID:440
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3104
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:6120
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4232
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2504
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5264
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2176
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1212
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3760
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3312
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3028
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:3396
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2444
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2892 2844 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4260
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2896 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:2496
-
-
C:\ProgramData\WPS\Installers\5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe"C:\ProgramData\WPS\Installers\5e93d58b367e474788ea23e8be59b197_Personal_Office_i18n_Free.exe.601.1288.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5A58FE -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3188 -
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kdesktopshellext\kdesktopshellext.dll"2⤵PID:1980
-
C:\Windows\SysWOW64\regsvr32.exe/s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kdesktopshellext\kdesktopshellext.dll"3⤵PID:3028
-
-
-
C:\Program Files\Kingsoft\office6\wpscloudsvr.exe"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService1⤵PID:2696
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\ksolaunch.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\\ksolaunch.exe"1⤵PID:1928
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 b6be2c4ad8e9a91021034ac8fdafed7ab15ea1c95797675bfd32f2a8911175af
- MD5 a7c0141bef25432161f00d3e0cdbc16b
- SHA1 4491a8c4fd44eacb23c43ffc8fa4169adb81eb51
- SHA512 2d9d95c8701130d6919786f91343cf02eb354ce9fca8ab2b865cf4f11e8aca166c38745aba40cb6aacf5c1f525f844a3fc953a419f5d9ea90f88c775c141a3e4
- SSDEEP 49152:vb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnD/YIQkJV:t3q6tjB8DJ
- TLSH T116D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 bf049f606406678ac33edf8eb5ea90822f583e3a32f8c1dc8fc4028857f0d8b9
- MD5 74a9a6a0cb8ef5f4af8e6643c420cb48
- SHA1 523249239c7a2a792d042fc0ca94802253e07b3d
- SHA512 e6ffc03f43a2142dbba640355ee9c1812243a052562d4651a28ea7f456b30e4e4ab26aa3408ae94fba01c75441d5771ff0bed4a7b73348d824c6dd448eb40f16
- SSDEEP 12288:m1XLsswWkxy2lRq2czA0PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:EXYfDtczA0PsHAnrsRwYIQk3mhUVi
- TLSH T18C65F12963E409F9ED67823CCCA18515E6337C9187A0E79B03E499261F337D85E3EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 32d54327ed09180239d1a14df455d92e878f769fc32e60539e52013ba92c04c0
- MD5 6d0cf150a90747eb5233e69a025a8bc7
- SHA1 5e0b9909fbffb41dcc4b608ebec1356dded4e83c
- SHA512 df76258b27c4b4d274fb2e30342a5e91775f0386f05b9d79a940501d6a9eec5e47e9881a8108cd9168ff73674f7a4ac807d2a7a87e50cb8212374cb883505b7f
- SSDEEP 24576:U0Le5ji0hmxnrMfPsHAnrsRwYIQk3mhUVi:UPji0AxW/YIQkJV
- TLSH T141859E16F6788331D073C0B9C5D2A69EE97230815B308ACB4296D77C7E67BE68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 edcd7ffea380d0b8f86784660d8ae5bf47b42c6d09d66c9ff698b3f4c282ab5e
- MD5 5a3385c63a5b6467eb7b6952a91b8da5
- SHA1 6ffc554b4fe640f51951647bc084ec897ebbf519
- SHA512 800da692432a512c53bf944a91b82404532514b6e7f397df7b62783b2c81cc0f0b77ddc6363a6bdce02081ae38c944dc71af1914222828df475ff7f9b333ceb9
- SSDEEP 24576:Sa7/ezSC6vUyDZaqgrvWx6q8wyu1PsHAnrsRwYIQk3mhUVi:1/ezSC6vURPvMHjyK/YIQkJV
- TLSH T114755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 645cf53f3a5b91c44db8dc1f03c97e81b2c0e8026581790afbe5ed2d845cd988
- MD5 dde2e7484f85aaff330c02afc2260cdd
- SHA1 4d66ecf6b5c99498c3066a244ce94767c443c9bc
- SHA512 dfdb45cc3d6b5b8587774bd0521b83abefad28f3803213d536bd7fc2311d4c701d22480e5dd9e0ca0de03644d8736af426f198e13e04cb7475ced7d0ac136909
- SSDEEP 24576:IVbqPb88hv/lV7QPsHAnrsRwYIQk3mhUVi:IVO88hXlVo/YIQkJV
- TLSH T111559F66F6748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E67BD6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 49897213cc9f2bce5d0f03dbedc47af98b996c6884b9d6fbc35ca38dc1945e33
- MD5 53e848abebcce75e69119744420161b5
- SHA1 4a34470942b87c91272f67d8dd7211b69233f129
- SHA512 a687f7f580b09d57924d881c8c9efdafa41f159610052128e86ff934e1befbaa36537f1689fd64cf1935996ea0fc6eef17d79bf31ed72f90290b265bdd266b58
- SSDEEP 12288:4GbPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:4GbPsHAnrsRwYIQk3mhUVi
- TLSH T1294523A6C3AD85B0E3BB06343CA1E929C5377EE0FDE1133581F0761F6C35E01A566A96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 84f2bfc6b9ab08dc1514e0fe7afb95424daa99c4c677c239e4520d9fe5e49553
- MD5 f96b70e5f733d7c09023a689ab7dbed9
- SHA1 687a65bbee1f6c1290bee22516fc2f006f206984
- SHA512 54907cbc2c7deb46a6e7beaeaecbd20a2cf36040d16c3166911cf879a31706e3ce9be6f8a41597d570c2db04c922b8204baf9ec797e4cf859b7af92e6ebc3494
- SSDEEP 12288:Rmw5HEjsChNOBFgl0WDm+CVPsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:MwuXOWaPsHAnrsRwYIQk3mhUVi
- TLSH T1EB65F14A73E80CF9E5A742388953C536E7B2BC512A61D71F03A0C65B6F37711AD2DB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 61a15ff3e99467024817b9ce6e86079a14b6f956026979843267ca45630f65fd
- MD5 dd566ef787c7f8653f8b124d42b6f3c7
- SHA1 302fca6466459d093f0143cebba06c751783c023
- SHA512 d3c5522ac2c152285d783c7e93f94580d47e58d8f0510080072746a8fc683c23b5b8b01794eaebf5da8260e2ea259a41280bf9930c802fbc790cfd8e559ab9d7
- SSDEEP 49152:tB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glw/YIQkJV:zu6JmQxd2dwDJ
- TLSH T1BCD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.6MB
- SHA256 f7034792a5067d98c6e054ef4fb48650b781fab6b0c3da82b0c76228bbcedf0f
- MD5 a6ecce5196766ab59153004c795c40d7
- SHA1 f8a2740b934571c9c4cc6bbf60000c708961cc0f
- SHA512 7e60acc642931f35dc8d6ca0cbff73fc6009e8d011f54455692e52677430ea24674544229d539734a4fb542d2c062be7714854ef4856dcc4edc2446f2f62f57f
- SSDEEP 24576:PfwvOk9RX6wkyAI7PsHAnrsRwYIQk3mhUVi:/MnYI3/YIQkJV
- TLSH T1EC85DF29EBDC44E5E1B7923C99B3460AF6B178691B71C2CF0299536E0E33ED46D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 d0aca96f1f9b5d9715d0a0987940de0c79ffc75b1612651838d0cfc3c84d678f
- MD5 581e462cd618f4b5452ec2fa664f6698
- SHA1 07f03554c9a1d29aaa3a85cbdee4003e8e59b1dc
- SHA512 5de9db44eb0f7a758c73f81d720f754e4520c4761ac30d36a3dffb81b7750b4de9ad64472b9df0502d437c7af6810653f5c910dc37bad2e8c9204adca851f7bc
- SSDEEP 49152:iYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0g/YIQkJV:yySzP4DJ
- TLSH T100067C96A1A801D5C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 5a6a580374b98625cee6305db88b92b8fcb2b5943e1d552b4ec4415c4420e04f
- MD5 457eb1f448e73d3a0199337c92ae3912
- SHA1 f1e9cbcae2b76a725235fc514a1a3f47011b00f6
- SHA512 b3e31fd8aed698ed17033ef84a1ffe7bbf7bc92d4f7b5466e6cbc019129bd9ffab9a09c9cf23afb37e43d64d70df9dbd3350fec75cc56e69a66e492bb6503a57
- SSDEEP 24576:F47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYSPsHAnrsRwYIQk3mhUVi:F47JUQjairIhCnDHUPfF/w/YIQkJV
- TLSH T1CA65AE1EA3EC01E5E1BA827885158A5AEA71782D5F31C6CF12B0837D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 001177a54b9b165e3583b0bb2c1e8368f52a5071e06409a28cee40d2ad155751
- MD5 8c4de2871ccccaf1ff207e931e5a1f01
- SHA1 5bb99c30178213c6016e251475f1f16cd39712f5
- SHA512 d0c045ff47cce65d6133c23dec397638c90566438a21b7a5cef64680e9f8770ec1997adc926f8742ef031c5625e68260725945a4af24c3acd28e0cc229256816
- SSDEEP 12288:IjfQC6y5bgw2vTT90syMcPhGCh3Acyu4vaRM7OX7rtk:I8C6/w2vTT9fkGCh3uhvaRM7K
- TLSH T182452811762BD75FC6A940325E33D1CCAB707D01EE45AB0372C8873FD576668BAB2292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 535KB
- SHA256 3396823b1ed76e713d4dfb1ac6276607d9c5d6fa7cfb148e36e6f4114ff545c3
- MD5 7a8fbdf796cb9363b065f40ea52de0d1
- SHA1 3fc86eeec31aad9aa714567b9137a994b5ac79fc
- SHA512 532161b4ef06368e168562a78fd0bf74f950426976d720bdbe4e5a0003a06d3d633cd158fa3cd24e5bbe5277c1c8ade6e491a1ed233b694008a7c71f3db48f13
- SSDEEP 1536:/rrUxTB6etbsa+hTfzkctud8pjXcdHFm998WF87WToprjwVtcY/6+HdLm9hhpkRz:Tr8Toisnnk0JXoo97FQtIxy+9q0wUq4
- TLSH T187C4C6145BB6D35FDC69C8BB50717189AF383521AB412F886BC9887858B301E71FB3AD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 471B
- SHA256 97b4ca23c794af1a92a839f3ad9b74defe4681160061d01e02a7c5de233d4260
- MD5 5f955a6ea594edaa3ff59ead2093ee23
- SHA1 0dd51ed4a70ecc3a39eee9b9b0cf03ff33c25d54
- SHA512 a701ad2824aa444870d4338ae85f37e6c92ed0fbfb842d504c4aab513c195eb9f8f0d9c052960d9eb6bd56932669888312e4b451076cbff1d89bc1ef60f9e964
- TLSH T13DF0DCB70CB734E12023843C3BF46B7A22F25A9910C78431703009D083E36BD128E40E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
- Size 727B
- SHA256 65fd6a0fae15910213d0edd317e3b0f0f12a9929e4e659feb599b774c8403f4c
- MD5 c4d678ee3298afcedc05b1029c122cb4
- SHA1 c67835bc13773684498967bfa9142aaec849bf1a
- SHA512 10f55cf5a529597ab9b1354e953746f7dac150a652ed48ccb342bd6753f27fb6f30ba52b4993e90c619988b299d6866ee4e2093dd2c7c689a3784d1ab5ded3ec
- TLSH T1CA016004066A1ED0FE12288A9738863A6A8742845BAF084DA23987E488C5323DE22200
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 6d2d75d1a6eb0fe58611d3cc961aa193da86ee077c98ba511db3c8316ad5d35e
- MD5 02ae2ba9827fa8234b1f504337edae45
- SHA1 966a1a97bafa28d1f326affd8839fdefc6531d49
- SHA512 822ab06199070fca3a3d5e1140890b08714256f473157b7eacb78c54a94e2498f03149643817a201ca9e42d9c48a213ff01fbee7145427b1c177ab5603739032
- TLSH T12801992218D9CAC034D3C4169FDC53F2F566C3FA304042C27174539B14607B2B763155
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 400B
- SHA256 f1679571c7c9d660cd12dbd7bb433a08f928017cab62a771c718a5b268fe095f
- MD5 a493d8bd238710b56bc261c3f416aee3
- SHA1 788700e60fb9742219064be47ff8384b2b918128
- SHA512 9fab3176475413529cab850567b492467abe4723883373dff8e8157f0665512007924ce3d12d2a0b9efcbd7f80274db26ed1b2f5338e3048a4a855f052b9535c
- TLSH T183E0202417FA541EF1B0977403EDD0967F27F1423C4456BE1D82151D9D1BA005C56C35
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
- Size 404B
- SHA256 b6ed3568484dbab63b153875a9cd5a3f56f0e6673f339ae15ffa638f6cb38519
- MD5 65136a7a965a398f738545773ae67273
- SHA1 36c873af30006b8c5e0c246904f5dd3910a2eca9
- SHA512 b18a7cfbf17df96dd75bb2cce8975159f136c43301700af4f7017696c65f5d18ac4fd3f14ee809af62455f34a05430b946b6388b7eb7f9d2e83e8294090d9f10
- TLSH T160E0C63422F90C9EF0F0D07442E298228C99F20B2800C2A91140534AAA26B009CB2234
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 8e3c48f408f1849cebd99ea53f797e9ccadf5d55067d1695f74867165b88fe39
- MD5 122274474e93daa82428f0c38707cd81
- SHA1 637fda41da6c67d48c409302f13632292b879a33
- SHA512 130cbb49ebe9f5d52adbc76abd895a22fc6dd6c659184698cb5abb191024b6847c6a5e41839d612aa885b30f2e1183e498c38cdee6e7eb6ce0a126a3a17a93e4
- TLSH T1DFE0C63C22EFB81EF0B08C3146F9A1762DA8F3022400B3B80AD08308FB0AF015E10AF0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\StartScreenTile\ksolaunch\logo-small.png
- Size 6KB
- SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
- MD5 8d650fe389e3665607fdbf938c1a1722
- SHA1 2e545f9555ff22313e4ce113995d8aa694e5cab8
- SHA512 f116621bfecb602d02919eb1ee9d7dc92e82b313b8b54cda42ab48c5e7ec60b02005edcad763fff6b497ca4bc46e83cb0c9a249be791f245bb9c599950fdf015
- SSDEEP 192:HSO0z+xgsZ7wNP+agwQznBm2KIvdgoeAtzpZb/D1:yMRoP+z5IIa8hD1
- TLSH T1CCD19EEE6F1CCE4F079D52F7500AC0A9DEA218AA905764D4D68E70B471FE6D120EC5C3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\StartScreenTile\ksolaunch\logo.png
- Size 12KB
- SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
- MD5 d58510dca6b659c6e4ba7a454d5b75ce
- SHA1 e142de2dda3811a2e8bbbb2eb64d366e8eb9ea3c
- SHA512 42409f9976ad08ecf1756d1c2915f3ffd17cdc78e9ff552c0a08bdfa2fda8960e408721bfc9de1a5ed9c9aca3e23b97adb721b3c51b6b3f0ed3ee4a4c780cf88
- SSDEEP 192:ySLu8Kp8OtM5IirU31+5AejJ7D+N+QOtHQjrE9aTYpR8XnXrWjvyNTtLJci:NC8o8do1+5D+N+QPE9B2Xn7WrINJP
- TLSH T1BC42C08F68918EB2CE443C39F356115F1FE12A5E7E19A2CF2CE7944A239044ACE1591F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\everythingsearch\everythingbinary\Everything-KingSoft-Read-Only.ini
- Size 404B
- SHA256 b5980cd1122d2ad4727bc06806e3d2a6598b7d67b6eb3d2732938d08c6deedbb
- MD5 6a4653f40acaaa13e2b0f60f067ea93f
- SHA1 34981baa55ef31ae6b6d5985fdd02798e3bacde2
- SHA512 f286472389e50fa51abe03068cc3e1f9d18b19926d84b66b1df28c157cbc70e8de32a8deb7b4096f462605a2bdd4d76f9863c6ca0872703c60d473a3271778ea
- TLSH T15DE02B99808C4B1C7656E6948D715E4F42E1C79C1B98174CCB0BC241E91950DF63A439
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kcoworkdockpanel\mui\es_MX\kcoworkdockpanel.qm
- Size 846B
- SHA256 8f0de81b05e2ce8a22432406009084933f0cf410e6efb534aafd71699651120c
- MD5 6e815f2b93f16067d08e51cdb69b81e4
- SHA1 40630f21ec4e2ce47da271f5e379737bef67fad5
- SHA512 7e9586a605815f829a2881ae328d4df3cb9600949767cc5c8fb8186cc2243b08d8cec4bd52cff81c728fdb0c8fd7ce1c9d8e52e9fe4139722e99d4be12c6e482
- TLSH T12F01E9D527FD2F19F3F79BB179E652108F3679082931D16F2145A40D05A15505DD0327
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kcoworkdockpanel\mui\vi_VN\kcoworkdockpanel.qm
- Size 839B
- SHA256 ad5549bf1c748909f191eba6e08caccfb31dbe1a2ce4bfafcb1e41702f40c95f
- MD5 3eabae85edf1db8a54d42509c660862c
- SHA1 ea6133582aaf7aaf5330142474dec996e527b461
- SHA512 05d619228af227bec2d3b33aab044dcaf79b69633c604f81d6456eb10d4420e48024a9a88cd706fb5c00908565347f5e04302f90bc5211d48d99e2aab2feb7d9
- TLSH T16801E29523BD2F19F3F79BB17AEAA2208F3679082932D16F2145A40D05A29508EE0327
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\ketaiconditionalformat\webview\run.ini
- Size 171B
- SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
- MD5 b30cb271e143eace0f55ea2e562e1e9f
- SHA1 9d97dbf24931cfc114384c3f4dbbae21c9e51be5
- SHA512 dc593185fa63b458024c3a913c558e5686806154181dea67eec786ada50595c53bab822833ad1e76c9acdf21be3eba50631391b7e575d7f1f6409ceccf966535
- TLSH T1AAC080D4D0256F97DC31C6B5ED54AF1A7560E700251C1EC3D530DC4E9E9696551C805D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kpdfcorporateglossary\res\dist\index.html
- Size 636B
- SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
- MD5 72cdeca808b16e794ec5b66bd02246bf
- SHA1 e75b6c4e084efc8e60c9e4fbe9e9ae02bfbf4132
- SHA512 6562ed498bae7f819caa5ebff9ba373b1bbeae3c92befacbc44a72419e6a3aedeee7fe43347d1bf8c46b9c90c8e515181a6dc50c4ad954a640cf6b2520269ed8
- TLSH T1E5F002EA3C25F055CB911EA43DF2F19E245E3AB29DB9DE942AF4513543C03694D0BF48
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kpdfcorporateglossary\res\dist\index.js
- Size 2KB
- SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
- MD5 67dde682d1968824023dd9773f9ec48b
- SHA1 81e0a21a7ba2c05193ecc13672a3f537539e0699
- SHA512 86bccae3d66df4dd552c12a42d1ed0d57d6cdb7b904caa1f89c874e506fb76412b2df45e3e5f673837cb72aa18b0ab2c1dfb489b1da37068d83d7ccb25d3d8ea
- TLSH T1FD5173C9F79E702209EAE136583F0006E17735596098A1C8B87ED8F16EB555E7077F38
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
- Size 7KB
- SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
- MD5 eb3b05c3a3fdef3b0c5c9020756ebb33
- SHA1 27c5773e17f9c05f471ccd22db42015561b4e669
- SHA512 9a511c6d0aad855448ae45130d7ed031062bb7e6881e68aa2406c7c122220318379c312bc13876599dd7fe88e2beac296adf5bcdc015ef4e0e3f362e76303ab0
- SSDEEP 96:9uMJIMzvOcuq4v+nB1W1QjjaKhwc3Rgjfqqm8bm83:9lTgVv+B1W1Q6ywc3RgjfDm8bm83
- TLSH T141F15211D6925216603393B4DFA25719FB260023A3038A38BFECA2558F75C495B93FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
- Size 4KB
- SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
- MD5 1ba2ae710d927f13d483fd5d1e548c9b
- SHA1 c0605efed936ee2600284e6480521d06fa64f872
- SHA512 f933cd352eaba92f509b3863353ddfefadfada26a4152ecdc4727d450bbf35e7b10fb3038fe8db340d5c63d74e608c1560ec84d0f6ffc8ccd940c9e0d7533544
- SSDEEP 48:i3H5R5hLOR4kt38PduMoglJrd6qTrp9hweFC0+6Ga:ipHFUs4MLBvuyCda
- TLSH T1EE9175DF61C388D9C1B1977F78C449A14F6FD951BA28351F55CF30622E5D75818C1C46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwebpromehelp\run.ini
- Size 226B
- SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
- MD5 abc3a6089b0ea76ffc960fbc9b6e66d1
- SHA1 50ad0cb201c13799024de56cf45116cf65ff5569
- SHA512 ec1e32b7bed882095b23e049a4e1a86acf0bf993e2f691105ffbd99d93ebf28faad4fbdd645ac1eefa74ede575854a3994c7c6d2bacc6f7a09a1991561b1a44b
- TLSH T157D09700C0B5658AC1254C827CA53DC411085B4B27608E02CCF0C34D508EBECE56B08A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
- Size 216B
- SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
- MD5 07306930f7d374663bd13e38ea0e92a1
- SHA1 12f877e8ab93d874b55d75eef6747615619dad4f
- SHA512 4cc0517ed0b9d665df4db93fb3093067e90f64b34f1d41420ed975b4cec64d4cc0aede64092d79c610c04e1ecd9514a9ef48389d5c157b5bcf698fc33670db98
- TLSH T1D8D0223BB3CC8E1CF9224A22F35A713580AF41C3548942E4D8322032E4011CEB93B6E8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
- Size 334B
- SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
- MD5 d36fe6147829a72b42e054a5db27d270
- SHA1 80779a8eb37d8bb1d5fcc594576f80dbd61fac98
- SHA512 94224816f757241b3a6d19788225378ae070fc62b4620e11e10a033e3be5d9cc858cd9e669cc275b1fa82e57094d0df13a6d9868cf00afaa17cf2ec0193acd74
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
- Size 327B
- SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
- MD5 18770de3f96bac1e75e588015024fcf8
- SHA1 e6254c054edef68f9c27059efd82eeaa69c863b5
- SHA512 fcb76291a73d7f2e30f4266ea8f0dfa2d9e203cf9770fb7ffd73cc1994502992fabd0803224c1e1155c1e4b678b5af0e8b3aec114beb1f02299e8885d5a61d0a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
- Size 54KB
- SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
- MD5 732389ded34cb9c52dd88271f1345af9
- SHA1 8058fc55ef8432832d0b3033680c73702562de0f
- SHA512 e8971ae48f5287d252f5b0a2d0516091bef0d2febf7d01fd7b435e426d106fea251037439ec42c2937e934b66f38e5eb43d00a213cdf334f482f4a06b1817f9c
- SSDEEP 1536:qTIRCXXCwinqtuPM16hD2N3SUjbwaST4DCJe:39GEcgD2njb5ST4h
- TLSH T10A433B32436A9BE7F416047F5C1F55830A9F4F22F53DEA8B83A6192514162FD0864BEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
- Size 27KB
- SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
- MD5 535877f50039c0cb49a6196a5b7517cd
- SHA1 0000c4e27d38f9f8bbe4e58b5ce2477e589507a7
- SHA512 da269b20f13fb5b0bb4628b75ec29e69bb2d36999e94b61a846cb58db679287a13d0aa38cdf64b2893558d183c4cc5df8da770e5a5b2a3288622cd4bd0e1c87b
- SSDEEP 768:gOvv6ExpCVxUtrT6w8ClFd80EjPVerMKBaGXjAlEm:Hvv6xVWewtlFdGjPlkFjAlEm
- TLSH T1B9C2E13197213AE9D9824EF876E498FEF1651402290F390E8696ADB3A98D5C73E16831
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
- Size 107KB
- SHA256 c9c5602e26393532e59391d5944a578716f3b6cad104ae20ac8caac805e52f86
- MD5 d758ec835091abce0528909c5dadfe24
- SHA1 07a9ffb19860ece3293780c707bc71f25a6e5d42
- SHA512 74d869f2cc25b5a49adea778f52f59c6f4b7f2eca31c511f19250538d241136a6cbefedccb250a3773500bdc6b9caa57ae7cee40c0dc2d8753f2386e2f390cc4
- SSDEEP 3072:KazzQ51KYGqMkYUl26MeCsAcdl6y7tqWD:mMQ/euD
- TLSH T13DB31B37214D132D383BDAA2E55D659A60C8F61BC01253F5FA247B1DCA837873A763AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
- Size 279KB
- SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
- MD5 a3964e72421a1ef5fb60c6e17eb5d705
- SHA1 5dd9584be5141e884a230c48746e1c88126b0a55
- SHA512 4ce4119b7407b460969041809354c4ede587047ee643f2897eb0ecb9627608431f43fed27c54c70bacff3a6694eb32a85b535c7d6397ac22d7d28e260b0a5467
- SSDEEP 1536:39eSBQG+dyAUlHj/8D0Q+SPxZztR+LCrwHFfyqHYb3PPV7BYUOf0I79lDxiRSL2Q:3zfZYKVxiW
- TLSH T14054B6229140212E702BDE3DF7C4EA4AE225C6B3C4125BFEF953651DC7C36AA117778A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
- Size 380KB
- SHA256 f1bd1ffaba49fd0c0040f182231f739000b0e4bc762900ecacab4980f743b203
- MD5 bb8a0b01c0ac1190e643c4e9daf4b69e
- SHA1 f0286c3ea896a359666be8f10a7519c767afb321
- SHA512 da37ebedf1e5365df105b3bfb559d0dc6a75b2896ad29c844c6b987ac5388139fe88414cc6128144f6fa50086564ea67f257eec54941dd43b124be0b8b276573
- SSDEEP 6144:5pK457wXrka10TbOXsEYpHBBs6Ve5NtXoqIpgznl87A6v0eX4AiDuViQbgQgILTv:64G0WtYpmiLlTD8QmIqU1NBqq
- TLSH T1E4846C4B758BBB5A1F35B66340DF3C88D01C6EC09812A5C9FABDD9D09144B9A32D63BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
- Size 249KB
- SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
- MD5 6351ea268f992f52e0f4418a7028b91d
- SHA1 5bb3cb88465c550a1fd033a079a8b2eba5e071b8
- SHA512 44940d07abfdee6403e9400e596ac5e5eb234ba77a1c90c2fe4086878c12f4805c709eb84538071f21d5710d3569d342e7caea10061e2ab2661c5117c5966297
- SSDEEP 3072:p+Xy2rHhkiTtcsuaIwK3zqDLW/ix3Iu7doNFBWgz/bwUzxqcG7gLEOhA:phKHhklsi3zpCdoNFBHz/bwAfG7cW
- TLSH T10A44F8CDB2D1B0A517EB61B4813F610BF27B6499B44E80D0E226E5D4BC7998E9127F3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
- Size 424KB
- SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
- MD5 cf29fba214e7f43f2ca1b629109d126b
- SHA1 d0dda9486528586af6943abe7a3afa319c790f25
- SHA512 2ad7e4711f5917b8d13f861d4fb2688e6ce3951da43a89263a2d9743199e173429398ec1a9537b1df25593d3999dd34fb590e2d2a6e7a632ccc44265d93c3bca
- SSDEEP 6144:z8KzCOcC0CXWsJvRekr0dgei/zJbBoCF7az2bzNM:zbzCODTWsJvRbw6zJbBfaz2bC
- TLSH T13694198DB2C1B0A517EB60B4913F610BF23B6469B44E80D4F266E5E57C7898E9127F3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
- Size 10KB
- SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
- MD5 0f4634d4af8b73f882440c1181697d86
- SHA1 748bb9a14c8a6c64fa060ddcb1b4baebfb3f6fd3
- SHA512 eeff081cb256a44ff4557dae145c3d277ad936fef58674cb7d2949b6c302c3a746f05495daa6ccabf39c26bacf13c6fee3bab20de4f1d13810be0503787c89d5
- SSDEEP 192:cyxPpQcKb2d4U1nE92Ui6OPl20b3G0qE7I2ByobYGeBv+x9qkgYbeO:zzFZr6OddG0q/yTh3UYx
- TLSH T1AC32C887B30483755A90E790F6C76DA5A93ED0EE73A4168A3CEE421812581DEB3E7CC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
- Size 13KB
- SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
- MD5 dd59d31e84434c59c5c3735bd0b0dc3b
- SHA1 c34473850d3749aae725856f68a262a0afebee00
- SHA512 f3acd51920f945b49dceb56fd2a5a4ff170c4a5770665bef3d888f8497a288dc33bd15f24780cbe9b8ced585fbacb92a8700d1322a6d4acd2b6e5893370822ac
- SSDEEP 192:GwSuCUHXDhEblYfhQ9GYSOqUr9b1AARAU0qWo3wYXVMojXiyaH:dCaXDhEK55YmUrLAgkqWo3RVhpQ
- TLSH T140523295F3C50E22B4991749BA03D57BF19558FAFC2CC18D5CF2D236136C9C986928C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
- Size 14KB
- SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
- MD5 5cee0947c1ef6f00e18eb17cf77388af
- SHA1 5a27bc625acfb46d2368a9a376d797ecab912a3a
- SHA512 1bf91f08d2a2a446ef0e22df40fd09b090fa300f599bacdd5c698aa61a6fef12ad3d3e38299804a016e5a22a82ddfeb6840cdc7a79ea51244942cb22e659331e
- SSDEEP 384:HTO1ksU66rAJGO+NedvSGdv+GfBgLj95LKn:zO1ksU66rAJG5NedKGdv+GfyLj2n
- TLSH T11D6230ACC3CD5C69C86183FA090B35C27836ED49FEA5AE7280EDF4202DA19DFD815674
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
- Size 57B
- SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
- MD5 b684f2b8022aaa97ede28f9d224c4db5
- SHA1 2087206ddbfd6d6d71f843a132b58ed533d87169
- SHA512 8d30da66bfdd99dab88c4b9766b692c39ecbc8dd725e9f858c95993d4f2bf46c37891a1f8f4f1eb6fe09bed7008b8df48d2a9b4f10d7caf20f823f121f6ebb40
- TLSH T19F9002E7F0A1707344616959630722AA35D11130017430010900487434A580FCD22F88
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
- Size 906B
- SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
- MD5 c47a5cfed147c402538358294808e68a
- SHA1 8aa499336bc4a50a70710735b67fc5da923fc61a
- SHA512 a71831abb9393b6c0ad62feb29fefbb192e1706b08ab88dec0a8e6a9cf61b6a7e106454a7e6e518f69425cc91846036e8fe2956ea939625678f17b330860ba1b
- TLSH T15311E309934DC285960AD7B8563C1754347272DF9E1FD55CE7E633012D3C6AF185C27A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
- Size 1KB
- SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
- MD5 c17417f321f52624ee0dc60ed76a31b6
- SHA1 b64e19a5b03c92a931fa9a1eba899f491e669a1e
- SHA512 bf160829598cf0b22ea48a5f7310adfbd26fbc1bbf23ea3cb8d9cebbeb92b5e81b914bd6021cd41df5984ef00698acb1c1151e134c714e0a1be7dcd439c78485
- TLSH T16D21F0ED57EE35C8644CD37028DA6079627B35F43969EF048914A9D1FE4205D499F9C0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
- Size 1KB
- SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
- MD5 0620393a949b58f6af37b0accb79e32c
- SHA1 0025e4da5ffb8695a8f9731a05b1b89f1a71bf24
- SHA512 0d308c758f825d548874cf8b4b8ec20f3685b39c7232246697dd95e5e5f40da7cd21de7ba5faafd0d8a121b5e6b85c5aadc4232e3f0c943535e062ae449ef29e
- TLSH T1333142D111BD0116E11AC365D7FD7AC70B3EB4DB26E558BCB68C250FAB404DB0A9B219
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\cfgs\setup.cfg
- Size 449B
- SHA256 43da7b18b9685f34614e3e6cb71a6feda052247eae7372e59e1f84011528d020
- MD5 8c15c1fe6e9b92a00d8bf6ea26a0b40f
- SHA1 943cb383daa545f2389463e67ef446d75efbb5e9
- SHA512 1e65bb741d94af3ec194e2fbbd54c5df08cae51fc74e0e0bc011108551a7ff6886ea58d8e1c87b603e71e4e914625244236e11ba1f9c9971a04a0980914562db
- TLSH T1C8F0556A030370741E22431410BA14F2E3FB02C81017800D25A8A88D7BBD83E86BF13A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
- Size 1KB
- SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
- MD5 66726a0fbd424ccb700cecb212a47007
- SHA1 9795ae26acf0b942ab6a0cd06f206ba69eda18db
- SHA512 30ddd2fa17517792a86bdb03827a0809ed362ab2dbd9a7baf194d1f47348c96e0ca8e64515c1a58d7a1740e85f53a3676b49ff6c699d598a27c234c14672604f
- TLSH T1E031C6CD318AC42FCC61D531F4D534156817D760BF928C74102BC5576E0F68E58C6662
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
- Size 41KB
- SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
- MD5 f41e909b0284949bdd3bea9393a6ff2f
- SHA1 a41497f65f44368ad517f464eb0da4403aa700c0
- SHA512 d800b9b807a72d19f17bf5bb923d2489328b2f8801c2146b0c67d3d4cd8c70d5f22decd6581ad14d5584f3895140180c8578ede4fa8df755ca742c18cbb3b67b
- SSDEEP 768:lwQ75cI1zETv/7H0vFtZKSZTRomseFVEFqG5IphchDB8h/rW7oELmG1wvcG7GyGK:9qNTn81Romse8Fl5ahcVChjQmG1/sl+Q
- TLSH T114139F61D40A142FC263B3F6E478164F73FEE86248179797ACD51096282F97C2E9D38E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\utility\install.ini
- Size 462B
- SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
- MD5 71e0a7ecd6bd2e91c04a3edf760c45d7
- SHA1 e6cf872ce6def16bca98818ba289395580701292
- SHA512 282b4c8be6abb97383d7dda8258fbf069fd668f4fad722582567cbc916b5c7da9a39a157a35511210306c19e46ef34c02af17f2af1ec7707bb3d84f3d529c3ca
- TLSH T178F097090C98C66E36282188B0D3C2C0A9ABCE260D0CE410E2D36E1BFC02E0A217E02D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.27458\utility\install.ini
- Size 595B
- SHA256 633b0a83d0c4f586a89b28c8b555051249d0de63ba28a46d3c70cc661c1977cb
- MD5 b7bb121835842879f516c4656ea02502
- SHA1 b1179ea85ecc19cbf63f38385413eccc91fbd1e1
- SHA512 18b22e323598dccf2a734fc155e11bdfefe9c3127c4c3413107d929d22b538d00ac0bba3c1b8be32a6d5aba0fdc1846ae3fd27bf3fea3e087b2896a52c85951b
- TLSH T1F3F0A2090994C56E31153148B0D3C5D0A99BCE151D4CA421E2E76E1BFC02D0E227D43E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APPX.8gbek23zppqz0vdg_hoidv8ke.tmp
- Size 4KB
- SHA256 9d2f34f1b17536dd689db858d42c85a78cb48ccf24f55fd578699dd1cbd7c930
- MD5 2bc82584706945350309746d863da639
- SHA1 f0862f788988dce106735e4bb66708aab43a06e0
- SHA512 1956c1d910995ee93dbb0977f8bc82c1aaf14bdb7549b34eead6055390d26361321192d6cef4e18fbb1ad5cf6faf44693fadc932ce63595550769c6a50b81a5e
- SSDEEP 96:0AxANmAN4ANGAxAqAGAmvACANANzAFFTfOS/VjHH3HSbUrbVj/x4JT9:zeTJzetx/ViGfBVLH3y4rpbx4JT9
- TLSH T1F291F14A98E415D052308825A36BE251AF0D4F9316CD80DCF9DCDA6D3FC53A79133AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APPX.8teqp4x5qvtis_dez_al8n7ag.tmp
- Size 712B
- SHA256 ca530362f0c0ce31427a69699ef6bfd74b6f7ab9e31e011482c3f740e2ab1591
- MD5 6767a05a4f1c2a2bf14c10ef8f465a04
- SHA1 7de766c8101ade47d5470fc587f184188af336e4
- SHA512 c13305627369cee18944f7a71973651f52e5d442b0e0d5dac1da9a1b58c7e913dc029fc22c8c10dbaa37783c7846756b2b76fb80ba74761c393ee4ce93aad385
- TLSH T12C01FE289318BE2A46784FAA0BBEB9403C02815B23170A6E6CCA897658174A11AA71D9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APPX._loacq33dv8836ryaqsybo1zh.tmp
- Size 4KB
- SHA256 322a6bbe4151c8c0d85b94a20e1566a69e7e19532fe6bb7ee4b5d806daea5366
- MD5 9829c378f563249eafe72d677b821374
- SHA1 cc15a1a414235d26265ebec559f4673fccf3ea58
- SHA512 08f7e7d3c93880f6fde8f0dafefa7c36c247f12a67239fa77c129c5e790b99a33622c24e7c08259d39fa0570c1057308d3650e3e7776602dfd29821853418ff6
- SSDEEP 96:0AxANmAN4ANGAxAqAGAmvACANANzAFqTQOS/VjHH3HRburbv/x4JT9:zeTJzetx/ViGcqVLH3xyrjx4JT9
- TLSH T1C991004A98E415D052308825A3B7E251AF0D4FA316CD80DCB9DCDA6D3FC63A795336E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APPX.bngi1tn6yaa9_7i7rdfz4ybff.tmp
- Size 10KB
- SHA256 48a4677f90caebdd754cd81625ce5a5c1472cbd77e104727973a983b7b69a37d
- MD5 799239e1a3e2a7dbc2558bc3ccce85ab
- SHA1 b1f241e70c3d694d1932d40d932c986f363bab84
- SHA512 bad9a87842089421b1be170e94b2e80c48d1c17caa56d715453c37edf1124901df5d36e1ea971fe35d50812e2e05d1ae79d26e516f9de7ee359386a5bb441fc6
- SSDEEP 192:eEaGIYiYF8+2Qih7kuby5BSNONULc8pq8RuwdmL4pUQrNyJlD:xaGIYistw7kGyn8y8RbmL4nNyJlD
- TLSH T1BD224BA388906C09ED17AD10B4D49A3BFEB675952ED1C1C37198C1A68B853833FDD2F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APPX.cidv0xjs9ufc2qrrwdyc2i2kc.tmp
- Size 10KB
- SHA256 98fe968a85beac88b25286253496e3c4b296dae7daa8a7311cc280a1b44b7306
- MD5 fec5a7505c73c1d8da22a482a7bc09b1
- SHA1 f4885fcd7fb6162bd52be86396e27609108f2dd1
- SHA512 76a093bd6f9af8ae077620995b378d45b1ba2fe2208f0d23e1c84756705fbc00904582db6ca696d6576338493fe023b1e83da36ebb015107c543e93f4c630ddd
- SSDEEP 192:IJIYiYF8+2Qih70aMDJULc8pq8RuwdmL4pUQrNyqkAHNs:IJIYistw70aMDiy8RbmL4nNyqr2
- TLSH T1B1223AA388902C05ED57AD10B4D4993BFEB2B1956ED1C1D37158D5968B823833BDD2FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APPX.hwxcvl91ychzgx165jybbzyig.tmp
- Size 712B
- SHA256 5d3a68b91b773660c9e58606782baaf5ba7a691919364373ad559fe8d0d47572
- MD5 9a7ea45256eb99a438e85eb122115d96
- SHA1 b3e77a58d4d3fb2dd01f866571e7ef7af6c3c2d8
- SHA512 bfdaf2da4e982a57cd0a6fc5d7391cae0ee7dfedc881a897d8ebf6e3425475cd1fdeed5bbad829516fda8ecb1415cc93c11fd798dd767ba075fb71713427f957
- TLSH T1CF01F4289318BF3646784FAA0F7DB6403C13815B13170A2A5CC7887648270D11A571D9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APPX.khw7mnsbhpuwk4x21z1gtae8f.tmp
- Size 4KB
- SHA256 81c968c375f69d9e4666901fd4c14a6ce4b738639ff78488562e2c79f8fb14d8
- MD5 a4e510ae4ca446423550859eb3193a92
- SHA1 de1f946c7687a9cbc4e427c106e62691a203b67c
- SHA512 f835d5adb86ab9feb23517a26a7054a6cfdaead71c3b3e0f2a2dea959376a119e7dad97f1c02bd5ad7d53ea7b1f42e65e9847e2842a290a7d4f6ca807cded707
- SSDEEP 96:0AxANmAN4ANGAxAqAGAmvACANANzAFjTpOS/VjHH3HMbgrbF/x4JT9:zeTJzetx/ViGhPVLH3sUrNx4JT9
- TLSH T17B91E14A98E415D092308825A367E251AF0D4FE716CD80DCB9DCDA6D3FC53A791336A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APPX.mbootsgtwljavf7_e_gv2r9jg.tmp
- Size 10KB
- SHA256 c5d31eaf2dcdd0552e36e1920b28fb4497d3a9861853933e2f7891cf6640d475
- MD5 4dfab569effef092d368c281a080ea40
- SHA1 d6dea8647c744bdcd79d8fb34bccfe053ae04bd8
- SHA512 5e6271b1abc0057b10ce099de54828e5ed66120ad11ea32626b355eaf8fc32bcc87dc9c1b0856edea4faf7c3b091a429304f8f29908e6080474de09ce2292ca2
- SSDEEP 192:FIYiYF8+2Qih7PhULc8pq8RuwdmL4pUQrNyreyL63rY0:FIYistw7P6y8RbmL4nNyrey2v
- TLSH T14D224BE389A42C05DD1BBD10B4D4A53BFEB276A52AD1C2D63158D166CB823823FDD1F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APPX.ru0g06noj5locitok9_97kerb.tmp
- Size 712B
- SHA256 305c5a71a701f62b895dbe79ee5a0ce797ac3b5c85b51521264723960078134f
- MD5 c2ce812dcfc9567ced0ffa26b1ea2713
- SHA1 1a1179f51be4e394f6667719776a6cf771678b3e
- SHA512 652f2bf022f2c31e1490e41dd15052c92fc4021cf8bf9d46c760e2045a76136f57a7fb5119475886e3ba5127b4cad9b64768cb86dbc2da00af428705a769a237
- TLSH T149012828A318FE35467C4FAA0FBDB5443C13415713171E6E6CC6C875581B1D11A571C9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\Qt5CoreKso.dll
- Size 5.7MB
- SHA256 594f50c668648035620f9e180e4419f0d5309097a69bf85d6a21cee14d1523f6
- MD5 4c9f67ecacbdb972e7feb27afbc810fb
- SHA1 2c755665772c76deea21365938450464c23c588c
- SHA512 faaa08ef6d6df0463f05dd01277d7f4c8c83a1b83c35354bef6a8b0033fcc3dd7553547219b86be205ccdc40df24df591529bceca66ec4c8bd645421c46c2b93
- SSDEEP 98304:ekcp4wh3njl0wPXJsv6tWKFdu9CUWigl4rHIscar:ekm4whzl0CJsv6tWKFdu9CUWIoscar
- TLSH T114567C47FA960269D8B6C238C9D7C117F673B80247214BDF2298A3496A777F0293F359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\Qt5GuiKso.dll
- Size 6.4MB
- SHA256 8be6e669754d5455e76417710a52dff1a56702b408ab0d1137774fa96c92fdf6
- MD5 9e1f7f93f937031e5297c90c7075d3fa
- SHA1 97656ecf71e2724b6791a92a9d537d35a731e3cd
- SHA512 4e83d0aeefbf1d13db7e1398c266ea1cfa6224640f5a658bc80575d07fbedb058e04c80a385b4d95917c5a1ac92bf614d973114d2613cb9708faadae79cf7ba3
- SSDEEP 49152:+0TIj9QFYeZhXgDIZil6pwbCOn33vV93VxX6Fo5uldoFf7oO+PzzzjVKLSJDTNRG:1TIjqzbc3am3+7z1K2RIvLCNi54N18
- TLSH T19566F886EA456359C972D17987CB042FE1F37C4283524BC76C45AB490E237EA1B7FE82
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\Qt5SvgKso.dll
- Size 503KB
- SHA256 e7e63cdeb522b8e72607c3a365eba4e7f1538955ef1c9ca9df799ca178c9677b
- MD5 f3fef98acf450e3c5ff2b44cafe8144c
- SHA1 4dcc3afa44a9c437185ec9c3c7273d088c230beb
- SHA512 ce2e6fd13cc406effecbdb518ccd1c38e55e526b688dbf0bbb34b9cd29f70e7c35e9103179848e6031255500f31a01ff54fe889dac116f381ca2806c6a8dc253
- SSDEEP 12288:NYYYJUNY675fyplktpsPQVLEgZ/ABXH9a/vngheZL/XEnEsrnJpaymesGrx10rka:NYYY475feysfE
- TLSH T121B44993FB520798D526D27CC8978806F273340443A39BDF2A5AEB651F236E1763E391
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\Qt5WidgetsKso.dll
- Size 5.6MB
- SHA256 423c0c95b6c4e005798aa6151d7f4b43a4f4c9694f0e926d0b0cc34106ba7ba1
- MD5 19b86ef8be86dfd4bfbf87bb226a7826
- SHA1 d65a0eb74c3e750020d1181cc0a53b72b83e70af
- SHA512 5fa6b120b42488198d497a3b5da093a9ecd130e7078fb0b30b7909a7107c73825bfc00920dbcf5e557112491b92ce879b00901c7ddea9611bb0382f573248ed4
- SSDEEP 49152:b96ypjI6A3p4lPvwtjPZFQ1+KXJjYxok/reBsgGCJ6eJ0Jd0ba8R9RtWDiRl9TId:DXcLAhRl9TIXdkroNiBTJ7XC
- TLSH T157466B43FBA50389C56BD23CCACB8513E2B2780447234BCB6959DB691F637E2197E790
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\Qt5WinExtrasKso.dll
- Size 251KB
- SHA256 86cb3e80b1a162c0e11c23e5501ef023de6894ec1056a5aea137470024c157a5
- MD5 5c467ef99bbdcaa30e2910aee511ec90
- SHA1 3b460734f120090115a81f9430f3cf972a8c5113
- SHA512 db70ad44ebd21680a16098a681a15f82bf13b07215940320c02414e331ab18e767dab07cae730c2a7a8ad539584d6ff861611d7705cfd02914c6700ebfac2121
- SSDEEP 3072:cF5o5cKUM7YLBwcJf1+6Ws2LB+xvN805sR:cfpMqxvN81
- TLSH T191449684B6DD9619F809B0B88FCCD199C223BAED8B47425F351ED39F4B619816E139F0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-console-l1-1-0.dll
- Size 11KB
- SHA256 2afbfa1d77969d0f4cee4547870355498d5c1da81d241e09556d0bd1d6230f8c
- MD5 919e653868a3d9f0c9865941573025df
- SHA1 eff2d4ff97e2b8d7ed0e456cb53b74199118a2e2
- SHA512 6aec9d7767eb82ebc893ebd97d499debff8da130817b6bb4bcb5eb5de1b074898f87db4f6c48b50052d4f8a027b3a707cad9d7ed5837a6dd9b53642b8a168932
- SSDEEP 192:4nWYhWxWWFYg7VWQ4uWjXUtpwBqnajrmaaGJ:2WYhWvZqlQGJ
- TLSH T186421A838EFC9543F9A66E701B99D9833C3DABD76910905925A8F19C2CC33D1EB0072D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-console-l1-2-0.dll
- Size 11KB
- SHA256 00942431c2d3193061c7f4dc340e8446bfdbf792a7489f60349299dff689c2f9
- MD5 7676560d0e9bc1ee9502d2f920d2892f
- SHA1 4a7a7a99900e41ff8a359ca85949acd828ddb068
- SHA512 f1e8db9ad44cd1aa991b9ed0e000c58978eb60b3b7d9908b6eb78e8146e9e12590b0014fc4a97bc490ffe378c0bf59a6e02109bfd8a01c3b6d0d653a5b612d15
- SSDEEP 192:iTWYhWyWWFYg7VWQ4uWq6Cu87ZqnajgnLSyu:sWYhWi1XHllk2yu
- TLSH T15B423A93CEFC9543F5A6AD704699D9833C3CABCB2910916536A8F19D2CD33D1EB00A1D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-datetime-l1-1-0.dll
- Size 11KB
- SHA256 77577f35d3a61217ea70f21398e178f8749455689db52a2b35a85f9b54c79638
- MD5 ac51e3459e8fce2a646a6ad4a2e220b9
- SHA1 60cf810b7ad8f460d0b8783ce5e5bbcd61c82f1a
- SHA512 6239240d4f4fa64fc771370fb25a16269f91a59a81a99a6a021b8f57ca93d6bb3b3fcecc8dede0ef7914652a2c85d84d774f13a4143536a3f986487a776a2eae
- SSDEEP 192:5WYhWYWWFYg7VWQ4SWSS/njxceXqnajLJ35H:5WYhW4gjmAlnJpH
- TLSH T1FE322A838BBC4503FEA32EB042A9D9937D3D67D62A10C12A05B5F1682C937D1EB14B2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-debug-l1-1-0.dll
- Size 11KB
- SHA256 45e48320abe6e3c6079f3f6b84636920a367989a88f9ba6847f88c210d972cf1
- MD5 b0e0678ddc403effc7cdc69ae6d641fb
- SHA1 c1a4ce4ded47740d3518cd1ff9e9ce277d959335
- SHA512 2badf761a0614d09a60d0abb6289ebcbfa3bf69425640eb8494571afd569c8695ae20130aac0e1025e8739d76a9bff2efc9b4358b49efe162b2773be9c3e2ad4
- SSDEEP 192:4WYhWFsWWFYg7VWQ4eWZzAR/BVrqnajcJH:4WYhWFMJRLlA5
- TLSH T1E9321B828BFC9103F9A7AFB053D9D9933C3DA7C72910916605A9F45D2CD37D1AB10A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-errorhandling-l1-1-0.dll
- Size 11KB
- SHA256 accdd7455fb6d02fe298b987ad412e00d0b8e6f5fb10b52826367e7358ae1187
- MD5 94788729c9e7b9c888f4e323a27ab548
- SHA1 b0ba0c4cf1d8b2b94532aa1880310f28e87756ec
- SHA512 ab65495b1d0dd261f2669e04dc18a8da8f837b9ac622fc69fde271ff5e6aa958b1544edd8988f017d3dd83454756812c927a7702b1ed71247e506530a11f21c6
- SSDEEP 192:imxD3vEWYhWnWWFYg7VWQ4eWMOwNbDXbBqnaj0qJm8:iIEWYhWFpLbBlwqJm
- TLSH T146321A928BFC8043F9E76E7017A5D9837C3D77D7295081A506A8F1A92C933D1EF11A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-file-l1-1-0.dll
- Size 14KB
- SHA256 7cb0396229c3da434482a5ef929d3a2c392791712242c9693f06baa78948ef66
- MD5 580d9ea2308fc2d2d2054a79ea63227c
- SHA1 04b3f21cbba6d59a61cd839ae3192ea111856f65
- SHA512 97c1d3f4f9add03f21c6b3517e1d88d1bf9a8733d7bdca1aecba9e238d58ff35780c4d865461cc7cd29e9480b3b3b60864abb664dcdc6f691383d0b281c33369
- SSDEEP 192:+AuVYPvVX8rFTsRWYhWyWWFYg7VWQ4eWQBAW+JSdqnajeMoLR9au:TBPvVXLWYhWiBdlaLFAu
- TLSH T1E962E853D9B4F25BF98FAE315192D843683852C7042541C91BD8A7AD3CE73C5E3D8A9C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-file-l1-2-0.dll
- Size 11KB
- SHA256 7a3c5167731238cf262f749aa46ab3bfb2ae1b22191b76e28e1d7499d28c24b7
- MD5 35bc1f1c6fbccec7eb8819178ef67664
- SHA1 bbcad0148ff008e984a75937aaddf1ef6fda5e0c
- SHA512 9ab9b5b12215e57af5b3c588ed5003d978071dc591ed18c78c4563381a132edb7b2c508a8b75b4f1ed8823118d23c88eda453cd4b42b9020463416f8f6832a3d
- SSDEEP 192:dzWYhW1sWWFYg7VWQ4yWL3sQlmqnajlD4h1N:BWYhW2e6l94h1N
- TLSH T111323B928BBC4143F9D66E7053E8D9877C3DA3DB2E60815905A9F09D2C837D1EB10A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-file-l2-1-0.dll
- Size 11KB
- SHA256 349a79fa1572e3538dfbb942610d8c47d03e8a41b98897bc02ec7e897d05237e
- MD5 3bf4406de02aa148f460e5d709f4f67d
- SHA1 89b28107c39bb216da00507ffd8adb7838d883f6
- SHA512 5ff6e8ad602d9e31ac88e06a6fbb54303c57d011c388f46d957aee8cd3b7d7cced8b6bfa821ff347ade62f7359acb1fba9ee181527f349c03d295bdb74efbace
- SSDEEP 192:/VyWYhWjAWWFYg7VWQ4eWiuNwzNbDXbBqnaj0q:/VyWYhW8g+LbBlwq
- TLSH T1C5321AC2CBFC9403F9A76E705299D8877C3DA7C7291081690AA8F5AC2C973C0EB51E5D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-handle-l1-1-0.dll
- Size 11KB
- SHA256 c78a1217f8dcb157d1a66b80348da48ebdbbedcea1d487fc393191c05aad476d
- MD5 bbafa10627af6dfae5ed6e4aeae57b2a
- SHA1 3094832b393416f212db9107add80a6e93a37947
- SHA512 d5fcba2314ffe7ff6e8b350d65a2cdd99ca95ea36b71b861733bc1ed6b6bb4d85d4b1c4c4de2769fbf90d4100b343c250347d9ed1425f4a6c3fe6a20aed01f17
- SSDEEP 192:P9RWYhWEWWFYg7VWQ4eWncTjxceXqnajLJS:LWYhWk3TjmAlnJS
- TLSH T1BC324DC2CBBC8003F9A76E7047A9D9937D3DA3DB2911816A05A9F1692C933C1DB10B2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-heap-l1-1-0.dll
- Size 11KB
- SHA256 2e981ee04f35c0e0b7c58282b70dcc9fc0318f20f900607dae7a0d40b36e80af
- MD5 3a4b6b36470bad66621542f6d0d153ab
- SHA1 5005454ba8e13bac64189c7a8416ecc1e3834dc6
- SHA512 84b00167abe67f6b58341045012723ef4839c1dfc0d8f7242370c4ad9fabbe4feefe73f9c6f7953eae30422e0e743dc62503a0e8f7449e11c5820f2dfca89294
- SSDEEP 192:5t6DjZlTIWYhWsWWFYg7VWQ4eW4MtkR/BVrqnajc:5t6Dll0WYhWMqkRLlA
- TLSH T13E422A85CAEC9103F9676EB053D5D9873C3DB7C62510802615A8F19C2C937D1EB25B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-interlocked-l1-1-0.dll
- Size 11KB
- SHA256 b02324c49dd039fa889b4647331aa9ac65e5adc0cc06b26f9f086e2654ff9f08
- MD5 a038716d7bbd490378b26642c0c18e94
- SHA1 29cd67219b65339b637a1716a78221915ceb4370
- SHA512 43cb12d715dda4dcdb131d99127417a71a16e4491bc2d5723f63a1c6dfabe578553bc9dc8cf8effae4a6be3e65422ec82079396e9a4d766bf91681bdbd7837b1
- SSDEEP 192:nWYhWNWWFYg7VWQ4uWtGDlR/BVrqnajcU8:nWYhWLJDlRLlAU8
- TLSH T165321A828AFC5143FAB76E7042E4D9937C3DB7DB261091550AA8F49C2C877D1FB10A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-libraryloader-l1-1-0.dll
- Size 12KB
- SHA256 08484ed55e43584068c337281e2c577cf984bb504871b3156de11c7cc1eec38f
- MD5 d75144fcb3897425a855a270331e38c9
- SHA1 132c9ade61d574aa318e835eb78c4cccddefdea2
- SHA512 295a6699529d6b173f686c9bbb412f38d646c66aab329eac4c36713fdd32a3728b9c929f9dcadde562f625fb80bc79026a52772141ad2080a0c9797305adff2e
- SSDEEP 192:FvuBL3BBLZWYhWxWWFYg7VWQ4uW4g0jrQYcunYqnajv9Ml:FvuBL3BPWYhWv8jYulhMl
- TLSH T1A3422BC2CBAC9143F5E65E3042A5CC477C3963DB5960C46906ADE1A82CE33C0EB10B2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-localization-l1-2-0.dll
- Size 13KB
- SHA256 059cb23fdcf4d80b92e3da29e9ef4c322edf6fba9a1837978fd983e9bdfc7413
- MD5 8acb83d102dabd9a5017a94239a2b0c6
- SHA1 9b43a40a7b498e02f96107e1524fe2f4112d36ae
- SHA512 b7ecf60e20098ea509b76b1cc308a954a6ede8d836bf709790ce7d4bd1b85b84cf5f3aedf55af225d2d21fbd3065d01aa201dae6c131b8e1e3aa80ed6fc910a4
- SSDEEP 384:NOMw3zdp3bwjGzue9/0jCRrndbwNWYhW6WAulh2:NOMwBprwjGzue9/0jCRrndbw5D
- TLSH T1CE520892C6E8D207F85DAD717167D9437C38A6C50822D95603F6FB2428E33C5E79172D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-memory-l1-1-0.dll
- Size 11KB
- SHA256 dadbd2204b015e81f94c537ac7a36cd39f82d7c366c193062210c7288baa19e3
- MD5 808f1cb8f155e871a33d85510a360e9e
- SHA1 c6251abff887789f1f4fc6b9d85705788379d149
- SHA512 441f36ca196e1c773fadf17a0f64c2bbdc6af22b8756a4a576e6b8469b4267e942571a0ae81f4b2230b8de55702f2e1260e8d0afd5447f2ea52f467f4caa9bc6
- SSDEEP 96:qo1aCFEWYhWwp/DEs39DHDs35FrsvYgmr0DD0ADEs3TDL2L4m2grMWaLNpDEs3OC:teWYhWVWWFYg7VWQ4yWwAKZRqnajl6x7
- TLSH T10E424B818BFCD503F5D72E708399CA977C3EA7C66DA0911902A9F1992CD33D1E710A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-namedpipe-l1-1-0.dll
- Size 11KB
- SHA256 b57e70798af248f91c8c46a3f3b2952effae92ca8ef9640c952467bc6726f363
- MD5 cff476bb11cc50c41d8d3bf5183d07ec
- SHA1 71e0036364fd49e3e535093e665f15e05a3bde8f
- SHA512 7a87e4ee08169e9390d0dfe607e9a220dc7963f9b4c2cdc2f8c33d706e90dc405fbee00ddc4943794fb502d9882b21faae3486bc66b97348121ae665ae58b01c
- SSDEEP 192:cWYhWZSWWFYg7VWQ4eWkcc7ZqnajgnLSp:cWYhW84cllk2p
- TLSH T1E7322B61C7AC8143F9AB6E7042D9D9933C3DA7CB2910C16556ADF9A92C837D0E730B2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-processenvironment-l1-1-0.dll
- Size 12KB
- SHA256 aa415db99828f30a396cbd4e53c94096db89756c88a19d8564f0eed0674add43
- MD5 f43286b695326fc0c20704f0eebfdea6
- SHA1 3e0189d2a1968d7f54e721b1c8949487ef11b871
- SHA512 6ead35348477a08f48a9deb94d26da5f4e4683e36f0a46117b078311235c8b9b40c17259c2671a90d1a210f73bf94c9c063404280ac5dd5c7f9971470beaf8b7
- SSDEEP 192:qKWYhWbWWFYg7VWQ4eWYoWjxceXqnajLJe:qKWYhWJ4WjmAlnJe
- TLSH T1D14219C2CBBC5003FAD76D7042A9E4A77C3893E72D1080690564FA693C977D1EB94B5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-processthreads-l1-1-0.dll
- Size 13KB
- SHA256 c9a686030e073975009f993485d362cc31c7f79b683def713e667d13e9605a14
- MD5 e173f3ab46096482c4361378f6dcb261
- SHA1 7922932d87d3e32ce708f071c02fb86d33562530
- SHA512 3aafefd8a9d7b0c869d0c49e0c23086115fd550b7dc5c75a5b8a8620ad37f36a4c24d2bf269043d81a7448c351ff56cb518ec4e151960d4f6bd655c38aff547f
- SSDEEP 192:AWXk1JzX9cKSIvWYhWLWWFYg7VWQ4SWW0uI7oinEqnajxMyqY:AWXk1JzNcKSIvWYhW5+uOEle6
- TLSH T1A1520AD5C6FC9183F88AAD306685D9533C3AD7C5192A813106E9F2E93DEB3C2D62462D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-processthreads-l1-1-1.dll
- Size 11KB
- SHA256 25a99bdf8bf4d16077dc30dd9ffef7bb5a2ceaf9afcee7cf52ad408355239d40
- MD5 9c9b50b204fcb84265810ef1f3c5d70a
- SHA1 0913ab720bd692abcdb18a2609df6a7f85d96db3
- SHA512 ea2d22234e587ad9fa255d9f57907cc14327ead917fdede8b0a38516e7c7a08c4172349c8a7479ec55d1976a37e520628006f5c362f6a3ec76ec87978c4469cd
- SSDEEP 192:NtxDfIeA6WYhW7WWFYg7VWQ4eWpB5ABzR/BVrqnajcb:NtxDfIeA6WYhWp28RLlA
- TLSH T17A422A929AFC9043F997AEB052D5E9533C3EB7C72621806515B4F16C2CD73C1EB11A1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-profile-l1-1-0.dll
- Size 10KB
- SHA256 42f4e84073cf876bbab9dd42fd87124a4ba10bb0b59d2c3031cb2b2da7140594
- MD5 0233f97324aaaa048f705d999244bc71
- SHA1 5427d57d0354a103d4bb8b655c31e3189192fc6a
- SHA512 8339f3c0d824204b541aecbd5ad0d72b35eaf6717c3f547e0fd945656bcb2d52e9bd645e14893b3f599ed8f2de6d3bcbebf3b23ed43203599af7afa5a4000311
- SSDEEP 192:clIHyZ36WYhWulWWFYg7VWQ4yWqeQDbLtsQlmqnajlDC:clIHyZKWYhWKhlbp6l9C
- TLSH T111320992CBFC4043F5A36E7053D8DA837D3DA3DB6A6081190569F4AD1CC77D0AB6492E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-rtlsupport-l1-1-0.dll
- Size 11KB
- SHA256 02d987eba4a65509a2df8ed5dd0b1a0578966e624fcf5806614ece88a817499f
- MD5 e1ba66696901cf9b456559861f92786e
- SHA1 d28266c7ede971dc875360eb1f5ea8571693603e
- SHA512 08638a0dd0fb6125f4ab56e35d707655f48ae1aa609004329a0e25c13d2e71cb3edb319726f10b8f6d70a99f1e0848b229a37a9ab5427bfee69cd890edfb89d2
- SSDEEP 192:4GeVvXK9WYhW1WWFYg7VWQ4yWj6k50IsQlmqnajlDl:4GeVy9WYhWzVk6l9l
- TLSH T179422B968BBC5003F5A36E70139ACE8B7D3DA7D729A4812604A5F19D1CC33D4FB14A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-string-l1-1-0.dll
- Size 11KB
- SHA256 9447218cc4ab1a2c012629aaae8d1c8a428a99184b011bcc766792af5891e234
- MD5 7a15b909b6b11a3be6458604b2ff6f5e
- SHA1 0feb824d22b6beeb97bce58225688cb84ac809c7
- SHA512 d01dd566ff906aad2379a46516e6d060855558c3027ce3b991056244a8edd09ce29eacec5ee70ceea326ded7fc2683ae04c87f0e189eba0e1d38c06685b743c9
- SSDEEP 192:byMvQWYhW5fWWFYg7VWQ4eWio3gDwcunYqnajv9JS:byMvQWYhW/BXwulhw
- TLSH T17F321B82DBBC9003F9A36E704799ED877C3CABD72910826516A9F1942CD33C0EB14B1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-synch-l1-1-0.dll
- Size 13KB
- SHA256 a31a15bed26232a178ba7ecb8c8aa9487c3287bb7909952fc06ed0d2c795db26
- MD5 6c3fcd71a6a1a39eab3e5c2fd72172cd
- SHA1 15b55097e54028d1466e46febca1dbb8dbefea4f
- SHA512 ef1c14965e5974754cc6a9b94a4fa5107e89966cb2e584ce71bbbdd2d9dc0c0536ccc9d488c06fa828d3627206e7d9cc8065c45c6fb0c9121962ccbecb063d4f
- SSDEEP 192:L1dv3V0dfpkXc2MAvVaoKKDWYhWTJWWFYg7VWQ4uWoSUtpwBqnajrmaaGWpmJ:Zdv3V0dfpkXc0vVaeWYhWj/qlQGWpmJ
- TLSH T1A8522A92D7E8A243F56FEE7046CAC5936C3857C74A20C0261195FAAD3DE33D0EB1562E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-synch-l1-2-0.dll
- Size 11KB
- SHA256 1c72ac404781a9986d8edeb0ee5dd39d2c27ce505683ca3324c0eccd6193610a
- MD5 d175430eff058838cee2e334951f6c9c
- SHA1 7f17fbdcef12042d215828c1d6675e483a4c62b1
- SHA512 6076086082e3e824309ba2c178e95570a34ece6f2339be500b8b0a51f0f316b39a4c8d70898c4d50f89f3f43d65c5ebbec3094a47d91677399802f327287d43b
- SSDEEP 192:ztZ3XWYhW3WWFYg7VWQ4eWNnpit7ZqnajgnLSl:ztZ3XWYhWVg+llk2
- TLSH T1DF422AA6CBAC5203F5A79D7047D9D8833C3DA7DA2950816116BDF1693CA33C1E700E2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-sysinfo-l1-1-0.dll
- Size 12KB
- SHA256 19c78ef5ba470c5b295dddee9244cbd07d0368c5743b02a16d375bfb494d3328
- MD5 9d43b5e3c7c529425edf1183511c29e4
- SHA1 07ce4b878c25b2d9d1c48c462f1623ae3821fcef
- SHA512 c8a1c581c3e465efbc3ff06f4636a749b99358ca899e362ea04b3706ead021c69ae9ea0efc1115eae6bbd9cf6723e22518e9bec21f27ddaafa3cf18b3a0034a7
- SSDEEP 192:fKIMFFyWYhW6WWFYg7VWQ4eWoVjxceXqnajLJ4:fcyWYhWKRjmAlnJ4
- TLSH T11E421992DBBC9203F9A76E7052D5D5833D38A7D62511C11906E9F3B83CA33C5DB50A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-timezone-l1-1-0.dll
- Size 11KB
- SHA256 3d798b9c345a507e142e8dacd7fb6c17528cc1453abfef2ffa9710d2fa9e032c
- MD5 43e1ae2e432eb99aa4427bb68f8826bb
- SHA1 eee1747b3ade5a9b985467512215caf7e0d4cb9b
- SHA512 40ec0482f668bde71aeb4520a0709d3e84f093062bfbd05285e2cc09b19b7492cb96cdd6056281c213ab0560f87bd485ee4d2aeefa0b285d2d005634c1f3af0b
- SSDEEP 192:4EWYhWdWWFYg7VWQ4eWvvJ6jxceXqnajLJn:4EWYhWbwYjmAlnJ
- TLSH T1F24228D3CBB88403FDEB6F7047A9D4937D38A7E61920815909E6E4693C973D1EB10A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-core-util-l1-1-0.dll
- Size 11KB
- SHA256 5eb724c51eecba9ac7b8a53861a1d029bf2e6c62251d00f61ac7e2a5f813aaa3
- MD5 735636096b86b761da49ef26a1c7f779
- SHA1 e51ffbddbf63dde1b216dccc753ad810e91abc58
- SHA512 3d5110f0e5244a58f426fbb72e17444d571141515611e65330ecfeabdcc57ad3a89a1a8b2dc573da6192212fb65c478d335a86678a883a1a1b68ff88ed624659
- SSDEEP 192:dZ89WYhWFWWFYg7VWQ4eW5QLyFqnajziMOci:dZ89WYhWDnolniMOP
- TLSH T1FD322B838BFC8403FAA76D304795DD837C3CA7DA266080A519A8F5992CC37D1EB14B2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-crt-conio-l1-1-0.dll
- Size 12KB
- SHA256 b119adad588ebca7f9c88628010d47d68bf6e7dc6050b7e4b787559f131f5ede
- MD5 031dc390780ac08f498e82a5604ef1eb
- SHA1 cf23d59674286d3dc7a3b10cd8689490f583f15f
- SHA512 1468ad9e313e184b5c88ffd79a17c7d458d5603722620b500dba06e5b831037cd1dd198c8ce2721c3260ab376582f5791958763910e77aa718449b6622d023c7
- SSDEEP 192:R0WYhWRWWFYg7VWQ4eWLeNxUUtpwBqnajrmaaG:R0WYhWPzjqlQG
- TLSH T1BF42E68396FC5A03F5535F30A7F9DAC37D3A27D72A506069045AF4A838C23D5AB11A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-crt-convert-l1-1-0.dll
- Size 15KB
- SHA256 6c008be766c44bf968c9e91cddc5b472110beffee3106a99532e68c605c78d44
- MD5 285dcd72d73559678cfd3ed39f81ddad
- SHA1 df22928e43ea6a9a41c1b2b5bfcab5ba58d2a83a
- SHA512 84ef0a843798fd6bd6246e1d40924be42550d3ef239dab6db4d423b142fa8f691c6f0603687901f1c52898554bf4f48d18d3aebd47de935560cde4906798c39a
- SSDEEP 192:JM0wd8dc9cydWYhWyWWFYg7VWQ4eW9jTXfH098uXqnajH/VCf:G0wd8xydWYhWi2bXuXlTV2
- TLSH T14362C65366E42F26F69B177221FEC7D72A394781259143B4C217E54C3883781BDA7C1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-crt-environment-l1-1-0.dll
- Size 11KB
- SHA256 aa3e3e99964d7f9b89f288dbe30ff18cbc960ee5add533ec1b8326fe63787aa3
- MD5 5cce7a5ed4c2ebaf9243b324f6618c0e
- SHA1 fdb5954ee91583a5a4cbb0054fb8b3bf6235eed3
- SHA512 fc85a3be23621145b8dc067290bd66416b6b1566001a799975bf99f0f526935e41a2c8861625e7cfb8539ca0621ed9f46343c04b6c41db812f58412be9c8a0de
- SSDEEP 192:6KNMWYhW6WWFYg7VWQ4eWSA5lJSdqnajeMh3:6KNMWYhWKiKdlaW
- TLSH T154420A868BBC5543F6976E7047B9E9437D3C67C7291082650569F1582CC73C0FB11A1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-crt-filesystem-l1-1-0.dll
- Size 13KB
- SHA256 974af1f1a38c02869073b4e7ec4b2a47a6ce8339fa62c549da6b20668de6798c
- MD5 41fbbb054af69f0141e8fc7480d7f122
- SHA1 3613a572b462845d6478a92a94769885da0843af
- SHA512 97fb0a19227887d55905c2d622fbf5451921567f145be7855f72909eb3027f48a57d8c4d76e98305121b1b0cc1f5f2667ef6109c59a83ea1b3e266934b2eb33c
- SSDEEP 192:CGnWlC0i5ClWYhWwWWFYg7VWQ4eWtOUtpwBqnajrmaaGN4P:9nWm5ClWYhWQ8qlQGN6
- TLSH T1BF52F78387E86E12FAA71F7156EDDBD73E3D2BC2199282658016A45836C33C07F2255E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-crt-heap-l1-1-0.dll
- Size 12KB
- SHA256 8166321f14d5804ce76f172f290a6f39ce81373257887d9897a6cf3925d47989
- MD5 212d58cefb2347bd694b214a27828c83
- SHA1 f0e98e2d594054e8a836bd9c6f68c3fe5048f870
- SHA512 637c215ed3e781f824ae93a0e04a7b6c0a6b1694d489e9058203630dcfc0b8152f2eb452177ea9fd2872a8a1f29c539f85a2f2824cf50b1d7496fa3febe27dfe
- SSDEEP 192:8a9aY17aFBRAWYhWYWWFYg7VWQ4eWbr0tJSUtpwBqnajrmaaG:8ad9WYhW4F/qlQG
- TLSH T117420A938ABC5543F5A36F706AE8DACB3D3E63D67D5080670157F59829833C0AB2162E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-crt-locale-l1-1-0.dll
- Size 11KB
- SHA256 edc1699e9995f98826df06d2c45beb9e02aa7817bae3e61373096ae7f6fa06e0
- MD5 242829c7be4190564becee51c7a43a7e
- SHA1 663154c1437acf66480518068fbc756f5cabb72f
- SHA512 3529fde428affc3663c5c69baee60367a083841b49583080f0c4c7e72eaa63cabbf8b9da8ccfc473b3c552a0453405a4a68fcd7888d143529d53e5eec9a91a34
- SSDEEP 192:+WYhWoWWFYg7VWQ4eWSoV7jjT6iBTqnajbQwr1:+WYhWIiVTTXZl3QC
- TLSH T132422A468BFC5103F6936EB04AECEA837D3EA7C71A1181A50596F5982C833D8EB11A5D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-crt-math-l1-1-0.dll
- Size 20KB
- SHA256 f6a93fe6b57a54aac46229f2ed14a0a979bf60416adb2b2cfc672386ccb2b42e
- MD5 fb79420ec05aa715fe76d9b89111f3e2
- SHA1 15c6d65837c9979af7ec143e034923884c3b0dbd
- SHA512 c40884c80f7921addced37b1bf282bb5cb47608e53d4f4127ef1c6ce7e6bb9a4adc7401389bc8504bf24751c402342693b11cef8d06862677a63159a04da544e
- SSDEEP 192:8JIDSM4Oe59rmkUALQe1hgmL44WYhWWWWFYg7VWQ4yWARgKZRqnajl6umA:8JI2M4Oe59Ckb1hgmLhWYhW2v2yRlwQ
- TLSH T14092A74749DCFF63D18F1BB741F08BCE6A385AA665D1B6B4C81B908434A27C47E83949
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-crt-multibyte-l1-1-0.dll
- Size 19KB
- SHA256 5b3e29116383ba48a2f46594402246264b4cb001023237ebbf28e7e9292cdb92
- MD5 a5b920f24aea5c2528fe539cd7d20105
- SHA1 3fae25b81dc65923c1911649ed19f193adc7bdde
- SHA512 f77f83c7fad442a9a915abcbc2af36198a56a1bc93d1423fc22e6016d5cc53e47de712e07c118dd85e72d4750ca450d90fdb6f9544d097afc170aeecc5863158
- SSDEEP 384:4SrxLPmIHJI6/CpG3t2G3t4odXLhWYhWfgy6l9ne:4iPmIHJI6vZO
- TLSH T1CE921D6B8EE82E12E28FD7F3B5F6C7C62A350F9105C07375A26785483841EE9BD52E05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-crt-private-l1-1-0.dll
- Size 62KB
- SHA256 55bc91a549d22b160ae4704485e19dee955c7c2534e7447afb84801ee629639b
- MD5 5c2004daf398620211f0ad9781ff4ec2
- SHA1 e43dd814e90330880ee75259809eee7b91b4ffa6
- SHA512 11edbbc662584bb1dea37d1b23c56426b970d127f290f3be21cd1ba0a80d1f202047abb80d8460d17a7cacf095de90b78a54f7c7ec395043d54b49ffe688df51
- SSDEEP 1536:Se6De5c4bFe2JyhcvxXWpD7d3334BkZn+PI5c:Se6De5c4bFe2JyhcvxXWpD7d3334BkZU
- TLSH T1C05307DB49E63F21E18FF7B76BFB17C90B253A4418806274EAC7556B34853A9BC43A01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-crt-process-l1-1-0.dll
- Size 12KB
- SHA256 191f53988c7f02dd888c4fbf7c1d3351570f3b641146fae6d60acdae544771ae
- MD5 dd899c6ffecce1dca3e1c3b9ba2c8da2
- SHA1 2914b84226f5996161eb3646e62973b1e6c9e596
- SHA512 2db47faa025c797d8b9b82de4254ee80e499203de8c6738bd17ddf6a77149020857f95d0b145128681a3084b95c7d14eb678c0a607c58b76137403c80fe8f856
- SSDEEP 192:+nqjd7dWYhWDWWFYg7VWQ4yWMJ5HKZRqnajl6b:+nsWYhWxp5HyRlwb
- TLSH T1604209878BF86953E6675F3082F9D7877F3B53C2690082698456F05D3C833D5AB21A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-crt-runtime-l1-1-0.dll
- Size 15KB
- SHA256 4390c389bbbf9ec7215d12d22723efd77beb4cd83311c75ffe215725ecfd55dc
- MD5 883120f9c25633b6c688577d024efd12
- SHA1 e4fa6254623a2b4cdea61712cdfa9c91aa905f18
- SHA512 f17d3b667cc8002f4b6e6b96b630913fa1cb4083d855db5b7269518f6ff6eebf835544fa3b737f4fc0eb46ccb368778c4ae8b11ebcf9274ce1e5a0ba331a0e2f
- SSDEEP 192:maajPrpJhhf4AN5/KixWYhW4XWWFYg7VWQ4eWvppXjxceXqnajLJhrdCq:mlbr7nWYhW41MXjmAlnJhUq
- TLSH T19572D74397FC7F27E5972B7216F9D7D72E3A638226108179C463B0983883781BD5721A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-crt-stdio-l1-1-0.dll
- Size 17KB
- SHA256 6f6f6e857b347f70ecc669b4df73c32e42199b834fe009641d7b41a0b1c210af
- MD5 29680d7b1105171116a137450c8bb452
- SHA1 492bb8c231aae9d5f5af565abb208a706fb2b130
- SHA512 87dcf131e21041b06ed84c3a510fe360048de46f1975155b4b12e4bbf120f2dd0cb74ccd2e8691a39eee0da7f82ad39bc65c81f530fc0572a726f0a6661524f5
- SSDEEP 192:WpPLNPjFuWYFxEpahTWYhWHWWFYg7VWQ4eW9M3u57ZqnajgnLSuRCz:W19OFVhTWYhWlBu5llk2
- TLSH T15682C54785EC7F02E29787331AFAEBEA5A31578338007178C117E99836CA3D87E43559
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-crt-string-l1-1-0.dll
- Size 17KB
- SHA256 45e0835b1d3b446fe2c347bd87922c53cfb6dd826499e19a1d977bf4c11b0e4a
- MD5 f816666e3fc087cd24828943cb15f260
- SHA1 eae814c9c41e3d333f43890ed7dafa3575e4c50e
- SHA512 6860abe8ab5220efb88f68b80e6c6e95fe35b4029f46b59bc467e3850fe671bda1c7c1c7b035b287bdfed5daeac879ee481d35330b153ea7ef2532970f62c581
- SSDEEP 384:NFvU4x0C5yguNvZ5VQgx3SbwA7yMVIkFGl/WYhW49PBolniMcx:T5yguNvZ5VQgx3SbwA71IkFwNJT
- TLSH T17482C64386F83F02DA8F57B359FAC7C32E385F46254153B5D467A48C38827A2BE67909
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-crt-time-l1-1-0.dll
- Size 13KB
- SHA256 b48310b0837027f756d62c37ea91af988baa403cbcbd01cb26b6fdae21ea96a2
- MD5 143a735134cd8c889ec7d7b85298705b
- SHA1 906ac1f3a933dd57798ae826bbefa3096c20d424
- SHA512 c9abe209508afae2d1776391f73b658c9a25628876724344023e0fc8a790ecb7dbce75fddae267158d08a8237f83336b1d2bd5b5ce0a8eed7dd41cbe0c031d48
- SSDEEP 192:qy5NDSWYhWcQWWFYg7VWQ4eWAcSJR/BVrqnajcm2:qU0WYhWcwASJRLlA
- TLSH T1635209439AE86A07FA971B7212FDD7E73F3917C22A8071758166D4983A93390FE1381D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\api-ms-win-crt-utility-l1-1-0.dll
- Size 11KB
- SHA256 c81c4bba4e5f205359ad145963f6fbd074879047c66569f52b6d66711108e1ed
- MD5 6f1a1dfb2761228ccc7d07b8b190054c
- SHA1 117d66360c84a0088626e22d8b3b4b685cb70d56
- SHA512 480b4f9179d5da56010fa90e1937fe3a232f2f8682596c16eeaed08f57cf8cffeaa506060429501764f695cb6c5b3e56b0037de948c4d0e3933f022a0b4103d2
- SSDEEP 192:GI6fHQduPWYhWcWWFYg7VWQ4yWpbdsQlmqnajlDPD:2f5WYhW8Kd6l9L
- TLSH T1F64229838BFC5643F6A72F7083E8DA833D3E67D6696082654065F5993883BD0FB2151E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\concrt140.dll
- Size 316KB
- SHA256 2405355f0a58067b258f8df33c327e3a3d716eaac5a3a5aebb757842d85bd376
- MD5 5fe9a647921ded8a2fad92deb9ec4ab2
- SHA1 1ce87fac4c22aae82a81ddb26952c074b744e78d
- SHA512 11fe4c0519cb1df73695ce38b5fdea2a563de565116a47ff0032d5a68b8c51fe732ad66738a7167e56d79193c60af9204a7ee0beae8ff8bb75abd0b484c2d764
- SSDEEP 6144:jfjSd54rw5k9cZW1Cbfpri5/ww8VRj7nWzg/p8Wcz:DOP4rwK9c0ILqzocz
- TLSH T16C64398A76140CE6F96BE039C553851BE6F2BC416352D3CB0264839E6F637D1E93A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\dbghelp.dll
- Size 1.5MB
- SHA256 13f0c74845318b52b76e6000564b1a99c37de48422b44ac74d034fa222c65a23
- MD5 a5e4b3ff51cf5b7926d9651908feb666
- SHA1 4ef5d229709e40f3f84e46c3a28341eadbd1a044
- SHA512 0615ff581b648715461349b1622fbc208042fc8c395cb2d271203b25b036f59edb0fc3470065dc15061af1be0fff48981f55bbea7f00c88906e9b470764a86fa
- SSDEEP 24576:xU5lL6v/X5lknycQFrQ8gKt/X95WqbQLZopKjMcqpzd1YWLfY:Kni/X5lknDFUCaQLq8
- TLSH T1A975299BF97941F5DCBAC039D662A627F9B13859832497C367908B562F23BF4983D300
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\kbaseconfigcenter.dll
- Size 1.7MB
- SHA256 b130b9e9b4a11ec3c6fe06ac85c6e879b20c8f1e7e4db3183f6bf8aac88e3de6
- MD5 f684d9cf6ce4338b626f11d34fe7bf10
- SHA1 846113cc864b8e33e42058c96d5dc4b394ad9624
- SHA512 55cdb50e8681d5a42f029371dcab5a07429afc21cc3e473c147d2abeb222b79b772b7f3544a02ea45e8ae06da74becb01f1e3073a9fa0ba7995c12c740d211a0
- SSDEEP 24576:6yyPyvUiY7+SpzbAlx6NOTgwSFXa9/+p45DWqPCAYyyKcJQ:6yyPyvUz+SpAlx6JI+pVqPKyyJQ
- TLSH T19A856C136F86882CD14E6734661B274AE7786A76CB3086DBA7D03D954E362C09F31B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\kpacketui.dll
- Size 829KB
- SHA256 856122dae51a56a793e0a3c82492998f07e32ad57a98b64eb9e368c5826d19a1
- MD5 c76665e46eed60428cea6b6147de0b21
- SHA1 6932cd2232dab53dfe0f72e93734b4a6fd86e8f8
- SHA512 6f26d5ce204628ee354e44424293270c219b069a5d50e01d115eddd324828824c62405732d0f67ed7c12d1621b513f3df66116d1538ece007fe2a6b633ab1ad9
- SSDEEP 12288:yvFtoWXnnjy0lmkr1DN3Z7JfVGnYxoukUJowWqYYSj3:yvFt3nnGi5D9NGYxfEbz
- TLSH T1CF058C1FE7A903B9E03EC17AC5978813E272744503A6ABEB5944EE652F773E5093E340
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\msvcp140.dll
- Size 544KB
- SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
- MD5 bc88b387cafa556068b5c5d6ff3ccc8f
- SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
- SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
- SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
- TLSH T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\msvcp140_1.dll
- Size 35KB
- SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
- MD5 2a214cb2f0f9473e7765ee3b8db8651e
- SHA1 9ce5c3d6c7d94b175f136f552af8771dca6147b3
- SHA512 ea9a759babdec5818fa1e430d1cb453cac762cfaa8f934e01d7182100f66cae21527962696f5bd963fcb0fba2c0f38bf4028e75f89e9e599ddee008021646a33
- SSDEEP 384:3jJ2J9VQH+qNy09dmFWcS5gW7YZ1gr4iSt+e92xS+R9zWd/I1IHRN7SUl8BR9zTr:d8QH+qNy0PmgogU9v2ci9zeHSn9z3
- TLSH T1C3F25D86F7248442EC674970C699EE837C3DB3D25B50969B17A5F61C0DA33C1FA34A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\msvcp140_2.dll
- Size 273KB
- SHA256 3ea06f0ee098b4823cb79599df3780e7f23cce52c19aac31d2a0d47efe33a5e9
- MD5 3151333808c2c2339d5f5466df70b7dc
- SHA1 e48159bb2127ec812ff679f6fabc41141009f26a
- SHA512 8f1daa078e124dc89b51b84baab8d6cc2d77497be23b2ba95ef3fee54d9034e17bf5cd15a4043d025699972cae20f9c46d2e7bef48e4283f3ad9ca6b84fc64d1
- SSDEEP 3072:1J51P7emwi1j+XZi7b1dbqtH0h6XV3Q0JPQo07ICl3Sg2xmygdCg2LMeDh5FD799:1JbjwvnQo/iy5L/XxTWrNM
- TLSH T1AD543912B51A2EBFC5D6E8B04939B416FC223A418775C48A57C31C8D9E2BB437FE3529
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\msvcp140_atomic_wait.dll
- Size 49KB
- SHA256 640b2aefced484d0368eea5bdd06addd0658a3a70a49256e560d6923b404a479
- MD5 44aec42494531580bca182b0e2fb19c2
- SHA1 a85a6a4de6656e5969fa4ab15f2230dfe2839e75
- SHA512 d8afb5bbb1394fd14c3ec8ecdd4c02e1c6f23031b15173b1448dfd4915c392bb8512cd41eccb449db19969397a09046d27d54db704c8122ff62c12ff5a89c9d6
- SSDEEP 768:ayMsqh8UGchsJr3KbYA5XeDmqw4DYPW9zr0JD0io9z7p1uF:W+UjCKb/5XeCqgazrURgz91G
- TLSH T19C337DDDA7684083E5678634C1A4E517FA7AB7E20710D6EF4352F0890FA37D1AE34B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\msvcp140_codecvt_ids.dll
- Size 31KB
- SHA256 f2069a52880ec885ee7f0511186100eb7fada0411a2b4948fafea7735b878a18
- MD5 3ece3fb90bfaea8e9a5fb7139ff9cbdc
- SHA1 91b19dd0db24a5cbd944eca9c67fad3b53f9c154
- SHA512 c059ffd80de25ad10d34064b1e9421666525da67710de0ac445cfc45b8139715dd946f7e90c1e0d719c60e3d5902e3229db4496c87d674c0012c9b4a8c2b2291
- SSDEEP 384:p7GVNpd36sRWioEWEw4himRSt+efdDtdQ5R9zpU8NSqHRN7w9ju0R9zlWdo:5GVsfaw4DYd7ds9zmMEu49z0G
- TLSH T19BE27C89DA3C4487EC9B5C7082ACDE477C3D77C60A10569B4392F5181DA33C6EB3866E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
- Size 75KB
- SHA256 762ed66bb00b4265179bb880b1fe9257f2c70f8aaa4f40ddaa7b5203b48e7e95
- MD5 1c5eba9682c2c2e69661b7cc8c62709d
- SHA1 bb211c35a8b339c2f4d28cb737a07b28e29b6b50
- SHA512 0cf18d94f7dacd68afddca1fa31de59bbcfaa6afbbb2f74dd10b31b55f619c6d897ded9119d35cec23997a84f1185063b1cd16530793ceabfa3bdc7d58110240
- SSDEEP 768:IXOzQ/DBnTQxkUtwZfVKFkYQJc1lqTwj6NBvfeZSac6mWWr9YiDLk5C7auy7Yi7w:Ljf8Jdwj6NBCSac0+97b2j777NW
- TLSH T117737CA3DB44169DE51B8634CAD58A1BE6B27842076293CF6728E3680F733D2397D3D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
- Size 46KB
- SHA256 affe52c29ffb15dbc71fcbe4404d0f87211dad147c4387961879a1d7edcc72f9
- MD5 7328166c3e14c50d476a69509ed90faf
- SHA1 bfd19cde8a117aa69a117747ef6ea50d473c14fd
- SHA512 cd23e28f80996b2047b1217bd4c5fb6b9526e448f5d99757fa94757d32cde6e1c540ff0b448f6d28f49e9340398730470fd75ab03823d1ac3d723c53ccf75297
- SSDEEP 768:R/6pbQ2EGQ9VPbHZwUK5YiDLk5C7oYi77rh5ALG3:eQ2TqbHZwUK57bs773t3
- TLSH T167237BA7CF540C09E9279B70B4C98A26F972B8515B92C3CF2294D2690F963C23DBD3D5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\qt\plugins\platforms\qskia.dll
- Size 1.9MB
- SHA256 b2d433e26b427b1969bec756734592c509327b3bd681e00bb284e89ba5997d13
- MD5 c2562793bb2c8214bd59e98c4afb221e
- SHA1 e06b8360527a4eb5c9b2effc7731c26518e44ce8
- SHA512 1eccc45f6e4c248251293f60a2e4f023473787391f3b6b19f1a91034f50cab00bc0c446ada71888a38d2784b5f8f6dbe9aea255f0ed344e050438fc7bf37dd0e
- SSDEEP 49152:/Gscv0F9WxN+G7hwbbAlsUlc/Hq/zBUok82a66kTcKawv:/F9WRhwv
- TLSH T1EA957D43E3B44299C2A7C13D868B8F0BE6B1740543629BDB2650CF59EF237E21A7E751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\qt\plugins\platforms\qwindows.dll
- Size 1.6MB
- SHA256 90a8bc6abbb6709372a924c852bcf73268fc98b07126eab14763859271e89d46
- MD5 1b3e863b6da468450f5a3064012de1cc
- SHA1 c1b83819e7da9d1bf09dd25c95078980498cbdbe
- SHA512 e9ae543d9c8e6c4d7fc753a3353c973b57e6bb4bef472c628523dda33e6cec218848212d56ea21ae483c1a5755bffa81a53de46c1530af8d15e40a18d0401613
- SSDEEP 24576:FA9T04p4/1M+XCrbBB376YStwHxDCWYkbJ3KbZ+OiKO2:8T0IKcbBxlowHx+eJCiN2
- TLSH T1E2757C43E3A44398C167C239C68B9A1BE77178050361ABDB25A08F59FF63BE3177A741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\qt\plugins\printsupport\windowsprintersupport.dll
- Size 88KB
- SHA256 f045c9db926058e1421e8a31600edb7985d95922521e527f14057d8bb3777243
- MD5 d931ae3bd0bf776fcb3f1e8f47118c69
- SHA1 b9746b466ea60330b9d39dc6db1f19bb1a4a7f0e
- SHA512 e52e7f02a03fc118a309e5072f40ef61b9c1bd31ca57fa4a4768cd67da2ab1ed2e029f351a11bed1805796752ab2b79664db231f6f6013c2be0ae12380cf126c
- SSDEEP 1536:MUOvHEs27LT3nOv3sQwd3GMuxOtCJZ0bm9c7byQ77C/:Mvvks2TOv3K3G9OtCJZ0bm9caQq/
- TLSH T1769349A3EA64018CD626C139E4D70926F732B45517A283CF6368D74D4F237D23EB939A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
- Size 159KB
- SHA256 c2ca509b65c67bda29de9738ee2fb40ab14d465dd9848871a291739fd4eb7407
- MD5 04c9c8d51b78875061fc4ed3e56b047a
- SHA1 50797d3e04d0e00600b688ccacf4442bbf08843c
- SHA512 4c962db9f119f64c856bad63880cb3e80ed5129849727a8b69ed6bc5f8debc003101542c6b9d3ca650d3a75c5eeb8540e783f8273b7808cd4231ccd7f5ee1804
- SSDEEP 3072:GSApjXbrT36b96bavsTHnbNgJUtybgP6vsHVcI2ojOWa:yX6b96bavqHnbNpn6vsHVcb
- TLSH T159F33913F65143D9C527D2B8C19A0512F3B37444436257AF29A6DBB82F533A2BD3EAC2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\ucrtbase.dll
- Size 987KB
- SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
- MD5 61eb0ad4c285b60732353a0cb5c9b2ab
- SHA1 21a1bea01f6ca7e9828a522c696853706d0a457b
- SHA512 44cd871f48b5193abb3b9664dbea8cdad19e72c47b6967c685cf1cc803bc9abb48a8a93009c972ef4936e7f78e3c92110828790aa0a9d26b80e6a523bbcd830d
- SSDEEP 24576:xOPJ1g7mT6BNvwTOxNfoYotrz1111111r8SoKxmxvSZX0ypdNLh:xO1aNoaxNfo/+a
- TLSH T18D259E64F75C0AA6C17BE17CC95B550ED972340647608ACF03EA8BB97E2BBE91637310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\vccorlib140.dll
- Size 344KB
- SHA256 19839407c3fdbc824e5bce189bf68ddf8097f12ec28b757797ffa0415c144ddd
- MD5 0b4d02b22ffe3957db27d9cc6cff6edf
- SHA1 bec5a8eed4434222956d9f0f0482f8562d992317
- SHA512 9588f6e2c96b2793598cd6335bf10cdd53acd77886a5f703118c77af676da1ec3f393d55a1b1dc28dd33bf69c4c5bc70c615f8d41e1829e473ff9bbc1163ea3c
- SSDEEP 6144:PpVeNd1C++IAU1qsxEW5QcT2Xgs4hiWi/GDhmVejWXaV+GpfOqmIzt/mtBGgVa0J:Pp0+Xgs4hiWi/GDhmVejWXabO/IzgtK+
- TLSH T16C74E4277B9C4CC3C931A0794E978309E372694207A1E3CB0691970E5F7B7E8AD3B665
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\vcruntime140.dll
- Size 121KB
- SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
- MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
- SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
- SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
- SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
- TLSH T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\vcruntime140_1.dll
- Size 48KB
- SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
- MD5 cd1b08f4930b276ad78853580b76b5c6
- SHA1 a0330279d3d0d47f19ed984726e25260b547a228
- SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
- SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
- TLSH T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\office6\vcruntime140_threads.dll
- Size 37KB
- SHA256 219915cf20822f34d5e7c1fdd4e21ae7f3396881096c51036225fb8f84b47afa
- MD5 e57bb2cda101fda5c72f3af09b035bd6
- SHA1 77363f6b41d022dbd34e182a93087fc63a5b08cb
- SHA512 cab172e140cc2da4444a0c37a42187c4bd29997aa5522f5cf076d8d40cb0116a9e905162349204415213c75ff34cca98cdcc5a7ee9535a8d28945af726545441
- SSDEEP 768:CjJ+AiHEFeLUIHmJ9crFciw4DY0zxOW9zeLCbpiFds9z9:+uHEwLUIHscrFcig0zUizGEpiFdkz9
- TLSH T126037C86D7684487E9EA9870C2B9DA47BD3EBBD20B5041DF4381FA480D633C2EA3571D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\pl_PL\style.xml
- Size 3KB
- SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
- MD5 034f37e6536c1430d55f64168b7e9f05
- SHA1 dd08c0ef0d086dfbe59797990a74dab14fc850e2
- SHA512 0e1911c882152a4e1059a3ce1880d7fb2aed1e1e36cbd37055de2e2a1333acb2a0233ba2a4d969ccebbef1e77809aa5e78807aa9239545beae8c548c0f8f35c0
- TLSH T1E381CA80A610BD0AC563F51573AB7509762CB36383ECCFC4F0EE2E698753652644B63E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\product.dat
- Size 80KB
- SHA256 dfafb839b12ed1150bce08960e25601fd322667c6f784ac901c5e0b4666098d8
- MD5 ecdfe28d5282840199df0d192cb1bf67
- SHA1 38ff2fdc99aa3a76eef2253878261f0cebf05f08
- SHA512 10b2161fdfa407e0c0c9b00ba34b43c5bb8639404b4f1cfd6ef97902a44e8edf5fcd4f2e20b64d5ccd6dedecb6564a4e99a7987da726d710017cade8faacdf32
- SSDEEP 1536:1yKKOpT+q2ZAJBgBrAvSVxel50kydpgnoNQ:1yGT+jZqBg5AKV00kydmnou
- TLSH T1E6837EFB7E0E2EE568CF232B5D7B282CAAF54D15349B548862C3E558EC1C0B63CD6548
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\product_new.dat
- Size 79KB
- SHA256 08c0a368ca8956d7e20bdb83288cb72542c9cbf3cb5446f371a7667d119c24f2
- MD5 cd7c6055b61f512ceae7f3cde761e3ee
- SHA1 05946131d0fcedf8267a5634efaace1749edd785
- SHA512 b33373ad7d68150568e8a86eb773149ae28d31e7059c382e45804df6f9ffe045408395aea1635a6591c06fd256e3d862db9d1d41490ad18e8300a21dcdae30e1
- SSDEEP 1536:83CcyHh6mkieSiLIBI1e2pFgEkKH6fh3/tI2QcsB5zJzEy7c:qGHQ+rvOK5BhljsB0D
- TLSH T188832C09ECD16EAD685052791D376D8227B7DD91A0DD30AC4B12AA4CFC3CF887B72A91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wps\~e5a540d\CONTROL\vi_VN\style.xml
- Size 4KB
- SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
- MD5 394488b30107bcebb84a97ed5d754cee
- SHA1 69ebe17f7d577e9bf69c87cff45c3251f0bbc86e
- SHA512 24a6bc7debbf7030c1261c69cb4ae7bf3cbb5c7fac315188163c6001e58dfbe2e634925cb767044da7ea0e6d08c709b2ade02f6e43930819e1bef6f7569cad5a
- SSDEEP 96:gd6SmSZcFe9gSs8TcySCSi58VS5eQJ/gQkgQ0/Mw8CclQgYzdr/PwiCSeDeR3ciw:gdAh8Ax
- TLSH T13FA17780A610BD0AC563A51977AB7909B62C736383ECCFC4F0EE3E658753692644B63D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\tempinstall.ini
- Size 387B
- SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
- MD5 c38481658f9149eba0b9b8fcbcb16708
- SHA1 f16a40af74c0a04a331f7833251e3958d033d4da
- SHA512 8f98d62f88442b8ef94aa10074e35aa8d9494f3c76ce8b143ca0bf7fa0d917f3175212fbcd6e7b0597fd0ec0e1b2827f157135512fb01c88218d36e2f7dd73ce
- TLSH T1D4E09B1BA8D1B0ABDEB302E988979D54BAC03D9A066D23147762540D3D32918FB41D65
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\tempinstall.ini
- Size 433B
- SHA256 9e87b2ff306efedf7bf1074749b4602c332bc825aed80721eba19d5f544d2ec3
- MD5 a9519168ca6299588edf9bd39c10828a
- SHA1 9f0635e39d50d15af39f5e2c52ad240a428b5636
- SHA512 0607eb1f5598320961fbd8ef75beeb1b6dc1af3cae7eeb5ba352f3e2a2edb25e1d9e68fb46c24e4299957352c0c906314c889c2d1092437eccc1d1a0485f3557
- TLSH T194E0540FA891B0679D7302F488E39C007AC03E96055D1210773144093C32A14FB81D69
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
- Size 10KB
- SHA256 13ca732165626aef193301fa365c87e498ac77033114dfc07d34c6f9faaafbf5
- MD5 1dfbd29164dbf3c2b33cdcad48653d6e
- SHA1 6054ee7fa63ff53ea6b4926abfb32d5a28c07b1d
- SHA512 b036a2b53852439d79c9425625f4a9ec606bb0beed8f2f78418b5c10142d6992ebdd2a789f9db422293438f75ed6da4108e02f2b2e567ff375f9b799f3ac9a61
- SSDEEP 96:tcHrdHADQC8IH5/KB76SvBfqCOvLtI0xX2UbjmMMtqK2nS3vs93aQaPT6tjfV:tOtB3qR9ZcIJV
- TLSH T192227A57827E0658477A0A6813F39D493ADAAACF275130C03F33DDA78AEE461825F764
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
- Size 11KB
- SHA256 64ace39767b856324420d8020b654aaf85e8b4ec5cdc2300cd562685d10de48a
- MD5 2a2b52127f01a11359ee186f212c0ccb
- SHA1 9a6fbd14a466357c115cc5eb87aed164520065e0
- SHA512 3bcd7b80405b2aeb8da59b32b9d2b058b64ea14721c99e69532e6f5ec9946c9bb7ccabaeb23ba0a4767a0d0d7cdff0b2b6260f6241afaf0b5998c9e694125a93
- SSDEEP 96:tcHrdHADQC8IH5/KB76SvBfqCOvLtI0xX2UbjmMMtqK2nS3vs93aQaPT6tjfPynI:tOtB3qR9ZcIJPuWNbdFJn
- TLSH T123428F57827E4618477A0A6813F39D8939CBAACF275530803F33CDA78AEF451925F764
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
- Size 27KB
- SHA256 92229df3648428f8b29b8009673f0ab31d823c3385e8eecd3b7e3e5392ccb9fb
- MD5 b12ff03a7174b15de0638e7b321c9e0f
- SHA1 f9d0e9c4ae467526f1243e324475191d1007084d
- SHA512 ea8c69a70f22a2eec43857438f3f10895c2353e39294825a9312d3b9b514431a03576d903f45f39f466b03e4fe5014cea4bbff9c8b3ccfa778997926d92e082b
- SSDEEP 192:tOtB3qR9ZcIJPuWNbdFJmiPo3GiQv6C2te0Nc75ST0usBqaLPtNmhm9y7aSPvhzj:tZcI5Vr8Ch4V
- TLSH T11AD25B56023DD10042FF9A8442B79E9E34CB5BAF274831513FB789A389EED51D2EDB18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
- Size 61KB
- SHA256 acf570c08a525ccc0d5865012f1dc9e89b29f9f15728b1398afc27c517e9c46e
- MD5 cdeb9707fdf41f89c51a03cd0d33daf7
- SHA1 9d13cf9a32dc64dc2f74fe0a6b3e54b7afd9ccf7
- SHA512 30ba02418039d8fac447927c2508a1fafff67598e89e6449239b0197a4243611b89713c38a471ebf33dcc4e46513869014b4d895a0584cfaea961862ea45aa21
- SSDEEP 192:tOtB3qR9ZcIJPuWNbdFJmiPo3GiQv6C2te0Nc75ST0usBqaLPtNmhm9y7aSPvhzT:tZcI5Vr8Ch44hHzfiQcPqzipqYiYVl
- TLSH T11E53B2560A3DC11092BBD78002F78F8E748BDA5F265839103FF7547399EAC129AEDB58
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
- Size 41KB
- SHA256 311b70370bf1df44607e3278aad3ff149d0cae01e24b9524994de44eeda2b8f6
- MD5 3b289bd32a4ce27a05b03c25dcf38c0c
- SHA1 482b141a2d1a704037fb3019c86b470676c70d10
- SHA512 fba0f0dae3b64d1de476663016040d28381cfd1b163a8a7f1fb2e1e682067e982fd7e18476d410dd6347fe6c9a3167b139f62241fe67ad8b5af4b6f75c4faad0
- SSDEEP 768:6Ua8nbAFZhDB9SYBaFwWE3LH58Kcq73hdjqaDbPuPntAN:wKbADhDB9SYBeE79ke
- TLSH T139130096B7E91568F6F72F6569B968944C3E7DD22C09E0EC01602D8E0932F90EDB0737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data
- Size 41KB
- SHA256 f6388845fd51804d2858edac3ac1402ecd43e3f5c927f167ad09a758f2593325
- MD5 15df534ea5ba7508c48dded517a11597
- SHA1 1dc8747eed361f45040d2d4ec75f0eac3b12ccce
- SHA512 4c9020eba8d7459672ac9e8625f1f765dda740511b2b9064729fd35fcfafd91d823ec9964f81c0b08a34f9ea4544ee9f0bbe585d73964711a6f885f5c592e892
- SSDEEP 768:6EwOa8RbbFZhDq9SYBaMdCMwWE0EuZIp6Db+qPsqAp:aF4bbDhDq9SYBVEFNY+
- TLSH T166130196B7FA1558F6F72F6569B968944C3A7DD22C09E4EC01602C8E0932F90EDB0737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 b844e30faf7714be2a046d41bcd69b2de980713cce9a52965d8b3a130dc3713b
- MD5 7e7daa28bd98432aa4d05915266e4f3a
- SHA1 2cfc72bc2195054db5c7bedd629b8695adddad52
- SHA512 809eec6d67f3edac0ab39001d75cc983aab41f1f23eab9de400bd8f9568bde06e6179a1feffb8acfc1f07001cfcbc6147f7b6b224c415e57a02f57f610970b36
- SSDEEP 12288:ZF7/PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:n/PsHAnrsRwYIQk3mhUVi
- TLSH T1B74523A6C3AD89B1E17B07342861D538952B7EF0FFD103F7E1A0621B6831E815D75B8A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 a7e740ce45bae56fa7641066d11b3472aab8b0d7d329cbfabf26575e33574f3c
- MD5 c31cd8f1270bc5c5546a02599af58996
- SHA1 cdc5330a62b50fb8d173fead2bebbda2c15ca344
- SHA512 8e833c64a8201ab0da12c6dc3bfb9f123e5f1782ba516b5cfad593af74295a90c74797ecf30dcfede142f4fdfe7ab1a555007cd27a8a1fd267f015465f6fb7e1
- SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bY1PsHAnrsRwYIQk3mhUVi:Tgb4mBIBhGFi/YIQkJV
- TLSH T1B365AE1E22EC02F5E0FAD2B89DA64417D6B278161732D2DF1151423D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.7MB
- SHA256 b3d71d84b3b41f3ef585b150f65a4ae4daabb6185b070d2a6f2c4b2b1420e333
- MD5 07572c603cb12cbf3e6a9bb2d21b49b4
- SHA1 cf3af524f9b39ff721fc7ec4d32aa705c6649f8c
- SHA512 13ded7002cd63311256f6943c7b3ad0b666fe5a61ff17ae6af86c9c3ea40b5c2c30470e1e3eabe5ad57bcfa8602153d3c8ebd7dbc6b0d2fb5a9f2fb2cab0ba4b
- SSDEEP 24576:hG88u8FpJqH1nzria7/mCPsHAnrsRwYIQk3mhUVi:k7ZFPqV6a7/F/YIQkJV
- TLSH T10185F165A3E501F0D47BD13889824667F672B8211360EBEF07A88B561F33AD54B7EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.4MB
- SHA256 e60c2f621bcae3f518e40577cccfba378d5ecd76768651c86c28372c05b06d5a
- MD5 bc596f3058d5bb791dc85d197e89ece8
- SHA1 e44397ec158d794a45209a272d1878243f77fd07
- SHA512 7915f118c34861127becdfb09fb1e3b7058cb9485dc7c02ca9dd8f23774c2a8254175baa0333a80cc2b96a2f8e626a8d30c87f5794610a6388a8ed774147569d
- SSDEEP 12288:fHvUrBFrEjwaQ+PsHAnrsRO1Hb/OFGxQmJ8aHWTa1ebUVu1n7Z:fPUr+NQ+PsHAnrsRwYIQk3mhUVi
- TLSH T12865E12F62ED18E5E677A17C89828619E7327862575293DF02E0817E5E33ED87C3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 18b829dcc513f074accb42ea7249c84e14db269a98c52102eae651ef52dea630
- MD5 45ef71e7d1a58c0202e46c0ddcaf7056
- SHA1 dfb9bf0a044dc4dc4dd3bfad8f7919575e984b79
- SHA512 f08a08f853410e70b3f3a07d5e339f2a667b5384bc1de2496e4f4d7237a5d338a3538f862c757e33073e3155f3ce7fe2ae7fa745225928136294c2a59dbc651a
- SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAje/YIQkJV:WG05lO43bfDJ
- TLSH T12CD5CF6E62EC11F9D1BBC17CD9C6860BEBB23825033556CB02A486A91F27FF4657E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 4a74faf6a2c1328b91472d1ade9195753ef678d4ddc9d8226252805df603dceb
- MD5 8ee1d281c343b95d8d2e1c9457af683e
- SHA1 f5e6829c42d2144daab04067ccd7d2b97b5ce9bf
- SHA512 0d10dab539b333c19ff280563018a84e44021b10b739d40a8e2d3fb476f4003cd56013ddbd4e9238a5e71a7d3f33ba68d808c32f562236857c8a626895372bd9
- SSDEEP 24576:Wfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnUPsHAnrsRwYIQk3mhUVi:Oa5POZ3hJt2pasx2+mW/YIQkJV
- TLSH T17065BF5EA7FC01D5D1B9D17DC583861AE5B1346153329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 dcc39b23e73d7b85b1f7a2d294c591006cc13b5c6d2eed9b1870242726003b87
- MD5 be98d0a2188ce772dd6714389034079e
- SHA1 06b06ae5f1002c19f5c2cd45d98207a725b6c82d
- SHA512 0432e4267af28f82456e6fe0e253a802476a0e70f6c12eaacc42b1c610284dd9998b3ecd3ee32b3b0433916d5050d241df8be64cd8e1fb7f05d4be3cbde3f2b1
- SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7Fk6PsHAnrsRwYIQk3mhUVi:cNc/zEOVHFl/YIQkJV
- TLSH T1E2857B2623E901E4E1BBE1BE89779546FA717865573086CF0291811F1E73BF46C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 82d9600303c1e4c86c52923430fcfc2e4e5adfaebc4796423dc89bcaaf9e4946
- MD5 fa2991ec3eba77bb7f9f54652cdae905
- SHA1 04327418436937e4f5fdada544f6444f383f508c
- SHA512 6032afbd9298d47219addec42fb2819acbc6ccc7f6170c5accecb685df8fd5a7b50085f8c806216b25e6ddb250a392fbf67b5cf988c969385e222eefcf83ff2b
- SSDEEP 24576:N3kNvNnaFeYhJNtmZBmYPsHAnrsRwYIQk3mhUVi:N3MwBtOm0/YIQkJV
- TLSH T16255AF6EB6F846E4D1FEC6B48D238512E6727861173253CB9290C13F0E279D89D7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 b0a62fd1332cd70fb0c508a1c0da95ede6888c1540fb9f2a7c7f23563e933ced
- MD5 86c3d2f520463fe0682c839148790bba
- SHA1 002e96c7f1fe5c47c22c966ece862d2a426a2de8
- SHA512 a3d10249b43edbc97a0b203d624a1eb4333c3de60dcf95a96709ed076abb36ea445c56c5b2769d8dedc17ef3d40382f07ae2077b523f237c9b79caf43319445c
- SSDEEP 24576:qD3FHshBIYQgAzPsHAnrsRwYIQk3mhUVi:qDVHeBIAAv/YIQkJV
- TLSH T14675E17EE79C04E4D57BC17C9A638A06E77138A9036256DB02D081BA1F2BEE47D39F50
- MD5 SHA1 SHA512 SSDEEP TLSH