2b8dd2d9c9d910d844ab3c2a46542033728107c673dd1cafcb189d829b0548b7

Analysis

max time kernel
117s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Size 5.7MB
Sample260730-vd2txsseng
SHA256 2b8dd2d9c9d910d844ab3c2a46542033728107c673dd1cafcb189d829b0548b7
MD5 dc24242e766e70660e6a8d3c7f49ecdd
SHA1 650e7d9fc86260c0645ae9265d3d2cefa696eb39
SHA512 99c6e15e80d4a82a6624900b2f2f43f3602d3f5ddcda9d1fa9b43d47320bd74a040489163d16f39eb790ce92eac1e2cef818f20b3cd0a6257f419bcbffadeb92
SSDEEP 98304:7tSuMOINjO91x364DT+Tx4NVMFb/55PU/yO40xTQWj:AMJtM9/5Rwc0RQk
TLSH
T14656C001BB85C5F1E5D201B0597AAB7A983DBE28573088C7A7D11D2A88312D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
4944	elevation_service.exe
424	elevation_service.exe
1372	maintenanceservice.exe
2872	OSE.EXE
3920	PerceptionSimulationService.exe
3208	perfhost.exe
2572	ReFsDedupSvc.exe
1780	SensorDataService.exe
5524	ssh-agent.exe
2148	AgentService.exe
912	SearchIndexer.exe
5832	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
4988	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	31	9.9.9.9	4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
File opened for modification	\??\PhysicalDrive0	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	\??\PhysicalDrive0	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5a75782283806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000039715b0c4420dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001dbd10c4420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042b3fb0e4420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a325050c4420dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029f76c0c4420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c892e024420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000069c6b60d4420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019e6f30b4420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c7db70b4420dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 40 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\FlightRoot	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TestSignRoot	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\OemEsim	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedDevices	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
5832	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
5832	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
5832	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
5832	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
5832	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
5832	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
5832	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
5832	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
4988	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
4988	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
4988	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
4988	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
4988	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
4988	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
4988	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
4988	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
4988	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
4988	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
4988	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
4988	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeAssignPrimaryTokenPrivilege	2148	AgentService.exe
Token: SeBackupPrivilege	2572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2572	ReFsDedupSvc.exe
Token: 33	912	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	912	SearchIndexer.exe
Token: SeDebugPrivilege	4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 5408	912	SearchIndexer.exe	100
PID 912 wrote to memory of 1376	912	SearchIndexer.exe	102
PID 912 wrote to memory of 5184	912	SearchIndexer.exe	103
PID 912 wrote to memory of 2680	912	SearchIndexer.exe	104
PID 4828 wrote to memory of 5832	4828	2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_dc24242e766e70660e6a8d3c7f49ecdd_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"
1⤵
- Unexpected DNS network traffic destination
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828
- C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
  "C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  PID:5832

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:424

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1372

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2872

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3920

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3208

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1780

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5524

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5184
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2680
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:8424

C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
"C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5AF1C4 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5aecb3\
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 623937b38311766ce506f7d7304695b710f1a3ffc09d0d73d7a7099c1c7a1792
MD5 2b4fca5c0ea740c31be738bc1658b201
SHA1 01422d61ee78f5019c8886492b566212e7d6a306
SHA512 1fe201cf639f128e31b92961f629c87be1cffe942797157486692914a149bdd85a5dd05a4f8c5cc1aacde457e649cf57e83f212002273d33923289a3c2051566
SSDEEP 49152:Ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxnz95MdTAcQQfjP+:i3q6HjB60xTQWj
TLSH
T19FD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 ffbf905d3c2408036410f20142c63c88e393d0676fcc92707fc30794e5db6f92
MD5 68261da1c075089d02daf0301b17634f
SHA1 6897ddf001e043b081f104d8637bd9939c053dcb
SHA512 4eed9a76dc928d9dc15f7dd6ddf5917a4143c942349cc068918c074a1a589de02a7ccdcb2bb9eaa374f1cf67151c2ce3ed3b99be7eba1bab1e2ffd65dae19f1b
SSDEEP 24576:EXYfDtczAeN94AMdTEvcQFuOjOP95Xdt5c:jtcF95MdTAcQQfjP+
TLSH
T1AA65F12877D508F9ED678278CCA18115EA33BC514B60E78B03E48A6A1F337D49E7EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 875a81063237f21eef07dfba29699594b0ff64780f506b60990a8d78bb873b31
MD5 59ce33b06d7e66e67ba5b4a77279974e
SHA1 da6bec40b5d5af4dc7243a4b590f90c64bc2a31d
SHA512 b0cb41664f4b22434dc65694f28bfe092d8812f053b68a8bd2308760853b76a7fee2e5b74d02cbb04b65a487e5fb44c9023d4260b35b1a28faad67e740495bb9
SSDEEP 24576:A0Le5ji0hmxirMtN94AMdTEvcQFuOjOP95Xdt5c:APji0AcM95MdTAcQQfjP+
TLSH
T177859E15F6788335D073C0B9C5D2A69EED7230825B308ACB4286D77C6E67AE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b64edc4a172f42866627be20f085e23588e0f647330c4d92269a17544c59a3e1
MD5 49065557142c26d9bbc91deaebb9d40b
SHA1 01cd5a4e8c9e6318ebf4a84058ecf7d6c37d31c2
SHA512 929f31875e0dbb3ab2329d4d8a073548da451665626ab6a5c0cc2fc0a205671d65049137f2b4881ea5185f3b2cb91669047cb250e580059a0f5121198851a26f
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWE6q8wyu/N94AMdTEvcQFuOjOP95Xdt5c:9/ezSC6vUzPvxHjyI95MdTAcQQfjP+
TLSH
T1B1755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 77d8876c1cc98a6d80a6f7f692e2e745860fc44837685cd56211e2a92a064df9
MD5 9c0d17696d724f8aaa04e28de3216a14
SHA1 b7f4978b619a7f4c176308f7108e48e2a51936c6
SHA512 d8a974847f0cb3a87d3421e181b0f60ed4340b24c93041d908c4869914c9a13715b5ad1a1c1c8193266e5f8b7b889f84374106b0a5905b8ff90a5f10fb3f9489
SSDEEP 24576:AVbqPb88hv/l+6KN94AMdTEvcQFuOjOP95Xdt5c:AVO88hXl+X95MdTAcQQfjP+
TLSH
T1E2559E66F6748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e72e114d0e8cb8fb596b93ca8cb01bc897d1d48148ebdeca5c4d934002ef64d0
MD5 c0328769c718de55e4327c4ca1d210e1
SHA1 0dda0bb1cde2223e5c6e2abf19851fd2f59ba8ff
SHA512 83994f620312a4a5af4a3dd3654a3f3c1dfcf1d64bce92db4e2c6350436d9e2141547b8b3336b56a38b4bf4c38c79373dd4a242b9cef98ea97148555004cb455
SSDEEP 12288:yRZqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:yRZN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1B14523653F8DD0BAF3E719B05CF880686D0A9F518E41964F53D25FAE89389C2D6E102E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 7ba55b02d2d0586b49b8a8186c31f8ff5f10a72cf877dc440e3337f5e69d25ee
MD5 508063871f1c4e871d0cf6a98100086f
SHA1 06c9ff7623c64f453ba3eaecf3fc4f04044986de
SHA512 c92b9b7e7a98d4961938e303a05d2a4c86a3f7144feaceb03399bb423a75c55b78e96c00228179906a4d528f601bb3f815ae633959f975780d4105cd14bad49f
SSDEEP 12288:reBNUbTVO86UiqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:rJIUiN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T19F65CF3BAE28FCE2C27A5DB85A91C240E77278704F52A3CBD165830EDE235D15EB5C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2c209840eac46758c77926f42fd254ed9f1a402cb2ea4d86e215ae13c5a3c88a
MD5 01ab0cd4acc5ec19deeca76d1d0facb7
SHA1 8b06d1f13e6320eaaba2b9e8139841f5004bfffd
SHA512 806401cc8361ad767a2022269ef1db510fcd528026331e0a10d8d4850fbac95c321edfe1a9324891ff092ba79ea69f415f2be33940284969d0bb4e438deba58e
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THa:UQvGAdlCEL8c/yRNw5Cl0xTQWj
TLSH
T162266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 7c1ebdea75e6c8dc8bf4c8ede596e4a9dbcf0f7f09303486989d7bc7a12d899c
MD5 c767c50527bbcae513650cc4dcb4f100
SHA1 517c11bff9c4a23b16cadfa4109d6d3c88c46e9f
SHA512 688abbbca934df41899558435bcb2ad65d15d8472499b08f0ccdbb091915f0bca4f21827726b7bcd7415b48ef6ceaae519498067c8418e4bc276d456b587cbcb
SSDEEP 24576:OdewsAjEN94AMdTEvcQFuOjOP95Xdt5c:mlj895MdTAcQQfjP+
TLSH
T19F75E031FE75E036C2BB0DB21B75C716182D7A204F511AC3E3E88E9E59342D267B6A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a1b7bb4dd2b423deec36f717400ca49054ba6bfe9921cd652642065a1fcc5411
MD5 8eb0ad6598b269bc2c01f637f2cbe208
SHA1 fa5430d42080688e89fe6c85212b6aa5a1d3c503
SHA512 ea0d9a862d4c441f30491fb02193e5329fef04db0cff35a22b449226dedff7bfa3696658d38c9c8bb5e340a168c78b74c981c3996499249e0234580574d57f03
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH00RQk:7UEtQevvqc2W1cpV2EI3200d
TLSH
T139474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d5b4dfe4ef477c900266eabb7b63bb39616f4a2995bbcb24d2ddc78a45340668
MD5 12eb364a11ff38a0fb0add08e0ed32c8
SHA1 82ca9e017cfda2012c2a20f50ac2d08edddf3414
SHA512 abe5e8736ec806e32e78a0fe5640e614febf29e5acc1f6c12d496dcd22ebec0d503e3d86d30b21bc857b770127c2b37f0a97cafa1e80a8b4765ed0c5b95891a8
SSDEEP 49152:KCbRquA/m2yL5zTfFiV+XenmE3/zc95MdTAcQQfjP+:/oquVjnmx0xTQWj
TLSH
T1AED58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e28b82f060cabd7cd578c8352220e3eaf80f45a9c58ba3d9d5025c22b079ef1c
MD5 15652f98fab44e0f18ead509d60f88f5
SHA1 78f08618e9ba0f5544f1b9803f72860915ef4a3f
SHA512 2587af3ccc9cdb1a2804100eb5ed353dd1dfb981936658d7fb218db4dd9666023b6f961c1cc55c7625e197747d8e8665fe5ffd7d6700c2e5bddf01a2cde4098d
SSDEEP 24576:eAhGLJIFoiwtA5l7S53zN94AMdTEvcQFuOjOP95Xdt5c:eAMyFoiq5h95MdTAcQQfjP+
TLSH
T19D359D81EBF955D4F5B3AAB899B68171EA76BCA65E31C20F2250D11F0E33E409D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 273703f709f6411be9919c0466e2781cb3ed5200fc9e7280e55d86f33a87800d
MD5 d5be14b6dc96c0445a7aca671f72ca9e
SHA1 b8d4de55abb2e065dfee575cc7ff3019894c33cf
SHA512 d01b8a2142fd824c2b41e0bcd7989466e5b7d9bc4cc91ad7326f69e850dc535be0c27f82c5782254e2500582e7aca1d7f4d38ac70bd25c260674ce666875124c
SSDEEP 12288:0mw5HEjsChNVBFgl0WDm+CfqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJs:xwuoOWIN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1E665F14637990CF9E9A786388597C136FBB2BC022A21D71F17A0C65F5F37361AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d89255d729a3e9047e99de9dd42174d55a8e9dea5a8c0747eeb05327a8ce813e
MD5 fae35f99863ed17b4b7121267a06c9a1
SHA1 0c6688d70dbcc08fc42ec0f16ad7365b4ac8c4de
SHA512 ec51a7834df1896d18222e67b40f7bebdc4fa60ae194d60acf6a191998878255eae20f159ad5138f8b390afece87c9ba8a4a66cb9851de2890a76c0f55d2d498
SSDEEP 12288:NBZ1IyUqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:rZuFN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1C45512593BD860FAE1A35274CCF48215EB727D525B3243CF13614AAE5F32AC29E75322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 deb1655a5a702aad9c66a2bc3af3fb0d3e8b909cc7d35283b706dfaf36a1f6d0
MD5 b157be613caf752e8063ff594707b356
SHA1 8ec56964072c231aed2cb6cc78cc13bdc6f62baf
SHA512 49335b62795434090dfa8a057eccb22c4ce5d02520498d0c0db478cd39a566d369bab0b033879c1aa9b96bbfb04204c145faa4b5baf4b16f563cb0fec072999c
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:QQRQyi36YOcPQLvw2gAf+PN3e0xTQWj
TLSH
T19C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f7ac464858e093ea304b298e21ebf4872d0672cfdb6cf16467cfc94aebc4ea9e
MD5 1c9d894e21b3852ca6878382891f9bdd
SHA1 8c47f3fc785339737995282bee704e1e59ea54a2
SHA512 39160187cf1cd2be7fb7542f50ab01dfb8a5224d167f007c148ba09d94b81c0a14129fc54fce6fe565a3b20cce777972aa6f6c87f33711b818e81297128fad58
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:vQRQyi36YOcPQLvw2gAf+PN3e0xTQWj
TLSH
T134667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e2fb10703a074e05ef89d4f8d4725fc350f7e59f505764743908f37081103e7b
MD5 54fdd777ac062d439aa69d986269ceaa
SHA1 4438be265a3744454e5bc1d62583b9bd604adaa8
SHA512 1854ca55388263e1016f66ad6a50262cdfa569ebdd340fdbaf34002b7f5050c13e0967a3d5f92848fc1f3c42b05878c6faa8f9da3b646de8546c54796c85afb2
SSDEEP 49152:s68Qg55nhheWu7PNU3/M95MdTAcQQfjP+:mthWRc/M0xTQWj
TLSH
T105B55A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0a58d93a6778bac7be37f14d47ee69259127474893cd784e360068daa29e1a58
MD5 a436cee79d87b74cadc26853d8bf66dd
SHA1 2020abd4af5c73729c5ba68fa88a29ebb242516d
SHA512 9108a404636201fc7f5096f5f4a03cc9c114511134878bf936944ce33f4008b0c1e9a637990d9665e0441e7728a1f027b4dc6feb0e6b8cc8b91fe55af7292875
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk990:ny5112gYy5azzVvL69nLKnhZv0xTQWj
TLSH
T1BD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c5c476a5aa0effc119376824edb5a5a83efbcfb5de6a2e2a3cd04744a2a60682
MD5 b028b9d10d2a8557fb645a2f82704c6d
SHA1 e047be78e80633550c2baa623bb163870ad6158e
SHA512 4283d9d45c7e5e1b1ae0038b83aaeb86d8ad51ebe7684dc8b59aa11860c7d6088b6f72f26c56655b59284a36860ee0e82986325d1b673dd0f5732c6f5fb7fd0b
SSDEEP 49152:UB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glG95MdTAcQQfjP+:Ou6JmVxd2dG0xTQWj
TLSH
T1F2D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b3b408f4ba1c1e6760e778a81d402df4daa735b5a08d5ab82b35ecaa3bb29c83
MD5 928c01c72c9311ae1cdfcf69f021ebc8
SHA1 72332a5b03ec37c52b6e9945dbe810976c99136e
SHA512 40f425e58822a515e15edd8c21d6e8354884bd6448823ef3efb3bdd0351fbfddba7642427c48341252675c9ec2d4babee371ca1e29cb174bd3259d160337a8e7
SSDEEP 49152:c1hpsNoJpF1A6UU44CwH7R4xy95MdTAcQQfjP+:cmifPbRx0xTQWj
TLSH
T1D0B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 17b41f03024e35f2e2b36ca20ea31a9df656b6654230bea41d90f04d4f7a176c
MD5 eb08cc0fd776059f9e999dcbef6c2cd4
SHA1 5fc7e70b926edff3aaf428bcb6f358ff313a28f0
SHA512 6328f3efcfdf503c4654cfa0847aba15ad81d1083681b0b0c99808a9225ec349b469f5a40a09f89337cb934f11614d60e57546f2aa13bf34d0951a3aeb6c2c96
SSDEEP 49152:ISuZQIY0Be2KRRVtOnks6NMHqj95MdTAcQQfjP+:S5dKTi61j0xTQWj
TLSH
T17BC5BF13F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 32eb560bdb59395cb58cc1d28b34d95dec5542bc0fbf789615d5a6c9284ea59b
MD5 6c94b0c65227858b1ef5dbaa48e83149
SHA1 799055218b53c00e9b097673ec3d847559939b32
SHA512 ba5001e931b7e2e2947f93ef7a455282af50240e706cc91562acb541b2aba9772a87e9947b78f305d321ef67b950fe0f1545e352e0a66c924da2582a8a42ce67
SSDEEP 49152:zhtSn8EApI0figngiDn0AP5w295MdTAcQQfjP+:yX2iyphd0xTQWj
TLSH
T15995BE13F2D900E8D05ED174C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 469b64e453bc443fa3f65b923476fb35d8ab60c680ee10777e7799643e65107c
MD5 03223c32489ba33178828b3671f3345e
SHA1 e09b38b2283a3c75ec523174a9f1a6b04653ff61
SHA512 b6fe9901d496cfb0f7703cd55b06678f101893acb93ab0e6636a6c48e85b7fa461559a32f70b6f63197fa0475b9e3b1b2834b910f22eba62f009360236c0f8c7
SSDEEP 12288:UxqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:UxN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1D14523543F8EC1BFF18615B08CF88168AC0E5F56DF42528F63974E6E8A35AC2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 779976eb7c62fc54a1b65e68672a1f68b9e05276c1000e65298b592adce5c31a
MD5 0bf84735b0650f1528bd21d02f697798
SHA1 3592add63070d443e750cff46f430f469d95ef4c
SHA512 10af30b8878a1d8a2d847ae540a06144beab8a7c413e8c717deaf4c03a197c63ffe8c55e3306968dff9124211a6b920209b711d629e8e962d7a23e3ec022217e
SSDEEP 12288:jwqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:jwN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1884523643F8E81BFF18615B08CE48168AC0E5F57DF42528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b887c72864f8c67acb303690b334a045b5042174fcd77e78ebbd8a5d703b7693
MD5 83e62354434dc4ff2f60315cd7be24d8
SHA1 671fb2a81ed85bea0abd24cb6a9a938ca91e67bb
SHA512 8e888a2e1fc5b16e834bd043d968b92510791440b2bab8952c29a63e2de9d57ac77a6687ddc4f9d5d3f0284b30af655ae8532ae178c0ffd1d4e55b5fe7e98f18
SSDEEP 12288:O6qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:O6N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1114523643F8EC1BFF18615B08CE88168AC0A5F57DF42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 1e50a78f6cbe12fcc3a6133dee6014d9478fbb3e7b1e691daaa90d3ff6da5f12
MD5 62efd0d7ce60b91fccf9bfb29dbbd0c4
SHA1 5ec99b9a8cf7da702b25bef73220637125ab8125
SHA512 181d47f25cd0609b9b692b2f22ba05e4775d3236859c34e3c41ee08c642fcb62ae325499c60402e85f4bc9141f5e9c74945844f88da7bcb640c766a9df41b59d
SSDEEP 12288:ZVTqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:HN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T13A4523553F8E80EAF4A796B0C8F48164ED6ABF929F12938F57420E5E4E317C1D9F0069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 624bc1fb2e0d9be1379c59fafa7cf39fb95e3cdd5efee69501bcac4676acf50b
MD5 1b9faad449c8274ce412a35c0fb74086
SHA1 1fe5770dc5790e87a8317454cf2d17ca1905e03e
SHA512 6f4583e5e0a8d58f65658fc7a08bc9acd44747762bcf5fd717d989f7ce22c7f74eff7c1b56a5e40610ac754467e53b19d2c083915643203ab16cb894581c2d72
SSDEEP 12288:r7qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:r7N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1984523643F8EC1BFF18615B08CE48168AC0E5F57DF42528F67974E6E8A34AC2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e060d4847a4b6edf96481e8a3b0c2878ee557968cf6e4f942e4aaaf51c03ef9e
MD5 8f214cfbd9f6440a18f08429734a0d14
SHA1 ab10ba154c6f8cb69abae1310237987dff640c28
SHA512 b8ce123fc05530f7a25dee6783237a289da55b545c92080d8696c380b5f36be0960463c36e19ca5d6f7019fc03adea5b996971c6bd663b5841aab927ffd2bb36
SSDEEP 12288:KcqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:KcN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1934523643F8EC1BFF18615B08CE48168AC0E5F57DF42528F67974E6E8A34AC2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 665e47faa704c44acf60b59d5ab948acee5cb4f4b558a8da1348bb0f35d3e1ec
MD5 52266d040aef1d3701a8318014940d5e
SHA1 83d908eac9bb0dda942a04afc068e2bb38ccf9c9
SHA512 4eddf53e3af189f040ba3e53a17eec7bbaf70ee57a6515c3bae3d41e93802fa5e1f7965912a2e5e3e01ab4eab7a8b02aa5f1732617342cbe0e439a0744c9ee8c
SSDEEP 12288:d4qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:d4N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1E94523643F8E81BFF18605B08CE48178AC0E5F57DF42528F67974E6E8A389D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 0329957d4e817f69db8d828131e1d44279b8f251d993b2e8b8c45396d853bd29
MD5 f08d945d87990d3d402f5d4319214126
SHA1 79edf3bdc6ab3d4b7b9427abc36f09ed5b0b91ae
SHA512 acfd2182d20f0c2727cd409e5213e40bdda8fe523354a361c878ca4cd3c9de7335a21e0c136c5ebf5913ed42b34a7bc26744a75b405e11d351fe40fecf66325d
SSDEEP 24576:wZMSzFVSOQN94AMdTEvcQFuOjOP95Xdt5c:wZMSzfU95MdTAcQQfjP+
TLSH
T143650294779418F8ECA3813ACC658915D6B27C5A0B60C60F03E4366B5F333E15D7EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 cd33e87ee7fb3e170a9f38ffb9e6c0818f9d20d0e852b5340449f52eba2e4bed
MD5 39b19bda6ca8ee899953e6fc3ced7d91
SHA1 b20d473351da70556acf39a1ec57824966584085
SHA512 ba18e7d24ed62a6546ede780384f8f68c7889f08b92521ca9cb109c7a835927d93a21f1f417e0df022a54c79f81d48e0cf3ef126b9500c3c67e85dbc9868e167
SSDEEP 12288:iVqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:iVN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1874523653F8EC1BFF18605B088E48168AC0E5F57DF42528F67974E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4965024e03100e43f19f1e568585827fffc7386c72f767edd8343c7e4ad307c4
MD5 e41c81642b5abcc6c96d97754f0f94b3
SHA1 8fbb7a649153d7ea2bba806865f1c13f719c0779
SHA512 e24d4e3de1c622e0f4a59302d784b678e3f5d612abcb5e7251cd24a457d6b25bfb4b9e7eefae519fa1d7b9c1e0298dd8bd3d7b2fddc8a78659ec40d7af186ac7
SSDEEP 12288:PpqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:PpN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1D94523653F8EC1BFF18605B08CE48168AC0E5F57DF42528F67974E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f7def53e710ec986aad19518e57c79f6e6067c5a27095c3955a10392091409b4
MD5 2550267392f35ab89e27afcfc66838ab
SHA1 d629f15a878f09029106f5cd597d5f28fbdcd690
SHA512 c3840fc3830b280cae183daef4641c63ef4bfe4ab14efd5dafdf0e1395a76d51f81faa77b85bc2d2c40c0856d4fbd61284b39befe53d3431573dd0572c3b0563
SSDEEP 12288:IyPz5L8UqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:JzyUN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T168550217379930FDE1679234C8A14615FB76BD324B208A9F13A00B7A1F376D19EBA760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a09000a76df35c952a165cea68359c33d4e78ac1b965707861bce5362c9af54d
MD5 4369dc1ee0bf85cfaeb0fb25e3d5faf5
SHA1 4c74d0229eff3378eb76a3a9a7695d1021fa679f
SHA512 1fb9cf7cafaa0bce294a841ba5c9bc1a63657fd29d5a76bd741e592b556ddacf42c35888e14d16907aa64e577f7616a908acf2ffc8dd372158fd003cb78c1264
SSDEEP 12288:LVqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:LVN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T10D4523653F8EC1BFF18605B088E88168AC0E5F57DF42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9e0ca981e8d4e40d6742d9e6f58058dea4a174ba17419c2f6b55a82ea902f2b7
MD5 553107a093c718d4d2b12a5ae0264dff
SHA1 29b2826dacc5f4b61a3b1b05c89c41f9a5f3996f
SHA512 e9918d02ef3f026a7f9185784bade8ab59dc906a3605639e798b55cf770318f5034b12c2c70eb80c57e2b3ad586805e9a5e243127035ef2e017237f44ac8c86e
SSDEEP 12288:kVqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:kVN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T12F4523653F8E81BFF18605B08CE48168AC0E5F57DF42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 81cd6a6dd3fd327f0e35aa8027c8f73ba24500bc16b5a7b5b204ad278ab13e5a
MD5 15cd5287bcf55a5a271e59170da617d6
SHA1 1df72295d4288acc9684540074f55ba5821d59dc
SHA512 d020636bd84f6f899ea7d949f470c989c9acc05e89a46e42678bc1002bfaa4a77ebc5a8c7f6770bb912c2ecaf6510d31d6f3d9b5e3a1b1edde07952eb9358941
SSDEEP 12288:jyPz5L8UqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:OzyUN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1E9550217379930FDE1679234C8A14615FB76BD324B208A9F13A00B7A1F376D19EBA760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 bb9af9439226820ae87ff6847015e1e8f95a8d6fd904f39d943680edb79f76e4
MD5 ec8d931d063467f962ea348fe7c3ad40
SHA1 97fa1e509b0580f1fe01b96e0e9333a91cb4b773
SHA512 863028595eaf8054028b5779acdcd5b43eadb500f368d9ade850f0d7c814b2dab91fc20376de6425f57d91147b1c45579c3ef4bc38bedf2b5b1edd985ff5c7c0
SSDEEP 24576:YTHaLl3z0zDqN94AMdTEvcQFuOjOP95Xdt5c:YT6Llj195MdTAcQQfjP+
TLSH
T1A26502A4739418F8ECA7813ACC658516D6B27C5A0B60C60F03F4366B5F333A15D7DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 e68e9164a3477bea88d4cc961e0534104f8e2c566ea8af64670b80b6b1f08d6b
MD5 1381b0c95affc4e5a190f2e5b4d62688
SHA1 b4ed13d9abbdb0393a6314ecc4fc857842da9cfd
SHA512 6efc10e66089ba6c171df01a11afcbac56e292c500b603e928a495680f4f007b864fe5935fb8ad9710986c5daada6c3623d8d4447c643b90b1b7882ee1cc9fcc
SSDEEP 24576:l37d9CHKy7GZWN94AMdTEvcQFuOjOP95Xdt5c:F7d9CHKyaU95MdTAcQQfjP+
TLSH
T1EB75CF90F7E810E8F0B79A35CD768511DA767C5A1B21DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 bbcc6991730be908268c645787e2a5729ba59a74dd3cb198f099d5906b776dfe
MD5 8bb3687ba40e9e2afb170d14a3fccce3
SHA1 f30d31778b1f173605a253935bb48d9c54aef789
SHA512 9f84848ea7c9ec97cbedc3b23b99db3bc1bf02ed5a009b54aad7c2e020f4719ba7c7a44c92f75dec36413db6699b40e94cd85307023337546a766bea65586285
SSDEEP 12288:7aqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:7aN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1754523643F8EC1BFF18615B08CE88168AC0A5F57DF42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d8229885cf71a1a6b576fc1264e719d3b51f2c1df79709ba86e58e6b72fbb960
MD5 6d2a7fcb0d82271085afa90453bc1af1
SHA1 ed44f10c9f3d9ad77b5e4f2bfe3b14b2ed9082a9
SHA512 47ac17a3996cf065ce0e782f3eff53f74aae95e81cab74af1ed5ad13facbc5c610b253cb250bd888e0aa2387249f89ba642acc41355aedaa8467317808a9900c
SSDEEP 12288:40qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:40N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1AD4523643F8E81BFF19605B08CF48168AC0E5F56DF42528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 33a974872c3a601e4dc33ce02e9a20709146ab82ae74be6f33b09d3946207648
MD5 b3ff7cec286231414916bccc60fe9fbe
SHA1 49436f86af4b9ce1c64978f651f39be20d1b3656
SHA512 7c310ff243b76c36505bd3066fdc3570f996ca53e420d311766a08ea92421910a60eec7a42ae425e4bc9166c6bf71b8e8b1f46f65d0ace6340ca8b16142dc451
SSDEEP 12288:anqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:anN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1AF4523643F8E81BFF18615B088E48178AC0E5F57DF42528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 543867318736b2b849226d611f334828ecc00a280897f831f6e1eb395bbe1f59
MD5 7dad19d46b2d227ecda44a6d617cc10d
SHA1 04003c9218572e05c824163c52136dda8bef5e64
SHA512 dc982656653b46a828e16a5b4c50184f88b09ca0971a01316e44a8175ae29186e9f471c0f44a008a7ff1271c46019d27012aee091374bf12e8ecd3df3d044ca5
SSDEEP 12288:VVqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:VVN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T18E4523653F8E81BFF18605B08CE48168AC0E5F57DF42528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7f5909c6a3f0cd577391ee7bb3f19e868af5f65bde8b2ab4bd1d1d98c32d0465
MD5 255731751377e230afb2f518bb912dd5
SHA1 3dd46a55a6fafd55a82b7a558f53c8399e34ed84
SHA512 88d7ff4a5519db553f051d8acfd5226770f6c55228cc0d40426d0ab58dbc13b333d1ea1b1c2b7f7950116965fcb8220b8cbe972dc1654b29883b83d766d0b4bf
SSDEEP 12288:8aqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:8aN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1E84523643F8EC1BFF18615B08CE88168AC0A5F579F42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 9b6be2b32dfa6057911773b9cf69873a4a3fd32d1d84fa3ec898f83ba0b3d182
MD5 6682197a2d255da7a4851047859257cb
SHA1 77c11056e211da9f169d5a6cb8a61a5862334018
SHA512 e11e490fee30e992bd56adb95609fa8352874ca86db97a638abcf944ee77ccb00fa202d3076e82b1bc47c75138ca75fa0166e9a1aabee3f671a880879658fb47
SSDEEP 12288:0dqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:0dN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T15C4523643F8E81BFF18615B08CE48178AC0E5F57DF42528F67974E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 444adc6198d8cf5e72cc45448adc65e15c928e43c9b4f10e829f7e9ce70b136e
MD5 777a5db55d77353a5c6a3eeca3414f56
SHA1 17b15cab33724c619b31541621c947bcce97685c
SHA512 f0e8668347d9dad3a42395daffdadf653a764128ce90fb15c5cbc3e520c975ec20a205b9329302024b8b83b2bb0748a766fce3f88491c123dc033c6c8a459157
SSDEEP 12288:I7qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:I7N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T11C4523643F8EC1BFF18615B08CE48168AC0E5F579F42528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 cc1000f272351055e11d591f71dda824d08a1225b7227b631abdcd3b90416c13
MD5 cf34b6f853295afcdef673d70693703b
SHA1 8445ddb26b0cc6b6642da50c5f629c28b4ea9029
SHA512 510c8193a8303020bc1086fafcd759edff735ffb9a8ead11304bc80ac1acbf758db5b021b6f26fc82f770e657d08102278fd5ca411084ccd5f00293b7e4f6ff5
SSDEEP 24576:qfwvok9RX6wkyAI5N94AMdTEvcQFuOjOP95Xdt5c:2MnYIP95MdTAcQQfjP+
TLSH
T11985CF29EFDC44E5E1B7923889B7460AF6B178591B31C2CF129A53AD0E37ED09D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5610c7934b6d04a36deffc23ecd7d242a6af52b5755fcb47e9d0a483df7e9670
MD5 fbb997099b145991ec177a0e5b8d8e6b
SHA1 0aa8140238a4f8d21ca84373b77f02762f5c1016
SHA512 7c94bd28f94f6cc7dcd7cac468eb772cebf4a8b0b03abd2f936a8d515b9da406d1fe4a2b2bd34ec45bdbbef5516a24c385775c762a75715bb7fa1eab7120c7b7
SSDEEP 49152:yYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0W95MdTAcQQfjG:sySzP+0xTQWj
TLSH
T1E2066C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2dc694413edbb3c57093da7dca96d0ca20d24f8d2772c4818ff5352c31b14b3d
MD5 0cf6e1c197e0d7bbf080ca380e15eb6d
SHA1 f0cf8b234065ca16da2cbdfc67b3c8f97acae635
SHA512 def841b68c85adf8ef7bc2408eed296fc334399baba728eba32faf3b44c0c10d1b104b4782709e1b21275a15361acb6b4db64c93ecac34ca046c4188861ed779
SSDEEP 24576:R47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYgN94AMdTEvcQFuOjOP95Xdt5c:R47JUQj1irIhCnDHUPfF/G95MdTAcQQq
TLSH
T13565AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 47e37056627a068871d753a39030dd5d46f1c44e0bdf06e9cec53bfb0a73b2d2
MD5 cc07f8cce7317fc1c892db68e77c4e4e
SHA1 b51b204bd685b1d970d7c9be44f4fadc8c218385
SHA512 8fa8cf5dab6d8b1c978d56122eb69a61e526191af255d1ecfd4092d1aa583718461925967ab7e49ce5d8930713d2e69ddbad522f71ae40346f699957cc14e39f
SSDEEP 12288:QNsfFqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:xFN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T15955F119E68842E9D0AE6270CB958640B7277D258BE1D3CF53D0F93E0F366D09EE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\karticlewebcloudsummary\mui\dist\run.ini
Size 171B
SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
MD5 b30cb271e143eace0f55ea2e562e1e9f
SHA1 9d97dbf24931cfc114384c3f4dbbae21c9e51be5
SHA512 dc593185fa63b458024c3a913c558e5686806154181dea67eec786ada50595c53bab822833ad1e76c9acdf21be3eba50631391b7e575d7f1f6409ceccf966535
TLSH
T1AAC080D4D0256F97DC31C6B5ED54AF1A7560E700251C1EC3D530DC4E9E9696551C805D
MD5 SHA1 SHA512 TLSH

Submit Download

kcoworkdockpanel.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kcoworkdockpanel\mui\es_MX\kcoworkdockpanel.qm
Size 846B
SHA256 8f0de81b05e2ce8a22432406009084933f0cf410e6efb534aafd71699651120c
MD5 6e815f2b93f16067d08e51cdb69b81e4
SHA1 40630f21ec4e2ce47da271f5e379737bef67fad5
SHA512 7e9586a605815f829a2881ae328d4df3cb9600949767cc5c8fb8186cc2243b08d8cec4bd52cff81c728fdb0c8fd7ce1c9d8e52e9fe4139722e99d4be12c6e482
TLSH
T12F01E9D527FD2F19F3F79BB179E652108F3679082931D16F2145A40D05A15505DD0327
MD5 SHA1 SHA512 TLSH

Submit Download

kcoworkdockpanel.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kcoworkdockpanel\mui\vi_VN\kcoworkdockpanel.qm
Size 839B
SHA256 ad5549bf1c748909f191eba6e08caccfb31dbe1a2ce4bfafcb1e41702f40c95f
MD5 3eabae85edf1db8a54d42509c660862c
SHA1 ea6133582aaf7aaf5330142474dec996e527b461
SHA512 05d619228af227bec2d3b33aab044dcaf79b69633c604f81d6456eb10d4420e48024a9a88cd706fb5c00908565347f5e04302f90bc5211d48d99e2aab2feb7d9
TLSH
T16801E29523BD2F19F3F79BB17AEAA2208F3679082932D16F2145A40D05A29508EE0327
MD5 SHA1 SHA512 TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kpdfcorporateglossary\res\dist\index.html
Size 636B
SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
MD5 72cdeca808b16e794ec5b66bd02246bf
SHA1 e75b6c4e084efc8e60c9e4fbe9e9ae02bfbf4132
SHA512 6562ed498bae7f819caa5ebff9ba373b1bbeae3c92befacbc44a72419e6a3aedeee7fe43347d1bf8c46b9c90c8e515181a6dc50c4ad954a640cf6b2520269ed8
TLSH
T1E5F002EA3C25F055CB911EA43DF2F19E245E3AB29DB9DE942AF4513543C03694D0BF48
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kpdfcorporateglossary\res\dist\index.js
Size 2KB
SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
MD5 67dde682d1968824023dd9773f9ec48b
SHA1 81e0a21a7ba2c05193ecc13672a3f537539e0699
SHA512 86bccae3d66df4dd552c12a42d1ed0d57d6cdb7b904caa1f89c874e506fb76412b2df45e3e5f673837cb72aa18b0ab2c1dfb489b1da37068d83d7ccb25d3d8ea
TLSH
T1FD5173C9F79E702209EAE136583F0006E17735596098A1C8B87ED8F16EB555E7077F38
MD5 SHA1 SHA512 TLSH

Submit Download

errPage.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
Size 7KB
SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
MD5 eb3b05c3a3fdef3b0c5c9020756ebb33
SHA1 27c5773e17f9c05f471ccd22db42015561b4e669
SHA512 9a511c6d0aad855448ae45130d7ed031062bb7e6881e68aa2406c7c122220318379c312bc13876599dd7fe88e2beac296adf5bcdc015ef4e0e3f362e76303ab0
SSDEEP 96:9uMJIMzvOcuq4v+nB1W1QjjaKhwc3Rgjfqqm8bm83:9lTgVv+B1W1Q6ywc3RgjfDm8bm83
TLSH
T141F15211D6925216603393B4DFA25719FB260023A3038A38BFECA2558F75C495B93FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicon.ico

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
Size 4KB
SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
MD5 1ba2ae710d927f13d483fd5d1e548c9b
SHA1 c0605efed936ee2600284e6480521d06fa64f872
SHA512 f933cd352eaba92f509b3863353ddfefadfada26a4152ecdc4727d450bbf35e7b10fb3038fe8db340d5c63d74e608c1560ec84d0f6ffc8ccd940c9e0d7533544
SSDEEP 48:i3H5R5hLOR4kt38PduMoglJrd6qTrp9hweFC0+6Ga:ipHFUs4MLBvuyCda
TLSH
T1EE9175DF61C388D9C1B1977F78C449A14F6FD951BA28351F55CF30622E5D75818C1C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebpromehelp\run.ini
Size 226B
SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
MD5 abc3a6089b0ea76ffc960fbc9b6e66d1
SHA1 50ad0cb201c13799024de56cf45116cf65ff5569
SHA512 ec1e32b7bed882095b23e049a4e1a86acf0bf993e2f691105ffbd99d93ebf28faad4fbdd645ac1eefa74ede575854a3994c7c6d2bacc6f7a09a1991561b1a44b
TLSH
T157D09700C0B5658AC1254C827CA53DC411085B4B27608E02CCF0C34D508EBECE56B08A
MD5 SHA1 SHA512 TLSH

Submit Download

close-secondary.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
Size 216B
SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
MD5 07306930f7d374663bd13e38ea0e92a1
SHA1 12f877e8ab93d874b55d75eef6747615619dad4f
SHA512 4cc0517ed0b9d665df4db93fb3093067e90f64b34f1d41420ed975b4cec64d4cc0aede64092d79c610c04e1ecd9514a9ef48389d5c157b5bcf698fc33670db98
TLSH
T1D8D0223BB3CC8E1CF9224A22F35A713580AF41C3548942E4D8322032E4011CEB93B6E8
MD5 SHA1 SHA512 TLSH

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
Size 334B
SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
MD5 d36fe6147829a72b42e054a5db27d270
SHA1 80779a8eb37d8bb1d5fcc594576f80dbd61fac98
SHA512 94224816f757241b3a6d19788225378ae070fc62b4620e11e10a033e3be5d9cc858cd9e669cc275b1fa82e57094d0df13a6d9868cf00afaa17cf2ec0193acd74
MD5 SHA1 SHA512

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
Size 327B
SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
MD5 18770de3f96bac1e75e588015024fcf8
SHA1 e6254c054edef68f9c27059efd82eeaa69c863b5
SHA512 fcb76291a73d7f2e30f4266ea8f0dfa2d9e203cf9770fb7ffd73cc1994502992fabd0803224c1e1155c1e4b678b5af0e8b3aec114beb1f02299e8885d5a61d0a
MD5 SHA1 SHA512

Submit Download

element-icons.ttf

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
Size 54KB
SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
MD5 732389ded34cb9c52dd88271f1345af9
SHA1 8058fc55ef8432832d0b3033680c73702562de0f
SHA512 e8971ae48f5287d252f5b0a2d0516091bef0d2febf7d01fd7b435e426d106fea251037439ec42c2937e934b66f38e5eb43d00a213cdf334f482f4a06b1817f9c
SSDEEP 1536:qTIRCXXCwinqtuPM16hD2N3SUjbwaST4DCJe:39GEcgD2njb5ST4h
TLSH
T10A433B32436A9BE7F416047F5C1F55830A9F4F22F53DEA8B83A6192514162FD0864BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

element-icons.woff

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
Size 27KB
SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
MD5 535877f50039c0cb49a6196a5b7517cd
SHA1 0000c4e27d38f9f8bbe4e58b5ce2477e589507a7
SHA512 da269b20f13fb5b0bb4628b75ec29e69bb2d36999e94b61a846cb58db679287a13d0aa38cdf64b2893558d183c4cc5df8da770e5a5b2a3288622cd4bd0e1c87b
SSDEEP 768:gOvv6ExpCVxUtrT6w8ClFd80EjPVerMKBaGXjAlEm:Hvv6xVWewtlFdGjPlkFjAlEm
TLSH
T1B9C2E13197213AE9D9824EF876E498FEF1651402290F390E8696ADB3A98D5C73E16831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
Size 107KB
SHA256 907d1f5ee046fae72b52eaf99508ddb6b48d47b803076db0e9a86b0e21a54ba9
MD5 0ad676312c51d1b96bd08f056ab33496
SHA1 270438a06781cb68c376bc18c42437dd5ce262da
SHA512 6a6883f9fa0a1f768bf985340dc6cb4651e5ce691066c9597126ba1fc62b2a45a2eee52a1d8452faec885bbd3358be3fb04a15fbfca0302feaa1adc2c81130c3
SSDEEP 3072:KazzQ51KYGqMkYUl26MeCAAcdl6y7tqWD:mME/euD
TLSH
T15CB31B37214D132D343BDAA2E55D659960C8F61BC00253F9FA247B1DCA837873A7A3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
Size 279KB
SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
MD5 a3964e72421a1ef5fb60c6e17eb5d705
SHA1 5dd9584be5141e884a230c48746e1c88126b0a55
SHA512 4ce4119b7407b460969041809354c4ede587047ee643f2897eb0ecb9627608431f43fed27c54c70bacff3a6694eb32a85b535c7d6397ac22d7d28e260b0a5467
SSDEEP 1536:39eSBQG+dyAUlHj/8D0Q+SPxZztR+LCrwHFfyqHYb3PPV7BYUOf0I79lDxiRSL2Q:3zfZYKVxiW
TLSH
T14054B6229140212E702BDE3DF7C4EA4AE225C6B3C4125BFEF953651DC7C36AA117778A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
Size 380KB
SHA256 fd9dcbe72da3477714bf68b8987db4718e4be32f313d09bfefbd4d78aa051a84
MD5 64ac5333133e48efc94a0f579e10878f
SHA1 ca547d97d85fa913f48aabcbb23a227c6a2e6bad
SHA512 be9be830f1a3149b238b7363cb6aac08281d244825f4c0ebdd69e31daaf05562555a46484af78de442b7deb3ca71b8a8698331e617b433a0f86cf39e2668576f
SSDEEP 6144:qpK457wXrkaY0TbOXsEYlHBBs6Ve5NtXoqIpgznl87A6v0eX4AiDuViQbgQgILTV:x4B0WtYlmiLlTj8QmIqUrNBqq
TLSH
T1DE846C4B758BBB5A1F35B66340DF3C88D01C6EC09812A5C9FABDD9D09144B9A32D63BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
Size 249KB
SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
MD5 6351ea268f992f52e0f4418a7028b91d
SHA1 5bb3cb88465c550a1fd033a079a8b2eba5e071b8
SHA512 44940d07abfdee6403e9400e596ac5e5eb234ba77a1c90c2fe4086878c12f4805c709eb84538071f21d5710d3569d342e7caea10061e2ab2661c5117c5966297
SSDEEP 3072:p+Xy2rHhkiTtcsuaIwK3zqDLW/ix3Iu7doNFBWgz/bwUzxqcG7gLEOhA:phKHhklsi3zpCdoNFBHz/bwAfG7cW
TLSH
T10A44F8CDB2D1B0A517EB61B4813F610BF27B6499B44E80D0E226E5D4BC7998E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
Size 424KB
SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
MD5 cf29fba214e7f43f2ca1b629109d126b
SHA1 d0dda9486528586af6943abe7a3afa319c790f25
SHA512 2ad7e4711f5917b8d13f861d4fb2688e6ce3951da43a89263a2d9743199e173429398ec1a9537b1df25593d3999dd34fb590e2d2a6e7a632ccc44265d93c3bca
SSDEEP 6144:z8KzCOcC0CXWsJvRekr0dgei/zJbBoCF7az2bzNM:zbzCODTWsJvRbw6zJbBfaz2bC
TLSH
T13694198DB2C1B0A517EB60B4913F610BF23B6469B44E80D4F266E5E57C7898E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
Size 10KB
SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
MD5 0f4634d4af8b73f882440c1181697d86
SHA1 748bb9a14c8a6c64fa060ddcb1b4baebfb3f6fd3
SHA512 eeff081cb256a44ff4557dae145c3d277ad936fef58674cb7d2949b6c302c3a746f05495daa6ccabf39c26bacf13c6fee3bab20de4f1d13810be0503787c89d5
SSDEEP 192:cyxPpQcKb2d4U1nE92Ui6OPl20b3G0qE7I2ByobYGeBv+x9qkgYbeO:zzFZr6OddG0q/yTh3UYx
TLSH
T1AC32C887B30483755A90E790F6C76DA5A93ED0EE73A4168A3CEE421812581DEB3E7CC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
Size 13KB
SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
MD5 dd59d31e84434c59c5c3735bd0b0dc3b
SHA1 c34473850d3749aae725856f68a262a0afebee00
SHA512 f3acd51920f945b49dceb56fd2a5a4ff170c4a5770665bef3d888f8497a288dc33bd15f24780cbe9b8ced585fbacb92a8700d1322a6d4acd2b6e5893370822ac
SSDEEP 192:GwSuCUHXDhEblYfhQ9GYSOqUr9b1AARAU0qWo3wYXVMojXiyaH:dCaXDhEK55YmUrLAgkqWo3RVhpQ
TLSH
T140523295F3C50E22B4991749BA03D57BF19558FAFC2CC18D5CF2D236136C9C986928C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
Size 14KB
SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
MD5 5cee0947c1ef6f00e18eb17cf77388af
SHA1 5a27bc625acfb46d2368a9a376d797ecab912a3a
SHA512 1bf91f08d2a2a446ef0e22df40fd09b090fa300f599bacdd5c698aa61a6fef12ad3d3e38299804a016e5a22a82ddfeb6840cdc7a79ea51244942cb22e659331e
SSDEEP 384:HTO1ksU66rAJGO+NedvSGdv+GfBgLj95LKn:zO1ksU66rAJG5NedKGdv+GfyLj2n
TLSH
T11D6230ACC3CD5C69C86183FA090B35C27836ED49FEA5AE7280EDF4202DA19DFD815674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apm-init.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
Size 57B
SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
MD5 b684f2b8022aaa97ede28f9d224c4db5
SHA1 2087206ddbfd6d6d71f843a132b58ed533d87169
SHA512 8d30da66bfdd99dab88c4b9766b692c39ecbc8dd725e9f858c95993d4f2bf46c37891a1f8f4f1eb6fe09bed7008b8df48d2a9b4f10d7caf20f823f121f6ebb40
TLSH
T19F9002E7F0A1707344616959630722AA35D11130017430010900487434A580FCD22F88
MD5 SHA1 SHA512 TLSH

Submit Download

default_ava.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
Size 906B
SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
MD5 c47a5cfed147c402538358294808e68a
SHA1 8aa499336bc4a50a70710735b67fc5da923fc61a
SHA512 a71831abb9393b6c0ad62feb29fefbb192e1706b08ab88dec0a8e6a9cf61b6a7e106454a7e6e518f69425cc91846036e8fe2956ea939625678f17b330860ba1b
TLSH
T15311E309934DC285960AD7B8563C1754347272DF9E1FD55CE7E633012D3C6AF185C27A
MD5 SHA1 SHA512 TLSH

Submit Download

desk-sync.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
Size 1KB
SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
MD5 c17417f321f52624ee0dc60ed76a31b6
SHA1 b64e19a5b03c92a931fa9a1eba899f491e669a1e
SHA512 bf160829598cf0b22ea48a5f7310adfbd26fbc1bbf23ea3cb8d9cebbeb92b5e81b914bd6021cd41df5984ef00698acb1c1151e134c714e0a1be7dcd439c78485
TLSH
T16D21F0ED57EE35C8644CD37028DA6079627B35F43969EF048914A9D1FE4205D499F9C0
MD5 SHA1 SHA512 TLSH

Submit Download

loading.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
Size 1KB
SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
MD5 0620393a949b58f6af37b0accb79e32c
SHA1 0025e4da5ffb8695a8f9731a05b1b89f1a71bf24
SHA512 0d308c758f825d548874cf8b4b8ec20f3685b39c7232246697dd95e5e5f40da7cd21de7ba5faafd0d8a121b5e6b85c5aadc4232e3f0c943535e062ae449ef29e
TLSH
T1333142D111BD0116E11AC365D7FD7AC70B3EB4DB26E558BCB68C250FAB404DB0A9B219
MD5 SHA1 SHA512 TLSH

Submit Download

error-net-72.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
Size 1KB
SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
MD5 66726a0fbd424ccb700cecb212a47007
SHA1 9795ae26acf0b942ab6a0cd06f206ba69eda18db
SHA512 30ddd2fa17517792a86bdb03827a0809ed362ab2dbd9a7baf194d1f47348c96e0ca8e64515c1a58d7a1740e85f53a3676b49ff6c699d598a27c234c14672604f
TLSH
T1E031C6CD318AC42FCC61D531F4D534156817D760BF928C74102BC5576E0F68E58C6662
MD5 SHA1 SHA512 TLSH

Submit Download

presetLayout_16.pptx

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
Size 41KB
SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
MD5 f41e909b0284949bdd3bea9393a6ff2f
SHA1 a41497f65f44368ad517f464eb0da4403aa700c0
SHA512 d800b9b807a72d19f17bf5bb923d2489328b2f8801c2146b0c67d3d4cd8c70d5f22decd6581ad14d5584f3895140180c8578ede4fa8df755ca742c18cbb3b67b
SSDEEP 768:lwQ75cI1zETv/7H0vFtZKSZTRomseFVEFqG5IphchDB8h/rW7oELmG1wvcG7GyGK:9qNTn81Romse8Fl5ahcVChjQmG1/sl+Q
TLSH
T114139F61D40A142FC263B3F6E478164F73FEE86248179797ACD51096282F97C2E9D38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5CoreKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aecb3\CONTROL\office6\Qt5CoreKso.dll
Size 5.7MB
SHA256 d76ce35aa1a6d2d9ee025bbb2e8743c401039cd4161058dc4f379588057a5b94
MD5 16c3e81f3e45df75d11e28cb07b001c3
SHA1 d4d46eec649ececc72466873d2bb6bbbc4c515c4
SHA512 f7bd1025a66f168f14034726da7bf7369c8c34e53ded56327dbf1ee1a0ef87627910d255487b2ea5ee9e3098a769e367f2e43783b3d7d3aa7223a4300cbda562
SSDEEP 98304:FkAb4j8eO36Z5AKJsv6tWKFdu9C6iPl4rVsca4:Fkg4j8eg6ZZJsv6tWKFdu9C6xVsca4
TLSH
T16C567C47FA964269D8B6C238C9D7C127F673B80247214BDF2258A3496A737F0293F359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5GuiKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aecb3\CONTROL\office6\Qt5GuiKso.dll
Size 6.4MB
SHA256 c3a2de3161f7cc03dccd2c375cb10aeda109069c13689c105ba161f39c2a35d4
MD5 569c0bed6125720be6793d7facabb2f0
SHA1 d3ec78f7c465d00544fa2e21b345afb2d60cbb2d
SHA512 755abb42e1c7f1427c55938a611c8e1f8c73c228ae390b4c7f5d252804f06c46e466de30ce948a75670c8e4b7e605339fd41ca346aa2451ece42993259f006df
SSDEEP 49152:8dwe5wpMO4YOd3vBY5atKJmv+X8YXTJTyCIyCjIzjuwIomuyox3GREHckZFUT6YR:Kwe5W4LhPWfr2uyoZGGdBJ4P
TLSH
T11166F886EA556359C972D17987CB042FE1F37C4283524BC36C45AB490E237EA1B7FE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WidgetsKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aecb3\CONTROL\office6\Qt5WidgetsKso.dll
Size 5.6MB
SHA256 70eeb2b38bd9e4b17d49e62a1a8c5040a0ba309205224d500a89b20480ff4886
MD5 7a9d9082e35636aab6d53fd9cb43b5bc
SHA1 8c4c36e1d0093b51be7b515064b8c2bd78375a7b
SHA512 2e21462bc80d2615556f3e34df721a549d066ec8a93f1445748c2473807d613b397edf091cb99143b8addccb118f8951203c4ecc19cddc26d047cc39ba567324
SSDEEP 49152:cbXPQj9zA+84QMzrV2gPZUIU2wuxPjYqok/revAgxSkSsODt5fVKnsjBKRI0QdBZ:B7ValZRI0QdBbj8PwtxTMnd4X
TLSH
T113466B47F7A50389C56BD23CCACB8613E2B2780447234BCB6959DB681F637E2197E790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aecb3\CONTROL\office6\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aecb3\CONTROL\pl_PL\style.xml
Size 3KB
SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
MD5 034f37e6536c1430d55f64168b7e9f05
SHA1 dd08c0ef0d086dfbe59797990a74dab14fc850e2
SHA512 0e1911c882152a4e1059a3ce1880d7fb2aed1e1e36cbd37055de2e2a1333acb2a0233ba2a4d969ccebbef1e77809aa5e78807aa9239545beae8c548c0f8f35c0
TLSH
T1E381CA80A610BD0AC563F51573AB7509762CB36383ECCFC4F0EE2E698753652644B63E
MD5 SHA1 SHA512 TLSH

Submit Download

product_new.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aecb3\CONTROL\product_new.dat
Size 83KB
SHA256 53a97ea8fd5bde7018db62835a7aaf4ec5689e175224e7cdb18bf070357de113
MD5 b58e647aabdee999ac048482ce15ff98
SHA1 4c8d0c481563b187cf00d1de36ae65ce6b2b7cb5
SHA512 b885fd8be8f72caf0eef8d4439b234035c1e71eefa5b69efe7adba2943de872c0bfce1cf06e06a41e3b8de6f776e07da283f75974171e34e6442176ed79355e0
SSDEEP 1536:I3CcyHhFmk6ebivjsUd1YXpFgnkJWvxh3/hICzQgKBVkeUzEy7n:2GHDW1ITZKkEh5zPKBtc
TLSH
T17E832C18ECE16EAD685052791D376D8227B7DD9160DD30AC4B12AA4CFC3CF887F72A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5aecb3\CONTROL\vi_VN\style.xml
Size 4KB
SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
MD5 394488b30107bcebb84a97ed5d754cee
SHA1 69ebe17f7d577e9bf69c87cff45c3251f0bbc86e
SHA512 24a6bc7debbf7030c1261c69cb4ae7bf3cbb5c7fac315188163c6001e58dfbe2e634925cb767044da7ea0e6d08c709b2ade02f6e43930819e1bef6f7569cad5a
SSDEEP 96:gd6SmSZcFe9gSs8TcySCSi58VS5eQJ/gQkgQ0/Mw8CclQgYzdr/PwiCSeDeR3ciw:gdAh8Ax
TLSH
T13FA17780A610BD0AC563A51977AB7909B62C736383ECCFC4F0EE3E658753692644B63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 10KB
SHA256 444771092c323e3e41e6aa6291a72e148b00d4ac1e10f04c9ec48fd3c99f4d76
MD5 e7cd03253de669c925fe356767dc6bfb
SHA1 78728eae1a743ba2e774f3d43d39cb7df7e815ac
SHA512 7638c58409e1b24237804279d276d8c920d6d9cf5f5b7b40d8b3b01624035009f2356966b84dc9626640336dd76b9ed75021c5cda4559dc39aeb8ef24bbd0b6f
SSDEEP 96:xjHm+UGcAD7bFZHEyKB2DSicfqbOiNbq0/ZEUdl0MMtoKEpS5v+r5YSYRV6blfM:xkdB1q6Sr4shM
TLSH
T19922A077506F015C077E0B3923A28E482AFA7EC9775165983F37EE978ECF410819E5A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 af0fac11146a39e134267719e70279db279eef53bdf8e4369ac5b359fae122ef
MD5 b4fc17151249d8dd1038ff08910b64f1
SHA1 b32636a6fa5b18332757c4fbf2d0d78db49095aa
SHA512 d08f8736e31919a266f9a460c5db8e0bc39a6a93fd571ccdc84942671e17c1538a5bf3c213810be4b5b28dddc148ad3a7d29cdff13e03c1f2350391f889d7a91
SSDEEP 12288:G07NqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:/NN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1024523253F8ED56AF5B615B058E8C1386D0FBF658F0191CFA7824AAE89349C1DEF101E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 eb5b45b1f87ae8032250329dde1ffa14968e4eab013c50f05238530c8a5cd8a1
MD5 cd61806885bdd24cbb5403060c296d9e
SHA1 fc0e69a8453f9fd5226d4219f276f06837d9c815
SHA512 cb0b02971ce2aaffc8a6a9276970b71f08f77b899e339e95f3b69da1d7bbfc34086b8e4fa152f0f987333f3315d3040f36088e50b5b14745ad27cd4d6e62a169
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bY/N94AMdTEvcQFuOjOP95Xdt5c:dgb4mBIBhGFQ95MdTAcQQfjP+
TLSH
T1CB659E1E22EC02F5E0FAD2B89DAA4417D6B278160731D2DF1251426D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 92ea721c3261ab545a878ede9810559de4d3333c7df3a3f59619be50bd13cf34
MD5 4ce112edf48f41331e740e9c2d060348
SHA1 4e6eabc85625b43e7021311f3a68407deae6e02a
SHA512 e3e64195ed0cd4e9b7727a3a60dcdd99b68bbce1ee33bfc70747bfa64f51e5d4315c37efdef4309307b39d841612f789c2934a04d1b15d6493421cc811008259
SSDEEP 24576:VG88u8FpJqH1bzria7/mQN94AMdTEvcQFuOjOP95Xdt5c:Y7ZFPqVea7/t95MdTAcQQfjP+
TLSH
T1F585016577E501F1D47BD13889864663FAB2B8210360EBDF07A88B551F23BE14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 ec9eeb553872c3c1301d3df08c1e0936998ad35d124910b9c0909887a1476987
MD5 a5f9d370b5eb64e43cc631fc736e1739
SHA1 636317451093a30da1b92339651b9465f7b5f683
SHA512 c9db5b884f6928bdfbeb32509a00b6adf9afd177da9607700fa229f8a20e9c8cd29653e14c0448942d648d698fef6502dd13807c875091d3f3f54a0118163ccc
SSDEEP 24576:vPUr+NQsN94AMdTEvcQFuOjOP95Xdt5c:vJQU95MdTAcQQfjP+
TLSH
T15C65E12F36DD18E5F676A17C89868219F772B8620712D2CF02E1817E4F27ED4BD39624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a4398ba08b78abd3723cf71f24c585d7d509220f88800180c3a249a6ab0dffd8
MD5 fc7e6c3fc2dd7da72b5fb759d9ad83ec
SHA1 22b22baf1a6be1216110536a5d79e51020304413
SHA512 033704b20708ee44de7a79d2769eb0ab088fbc4eb99128da5f6f2de98ac43dab42b844d19a17050fb99699afe4f71e8f2a203adebb9d544386742378714cdb3a
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjk95MdTAcQQfjP+:8G05lO43bH0xTQWj
TLSH
T1D1D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c303c1770246d2720fe33b4ee16eb2e9ce2dc4002263e06b11f697c9c962d726
MD5 fdb6ad9b0fb9e8657ba33ee039dc0bc9
SHA1 bbe847228a442f68a1dcb54485baf1b89810a716
SHA512 e33645c4e2935c22c30f3950d15cecd331e0094f7abd08f79fded26bd633c13773c96ccbf8724991279c294e963815fabc3f5b2e44154fde20fdc5c96dabed3d
SSDEEP 24576:rfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn+N94AMdTEvcQFuOjOP95Xdt5c:za5POZ3+Jt2pasx2+mM95MdTAcQQfjP+
TLSH
T10D65AF5EA6EC01D5D5B9D17DC583861AF5B1342253329BCF022182BE3F27EE89E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cb940a9c4334fe44f34dee7f8af24f4805e320d703f131794bd306c6c5bc9948
MD5 77c46e782d6e68c53bb02a72313d1e16
SHA1 ef24dc15ef781c6fa9ad3503a7769ee965a018f8
SHA512 aaa82a1b157115a3e3cc2617379e5737d5ebd2bdbad0ec97b10f37ca5c3c246ba3abf0004794e2280ea16d39d9128f24beb74db9af4701c6c681b52d1d071244
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FkoN94AMdTEvcQFuOjOP95Xdt5c:ENc/zEOVHFN95MdTAcQQfjP+
TLSH
T1DA857B2623E901E4F1BBE1BE89779546FA71786517308ACF0291851F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 dd654de36f16651a14b658f5ab8381a52bc0cfb09ac3e3139ac9b2b56224e3ef
MD5 c0398a148e5ce2f8cc83da16ccc16170
SHA1 cd95222cdc6455d379a1a092ca0198116400c31d
SHA512 b05642cb2a9fac6cc8f425c20c4ed89fea3d26dd3dbc7c635cb05e859f76e03afce76b332adc9c5b791ab4d858a4b97ecb53ce0ee7af662022ee990ee1967ebf
SSDEEP 24576:98kNvNnaFeYhJNtmZBmyN94AMdTEvcQFuOjOP95Xdt5c:98MwBtOmC95MdTAcQQfjP+
TLSH
T13955AF6E7AA846E4D1FAC6B4CD238512EA727861073293CF5390C13F4E279D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 94811f3ceb0cfcde1042399c7e2f73a05b12208bb548a4c5ebe5d7f7310d672c
MD5 42a5676b0e86e299eeeee8ed6532ee7e
SHA1 74c4b1dfe2eec8b6f8580248f0410159ea7cfd42
SHA512 c167f8e8f3e6cbd889474e0cbac6b0f95b5c61cebb3ae6884060d521409547d146d5f7ca75dbbe5ae8c1114f3941526cc4252aa18f0a5f23077443bc29f4d862
SSDEEP 24576:gD3FHshBIYQgARN94AMdTEvcQFuOjOP95Xdt5c:gDVHeBIAA395MdTAcQQfjP+
TLSH
T19A75E17DEB9C00E4E57BD1BCCA638506E77138A9072256CB02D481BA5F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/424-136-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/424-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/424-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/424-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/912-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/912-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/912-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/912-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1372-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1372-51-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/1372-47-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/1372-40-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1372-41-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/1780-262-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1780-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1780-96-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1780-102-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1780-264-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2148-131-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2148-120-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2148-126-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2148-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2148-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2572-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2572-89-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2572-83-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2572-298-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2572-315-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2572-317-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2872-55-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2872-62-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2872-261-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2872-56-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3208-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3208-283-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3920-68-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3920-275-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3920-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3920-74-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4828-6-0x0000000000E40000-0x0000000000EA7000-memory.dmp

Download

memory/4828-78-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4828-7-0x0000000000E40000-0x0000000000EA7000-memory.dmp

Download

memory/4828-5-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4828-0-0x0000000000E40000-0x0000000000EA7000-memory.dmp

Download

memory/4944-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4944-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4944-23-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4944-16-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4944-22-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5184-3449-0x000002021B960000-0x000002021C085000-memory.dmp

Download

memory/5184-324-0x000002021B960000-0x000002021C085000-memory.dmp

Download

memory/5408-325-0x00000236DA0F0000-0x00000236DA815000-memory.dmp

Download

memory/5408-3478-0x00000236DA0F0000-0x00000236DA815000-memory.dmp

Download

memory/5524-313-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5524-107-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5524-109-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5524-115-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5832-877-0x00000256BB950000-0x00000256BBEDE000-memory.dmp

Download

memory/5832-3307-0x00000256BB950000-0x00000256BBEDE000-memory.dmp

Download