b4afbedee4681d64b689368511cc71a048063d3e0e361b8286d62c693e4d639b

Analysis

max time kernel
104s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Size 5.7MB
Sample260815-rm688ayvht
SHA256 b4afbedee4681d64b689368511cc71a048063d3e0e361b8286d62c693e4d639b
MD5 52e154257e5f9f7d8ca674e3c537655e
SHA1 bfdcd04a1811e02ac5c20e43dceeec97d79c1a71
SHA512 630a6cadbb9bc5db4af9835fe59cf6ea4cbfbd2a6f9f8aa9ca818ddf43906ac708edea14e52f07e6388dc15329e5b3f7b2481e30b889e254466a022889b28710
SSDEEP 98304:ftSuMOINjO91x364DT+Tx4NVMFb/55PU/yOe0xTQWj:8MJtM9/5RwC0RQk
TLSH
T1F656C001BB85C5F1E5D201B0597AAB7A983DBE28573088C7A7D11D2A88312D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
1628	elevation_service.exe
3140	elevation_service.exe
4448	maintenanceservice.exe
1796	OSE.EXE
1864	PerceptionSimulationService.exe
5404	perfhost.exe
3428	ReFsDedupSvc.exe
5624	SensorDataService.exe
6020	ssh-agent.exe
2960	AgentService.exe
5656	SearchIndexer.exe
3224	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
204	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	\??\PhysicalDrive0	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8ffae5e238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034fb102ec12cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1e8732dc12cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000006629ae2fc12cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1bb6f2cc12cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000027aba2dc12cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e716e2fc12cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b686ae2dc12cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 40 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedDevices	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\OemEsim	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\FlightRoot	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TestSignRoot	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3224	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
3224	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
3224	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
3224	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
3224	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
3224	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
3224	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
3224	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
204	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
204	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
204	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
204	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeAssignPrimaryTokenPrivilege	2960	AgentService.exe
Token: SeBackupPrivilege	3428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3428	ReFsDedupSvc.exe
Token: 33	5656	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5656	SearchIndexer.exe
Token: SeDebugPrivilege	3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5656 wrote to memory of 2524	5656	SearchIndexer.exe	100
PID 5656 wrote to memory of 5876	5656	SearchIndexer.exe	101
PID 5656 wrote to memory of 2328	5656	SearchIndexer.exe	102
PID 5656 wrote to memory of 4888	5656	SearchIndexer.exe	103
PID 3944 wrote to memory of 3224	3944	2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_52e154257e5f9f7d8ca674e3c537655e_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944
- C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
  "C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe" -checkInstallEnvironment
    3⤵
    PID:3732

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3140

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4448

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1796

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1864

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5404

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3428

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5624

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6020

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5656
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2524
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2328
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1624 1616 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4888

C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
"C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5B1133 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5b0b37\
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a7324f377ad82fffa60365239a23fe2f36f0ac9dea14b37d6a618cd718383a96
MD5 79dd7193046ddcf7439254d550e8287f
SHA1 9e3ceb921df2963c9f9538db72665f109686cb6e
SHA512 5d3017b752b2a2c76eaafb3b696e0d07f542ad0925d0f1eba22eef78da3c1d5c00c4eb82b57d2973a19ab800c7ead5bcda5b48648a4c5edd690fd09a8a791895
SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnw95MdTAcQQfjP+:K3q6HjBh0xTQWj
TLSH
T129D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 b32f6bf994a817814fc4a9398a1b90b4f718301d43ccf0f0c5e5747564fc4950
MD5 9a1702afb0bf1ceaaf385877e8055c7c
SHA1 e0a4ccd585054aab9e673f92be1563026ebe564d
SHA512 73f44585a9422f41919d8ed3c18eb75da9ccb2b3d10939cf2ba397c03fb71762a5334636174aa5323b85c6a71426a217b8e4d2280d1c422b2b9d2bf0ec2261b8
SSDEEP 24576:AXYfDtczAHN94AMdTEvcQFuOjOP95Xdt5c:3tca95MdTAcQQfjP+
TLSH
T13265F12877D908F9ED678278CCA18115EA33BC514760E78B03E48A6A1F337D49E7EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e91dc430825d69a5b070a7114a2db12147eb3cd059fd29656e11043cb41e8d94
MD5 581240d4bc3ab67c707e4a8a6566cb4a
SHA1 65a7d622cb04fe03adc410f97869ab3e3140c83a
SHA512 0600b9434d7a5f457cb199545cbb33bd91337656eb8cd59afb9451fd94a794e9c37be2799f2a624eb28fd2410a5b31108755053db3d39e4c61e8d46bdfa4b9fb
SSDEEP 24576:50Le5ji0hmxirMoN94AMdTEvcQFuOjOP95Xdt5c:5Pji0Acz95MdTAcQQfjP+
TLSH
T175859E15F6788335D073C0B9C5D2A69EED7230825B308ACB4286D77C6E67AE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a570804c1514ac5f68c98f7fa457249fa29b9b0c3c15088dd312e652d9a185d7
MD5 489336abc3e236bd37e1cf29d36559a2
SHA1 1c35029c92d8cb98eca1c07888b97656b9d9b0d5
SHA512 2b58cb477740cdbbc283ee841a1728ccb774db3d4e14174231253d3cd47a1890b00f291ebfdeb8dd1f00392fab2a572a075655752083c1e1164088d5b44225a5
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWE6q8wyuKN94AMdTEvcQFuOjOP95Xdt5c:C/ezSC6vUzPvxHjy/95MdTAcQQfjP+
TLSH
T1C3755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 caa4fb2e6ddd84c7619109800b2b21f098394ff481ce634f9f9fc6b6068bfdbd
MD5 fe810f2e74aa2ca2d6347d9f78b8a702
SHA1 1c200864fdcae9a779e5c2e78c2c6af3063e2459
SHA512 1aba7a62c3f7d531ea7711ebbc915c10da664e4ada04e3d2dbb8fec12f4c82831406e0cd28e3c5342db32bc2f8b025b3cc60bbd132334b291d2dccd9ef42ccf8
SSDEEP 24576:6VbqPb88hv/l+6TN94AMdTEvcQFuOjOP95Xdt5c:6VO88hXl+k95MdTAcQQfjP+
TLSH
T12F559E66F6748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c707731d7ccf97b07b412b0697b6265554bac58732acda303fc27af7e5546689
MD5 0cfc32e5b7d2ae03929995bff9b38cf3
SHA1 ae7cc2031954b254ec492a602568cf6850544a87
SHA512 738d8eebb1131b3d5f771bd2acfbada2022791ba26dc7ed156c831330d44891c3bff644151f38c64dd8028fd5aeab25523a117a7afee04a0369ff11f35160be9
SSDEEP 12288:SR0qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:SR0N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1DC4523653F8DD0BAF3D719B05CF880686D0B5F518E41964F53E25FAE89389C2D6E102E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 c3b76c3f8797a7aa5b770838fcffa3f5cba236e0dca55cd4e6df1bf6e7eec5a3
MD5 e8e730854f6166edc9fde1d74c2c7640
SHA1 364d6b1331a23a16ae29d7c1b9c44167105fbd63
SHA512 2fcee354bc6aead368c71a47273bd6b5a2940943ef106af9e1e9f88f0b69cbbdca5f0fc9c73eadb97965e4b3cede0b063a7c3f438c0c32d356b48e42babf6b69
SSDEEP 12288:ZeBNUbTVO86U7qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:ZJIU7N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1BC65CF3BAE28FCE2C27A5DB85A91C240E77278704F52A3CBD165830EDE235E15E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cb935614d2ac8c6851ec7571004fd76a1e4f045327b4935778d11e0174319eec
MD5 636f815e7263fbd0bd925dcf4c40a204
SHA1 ee607621853b5eaeb26dc5a67ecd4ee283c22f4a
SHA512 f7379b58de645edd10d9d865137ac0ddfed85c0e2b2b381dba30869830ecc67b0952324d6b80321a1edde776585e966ef8f48cbbff3bf7cacbaa9d84aeb91023
SSDEEP 49152:fQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THz:fQvGAdlCEL8c/yRNw5C60xTQWj
TLSH
T193266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 8250b0e9ec4158d4fcc192477ffc1c3019a99ebe220f1a86c9fa7ec9d67e55ff
MD5 b806449fab204e4748732198c776d7ac
SHA1 29f1f26824e4c698d2ef3a63bfa2991d7983d1c7
SHA512 3fcde33e01e8fb213372053915b9cc44d69a9f48172371812fcf0c0b1438c3d3addfde26035cc85d32e88f8e91b159710d23c75c3c33591536716b656697332c
SSDEEP 24576:OdewsAjlN94AMdTEvcQFuOjOP95Xdt5c:mljD95MdTAcQQfjP+
TLSH
T13575E031FE75E036C2BB0DB21B75C716182D7A204F511AC3E3E84E9E59342D267B6A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 49037a0f4ee51e66961a13fdb8433ef46030d1c69a44749cdc9e69730a98fe14
MD5 26f952076b2fa14101ab19789ac87b6f
SHA1 4e35ef3807504aa203cfdbf788d567ba688cb8ac
SHA512 7bb52d241d839074411d2cfcf39e5fad4350b4fa3fe9aba991dbe309f1229fdc323454f19ce0bc3c1088bea4c871bd6f530f1dfc1461ed145738078c6955ee85
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHr0RQk:fUEtQevvqc2W1cpV2EI32r0d
TLSH
T132474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1622e6b4f589a27ea92f993fb4d0e3adb1e117a199f45d318108ec7bcd943280
MD5 cad5bfda81932dc0de1d8ac7b22543d7
SHA1 978d05e15f6210c4614f3b472c5697fc508bf016
SHA512 280f5be9c18dcdefb25e2a6375fa9f71705def1aa9024115714974b9609a22b81884cb46eaf451176b48757305fe32844ed40523dd808cc3a523c24caa1d3a23
SSDEEP 49152:vCbRquA/m2yL5zTfFiV+XenmE3/zj95MdTAcQQfjP+:ooquVjnmW0xTQWj
TLSH
T1A8D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 32c23d3205933355711bc76e8ae50b7208b88f67bf19c49dce7365b48504d787
MD5 759325e6634b1dae39a44b6963bf5b58
SHA1 e27558752e96354512cb5f4e6aae549d1469074d
SHA512 3eee71e2696bbe5c963f77368da78dcca237322271d62175b33f3fd586e617faf814c718f61841b25a2ee2c8680161103c14225a7274de8999349faab3c17c1e
SSDEEP 24576:YAhGLJIFoiwtA5l7S53eN94AMdTEvcQFuOjOP95Xdt5c:YAMyFoiq5m95MdTAcQQfjP+
TLSH
T1A8359D81EBF955D4F5B3AAB899B68171EA76BCA65E31C20F2250D11F0E33E409D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5694fe713b2c0cfedcc596b0846773e016b98201f3b8e1b3d8ac313144005f37
MD5 e1b74af08aa34600339bf93399e07f4e
SHA1 f013ccaff936fddcb190088fa7bb00811313eb0a
SHA512 16ebc7abe4d41d740ccf83f78f5050ea99c6d82fb07a22b7b007d375693e2d7b1fb8730e88eee4cdb7b8e79b5ce55a790cc6a283c55c85be5e2be0d749711856
SSDEEP 12288:Kmw5HEjsChNVBFgl0WDm+CqqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJs:DwuoOWpN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T10865F14937991CF9E9A782388597C136FBB2BC022A21D71F17A0C65F5F37361AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 104c88ad9a236bbf14bb12e411f2b6f82802b51423ffc75cf0d392cda9987f07
MD5 e6f6a4bd129c884000ff2bd601322035
SHA1 85d61079400ccb24dcdebe458531a77932dd0daf
SHA512 ec30f5dea163b60cc4299b228bebf9251546e8e4023e2249e1dda8c209d9f658fdd8d6ca61c41c49cc5e6fbf5900944b6bcfe598415124a20cc0f986b0e5b9de
SSDEEP 12288:lBZ1IyVqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:TZuwN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1315512593BD860FAE1A35274CCF48205EB727D525B3243CF13614AAE5F32AC29E75322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7bd0409c736b237b1401f08956902c2b628743eaaf7ee01461c88c9bca926426
MD5 5f99884798c77c62afe9f29e2341cc3a
SHA1 2a7215f84bb7514cc738b66640d729e81bd6eead
SHA512 6874b5520288851bbe316c7421e2d8ed2dbbe23bb8b79596648e570d548203e5562d896ede3183ba14418795fd95d818d3715259aaefbd2596aeb4e08e2cd344
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:mQRQyi36YOcPQLvw2gAf+PN3F0xTQWj
TLSH
T1D1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 64611734486daeca56f4ea78df26d530bb8a73cebe3b1dc1eed1902474bdbebd
MD5 f32f6f22a84a6dc2e2e1ed721dea12ec
SHA1 31461233fa8f01c366b670b1e0606b95b232eb9f
SHA512 6c23b50b85eee340cf532ef354165a6604c0f8ce7f6c8624c03ccb710a45936e279e54ab215cc69b28f35540fc19c1fc1ddfd01434be9c2bfb0ce5b0af5bb724
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:qQRQyi36YOcPQLvw2gAf+PN3F0xTQWj
TLSH
T10E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 915e5901da7deda3cec152a43e21eb9e1cf35bbf7630e58274544e4f68e02752
MD5 60528db82f43484a4122d87fe5f8a96d
SHA1 0d7e6bfadca7ba8216a5300408e6a55a6d6a5322
SHA512 f9b42b327b55b8f57e6c2b4b6d80af2ac7c2be61944058a6a35fc8daa8ef9bb181299cabfa0b8cd23e0296e3c215e72175e1a60a9187c8bf121bbe20a53d1eff
SSDEEP 49152:l68Qg55nhheWu7PNU3/z95MdTAcQQfjP+:zthWRc/z0xTQWj
TLSH
T104B55A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 56f29c3e78a5fc8fc48d11da29b2d12919b876498ddeebca178803e74201b818
MD5 a5e16420b1d5c390fbbe59faee829c3f
SHA1 7d9a5666a385ab0819f9f0b87dea50bb3d6bde57
SHA512 37bcd197b3c197aa8e0329749511a460fd67237bd4fc80cc3b76ef4b3dfe6eb5537799fdcec05a7676f1decef27455294b21841cfadb0f361bafc7cbe36c9005
SSDEEP 49152:u3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99l:Py5112gYy5azzVvL69nLKnhZM0xTQWj
TLSH
T16A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8a4869e9001ac6b4b7f93672ce9846ec76d5116700c853c97ee6914cfb217a07
MD5 20abb9b6016c334e2136a83d8f5dede3
SHA1 6f4a8679bd4ec5cc4a3ac6726106bc1a3bd30111
SHA512 ee97de9d61d54e627bb17b3cf5cc9f48b0b79106698f5e9e31db0ae88aef6e54dc86401ee981d45b1d0f4aa528c4c2a9f0e2eab6432e08f6444dfd3d45363553
SSDEEP 49152:MqB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gld95MdTAcQQfjP+:Nu6JmVxd2dd0xTQWj
TLSH
T191D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 db45783a79c9febca19b89e6c976c05c142c72b0647bda9b6a40b28d09e41130
MD5 4126ca1e31d2c7af3b73b02ea841dd43
SHA1 51f6198ff227d10493d2e0f82a6cb29c8f472c6d
SHA512 e2061134f421f57d1a0a7f5fe0bcc900068f5bf9e599e7fd227dbadbfbd1bb187fc474992729fb1bafd94d327521137a081b3ea2d6349aaf54f27b5c8c49246b
SSDEEP 49152:m1hpsNoJpF1A6UU44CwH7R4xJ95MdTAcQQfjP+:mmifPbRW0xTQWj
TLSH
T10BB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6355429905eb31643f2b77deaf674e7dc9574de94d55a2aa4b98667a54af84c8
MD5 5194315e8e78d32368b63e93c29ddc47
SHA1 3dedf6a8fe8074209e260ce24dd004a98e3542c3
SHA512 7900d6cc579e01c00dc573de869fcec6c9dbbb61619c6d46dcf5e6aef8cf59f5eeb374af23324894b90adab04f9b49124714ae08bf4bcf7d277cd3ed7752346e
SSDEEP 49152:uSuZQIY0Be2KRRVtOnks6NMHqA95MdTAcQQfjP+:g5dKTi61A0xTQWj
TLSH
T1C9C5BF13F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e4d67480f64a4ba3466cb8e1adf4194e5e7a7ba5aadb0deaff15a6984b47fcd4
MD5 f99f334431e7ee69a42bcd47e27808e1
SHA1 f5548be619acedf137e2d18e37061af0163f5c45
SHA512 b4f50f60fd0ba59fc2a5a3a5a3894893e4834b1d02b6ffe94f294b5211c6984647574416d3b133741d0d3cae96948cb784003950e2a94baf19e9408f25464e9e
SSDEEP 49152:6htSn8EApI0figngiDn0AP5wt95MdTAcQQfjP+:7X2iyphC0xTQWj
TLSH
T15B95BE13F2D900E8D05ED174C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4c6c4f5d731aff3a34012a93ea5813aefcf901a8eb75d9efd7ed3edae64390c7
MD5 8d1f771a3ec3ac134e36f49324b7c859
SHA1 186cf9e9a2849c452f001f70c8aa7d63dd7772df
SHA512 3a217e9c0269e06fe9db881161e74fe6fbda579f1a0e7e8e1ee8c5c51655bea8ec71197534360c9c7bf16ce74fcf2ace429fd55bc9cb7b79591280109b7f8459
SSDEEP 12288:tcqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:tcN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1424523643F8EC1BFF18615B08CF88168AC0E5F56DF42528F63974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 603005c56c613ae6755b6be609b86e38e96cd68a58973781f60b57405a1f1ece
MD5 c7324a2a1fa201e938578e664714f0f2
SHA1 f2ea9de2746fc7fbed2e9c1627e7987e2a2e35c7
SHA512 28b41e7e6e337973896bfbc2d4aec2a802c97a1a00c7bec4a52d05068b45a6cb2cb4cf913dc1cf95e01f8448bc4bacb02a0629337fc788e31d3ec7d0ab646cfe
SSDEEP 12288:CBqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:CBN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1C24523643F8EC1BFF18615B08CE88168AC0E5F57DF02528F63974E6E8A349D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8c71de496ffa41b31af7eb10d361dfd3516dfdb7021c85866e32b686f312b6bc
MD5 99f3bb2bc25b387a7169104dcc595843
SHA1 6c94b59e3dccc87ea886cd9638abc60d259bfb5d
SHA512 41be207dffa0b921d80306e54774b3fc09dc131700758d6c5b95d4e154dfea8c25e707246bfa850387d0950b74dae2ff29e235086f1fdbf1503caf1fb75bfadf
SSDEEP 12288:zjqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:zjN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1624523643F8EC1BFF18615B08CE88168AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 3785d5f4333a590ac7ad655073d86a81ad33fdd635d433db495b2099099c235a
MD5 547462f26a268bfc4f88755370405407
SHA1 aaefda8c599274a0dce6df3a84d5b1280eef8d27
SHA512 2934473f7aca9da2f8486e8c91ebfe27aed5fc99542d771a9dc022e913c392fe1dba63116a36fd3075efb70938292c0aeef51bc47760848de918a56e76328626
SSDEEP 12288:gV+qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:LN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1BE4523553F8E80EAF4A396B0C8F48164ED6ABF929F12938F57510E6E4E317C1D9F0069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 dc84e5d47cb878f0b7633f3ce0a4100af1b027171c57dc938b20cfc0c2482d31
MD5 44298c6a48c66dafa977d84c060f4f43
SHA1 1129b3edaed2be76e43e9b4355c51c918aa8f53b
SHA512 9d6f11698f009ea8518ca75e79b714d91df91125a511d6e53ce80aa1871e6fc58cfef51e59090436f72e3df5efde4416e6de561824a888e672e2af927dec9caa
SSDEEP 12288:SWqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:SWN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1F94523643F8EC1BFF18615B08CE88168AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9d55cc0a55fead02903a46b953dc6048b69c59b1876867afd56c78f39c651ec4
MD5 2f331eb1b36d1616e443f0f277a8a704
SHA1 9021a7c16bc68b4a717d6c310d0b777b2c98f31b
SHA512 84536007d6f0b09c0b3f2bd981ef4ab25cccc82f33f5f78758871a6e6b8f77cc27c1815ee600553472feaf9520438fa96fcec5a75ceadf155b5f1d0803927b22
SSDEEP 12288:BtqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:BtN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1764523643F8EC1BFF18615B08CE88168AC0E5F57DF42528F63974E6E8A349D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 49db9ff4bbc485328339e7a71a4c64f9ba10e8c1fbbc859028a8ed24c73ac21b
MD5 225af285543cb4ccaa32602f0ec5106c
SHA1 143757b533c9be88069c17a6cf4eb5efcab8cfeb
SHA512 d4ffac15e933f2230289aa40a8f109cd97f22d5e0e33642ae866f95668f45f0bb786d25a6cb9c0ccb7714bfabd8e75c7a10ab6a6205c826554f59726695b54da
SSDEEP 12288:q5qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:q5N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1094523643F8EC1BFF18605B08CE88168AC0E5F57DF42528F67974E6E8A349D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 379d4e8669cd0fdbfd70db49ff229bed57144fb6eb468e07a9cd68913f2ab205
MD5 0cb9339b94f8ef60770c61e72d9031de
SHA1 140d44c89adaac2b147776aad7aad7ad616abbbb
SHA512 3861f9e14f2cf7dea972a3c4c9b31522bcc46cb7416d465475ae86f5cc48b2f6e1ef4a78a8f6687543b4680d60e0bf6d95f5b9fcb3ff4d93b32c3f0d30cf1add
SSDEEP 24576:KZMSzFVSOhN94AMdTEvcQFuOjOP95Xdt5c:KZMSzfL95MdTAcQQfjP+
TLSH
T1BF650294779418F8ECA3813ACC658915D6B27C5A0B60C60F03E4366B5F333E15D7EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8d3e173c414dab4bf8e1ea3fbe62938dee4f9ae9628531df1f6ac656e2d3453d
MD5 bde1684780ab3e1ab6e18bcc63d20279
SHA1 91f9ece11e97ea53fde23481b957c26a67d6950b
SHA512 8392c7721530d81f0b6da82507e389eb710e0339a8819dedc328b235f6887eae0f8fd4685ac81e0faf61846bce3e2df3bdf32a8ec769a2c9026ac6404c049872
SSDEEP 12288:1gqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:1gN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1A44523643F8EC1BFF18615B08CE88168AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0f5541bbd57d5984d4622615b4cf72554ec4227ff79629f6a1910b7579e3d806
MD5 272e7232fb2cd7c162a550c28769fb75
SHA1 02874c9b1f6950ab8a45d16484cadb84a657bd16
SHA512 c8446d79a5b08e12522cec82fc115e1444da8979079e7e6143fc6666fe34c7f82db85584e9109fe96fa873282f41edaa5041fa17d47afd19ebd3741e86c23f04
SSDEEP 12288:KkqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:KkN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1904523653F8EC1BFF18615B08CE88168AC0E5F57DF02528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 d43f41cbeffb5aa94b08c3f8290acd3b7f50f3eb9d6ceab4b1c1ad478c617f2b
MD5 fa848a4946fa7b04b752142ea0220cb2
SHA1 a3f710e09a8f4d6086b7ba510a6b262544e16691
SHA512 4dd3e963aab2add61631b71ae506a23fb76e299018d13f7505b8caec70243f71cf92b5f8f3c211e74a7519338b41f3ddf2ca922576cf1c9c800192c0d4677580
SSDEEP 12288:IyPz5L8VqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:JzyVN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T10C550217379930FDE1679234C8A14615FB76BD324B208A9F13A00B7A1F376D19EBA760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3993fe083abb7e49755f36e0c3d697253fc2e3371abbd712c6a772b18f60980d
MD5 22af334656a586772674aee6cc1b696e
SHA1 8300556828768c00ef7336d232b1d2dc27f2152b
SHA512 ac5a45b24d09fcb955d005e34cf9d39422cf966503014c91aa304f5c75e4c98e64dc66b3dde213427b8ca48527ed70d4153b91867eb08cae9a8af49f17264f13
SSDEEP 12288:SgqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:SgN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T19E4523653F8EC1BFF18605B08CE88168AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c040e732e97961d7a39b1e4220b758ad64ebd614a424ad29b6523320318e1dad
MD5 5848b7fcd8419b3f8992f33dbb81390c
SHA1 9fbaef5552dbaf8fe93d40b5909ad65fe1d510e6
SHA512 9ddff7640b98cc1ec32398a7829399001625a84bd0e8df4d0e0d2f747580a706b9cfdd464124de12b5cf978b2573d175f791595652d5ee1128235bcec6e1d888
SSDEEP 12288:rgqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:rgN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1D84523643F8EC1BFF18615B08CE88168AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 0295c4dce30728dfb78b9eaa347694fedaf06e6782ebf62c1d0986cd9c6b43ca
MD5 58c76cfd30e798e91b73954a81def2b4
SHA1 e24e53148fe95edb66d7071801af737bcab96993
SHA512 bb1a4e34ca93038c78ac0134baff4e2db13e892d18dea03c5145184b4e66fbe37a08bb933b26ad3830c4023e3ee6093340e08fe97304287f6f1b1eb7bbfc8228
SSDEEP 12288:FyPz5L8VqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:MzyVN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1A0550217379930FDE1679234C8A14615FB76BD324B208A9F13A00B7A1F376D19EBA760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 3ba53da9996e350f3f0053f9ac254fda4e026d82097ecd87cfcbacd847298359
MD5 60aec05f5aaecd46abc91725ce8c35a0
SHA1 997369c35c47bbe9957cf966f4fca88cc3721678
SHA512 51865c5a99fae08dde46c0d18dbd589888cc2861f48dc784ff7aa2544ee61b125da44692937d208bc75d2e51c5f82b6dd815100e4c80ac966b422c71f905917b
SSDEEP 24576:3THaLl3z0zDzN94AMdTEvcQFuOjOP95Xdt5c:3T6Lljq95MdTAcQQfjP+
TLSH
T11B6502A4739418F8ECA7813ACC658516D6B27C5A0B60C60F03F4366B5F333A15D7DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 2da23b960cbbfac369eac0f2d720bf72157eb94b50b6fcf2054db0f02d9f42df
MD5 fe1ca458aa89f2ac98f3a2fec25b058f
SHA1 744f1f14f065e300ed5fc18bee50d80e49cd19ec
SHA512 68512c6d136bece0a35c475163b3ecac33f592ba49eb0950334d84fda7aac1b1ba85155dc6536b4b8eccfc5ad8c2105cb6a284697cc82db3f60d6f8d70d1dc4b
SSDEEP 24576:837d9CHKy7GZPN94AMdTEvcQFuOjOP95Xdt5c:m7d9CHKyaL95MdTAcQQfjP+
TLSH
T1A275CF90F7E810E8F0B79A35CD768511DA767C5A5B21DA8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6dd77a643147ca41b02410df8c3c26f8369cf2f11625dad834a6843b884469b5
MD5 d3d0f1ffdf5e0c962d6f9e30e41bf344
SHA1 e814984222abe546c90ba3788db60a88432ba960
SHA512 212545c82ec32ee6bb10e9c333e06883028a70ca4f2726ab1a6bc04b6f94f50b0ee586f8f9dbc8f86a86aeb18e349cb485f5cea2fbd0a864dd625edac334fca8
SSDEEP 12288:fDqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:fDN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1BD4523643F8EC1BFF18615B08CE88168AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 41bf772f763115d7ef716cb60bb86993414ff7809749a7e860a58122f2483be1
MD5 681f5facab1d59938ac6b42524d7d726
SHA1 b6df91dea35cf97c87a5463d8ca06932d6f8c1a6
SHA512 3bbaba08abb1a25b3e8cdb85f7524bf4088ddeed27a3f1c6798e3a445995f1284b3a8b58f850b2c94e88fabd84df1302a6242ab7242de8c64be46ee2661b96da
SSDEEP 12288:B1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:B1N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1714523643F8E81BFF19615B08CF88168AC0E5F56DF02528F67D74E6E8A389C2D5E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 be2210468c7a276b4cdfd654a6c7a69c4c974f9883f065d5f52fa7efbc4b56d3
MD5 203a0f6d0bac90e368fee43b24376c06
SHA1 12c278e7aabf40e47ad6ef0a43d491fdec45f4c2
SHA512 4daac8ad808e0f89e9a76cf4c5c86cc0d6c96c2d61d7ff1ebb70afa5c88bcf157f71a468e54de4a3da2ea9f70ae4a01f4072703145b20e76f8a1dd1fc1f74f7b
SSDEEP 12288:3iqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:3iN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1DA4523643F8EC1BFF18615B08CE88168AC0E5F47DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 53bcc446378a32bc32035b15c1d7a6c6cb218ab5d754659d6bcc35e2c18a65f4
MD5 76d2bbfb088175af1d3fec5637a08c90
SHA1 56fa64159e981af041bb6abb62ba6719911811d7
SHA512 84f6958708516390b88259080303d5513487fdc13c7211167bbd1c02af9879d4f7f95065e7b2ce3d5daeef4f678841e2a5d34345e926c67e7ce456397b312140
SSDEEP 12288:BgqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:BgN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1D94523643F8EC1BFF18615B08CE88168AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 10a6d62e0d026f64697c64926dd9db5e01ffcfe490d7a7f681d0709ddb3bac60
MD5 3e93fc2fd72df0dd178844f934ae1cf7
SHA1 246d94cd531311f7f48d6cb27056f48f462b086f
SHA512 ad4a9688d52d749c50664d2e62b7f3f91646420e0e788e2b679ea9deea77cbb046c90519df7fb450b41bb57e5e85a1c612920ad0e0a138c23e33fa652735b0ba
SSDEEP 12288:TDqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:TDN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1344523643F8EC1BFF18615B08CE88168AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 916597c597fdd92883fc6779f14cf67d1dd3e133a8ab89dc26b8bd594d19e9c7
MD5 43b0620895d01a5b7c29fe43c83e13a3
SHA1 11eab3080bfc520dbf2a48db17b7f9cbe5e13c55
SHA512 090f342067b8ebda04fea5b54deccee6e252312755aee76e8d39223dc5f6caf933c7fe355300eb2f4e74a849e4ceda7b9be08fe68c4c0f1d04c6763a6fbf5ba0
SSDEEP 12288:a4qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:a4N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T15C4523643F8E81BFF18615B08CE88178AC0E5F57DF42528F67974E6E8A349C2D5E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 644036e768a9dbd954cef74e6d6ac5bb2af3e5740e652b9ad16c5ad8b557324b
MD5 fe0812fd56e0107f5c8d4b8e7df20c22
SHA1 986b0a3870f99d516d064bab8a645a70ed972160
SHA512 50394d45e4c90aad5a06e22dc9c31f7b40aae1849460bcf341eafef81394dbfb58169035ff753c87c2e1d62bf8d20b70c2cead2456ea1dc7134289d25c64576e
SSDEEP 12288:uWqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:uWN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1BA4523643F8EC1BFF18615B08CE88168AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 9558af0f833a91a253bf0cf0e88e190bbda92f47db6a77809f8a41b3440cfe4a
MD5 946d19945509bc082fc2359e7fe44a95
SHA1 a56862ff8ecb440af05b6fe577b3600fec148deb
SHA512 90684870a7e3a70aabc0414d27532059dab1630c2114106da5a0851c4ffc4e69df94fc2c3675e93589878bdd3014a811ddcd3da93edbce06fba05a0473f4325b
SSDEEP 24576:7fwvok9RX6wkyAIUN94AMdTEvcQFuOjOP95Xdt5c:dMnYIs95MdTAcQQfjP+
TLSH
T1FD85CF29EFDC44E5E1B7923889B7460AF6B178591B31C2CF129A53AD0E37ED09D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5b8e6b675dd628e91ab72740613d56c4ecd2940f16661aa72f79795858183076
MD5 8a53738711d152f1f92bdd4cd246702f
SHA1 8ca8d0eec79207eb2c67ef0166e5e84d41a6cd5d
SHA512 d9a8f4040426217ed7be1a2347af8a2afdc79cc89b257e9ae4c9651673cf433588efe536f80342215f42d54eaca2e59759c2a14667ff4891cf67d9f640cc301b
SSDEEP 49152:VYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0N95MdTAcQQfjG:VySzPl0xTQWj
TLSH
T100066C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 99330b4891377f5cbb6f52bfac2d6d2e0a7e63a9a4ea4a5725e28935ee4f881b
MD5 e14ccd707ce664dcc49a54bf9db63c5f
SHA1 22cadcbf9e5d263454db8414417fe407e4b60fde
SHA512 3ee37ad4fda896d8af3419c9bf402f904ed22b2fe4d101288dcb89364a0a210a36dfd944996d3646dca746dbe5cce99a277ba3cad611974b4e2c146e101e2452
SSDEEP 24576:H47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYRN94AMdTEvcQFuOjOP95Xdt5c:H47JUQj1irIhCnDHUPfF/d95MdTAcQQq
TLSH
T1CC65AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 b9d532c391522e70ab651a3afb544cee62bb3edf89164346a4739054ba5af665
MD5 895ad9f510c75dc9d534b2ff3675b010
SHA1 b843c08b2a09594eee774f963224ef2a8d078739
SHA512 92a6f7f23f59e2bf0c4b6d4183023c5872a4102883114c22ce16be7a81599f81c3ce7dd2ad15900c64a0b44a01acfacde6703cd9c619a352540c1a68706362c9
SSDEEP 12288:gNsfwqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:BwN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1DB55F119E68842E9D0AE6270CB958640B7277D258BE1D3CF53D0F93E0F366D09DEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo-small.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\StartScreenTile\ksolaunch\logo-small.png
Size 6KB
SHA256 8bad76a7433cf4662c38a539c2429336d65feeeef1bb5c6435928a9574b216f8
MD5 8d650fe389e3665607fdbf938c1a1722
SHA1 2e545f9555ff22313e4ce113995d8aa694e5cab8
SHA512 f116621bfecb602d02919eb1ee9d7dc92e82b313b8b54cda42ab48c5e7ec60b02005edcad763fff6b497ca4bc46e83cb0c9a249be791f245bb9c599950fdf015
SSDEEP 192:HSO0z+xgsZ7wNP+agwQznBm2KIvdgoeAtzpZb/D1:yMRoP+z5IIa8hD1
TLSH
T1CCD19EEE6F1CCE4F079D52F7500AC0A9DEA218AA905764D4D68E70B471FE6D120EC5C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\StartScreenTile\ksolaunch\logo.png
Size 12KB
SHA256 ddfd8c3e15c7a4667e369546fd8be6e7dd24be632acba2692ffbfc4272eb6518
MD5 d58510dca6b659c6e4ba7a454d5b75ce
SHA1 e142de2dda3811a2e8bbbb2eb64d366e8eb9ea3c
SHA512 42409f9976ad08ecf1756d1c2915f3ffd17cdc78e9ff552c0a08bdfa2fda8960e408721bfc9de1a5ed9c9aca3e23b97adb721b3c51b6b3f0ed3ee4a4c780cf88
SSDEEP 192:ySLu8Kp8OtM5IirU31+5AejJ7D+N+QOtHQjrE9aTYpR8XnXrWjvyNTtLJci:NC8o8do1+5D+N+QPE9B2Xn7WrINJP
TLSH
T1BC42C08F68918EB2CE443C39F356115F1FE12A5E7E19A2CF2CE7944A239044ACE1591F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything-KingSoft-Read-Only.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\everythingsearch\everythingbinary\Everything-KingSoft-Read-Only.ini
Size 404B
SHA256 b5980cd1122d2ad4727bc06806e3d2a6598b7d67b6eb3d2732938d08c6deedbb
MD5 6a4653f40acaaa13e2b0f60f067ea93f
SHA1 34981baa55ef31ae6b6d5985fdd02798e3bacde2
SHA512 f286472389e50fa51abe03068cc3e1f9d18b19926d84b66b1df28c157cbc70e8de32a8deb7b4096f462605a2bdd4d76f9863c6ca0872703c60d473a3271778ea
TLSH
T15DE02B99808C4B1C7656E6948D715E4F42E1C79C1B98174CCB0BC241E91950DF63A439
MD5 SHA1 SHA512 TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\karticlewebcloudsummary\mui\dist\run.ini
Size 171B
SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
MD5 b30cb271e143eace0f55ea2e562e1e9f
SHA1 9d97dbf24931cfc114384c3f4dbbae21c9e51be5
SHA512 dc593185fa63b458024c3a913c558e5686806154181dea67eec786ada50595c53bab822833ad1e76c9acdf21be3eba50631391b7e575d7f1f6409ceccf966535
TLSH
T1AAC080D4D0256F97DC31C6B5ED54AF1A7560E700251C1EC3D530DC4E9E9696551C805D
MD5 SHA1 SHA512 TLSH

Submit Download

kcoworkdockpanel.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kcoworkdockpanel\mui\es_MX\kcoworkdockpanel.qm
Size 846B
SHA256 8f0de81b05e2ce8a22432406009084933f0cf410e6efb534aafd71699651120c
MD5 6e815f2b93f16067d08e51cdb69b81e4
SHA1 40630f21ec4e2ce47da271f5e379737bef67fad5
SHA512 7e9586a605815f829a2881ae328d4df3cb9600949767cc5c8fb8186cc2243b08d8cec4bd52cff81c728fdb0c8fd7ce1c9d8e52e9fe4139722e99d4be12c6e482
TLSH
T12F01E9D527FD2F19F3F79BB179E652108F3679082931D16F2145A40D05A15505DD0327
MD5 SHA1 SHA512 TLSH

Submit Download

kcoworkdockpanel.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kcoworkdockpanel\mui\vi_VN\kcoworkdockpanel.qm
Size 839B
SHA256 ad5549bf1c748909f191eba6e08caccfb31dbe1a2ce4bfafcb1e41702f40c95f
MD5 3eabae85edf1db8a54d42509c660862c
SHA1 ea6133582aaf7aaf5330142474dec996e527b461
SHA512 05d619228af227bec2d3b33aab044dcaf79b69633c604f81d6456eb10d4420e48024a9a88cd706fb5c00908565347f5e04302f90bc5211d48d99e2aab2feb7d9
TLSH
T16801E29523BD2F19F3F79BB17AEAA2208F3679082932D16F2145A40D05A29508EE0327
MD5 SHA1 SHA512 TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kpdfcorporateglossary\res\dist\index.html
Size 636B
SHA256 196660d8cc2ee5c67f628c97f75d9e6f3ed34d4078e879306490ff5b07250fe6
MD5 72cdeca808b16e794ec5b66bd02246bf
SHA1 e75b6c4e084efc8e60c9e4fbe9e9ae02bfbf4132
SHA512 6562ed498bae7f819caa5ebff9ba373b1bbeae3c92befacbc44a72419e6a3aedeee7fe43347d1bf8c46b9c90c8e515181a6dc50c4ad954a640cf6b2520269ed8
TLSH
T1E5F002EA3C25F055CB911EA43DF2F19E245E3AB29DB9DE942AF4513543C03694D0BF48
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kpdfcorporateglossary\res\dist\index.js
Size 2KB
SHA256 4fe8a15f0109a476cc4062cef4d3907f338c4f4bc0302c8f3089d1d3a606bb1e
MD5 67dde682d1968824023dd9773f9ec48b
SHA1 81e0a21a7ba2c05193ecc13672a3f537539e0699
SHA512 86bccae3d66df4dd552c12a42d1ed0d57d6cdb7b904caa1f89c874e506fb76412b2df45e3e5f673837cb72aa18b0ab2c1dfb489b1da37068d83d7ccb25d3d8ea
TLSH
T1FD5173C9F79E702209EAE136583F0006E17735596098A1C8B87ED8F16EB555E7077F38
MD5 SHA1 SHA512 TLSH

Submit Download

errPage.html

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kusercenter\mui\zh_CN\res\errPage.html
Size 7KB
SHA256 c723f9cb4803d6fa7e16e7bb4b953f26803721b23e8b18bc1cd1eca6b9eef8e9
MD5 eb3b05c3a3fdef3b0c5c9020756ebb33
SHA1 27c5773e17f9c05f471ccd22db42015561b4e669
SHA512 9a511c6d0aad855448ae45130d7ed031062bb7e6881e68aa2406c7c122220318379c312bc13876599dd7fe88e2beac296adf5bcdc015ef4e0e3f362e76303ab0
SSDEEP 96:9uMJIMzvOcuq4v+nB1W1QjjaKhwc3Rgjfqqm8bm83:9lTgVv+B1W1Q6ywc3RgjfDm8bm83
TLSH
T141F15211D6925216603393B4DFA25719FB260023A3038A38BFECA2558F75C495B93FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicon.ico

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebmemberrenewalpopup\entry\favicon.ico
Size 4KB
SHA256 db74ab0b78338c1f778f8398c45f4103c99aea0e845a3118a7750b4eeafd3445
MD5 1ba2ae710d927f13d483fd5d1e548c9b
SHA1 c0605efed936ee2600284e6480521d06fa64f872
SHA512 f933cd352eaba92f509b3863353ddfefadfada26a4152ecdc4727d450bbf35e7b10fb3038fe8db340d5c63d74e608c1560ec84d0f6ffc8ccd940c9e0d7533544
SSDEEP 48:i3H5R5hLOR4kt38PduMoglJrd6qTrp9hweFC0+6Ga:ipHFUs4MLBvuyCda
TLSH
T1EE9175DF61C388D9C1B1977F78C449A14F6FD951BA28351F55CF30622E5D75818C1C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebpromehelp\run.ini
Size 226B
SHA256 c2fcf4d5d04350a76c4ce6b06db287d9e9c63b0f886fae500ac27b0627d38cc9
MD5 abc3a6089b0ea76ffc960fbc9b6e66d1
SHA1 50ad0cb201c13799024de56cf45116cf65ff5569
SHA512 ec1e32b7bed882095b23e049a4e1a86acf0bf993e2f691105ffbd99d93ebf28faad4fbdd645ac1eefa74ede575854a3994c7c6d2bacc6f7a09a1991561b1a44b
TLSH
T157D09700C0B5658AC1254C827CA53DC411085B4B27608E02CCF0C34D508EBECE56B08A
MD5 SHA1 SHA512 TLSH

Submit Download

close-secondary.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwebwpscopilot\static\img\close-secondary.svg
Size 216B
SHA256 3c94c153044aa4668868fc49a5923059b5aee36430702fcbb3c4d3d11508f591
MD5 07306930f7d374663bd13e38ea0e92a1
SHA1 12f877e8ab93d874b55d75eef6747615619dad4f
SHA512 4cc0517ed0b9d665df4db93fb3093067e90f64b34f1d41420ed975b4cec64d4cc0aede64092d79c610c04e1ecd9514a9ef48389d5c157b5bcf698fc33670db98
TLSH
T1D8D0223BB3CC8E1CF9224A22F35A713580AF41C3548942E4D8322032E4011CEB93B6E8
MD5 SHA1 SHA512 TLSH

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwpsaibasetypo\mui\es_MX\kwpsaibasetypo.qm
Size 334B
SHA256 8e1016c2d749cfd1eb2eb870b90c2b662f0bf7e14f8c14a7be140aa649d33af3
MD5 d36fe6147829a72b42e054a5db27d270
SHA1 80779a8eb37d8bb1d5fcc594576f80dbd61fac98
SHA512 94224816f757241b3a6d19788225378ae070fc62b4620e11e10a033e3be5d9cc858cd9e669cc275b1fa82e57094d0df13a6d9868cf00afaa17cf2ec0193acd74
MD5 SHA1 SHA512

Submit Download

kwpsaibasetypo.qm

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\kwpsaibasetypo\mui\id_ID\kwpsaibasetypo.qm
Size 327B
SHA256 257e81e6819f72b7a38099365e27a76faf9b2b5081290730f4784045ecc2df40
MD5 18770de3f96bac1e75e588015024fcf8
SHA1 e6254c054edef68f9c27059efd82eeaa69c863b5
SHA512 fcb76291a73d7f2e30f4266ea8f0dfa2d9e203cf9770fb7ffd73cc1994502992fabd0803224c1e1155c1e4b678b5af0e8b3aec114beb1f02299e8885d5a61d0a
MD5 SHA1 SHA512

Submit Download

element-icons.ttf

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\wpsbox\mui\default\html\sharefolder\static\fonts\element-icons.ttf
Size 54KB
SHA256 a30f5b3ba6a48822eae041e0ca5412a289125e4ba661d047dae565ac43b4a6b2
MD5 732389ded34cb9c52dd88271f1345af9
SHA1 8058fc55ef8432832d0b3033680c73702562de0f
SHA512 e8971ae48f5287d252f5b0a2d0516091bef0d2febf7d01fd7b435e426d106fea251037439ec42c2937e934b66f38e5eb43d00a213cdf334f482f4a06b1817f9c
SSDEEP 1536:qTIRCXXCwinqtuPM16hD2N3SUjbwaST4DCJe:39GEcgD2njb5ST4h
TLSH
T10A433B32436A9BE7F416047F5C1F55830A9F4F22F53DEA8B83A6192514162FD0864BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

element-icons.woff

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\sharefolder\static\fonts\element-icons.woff
Size 27KB
SHA256 ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
MD5 535877f50039c0cb49a6196a5b7517cd
SHA1 0000c4e27d38f9f8bbe4e58b5ce2477e589507a7
SHA512 da269b20f13fb5b0bb4628b75ec29e69bb2d36999e94b61a846cb58db679287a13d0aa38cdf64b2893558d183c4cc5df8da770e5a5b2a3288622cd4bd0e1c87b
SSDEEP 768:gOvv6ExpCVxUtrT6w8ClFd80EjPVerMKBaGXjAlEm:Hvv6xVWewtlFdGjPlkFjAlEm
TLSH
T1B9C2E13197213AE9D9824EF876E498FEF1651402290F390E8696ADB3A98D5C73E16831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\css\app.css
Size 107KB
SHA256 907d1f5ee046fae72b52eaf99508ddb6b48d47b803076db0e9a86b0e21a54ba9
MD5 0ad676312c51d1b96bd08f056ab33496
SHA1 270438a06781cb68c376bc18c42437dd5ce262da
SHA512 6a6883f9fa0a1f768bf985340dc6cb4651e5ce691066c9597126ba1fc62b2a45a2eee52a1d8452faec885bbd3358be3fb04a15fbfca0302feaa1adc2c81130c3
SSDEEP 3072:KazzQ51KYGqMkYUl26MeCAAcdl6y7tqWD:mME/euD
TLSH
T15CB31B37214D132D343BDAA2E55D659960C8F61BC00253F9FA247B1DCA837873A7A3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.css

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\css\chunk-vendors.css
Size 279KB
SHA256 64a207f1e9e24bd26d83e1397dfb94a155b46e0589ba5f002f1557072f3c21db
MD5 a3964e72421a1ef5fb60c6e17eb5d705
SHA1 5dd9584be5141e884a230c48746e1c88126b0a55
SHA512 4ce4119b7407b460969041809354c4ede587047ee643f2897eb0ecb9627608431f43fed27c54c70bacff3a6694eb32a85b535c7d6397ac22d7d28e260b0a5467
SSDEEP 1536:39eSBQG+dyAUlHj/8D0Q+SPxZztR+LCrwHFfyqHYb3PPV7BYUOf0I79lDxiRSL2Q:3zfZYKVxiW
TLSH
T14054B6229140212E702BDE3DF7C4EA4AE225C6B3C4125BFEF953651DC7C36AA117778A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\js\app.js
Size 380KB
SHA256 fd9dcbe72da3477714bf68b8987db4718e4be32f313d09bfefbd4d78aa051a84
MD5 64ac5333133e48efc94a0f579e10878f
SHA1 ca547d97d85fa913f48aabcbb23a227c6a2e6bad
SHA512 be9be830f1a3149b238b7363cb6aac08281d244825f4c0ebdd69e31daaf05562555a46484af78de442b7deb3ca71b8a8698331e617b433a0f86cf39e2668576f
SSDEEP 6144:qpK457wXrkaY0TbOXsEYlHBBs6Ve5NtXoqIpgznl87A6v0eX4AiDuViQbgQgILTV:x4B0WtYlmiLlTj8QmIqUrNBqq
TLSH
T1DE846C4B758BBB5A1F35B66340DF3C88D01C6EC09812A5C9FABDD9D09144B9A32D63BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\static\js\chunk-vendors.js
Size 249KB
SHA256 7d05683d8cb8055b00f58e8261786536ba7e59cc05d1afa0fbb032a4f6e657e0
MD5 6351ea268f992f52e0f4418a7028b91d
SHA1 5bb3cb88465c550a1fd033a079a8b2eba5e071b8
SHA512 44940d07abfdee6403e9400e596ac5e5eb234ba77a1c90c2fe4086878c12f4805c709eb84538071f21d5710d3569d342e7caea10061e2ab2661c5117c5966297
SSDEEP 3072:p+Xy2rHhkiTtcsuaIwK3zqDLW/ix3Iu7doNFBWgz/bwUzxqcG7gLEOhA:phKHhklsi3zpCdoNFBHz/bwAfG7cW
TLSH
T10A44F8CDB2D1B0A517EB61B4813F610BF27B6499B44E80D0E226E5D4BC7998E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chunk-vendors.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\chunk-vendors.js
Size 424KB
SHA256 35657b23ae75c5808c921aaa9bcb5b4a31096b344fa792a14c0b4f7817fb2d1d
MD5 cf29fba214e7f43f2ca1b629109d126b
SHA1 d0dda9486528586af6943abe7a3afa319c790f25
SHA512 2ad7e4711f5917b8d13f861d4fb2688e6ce3951da43a89263a2d9743199e173429398ec1a9537b1df25593d3999dd34fb590e2d2a6e7a632ccc44265d93c3bca
SSDEEP 6144:z8KzCOcC0CXWsJvRekr0dgei/zJbBoCF7az2bzNM:zbzCODTWsJvRbw6zJbBfaz2bC
TLSH
T13694198DB2C1B0A517EB60B4913F610BF23B6469B44E80D4F266E5E57C7898E9127F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\en-us\index.js
Size 10KB
SHA256 9b231e881665f468c1f04edd0e7f41d993df04a8e97b08fd1e02cda97b8fd748
MD5 0f4634d4af8b73f882440c1181697d86
SHA1 748bb9a14c8a6c64fa060ddcb1b4baebfb3f6fd3
SHA512 eeff081cb256a44ff4557dae145c3d277ad936fef58674cb7d2949b6c302c3a746f05495daa6ccabf39c26bacf13c6fee3bab20de4f1d13810be0503787c89d5
SSDEEP 192:cyxPpQcKb2d4U1nE92Ui6OPl20b3G0qE7I2ByobYGeBv+x9qkgYbeO:zzFZr6OddG0q/yTh3UYx
TLSH
T1AC32C887B30483755A90E790F6C76DA5A93ED0EE73A4168A3CEE421812581DEB3E7CC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\es-mx\index.js
Size 13KB
SHA256 6037693f040dc6659fbdfc05479fb21830cfa316f738cb42cf07728c8c6227aa
MD5 dd59d31e84434c59c5c3735bd0b0dc3b
SHA1 c34473850d3749aae725856f68a262a0afebee00
SHA512 f3acd51920f945b49dceb56fd2a5a4ff170c4a5770665bef3d888f8497a288dc33bd15f24780cbe9b8ced585fbacb92a8700d1322a6d4acd2b6e5893370822ac
SSDEEP 192:GwSuCUHXDhEblYfhQ9GYSOqUr9b1AARAU0qWo3wYXVMojXiyaH:dCaXDhEK55YmUrLAgkqWo3RVhpQ
TLSH
T140523295F3C50E22B4991749BA03D57BF19558FAFC2CC18D5CF2D236136C9C986928C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\syncfolder\wps-i18n\ja-jp\index.js
Size 14KB
SHA256 120bf936d9ec60ded97b7c28f1f10f605a1999c3c1ff596e48d32b5a21352353
MD5 5cee0947c1ef6f00e18eb17cf77388af
SHA1 5a27bc625acfb46d2368a9a376d797ecab912a3a
SHA512 1bf91f08d2a2a446ef0e22df40fd09b090fa300f599bacdd5c698aa61a6fef12ad3d3e38299804a016e5a22a82ddfeb6840cdc7a79ea51244942cb22e659331e
SSDEEP 384:HTO1ksU66rAJGO+NedvSGdv+GfBgLj95LKn:zO1ksU66rAJG5NedKGdv+GfyLj2n
TLSH
T11D6230ACC3CD5C69C86183FA090B35C27836ED49FEA5AE7280EDF4202DA19DFD815674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apm-init.js

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\apm-init.js
Size 57B
SHA256 206ed6246f4276b7fb449cb6ba6c8947789db6e66bf2c07a8e5c6fbff6c0dfce
MD5 b684f2b8022aaa97ede28f9d224c4db5
SHA1 2087206ddbfd6d6d71f843a132b58ed533d87169
SHA512 8d30da66bfdd99dab88c4b9766b692c39ecbc8dd725e9f858c95993d4f2bf46c37891a1f8f4f1eb6fe09bed7008b8df48d2a9b4f10d7caf20f823f121f6ebb40
TLSH
T19F9002E7F0A1707344616959630722AA35D11130017430010900487434A580FCD22F88
MD5 SHA1 SHA512 TLSH

Submit Download

default_ava.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\default_ava.svg
Size 906B
SHA256 96e697f527a5e0f977c358c7e12d63c424ebe9e2fd6b400e4b1a088360d4c9a8
MD5 c47a5cfed147c402538358294808e68a
SHA1 8aa499336bc4a50a70710735b67fc5da923fc61a
SHA512 a71831abb9393b6c0ad62feb29fefbb192e1706b08ab88dec0a8e6a9cf61b6a7e106454a7e6e518f69425cc91846036e8fe2956ea939625678f17b330860ba1b
TLSH
T15311E309934DC285960AD7B8563C1754347272DF9E1FD55CE7E633012D3C6AF185C27A
MD5 SHA1 SHA512 TLSH

Submit Download

desk-sync.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\desk-sync.svg
Size 1KB
SHA256 13b5176d53968b8d36cb72668a1e3ffa7499bd98ddfcf0f1088123a9bd3ca19b
MD5 c17417f321f52624ee0dc60ed76a31b6
SHA1 b64e19a5b03c92a931fa9a1eba899f491e669a1e
SHA512 bf160829598cf0b22ea48a5f7310adfbd26fbc1bbf23ea3cb8d9cebbeb92b5e81b914bd6021cd41df5984ef00698acb1c1151e134c714e0a1be7dcd439c78485
TLSH
T16D21F0ED57EE35C8644CD37028DA6079627B35F43969EF048914A9D1FE4205D499F9C0
MD5 SHA1 SHA512 TLSH

Submit Download

loading.svg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\yunbox\mui\default\html\transfer\img\loading.svg
Size 1KB
SHA256 ecca43be5346a4b5a0bb9a87622c63922792b4c376a38089096a7dc11fdb7097
MD5 0620393a949b58f6af37b0accb79e32c
SHA1 0025e4da5ffb8695a8f9731a05b1b89f1a71bf24
SHA512 0d308c758f825d548874cf8b4b8ec20f3685b39c7232246697dd95e5e5f40da7cd21de7ba5faafd0d8a121b5e6b85c5aadc4232e3f0c943535e062ae449ef29e
TLSH
T1333142D111BD0116E11AC365D7FD7AC70B3EB4DB26E558BCB68C250FAB404DB0A9B219
MD5 SHA1 SHA512 TLSH

Submit Download

setup.cfg

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\cfgs\setup.cfg
Size 449B
SHA256 45a9cbbacd1a5a9ef690f4b0d8978d908cf12fc423254b3b591b00a7231aa5bd
MD5 656e40598e526d31a49004aea4f1e0ed
SHA1 e8a58d582f70b6f4a331508143c758f241c785ff
SHA512 8ca2432f432482a87cbc6f744416bde09ba69f7a234848ff20d82a02b362b8c48ffd2be45e268a0876298e62dbcd36b620901d9290fa4a87f5abd3a7a95584d4
TLSH
T123F0556A030370741A21431410B914F2A3F601C91117840D656CA88D6B7DC3D86BF13A
MD5 SHA1 SHA512 TLSH

Submit Download

ksomisc.exe

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\ksomisc.exe
Size 3.7MB
SHA256 9555ca85ef085b11d92dd2fa4c901d4fa3c72865df5e7a6bfeee6cc7c8a8f3b0
MD5 f36a666ccbf1a286eab2aab3fce0f72b
SHA1 df8dfbb550195edba779d3deb30b3ebd8d437aaf
SHA512 f873872331477835895c47c06af5a4a62cbd57eceda336fa854fd113d393a8e3772de80c0638f0e753f91001556c523a029da55d7111a29ce7d399060d027497
SSDEEP 49152:NM2VJSc5XE2+OX6KujrtYtB+OL+ro3RauJIwmfL5PEpPJj5W6L0TkgNp+eUqASsY:9H5XbRXCszwogk0NJgs
TLSH
T136067C1BA2E903E8D1B6C238CA955D03F6B6380643316ADF11509E790F7BBF15E7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

error-net-72.png

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\mui\ja_JP\resource\webdlg\img\error-net-72.png
Size 1KB
SHA256 3d2b5a80659755770d46bd5b5c1f81173959d3ee7ed59a8a80ee775ceb48f89b
MD5 66726a0fbd424ccb700cecb212a47007
SHA1 9795ae26acf0b942ab6a0cd06f206ba69eda18db
SHA512 30ddd2fa17517792a86bdb03827a0809ed362ab2dbd9a7baf194d1f47348c96e0ca8e64515c1a58d7a1740e85f53a3676b49ff6c699d598a27c234c14672604f
TLSH
T1E031C6CD318AC42FCC61D531F4D534156817D760BF928C74102BC5576E0F68E58C6662
MD5 SHA1 SHA512 TLSH

Submit Download

presetLayout_16.pptx

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\mui\zh_CN\templates\Wpp Default Object\Preset Slide Layout\wideLayout\presetLayout_16.pptx
Size 41KB
SHA256 8c66bc3793cd3f041341b2d6172ef212a590528c11bc281da98f2718cfc757bc
MD5 f41e909b0284949bdd3bea9393a6ff2f
SHA1 a41497f65f44368ad517f464eb0da4403aa700c0
SHA512 d800b9b807a72d19f17bf5bb923d2489328b2f8801c2146b0c67d3d4cd8c70d5f22decd6581ad14d5584f3895140180c8578ede4fa8df755ca742c18cbb3b67b
SSDEEP 768:lwQ75cI1zETv/7H0vFtZKSZTRomseFVEFqG5IphchDB8h/rW7oELmG1wvcG7GyGK:9qNTn81Romse8Fl5ahcVChjQmG1/sl+Q
TLSH
T114139F61D40A142FC263B3F6E478164F73FEE86248179797ACD51096282F97C2E9D38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\utility\install.ini
Size 462B
SHA256 02b12d84543840f23c9de9ec5955143228ba0944a1cb0d7e78fa9d6bf2ca9c43
MD5 71e0a7ecd6bd2e91c04a3edf760c45d7
SHA1 e6cf872ce6def16bca98818ba289395580701292
SHA512 282b4c8be6abb97383d7dda8258fbf069fd668f4fad722582567cbc916b5c7da9a39a157a35511210306c19e46ef34c02af17f2af1ec7707bb3d84f3d529c3ca
TLSH
T178F097090C98C66E36282188B0D3C2C0A9ABCE260D0CE410E2D36E1BFC02E0A217E02D
MD5 SHA1 SHA512 TLSH

Submit Download

Qt5CoreKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b0b37\CONTROL\office6\Qt5CoreKso.dll
Size 5.7MB
SHA256 d76ce35aa1a6d2d9ee025bbb2e8743c401039cd4161058dc4f379588057a5b94
MD5 16c3e81f3e45df75d11e28cb07b001c3
SHA1 d4d46eec649ececc72466873d2bb6bbbc4c515c4
SHA512 f7bd1025a66f168f14034726da7bf7369c8c34e53ded56327dbf1ee1a0ef87627910d255487b2ea5ee9e3098a769e367f2e43783b3d7d3aa7223a4300cbda562
SSDEEP 98304:FkAb4j8eO36Z5AKJsv6tWKFdu9C6iPl4rVsca4:Fkg4j8eg6ZZJsv6tWKFdu9C6xVsca4
TLSH
T16C567C47FA964269D8B6C238C9D7C127F673B80247214BDF2258A3496A737F0293F359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5GuiKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b0b37\CONTROL\office6\Qt5GuiKso.dll
Size 6.4MB
SHA256 c3a2de3161f7cc03dccd2c375cb10aeda109069c13689c105ba161f39c2a35d4
MD5 569c0bed6125720be6793d7facabb2f0
SHA1 d3ec78f7c465d00544fa2e21b345afb2d60cbb2d
SHA512 755abb42e1c7f1427c55938a611c8e1f8c73c228ae390b4c7f5d252804f06c46e466de30ce948a75670c8e4b7e605339fd41ca346aa2451ece42993259f006df
SSDEEP 49152:8dwe5wpMO4YOd3vBY5atKJmv+X8YXTJTyCIyCjIzjuwIomuyox3GREHckZFUT6YR:Kwe5W4LhPWfr2uyoZGGdBJ4P
TLSH
T11166F886EA556359C972D17987CB042FE1F37C4283524BC36C45AB490E237EA1B7FE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5SvgKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b0b37\CONTROL\office6\Qt5SvgKso.dll
Size 503KB
SHA256 bc68fc65d3620fd0e31e625ac359ce68d0c26bc45f68d5ada1e4cb4df9852978
MD5 dd6a72edfaaa9f0db4172ec0ee37e47e
SHA1 3e01006aecaf7f8557805c7495fb8a9309caabb2
SHA512 82877887e307a211d6108dc439f104a602e31edc9647cb67c3e8b7bd45d9862f53497a5c3b4d5023825d02294e46e0ad4f1931b8d080427f506e5d600d57405b
SSDEEP 12288:xYYYJUNY675fyplktpsz/VLEgZ/ABXH9a/vngheZL/XEnEsrnJpaymesGrx1/9kJ:xYYY475feysZMa
TLSH
T105B44993FB520799D526D27CC8978802F273340443A39BDF2A5AEB651F236E1763E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WidgetsKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b0b37\CONTROL\office6\Qt5WidgetsKso.dll
Size 5.6MB
SHA256 70eeb2b38bd9e4b17d49e62a1a8c5040a0ba309205224d500a89b20480ff4886
MD5 7a9d9082e35636aab6d53fd9cb43b5bc
SHA1 8c4c36e1d0093b51be7b515064b8c2bd78375a7b
SHA512 2e21462bc80d2615556f3e34df721a549d066ec8a93f1445748c2473807d613b397edf091cb99143b8addccb118f8951203c4ecc19cddc26d047cc39ba567324
SSDEEP 49152:cbXPQj9zA+84QMzrV2gPZUIU2wuxPjYqok/revAgxSkSsODt5fVKnsjBKRI0QdBZ:B7ValZRI0QdBbj8PwtxTMnd4X
TLSH
T113466B47F7A50389C56BD23CCACB8613E2B2780447234BCB6959DB681F637E2197E790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5WinExtrasKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b0b37\CONTROL\office6\Qt5WinExtrasKso.dll
Size 251KB
SHA256 5f55c44db9c677781b79f5c0527fc5ec81dad8e4fbfac6076a45f1d0d747e24e
MD5 ad3380736b935ae7c3c8a986f3d90adc
SHA1 6530bd9ec891b074029880b02614b56564e0d6c9
SHA512 70eccfa8b101ec12dc5fbbea3cee0d148ae18edb72618f54cad8302d01a9a0d82efb2bbc3b24249502888250d2bb8828f58206486d286fcd3ba772dce7bd28ad
SSDEEP 3072:BF5o5cKUM7YLBwcJf1+6Ws2F0+xvN8093ZWFh:BfpMjxvN808
TLSH
T1F6449684BADD9619F81970B88FCCD199C223BAED8B47425F351EC39F4B619816E139F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b0b37\CONTROL\office6\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b0b37\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
Size 75KB
SHA256 dcf5212ec3fe7746f8b26a504687be3bb29954294b7f448c4940b413fb04c527
MD5 80946fdc71e0211e5e4c54428615ac29
SHA1 2df40528efde1df3b996568df59900832b1ad9e8
SHA512 d842f4d7e956fc96902742a3095753be43d33f60f7d0bee53e95d2342da998d95ca1aac5c56c284a5ae078c923f45effd19b16b9921ef7ed0e13c306d8a34b9b
SSDEEP 768:YXOzQ/DBnTQxkUtwZfVKFkYQJc1EqTwi6NBv9ZpZSac6mWWrDYiDLk5C7toHZtY0:7jf8J6wi6NBV9Sac0+D7bRQt77f
TLSH
T1C9736CA3DB441799E51B8634DAD58A1BE6B2784207A293CF6324E3680F733D2397D3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b0b37\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
Size 46KB
SHA256 524e279aa876ea45ac1205c4f4210c226aded2298d96b4ba46f3e7c4faec499a
MD5 d7957c1bee4a820225202b81e5cef01c
SHA1 de1e1969fe0dff1c7fbaaae9aceb19e68303126d
SHA512 7f7347bc8a1de88638d85af90c12fb6f23e6e963a2a5db8b70ea3ff681c8070622a36ab0b542c49de6834ae04561042217e3e3f2de73b04c4a49211f73a1ef7f
SSDEEP 768:m/6pbQ2EGQ9UXbX8UKaYiDLk5C7blYi77M5ALlt:rQ2TTbX8UKa7bPl77L
TLSH
T16E237B97CF540C09E9279A70B8C58A26F972B8514B92C3CF3294D2694F963C23DBD3D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qskia.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b0b37\CONTROL\office6\qt\plugins\platforms\qskia.dll
Size 1.9MB
SHA256 6daafb39daca277e272ba56a115eed0235b45d5d820fa9b315f78005e048e6e6
MD5 d6935f83ac4579a4ad454d9115ba5c3a
SHA1 27e617a82f8b472e017113e0aefa10d2822998e5
SHA512 8dfd760c0627ff40d878b450d72f2d80e0dd4d341f78cfd9ef97ae13c059c6f6292d2ffc8a9bc48234613ad9a78f35865139be584f28c79b0840b448131e1001
SSDEEP 49152:ddsZt1rO+9yWfbVQLR4bC9c4RmZSHpjlW2k82a66kTc5d7:5+kW3yp
TLSH
T137957D43E3B44298C1A7C13D869B9F0BDAB1740543629BDB2260CF59EF237D21A7E791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b0b37\CONTROL\office6\qt\plugins\platforms\qwindows.dll
Size 1.6MB
SHA256 8a87eb5fad6e90294115e7b3df56971dd278a48456344b4bf2ea15a3055c56af
MD5 7f388c6765a0b162126462c8c3828dc7
SHA1 c79b5d39b0bd5be4e7d8969ee85b7981ba0767ed
SHA512 1aec90ed4e0b8ba0c64e295adaee2b3331936dc5ca96aba8576b936c4c1df398a31e13df27c691019ab32f826993db676bb5353dd5c5bedbee3615190f909344
SSDEEP 24576:AkGAzEn7Kn2eozTuqTttIrHhbR2gkNVDIsZM1M3aaV+Z:Aozu7Kn2xzTuYarHh9cVWM1Vs
TLSH
T160756B43E3A44398C16BC239C68B9A07E77174050361ABDF25A09F59EF63BE3177A781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b0b37\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
Size 159KB
SHA256 a4c3bb047f8d6d9240d5b020de80ee53585ed5029fec341ce2bab300b615a586
MD5 f10b88b6bec3fb5b9178b991475b432e
SHA1 5be625fa162f3a82a9d59297663b5072e4db0ab4
SHA512 261cf4b1e7ee029c6f3be6dc177137a258f6a44639fb10abf4b33ac0cc051c080efe5627e402328470d6eab0514d8a2f1619d5d418e88090d490ba2c7b8e040d
SSDEEP 3072:eSApjXbrT36b96bavsTHnbNgJUtrbgPwYhEIcI2oj9NQRu:qX6b96bavqHnbNpowYhEIc9Ru
TLSH
T14CF34913F25143DAC527D2B8C19E0512F3B37454436257AF25A6DBB82F533A2BD3EA82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b0b37\CONTROL\office6\ucrtbase.dll
Size 987KB
SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
MD5 61eb0ad4c285b60732353a0cb5c9b2ab
SHA1 21a1bea01f6ca7e9828a522c696853706d0a457b
SHA512 44cd871f48b5193abb3b9664dbea8cdad19e72c47b6967c685cf1cc803bc9abb48a8a93009c972ef4936e7f78e3c92110828790aa0a9d26b80e6a523bbcd830d
SSDEEP 24576:xOPJ1g7mT6BNvwTOxNfoYotrz1111111r8SoKxmxvSZX0ypdNLh:xO1aNoaxNfo/+a
TLSH
T18D259E64F75C0AA6C17BE17CC95B550ED972340647608ACF03EA8BB97E2BBE91637310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b0b37\CONTROL\office6\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b0b37\CONTROL\office6\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b0b37\CONTROL\pl_PL\style.xml
Size 3KB
SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
MD5 034f37e6536c1430d55f64168b7e9f05
SHA1 dd08c0ef0d086dfbe59797990a74dab14fc850e2
SHA512 0e1911c882152a4e1059a3ce1880d7fb2aed1e1e36cbd37055de2e2a1333acb2a0233ba2a4d969ccebbef1e77809aa5e78807aa9239545beae8c548c0f8f35c0
TLSH
T1E381CA80A610BD0AC563F51573AB7509762CB36383ECCFC4F0EE2E698753652644B63E
MD5 SHA1 SHA512 TLSH

Submit Download

product_new.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b0b37\CONTROL\product_new.dat
Size 83KB
SHA256 53a97ea8fd5bde7018db62835a7aaf4ec5689e175224e7cdb18bf070357de113
MD5 b58e647aabdee999ac048482ce15ff98
SHA1 4c8d0c481563b187cf00d1de36ae65ce6b2b7cb5
SHA512 b885fd8be8f72caf0eef8d4439b234035c1e71eefa5b69efe7adba2943de872c0bfce1cf06e06a41e3b8de6f776e07da283f75974171e34e6442176ed79355e0
SSDEEP 1536:I3CcyHhFmk6ebivjsUd1YXpFgnkJWvxh3/hICzQgKBVkeUzEy7n:2GHDW1ITZKkEh5zPKBtc
TLSH
T17E832C18ECE16EAD685052791D376D8227B7DD9160DD30AC4B12AA4CFC3CF887F72A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5b0b37\CONTROL\vi_VN\style.xml
Size 4KB
SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
MD5 394488b30107bcebb84a97ed5d754cee
SHA1 69ebe17f7d577e9bf69c87cff45c3251f0bbc86e
SHA512 24a6bc7debbf7030c1261c69cb4ae7bf3cbb5c7fac315188163c6001e58dfbe2e634925cb767044da7ea0e6d08c709b2ade02f6e43930819e1bef6f7569cad5a
SSDEEP 96:gd6SmSZcFe9gSs8TcySCSi58VS5eQJ/gQkgQ0/Mw8CclQgYzdr/PwiCSeDeR3ciw:gdAh8Ax
TLSH
T13FA17780A610BD0AC563A51977AB7909B62C736383ECCFC4F0EE3E658753692644B63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 387B
SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
MD5 c38481658f9149eba0b9b8fcbcb16708
SHA1 f16a40af74c0a04a331f7833251e3958d033d4da
SHA512 8f98d62f88442b8ef94aa10074e35aa8d9494f3c76ce8b143ca0bf7fa0d917f3175212fbcd6e7b0597fd0ec0e1b2827f157135512fb01c88218d36e2f7dd73ce
TLSH
T1D4E09B1BA8D1B0ABDEB302E988979D54BAC03D9A066D23147762540D3D32918FB41D65
MD5 SHA1 SHA512 TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 10KB
SHA256 cc52ea0bb95fc596f3cb0177db29a31913421f73adcff8cf27bc823432142aac
MD5 d6e958304d468d88c90a8906b6ff41fa
SHA1 a6208c88b06474ebbab0f59ab0098aacaebaaf9f
SHA512 c9031ec32ac8279119167c105b63c589daed1526ce2ab1e422c1afc38e0be78d70833862e0db8778e86111ad6b6a6c9518d4a9cb16cc020172bcd97537c58ea3
SSDEEP 96:hIlnHUHvFADCAuKHLtKBJoSdDfqAOdZ/K0zVEUph0MMtYKElS1veP1ICI9R6/hfb:hfHZB/qP/b0ERHR5j
TLSH
T1DA328D9B41FE459C07BE0A6923A6CE443A9A19DD374D65C03F33DEA74BDF01041AFA98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 49e4245645c1db576480a75d8fbc22d3aed6336c6679fb3bfbaba73b8cb9651a
MD5 a8bf02d78277c27454af882a3d4fdc35
SHA1 4d69136256d4e34e44814573931054693cb58d2d
SHA512 cc9921293505d2e04582efd86de1b55bcb985e8f11d99e194b112a27ed4466a0236f84a2782267e1ade5c1d54cb80e4bdeaf803065106d849902b5c6d687c301
SSDEEP 12288:s07IqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:RIN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1A84523253F8D956AF5B616B048E8C1386D0FBF658F0191CFA7924BAE89349C1DEF101E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 079693e8013057132a4ff9a180a194fd3f88a3621241b82d3b3b9c5b6478c4b8
MD5 f68895be7c25bd93472b5ef75ce7a1f4
SHA1 6ac49f6850dca9579bb738267731647b14b9087c
SHA512 713310f7a9417870e2fa6eaf31f0f808858647940bde78af878896de177fc7649fefb12fc5def804c3f84a7da665d1cdb6fff42f6bda5e0f349c023f577c068a
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bYKN94AMdTEvcQFuOjOP95Xdt5c:Lgb4mBIBhGF395MdTAcQQfjP+
TLSH
T118659E1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1251426D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 4c0663fa8952e87e279342d0fce1982f0cae418a11698df3fec3dad7951ba21e
MD5 d96c9ad9e2ccaef4427ba2fb7f3d3cb2
SHA1 a94e3452e5396783790b9bd53b2b11c81857aac6
SHA512 569e2711b175c101aa8c776b7afdff73124c1a3682a1df81a1cdf3eeff730e7587d879f2ad009449976bab25fcea3480e45f415226159d8e92491a1eee949a86
SSDEEP 24576:QG88u8FpJqH1bzria7/mhN94AMdTEvcQFuOjOP95Xdt5c:D7ZFPqVea7/y95MdTAcQQfjP+
TLSH
T1B085016577E501F1D47BD13889864663FAB2B8210360EBDF07A88B551F23BE14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 9cd4c9a0457cf324718b2d7d22577fdef16bd8d3b919657d26e6abf414de8632
MD5 ac4813cec5cdcced75fbcf27a296c1e4
SHA1 ae8eb2aae3e6d0399511b0f29eef1900861eeb5e
SHA512 f9cde23618eec947b98277a4120242ab2988db60ca22899e975f2e0a4b5eef1b62e1923208fe820075c7e385fb8b900879fd9d3dd82a1cd4f1212b2f97fd1f31
SSDEEP 24576:oPUr+NQdN94AMdTEvcQFuOjOP95Xdt5c:oJQL95MdTAcQQfjP+
TLSH
T1BC65E12F36DD18E5F676A17C89868219F772B8620712D2CF02E1817E4F27ED4BD39A14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 437613472b35efdd96d70f96c53b3322bd956402631575ae866f02c211d6ef95
MD5 e51fb3e89048d804ed445bb624d5c72e
SHA1 7a7078091777905c3ef92f8476d98064177819a5
SHA512 8cbfd7e770689fa64f25624cb44ed6eddc5635268c684b668272c4773cd99b46ab5c0736d8d4c6aa22322c5127accd43e43ea540f76741b1f104d4764d864e61
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj795MdTAcQQfjP+:DG05lO43b00xTQWj
TLSH
T17FD5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 853aadc7e9b6542251450575e12abb3ec5f9c2efafb7fc4c0cc33c503e63e951
MD5 255d99cdfacab46b96fa17fc8008615d
SHA1 b9a10fe4a781847e8d5d382faeaeb1a7bbd688ff
SHA512 40ad207f8494603c2984007589ff93d2440c85967350c3b0604ee6031f475a268fbd1e5eef8a818c97134bcee5628ad35e5330d7af3b621b77f50ab1c8c4600e
SSDEEP 24576:kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnnN94AMdTEvcQFuOjOP95Xdt5c:8a5POZ3+Jt2pasx2+mz95MdTAcQQfjP+
TLSH
T14D65AF5EA6EC01D5D5B9D17DC583861AF5B1342253319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 72e235bc0b7bebc35144bfddfb88d64f515b2c2e46417c8f93c9d3775177ba54
MD5 ed91745acf1e3ee3977a893a30470695
SHA1 c5374a8fefd56a5151d4045f3072ce5670f08d78
SHA512 999e0dad0e17ed59917f9080a0702f992378355eeb1539b0e5a240e39aa2f6d6e64f3b1ca1f48329fca344286e10c32fef3d601cdc0eac4a48ba61b0b590c641
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7FkJN94AMdTEvcQFuOjOP95Xdt5c:dNc/zEOVHFS95MdTAcQQfjP+
TLSH
T1ED857B2623E901E4F1BBE1BE89779546FA71786517308ACF0291851F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e90b68b28f563e974d4793bf8a1e69c7d01edf53f0966780b5da860f627b69ed
MD5 cd86d5f877f9fe74095b2ed64bfcc3ac
SHA1 374de5a6255320e440d6712524bc39e1360b08ce
SHA512 9d376a4dc43bd52a4c041ee335af803dfa7db5b46606f4b87eda50d27a05fdbf35a6b6d47499897a6dcecf3ccfb19a88fc05913c2cfb037cc1ab71288011196f
SSDEEP 24576:Q8kNvNnaFeYhJNtmZBmrN94AMdTEvcQFuOjOP95Xdt5c:Q8MwBtOm595MdTAcQQfjP+
TLSH
T15755AF6E7AA846E4D1FAC6B4CD238512EA727861073293CF5390C13F4E279D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 dd6a866e38404a13f711ec2a2d885d668fe9a3583b1b9843b58540aae959b5a7
MD5 b1c452726a4aa28cce855b25a0ad99b7
SHA1 e3a7ddd785baa28808dedb564322dbe48816f347
SHA512 4ffe0f7c4f4fdb33d8b496a84423da101277a7d632a670f1b62e69fbf04b11b692f7673c9d0afb900af2341b5162b55dfd564fb46972999234c25cd812ebe867
SSDEEP 24576:GD3FHshBIYQgA8N94AMdTEvcQFuOjOP95Xdt5c:GDVHeBIAAE95MdTAcQQfjP+
TLSH
T1EA75E17DEB9C00E4E57BD1BCCA638506E77138A9072256CB02D481BA5F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1628-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1628-96-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1628-15-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1628-24-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1796-64-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1796-58-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1796-188-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1796-57-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1864-70-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/1864-76-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/1864-222-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1864-68-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2960-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2960-128-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2960-122-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2960-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2960-133-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3140-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3140-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3140-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3140-138-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3224-848-0x00007FFF49880000-0x00007FFF49E0E000-memory.dmp

Download

memory/3428-264-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3428-91-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3428-84-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3428-326-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3428-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3428-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3732-9460-0x00007FFF45D10000-0x00007FFF4629E000-memory.dmp

Download

memory/3944-7-0x0000000000B20000-0x0000000000B87000-memory.dmp

Download

memory/3944-6-0x0000000000B20000-0x0000000000B87000-memory.dmp

Download

memory/3944-2-0x0000000000B20000-0x0000000000B87000-memory.dmp

Download

memory/3944-0-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/3944-83-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4448-42-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4448-53-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/4448-55-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4448-49-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/4448-43-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/5404-80-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5404-245-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5624-104-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5624-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5624-98-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5624-279-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5624-288-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5624-291-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5656-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5656-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5656-299-0x0000000002FB0000-0x000000000324E000-memory.dmp

Download

memory/5656-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5656-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6020-293-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6020-117-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6020-111-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6020-109-0x0000000140000000-0x000000014027D000-memory.dmp

Download