Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/10/2026, 16:14

General

  • Target
    2026-10-27_f1479e04871f164583c02fdd0145b179_dark-comet_darkgate_elex_gcleaner_glassworm_magniber_remcos_stop.exe
  • Size 17.8MB
  • Sample261028-tp4l8ass2m
  • SHA256 5e73d0428ebeda0ff1f1edfdd07551140435fbdfa947ad26e94072628007c0e9
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • xred

C2
  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Family: Xred

    Xred is backdoor written in Delphi.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in Program Files directory 2 IoCs
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-27_f1479e04871f164583c02fdd0145b179_dark-comet_darkgate_elex_gcleaner_glassworm_magniber_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-27_f1479e04871f164583c02fdd0145b179_dark-comet_darkgate_elex_gcleaner_glassworm_magniber_remcos_stop.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3164
    • C:\Users\Admin\AppData\Local\Temp\._cache_2026-10-27_f1479e04871f164583c02fdd0145b179_dark-comet_darkgate_elex_gcleaner_glassworm_magniber_remcos_stop.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2026-10-27_f1479e04871f164583c02fdd0145b179_dark-comet_darkgate_elex_gcleaner_glassworm_magniber_remcos_stop.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Drops file in Program Files directory
      • Direct Volume Access: Opens a physical disk for reading
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:4688
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:252
  • C:\ProgramData\Synaptics\Synaptics.exe
    C:\ProgramData\Synaptics\Synaptics.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1100
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:5000

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        360AblumViewer.exe

        • Path C:\Program Files (x86)\360\360zip\360AblumViewer.exe
        • Size 2.9MB
        • SHA256 542823fff6e85107ffc93dd40f5bab1eef4a6283adb8e958b37ab4c46ebedb7a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360AblumViewer.ini

        • Path C:\Program Files (x86)\360\360zip\360AblumViewer.ini
        • Size 22KB
        • SHA256 42debade657490554a4341bb50e4acd0c2462ba2f826f8e6936e9a678b33bcae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360Base.dll

        • Path C:\Program Files (x86)\360\360zip\360Base.dll
        • Size 765KB
        • SHA256 df47563f588d6c3cc4a7aab373adef0a2f99d2d0735cda4915d1baeb7e7eb3ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360Common.dll

        • Path C:\Program Files (x86)\360\360zip\360Common.dll
        • Size 511KB
        • SHA256 04af0d72b83ef8372b282ba4b0aa21b36b74954b80bda1b6cf2b84a13f4107f5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360Conf.dll

        • Path C:\Program Files (x86)\360\360zip\360Conf.dll
        • Size 294KB
        • SHA256 885aa4f58297382396717563137d212fbcb4299f95426c40c43abcdcecf54246
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360DeskAna.exe

        • Path C:\Program Files (x86)\360\360zip\360DeskAna.exe
        • Size 226KB
        • SHA256 cdb92949d31bd356646c2d446d21a6c521e72e27b27c2d8cffc9e5931bef5b5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360DeskAna64.exe

        • Path C:\Program Files (x86)\360\360zip\360DeskAna64.exe
        • Size 226KB
        • SHA256 d210bea886fe8fd53be7ac15b39115f9fcb346958c9ae0f93caa27ed35570cf6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360ExtLoader.exe

        • Path C:\Program Files (x86)\360\360zip\360ExtLoader.exe
        • Size 502KB
        • SHA256 61d2258a87a2d3cde2f9b3bb067a14bc99421cd51c452a3ba47276d6df89ecf5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360FileChecker.exe

        • Path C:\Program Files (x86)\360\360zip\360FileChecker.exe
        • Size 445KB
        • SHA256 2692939b640e41300fb54f8f31a2faf1b5c09e025cb08033bce6dd0d9020d6bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360ImageDecode.dll

        • Path C:\Program Files (x86)\360\360zip\360ImageDecode.dll
        • Size 1.4MB
        • SHA256 0c32df910f368011fbfcb50e2c7fa148ac658c1fc45398a8b1849beb753fbeb1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360NetBase.dll

        • Path C:\Program Files (x86)\360\360zip\360NetBase.dll
        • Size 1.4MB
        • SHA256 cc12e5e770c1dd04c3fb550af900caf7e8ab0fae530450694c84734075e50e40
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360NetUL.dll

        • Path C:\Program Files (x86)\360\360zip\360NetUL.dll
        • Size 239KB
        • SHA256 e692bb1cabb48bd7652f7fcc17c10f0c421304677128e199347ca54c75340ce5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360P2SP.dll

        • Path C:\Program Files (x86)\360\360zip\360P2SP.dll
        • Size 691KB
        • SHA256 090d9b8cf0aeeafec638c1a0c869ecb4d56233fb9561129f2acbc34a2ef471c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360Util.dll

        • Path C:\Program Files (x86)\360\360zip\360Util.dll
        • Size 696KB
        • SHA256 212cb6f25ea457e098587ed07dacca08d3c251d461846767039fb169157f6c73
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360ZipChrome.exe

        • Path C:\Program Files (x86)\360\360zip\360ZipChrome.exe
        • Size 597KB
        • SHA256 59872aad8689fe8ceb7b578914ef3a84bd5cdc1bfaf7077e779984e652237e56
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360ZipExtInstaller.exe

        • Path C:\Program Files (x86)\360\360zip\360ZipExtInstaller.exe
        • Size 186KB
        • SHA256 fc59ba49499b0f4664dd4ff4e0e791c6000eade5cf2ec5986f2216b71da9205a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360ZipExtPackage.msix

        • Path C:\Program Files (x86)\360\360zip\360ZipExtPackage.msix
        • Size 32KB
        • SHA256 be58b0eb21c9a4d575e377bf46d0582f53ef5ce684146d53d34b3cbf1d00ef55
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360ZipMgrTray.exe

        • Path C:\Program Files (x86)\360\360zip\360ZipMgrTray.exe
        • Size 540KB
        • SHA256 6c6988c653b68b47fa13a5039e25c663b16c89d0ee086e963548ab241ba61207
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360ZipSandbox.exe

        • Path C:\Program Files (x86)\360\360zip\360ZipSandbox.exe
        • Size 516KB
        • SHA256 5cf3c02cce4006faf3af6146953415b1d79a4502f6c0c4c08c78e22922319972
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360net.dll

        • Path C:\Program Files (x86)\360\360zip\360net.dll
        • Size 478KB
        • SHA256 b674719b87562da677d8ebccc8829a5cf8ec5822ac65a49ed4ed441a919017a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360verify.dll

        • Path C:\Program Files (x86)\360\360zip\360verify.dll
        • Size 104KB
        • SHA256 ad06ba38f929be5d3527c2003f3fb44a457d77e4ad136c75b559f84d1d366ee5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360zip.exe

        • Path C:\Program Files (x86)\360\360zip\360zip.exe
        • Size 2.4MB
        • SHA256 d32a9a64dbcaea3bdb9b1f371dc7123427104a5bfd86bb263c46da2d85c77ebb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360zip.sfx

        • Path C:\Program Files (x86)\360\360zip\360zip.sfx
        • Size 431KB
        • SHA256 179b874362fdd6d4461e6e5704f7f273e4cc0d4936d4a9787eaa52f7753c3a99
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360zipExt.dll

        • Path C:\Program Files (x86)\360\360zip\360zipExt.dll
        • Size 698KB
        • SHA256 27182a2fc94552780b7128db7f7462da51419bb8b6b0e3e332ab2b83f2571fe1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360zipExt64.dll

        • Path C:\Program Files (x86)\360\360zip\360zipExt64.dll
        • Size 906KB
        • SHA256 74c385728cbd55b5a4ba43fcb84708a9cdc9add9abf2776effe1f7a70a9d3215
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360zipExtW11.dll

        • Path C:\Program Files (x86)\360\360zip\360zipExtW11.dll
        • Size 938KB
        • SHA256 ec5e27fb5b2139b5d4028377f3c31b66f2369423596cadd987fe35f1382263cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360zipInst.exe

        • Path C:\Program Files (x86)\360\360zip\360zipInst.exe
        • Size 2.7MB
        • SHA256 c920cf546739de6731aa628a391fad7c35b198fdc61a40c9046aa6edb646b0c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360zipPluginMgr.dll

        • Path C:\Program Files (x86)\360\360zip\360zipPluginMgr.dll
        • Size 233KB
        • SHA256 46e5ca7a70bc341e408282ae260f57a302e10f9b9e54904f413c2b48dbf4a318
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360zipUpdate.exe

        • Path C:\Program Files (x86)\360\360zip\360zipUpdate.exe
        • Size 730KB
        • SHA256 3cc23d1f314ee4b0f304e0aa32ba884a8f7170d555e6ea7e0241a9abe2127dba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360zipc.dll

        • Path C:\Program Files (x86)\360\360zip\360zipc.dll
        • Size 796KB
        • SHA256 88e920f6a6b42446ae720f47d7063bf63d2369b19c34a5fd7fba04722d3ece55
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360zipver.dll

        • Path C:\Program Files (x86)\360\360zip\360zipver.dll
        • Size 18KB
        • SHA256 5a16822fd0a3deb338605037fe0e49fb68fd1650b474355420f411a318dfc45c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360压缩官网.url

        • Path C:\Program Files (x86)\360\360zip\360压缩官网.url
        • Size 164B
        • SHA256 602a8969fd04598c38c25d16c56322a41727213706e4e85124e12544a43f1a00
        • MD5 SHA1 SHA512 TLSH

        Square150x150Logo.scale-100.png

        • Path C:\Program Files (x86)\360\360zip\Assets\Square150x150Logo.scale-100.png
        • Size 4KB
        • SHA256 58d8b9e6c5081324d5d830f24ee01a247b1e46b90b2f54eb597e589df79156d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Square44x44Logo.altform-lightunplated_targetsize-16.png

        • Path C:\Program Files (x86)\360\360zip\Assets\Square44x44Logo.altform-lightunplated_targetsize-16.png
        • Size 526B
        • SHA256 5d3ddad2d4ad91500eae99370196fcd996ec4f1006a6f2a9c0d30cea6149d991
        • MD5 SHA1 SHA512 TLSH

        Square44x44Logo.altform-lightunplated_targetsize-24.png

        • Path C:\Program Files (x86)\360\360zip\Assets\Square44x44Logo.altform-lightunplated_targetsize-24.png
        • Size 908B
        • SHA256 8db89d221ab2c549884c66dcc16944739c90077241b95c3fb4b00c9c36e63313
        • MD5 SHA1 SHA512 TLSH

        Square44x44Logo.altform-lightunplated_targetsize-32.png

        • Path C:\Program Files (x86)\360\360zip\Assets\Square44x44Logo.altform-lightunplated_targetsize-32.png
        • Size 1KB
        • SHA256 74dc878d5bf8f0cfdf8ef016fcd473c476c36163d4bb8847a250eb59a3f327ee
        • MD5 SHA1 SHA512 TLSH

        Square44x44Logo.altform-lightunplated_targetsize-48.png

        • Path C:\Program Files (x86)\360\360zip\Assets\Square44x44Logo.altform-lightunplated_targetsize-48.png
        • Size 3KB
        • SHA256 2af735ae280235aebf2897289a403a5190b5577cecb89fde7f42821fc6556627
        • MD5 SHA1 SHA512 TLSH

        StoreLogo.scale-100.png

        • Path C:\Program Files (x86)\360\360zip\Assets\StoreLogo.scale-100.png
        • Size 3KB
        • SHA256 4fdb9d97d8f859eecbd66bec2ec0e929de4b7a2e5d5ba915e987f946b1578bb7
        • MD5 SHA1 SHA512 TLSH

        BAPI.dll

        • Path C:\Program Files (x86)\360\360zip\BAPI.dll
        • Size 248KB
        • SHA256 5b0175f57e6fd913be4b94f3e37d62422fae2590320d6df830515cd744efcb25
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CleanUtils.dll

        • Path C:\Program Files (x86)\360\360zip\CleanUtils.dll
        • Size 1.6MB
        • SHA256 05e8949d7895f684181f456c09884399f53e47424d66ed6000137a0f13667c9e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CrashReport.dll

        • Path C:\Program Files (x86)\360\360zip\CrashReport.dll
        • Size 170KB
        • SHA256 07ed1d3443e7f9b2531aaa0b957a298ea6c5c81bcd321e7faf25a17a85063169
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DumpUper.exe

        • Path C:\Program Files (x86)\360\360zip\DumpUper.exe
        • Size 426KB
        • SHA256 4b32c723b0457c4bed72b48343f84cb1e8c6a834c6d17326a3a268f1786dd2c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DumpUper.ini

        • Path C:\Program Files (x86)\360\360zip\DumpUper.ini
        • Size 167B
        • SHA256 d77efb81ad7aaaaa12ff7f300a02845d5b0247401da47d8af8caf7f184b74b1d
        • MD5 SHA1 SHA512 TLSH

        EncodeHelper.dll

        • Path C:\Program Files (x86)\360\360zip\EncodeHelper.dll
        • Size 210KB
        • SHA256 8052090162710a671cdc7a81b11ba0e1f5792fcadc783a23833013dc94126801
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IEFile.ico

        • Path C:\Program Files (x86)\360\360zip\IEFile.ico
        • Size 24KB
        • SHA256 bf39218aa16f6fa8760f805b96a8b0c31ef23c2dbd77740e944aba26b24f5164
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ImageHandle.dll

        • Path C:\Program Files (x86)\360\360zip\ImageHandle.dll
        • Size 837KB
        • SHA256 9a41e6bfae2e0094341a2bd1027a214f9b24a8df69b3886cc99cd08867fad335
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KitTip.dll

        • Path C:\Program Files (x86)\360\360zip\KitTip.dll
        • Size 913KB
        • SHA256 1b0029ba50a3a99724d0a26f73d790525314d14044c9dc8f6e69a6184c5703d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LiveUpd360.dll

        • Path C:\Program Files (x86)\360\360zip\LiveUpd360.dll
        • Size 631KB
        • SHA256 d5df8134cf83e317b45771551b88b49fd9f0c65f24dd043b8e403e971ace38a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LiveUpdate360.exe

        • Path C:\Program Files (x86)\360\360zip\LiveUpdate360.exe
        • Size 910KB
        • SHA256 a5312b85a4783124a6512ceb4eafd364ac0414d7543146ddf525ad89dcf0a269
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LockKrnl.dll

        • Path C:\Program Files (x86)\360\360zip\LockKrnl.dll
        • Size 600KB
        • SHA256 e639272efbf92096e16cfe533466b9abfb36d976b7adab7ac353430b63b4c22a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MiniUI.dll

        • Path C:\Program Files (x86)\360\360zip\MiniUI.dll
        • Size 923KB
        • SHA256 69ed9c1032e6f7f43f21f2cc7d7f8aa92e27342f14ef2a77b22535662270d8aa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MultiMediaOpt.exe

        • Path C:\Program Files (x86)\360\360zip\MultiMediaOpt.exe
        • Size 703KB
        • SHA256 70a4912d17ffb37fe3ed74c0d42e02656e52759f0ad7c6c561dba8dcc4f039ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PDown.dll

        • Path C:\Program Files (x86)\360\360zip\PDown.dll
        • Size 246KB
        • SHA256 ab5ed6a806b827f85327471812569761ec2d7392e9993d30441eb8ff2120a7ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        S360.ini

        • Path C:\Program Files (x86)\360\360zip\S360.ini
        • Size 78B
        • SHA256 c7740c4df8045af0dbd4ed7437a119287d3c63412eeeca7b517657ae9ea3551d
        • MD5 SHA1 SHA512 TLSH

        Safelive.dll

        • Path C:\Program Files (x86)\360\360zip\Safelive.dll
        • Size 445KB
        • SHA256 3312e5eda4515208d044d48fecdfe2e18db6dc7695d54f9cf2ed8dd89417b768
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SodaDownloader.exe

        • Path C:\Program Files (x86)\360\360zip\SodaDownloader.exe
        • Size 1.5MB
        • SHA256 5c5380d9aef0da67c52ca71f867c21d4336ad6b2dfb0c0e4b06c3b9001ca5628
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.ico

        • Path C:\Program Files (x86)\360\360zip\Uninstall.ico
        • Size 53KB
        • SHA256 e4a5ce7da3e9b7ee395d5731af1cc79297fa5781c23de1302fc34c680e01b97a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstaller.exe

        • Path C:\Program Files (x86)\360\360zip\Uninstaller.exe
        • Size 626KB
        • SHA256 1f459d306c317e304fa80b2dce54a061993c682f87ef719800b5119e91807720
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WICLoader.dll

        • Path C:\Program Files (x86)\360\360zip\WICLoader.dll
        • Size 88KB
        • SHA256 edfbe03ca5b315d5ff913224d7450978d9c93213c301e350ca91bc9f9912c123
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cloudcom2.dll

        • Path C:\Program Files (x86)\360\360zip\cloudcom2.dll
        • Size 1.3MB
        • SHA256 2f022ecbdecc367bc070bf9a76f5cc84970067d495e55a563ab25fb995631bdd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        config.xml

        • Path C:\Program Files (x86)\360\360zip\config\config.xml
        • Size 3KB
        • SHA256 4d8ce759afa09ef93fbe42b3f27028572497f4b3a6de86aaa83d92eec0e3eccc
        • MD5 SHA1 SHA512 TLSH

        MiniUI.xml

        • Path C:\Program Files (x86)\360\360zip\config\defaultskin\MiniUI.xml
        • Size 8KB
        • SHA256 6cbb4d0c5918e0d193b3ccee73b19a698d789dd98283acbed7ea4094428ca968
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Skin.jpg

        • Path C:\Program Files (x86)\360\360zip\config\defaultskin\Skin.jpg
        • Size 1KB
        • SHA256 c3283eaeba5db93fd5a4f6ef457080c86822bc7b51a85284f46c98e1e6c45338
        • MD5 SHA1 SHA512 TLSH

        defaultskin.ui

        • Path C:\Program Files (x86)\360\360zip\config\defaultskin\defaultskin.ui
        • Size 282KB
        • SHA256 80ab0b023867f517b21286b49b3c0c3546c115f086acd6bb1cb0ae65eeabedf2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        filechecker.ui

        • Path C:\Program Files (x86)\360\360zip\config\filechecker\filechecker.ui
        • Size 11KB
        • SHA256 b2cc3a90049df74b21ba9e643cf72239d3dc784b6fce3173efd160ee3fbd02a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zMiniUI.xml

        • Path C:\Program Files (x86)\360\360zip\config\filechecker\zMiniUI.xml
        • Size 2KB
        • SHA256 579cfd4811acb9d3157b413a20a6607f920119c19d97a985600fea6e49417d39
        • MD5 SHA1 SHA512 TLSH

        multimedia.ui

        • Path C:\Program Files (x86)\360\360zip\config\multimedia\multimedia.ui
        • Size 25KB
        • SHA256 c8cd793c87f944b41b66aa6e47ca3033dd1c65bfae4a4ec73cd80d5be484ac71
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zMiniUI.xml

        • Path C:\Program Files (x86)\360\360zip\config\multimedia\zMiniUI.xml
        • Size 2KB
        • SHA256 c9f9bbe369ff64b25f8b4b4c1351578a488e237841ba56084504bcd5aa43f796
        • MD5 SHA1 SHA512 TLSH

        zMiniUI.xml

        • Path C:\Program Files (x86)\360\360zip\config\zclassic\zMiniUI.xml
        • Size 4KB
        • SHA256 9d71e8245962f8dbab2d76c625c9c11116f5aeeae627a15e459de08bbebaac0f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zclassic.ui

        • Path C:\Program Files (x86)\360\360zip\config\zclassic\zclassic.ui
        • Size 101KB
        • SHA256 d95fc9c33785365c1def82629670ceb74396267e982bc9c8ff622f5f115ebdf4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        skin1.jpg

        • Path C:\Program Files (x86)\360\360zip\config\zcomment\skin\skin1.jpg
        • Size 19KB
        • SHA256 dc75fdcdada93e82ea23c4e7f5481c77208325804824c574cc6f7591e4044ada
        • MD5 SHA1 SHA512 SSDEEP TLSH

        skin2.jpg

        • Path C:\Program Files (x86)\360\360zip\config\zcomment\skin\skin2.jpg
        • Size 101KB
        • SHA256 d73fa1136d46266c7a2b5e418e1adec9281b0e42caa7741040cb7db8f7274d4e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        skin3.jpg

        • Path C:\Program Files (x86)\360\360zip\config\zcomment\skin\skin3.jpg
        • Size 44KB
        • SHA256 29efa2aa564cef96e5f2dd64279a6697a681f066443091d320f2b59642bb7010
        • MD5 SHA1 SHA512 SSDEEP TLSH

        skin4.jpg

        • Path C:\Program Files (x86)\360\360zip\config\zcomment\skin\skin4.jpg
        • Size 30KB
        • SHA256 c25380d366fd95c625c77b0b6025f13ff6a4d2717e6e1660c07c0b086a38d79b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        skin5.jpg

        • Path C:\Program Files (x86)\360\360zip\config\zcomment\skin\skin5.jpg
        • Size 64KB
        • SHA256 2ef010c2074cd0f5a21133ae532fe9b81639db00b6646e1d6121c3fe41d361a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        template1.rtf

        • Path C:\Program Files (x86)\360\360zip\config\zcomment\template\template1.rtf
        • Size 591KB
        • SHA256 c9812cd6ff409783dfbda634fada8bc75a75585da7464564ee251322bc6087f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        template2.rtf

        • Path C:\Program Files (x86)\360\360zip\config\zcomment\template\template2.rtf
        • Size 554KB
        • SHA256 e98f1fbda90dee28cf6e3fd1229bef0ae7b2c18f1878b87fd54681e09ccde58a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        template3.rtf

        • Path C:\Program Files (x86)\360\360zip\config\zcomment\template\template3.rtf
        • Size 186KB
        • SHA256 17142f44fac293d44b1a620fd231dc68083757c7c5725a54b4064c2d66a0ae07
        • MD5 SHA1 SHA512 SSDEEP TLSH

        template4.rtf

        • Path C:\Program Files (x86)\360\360zip\config\zcomment\template\template4.rtf
        • Size 262KB
        • SHA256 5496bcaec92fcfe098c36149d4d4419bda84e8c10844ff366abba5eaf65ba728
        • MD5 SHA1 SHA512 SSDEEP TLSH

        template5.rtf

        • Path C:\Program Files (x86)\360\360zip\config\zcomment\template\template5.rtf
        • Size 119KB
        • SHA256 6f8b7b9a9e3887841d6c3aa408791c1fb89b62033d4aa41861f9ed79e11f998b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zconfig.xml

        • Path C:\Program Files (x86)\360\360zip\config\zconfig.xml
        • Size 786B
        • SHA256 a2d79ec6689988ee90255fe0c7f95875d85630038d911b1e9bee9e2426dfc244
        • MD5 SHA1 SHA512 TLSH

        zMiniUI.xml

        • Path C:\Program Files (x86)\360\360zip\config\zdefaultskin\zMiniUI.xml
        • Size 4KB
        • SHA256 318a89805a03b391556fa663cc52874198616063f854e3508e01f7f426a4afb7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zdefaultskin.ui

        • Path C:\Program Files (x86)\360\360zip\config\zdefaultskin\zdefaultskin.ui
        • Size 504KB
        • SHA256 2d5db3bdc76dd2544b8dc65a3da6a3f062d20069941f386b57df7856970445a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zMiniUI.xml

        • Path C:\Program Files (x86)\360\360zip\config\zwin10styleskin\zMiniUI.xml
        • Size 4KB
        • SHA256 eb7a797e166b9ac937cb6fa62cc28a1c035446046aecb475d78469dd4e1ed1cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zwin10styleskin.ui

        • Path C:\Program Files (x86)\360\360zip\config\zwin10styleskin\zwin10styleskin.ui
        • Size 311KB
        • SHA256 71edaad0bd45d90c1b45574c633d14b15bc1a5d0b910bf473479216b1dbd668d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cssdk.dll

        • Path C:\Program Files (x86)\360\360zip\cssdk.dll
        • Size 2.8MB
        • SHA256 da9cfb3c7268b3a9bef158d277012b2f8ff6f5d9d75a663814e6bc10cb1e202a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cssdk.exe

        • Path C:\Program Files (x86)\360\360zip\cssdk.exe
        • Size 1.4MB
        • SHA256 d0d8b0f95917b44332a91787e2332ecf90d5fb4e0936de8cce9956ab8d741d8c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fileassocx.dat

        • Path C:\Program Files (x86)\360\360zip\fileassocx.dat
        • Size 137KB
        • SHA256 e4eff67bbda413f848e2774709bbf38ebf76472be20afac374e5a780269f9a82
        • MD5 SHA1 SHA512 SSDEEP TLSH

        heavygate.dll

        • Path C:\Program Files (x86)\360\360zip\heavygate.dll
        • Size 530KB
        • SHA256 48576b671bd975e9ea9cc40e6c9ab1fc2c4ae5114ec59442086291d1c674c7d8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libZipSandbox.dll

        • Path C:\Program Files (x86)\360\360zip\libZipSandbox.dll
        • Size 771KB
        • SHA256 5816370b66dcc4d3901c3ff363c4e5527e1563f9095909046309cd9c67babbd6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        livep.dat

        • Path C:\Program Files (x86)\360\360zip\livep.dat
        • Size 3KB
        • SHA256 315dd044eab15b9122315e73f86294c4dff170e639be271f74e7960d84e6e627
        • MD5 SHA1 SHA512 TLSH

        rarnew.data

        • Path C:\Program Files (x86)\360\360zip\rarnew.data
        • Size 20B
        • SHA256 30cbdc8b7afd4e079e93f1666220080b31a9b177f4d94ddcc1e5555fb8821f41
        • MD5 SHA1 SHA512

        resource.config

        • Path C:\Program Files (x86)\360\360zip\resource.config
        • Size 12KB
        • SHA256 d53e652269b65a12122a7d11cbcfa5748f120e8622cd6cab07e5f576459bdbf0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        resources.pri

        • Path C:\Program Files (x86)\360\360zip\resources.pri
        • Size 2KB
        • SHA256 6a3192a5f56136aa7fb660fdd4702a868231f70bf5c63fc82ed6c9fc3945be20
        • MD5 SHA1 SHA512 TLSH

        textinfo.config

        • Path C:\Program Files (x86)\360\360zip\textinfo.config
        • Size 22KB
        • SHA256 fa527c914a57fabf56610f1e71a0f0b0715639382d1f1bd10654b7bf0c0c9005
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360ZipPdfView.exe

        • Path C:\Program Files (x86)\360\360zip\tools\360PdfView\360ZipPdfView.exe
        • Size 299KB
        • SHA256 4454e32eb7e22a51b775d5f2288c28359c7587ad3f0265a0e1725553fd139e46
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pdfcore.dll

        • Path C:\Program Files (x86)\360\360zip\tools\360PdfView\pdfcore.dll
        • Size 6.3MB
        • SHA256 051d2f7fa2956a7a0ef6060be5586626c89ca9650bf744a8ef544ac9b1798577
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360kantu.exe

        • Path C:\Program Files (x86)\360\360zip\tools\360kantu\360kantu.exe
        • Size 1.0MB
        • SHA256 aceb9d8d270714d07e91f7ef19d9d34297502828b0677635edde3486e768e412
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iSeeImage.dll

        • Path C:\Program Files (x86)\360\360zip\tools\360kantu\iSeeImage.dll
        • Size 934KB
        • SHA256 c4633d65e6933a0b9f1dcd651b96a4f62a049ccb6d2198c808ab9351e1ac460e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iSeeRAW.dll

        • Path C:\Program Files (x86)\360\360zip\tools\360kantu\iSeeRAW.dll
        • Size 276KB
        • SHA256 2ebfb5459aa3cce13e45d6e34167c7e794ce2e39f2745c9ac7d2ef89f29eec70
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bmp.ico

        • Path C:\Program Files (x86)\360\360zip\tools\360kantu\icon\bmp.ico
        • Size 7KB
        • SHA256 236cfcb64d0796dc56aa8f42012b1f1c5a348afc8493df4a3050f24dc40c2a18
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gif.ico

        • Path C:\Program Files (x86)\360\360zip\tools\360kantu\icon\gif.ico
        • Size 7KB
        • SHA256 09d2aa91943c2dc7fac6feefd20b48ebc815e09323ac6305deaffddaec6d6719
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jpg.ico

        • Path C:\Program Files (x86)\360\360zip\tools\360kantu\icon\jpg.ico
        • Size 7KB
        • SHA256 798abd202643664ac555365b1b0904a338c46740ac47df912e35a1bc056d0059
        • MD5 SHA1 SHA512 SSDEEP TLSH

        none.ico

        • Path C:\Program Files (x86)\360\360zip\tools\360kantu\icon\none.ico
        • Size 21KB
        • SHA256 29acfc7fa75b8cafdf1f2c4c323bebe4b93d5991bd291ade156699ae44751f57
        • MD5 SHA1 SHA512 SSDEEP TLSH

        png.ico

        • Path C:\Program Files (x86)\360\360zip\tools\360kantu\icon\png.ico
        • Size 7KB
        • SHA256 8d4bdcb7d2e44b6279339e55ebefc6b131bfae46aab9d14f1c43ecfae7334962
        • MD5 SHA1 SHA512 SSDEEP TLSH

        psd.ico

        • Path C:\Program Files (x86)\360\360zip\tools\360kantu\icon\psd.ico
        • Size 7KB
        • SHA256 f2b6c1c3cab6cb5f9fdc7a97c5cfd4a043b7b5c52ed21b0f1904fd91f6f47134
        • MD5 SHA1 SHA512 SSDEEP TLSH

        raw.ico

        • Path C:\Program Files (x86)\360\360zip\tools\360kantu\icon\raw.ico
        • Size 7KB
        • SHA256 f396c1ccf258f53d47e4cedceefe2fcf7d24dceb7d85976f55d25b7f284ab957
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tif.ico

        • Path C:\Program Files (x86)\360\360zip\tools\360kantu\icon\tif.ico
        • Size 7KB
        • SHA256 d63ebb78dd98487de1fe9f42bb962439fb98ef0d01000eccdabdec26b79a67ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360FeedBack.xml

        • Path C:\Program Files (x86)\360\360zip\utils\360FeedBack.xml
        • Size 6KB
        • SHA256 22e0a55b96f349450a4ab9f11029fa2bda55c5470c8c6acc8c2c3963520f91db
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360Feedback.exe

        • Path C:\Program Files (x86)\360\360zip\utils\360Feedback.exe
        • Size 509KB
        • SHA256 296f99c6264eaf3dc5766eab19f8e879c93dd5b89b2b4e1b1e8213ab55734fff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        360ScreenCapture.exe

        • Path C:\Program Files (x86)\360\360zip\utils\360ScreenCapture.exe
        • Size 569KB
        • SHA256 5fca0b5e4c93d6673bda6719639a763715d1eda40356ad48e6f50882faf813fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        feedback.ui

        • Path C:\Program Files (x86)\360\360zip\utils\feedback.ui
        • Size 93KB
        • SHA256 39b098bba140f20ea6a5d928e830a07e1456d43d37434d8b195ca024cf316dc3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        somkernl.dll

        • Path C:\Program Files (x86)\360\360zip\utils\somkernl.dll
        • Size 3.2MB
        • SHA256 235fb32d2cbd7c61e9a0ddf1a9693e6614bcc2654fc48bae65a2478797b43cdb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        webp.dll

        • Path C:\Program Files (x86)\360\360zip\webp.dll
        • Size 316KB
        • SHA256 18ceeace67068c086f1dfe79c5126762a045ca55efa89ae6b0fb2ae4be4f0e4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zipnew.data

        • Path C:\Program Files (x86)\360\360zip\zipnew.data
        • Size 22B
        • SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
        • MD5 SHA1 SHA512

        Synaptics.exe

        • Path C:\ProgramData\Synaptics\Synaptics.exe
        • Size 753KB
        • SHA256 2ffde3a81d675e3787cffbacf90f07df222f09403751fd82e49093d8e107723c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ._cache_2026-10-27_f1479e04871f164583c02fdd0145b179_dark-comet_darkgate_elex_gcleaner_glassworm_magniber_remcos_stop.exe

        • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-10-27_f1479e04871f164583c02fdd0145b179_dark-comet_darkgate_elex_gcleaner_glassworm_magniber_remcos_stop.exe
        • Size 17.0MB
        • SHA256 84e85e9213ce9569fc694108bf3f0ddba8a4d1290b2cc3f969a3fc7d6a4d7594
        • MD5 SHA1 SHA512 SSDEEP TLSH

        C3795E00

        • Path C:\Users\Admin\AppData\Local\Temp\C3795E00
        • Size 20KB
        • SHA256 b35f01e6400bdc09f0167998126c30aed77d5cb85cd68908ab420898c648c63d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lY3PVcL9.xlsm

        • Path C:\Users\Admin\AppData\Local\Temp\lY3PVcL9.xlsm
        • Size 17KB
        • SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        {D23E7409-3FB3-4152-A6CC-9BE8D3F7E716}.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\{D23E7409-3FB3-4152-A6CC-9BE8D3F7E716}.tmp
        • Size 1.8MB
        • SHA256 513f6c5f595c88822bb8b2bf316c5692a18150dd5b6eae053407a5b292ab4c9d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/252-1348-0x0000000000400000-0x00000000004C2000-memory.dmp

        memory/252-1417-0x0000000000400000-0x00000000004C2000-memory.dmp

        memory/252-1386-0x0000000000400000-0x00000000004C2000-memory.dmp

        memory/1100-135-0x0000000000400000-0x00000000004C2000-memory.dmp

        memory/3164-120-0x0000000000400000-0x00000000015C7000-memory.dmp

        memory/3164-1-0x00000000004A0000-0x00000000004A1000-memory.dmp

        memory/3164-0-0x0000000001850000-0x0000000001851000-memory.dmp

        memory/4688-64-0x000000006F090000-0x000000006F0A0000-memory.dmp

        memory/5000-1346-0x00007FF81EE90000-0x00007FF81EEA0000-memory.dmp

        memory/5000-1347-0x00007FF81EE90000-0x00007FF81EEA0000-memory.dmp

        memory/5000-1342-0x00007FF821880000-0x00007FF821890000-memory.dmp

        memory/5000-1343-0x00007FF821880000-0x00007FF821890000-memory.dmp

        memory/5000-1344-0x00007FF821880000-0x00007FF821890000-memory.dmp

        memory/5000-1345-0x00007FF821880000-0x00007FF821890000-memory.dmp

        memory/5000-1341-0x00007FF821880000-0x00007FF821890000-memory.dmp