Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/07/2026, 11:00
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
44 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
40 signatures
150 seconds
General
- Target 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
- Size 31.9MB
- Sample260723-m39bashp5x
- SHA256 0f63575601b324548192347de46b35fca6a9b2259f5aa1fc75c8d340a009d54b
- MD5 6977254ade4a02256db1dbae4da8e932
- SHA1 f2d84b4f515e74383213531ce21b7c2a68e89722
- SHA512 e24b6aa706c832ad9869bce2323e607a9d228b811259ba6064b9be9e522d6e745464755abfa2a1d5d590578f9cea76a9be452e44a81de7af214cc5425744cfbf
- SSDEEP 786432:ISU3iKG857SBE+7LU+HIqDYppZITGql23iIu3d:Ijy5E+7fHIq0ZIa/I3d
- TLSH T1D277330623B402ADFFEBC1768657C507D7B07C05163A8A5F41A46AB62F33B725E2E361
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 26 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 98 1996 wscript.exe 99 1996 wscript.exe 109 1996 wscript.exe 122 1996 wscript.exe 125 1996 wscript.exe 129 1996 wscript.exe 151 1996 wscript.exe 153 1996 wscript.exe 157 1996 wscript.exe 160 1996 wscript.exe 165 1360 WScript.exe 166 1996 wscript.exe 173 1360 WScript.exe 174 1360 WScript.exe 176 1360 WScript.exe 177 1996 wscript.exe 178 1360 WScript.exe 182 1360 WScript.exe 183 1360 WScript.exe 184 1996 wscript.exe 185 1360 WScript.exe 187 1360 WScript.exe 188 1360 WScript.exe 191 1996 wscript.exe 192 1360 WScript.exe 193 1360 WScript.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\GUBootStartup.sys StartupManager.exe - Uses Session Manager for persistence 2 TTPs 1 IoCs
Creates Session Manager registry key to run executable early in system boot.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a00200000000000 DiskDefrag.exe - Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation program6.exe Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation p1.bin Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation StartupManager.exe Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation Initialize.exe Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation setup.exe Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation Initialize.exe Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation Integrator.exe Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation p2.bin - Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.js WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dll.js WScript.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 46 IoCs
pid Process 4884 alg.exe 3712 DiagnosticsHub.StandardCollector.Service.exe 3560 fxssvc.exe 4404 elevation_service.exe 4580 elevation_service.exe 3024 maintenanceservice.exe 2204 msdtc.exe 4264 p1.bin 2420 p2.bin 2280 OSE.EXE 1584 setup.exe 1112 program6.exe 2844 gupsetup.exe 1580 GUAssistComSvc.exe 2516 statisticsinfo.exe 5012 DiskDefrag.exe 116 StartupManager.exe 4832 GUBootService.exe 4372 GUPMService.exe 1264 procmgr.exe 1436 MemfilesService.exe 2752 GUBootService.exe 2360 GUPMService.exe 5040 GUBootStartup.sys 3308 MemfilesService.exe 4848 Initialize.exe 4052 GUBootService.exe 3148 Initialize.exe 5124 Integrator.exe 2764 autoupdate.exe 5280 PerceptionSimulationService.exe 5620 perfhost.exe 772 locator.exe 5888 SensorDataService.exe 2312 snmptrap.exe 4128 spectrum.exe 5988 ssh-agent.exe 6076 TieringEngineService.exe 3260 AgentService.exe 5968 vds.exe 5208 vssvc.exe 2696 wbengine.exe 6128 WmiApSrv.exe 4928 SearchIndexer.exe 5272 GUPMService.exe 756 GUBootService.exe - Loads dropped DLL 64 IoCs
pid Process 2844 gupsetup.exe 2844 gupsetup.exe 2844 gupsetup.exe 2844 gupsetup.exe 2192 regsvr32.exe 3164 regsvr32.exe 3824 regsvr32.exe 3308 regsvr32.exe 2844 gupsetup.exe 5012 DiskDefrag.exe 5012 DiskDefrag.exe 5012 DiskDefrag.exe 5012 DiskDefrag.exe 5012 DiskDefrag.exe 5012 DiskDefrag.exe 5012 DiskDefrag.exe 5012 DiskDefrag.exe 5012 DiskDefrag.exe 5012 DiskDefrag.exe 5012 DiskDefrag.exe 2516 statisticsinfo.exe 2516 statisticsinfo.exe 116 StartupManager.exe 116 StartupManager.exe 116 StartupManager.exe 116 StartupManager.exe 116 StartupManager.exe 116 StartupManager.exe 116 StartupManager.exe 116 StartupManager.exe 116 StartupManager.exe 116 StartupManager.exe 116 StartupManager.exe 116 StartupManager.exe 116 StartupManager.exe 116 StartupManager.exe 116 StartupManager.exe 116 StartupManager.exe 116 StartupManager.exe 1264 procmgr.exe 1264 procmgr.exe 1264 procmgr.exe 1264 procmgr.exe 1264 procmgr.exe 1264 procmgr.exe 1264 procmgr.exe 1264 procmgr.exe 1264 procmgr.exe 1436 MemfilesService.exe 1436 MemfilesService.exe 2844 gupsetup.exe 3308 MemfilesService.exe 3308 MemfilesService.exe 4848 Initialize.exe 4848 Initialize.exe 4848 Initialize.exe 4848 Initialize.exe 4848 Initialize.exe 4848 Initialize.exe 4848 Initialize.exe 4848 Initialize.exe 4848 Initialize.exe 4848 Initialize.exe 4848 Initialize.exe - Modifies system executable filetype association 2 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\lnkfile\shellex regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\lnkfile\shellex\ regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\lnkfile\shellex regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\lnkfile\shellex\ regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Glary Utilities regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Glary Utilities\ = "{B3C418F8-922B-4faf-915E-59BC14448CF7}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\lnkfile\shellex\ContextMenuHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Glary Utilities regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Glary Utilities\ = "{B3C418F8-922B-4faf-915E-59BC14448CF7}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\lnkfile\shellex\ContextMenuHandlers regsvr32.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" InfDefaultInstall.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\win.js\"" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\win.js\"" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\win.js\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\win.js\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dfl = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\dfl.vbs\"" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Z6Z5V5KKEJ = "\"C:\\Users\\Admin\\AppData\\Roaming\\dll.js\"" WScript.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA procmgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Integrator.exe -
pid Process 4980 powershell.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: DiskDefrag.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 97 ip-api.com - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 DiskDefrag.exe - AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1072-10-0x0000000140000000-0x0000000141FEA000-memory.dmp autoit_exe behavioral1/memory/1072-232-0x0000000140000000-0x0000000141FEA000-memory.dmp autoit_exe - Drops file in System32 directory 32 IoCs
description ioc Process File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\spectrum.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\52dacb42d44b5a9.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 1360 WScript.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Glary Utilities\skins\default\main\skins\skins_slider_front.png gupsetup.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Glary Utilities\languages\French(ReActif-Korrected).lng gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\Native\win7_x64\BootDefragDriver.sys gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\EmptyFolderFinder\toolbar.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\Register\active_normal.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\Register\InnerBuyRSS\English\js\jquery.js gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\Icons\ico_browser_default.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\languages\Estonian.lng gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\FileUndelete\uncheckhovert.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\PortableMaker\background.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\ov_img_license_user.png gupsetup.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Glary Utilities\Integrator.exe gupsetup.exe File opened for modification C:\Program Files (x86)\Glary Utilities\GUPMService.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe elevation_service.exe File created C:\Program Files (x86)\Glary Utilities\languages\french2.lng gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\main_tab_icon_files_selected.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\x64\msvcp90.dll gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\dupefinder.exe gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\DiskDefrag\btn_disabled.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\logo-gu.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\main_menu_hover.png.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\ov_icon_check_erase_pro.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\GridMap.ocx gupsetup.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Glary Utilities\languages\Francais (ReActif).lng gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\DiskDefrag\toolbar.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\ProcessManager\useful_default.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\Icons\ico_fileencrypter.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\Icons\ico_regdefrag_click.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\about\line.png gupsetup.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File created C:\Program Files (x86)\Glary Utilities\languages\lithuanian.lng gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\oc_cancel.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\about\home-default.png gupsetup.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\Register\about\feedback-default.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\Icons\ico_checkdisk_hover.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\Icons\ico_undochanges_hover.png gupsetup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File created C:\Program Files (x86)\Glary Utilities\ScanFile.dll gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\SoftwareUpdate.exe gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\languages\Catala.lng gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\ProcessManager\RClickMenu.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\ProcessManager\skin.ini gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\StartupManager\add-hover.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\Icons\ico_systemrestore_hover.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\menu\menu-bj.png gupsetup.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Glary Utilities\OneClickMaintenance.exe gupsetup.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Glary Utilities\Native\wxp_x86\RegBootDefrag.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Glary Utilities\AutoUpdate.exe gupsetup.exe File opened for modification C:\Program Files (x86)\Glary Utilities\OneClickMaintenance.exe elevation_service.exe File created C:\Program Files (x86)\Glary Utilities\x64ProcessAssist.dll gupsetup.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4168 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 39 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Initialize.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUBootService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wermgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language autoupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUBootService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language grpconv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Integrator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUPMService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language runonce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DiskDefrag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUBootService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InfDefaultInstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gupsetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUPMService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUBootService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SchTasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language program6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language statisticsinfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language procmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StartupManager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUPMService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Initialize.exe - NSIS installer 4 IoCs
resource yara_rule behavioral1/files/0x000700000002468f-872.dat nsis_installer_1 behavioral1/files/0x000700000002468f-872.dat nsis_installer_2 behavioral1/files/0x0007000000024a60-1868.dat nsis_installer_1 behavioral1/files/0x0007000000024a60-1868.dat nsis_installer_2 - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe - Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wermgr.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz wermgr.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU wermgr.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007293eac6921add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080d020c5921add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000446fe0c4921add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000801e10c5921add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e62f7c5921add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fc391c4921add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061f8e9c4921add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\TypeLib regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\*\shellex\ContextMenuHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31FB3410-EA8B-4931-91C5-ADA7B91D953B}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GUAssistComSvc.GUShellLink\ = "GUShellLink Class" GUAssistComSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GUBootService.SessionStartup.1\ = "SessionStartup Class" GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EADB8774-D17B-45F0-B661-8AA411CC2D15}\1.0\FLAGS GUPMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EADB8774-D17B-45F0-B661-8AA411CC2D15}\1.0\0 GUPMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GUBootService.BootService.1\ = "BootService Class" GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GU.Splitted\ = "Glary Utilities Splitted File" gupsetup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\TypeLib\ = "{B52C0F28-8D4C-4886-965C-0A772490064E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Glary Utilities regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CB4B4EAB-4ABB-4702-BB38-E3A1A1D5D67D} GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A9299FDE-3941-4C37-949C-630BEBCA9BB9} GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GUBootService.BootService.1\CLSID\ = "{E2DA46AF-A5CD-47A5-B345-7764100E3F97}" GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GU.Encrypted\Shell\Open\Command\ = "C:\\Program Files (x86)\\Glary Utilities\\fileencrypt.exe -d %1" gupsetup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GUAssistComSvc.EXE GUAssistComSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3DA5E31D-E553-4525-8AC5-EBD92B29A408}\1.0 GUAssistComSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GUBootService.BootService\CurVer GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2DA46AF-A5CD-47A5-B345-7764100E3F97}\TypeLib\ = "{A9299FDE-3941-4C37-949C-630BEBCA9BB9}" GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC9859D6-F6D3-4DD5-B0B2-FD2130EC36AC}\ProxyStubClsid32 GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CB4B4EAB-4ABB-4702-BB38-E3A1A1D5D67D}\LocalService = "GUBootService" GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Glary Utilities\\x64" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A805009D-B902-439A-8E64-26EE3507A12E}\ = "ContextHandler" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\InprocServer32\ = "C:\\Program Files (x86)\\Glary Utilities\\ContextHandler.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D6544943-452E-404F-9B94-93E27E656D85}\LocalServer32 GUAssistComSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F10E0193-E389-4E51-BDD8-D3DAF5F63851}\TypeLib\ = "{3DA5E31D-E553-4525-8AC5-EBD92B29A408}" GUAssistComSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\0\win64\ = "C:\\Program Files (x86)\\Glary Utilities\\x64\\ContextHandler.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71F03427-4342-4D6F-B71A-C7320428EFEE}\ = "SessionStartup Class" GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71F03427-4342-4D6F-B71A-C7320428EFEE}\VersionIndependentProgID\ = "GUBootService.SessionStartup" GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31FB3410-EA8B-4931-91C5-ADA7B91D953B}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\VersionIndependentProgID\ = "ContextHandler.CContextMenu" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GUAssistComSvc.GUShellLink GUAssistComSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CB4B4EAB-4ABB-4702-BB38-E3A1A1D5D67D}\ = "GUBootService" GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A9299FDE-3941-4C37-949C-630BEBCA9BB9}\1.0\FLAGS GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DED4F83E-5A2C-4971-AA04-E57134816579}\TypeLib\ = "{A9299FDE-3941-4C37-949C-630BEBCA9BB9}" GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EADB8774-D17B-45F0-B661-8AA411CC2D15}\1.0\FLAGS\ = "0" GUPMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{35AE4004-4194-4243-92AA-351BB7239539}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\Control\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ContextHandler.CContextMenu regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A9299FDE-3941-4C37-949C-630BEBCA9BB9}\1.0\FLAGS\ = "0" GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EADB8774-D17B-45F0-B661-8AA411CC2D15}\1.0\0\win32\ = "C:\\Program Files (x86)\\Glary Utilities\\GUPMService.exe" GUPMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2DA46AF-A5CD-47A5-B345-7764100E3F97}\LocalServer32 GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31FB3410-EA8B-4931-91C5-ADA7B91D953B}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Glary Utilities\ = "{B3C418F8-922B-4faf-915E-59BC14448CF7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GUAssistComSvc.GUShellLink\CLSID\ = "{D6544943-452E-404F-9B94-93E27E656D85}" GUAssistComSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F10E0193-E389-4E51-BDD8-D3DAF5F63851}\TypeLib GUAssistComSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DED4F83E-5A2C-4971-AA04-E57134816579}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{35AE4004-4194-4243-92AA-351BB7239539}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{35AE4004-4194-4243-92AA-351BB7239539}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31FB3410-EA8B-4931-91C5-ADA7B91D953B}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ContextHandler.DLL\AppID = "{A805009D-B902-439A-8E64-26EE3507A12E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\ProgID\ = "ContextHandler.CContextMenu.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F10E0193-E389-4E51-BDD8-D3DAF5F63851}\TypeLib\Version = "1.0" GUAssistComSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GUAssistComSvc.EXE\AppID = "{0BCB705C-0F64-405B-8CB3-CDF41B796E19}" GUAssistComSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GUBootService.SessionStartup\CLSID\ = "{71F03427-4342-4D6F-B71A-C7320428EFEE}" GUBootService.exe - Runs net.exe
- Script User-Agent 12 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 182 5C8734CEqiQqiNothingqiQqiVGXMSUXFqiQqiAdminqiQqiMicrosoft Windows 10 ProqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi HTTP User-Agent header 187 5C8734CEqiQqiNothingqiQqiVGXMSUXFqiQqiAdminqiQqiMicrosoft Windows 10 ProqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi HTTP User-Agent header 188 5C8734CEqiQqiNothingqiQqiVGXMSUXFqiQqiAdminqiQqiMicrosoft Windows 10 ProqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi HTTP User-Agent header 193 5C8734CEqiQqiNothingqiQqiVGXMSUXFqiQqiAdminqiQqiMicrosoft Windows 10 ProqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi HTTP User-Agent header 173 5C8734CEqiQqiNothingqiQqiVGXMSUXFqiQqiAdminqiQqiMicrosoft Windows 10 ProqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi HTTP User-Agent header 178 5C8734CEqiQqiNothingqiQqiVGXMSUXFqiQqiAdminqiQqiMicrosoft Windows 10 ProqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi HTTP User-Agent header 183 5C8734CEqiQqiNothingqiQqiVGXMSUXFqiQqiAdminqiQqiMicrosoft Windows 10 ProqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi HTTP User-Agent header 185 5C8734CEqiQqiNothingqiQqiVGXMSUXFqiQqiAdminqiQqiMicrosoft Windows 10 ProqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi HTTP User-Agent header 192 5C8734CEqiQqiNothingqiQqiVGXMSUXFqiQqiAdminqiQqiMicrosoft Windows 10 ProqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi HTTP User-Agent header 165 5C8734CEqiQqiNothingqiQqiVGXMSUXFqiQqiAdminqiQqiMicrosoft Windows 10 ProqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi HTTP User-Agent header 174 5C8734CEqiQqiNothingqiQqiVGXMSUXFqiQqiAdminqiQqiMicrosoft Windows 10 ProqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi HTTP User-Agent header 176 5C8734CEqiQqiNothingqiQqiVGXMSUXFqiQqiAdminqiQqiMicrosoft Windows 10 ProqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi - Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 4980 powershell.exe 2844 gupsetup.exe 2844 gupsetup.exe 4980 powershell.exe 3712 DiagnosticsHub.StandardCollector.Service.exe 3712 DiagnosticsHub.StandardCollector.Service.exe 3712 DiagnosticsHub.StandardCollector.Service.exe 3712 DiagnosticsHub.StandardCollector.Service.exe 3712 DiagnosticsHub.StandardCollector.Service.exe 3712 DiagnosticsHub.StandardCollector.Service.exe 3712 DiagnosticsHub.StandardCollector.Service.exe 4848 Initialize.exe 4848 Initialize.exe 3148 Initialize.exe 3148 Initialize.exe 3148 Initialize.exe 3148 Initialize.exe 3148 Initialize.exe 3148 Initialize.exe 4264 p1.bin 4264 p1.bin 5272 GUPMService.exe 5272 GUPMService.exe 5272 GUPMService.exe 5272 GUPMService.exe 5272 GUPMService.exe 5272 GUPMService.exe 5272 GUPMService.exe 4404 elevation_service.exe 4404 elevation_service.exe 4404 elevation_service.exe 4404 elevation_service.exe 4404 elevation_service.exe 4404 elevation_service.exe 4404 elevation_service.exe 5272 GUPMService.exe 5272 GUPMService.exe 5272 GUPMService.exe 5272 GUPMService.exe 5272 GUPMService.exe 5272 GUPMService.exe 5272 GUPMService.exe 5272 GUPMService.exe 5272 GUPMService.exe 5272 GUPMService.exe 5272 GUPMService.exe 5272 GUPMService.exe - Suspicious behavior: LoadsDriver 4 IoCs
pid Process 668 Process not Found 668 Process not Found 668 Process not Found 668 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1072 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe Token: SeAuditPrivilege 3560 fxssvc.exe Token: SeDebugPrivilege 4980 powershell.exe Token: SeDebugPrivilege 5012 DiskDefrag.exe Token: SeDebugPrivilege 3712 DiagnosticsHub.StandardCollector.Service.exe Token: SeDebugPrivilege 116 StartupManager.exe Token: SeDebugPrivilege 1264 procmgr.exe Token: SeDebugPrivilege 1264 procmgr.exe Token: SeDebugPrivilege 1436 MemfilesService.exe Token: SeDebugPrivilege 3308 MemfilesService.exe Token: SeDebugPrivilege 4848 Initialize.exe Token: SeDebugPrivilege 4848 Initialize.exe Token: SeDebugPrivilege 4848 Initialize.exe Token: SeBackupPrivilege 3308 MemfilesService.exe Token: SeDebugPrivilege 4848 Initialize.exe Token: SeDebugPrivilege 3148 Initialize.exe Token: SeDebugPrivilege 3148 Initialize.exe Token: SeDebugPrivilege 3148 Initialize.exe Token: SeDebugPrivilege 3148 Initialize.exe Token: SeDebugPrivilege 4264 p1.bin Token: SeDebugPrivilege 5124 Integrator.exe Token: SeDebugPrivilege 5124 Integrator.exe Token: SeDebugPrivilege 5124 Integrator.exe Token: SeDebugPrivilege 5124 Integrator.exe Token: SeRestorePrivilege 5124 Integrator.exe Token: SeBackupPrivilege 5124 Integrator.exe Token: SeDebugPrivilege 2764 autoupdate.exe Token: SeTakeOwnershipPrivilege 4404 elevation_service.exe Token: SeRestorePrivilege 6076 TieringEngineService.exe Token: SeManageVolumePrivilege 6076 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3260 AgentService.exe Token: SeBackupPrivilege 5208 vssvc.exe Token: SeRestorePrivilege 5208 vssvc.exe Token: SeAuditPrivilege 5208 vssvc.exe Token: SeBackupPrivilege 2696 wbengine.exe Token: SeRestorePrivilege 2696 wbengine.exe Token: SeSecurityPrivilege 2696 wbengine.exe Token: SeTcbPrivilege 756 GUBootService.exe Token: SeBackupPrivilege 756 GUBootService.exe Token: SeSecurityPrivilege 756 GUBootService.exe Token: SeSecurityPrivilege 756 GUBootService.exe Token: SeSecurityPrivilege 756 GUBootService.exe Token: SeSecurityPrivilege 756 GUBootService.exe Token: 33 4928 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4928 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4928 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4928 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4928 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4928 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4928 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4928 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4928 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4928 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4928 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4928 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4928 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4928 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4928 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4928 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4928 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4928 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4928 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4928 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4928 SearchIndexer.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1584 setup.exe 5124 Integrator.exe 5124 Integrator.exe 1584 setup.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1584 setup.exe 5124 Integrator.exe 5124 Integrator.exe 1584 setup.exe - Suspicious use of SetWindowsHookEx 32 IoCs
pid Process 2844 gupsetup.exe 1580 GUAssistComSvc.exe 2516 statisticsinfo.exe 5012 DiskDefrag.exe 5012 DiskDefrag.exe 116 StartupManager.exe 116 StartupManager.exe 4832 GUBootService.exe 4372 GUPMService.exe 1264 procmgr.exe 1264 procmgr.exe 1264 procmgr.exe 1436 MemfilesService.exe 1436 MemfilesService.exe 3308 MemfilesService.exe 3308 MemfilesService.exe 3308 MemfilesService.exe 4848 Initialize.exe 4848 Initialize.exe 4052 GUBootService.exe 3308 MemfilesService.exe 3308 MemfilesService.exe 3148 Initialize.exe 3308 MemfilesService.exe 3308 MemfilesService.exe 3308 MemfilesService.exe 5124 Integrator.exe 5124 Integrator.exe 5124 Integrator.exe 5124 Integrator.exe 2764 autoupdate.exe 3308 MemfilesService.exe - Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1072 wrote to memory of 4264 1072 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 93 PID 1072 wrote to memory of 2420 1072 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 94 PID 2420 wrote to memory of 1584 2420 p2.bin 96 PID 4264 wrote to memory of 1112 4264 p1.bin 99 PID 1112 wrote to memory of 2844 1112 program6.exe 100 PID 1584 wrote to memory of 4168 1584 setup.exe 101 PID 2844 wrote to memory of 3948 2844 gupsetup.exe 103 PID 3948 wrote to memory of 3476 3948 net.exe 107 PID 4168 wrote to memory of 4980 4168 cmd.exe 108 PID 2844 wrote to memory of 2980 2844 gupsetup.exe 109 PID 2980 wrote to memory of 3304 2980 net.exe 111 PID 2844 wrote to memory of 2192 2844 gupsetup.exe 117 PID 2844 wrote to memory of 3164 2844 gupsetup.exe 118 PID 3164 wrote to memory of 3824 3164 regsvr32.exe 119 PID 2844 wrote to memory of 3308 2844 gupsetup.exe 140 PID 2844 wrote to memory of 1580 2844 gupsetup.exe 121 PID 2844 wrote to memory of 2516 2844 gupsetup.exe 122 PID 2844 wrote to memory of 5012 2844 gupsetup.exe 123 PID 2844 wrote to memory of 116 2844 gupsetup.exe 125 PID 116 wrote to memory of 4832 116 StartupManager.exe 126 PID 2844 wrote to memory of 4372 2844 gupsetup.exe 127 PID 2844 wrote to memory of 1264 2844 gupsetup.exe 128 PID 2844 wrote to memory of 1436 2844 gupsetup.exe 132 PID 2844 wrote to memory of 632 2844 gupsetup.exe 134 PID 632 wrote to memory of 2584 632 net.exe 139 PID 2844 wrote to memory of 4848 2844 gupsetup.exe 142 PID 4848 wrote to memory of 4052 4848 Initialize.exe 146 PID 2844 wrote to memory of 2616 2844 gupsetup.exe 147 PID 1112 wrote to memory of 5180 1112 program6.exe 150 PID 5180 wrote to memory of 5316 5180 InfDefaultInstall.exe 151 PID 5316 wrote to memory of 5460 5316 runonce.exe 153 PID 1584 wrote to memory of 4232 1584 setup.exe 158 PID 1584 wrote to memory of 3036 1584 setup.exe 159 PID 3036 wrote to memory of 1996 3036 WScript.exe 160 PID 4980 wrote to memory of 4220 4980 powershell.exe 162 PID 3148 wrote to memory of 5124 3148 Initialize.exe 164 PID 5124 wrote to memory of 2764 5124 Integrator.exe 165 PID 4928 wrote to memory of 5616 4928 SearchIndexer.exe 184 PID 4928 wrote to memory of 1884 4928 SearchIndexer.exe 185 PID 1584 wrote to memory of 1360 1584 setup.exe 186 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\wrk\p1.binC:\Users\Admin\AppData\Local\Temp\wrk\p1.bin2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\SilentALL\program6.exe"C:\Users\Admin\AppData\Local\Temp\SilentALL\program6.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\gupsetup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\gupsetup.exe" /S4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\net.exenet stop GUPMService5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop GUPMService6⤵
- System Location Discovery: System Language Discovery
PID:3476
-
-
-
C:\Windows\SysWOW64\net.exenet stop GUMemfilesService5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop GUMemfilesService6⤵
- System Location Discovery: System Language Discovery
PID:3304
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Glary Utilities\GridMap.ocx"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2192
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Glary Utilities\x64\ContextHandler.dll"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Glary Utilities\x64\ContextHandler.dll"6⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Modifies registry class
PID:3824
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Glary Utilities\ContextHandler.dll"5⤵
- Loads dropped DLL
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3308
-
-
C:\Program Files (x86)\Glary Utilities\x64\GUAssistComSvc.exe"C:\Program Files (x86)\Glary Utilities\x64\GUAssistComSvc.exe" /RegServer5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1580
-
-
C:\Users\Admin\AppData\Local\Temp\nsj1BC.tmp\statisticsinfo.exe"C:\Users\Admin\AppData\Local\Temp\nsj1BC.tmp\statisticsinfo.exe" /install /GU5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2516
-
-
C:\Program Files (x86)\Glary Utilities\DiskDefrag.exe"C:\Program Files (x86)\Glary Utilities\DiskDefrag.exe" -InstallNative5⤵
- Uses Session Manager for persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5012
-
-
C:\Program Files (x86)\Glary Utilities\StartupManager.exe"C:\Program Files (x86)\Glary Utilities\StartupManager.exe" -install5⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe"C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe" /Service6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4832
-
-
-
C:\Program Files (x86)\Glary Utilities\GUPMService.exe"C:\Program Files (x86)\Glary Utilities\GUPMService.exe" /Service5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4372
-
-
C:\Program Files (x86)\Glary Utilities\procmgr.exe"C:\Program Files (x86)\Glary Utilities\procmgr.exe" -guupdate5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1264
-
-
C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe"C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe" -RegServer5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1436
-
-
C:\Windows\SysWOW64\net.exenet start GUMemfilesService5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start GUMemfilesService6⤵
- System Location Discovery: System Language Discovery
PID:2584
-
-
-
C:\Program Files (x86)\Glary Utilities\Initialize.exe"C:\Program Files (x86)\Glary Utilities\Initialize.exe" /setupschedule /installinit productid=15 productname=Glary Utilities Pro5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe"C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe" /Service6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4052
-
-
-
C:\Windows\SysWOW64\SchTasks.exeSchTasks /Delete /TN GU5SkipUAC /F5⤵
- System Location Discovery: System Language Discovery
PID:2616
-
-
-
C:\Windows\SysWOW64\InfDefaultInstall.exe"C:\Windows\System32\InfDefaultInstall.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\register.inf"4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Windows\SysWOW64\runonce.exe"C:\Windows\system32\runonce.exe" -r5⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\System32\grpconv.exe" -o6⤵
- System Location Discovery: System Language Discovery
PID:5460
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\wrk\p2.binC:\Users\Admin\AppData\Local\Temp\wrk\p2.bin2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\ProgramData\setup.exe"C:\ProgramData\setup.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -windo 1 -noexit -exec bypass -file C:\Users\Public\Settings\A\News\win.ps14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windo 1 -noexit -exec bypass -file C:\Users\Public\Settings\A\News\win.ps15⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "4980" "2396" "1968" "2400" "0" "0" "1960" "0" "0" "0" "0" "0"6⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:4220
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\diag fix\scheduled\Maintenance\ShellNew\dfr\dll.js"4⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4232
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\diag fix\scheduled\Maintenance\Resources\Licenses\setup\win.js"4⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\win.js"5⤵
- Badlisted process makes network request
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1996
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\Adobe\AIR\Logs\gp\PerfLogs\Google\start\dfl.vbs"4⤵
- Badlisted process makes network request
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
PID:1360
-
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:4884
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3712
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4572
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3560
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4404
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4580
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3024
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2204
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2280
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f4 0x5081⤵PID:4760
-
C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe"C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2752
-
C:\Program Files (x86)\Glary Utilities\GUPMService.exe"C:\Program Files (x86)\Glary Utilities\GUPMService.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2360
-
C:\Windows\System32\drivers\GUBootStartup.sysC:\Windows\System32\drivers\GUBootStartup.sys1⤵
- Executes dropped EXE
PID:5040
-
C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe"C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe" -Svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3308
-
C:\Program Files (x86)\Glary Utilities\Initialize.exe"C:\Program Files (x86)\Glary Utilities\Initialize.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Program Files (x86)\Glary Utilities\Integrator.exe"C:\Program Files (x86)\Glary Utilities\Integrator.exe" /autostart2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Program Files (x86)\Glary Utilities\autoupdate.exe"C:\Program Files (x86)\Glary Utilities\autoupdate.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2764
-
-
-
C:\Windows\system32\grpconv.exegrpconv -o1⤵PID:5580
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5280
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5620
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:772
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5888
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2312
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4128
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5988
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:6008
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6076
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3260
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:5968
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5208
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:6128
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5616
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:1884
-
-
C:\Program Files (x86)\Glary Utilities\GUPMService.exe"C:\Program Files (x86)\Glary Utilities\GUPMService.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5272
-
C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe"C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:756
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\dll.js"1⤵PID:5512
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4JavaScript
1PowerShell
1Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Glary Utilities\BottDefrag.dll
- Size 52KB
- SHA256 5dccd2e7663466c6d9f9d16a916e6756229f338d753a4608a4a6cd50c3a0a0f1
- MD5 10df2bd435d20867b143fa7152a552be
- SHA1 5bdd84b4d5a8be328c1e92a323fd0c9287a819ea
- SHA512 7f83311bcb9d59effce0d97559ceef4b3ded7925b24e3b1cf44dd022ab7a663071af22bd48abc4fa1ab2c996a1bece84f589a1c2d3e430d68a0245028ca26748
- SSDEEP 768:Zr4pTFKe5PmCSbAhx/tpTbhtocc0/ofTOtVyXYi7ha5ALvYi79OP385ALXj:lITFKCRSivpTb7occ0qTOtVyX7f7YPL
- TLSH T19F337C93AB942893E93F6A3035D5672B5C7EF4A21BD140C7631B5BCC0EA22D1F1BC199
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\CheckUpdate.dll
- Size 1.1MB
- SHA256 cca6bdfb53bc3cf9582dd3a4bc6899d96e9e723fa364b2c023bc54e99106d2d1
- MD5 c2e9d24f1263bdd76cc6f76c0b8db549
- SHA1 867ad6ce3219911fddd5db121ce650b07d1e88ec
- SHA512 0c721a2574695d11ebc8961b02445d990d3b3d6cb0b407bf7651647dc7861b0cbff7afdd09727c0d2a8b152c35f1a49e4b2d14c1dd067713c972bbd46f372939
- SSDEEP 12288:JaCd374kDO8FXwOnYOoHw0Q2DLcM3Z/1dDmF2aJUBq9R5oI3:Jak374kDO8FAfOopD53ZneVJUq7oI3
- TLSH T1DB359E5576E0C570C9BA327518A1873867FBEC39C77422E7BEC83F6949312D25A3821B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\Config.dll
- Size 41KB
- SHA256 370c35c39a11b27fe87bc1821e4f32b6331bba2b62c4c9a94eb2fc72ef1917b6
- MD5 7057d703122f7fe6d5c9f25a67262a9f
- SHA1 becb32c942cb589f82ff02a12d5dd0b0fd5a70bc
- SHA512 0121fb620199ac0e1007d32931a13f8122e83a44bae4f87b33f22d2844f998a0a17e04a2b3c3568e3fce0668f0873fd365ede64505b1eca90741ab891f31996a
- SSDEEP 768:q8wORwVnjaz9P4nge57FOt3Q+Vm+WYi7JgZ5ALKAYi7J75ALyJ:q8wHnOz92ge57FOtfVm+W7yxA7DJ
- TLSH T142136B96DCA4C822DA2F093078E5D63659653D956FE1C0D33799C71E0BA03C329F91AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\ContextHandler.dll
- Size 142KB
- SHA256 06cb3f49149ad2f4db0943296e9d6b73d95801695b8665f23c673c72f4f91efb
- MD5 1056d66a5df0f4b157814a629413aca2
- SHA1 f6b5c8ef780c57ed2b5f43177339c0199e79dc09
- SHA512 98d6ff623b83ce84f6dfe005bc32bb63047c2d2ec0c430193682383927f1bef2530c078436a3966142ec8f3188438c1193e662730cdbffd1d542598d3bd9fd41
- SSDEEP 3072:bC4zHkyBWdodneCsTVwtl045X6m2iskBFC:bC4zkyByodYJ0l02WeC
- TLSH T157E37C11BAA5C072C95F663858299329D77FFE508F6086C777183B2E8F703C19E3529A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\CrashReport.dll
- Size 300KB
- SHA256 c290e3f272fca3c0e7a7109b62ec763d486fd6ead29b8b5dc958e835087cb07f
- MD5 388d6c911e7095c0b63d462b1fd93984
- SHA1 59fcef414593b82451e01b607277bb3c33a5b813
- SHA512 6c7fa3f95563d1b2dd4929e8c08fba6d577ccc73f66f6a44bb99863793422c0b133285d69a9913f000123b78e12cd169046a6b6a067201f8094274f0ef3c851c
- SSDEEP 6144:KJ3KbqxdjkUe+wQ+Rm60lb/vtNJYb+QMd6wb2sj6pC:KhT1Bb/vtNJYb+QMd6wbBs
- TLSH T17F647B2176A0C432D9EB2534596F86796AEDBC305B60C1C7B7842F7D1E71AC16E3832B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\DiskDefrag.exe
- Size 998KB
- SHA256 525b17a1ba60e0190086c5273104986f9507c74ca6a7542220d6c682e47104fd
- MD5 a3abb8f4ab519cd13e43b48bcd410b01
- SHA1 7d54562a75b0387a0be7c789b2a78e99d8532c07
- SHA512 4b22434208043dfea6500169f7ca77fc551d7e2b39f98f2efaf030eabee54b0667788ab49c0e3bf9420e9768de5d7ee7e8f3db36a3736a73e44e677ac3b5690e
- SSDEEP 24576:TfpKTlPEpfH3sj+rAI+9J8vz7Qqg3zsIP:TmcpopfS9ggu
- TLSH T1E5256C11E78B80A7DD79233271AA772A552FB78B53504ACFD22E0F7A1D522C31C3A51B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\GUWndManager.dll
- Size 111KB
- SHA256 d9b69d819039e35bc460eb5aaf49da03a406e69001dab9fb2e4653ad35b760f0
- MD5 a591acb78db75843a0172ee71228f0fa
- SHA1 7621b4ce05f8ec738b3a4405c7cf3a0e8b014fee
- SHA512 026e179d8d64634498a17b6d28efb8951cdd0e085c292275c8060a2a04cd8dfe67f9418707f8a7fc8496a227cf3a66e491709d432d10ec8b4df136836ce70a17
- SSDEEP 3072:+rLxggRNF2MEf4EvuBU0dW/LmfIm2HmZnOtVndSPUF:+rtggfF2YRW/LmfWmZnOtV22
- TLSH T18FB38D40B7DA4171DE5F667C1498AB3AD737E252DFD00AC7BB284B8E0B941C26D39287
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\GridMap.ocx
- Size 161KB
- SHA256 65293604b2f7d9b9a9946724a1e0769ac4454453dfdb4ff491db1710e778159f
- MD5 0ac55e0d792e46c7d8638ffb001a4474
- SHA1 3b09248a427e6d81f5956f908690648a5cd83749
- SHA512 c736e71186ebe86eb0f8214ee82598e768e4b14968572736686a1fc8f7712c88f47b0dd270cf3080ed8528165945880f0712b5f3a5e2e542318b3cc11c53baca
- SSDEEP 3072:rDO5RDmuUOkl4oMWVayGNRRy8Couzy3OtUzARX7I+:f2UOkDtANnIouzy3OtUz4s+
- TLSH T192F34982FFC98572D99F167C28AB635D837B99909B1446C3F3542E4E6C602D36DB8383
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\Register.dll
- Size 596KB
- SHA256 7dad97e23b76c079bb6165a2d152b3f428f1dbdf3c766fcc1df091bfaa339365
- MD5 6c7355d4ffcced9f3d0dad8bbdd01787
- SHA1 78d2e883da8de4ea529533944f598a92323bbda6
- SHA512 706e9c4fee5fa7d6999f67741d2fc53d117ee5c7330638136fd281c8f4d5e0694a9bf12b3d8ee918b2f3067b78fc1898a58f92b487e83b6aa3e2d625a6a993fd
- SSDEEP 12288:ZpsiyNm3Y/isphv3cV3FQ/vP8+A0qlntgKmTMv4J:ZIph21hluKoMv4J
- TLSH T15CD47DC2A7898371D69E26B518EC6F0A903FB5C887BC4AD35364396F18322C36DB5747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\SkinsManager.dll
- Size 273KB
- SHA256 f3e9a31b06c41b0b544151fddb0bc735cfc100de8263b27ac2fbcf42b4b91d61
- MD5 ff33ccdd157ea8d6e67e22babfa4b16f
- SHA1 8ef628f77a67c87a9b2ca32414511d1b2ced17b3
- SHA512 21bceab2bbfe0f7dbf6163279e13591ef0dd14ef628156d4c1d69a7106bc725eb541ebd0ca04defe02e3a31579d29e10ce563044138b3cd65e27a3f8ae0d51b7
- SSDEEP 6144:qHGAZpd+36XPmL/D3z1L4vP0IytO0iwxlSO4:qH7MB/D3z1L4vP0IyQ0iuJ4
- TLSH T1D9548D107BD4C433C69F2535449BD77926FAB6715B61C2C7BB980E2E8E316C29E3834A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\data\backup.ini
- Size 3KB
- SHA256 726d3285a587967001e22d40b3cfb82627070366b27a3006fef01b25c2319ecb
- MD5 df3f77f52cba7e2776240236bc7138d6
- SHA1 f23bcc84a60abd92111fea397d773e2b9a70efd0
- SHA512 8a12c5b22be221481aab78098176f89732e1cc01d313c10370b5af95f712fe79b4c234cd27baa59dbfd62242335ed142f7b74e1a81e2a32d77d12d998579944c
- TLSH T1A481A14D6F0B583689077EB2700708A528AB17B663F09907EDDD7ACF2CD264F435E598
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Glary Utilities\dbghelp.dll
- Size 1020KB
- SHA256 dca9f45efed8eab442b491aebda3e3cce7f5f9fc5de527d2dbdfd85a5be85dfa
- MD5 74edbb03de3291fcf2094af1fb363f1d
- SHA1 16b5d948ed7843576781dc4f2a391607ac0120a4
- SHA512 b08eb03c54f25979c5aee745530ecd51c5761eb99871b867ff84e14590b32ef3247e17cf63bf953ee1efcb0fda8c4540191b9280db33359fdca352967e42b289
- SSDEEP 24576:YXm4cpDFYD2aC0jH5yrrXlpWrCSyZC0wLHr298TG00g8EAB4a:hpKD2aC0jH5yr7DWRyZlwH29vjDIa
- TLSH T1B1256C20E381823EDCEB10FA827D626D256CEA62071514C713D85EEEAB763E17E345D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\languages.dll
- Size 53KB
- SHA256 4ed99b01b61cd4da548ae44b06d646c86211896cabfdb521b5b84bf478f91fb0
- MD5 ddc3c3edab8d0f5ef2f7130a8a4716a9
- SHA1 2738cc5b8ac8682896d655b39d4fbd60222b3429
- SHA512 7939e96d10801be3c6f8eae63c05c305d124e1379cb09bf38f90de851fa804327edaf79e7cf4d9c0ab57f609b6dd53805deeae70ec0905d4c3e642442fb21fe1
- SSDEEP 768:X8sTiJOCCDk95IhiGu5xLWM2OK7bom9vYi75Co5ALdYi79PEt5ALy:XQknDk95IsnD2OKvom9v7Qp7CN
- TLSH T129336C528B4888F2DB4F627034D0A739997661503FD062D3A32B57EA0F773C1FA7A295
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\x64\ContextHandler.dll
- Size 91KB
- SHA256 fb0feadf021b5bf827b52f83d81333a08a48ea3adbd18efa901ab7d93be58a33
- MD5 f80cd76328913484c9169cac60f0776c
- SHA1 1971dd5b302c9c666b85789e3093f8cdddec2162
- SHA512 3d8240247ca11d2844cd8d5a0ff83ba42478cef0300721168aee9f66fd475d7a8f0068971690752876a5c3a6946aa5b3a2ca627f1c1e6d473f0f047aa2848c46
- SSDEEP 1536:gYo1JuCyDrd+esLdFLalpgJLArcRxOpq2fM7jE7rj:g7LKd+5dF2HcDOpqKMUr
- TLSH T1E9934A0AAB694051D162D578E9D78F56F2B2BC925F108BCF2222B71E0F733C15A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\x64\GUAssistComSvc.exe
- Size 149KB
- SHA256 894fbf335caaf0ab2f513b78e1e4350d1ba93abab2daaeb6954ca2c2c8670d80
- MD5 2be40cbdcf5e2dae6165aeafb13a968b
- SHA1 21dc59eeb0ccc2c2936822435f5b585f12e1e87e
- SHA512 187019a520877360852f1a20ccad705faac49ece6fa28c8c4e4ca436b4c05f9b5a3e0310a8ceffd5d8e071afc30bbd95b06b80b5a97883ad2a8c89781968a110
- SSDEEP 3072:xL6T8T2andt0l4wE1ZCD7CWkcWzJoPj5xdnm6xsXNIQ:g8T2arwwZCy5KPJm6DQ
- TLSH T19FE35B47B7A454FAC4669278CD924A45EBB3B8610B6087CF2324D35E6F337D16E3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\zlib1.dll
- Size 92KB
- SHA256 ecb1f550471c6bfb07c673bb1b05aef6b847e88fec380262b5ff168df5415651
- MD5 93e95f14035f38267693357aea64a5f1
- SHA1 6f859b95c39f6771a2db3e6ea8ed220fc5383de9
- SHA512 b01e05cd16c8e698635057e31ba8a5c9f375db0f44b81b4779ad161c465fa4b83347767cb9aa425ee2f4904a2fef20e1ba52793fbb836c7315e7c5c75b107c13
- SSDEEP 1536:ikCgJgBbAcqmHzDgd2+nToIfZIOjIOGix+73P6ye7:i0gaNmHzDgdXTBfzFGix+bBe
- TLSH T184939E538AD06B91DCB92E3460DA963DDF32B2490BEEC2D3348C6B515A013D5AB742CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 ac91974359dd98cf99a9f191b2fd9f776f432448ff74c515b27305d0ff734596
- MD5 2548a1bbd379564e2015f38dde040665
- SHA1 5bc58d3ff0d8e28ba3e4a83758eddb9f6a778b13
- SHA512 d384121ebf91ef01aa9f13101d38a128be6169067bca57b495ea8f449178de8b8465c339bdf6776024aa5e9143d2c94a1513f3dcce62e138a208652f2227b8e0
- SSDEEP 49152:jb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnLLNiXicJFFRGNzj3:B3q6mjBk7wRGpj3
- TLSH T13BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 a83137a1f682e2ac3ba0e78c554248621bb8fe3f550122656aabc9a148ea84ec
- MD5 cbbfdc8b8cda7d1548792bbb737166a3
- SHA1 23c72ba3202be457018393bb17154ae10a083697
- SHA512 0928fd2b2f83cf842ebed822fae776092ead954ff4fabcb20a8ad5d56e05e42b7fa338714d406f3d1b3bd19831793704ce3bc1b4b3c536a0dcec207d74535a1d
- SSDEEP 24576:+XYfDtczAo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dtc1LNiXicJFFRGNzj3
- TLSH T1E975012963D408F9EDBB813CC8A28411E6727C554760E7DB03A4A92A5F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 8165600ff832572c5a5a62c0ebdacbd3c62fcd850b54ec3d33f022e9f312b503
- MD5 db9ad278ae6c73816763be595e990efe
- SHA1 3d2e3d8a7579a04f7254d89776505dcf1554f6f8
- SHA512 7a0402bbb366a728d8abe7968afbaf71103ef0ad7e96348711c3651c784ebdde8c851f0244bd1a9a9a0fa2ddb10881635ff5048f327d270216b3f7de0b8c059c
- SSDEEP 24576:nwuROWF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nwSOyLNiXicJFFRGNzj3
- TLSH T1FB65F18632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 a7f7ef43927a8d309f119c3c1f559e70259c744a298a68736c5d801364b1e006
- MD5 464b85f4676dfb22ae91a5f8a9d76f12
- SHA1 ce33c5074f7273ade4c728ec26191c69b5c6ae04
- SHA512 b0848501858ac9dad80bbd8c05430c23a11371b4977a3d0b9dcc48449a7ac118e4cc9d6951cc52a25b321ed7af907898cdaccb5dd688f91da17d4490d39d0192
- SSDEEP 49152:VB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl4LNiXicJFFRGNzj3:bu6JmIxd2d47wRGpj3
- TLSH T166D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\AIR\Logs\gp\PerfLogs\Google\start\dfl.vbs
- Size 1.8MB
- SHA256 35894088d3d2cb2865ec5231784f67462c4509f0cf9fbacf8ec16999b72f7e31
- MD5 238c68a3e9b4c0209331471239d95e1a
- SHA1 f2a242c010e823d9d84d5b4a1dc8cd9e77f77f83
- SHA512 14ccb3c8453a9cd1f9d76402d68dff0ae4dd0d918581043090d80feb3bd3df451220d9958766fb60d24ef5a534c254ef559495c4c396e87eecf65787ecd41077
- SSDEEP 12288:wD5nBDSkt3NyxqjDHDoEcDFWIUQtbUd9kuqxKw2BD8HlulYdZRwQ9GoL71aCTv/q:S
- TLSH T19A854FF6AFD2E832B570D29AA048C960DD40C6F0CBB45452DC1751CE1EAF7075B8ABA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\diag fix\scheduled\Maintenance\Resources\Licenses\Settings\A\News\win.ps1
- Size 106KB
- SHA256 aa473b497f678fa03231fd55cd7c93467a26223f58f05581f59d4a81abd50152
- MD5 825db940f795e79799f96aff9de2e076
- SHA1 31e991b18e6f180e6f97439fad4561b88c802eed
- SHA512 ab4def662783717b4ab48a83991e3569d6bff2c0fd327d62adc5553e7e4e5e923645cad63ce3ae19ff0147ad29264c8e5705f7c6c84ae7ddb65c2e9713f3c970
- SSDEEP 768:o3n+xnbrb0aCfNXFmteyxUReuqNPFTRGtyHs63DnLQx+j5Rv8V/TSvsD4O2Aumd8:ou5tDkpVrDpHWt
- TLSH T16BB3FDB9DA39ECC0076C76D01AA7398A20B4A233477884A8EF500DCA7519F6EFF7555C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\diag fix\system\Audio\Prefetch\CL_LocalizationData.psd1
- Size 3KB
- SHA256 00a6c19fc0e6bc0d9da94c3ee1fa3628672ff8d2211d7d5ac8b297feb7aed670
- MD5 cbea3d1eb61aa13aebf97da2678e0313
- SHA1 e73f7d64283ac1c2eead94629ee8f21759c57cdb
- SHA512 7257b3c123e122e4815c1f3426dc4fc4c58439bda6fa03d70957690831f765fa79a63939e5b09e273a28d2b4d4f9dfbdf6620800f43d4f70aa6d2f4b4f496bd3
- TLSH T1F26155052EE8C03CF1F39F18D5A1D9131A6579DA5CE8A23C05A14D0D49E2B20CF6BBF6
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\diag fix\system\Audio\Prefetch\DiagPackage.dll.mui
- Size 9KB
- SHA256 b07cfffb57172a40a388f8f38817301c5b81a6a87a849b210e45eed60d0a36cf
- MD5 30a8c1af9bcf8bba0b6c380b25326b60
- SHA1 e236bebf7be0f573f73ab702e505613deeb1705b
- SHA512 519cbefb29826ab34bedbad89d6d3475674815bb74c203c3047a22e64f83216d3e0afc3e83c527f5e14fe4c42e4abd25a877d4b56f2cae70f990107b70159438
- SSDEEP 96:/v/dmzBrjs65GLo9navkBlvLokXpjQJtOsWg0JcWw6:/vY0Lo9avelzoOpjQJ5WriWN
- TLSH T1CE1279001EA9C53DF4A39B75C287C65392BD5467BCE9223F8A240F0915901348FABBFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\diag fix\system\Audio\ShellNew\CL_LocalizationData.psd1
- Size 3KB
- SHA256 82d59d69833c45c7b6a73b95bc2a878a59fdc849fd76aff21d8c268ee024d738
- MD5 f2b7c91f7928803c7af5fe964381fdce
- SHA1 bbac159d96eda1fffa346b6da6ac4d8c2f823aa1
- SHA512 33ffe010730689de30919475081de151f94fe519f45698cf818ed794ccdfdfad5a87f8e915018b67207461cc50b4218776d2ef229bb306bc8f18315ef99cefe9
- TLSH T11A61248663F80228F2F36F54A9B929640E76BCE6AC78D21C1291955E4CF2F50CDB1773
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\diag fix\system\Audio\ShellNew\DiagPackage.dll.mui
- Size 8KB
- SHA256 64eb9b75083ff881602ad48de5795e519c98de84029c2846bcfc857644a64c47
- MD5 c48e2806c002b63c4abe2eecd850a907
- SHA1 6022fedd0fc92a82ff708ffcd5cabd9e3d4a9e63
- SHA512 62e22d8a6ae47a30efe5692899fae7c7005811f3ba95eb6f88f54c5c1a176512e8a49713a49a8273f7784f03d05c79b53b8277ac97a0940af224d54ab4618201
- SSDEEP 96:gHd/0s6NN4HrNjuicyCrNurNZrd19ryrNzh2kjBA5ufrNZR5s337iMMl4LC9GJj9:g64d7mO4eHyWriWV
- TLSH T1F2F1CE41A3F94519F6FB6FB11EFA2A245A3AFCA6AD39C34D0650006D5872F51D8B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\setup.exe
- Size 1.0MB
- SHA256 d77941267af26274189629eea8956772005e55cadb228ac6df5f457f2beea462
- MD5 2a14a28c9937cef23341e8a8a5eaa64e
- SHA1 d6cf95791b318fe7811ddc07c901b37690517428
- SHA512 cec5758769f01705abb78db9d4951153481ae5e244b60131ce942cb5e568d7118af2ed6a6f0cdf3ef69590cb7e56243f89a669dc23e5271bde7ff46a95b57a37
- SSDEEP 24576:8bi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMdJRnYYYYYkYYYYYYY0YYYYYYYy:X/QMnl5YL7WzZyQRd7j
- TLSH T109357C52B7C3D1B2EE6215F2D47643721A39BC7517389CCBB3D4392ECAA22C0A679315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\gupsetup.exe
- Size 27.1MB
- SHA256 536111d3a430a66a37d5bf0b1f20d9d3d4e3de73e75bf41927c716a86c7c6949
- MD5 11f397c47b7a488c783620715c8b2776
- SHA1 4cb6f69f65750708fce5e79e2d5fdbdde138c3a6
- SHA512 ece5bbfdf776af25c704a2439ad841310d5b6bd09b47063e55d2cd3ca1e9acd9d36804b6247f1971698f1440cd2a51689ae799e098e8b74d264155c7c2531697
- SSDEEP 393216:zOrwwIdNdLjpjDUiuhMZXxJ9UodTm0J7DAOFDUDTcGwKfmgehED6w92VeCtY3VU4:z0wTNOOXxJ91TjJ7DAUDUDZmgSU2JtX4
- TLSH T1BA57333413D4A422D6B6C13E1E9B15EBA98B8F40AF4259416EC5BF1DEC33B12F19907B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SilentALL\program6.exe
- Size 27.3MB
- SHA256 0df89947dd84499aeb5804d39361c8a3aa0ddbf3c36e08220b3bf8a1763d2793
- MD5 44cf5b9bbc5eb61983bb69ebbda536eb
- SHA1 8b24c37dd70dc211ffdf8c5bd64fbd13e232a6c3
- SHA512 c9cff4cd62fb36fba47daa1f87a2268071fbc99310d742988fdb91941bccb584978d4da8fb6af9c206f60b8b27a5ceaec5d122f316df6e66482b7475b7ccd6ca
- SSDEEP 786432:TsPuXS9Jwd4NThHhGmvnZ8P07oS2KFZQ8s:TgJ9G4NTpomvnZ8PWfOt
- TLSH T1D357335BB681DD30C9F244B15E2011F876AE8CBC9AA845FB3BC73A91F1314D3B55AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dlnxe53g.rey.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsi2FF1.tmp\Inetc.dll
- Size 21KB
- SHA256 5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
- MD5 92ec4dd8c0ddd8c4305ae1684ab65fb0
- SHA1 d850013d582a62e502942f0dd282cc0c29c4310e
- SHA512 581351aef694f2489e1a0977ebca55c4d7268ca167127cefb217ed0d2098136c7eb433058469449f75be82b8e5d484c9e7b6cf0b32535063709272d7810ec651
- SSDEEP 384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
- TLSH T123A23B5253605FFEE3D71938B8B7773745EAE76464178A8F06732E8918B2352B930382
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsi2FF1.tmp\xtInfoPlugin.dll
- Size 160KB
- SHA256 6f12201a1c80198b9c9a6667c459c348230c587839a1f7b1133e14720b708aca
- MD5 8f358cfd9f9e30e64c536cd7dc5ce415
- SHA1 cbca484d99ce8da6badebfb507550974af821c21
- SHA512 14c69403c62ee82b5357980f0c76a4d9b80c7725790e0b9691a60394efc2787361f6b7dee83ca62f1b9ef6eae90bdf7d033b8c4ba6bacd51403187004b944c8a
- SSDEEP 3072:PKw+B2Ne6e9IhCiBOEM0X9FX/lChxkW0D7Fe:PTNe60Unce7Xoo
- TLSH T15DF36C0232E5C072E1FA623D0A629B2563BBBC64DEB187076750775E6E706C18D3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj1BC.tmp\KillProcDLL.dll
- Size 14KB
- SHA256 97b5b3985736cc0f49ceb2da68b01ce51fa821b6da3cec69cfeebfba8d626845
- MD5 2f8a43c3581af1f31ce8d9da0c03465b
- SHA1 3cce52e1dd53191127a98b324644c5cc581295ca
- SHA512 fd4ffab70048664c2f9aab375bb4c5cd89b3ff525335633dfd895dddf2be0791c56f585a9675f0a91be0d20882260709c847e0c8757e0fb49f80a932b187eab2
- SSDEEP 384:9WzZ97P5I3SlAS/5191BUrR17ziXPgKrdqr:97s6lz
- TLSH T1CD5208EBF513F0F2C54785F605A2FEBF4A3D3412482A8839EA98F4309D1B5DAA55500A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj1BC.tmp\MachineCode.dll
- Size 346KB
- SHA256 5d8cba3088d8f47655aeeee607842f680cdadcc40a076ea0785b7380a3808098
- MD5 b72f3c584af95c041fa9dbad2cdfbbad
- SHA1 9856ab340de2a817784d646b5fed2564f3a9d584
- SHA512 89bff99376b996dbee5a8c7f5412ec78c86b94591e84a9df3b381cf5725073ffa28a0d30eeeeb36c249d4c4368b91bf0354971d3010853a3281be2fd74222ac3
- SSDEEP 6144:o48L4/dXZ6yHiwCgKjaH0/LAo3jslcVx6cvY0obyDUrreN90UZbr8jn:o4Z/dcyHi8tH0jd4K6SYA/8jn
- TLSH T133748C00B641C036E66F257559AA877D26ADBD600BA0C2C3FBD46E7E5F312D27E3424B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj1BC.tmp\System.dll
- Size 11KB
- SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- MD5 fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
- TLSH T116326D5503504AF3E996863C00263B7FAF796A2095F14D53CFA394C0FE2E5C9AD38352
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj1BC.tmp\nsExec.dll
- Size 6KB
- SHA256 114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1
- MD5 09c2e27c626d6f33018b8a34d3d98cb6
- SHA1 8d6bf50218c8f201f06ecf98ca73b74752a2e453
- SHA512 883454bef7b6de86d53af790755ae624f756b48b23970f865558ba03a5aecfa8d15f14700e92b3c51546e738c93e53dc50b8a45f79ef3f00aa84382853440954
- SSDEEP 96:pBNUBGfVwhcAlhPRJAixx+3eDEsgcBbcB/NFyVOHd0+uisX4:qBGfV5AlJJfFgcBbcB/N8Ved0P
- TLSH T136D1D63B6AD029F3D0498930286779368BF988360F614210EFAB19E535E5DEBDA20647
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj1BC.tmp\statisticsinfo.exe
- Size 147KB
- SHA256 9f9aefcc2c546d11820c11a133a5d418ed90f1b27d51d18909fe55daca96f9ff
- MD5 f5d25f625cd85d01914a218e1d2a35d9
- SHA1 6681842a3d7d024d745cfb1865d06307ce726d15
- SHA512 dc7299676e939c2ce25d306e8833366c46d40d19a93419d14c4a71a9fb48f35629a504d1e004eb6cd0c119c321cac3f3268f43cafc4d3cf585e85eccac73791a
- SSDEEP 3072:+f1BDZ0kVB67Duw9AMccpo1iyWI2UDT9PefR5GDr2bLqC/qslNOtWEhJGNvKLf:+9X0GytyZXZsR8uHqCOtWgr
- TLSH T19CE3F12705A0AC57CDA30BB03DF95B3BEFB2A64551D487C3634886647F923C2175E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wrk\p1.bin
- Size 29.1MB
- SHA256 c5ba9b469be810ec60da26b9e5790434e8bbe7696f4c7dcb273863322a75409b
- MD5 fb5ee1d9451f911b3e8efe4706b0a670
- SHA1 5eb65b2fd85e80a38b2a0a6b3e85b324a28813f6
- SHA512 e286c2d7be4034f681b183da7d7e0aff3ea219d038c2e75e465b922284f63cfc2b06e666c34261ba9718ba032fc3365503958a6c97d871cc4c38fdcb14d6d25a
- SSDEEP 786432:asPuXS9Jwd4NThHhGmvnZ8P07oS2KFZQ8:agJ9G4NTpomvnZ8PWfO
- TLSH T16467338B6680FE70CCF585B15D2C12F8769F9C7C85A845BB3ECB3E9094315E2A056B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wrk\p2.bin
- Size 1.5MB
- SHA256 d6ce07877fe84f598a57dc22dca72cbd0bb9122d65b6941246ecaf809c137580
- MD5 4006bc6b72c962f6c0064129b80ec6bc
- SHA1 b36131acf14bfc2f6d5514558376f8ae7e8d29a6
- SHA512 43213c0d5f7716b38ec0c7b3362590dd3121c82fde63e7aaa8d48543eaee0d06813b508824f3628b6c224adf765b3c817c0a68fa8af75b8e67043e23588e67da
- SSDEEP 49152:o6xcx0y3Y8VKtoCLW0mGG5OyN3z9OX3h35xs0xnxV2B/azQQ8qGgY:o6IhVKtlW5E3+gY
- TLSH T16275E009E3A415ADD5B3A170DE52C925E7337C591BB1D28F03EC79A72F336908A39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~autoupdate.dat
- Size 184B
- SHA256 cec146ac085eef3bc664960115958ca370477b2c72a2cf29d6e7a8ad054712fe
- MD5 cd5f805ee8e53b4616d87dd41ce799e3
- SHA1 b0d1d7fc38455a25661c94f9f186343f7ea83861
- SHA512 72f5a361531364e04f1b337289653a0ce134ef05f229c201aa018ae059dacb85cf0b23632236a4ea8562cc70743c00b3c1aa0b19d45707379691f8a80ed60eb7
- TLSH T1A2C08C21114580CD12225A5E34F8F65F2291C441C248F7E4E31C77E42A2AA8A65CA3EC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dll.js
- Size 61KB
- SHA256 d6e7cb1c4bf89c7a125790dd91fb9c5580f60cf40083db5bd1c4182cf96f2ddd
- MD5 5a4416c39032a2e64cd47250140e465b
- SHA1 7303a9ae377944ff644a229e78069aca6d804ff9
- SHA512 231e847ca487b99958b7a0456047aeed403049746a1f3a00bdcfa1581ba05d6d29d0210a08c0baeb78ac449929974f9fcd418bd026d521bed7196d4db0c3a1b8
- SSDEEP 384:nGePIjj9pbaSnBigJDZT9B5gpB2M5r8lvueDrUqhf+A2a/rnR1Gmt4qLnouEv961:nPPqBspwMl8lv9p+AzNrtB6Nw
- TLSH T19A534C3CEDE7012FA1A9C9D6A5D50143743A779F632D6F890085C3E50B9374AEC6AC2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\GUTracksIni.tmp
- Size 204KB
- SHA256 f76eaf824ef2e3c80c7186dab37d213e82f17388145171d12ec585114a5264a4
- MD5 22c19d500d9832ba34a586401f464f61
- SHA1 aad98a13fb09c673f93f5cd7486a6118cb005aed
- SHA512 5377fa0cb1b6a6c8471bdea2a128f0c8dcce762b3d1bcd0cf176ac9f9d7df116cb2b9d8d20d066440a11be95e6e80b41d790a2775edfdc258e287728e8f96bd4
- SSDEEP 1536:znQC+5AO7rLHHYhpZSn6GezstztUG5nrAH9SVM2DsmJ/smY4EUQwPVTlp6unb6jo:znQP5nrPPs+/kjqL11v37
- TLSH T1C2145366300AB22C849733D8B5587652B3D6DFE5C0A441C76BC5FD4E920ABC4D7BA2CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\win.js
- Size 683KB
- SHA256 f61c6c7ed6662deaab051e896c8e27e5ca9a87b6e384c448b5b62d4d3c26810d
- MD5 12e0506264c384a31f9059a0cf0157f5
- SHA1 1ea4625fa14e594674bc94b7bba452b8ab603aea
- SHA512 8ce6737e5498864e1c03182844eab0468d67b15ceb0b27d0af7e0bd414f363154cfef74a43f03db3b9f53725b55e069f3792527875848be1f25f2c2ab5c521f5
- SSDEEP 6144:8VzWyrfM4Z1eP4V0NmwDirhbeuzgI9Wgj5IFsybc0Eu98/9TzjmD+lkeM41NecjI:81rf7ptyy7On
- TLSH T107E4BF3CFCEF491D64A198A177F1A583D06DB7A3A21E1BCE14999BF0870318DE568C8D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 c6f68ad6c1b78af3c2e3fb54f6accae240a11b24edcf817c349f88833cb7343e
- MD5 47a1fe4cc9566d1242842805a17e3587
- SHA1 2ee8b5f7f6e375ccb66332bdcb61d4eb423a14a4
- SHA512 92b55f87e01cbd6573fbb113fd6414f19f200fc025ef922cf4e7f3eb03b7ef76c7e829de2178888b37882251524c0017d5c89ede6e915a3605dfbf9cb5458d0b
- SSDEEP 24576:whbHjPa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:whbHjyLNiXicJFFRGNzj3
- TLSH T16F5512BE169C20E5F6B5903D86668409D370BC29172193EF6381527E4F3BFE94E38B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 109e03678a16ed6f300472b7afc2e255a11b1e4ea2b246e5628047c8bd8e7184
- MD5 0b9784b138c020b06160adbb2d576475
- SHA1 9155dabcb9b30b937dba011fbc6999b168be7237
- SHA512 110f356a6317995ff1ace8055d927d1658b1b476a2baca0a502814789961f688009b3973dc2bdc5ce46345ffcf25d22ed45469a089a2ef7f3db242946ac8f41c
- SSDEEP 24576:23YgnJcRTk4yti+R5dBR/i/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2IgnaTk46pBR/iLNiXicJFFRGNzj3
- TLSH T12145B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F39F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 b59ed4068c1da9977833f8e953707ae71e06d97331697cf271f3423cdd6c8540
- MD5 f1fd0f607d5ac36c3ae23d26ccd63363
- SHA1 59ccde91d38e5c7ba12a1042edaf2ad6ef5ffb2a
- SHA512 7fad6b87b476228dd066901099e0aeefe87b9329ed1ab906fbf18be3a5fb7d133a81916bb28c5f5a9c4284f002d7acd96c452e7e0ce307d1363c3b7c8c5260ee
- SSDEEP 24576:SnF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SnFLNiXicJFFRGNzj3
- TLSH T13B5512AE278C60E5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 23229cae939c20ebbb7f1cb8f53506339de4bf6b49c3a565f8e7b87b92f85160
- MD5 29de58c170e5e46f36a8aa1dbcb313b0
- SHA1 80804c5198235e3ddbca2989add911590c617a0c
- SHA512 8ddbc7ca69686560dee7c3af1eef5380f1c35101fb21da355071c8aeb0101074dca842bdda1d53dfa32fa10ae712c592ce4d1d47c49bf15e1432e464286d6ce0
- SSDEEP 24576:DIyK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DIRLNiXicJFFRGNzj3
- TLSH T113651245538860E5EAB9013CCA774064EA74BC349F2156EF9180BA3FAF36FD59E34B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 bd9c03ebea0887c63b63b88d51fe12cd80803899e88d5452ffb59487e6bb847a
- MD5 97aa97063121b37a6482c343f7d9ca50
- SHA1 5b87465fd558d91a31db2ca435e31d7c22912443
- SHA512 eaa4c88616159ec3a195bdf8c09061d5204f62d74cf508d609f4fb5b0ff85c5a36d814adc858a94b8274a3b1635b69fedc16d47f30db7151b2fbde1664ba56dd
- SSDEEP 24576:+1QT7EcpfxR+N5AWAz3ooiYzjMqbF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TTDxR+N5YzTBjMsLNiXicJFFRGNzj3
- TLSH T16455B02EA7F815E5D1BE85798B23C512FA727821033193CB42A0C17E1E7B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.3MB
- SHA256 6a03ccf6e87c2faa6f211c0efbd46f98eb0c96cd5056b9d952d8326b8dc39238
- MD5 113d3add380a56fda6144e69b0f7ce99
- SHA1 6b001f7e356f7118fb714f0c17b2d3e4a28e8d47
- SHA512 6790c08d0c302b6f629d98cd080d1065a0f8249754087a0a28671dc514d8ea6d7faaaa4ef730aa55a21ff83c217bb97d686877197eadd87d23579fe2b3413491
- SSDEEP 12288:F4KeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Bo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T19555125A13D830E0F5BA5139CA364014E660BC3957251AFF71D0A97E9B36FDACE38B12
- MD5 SHA1 SHA512 SSDEEP TLSH