Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 11:00
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
44 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
40 signatures
150 seconds
General
- Target 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
- Size 31.9MB
- Sample260723-m39bashp5x
- SHA256 0f63575601b324548192347de46b35fca6a9b2259f5aa1fc75c8d340a009d54b
- MD5 6977254ade4a02256db1dbae4da8e932
- SHA1 f2d84b4f515e74383213531ce21b7c2a68e89722
- SHA512 e24b6aa706c832ad9869bce2323e607a9d228b811259ba6064b9be9e522d6e745464755abfa2a1d5d590578f9cea76a9be452e44a81de7af214cc5425744cfbf
- SSDEEP 786432:ISU3iKG857SBE+7LU+HIqDYppZITGql23iIu3d:Ijy5E+7fHIq0ZIa/I3d
- TLSH T1D277330623B402ADFFEBC1768657C507D7B07C05163A8A5F41A46AB62F33B725E2E361
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 23 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 21 6724 wscript.exe 22 6724 wscript.exe 29 6724 wscript.exe 31 6724 wscript.exe 34 6724 wscript.exe 36 6724 wscript.exe 42 6724 wscript.exe 45 6724 wscript.exe 47 6724 wscript.exe 50 6724 wscript.exe 55 6724 wscript.exe 57 1324 WScript.exe 58 1324 WScript.exe 59 6724 wscript.exe 62 1324 WScript.exe 63 1324 WScript.exe 64 1324 WScript.exe 66 6724 wscript.exe 67 1324 WScript.exe 68 1324 WScript.exe 70 1324 WScript.exe 71 6724 wscript.exe 72 1324 WScript.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\GUBootStartup.sys StartupManager.exe - Uses Session Manager for persistence 2 TTPs 1 IoCs
Creates Session Manager registry key to run executable early in system boot.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a00200000000000 DiskDefrag.exe - Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.js WScript.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 33 IoCs
pid Process 2500 elevation_service.exe 3768 elevation_service.exe 5340 maintenanceservice.exe 256 OSE.EXE 4128 PerceptionSimulationService.exe 5532 perfhost.exe 3332 ReFsDedupSvc.exe 5060 SensorDataService.exe 476 p1.bin 1132 ssh-agent.exe 3804 p2.bin 6940 AgentService.exe 6948 setup.exe 5912 SearchIndexer.exe 2944 program6.exe 1280 gupsetup.exe 620 GUAssistComSvc.exe 6216 statisticsinfo.exe 6276 DiskDefrag.exe 6608 StartupManager.exe 4248 GUBootService.exe 4760 GUPMService.exe 1920 procmgr.exe 6068 GUBootService.exe 2092 GUBootStartup.sys 6984 MemfilesService.exe 5512 MemfilesService.exe 5308 GUPMService.exe 3412 Initialize.exe 6732 GUBootService.exe 6804 Initialize.exe 4276 GUPMService.exe 4544 GUBootService.exe - Loads dropped DLL 64 IoCs
pid Process 1280 gupsetup.exe 1280 gupsetup.exe 1280 gupsetup.exe 1280 gupsetup.exe 1056 regsvr32.exe 3520 regsvr32.exe 3040 regsvr32.exe 5584 regsvr32.exe 1280 gupsetup.exe 6216 statisticsinfo.exe 6276 DiskDefrag.exe 6216 statisticsinfo.exe 6276 DiskDefrag.exe 6276 DiskDefrag.exe 6276 DiskDefrag.exe 6276 DiskDefrag.exe 6276 DiskDefrag.exe 6276 DiskDefrag.exe 6276 DiskDefrag.exe 6276 DiskDefrag.exe 6276 DiskDefrag.exe 6276 DiskDefrag.exe 6608 StartupManager.exe 6608 StartupManager.exe 6608 StartupManager.exe 6608 StartupManager.exe 6608 StartupManager.exe 6608 StartupManager.exe 6608 StartupManager.exe 6608 StartupManager.exe 6608 StartupManager.exe 6608 StartupManager.exe 6608 StartupManager.exe 6608 StartupManager.exe 6608 StartupManager.exe 6608 StartupManager.exe 6608 StartupManager.exe 6608 StartupManager.exe 6608 StartupManager.exe 6608 StartupManager.exe 1920 procmgr.exe 1920 procmgr.exe 1920 procmgr.exe 1920 procmgr.exe 1920 procmgr.exe 1920 procmgr.exe 1920 procmgr.exe 1920 procmgr.exe 1920 procmgr.exe 6984 MemfilesService.exe 6984 MemfilesService.exe 1280 gupsetup.exe 5512 MemfilesService.exe 5512 MemfilesService.exe 3412 Initialize.exe 3412 Initialize.exe 3412 Initialize.exe 3412 Initialize.exe 3412 Initialize.exe 3412 Initialize.exe 3412 Initialize.exe 3412 Initialize.exe 3412 Initialize.exe 3412 Initialize.exe - Modifies system executable filetype association 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\lnkfile\shellex\ regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Glary Utilities\ = "{B3C418F8-922B-4faf-915E-59BC14448CF7}" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\lnkfile\shellex\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Glary Utilities regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Glary Utilities\ = "{B3C418F8-922B-4faf-915E-59BC14448CF7}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\lnkfile\shellex regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\lnkfile\shellex\ContextMenuHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Glary Utilities regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\lnkfile\shellex regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\lnkfile\shellex\ContextMenuHandlers regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ regsvr32.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\win.js\"" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\win.js\"" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\win.js\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\win.js\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\dfl = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\dfl.vbs\"" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" InfDefaultInstall.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA procmgr.exe -
pid Process 1704 powershell.exe - Enumerates connected drives 3 TTPs 49 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\F: DiskDefrag.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 DiskDefrag.exe - AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/6084-10-0x0000000140000000-0x0000000141FEA000-memory.dmp autoit_exe behavioral2/memory/6084-91-0x0000000140000000-0x0000000141FEA000-memory.dmp autoit_exe behavioral2/memory/6084-748-0x0000000140000000-0x0000000141FEA000-memory.dmp autoit_exe - Drops file in System32 directory 50 IoCs
description ioc Process File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\40aa6bec83806d8d.bin elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 1324 WScript.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Glary Utilities\x64\msvcr90.dll gupsetup.exe File opened for modification C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe elevation_service.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\DiskDefrag\btn_press.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\Register\close_normal.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\Register\about\home-click.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\main_skins.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\Icons\ico_undochanges_hover.png gupsetup.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe elevation_service.exe File created C:\Program Files (x86)\Glary Utilities\languages\Albanian - [M.D.].lng gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\x64\CrashReport.dll gupsetup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe elevation_service.exe File created C:\Program Files (x86)\Glary Utilities\SkinsManager.dll gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\FileUndelete\checkhover.png gupsetup.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\main_tab_icon_files.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\x64\ScanFile.dll gupsetup.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File created C:\Program Files (x86)\Glary Utilities\DriverBackup.exe gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\upgrade.exe gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\Icons\ico_startup.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\x64\Register.dll gupsetup.exe File opened for modification C:\Program Files (x86)\Glary Utilities\PortableMaker.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File created C:\Program Files (x86)\Glary Utilities\Resources\settings\TracksEraseImageList.bmp gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\main_dockbar.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\main_user_hover.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\x64\CrashReport.exe gupsetup.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Glary Utilities\FileUndelete.exe elevation_service.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\StartupManager\openfloder-hover.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\about\about_shade_border.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\languages\lithuanian.lng gupsetup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe elevation_service.exe File created C:\Program Files (x86)\Glary Utilities\GUPMService.exe gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\Register\close_hover.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\Repair_click.png gupsetup.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File created C:\Program Files (x86)\Glary Utilities\fileencrypt.exe gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\languages\German_Andy Kleinert.lng gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\Icons\disk_memoty_click.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\Icons\ico_diskdefrag_click.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\RemoveDriver.dll gupsetup.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\FileUndelete\combo.png gupsetup.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File created C:\Program Files (x86)\Glary Utilities\data\UpLoadStruct.ini gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\languages\arabic.lng gupsetup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File created C:\Program Files (x86)\Glary Utilities\AppMetrics.dll gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\data\SerialNumberExclude.ini gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\Native\wnet_x64\BootDefrag.exe gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\QuickSearch\arrow.png gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\skins\default\main\Icons\ico_startup_click.png gupsetup.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Glary Utilities\dupefinder.exe elevation_service.exe File created C:\Program Files (x86)\Glary Utilities\InfoCollect.dll gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\settings.dll gupsetup.exe File created C:\Program Files (x86)\Glary Utilities\UserPath.dll gupsetup.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5144 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 37 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUBootService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Initialize.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language grpconv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language statisticsinfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InfDefaultInstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Initialize.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUBootService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language program6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language runonce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DiskDefrag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUPMService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUBootService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUPMService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUPMService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StartupManager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language procmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gupsetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUBootService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SchTasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wermgr.exe - NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x000b00000001c774-821.dat nsis_installer_1 behavioral2/files/0x000b00000001c774-821.dat nsis_installer_2 behavioral2/files/0x000800000001cb40-1921.dat nsis_installer_1 behavioral2/files/0x000800000001cb40-1921.dat nsis_installer_2 - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f49873cf921add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae16c9cf921add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f8490498921add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ca6a397921add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000360b1198921add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ad599cf921add01 SearchProtocolHost.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GUBootService.EXE GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2DA46AF-A5CD-47A5-B345-7764100E3F97}\ProgID\ = "GUBootService.BootService.1" GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2DA46AF-A5CD-47A5-B345-7764100E3F97}\VersionIndependentProgID\ = "GUBootService.BootService" GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DED4F83E-5A2C-4971-AA04-E57134816579}\ = "ISessionStartup" GUBootService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2DA46AF-A5CD-47A5-B345-7764100E3F97} GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GU.Encrypted\ = "Glary Utilities Encrypted File" gupsetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ContextHandler.CContextMenu\CurVer\ = "ContextHandler.CContextMenu.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ContextHandler.CContextMenu\ = "CContextMenu Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GUAssistComSvc.GUShellLink.1\ = "GUShellLink Class" GUAssistComSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D6544943-452E-404F-9B94-93E27E656D85}\VersionIndependentProgID GUAssistComSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F10E0193-E389-4E51-BDD8-D3DAF5F63851} GUAssistComSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GUBootService.BootService\CLSID GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3DA5E31D-E553-4525-8AC5-EBD92B29A408}\1.0\0\win64 GUAssistComSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\TypeLib\ = "{B52C0F28-8D4C-4886-965C-0A772490064E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Glary Utilities\ = "{B3C418F8-922B-4faf-915E-59BC14448CF7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GUAssistComSvc.GUShellLink.1\CLSID GUAssistComSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3DA5E31D-E553-4525-8AC5-EBD92B29A408}\1.0\FLAGS GUAssistComSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2DA46AF-A5CD-47A5-B345-7764100E3F97}\ProgID GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2DA46AF-A5CD-47A5-B345-7764100E3F97}\Programmable GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2DA46AF-A5CD-47A5-B345-7764100E3F97}\TypeLib GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31FB3410-EA8B-4931-91C5-ADA7B91D953B}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\ = "ICContextMenu" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\*\shellex\ContextMenuHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3DA5E31D-E553-4525-8AC5-EBD92B29A408}\1.0\HELPDIR GUAssistComSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DED4F83E-5A2C-4971-AA04-E57134816579}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2DA46AF-A5CD-47A5-B345-7764100E3F97}\ = "BootService Class" GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2DA46AF-A5CD-47A5-B345-7764100E3F97}\Programmable GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Glary Utilities\ = "{B3C418F8-922B-4faf-915E-59BC14448CF7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2DA46AF-A5CD-47A5-B345-7764100E3F97}\TypeLib\ = "{A9299FDE-3941-4C37-949C-630BEBCA9BB9}" GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GUBootService.SessionStartup.1 GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71F03427-4342-4D6F-B71A-C7320428EFEE}\VersionIndependentProgID\ = "GUBootService.SessionStartup" GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CC9859D6-F6D3-4DD5-B0B2-FD2130EC36AC}\ProxyStubClsid32 GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GUPMService.EXE\AppID = "{F0D094A7-C48F-496E-B9DC-BA9E0B7F69BB}" GUPMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2DA46AF-A5CD-47A5-B345-7764100E3F97}\ProgID\ = "GUBootService.BootService.1" GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F10E0193-E389-4E51-BDD8-D3DAF5F63851}\ProxyStubClsid32 GUAssistComSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\ProgID\ = "ContextHandler.CContextMenu.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D6544943-452E-404F-9B94-93E27E656D85}\Programmable GUAssistComSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GUBootService.SessionStartup\CLSID GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EADB8774-D17B-45F0-B661-8AA411CC2D15}\1.0\ = "GUPMService 1.0 ÀàÐÍ¿â" GUPMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EADB8774-D17B-45F0-B661-8AA411CC2D15}\1.0\HELPDIR GUPMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71F03427-4342-4D6F-B71A-C7320428EFEE}\TypeLib GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31FB3410-EA8B-4931-91C5-ADA7B91D953B}\TypeLib\ = "{35AE4004-4194-4243-92AA-351BB7239539}" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\*\shellex\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A9299FDE-3941-4C37-949C-630BEBCA9BB9}\1.0\0\win32 GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DED4F83E-5A2C-4971-AA04-E57134816579} GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DED4F83E-5A2C-4971-AA04-E57134816579}\ProxyStubClsid32 GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71F03427-4342-4D6F-B71A-C7320428EFEE}\AppID = "{CB4B4EAB-4ABB-4702-BB38-E3A1A1D5D67D}" GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ program6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{28C97FA4-8378-42BF-A6F9-D615EB1272D7}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\ToolboxBitmap32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Glary Utilities regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F10E0193-E389-4E51-BDD8-D3DAF5F63851}\TypeLib\ = "{3DA5E31D-E553-4525-8AC5-EBD92B29A408}" GUAssistComSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DED4F83E-5A2C-4971-AA04-E57134816579}\TypeLib GUBootService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2DA46AF-A5CD-47A5-B345-7764100E3F97}\Programmable GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GU.Encrypted\Shell\Open gupsetup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Glary Utilities regsvr32.exe - Runs net.exe
- Script User-Agent 9 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 64 60208716qiQqiNothingqiQqiOAGGWFQTqiQqiAdminqiQqiMicrosoft Windows 11 Enterprise LTSCqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi HTTP User-Agent header 67 60208716qiQqiNothingqiQqiOAGGWFQTqiQqiAdminqiQqiMicrosoft Windows 11 Enterprise LTSCqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi HTTP User-Agent header 68 60208716qiQqiNothingqiQqiOAGGWFQTqiQqiAdminqiQqiMicrosoft Windows 11 Enterprise LTSCqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi HTTP User-Agent header 70 60208716qiQqiNothingqiQqiOAGGWFQTqiQqiAdminqiQqiMicrosoft Windows 11 Enterprise LTSCqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi HTTP User-Agent header 57 60208716qiQqiNothingqiQqiOAGGWFQTqiQqiAdminqiQqiMicrosoft Windows 11 Enterprise LTSCqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi HTTP User-Agent header 58 60208716qiQqiNothingqiQqiOAGGWFQTqiQqiAdminqiQqiMicrosoft Windows 11 Enterprise LTSCqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi HTTP User-Agent header 62 60208716qiQqiNothingqiQqiOAGGWFQTqiQqiAdminqiQqiMicrosoft Windows 11 Enterprise LTSCqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi HTTP User-Agent header 63 60208716qiQqiNothingqiQqiOAGGWFQTqiQqiAdminqiQqiMicrosoft Windows 11 Enterprise LTSCqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi HTTP User-Agent header 72 60208716qiQqiNothingqiQqiOAGGWFQTqiQqiAdminqiQqiMicrosoft Windows 11 Enterprise LTSCqiQqiqiQqi0.1qiQqiNAN/AVqiQqiVBScriptqiQqi - Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 1280 gupsetup.exe 1280 gupsetup.exe 1704 powershell.exe 1704 powershell.exe 1704 powershell.exe 3412 Initialize.exe 3412 Initialize.exe 6804 Initialize.exe 6804 Initialize.exe 6804 Initialize.exe 6804 Initialize.exe 6804 Initialize.exe 6804 Initialize.exe 2500 elevation_service.exe 2500 elevation_service.exe 2500 elevation_service.exe 2500 elevation_service.exe 2500 elevation_service.exe 2500 elevation_service.exe 2500 elevation_service.exe 476 p1.bin 476 p1.bin 4276 GUPMService.exe 4276 GUPMService.exe 4276 GUPMService.exe 4276 GUPMService.exe 4276 GUPMService.exe 4276 GUPMService.exe 3768 elevation_service.exe 3768 elevation_service.exe 3768 elevation_service.exe 3768 elevation_service.exe 3768 elevation_service.exe 3768 elevation_service.exe 3768 elevation_service.exe 4276 GUPMService.exe 4276 GUPMService.exe 4276 GUPMService.exe 4276 GUPMService.exe 4276 GUPMService.exe 4276 GUPMService.exe 4276 GUPMService.exe 4276 GUPMService.exe - Suspicious behavior: LoadsDriver 4 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 6084 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe Token: SeTakeOwnershipPrivilege 2500 elevation_service.exe Token: SeBackupPrivilege 3332 ReFsDedupSvc.exe Token: SeRestorePrivilege 3332 ReFsDedupSvc.exe Token: SeBackupPrivilege 3332 ReFsDedupSvc.exe Token: SeRestorePrivilege 3332 ReFsDedupSvc.exe Token: SeBackupPrivilege 3332 ReFsDedupSvc.exe Token: SeRestorePrivilege 3332 ReFsDedupSvc.exe Token: SeBackupPrivilege 3332 ReFsDedupSvc.exe Token: SeRestorePrivilege 3332 ReFsDedupSvc.exe Token: SeBackupPrivilege 3332 ReFsDedupSvc.exe Token: SeRestorePrivilege 3332 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 6940 AgentService.exe Token: 33 7120 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 7120 AUDIODG.EXE Token: 33 5912 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 5912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5912 SearchIndexer.exe Token: SeDebugPrivilege 1704 powershell.exe Token: SeDebugPrivilege 6276 DiskDefrag.exe Token: SeDebugPrivilege 6608 StartupManager.exe Token: SeDebugPrivilege 1920 procmgr.exe Token: SeDebugPrivilege 1920 procmgr.exe Token: SeDebugPrivilege 6984 MemfilesService.exe Token: SeDebugPrivilege 5512 MemfilesService.exe Token: SeDebugPrivilege 3412 Initialize.exe Token: SeDebugPrivilege 3412 Initialize.exe Token: SeDebugPrivilege 3412 Initialize.exe Token: SeBackupPrivilege 5512 MemfilesService.exe Token: SeDebugPrivilege 3412 Initialize.exe Token: SeDebugPrivilege 6804 Initialize.exe Token: SeDebugPrivilege 6804 Initialize.exe Token: SeDebugPrivilege 6804 Initialize.exe Token: SeDebugPrivilege 6804 Initialize.exe Token: SeDebugPrivilege 2500 elevation_service.exe Token: SeDebugPrivilege 476 p1.bin Token: SeRestorePrivilege 1704 powershell.exe Token: SeBackupPrivilege 1704 powershell.exe Token: SeTcbPrivilege 4544 GUBootService.exe Token: SeBackupPrivilege 4544 GUBootService.exe Token: SeSecurityPrivilege 4544 GUBootService.exe Token: SeDebugPrivilege 3768 elevation_service.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 6948 setup.exe 6948 setup.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 6948 setup.exe 6948 setup.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 6276 DiskDefrag.exe 6608 StartupManager.exe 1920 procmgr.exe 1920 procmgr.exe 6984 MemfilesService.exe 5512 MemfilesService.exe 5512 MemfilesService.exe 5512 MemfilesService.exe 3412 Initialize.exe 5512 MemfilesService.exe 5512 MemfilesService.exe 6804 Initialize.exe 5512 MemfilesService.exe 5512 MemfilesService.exe - Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 6084 wrote to memory of 476 6084 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 97 PID 6084 wrote to memory of 3804 6084 2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 99 PID 3804 wrote to memory of 6948 3804 p2.bin 100 PID 476 wrote to memory of 2944 476 p1.bin 104 PID 5912 wrote to memory of 2416 5912 SearchIndexer.exe 105 PID 2944 wrote to memory of 1280 2944 program6.exe 106 PID 1280 wrote to memory of 2160 1280 gupsetup.exe 107 PID 2160 wrote to memory of 2432 2160 net.exe 109 PID 5912 wrote to memory of 3432 5912 SearchIndexer.exe 110 PID 1280 wrote to memory of 4580 1280 gupsetup.exe 111 PID 4580 wrote to memory of 2668 4580 net.exe 155 PID 6948 wrote to memory of 5144 6948 setup.exe 115 PID 5144 wrote to memory of 1704 5144 cmd.exe 117 PID 1280 wrote to memory of 1056 1280 gupsetup.exe 119 PID 1280 wrote to memory of 3520 1280 gupsetup.exe 120 PID 3520 wrote to memory of 3040 3520 regsvr32.exe 121 PID 1280 wrote to memory of 5584 1280 gupsetup.exe 122 PID 1280 wrote to memory of 620 1280 gupsetup.exe 123 PID 5912 wrote to memory of 5072 5912 SearchIndexer.exe 124 PID 5912 wrote to memory of 4160 5912 SearchIndexer.exe 125 PID 1280 wrote to memory of 6216 1280 gupsetup.exe 126 PID 1280 wrote to memory of 6276 1280 gupsetup.exe 127 PID 1280 wrote to memory of 6608 1280 gupsetup.exe 129 PID 6608 wrote to memory of 4248 6608 StartupManager.exe 130 PID 1280 wrote to memory of 4760 1280 gupsetup.exe 131 PID 1280 wrote to memory of 1920 1280 gupsetup.exe 134 PID 1280 wrote to memory of 6984 1280 gupsetup.exe 137 PID 1280 wrote to memory of 4724 1280 gupsetup.exe 138 PID 4724 wrote to memory of 1884 4724 net.exe 140 PID 1280 wrote to memory of 3412 1280 gupsetup.exe 144 PID 3412 wrote to memory of 6732 3412 Initialize.exe 146 PID 1280 wrote to memory of 6832 1280 gupsetup.exe 147 PID 2944 wrote to memory of 5700 2944 program6.exe 150 PID 5700 wrote to memory of 3576 5700 InfDefaultInstall.exe 151 PID 3576 wrote to memory of 3080 3576 runonce.exe 153 PID 1704 wrote to memory of 6300 1704 powershell.exe 157 PID 6948 wrote to memory of 6288 6948 setup.exe 159 PID 6948 wrote to memory of 6628 6948 setup.exe 160 PID 6628 wrote to memory of 6724 6628 WScript.exe 161 PID 6948 wrote to memory of 1324 6948 setup.exe 166 PID 5912 wrote to memory of 6960 5912 SearchIndexer.exe 167 PID 5912 wrote to memory of 1456 5912 SearchIndexer.exe 168 PID 5912 wrote to memory of 2408 5912 SearchIndexer.exe 169
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_6977254ade4a02256db1dbae4da8e932_agent-tesla_amadey_icedid_luca-stealer_njrat.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\wrk\p1.binC:\Users\Admin\AppData\Local\Temp\wrk\p1.bin2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Users\Admin\AppData\Local\Temp\SilentALL\program6.exe"C:\Users\Admin\AppData\Local\Temp\SilentALL\program6.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\gupsetup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\gupsetup.exe" /S4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\net.exenet stop GUPMService5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop GUPMService6⤵
- System Location Discovery: System Language Discovery
PID:2432
-
-
-
C:\Windows\SysWOW64\net.exenet stop GUMemfilesService5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop GUMemfilesService6⤵
- System Location Discovery: System Language Discovery
PID:2668
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Glary Utilities\GridMap.ocx"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1056
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Glary Utilities\x64\ContextHandler.dll"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Glary Utilities\x64\ContextHandler.dll"6⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Modifies registry class
PID:3040
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Glary Utilities\ContextHandler.dll"5⤵
- Loads dropped DLL
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5584
-
-
C:\Program Files (x86)\Glary Utilities\x64\GUAssistComSvc.exe"C:\Program Files (x86)\Glary Utilities\x64\GUAssistComSvc.exe" /RegServer5⤵
- Executes dropped EXE
- Modifies registry class
PID:620
-
-
C:\Users\Admin\AppData\Local\Temp\nsiB0B9.tmp\statisticsinfo.exe"C:\Users\Admin\AppData\Local\Temp\nsiB0B9.tmp\statisticsinfo.exe" /install /GU5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6216
-
-
C:\Program Files (x86)\Glary Utilities\DiskDefrag.exe"C:\Program Files (x86)\Glary Utilities\DiskDefrag.exe" -InstallNative5⤵
- Uses Session Manager for persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6276
-
-
C:\Program Files (x86)\Glary Utilities\StartupManager.exe"C:\Program Files (x86)\Glary Utilities\StartupManager.exe" -install5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6608 -
C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe"C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe" /Service6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4248
-
-
-
C:\Program Files (x86)\Glary Utilities\GUPMService.exe"C:\Program Files (x86)\Glary Utilities\GUPMService.exe" /Service5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4760
-
-
C:\Program Files (x86)\Glary Utilities\procmgr.exe"C:\Program Files (x86)\Glary Utilities\procmgr.exe" -guupdate5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1920
-
-
C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe"C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe" -RegServer5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6984
-
-
C:\Windows\SysWOW64\net.exenet start GUMemfilesService5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start GUMemfilesService6⤵
- System Location Discovery: System Language Discovery
PID:1884
-
-
-
C:\Program Files (x86)\Glary Utilities\Initialize.exe"C:\Program Files (x86)\Glary Utilities\Initialize.exe" /setupschedule /installinit productid=15 productname=Glary Utilities Pro5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe"C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe" /Service6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6732
-
-
-
C:\Windows\SysWOW64\SchTasks.exeSchTasks /Delete /TN GU5SkipUAC /F5⤵
- System Location Discovery: System Language Discovery
PID:6832
-
-
-
C:\Windows\SysWOW64\InfDefaultInstall.exe"C:\Windows\System32\InfDefaultInstall.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\register.inf"4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Windows\SysWOW64\runonce.exe"C:\Windows\system32\runonce.exe" -r5⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\System32\grpconv.exe" -o6⤵
- System Location Discovery: System Language Discovery
PID:3080
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\wrk\p2.binC:\Users\Admin\AppData\Local\Temp\wrk\p2.bin2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\ProgramData\setup.exe"C:\ProgramData\setup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -windo 1 -noexit -exec bypass -file C:\Users\Public\Settings\A\News\win.ps14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windo 1 -noexit -exec bypass -file C:\Users\Public\Settings\A\News\win.ps15⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "1704" "2596" "2528" "2588" "0" "0" "2580" "0" "0" "0" "0" "0"6⤵
- System Location Discovery: System Language Discovery
PID:6300
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\diag fix\scheduled\Maintenance\ShellNew\dfr\dll.js"4⤵
- System Location Discovery: System Language Discovery
PID:6288
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\diag fix\scheduled\Maintenance\Resources\Licenses\setup\win.js"4⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6628 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\win.js"5⤵
- Badlisted process makes network request
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:6724
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\Adobe\AIR\Logs\gp\PerfLogs\Google\start\dfl.vbs"4⤵
- Badlisted process makes network request
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
PID:1324
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5340
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:256
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4128
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5532
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3332
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5060
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1132
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6940
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x0000000000000500 0x000000000000050C1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7120
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2416
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:3432
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 1688 1628 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:5072
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 1708 1724 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4160
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:6960
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 1688 1628 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:1456
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 1708 1724 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:2408
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5688
-
C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe"C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6068
-
C:\Windows\System32\drivers\GUBootStartup.sysC:\Windows\System32\drivers\GUBootStartup.sys1⤵
- Executes dropped EXE
PID:2092
-
C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe"C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe" -Svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5512
-
C:\Program Files (x86)\Glary Utilities\GUPMService.exe"C:\Program Files (x86)\Glary Utilities\GUPMService.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5308
-
C:\Program Files (x86)\Glary Utilities\Initialize.exe"C:\Program Files (x86)\Glary Utilities\Initialize.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6804
-
C:\Windows\system32\grpconv.exegrpconv -o1⤵PID:2668
-
C:\Program Files (x86)\Glary Utilities\GUPMService.exe"C:\Program Files (x86)\Glary Utilities\GUPMService.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4276
-
C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe"C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4544
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4JavaScript
1PowerShell
1Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Glary Utilities\BottDefrag.dll
- Size 52KB
- SHA256 5dccd2e7663466c6d9f9d16a916e6756229f338d753a4608a4a6cd50c3a0a0f1
- MD5 10df2bd435d20867b143fa7152a552be
- SHA1 5bdd84b4d5a8be328c1e92a323fd0c9287a819ea
- SHA512 7f83311bcb9d59effce0d97559ceef4b3ded7925b24e3b1cf44dd022ab7a663071af22bd48abc4fa1ab2c996a1bece84f589a1c2d3e430d68a0245028ca26748
- SSDEEP 768:Zr4pTFKe5PmCSbAhx/tpTbhtocc0/ofTOtVyXYi7ha5ALvYi79OP385ALXj:lITFKCRSivpTb7occ0qTOtVyX7f7YPL
- TLSH T19F337C93AB942893E93F6A3035D5672B5C7EF4A21BD140C7631B5BCC0EA22D1F1BC199
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\CheckUpdate.dll
- Size 1.1MB
- SHA256 cca6bdfb53bc3cf9582dd3a4bc6899d96e9e723fa364b2c023bc54e99106d2d1
- MD5 c2e9d24f1263bdd76cc6f76c0b8db549
- SHA1 867ad6ce3219911fddd5db121ce650b07d1e88ec
- SHA512 0c721a2574695d11ebc8961b02445d990d3b3d6cb0b407bf7651647dc7861b0cbff7afdd09727c0d2a8b152c35f1a49e4b2d14c1dd067713c972bbd46f372939
- SSDEEP 12288:JaCd374kDO8FXwOnYOoHw0Q2DLcM3Z/1dDmF2aJUBq9R5oI3:Jak374kDO8FAfOopD53ZneVJUq7oI3
- TLSH T1DB359E5576E0C570C9BA327518A1873867FBEC39C77422E7BEC83F6949312D25A3821B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\Config.dll
- Size 41KB
- SHA256 370c35c39a11b27fe87bc1821e4f32b6331bba2b62c4c9a94eb2fc72ef1917b6
- MD5 7057d703122f7fe6d5c9f25a67262a9f
- SHA1 becb32c942cb589f82ff02a12d5dd0b0fd5a70bc
- SHA512 0121fb620199ac0e1007d32931a13f8122e83a44bae4f87b33f22d2844f998a0a17e04a2b3c3568e3fce0668f0873fd365ede64505b1eca90741ab891f31996a
- SSDEEP 768:q8wORwVnjaz9P4nge57FOt3Q+Vm+WYi7JgZ5ALKAYi7J75ALyJ:q8wHnOz92ge57FOtfVm+W7yxA7DJ
- TLSH T142136B96DCA4C822DA2F093078E5D63659653D956FE1C0D33799C71E0BA03C329F91AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\ContextHandler.dll
- Size 142KB
- SHA256 06cb3f49149ad2f4db0943296e9d6b73d95801695b8665f23c673c72f4f91efb
- MD5 1056d66a5df0f4b157814a629413aca2
- SHA1 f6b5c8ef780c57ed2b5f43177339c0199e79dc09
- SHA512 98d6ff623b83ce84f6dfe005bc32bb63047c2d2ec0c430193682383927f1bef2530c078436a3966142ec8f3188438c1193e662730cdbffd1d542598d3bd9fd41
- SSDEEP 3072:bC4zHkyBWdodneCsTVwtl045X6m2iskBFC:bC4zkyByodYJ0l02WeC
- TLSH T157E37C11BAA5C072C95F663858299329D77FFE508F6086C777183B2E8F703C19E3529A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\CrashReport.dll
- Size 300KB
- SHA256 c290e3f272fca3c0e7a7109b62ec763d486fd6ead29b8b5dc958e835087cb07f
- MD5 388d6c911e7095c0b63d462b1fd93984
- SHA1 59fcef414593b82451e01b607277bb3c33a5b813
- SHA512 6c7fa3f95563d1b2dd4929e8c08fba6d577ccc73f66f6a44bb99863793422c0b133285d69a9913f000123b78e12cd169046a6b6a067201f8094274f0ef3c851c
- SSDEEP 6144:KJ3KbqxdjkUe+wQ+Rm60lb/vtNJYb+QMd6wb2sj6pC:KhT1Bb/vtNJYb+QMd6wbBs
- TLSH T17F647B2176A0C432D9EB2534596F86796AEDBC305B60C1C7B7842F7D1E71AC16E3832B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\DiskDefrag.exe
- Size 998KB
- SHA256 525b17a1ba60e0190086c5273104986f9507c74ca6a7542220d6c682e47104fd
- MD5 a3abb8f4ab519cd13e43b48bcd410b01
- SHA1 7d54562a75b0387a0be7c789b2a78e99d8532c07
- SHA512 4b22434208043dfea6500169f7ca77fc551d7e2b39f98f2efaf030eabee54b0667788ab49c0e3bf9420e9768de5d7ee7e8f3db36a3736a73e44e677ac3b5690e
- SSDEEP 24576:TfpKTlPEpfH3sj+rAI+9J8vz7Qqg3zsIP:TmcpopfS9ggu
- TLSH T1E5256C11E78B80A7DD79233271AA772A552FB78B53504ACFD22E0F7A1D522C31C3A51B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\GUWndManager.dll
- Size 111KB
- SHA256 d9b69d819039e35bc460eb5aaf49da03a406e69001dab9fb2e4653ad35b760f0
- MD5 a591acb78db75843a0172ee71228f0fa
- SHA1 7621b4ce05f8ec738b3a4405c7cf3a0e8b014fee
- SHA512 026e179d8d64634498a17b6d28efb8951cdd0e085c292275c8060a2a04cd8dfe67f9418707f8a7fc8496a227cf3a66e491709d432d10ec8b4df136836ce70a17
- SSDEEP 3072:+rLxggRNF2MEf4EvuBU0dW/LmfIm2HmZnOtVndSPUF:+rtggfF2YRW/LmfWmZnOtV22
- TLSH T18FB38D40B7DA4171DE5F667C1498AB3AD737E252DFD00AC7BB284B8E0B941C26D39287
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\GridMap.ocx
- Size 161KB
- SHA256 65293604b2f7d9b9a9946724a1e0769ac4454453dfdb4ff491db1710e778159f
- MD5 0ac55e0d792e46c7d8638ffb001a4474
- SHA1 3b09248a427e6d81f5956f908690648a5cd83749
- SHA512 c736e71186ebe86eb0f8214ee82598e768e4b14968572736686a1fc8f7712c88f47b0dd270cf3080ed8528165945880f0712b5f3a5e2e542318b3cc11c53baca
- SSDEEP 3072:rDO5RDmuUOkl4oMWVayGNRRy8Couzy3OtUzARX7I+:f2UOkDtANnIouzy3OtUz4s+
- TLSH T192F34982FFC98572D99F167C28AB635D837B99909B1446C3F3542E4E6C602D36DB8383
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\Languages.dll
- Size 53KB
- SHA256 4ed99b01b61cd4da548ae44b06d646c86211896cabfdb521b5b84bf478f91fb0
- MD5 ddc3c3edab8d0f5ef2f7130a8a4716a9
- SHA1 2738cc5b8ac8682896d655b39d4fbd60222b3429
- SHA512 7939e96d10801be3c6f8eae63c05c305d124e1379cb09bf38f90de851fa804327edaf79e7cf4d9c0ab57f609b6dd53805deeae70ec0905d4c3e642442fb21fe1
- SSDEEP 768:X8sTiJOCCDk95IhiGu5xLWM2OK7bom9vYi75Co5ALdYi79PEt5ALy:XQknDk95IsnD2OKvom9v7Qp7CN
- TLSH T129336C528B4888F2DB4F627034D0A739997661503FD062D3A32B57EA0F773C1FA7A295
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\Register.dll
- Size 596KB
- SHA256 7dad97e23b76c079bb6165a2d152b3f428f1dbdf3c766fcc1df091bfaa339365
- MD5 6c7355d4ffcced9f3d0dad8bbdd01787
- SHA1 78d2e883da8de4ea529533944f598a92323bbda6
- SHA512 706e9c4fee5fa7d6999f67741d2fc53d117ee5c7330638136fd281c8f4d5e0694a9bf12b3d8ee918b2f3067b78fc1898a58f92b487e83b6aa3e2d625a6a993fd
- SSDEEP 12288:ZpsiyNm3Y/isphv3cV3FQ/vP8+A0qlntgKmTMv4J:ZIph21hluKoMv4J
- TLSH T15CD47DC2A7898371D69E26B518EC6F0A903FB5C887BC4AD35364396F18322C36DB5747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\SkinsManager.dll
- Size 273KB
- SHA256 f3e9a31b06c41b0b544151fddb0bc735cfc100de8263b27ac2fbcf42b4b91d61
- MD5 ff33ccdd157ea8d6e67e22babfa4b16f
- SHA1 8ef628f77a67c87a9b2ca32414511d1b2ced17b3
- SHA512 21bceab2bbfe0f7dbf6163279e13591ef0dd14ef628156d4c1d69a7106bc725eb541ebd0ca04defe02e3a31579d29e10ce563044138b3cd65e27a3f8ae0d51b7
- SSDEEP 6144:qHGAZpd+36XPmL/D3z1L4vP0IytO0iwxlSO4:qH7MB/D3z1L4vP0IyQ0iuJ4
- TLSH T1D9548D107BD4C433C69F2535449BD77926FAB6715B61C2C7BB980E2E8E316C29E3834A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\data\backup.ini
- Size 3KB
- SHA256 726d3285a587967001e22d40b3cfb82627070366b27a3006fef01b25c2319ecb
- MD5 df3f77f52cba7e2776240236bc7138d6
- SHA1 f23bcc84a60abd92111fea397d773e2b9a70efd0
- SHA512 8a12c5b22be221481aab78098176f89732e1cc01d313c10370b5af95f712fe79b4c234cd27baa59dbfd62242335ed142f7b74e1a81e2a32d77d12d998579944c
- TLSH T1A481A14D6F0B583689077EB2700708A528AB17B663F09907EDDD7ACF2CD264F435E598
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Glary Utilities\x64\ContextHandler.dll
- Size 91KB
- SHA256 fb0feadf021b5bf827b52f83d81333a08a48ea3adbd18efa901ab7d93be58a33
- MD5 f80cd76328913484c9169cac60f0776c
- SHA1 1971dd5b302c9c666b85789e3093f8cdddec2162
- SHA512 3d8240247ca11d2844cd8d5a0ff83ba42478cef0300721168aee9f66fd475d7a8f0068971690752876a5c3a6946aa5b3a2ca627f1c1e6d473f0f047aa2848c46
- SSDEEP 1536:gYo1JuCyDrd+esLdFLalpgJLArcRxOpq2fM7jE7rj:g7LKd+5dF2HcDOpqKMUr
- TLSH T1E9934A0AAB694051D162D578E9D78F56F2B2BC925F108BCF2222B71E0F733C15A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\x64\GUAssistComSvc.exe
- Size 149KB
- SHA256 894fbf335caaf0ab2f513b78e1e4350d1ba93abab2daaeb6954ca2c2c8670d80
- MD5 2be40cbdcf5e2dae6165aeafb13a968b
- SHA1 21dc59eeb0ccc2c2936822435f5b585f12e1e87e
- SHA512 187019a520877360852f1a20ccad705faac49ece6fa28c8c4e4ca436b4c05f9b5a3e0310a8ceffd5d8e071afc30bbd95b06b80b5a97883ad2a8c89781968a110
- SSDEEP 3072:xL6T8T2andt0l4wE1ZCD7CWkcWzJoPj5xdnm6xsXNIQ:g8T2arwwZCy5KPJm6DQ
- TLSH T19FE35B47B7A454FAC4669278CD924A45EBB3B8610B6087CF2324D35E6F337D16E3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\zlib1.dll
- Size 92KB
- SHA256 ecb1f550471c6bfb07c673bb1b05aef6b847e88fec380262b5ff168df5415651
- MD5 93e95f14035f38267693357aea64a5f1
- SHA1 6f859b95c39f6771a2db3e6ea8ed220fc5383de9
- SHA512 b01e05cd16c8e698635057e31ba8a5c9f375db0f44b81b4779ad161c465fa4b83347767cb9aa425ee2f4904a2fef20e1ba52793fbb836c7315e7c5c75b107c13
- SSDEEP 1536:ikCgJgBbAcqmHzDgd2+nToIfZIOjIOGix+73P6ye7:i0gaNmHzDgdXTBfzFGix+bBe
- TLSH T184939E538AD06B91DCB92E3460DA963DDF32B2490BEEC2D3348C6B515A013D5AB742CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 3db1a7a5149a1f323976225c53711ed8bcb95c7fab4ed23ca24088c9ebe80b31
- MD5 41111f8567009af7afa120f290ae0be8
- SHA1 5a26ee8a9fd72529f7a47183e1ad1f69f1927772
- SHA512 db95a33c434f94f1d1d7dbf1da954fe9afc58d8938e9d709f7c590e416cf98c9512840e5b1017d4317178952d82769900e5a2772655deb50659d3942f4e4c6c2
- SSDEEP 49152:tb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnZLNiXicJFFRGNzj3:z3q6mjBO7wRGpj3
- TLSH T13FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 0763ae7cf03d1253c7348f856dbdc063b9c4249a7cb774fcfa3f108f74e35bb1
- MD5 d6bd8fb562d22077a4c5047fb593818d
- SHA1 0eec0eb7ad8b6da1a44ac34bc595916587ba938e
- SHA512 2691f38ff74ed09d2f136ae8c6c44bca152c6d7a54f27beb4d2ffedba3bc7e39eeac45fc430d6350726714549cb4d488ec2e3744cd1f3ea289d5113bfeb3ff6d
- SSDEEP 24576:hXYfDtczAq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ktcXLNiXicJFFRGNzj3
- TLSH T1E275012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 91817604234baf318c1719bea8291213872023b224752c1fed8441326c4ef456
- MD5 9e9a0444b1031fc1cf5d01558254cbe7
- SHA1 680e30207b4feb8d7883b8a912b467568b67f4bf
- SHA512 06f8a97544e1f37e95b013bf025786b836c5095b8098f59bdf0040408181fafaec35ee77cea81dc8db7bff4d7e0f23cd9c5ef42cf26f01e4a34544678011e614
- SSDEEP 24576:vwuROWo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vwSOfLNiXicJFFRGNzj3
- TLSH T1B865F18632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 43ecec0d5f0339195463c0a115a8c453ffbf706d1d913857b95fcbb67d889ef3
- MD5 ac7d12ebc068b620d5067d9211fef9cd
- SHA1 bf27ff9b708f9572cc8a3d5956ce97b67ea420b4
- SHA512 2c0e5bbf9c24b05b291292d277c7ba0264a5c52e8557b7561038f619d81defdb53f01b108cc08212eb737473cc7571badafa357b3b9b6594cf1c62b2e53c2834
- SSDEEP 49152:EB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glaLNiXicJFFRGNzj3:eu6JmIxd2da7wRGpj3
- TLSH T114D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 4a117810a49b20df93b3d6725004700229d678f817d0a5b2191b09266794cd15
- MD5 24067b04484df7325a2c65a88974cb71
- SHA1 7e5fb3a25872234aa920987de415354062d767e6
- SHA512 bda084b1094902c410161413ee70a494ea3ecf7f25bd58968b431c51ba87c09180d5ed4e1aa67ddc30a2546613f3a09d9474b280740fdbbc029d53a509e42adb
- SSDEEP 24576:Efwvzk9RX6wkyAI1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PMnYI1LNiXicJFFRGNzj3
- TLSH T13085DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 996KB
- SHA256 b483ec52cc94e2f21fa7aaee2f873a452422381d033bdf6b5e592b42f2cefe44
- MD5 cc1a9d0a9220e25ecd2182dac1996aca
- SHA1 aa904b763fb1a4de4c2f8edf15086ee749a553d6
- SHA512 3c6b09553d11bc82171d71c94227644a0d1831e7e84f2c6b3b62d9d612d781a41c3ab268272525cec860cbfd3985d7a088fb08b72a6cf937379adb5d1e05cc93
- SSDEEP 6144:BsBC2naiu5XR9ylCcbPotMxPxe1U3fUkTUdqDwu7I16/95zcTDu0htfcDWGngOBp:GCqWU3fTKqUuVwi2+DWGgOBwwF
- TLSH T103251810762AC75FC6AD40325E73D5CCAB707D42EE059B0372C8972FC576668BAF2292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 362KB
- SHA256 abb75aea83fea5b56675ca96b7a5563b615702a5c821e51242c5e00e8f80ea0a
- MD5 7faad7417a2ceeb210ad09120d4ef295
- SHA1 35d11f7ff018e0c0d6eee9e6bb20a227fc1768e4
- SHA512 eede63221b033ae6648a1dd7cfa7c8a2667f1540ca70557b1f849d11dc6105a7af1548cafb1487473136c1a51155def45aacd39a1f70cd93eb129540b3c3575e
- SSDEEP 1536:RAJ8Db28WMrjH3FtMH+x8s8EYPyAV+n3oN:i828DHHVaH28s8nxonY
- TLSH T12874C701F764F21AC0F681739870A79FAB3DB4129F125F063BC91DB9CCB225626797A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\diag fix\scheduled\Maintenance\Resources\Licenses\Settings\A\News\win.ps1
- Size 106KB
- SHA256 aa473b497f678fa03231fd55cd7c93467a26223f58f05581f59d4a81abd50152
- MD5 825db940f795e79799f96aff9de2e076
- SHA1 31e991b18e6f180e6f97439fad4561b88c802eed
- SHA512 ab4def662783717b4ab48a83991e3569d6bff2c0fd327d62adc5553e7e4e5e923645cad63ce3ae19ff0147ad29264c8e5705f7c6c84ae7ddb65c2e9713f3c970
- SSDEEP 768:o3n+xnbrb0aCfNXFmteyxUReuqNPFTRGtyHs63DnLQx+j5Rv8V/TSvsD4O2Aumd8:ou5tDkpVrDpHWt
- TLSH T16BB3FDB9DA39ECC0076C76D01AA7398A20B4A233477884A8EF500DCA7519F6EFF7555C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\diag fix\system\Audio\Prefetch\CL_LocalizationData.psd1
- Size 3KB
- SHA256 00a6c19fc0e6bc0d9da94c3ee1fa3628672ff8d2211d7d5ac8b297feb7aed670
- MD5 cbea3d1eb61aa13aebf97da2678e0313
- SHA1 e73f7d64283ac1c2eead94629ee8f21759c57cdb
- SHA512 7257b3c123e122e4815c1f3426dc4fc4c58439bda6fa03d70957690831f765fa79a63939e5b09e273a28d2b4d4f9dfbdf6620800f43d4f70aa6d2f4b4f496bd3
- TLSH T1F26155052EE8C03CF1F39F18D5A1D9131A6579DA5CE8A23C05A14D0D49E2B20CF6BBF6
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\diag fix\system\Audio\Prefetch\DiagPackage.dll.mui
- Size 9KB
- SHA256 b07cfffb57172a40a388f8f38817301c5b81a6a87a849b210e45eed60d0a36cf
- MD5 30a8c1af9bcf8bba0b6c380b25326b60
- SHA1 e236bebf7be0f573f73ab702e505613deeb1705b
- SHA512 519cbefb29826ab34bedbad89d6d3475674815bb74c203c3047a22e64f83216d3e0afc3e83c527f5e14fe4c42e4abd25a877d4b56f2cae70f990107b70159438
- SSDEEP 96:/v/dmzBrjs65GLo9navkBlvLokXpjQJtOsWg0JcWw6:/vY0Lo9avelzoOpjQJ5WriWN
- TLSH T1CE1279001EA9C53DF4A39B75C287C65392BD5467BCE9223F8A240F0915901348FABBFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\diag fix\system\Audio\ShellNew\CL_LocalizationData.psd1
- Size 3KB
- SHA256 82d59d69833c45c7b6a73b95bc2a878a59fdc849fd76aff21d8c268ee024d738
- MD5 f2b7c91f7928803c7af5fe964381fdce
- SHA1 bbac159d96eda1fffa346b6da6ac4d8c2f823aa1
- SHA512 33ffe010730689de30919475081de151f94fe519f45698cf818ed794ccdfdfad5a87f8e915018b67207461cc50b4218776d2ef229bb306bc8f18315ef99cefe9
- TLSH T11A61248663F80228F2F36F54A9B929640E76BCE6AC78D21C1291955E4CF2F50CDB1773
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\diag fix\system\Audio\ShellNew\DiagPackage.dll.mui
- Size 8KB
- SHA256 64eb9b75083ff881602ad48de5795e519c98de84029c2846bcfc857644a64c47
- MD5 c48e2806c002b63c4abe2eecd850a907
- SHA1 6022fedd0fc92a82ff708ffcd5cabd9e3d4a9e63
- SHA512 62e22d8a6ae47a30efe5692899fae7c7005811f3ba95eb6f88f54c5c1a176512e8a49713a49a8273f7784f03d05c79b53b8277ac97a0940af224d54ab4618201
- SSDEEP 96:gHd/0s6NN4HrNjuicyCrNurNZrd19ryrNzh2kjBA5ufrNZR5s337iMMl4LC9GJj9:g64d7mO4eHyWriWV
- TLSH T1F2F1CE41A3F94519F6FB6FB11EFA2A245A3AFCA6AD39C34D0650006D5872F51D8B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\setup.exe
- Size 1.0MB
- SHA256 d77941267af26274189629eea8956772005e55cadb228ac6df5f457f2beea462
- MD5 2a14a28c9937cef23341e8a8a5eaa64e
- SHA1 d6cf95791b318fe7811ddc07c901b37690517428
- SHA512 cec5758769f01705abb78db9d4951153481ae5e244b60131ce942cb5e568d7118af2ed6a6f0cdf3ef69590cb7e56243f89a669dc23e5271bde7ff46a95b57a37
- SSDEEP 24576:8bi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMdJRnYYYYYkYYYYYYY0YYYYYYYy:X/QMnl5YL7WzZyQRd7j
- TLSH T109357C52B7C3D1B2EE6215F2D47643721A39BC7517389CCBB3D4392ECAA22C0A679315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Register.inf
- Size 3KB
- SHA256 3ef78a03f14d92665877959ecc4d32abd545eaae10a1bdc8c7628ab1644417c2
- MD5 d35c0e900605f157653efcf82c88c554
- SHA1 a54ccfcc64f6b97deb93278fd149dfabf1036e49
- SHA512 3b85c260c8b59cb357d9a915f98a0ab27eaba5a3ede2f96e49e83abf651301e47837c16d284307d06ccbf8e4129f06fe612982ef33052780008f7ed3c683e8e3
- TLSH T1D3717312DBE41049F6F7AF14ADF49493AABA7818083ED1CE11984F4E49F3950CD22B7B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\gupsetup.exe
- Size 27.1MB
- SHA256 536111d3a430a66a37d5bf0b1f20d9d3d4e3de73e75bf41927c716a86c7c6949
- MD5 11f397c47b7a488c783620715c8b2776
- SHA1 4cb6f69f65750708fce5e79e2d5fdbdde138c3a6
- SHA512 ece5bbfdf776af25c704a2439ad841310d5b6bd09b47063e55d2cd3ca1e9acd9d36804b6247f1971698f1440cd2a51689ae799e098e8b74d264155c7c2531697
- SSDEEP 393216:zOrwwIdNdLjpjDUiuhMZXxJ9UodTm0J7DAOFDUDTcGwKfmgehED6w92VeCtY3VU4:z0wTNOOXxJ91TjJ7DAUDUDZmgSU2JtX4
- TLSH T1BA57333413D4A422D6B6C13E1E9B15EBA98B8F40AF4259416EC5BF1DEC33B12F19907B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SilentALL\program6.exe
- Size 27.3MB
- SHA256 0df89947dd84499aeb5804d39361c8a3aa0ddbf3c36e08220b3bf8a1763d2793
- MD5 44cf5b9bbc5eb61983bb69ebbda536eb
- SHA1 8b24c37dd70dc211ffdf8c5bd64fbd13e232a6c3
- SHA512 c9cff4cd62fb36fba47daa1f87a2268071fbc99310d742988fdb91941bccb584978d4da8fb6af9c206f60b8b27a5ceaec5d122f316df6e66482b7475b7ccd6ca
- SSDEEP 786432:TsPuXS9Jwd4NThHhGmvnZ8P07oS2KFZQ8s:TgJ9G4NTpomvnZ8PWfOt
- TLSH T1D357335BB681DD30C9F244B15E2011F876AE8CBC9AA845FB3BC73A91F1314D3B55AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsdA14.tmp\Inetc.dll
- Size 21KB
- SHA256 5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
- MD5 92ec4dd8c0ddd8c4305ae1684ab65fb0
- SHA1 d850013d582a62e502942f0dd282cc0c29c4310e
- SHA512 581351aef694f2489e1a0977ebca55c4d7268ca167127cefb217ed0d2098136c7eb433058469449f75be82b8e5d484c9e7b6cf0b32535063709272d7810ec651
- SSDEEP 384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
- TLSH T123A23B5253605FFEE3D71938B8B7773745EAE76464178A8F06732E8918B2352B930382
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsdA14.tmp\xtInfoPlugin.dll
- Size 160KB
- SHA256 6f12201a1c80198b9c9a6667c459c348230c587839a1f7b1133e14720b708aca
- MD5 8f358cfd9f9e30e64c536cd7dc5ce415
- SHA1 cbca484d99ce8da6badebfb507550974af821c21
- SHA512 14c69403c62ee82b5357980f0c76a4d9b80c7725790e0b9691a60394efc2787361f6b7dee83ca62f1b9ef6eae90bdf7d033b8c4ba6bacd51403187004b944c8a
- SSDEEP 3072:PKw+B2Ne6e9IhCiBOEM0X9FX/lChxkW0D7Fe:PTNe60Unce7Xoo
- TLSH T15DF36C0232E5C072E1FA623D0A629B2563BBBC64DEB187076750775E6E706C18D3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsiB0B9.tmp\KillProcDLL.dll
- Size 14KB
- SHA256 97b5b3985736cc0f49ceb2da68b01ce51fa821b6da3cec69cfeebfba8d626845
- MD5 2f8a43c3581af1f31ce8d9da0c03465b
- SHA1 3cce52e1dd53191127a98b324644c5cc581295ca
- SHA512 fd4ffab70048664c2f9aab375bb4c5cd89b3ff525335633dfd895dddf2be0791c56f585a9675f0a91be0d20882260709c847e0c8757e0fb49f80a932b187eab2
- SSDEEP 384:9WzZ97P5I3SlAS/5191BUrR17ziXPgKrdqr:97s6lz
- TLSH T1CD5208EBF513F0F2C54785F605A2FEBF4A3D3412482A8839EA98F4309D1B5DAA55500A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsiB0B9.tmp\MachineCode.dll
- Size 346KB
- SHA256 5d8cba3088d8f47655aeeee607842f680cdadcc40a076ea0785b7380a3808098
- MD5 b72f3c584af95c041fa9dbad2cdfbbad
- SHA1 9856ab340de2a817784d646b5fed2564f3a9d584
- SHA512 89bff99376b996dbee5a8c7f5412ec78c86b94591e84a9df3b381cf5725073ffa28a0d30eeeeb36c249d4c4368b91bf0354971d3010853a3281be2fd74222ac3
- SSDEEP 6144:o48L4/dXZ6yHiwCgKjaH0/LAo3jslcVx6cvY0obyDUrreN90UZbr8jn:o4Z/dcyHi8tH0jd4K6SYA/8jn
- TLSH T133748C00B641C036E66F257559AA877D26ADBD600BA0C2C3FBD46E7E5F312D27E3424B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsiB0B9.tmp\System.dll
- Size 11KB
- SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- MD5 fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
- TLSH T116326D5503504AF3E996863C00263B7FAF796A2095F14D53CFA394C0FE2E5C9AD38352
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsiB0B9.tmp\nsExec.dll
- Size 6KB
- SHA256 114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1
- MD5 09c2e27c626d6f33018b8a34d3d98cb6
- SHA1 8d6bf50218c8f201f06ecf98ca73b74752a2e453
- SHA512 883454bef7b6de86d53af790755ae624f756b48b23970f865558ba03a5aecfa8d15f14700e92b3c51546e738c93e53dc50b8a45f79ef3f00aa84382853440954
- SSDEEP 96:pBNUBGfVwhcAlhPRJAixx+3eDEsgcBbcB/NFyVOHd0+uisX4:qBGfV5AlJJfFgcBbcB/N8Ved0P
- TLSH T136D1D63B6AD029F3D0498930286779368BF988360F614210EFAB19E535E5DEBDA20647
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsiB0B9.tmp\statisticsinfo.exe
- Size 147KB
- SHA256 9f9aefcc2c546d11820c11a133a5d418ed90f1b27d51d18909fe55daca96f9ff
- MD5 f5d25f625cd85d01914a218e1d2a35d9
- SHA1 6681842a3d7d024d745cfb1865d06307ce726d15
- SHA512 dc7299676e939c2ce25d306e8833366c46d40d19a93419d14c4a71a9fb48f35629a504d1e004eb6cd0c119c321cac3f3268f43cafc4d3cf585e85eccac73791a
- SSDEEP 3072:+f1BDZ0kVB67Duw9AMccpo1iyWI2UDT9PefR5GDr2bLqC/qslNOtWEhJGNvKLf:+9X0GytyZXZsR8uHqCOtWgr
- TLSH T19CE3F12705A0AC57CDA30BB03DF95B3BEFB2A64551D487C3634886647F923C2175E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wrk\p1.bin
- Size 29.1MB
- SHA256 c5ba9b469be810ec60da26b9e5790434e8bbe7696f4c7dcb273863322a75409b
- MD5 fb5ee1d9451f911b3e8efe4706b0a670
- SHA1 5eb65b2fd85e80a38b2a0a6b3e85b324a28813f6
- SHA512 e286c2d7be4034f681b183da7d7e0aff3ea219d038c2e75e465b922284f63cfc2b06e666c34261ba9718ba032fc3365503958a6c97d871cc4c38fdcb14d6d25a
- SSDEEP 786432:asPuXS9Jwd4NThHhGmvnZ8P07oS2KFZQ8:agJ9G4NTpomvnZ8PWfO
- TLSH T16467338B6680FE70CCF585B15D2C12F8769F9C7C85A845BB3ECB3E9094315E2A056B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wrk\p2.bin
- Size 1.5MB
- SHA256 d6ce07877fe84f598a57dc22dca72cbd0bb9122d65b6941246ecaf809c137580
- MD5 4006bc6b72c962f6c0064129b80ec6bc
- SHA1 b36131acf14bfc2f6d5514558376f8ae7e8d29a6
- SHA512 43213c0d5f7716b38ec0c7b3362590dd3121c82fde63e7aaa8d48543eaee0d06813b508824f3628b6c224adf765b3c817c0a68fa8af75b8e67043e23588e67da
- SSDEEP 49152:o6xcx0y3Y8VKtoCLW0mGG5OyN3z9OX3h35xs0xnxV2B/azQQ8qGgY:o6IhVKtlW5E3+gY
- TLSH T16275E009E3A415ADD5B3A170DE52C925E7337C591BB1D28F03EC79A72F336908A39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\GUTracksIni.tmp
- Size 204KB
- SHA256 f76eaf824ef2e3c80c7186dab37d213e82f17388145171d12ec585114a5264a4
- MD5 22c19d500d9832ba34a586401f464f61
- SHA1 aad98a13fb09c673f93f5cd7486a6118cb005aed
- SHA512 5377fa0cb1b6a6c8471bdea2a128f0c8dcce762b3d1bcd0cf176ac9f9d7df116cb2b9d8d20d066440a11be95e6e80b41d790a2775edfdc258e287728e8f96bd4
- SSDEEP 1536:znQC+5AO7rLHHYhpZSn6GezstztUG5nrAH9SVM2DsmJ/smY4EUQwPVTlp6unb6jo:znQP5nrPPs+/kjqL11v37
- TLSH T1C2145366300AB22C849733D8B5587652B3D6DFE5C0A441C76BC5FD4E920ABC4D7BA2CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 a394474604b7f63eb167dbc375b7acf7dd7aa1a2db83a3e5dbe7decdb1d5e7ba
- MD5 381594a43067163a757db51d3834bdc3
- SHA1 4068d4c2eb3413bef02222a709098ede360111d3
- SHA512 fca765769b8e1c196995bce0eb56ef65d732bb6d696c64d9838a1c7e06e8482f0fa98609cc295393dc7082e0f21455a491f3d86b7e3dc8814d9131e5a0d39351
- SSDEEP 12288:+F7NiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T150552393468D59B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA238FDACF38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 7bfe30087cfb22aa7bfca0071c833f58b88a93b21c47524fe3c62b31df2bc28d
- MD5 6476f8260565338cc4e4c145c7c9cebd
- SHA1 bbe10bbd4e344285124ec0b6107a8678e52ba56a
- SHA512 673a412a0d022503657e88a688db6eba01aa6364cc3596d642469582667017ceb6d256dfdaf6bc71a522a9f3fffe69f7acbb6fc70e669306ebbbd6437896796f
- SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ygb4mBIBhGFrLNiXicJFFRGNzj3
- TLSH T1D565AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 877287f9a9a3b530546d41898bc43ae25af0f93e5f0d03bb1f0a49b7b0fb4ec1
- MD5 f81b9cc3bffb3a54ef64e9a2eab08233
- SHA1 20013caad422b77834625e9deefdbab9e25941a2
- SHA512 35674d40bc3aa5a3229878b78e15e5bda48c7241ce5d309673f06c251c127432c2a1ebc034692dc5f51c66c6b6e342dd255fd72b51a069e239aab1a8794b275e
- SSDEEP 24576:pG88u8FpJqH1vzria7/mQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:87ZFPqVya7/vLNiXicJFFRGNzj3
- TLSH T10785F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 a296d8684a9306ca17364d39d040a7aff2c7f42e069a1140122c6ffa13fdcfd1
- MD5 768d9c28e2b5ec5853227c71e8f6ec05
- SHA1 9fc4359d93b8aba5a051df95efcc0f73b217980a
- SHA512 3d0ecfefc3397bcb6dc333deb96f3eb2a7958193a5885d0e11b8f74bc6db9828318dcc8ed45e729ed7c6927f9eff9fef74c225ab9e56931aebc49b8bd583db59
- SSDEEP 24576:BPUr+NQ0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BJQ0LNiXicJFFRGNzj3
- TLSH T1A165F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 fd51996a1b30483a13d9b2dab77fc1944e7209f46bf0e9992340f58d53c120ec
- MD5 1834f72f7aebe6d926c2f27eb1237fc4
- SHA1 4c06a6a983beb23da71c111e21f90cec187ea293
- SHA512 fc5541c4f86d5b4bb460f5568d9be889c43c04ec7720d3315838aef2af75642d449119a7078b826625aeeb603be7ac21ebe8b40bb2590adc136a69bac2ebdb4e
- SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkLNiXicJFFRGNzj3:PG05lO43b97wRGpj3
- TLSH T19FD5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 946b4eea847fafa3bd3a6ea0c5b9802c2fce61be220a8a9e4ab7770eba55d794
- MD5 99164fa2accf828039f799f72b453159
- SHA1 c52c01de2ba1342f19c2e35b4c43aaf1c272d8fa
- SHA512 97086d87f3aa2e74d6354dcb5b81bdccb2e263809cb04700f5e11d38a2947935765e7ba8b302b8d99f2ad7a4a6463787fca4b8b51eef9e61fa02a9ee6e329f22
- SSDEEP 24576:Hfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnh/TwSfVcYG3K/cJHlnFR+IGNe8jg:/a5POZ3lJt2pasx2+mXLNiXicJFFRGNf
- TLSH T11C65BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 565a190889dc67e4f55f46df14f521646d751e60b164cbe466ecdaad07c7ddcb
- MD5 111798ede51610f523f95db11c2ab8cc
- SHA1 64494826b438e8804bba81d68aefa1bb27db4b1c
- SHA512 02827a7c2d9cc73ddeaab5200f17fc079e7d53551f58669bee0346a34c7e9e668fb01d724484d0a22ca088e7aa8f6c9988b20e3f2a417d4da28437ead1a2fd8b
- SSDEEP 24576:+NcwHdjbyQ4nLC18lb/EOjowL7FkI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+Nc/zEOVHFPLNiXicJFFRGNzj3
- TLSH T12D858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 2730ff551a999f3a2b986b6c6ff5a4343c10d35065140ed5be0914b46e42fa0c
- MD5 6de619397820461f5ca523d297133344
- SHA1 745834bf0128b52c94cb7afb561406330546a60b
- SHA512 3b1925b0fdd7803035a08753a64063a42a0c4e80ef9a8b3da2499355138645f981dd45d1d652c47ba7d94d43b3eb1b07c15438e5ff101507856c73ccee3a96c6
- SSDEEP 24576:ZzkNvNnaFeYhJNtmZBmm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZzMwBtOmmLNiXicJFFRGNzj3
- TLSH T18A55AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 c4d74014c59562ba6ef3b9dd438d4c6fbb0bd8f417dfdf42764db022cd6bfcfc
- MD5 9900ceff220f9391131a2cb1038716a1
- SHA1 c05a2576a4fd33b910e09d33e27951b6b287dc72
- SHA512 1d4698004a0087045829651c697dca3f6e9dd7675e5912a8305d38a45f4a8ec8b0da718f0e264c30bb0fcb623a091c622a3af9adf8611e0a5ff8d47622ede43c
- SSDEEP 24576:zD3FHshBIYQgAN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zDVHeBIAANLNiXicJFFRGNzj3
- TLSH T1AF75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
- MD5 SHA1 SHA512 SSDEEP TLSH