Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 17:35
Behavioral task
behavioral1
Sample
2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe
- Size 8.8MB
- Sample261012-v59nvaec82
- SHA256 cafd19de29dddd025f1cf35b8d970f22ebb3030e01a78430afdbb0fa1e478b46
- MD5 804e22571777c329b1530e2d0e981210
- SHA1 1218f175f51454f7e8f996ec1a121856e50dc41e
- SHA512 b4191b221ac5efaec1d7ea9325403eae8ebeaa24cbf77f0248cf99bbf5e7403c9582c5c6d1249305d0ff35a026d9feacb8300ded59c785697511b36d4a214f8b
- SSDEEP 98304:lU6PfG6fKUhYTNAvDM/zupf7qjFxiSKXHOCjSSKuqbp:lU2rnOTNA7KzuUiROCe/b
- TLSH T16B96BF5373E941ECE0BAD1798A568963D7737C550332ABDF02A099395F23AD04E3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe -
resource yara_rule behavioral2/memory/480-3-0x00007FF6C5720000-0x00007FF6C701A000-memory.dmp upx behavioral2/memory/480-8-0x00007FF6C5720000-0x00007FF6C701A000-memory.dmp upx behavioral2/files/0x000100000000931d-212.dat upx behavioral2/files/0x0001000000009398-216.dat upx behavioral2/files/0x0001000000009951-220.dat upx behavioral2/files/0x000100000001b992-231.dat upx behavioral2/files/0x0001000000009cd5-236.dat upx behavioral2/files/0x0001000000009cfd-240.dat upx behavioral2/files/0x000300000001a1be-244.dat upx behavioral2/files/0x000100000000b975-248.dat upx behavioral2/files/0x000100000000df20-252.dat upx behavioral2/files/0x0001000000009fd3-256.dat upx behavioral2/files/0x0001000000009b91-260.dat upx behavioral2/files/0x0001000000006215-264.dat upx behavioral2/files/0x000100000000a04f-268.dat upx behavioral2/files/0x000100000000ba3e-272.dat upx behavioral2/files/0x000100000000a0cd-276.dat upx behavioral2/files/0x000100000000b94f-280.dat upx behavioral2/files/0x000100000000a1d3-284.dat upx behavioral2/files/0x0001000000009354-288.dat upx behavioral2/files/0x000100000000a2c0-292.dat upx behavioral2/files/0x000100000000a303-296.dat upx behavioral2/files/0x000100000000a318-300.dat upx behavioral2/files/0x0001000000006223-304.dat upx behavioral2/files/0x000100000000bd4e-308.dat upx behavioral2/files/0x000100000000627a-312.dat upx behavioral2/files/0x000100000000a02b-316.dat upx behavioral2/files/0x0002000000019bc9-464.dat upx behavioral2/files/0x0002000000019bca-465.dat upx behavioral2/files/0x0002000000019bcb-466.dat upx behavioral2/files/0x000100000001b996-473.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\java.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe 480 2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-11_804e22571777c329b1530e2d0e981210_glassworm_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:480
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\java.exe
- Size 1.0MB
- SHA256 96f89405741b4b99f190a1d94d73e7e746ba375e0c8f1859d8d7edab6dba88bd
- MD5 31e2d9961a6d2f9a142752fcddebabd9
- SHA1 5d01a02f93d832a21b814b9e18750916c2c6ad63
- SHA512 951e0839c2258ba940ef3b156ce7c1f8702ab7e2eabcaec0f78752feff34f1d0ca650e19067535d2b85b0a950ac7aba60acdbc9f0495c169216c5d2faa02d712
- SSDEEP 24576:2ZMgzgWSirFRg1GCRXgDtVIzx64mugn2G6K6O5tsdpoV/:2ZMgz9rFqGCRXgD7W6kg2ZKvmcV/
- TLSH T121351295B25018F5ECA7823ECD655916D6B27C1A47B0CA0F03F4356A1F33370692EFAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\javaw.exe
- Size 1.0MB
- SHA256 ddaeef9dfd59020dcfcdbb27701b398fe0162150ef3b3f179e390ccf16d96306
- MD5 23e92f746ada59e00660fbf8aa0068f4
- SHA1 5e0fefec2e04cf058d28f332daf19b844160b3c0
- SHA512 4fb64c969c4eca0397183ac24addcbaf385896c6a6849189e10805c10aa3a4f2022b18d25fa4325c89c43714348cbc09937bedd98606dc8b32e37cec5db241fc
- SSDEEP 24576:wTpaLl3z0zxDFRg1GCRXgDtVIzx64mugn2G6K6O5tsdpoV/:wT0LljKFqGCRXgD7W6kg2ZKvmcV/
- TLSH T171350295B25018F9ECA7823ECD665516D2F27C1A4770CA1F07B435AA0F33370692DFA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\javaws.exe
- Size 1.2MB
- SHA256 96fce7d04319c35bd101fa8b841ef7ea735b53152ceca6e52f3a1ea84d48b0b1
- MD5 1c85ce4002ec3e6327390c2f26a2840a
- SHA1 c56f509c53a2cfca753cc9aac998e0bb631ffd7f
- SHA512 08578d5e333f1267dc723316143b8d87e092d36e857cda8f0560d1dfc6d3c9fc4623fb6a6b902bbb7abaea49f38736c1c3456e51d0f4c73eb92846ee4fe54e49
- SSDEEP 24576:b3EdcCH9y7ZMEFRg1GCRXgDtVIzx64mugn2G6K6O5tsdpoV/:7EdcCH9y1LFqGCRXgD7W6kg2ZKvmcV/
- TLSH T1F145DF90F3E810E9F0B78A35C9725512DAB67C5A5B71CE8F03A425591F336E19E38F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
- Size 6.4MB
- SHA256 e624ed57759add32f69787c29e2082449edfcd56c3a0fc8b9a7c10b954d6b7d0
- MD5 7808262eb756543a92e9f9ce887a3541
- SHA1 5f4cadd2901dad028f1021277bda7214298b5d30
- SHA512 79d651dc8cb602e5ed317795a4e4c5bec74996d6b59c66ee51cd41af7af69667e47c147f0d46bd30d5106fc813a7dc6eaf2e2144193761cdcfa2084666881f50
- SSDEEP 196608:0og1P9fIlOuz6IgF+I3m2MXP6HG8EzpGCRQ+6k:0ognqO86IgF+qbM/6HG8EVXRg
- TLSH T18F669C23A4E04035E5F733756D2C67395A327BA29F3145CB86906C946FB83E3293936B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.9MB
- SHA256 aca987d38183443a995360ac9bf48b72f4dfecb16014749012523b998e12f438
- MD5 32bebec2c1695e0eded1ebd0e1bb77e5
- SHA1 907d36e6a30496ab257e135649d90c98327d985d
- SHA512 63f6b462240be51e23001e527d3faf7eea76525ad089f1e25ec55ea00e66f7f835a4e39c82ba1a75423271b11126108fa06410e311436c5744f489157f58bd1f
- SSDEEP 49152:cb+632BuPkFKRrdE6oh7stBhuXjfS4LWxn1/+7EaqvIHpA9Ybp:G3q6gjB8SSKuqbp
- TLSH T1A6E59D03F2D900E8E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
- Size 824KB
- SHA256 656b3dcc3cc4a1130d571efeeeaa3f7685640508e97755bf821822672cd36e24
- MD5 f9c5fd5222eec0c952e4dd2ed0e1f48a
- SHA1 75db4a4e34a8f134f1173b74eec637bd7a6d7b37
- SHA512 806c66fdcf4117837ad61939e12360f2febdddbaf471916089ee833818256999a9b44339530c044c6099c7aa0313c005339f8d1ed1e80ee60c13a5fa66a9406c
- SSDEEP 24576:rTMVFRg1GCRXgDtVIzx64mugn2G6K6O5tsdpoV/:rTAFqGCRXgD7W6kg2ZKvmcV/
- TLSH T1BF052382A16510B7E5EA0B34A8372377DAB97D39D2D14F0717A13CDCAC311B1F21AAE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1021KB
- SHA256 6d7c0645238f367e14668f7b5ce7756f140de7fe77496f06b16239c295759c58
- MD5 0fae04fc5b182871adf882122558799f
- SHA1 8f9c062899e49b1564a17e9f085310a745dcc357
- SHA512 1b91c179aec82685ff48e80c341e3672e95b7b2bbc6d615a88a59fe4d6b4ff8a64b4b01570809f86b1bf85f4bc785c84456f5db53f6ed6d0bf4d835030459662
- SSDEEP 24576:fXY1k6czA5K/6XkSv7EIzp6R4kYRoBnvAHN7A9YzssAw:T6cn/+7EaqvIHpA9Ybp
- TLSH T1A025022973E50DF5EC67813DCCA28511EA73B86143A0E74B43E89A651F272C54E3EBE1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1001KB
- SHA256 ec88c54539f7f455e5f3c15d2a373e4661e5c1aede3f757b3893edda1095be4c
- MD5 11b6b68c8765f365b79807201e18bfe7
- SHA1 9cb5b29475711576e4ebd3a961b70646b21b486f
- SHA512 ecebd9fd15e32e0c27eb66b0725783dcc6fb8bb9e5a38d56e2241971c04a9200ea1684a7aebef112450ad214cbc52738b070e5444d8c1481c321794f4d59e5ab
- SSDEEP 24576:OwudOWYK/6XkSv7EIzp6R4kYRoBnvAHN7A9YzssAw:OwmOk/+7EaqvIHpA9Ybp
- TLSH T11D25014A33E40CF9E9668239C45BC536F7F2B8112A60D71F47A4C7561F3B251AD2ABB0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.8MB
- SHA256 97d5d8172d9b3d8028bad1bcaf95d61c39c59c10e139b2cfcbbf05e5f8e44654
- MD5 1ca0ad656ec9d430b8baccccf84f5440
- SHA1 e6700e3bb14414b720268d44f9b7ed94a4cac6ad
- SHA512 6f0c7785204c5bd8c1621db11beedc621145b4c9ad21920671e66d3c103b2f3b800c6d38dc0572a063baeafde81968d658257fa69bdb2e9701074867cfed53e8
- SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UZ:FQRQyi36YOcP8Lvw2gAf+PN3bVDuxU
- TLSH T14F767C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 5e98c65dd6111ed1797d8df4a654f37d58d7664252b032ec318ea40af2007841
- MD5 a194a51b8c6e2074d779004b81741567
- SHA1 b5926abe597ca781cc339cf5fec714effd52091c
- SHA512 165ea69af738f195f85ea067938537ddca260c0b2353d7aac0739df4bb61f1868033547e20fba8844ac1483b3c1f7dffbaec043896e9aae10e34b744d2070ac5
- SSDEEP 49152:xq+taZ3usBWOBr4tEGp0bqx0z+n217aau1glL/+7EaqvIHpA9Ybp:Yu6JmTxd2dLSSKuqbp
- TLSH T1DBE5AD13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.2MB
- SHA256 61319adf76be6754f9e65c0ca91b49907f06f23e278dd99bf43eedec8310f6fb
- MD5 19e0b02f784582fdec1b3a729420a409
- SHA1 f917c00242125380d2eea615e909caafc3cf7965
- SHA512 9f7d8f9bc5c8396a6516110c452a8794ad7ec35fa29acd85f36afc398892731a11f81ab05e806a7d6752c369a3f78d0fb75e92d142c14c19444643fb1bd9d671
- SSDEEP 24576:6pwvtk9RX6wkyAI8K/6XkSv7EIzp6R4kYRoBnvAHN7A9YzssAw:5MnYIB/+7EaqvIHpA9Ybp
- TLSH T19C45E029EBD848E1E177D23C98B7464AF6B178291B71C2CF029A536D0E37ED05D3A760
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.7MB
- SHA256 1c2148869b77ab0cbbc18d2808f3188a924a9930ea982821c09fcd4bf39c81b2
- MD5 a6f07f0272d9a622daa2a0a70f828add
- SHA1 d956d4773c10b9fc873cb34719890b1ce82920a7
- SHA512 3af9711f7c95f31fe1a171d6e8fc5c7854408efcda7a14ed968048fc4235e77689d199c81dc0aa27f3181e183f2ba08981afe33c2122cac52ca3d8d248f61769
- SSDEEP 49152:tYwtNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0kTxVXzuxGKlvW:tySzPEVDuxU
- TLSH T10B067D56A1A841D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.6MB
- SHA256 8e79006a7023a81698d8a43da6167569560d086bba3605c3bfd33b14f336f793
- MD5 a14cf71ee421b04a76bcebb763725df4
- SHA1 b4f5c396e8ba22dbebf07f76450aebb218047e41
- SHA512 e3f6e5da841cd3defa67fa5a6f4f5fd4634c03b5b32dce7c9a041995441aebcd4e3ff72c52b529096f4a845fc3382221c551d23a47185bd84f562423e269804a
- SSDEEP 49152:SC7JUQjXirIhCnDHUPfF/yxTxVXzuxGKlvzC:PJtglD0P2VDuxU
- TLSH T1A775BE1EA3EC01E5D1BA927885154A1AEA71742E1F32CACF2270837D6F27ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 782KB
- SHA256 5ea3b207afe66cc3049fc19d46f3a122c25c85cf942bc6c54f877cb703c68491
- MD5 93dd60783a60c3c7eedd8a14e97833dc
- SHA1 7f97da4e15f3c559ae01ba921a1633d4315b898f
- SHA512 a132a5dd5d702e76d7d5013fae5dc1d9147e20e8e92b1ca64c850687ff9a2eef9a55f588685c7fef957bffa911b7f0b0a0086b2c6c572613221d549c76113121
- SSDEEP 24576:TqK/6XkSv7EIzp6R4kYRoBnvAHN7A9YzssAw:Tf/+7EaqvIHpA9Ybp
- TLSH T11305231633D69DC1F874E631A42F84A4657AFB30E7C0D682DBDD6790152D8C28E826FE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.6MB
- SHA256 cb9f2d8ba03c05212493112b9f9e4dc3dd9d1c006ec033ac793b9b6a5f419533
- MD5 21d034b5d3a1de0d9aca875b7ce1dedb
- SHA1 dbff3ce7664912c86d4077d425004d05b70e50ba
- SHA512 47b2375e4d4c1ec3ffccb19bceda58ac987396e049efc59c0bf0da863fec037e0263a0627a0d2e87aacb91c3303361875fe04e70abc61c22caf00f7108e06395
- SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYOWLa7JTK+lXojonzuNbRs13Aa4lvv7C:4gb4mBIBhGFbTxVXzuxGKlvzC
- TLSH T1C775BF1E22EC02F5E0F5E2B8CDA64417D6B278160732D6DF1251426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppVClient.exe
- Size 1.5MB
- SHA256 3c7b075704babcb673302fe153661f7df730a2406f03be860856760ddbfd1b4b
- MD5 d764c049e6325eec6eeb92fdbb94a3cd
- SHA1 1e54c90e5ab29e1e7f010f6f50165548377e6b52
- SHA512 6b86827ac25620cf4ab754dfa53f32b6c0a15fc700284029a79d17c2a4d3cf98060bfe6f84ddb27a4b172ae10f27402aa80b668758a0cbf5d2405df464b3de11
- SSDEEP 24576:fTkNvNnaFeYhJNtmZBm7K/6XkSv7EIzp6R4kYRoBnvAHN7A9YzssAw:fTMwBtOme/+7EaqvIHpA9Ybp
- TLSH T1AB75BF2EB6F846E4D1FAC675CD238512EA727461173293CB9390C13E0E279D89E76F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 836KB
- SHA256 3fbf0bf4bb85ebaf6b9105ed27c45b6993552aef62827bb5b92cdadcb8f7091e
- MD5 c2c2cf82da536f58d080374c6273cdee
- SHA1 97fc4e92f7fe014562c29f7e9e6c33a7867ad53b
- SHA512 16db4295adaf12063af38804fcd43a4ebe01a0550b4fa857fe8953231e818bdb516f379f101a5b7d2dba698ae84dec48b002652d7238089f0f2e9e2e073c0555
- SSDEEP 24576:pGwK/6XkSv7EIzp6R4kYRoBnvAHN7A9YzssAw:pGF/+7EaqvIHpA9Ybp
- TLSH T19505232E32E66DD0D835D636D82B44D1B9B1B630A380D6EFCAE8E6700B2D4C14675DF9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 800KB
- SHA256 315da13496bc3fe9d7940a62585a5ab7efe875a7baa50b83ea41a5ff7c60def6
- MD5 c70b1f3d92e86d7b926d0fc118159d7a
- SHA1 dc23b1330afbe0e23855e8509e2de2c8856b6de2
- SHA512 45bde717786522e5dce4eb408c567f53b61b9eec893b6b6c550d456f18d9c97a33c1ab7ab0bcc9be466585ec734a2d60b17996ca05f544f1f655772ac6832c21
- SSDEEP 24576:OIK/6XkSv7EIzp6R4kYRoBnvAHN7A9YzssAw:ON/+7EaqvIHpA9Ybp
- TLSH T13505231A32968DC1E874E932E42F48D469B5F731F3C0D7C3DADC6650165E4C24AB26FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.3MB
- SHA256 e9e76f31911dc5a2a6fc4dbc2e98e38daaed2911a5989d5a55cef7f574102e42
- MD5 bbc9b334752797a9f9f417a160d582d1
- SHA1 43d973b04e8f00a9f8a27ad0da82d9bbda726135
- SHA512 7cd648e22087a25aad22e5815ba42fc2f82ac6e069969832524a9eeba99aea5fd2310dc6fa17757afe1cfaf67d25f064aa3105b78423475da9305fa68b919d58
- SSDEEP 24576:i8u8X8gMJqH1ezria7/mHK/6XkSv7EIzp6R4kYRoBnvAHN7A9YzssAw:7NsgkqVZa7/b/+7EaqvIHpA9Ybp
- TLSH T1D655016577E106F0D47BD138898646A3F6B2B42113A0EBDF47AC8B511F23AD14B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1004KB
- SHA256 3bdca9aca3a2b9ba644ac2d450393065cce8ee339f13c57caf2651f5c0ba0ca7
- MD5 8a24728c719f5e2556c289c6032f0fba
- SHA1 a3458315b61f65f9322cda04c2d3232007141dd3
- SHA512 2fa9487db3062c46b79835e7097cac345290906b8a8d57b22a0399b3357dbd6cf25bc50c1dfad3bb4c7cb1fc6991b22afdac607f6217ee0bd1162f62afe66d9c
- SSDEEP 24576:hPUr+NQWK/6XkSv7EIzp6R4kYRoBnvAHN7A9YzssAw:hJQr/+7EaqvIHpA9Ybp
- TLSH T1E525F12F32E91CE5E676E13DC9868609F771B4621351D2CF02E0817A0F67DD8AD3AB64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.8MB
- SHA256 995fc6618780dd9eb8f7acca22804a439526d7e66c5576eaffa6665a32cb76a4
- MD5 15ff27b20f2ba64aa4d703b47dcf6ab8
- SHA1 8895ccf842b94708f3f1e361613dce0de3d060d3
- SHA512 44fbb93ae42916e6bdc8eb1e8c6de23de4e22811ade021f9c38c69e6865009b0007fa6dcb1cd100b2f78e49087c30e703cf94831306c379b393815a0211cf7ef
- SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjb/+7EaqvIHpA9Ybp:yG05lO43b8SSKuqbp
- TLSH T1ECD5C06E62EC11F5D1BBD17CD9C64A0BEBB23425032456CF02A486A91F27FF4997E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.6MB
- SHA256 34aae79bef4cf4f34fa2e0cf29461651c5c5c90b8689aabef3862f467b7d5f77
- MD5 3b02534e788527822bcc47b9a527e988
- SHA1 c768f957d355eb33940c6dad239bf068e100095d
- SHA512 b31565dd2e55acb0e81d70e91bfad96d3d8721d4cd657a83df1ae830b192156cb3cf6c39f6eb1ef3adb2d0e7c799c7a623c78067c8755ea87d41e2bfe35dcdaf
- SSDEEP 49152:Ja5POZ3wJt2pasx2+m9TxVXzuxGKlvzC:NUhVDuxU
- TLSH T18475C05EA7EC01D5D179D17DC583461AF5B1342613329BCB122182BE3F2BEE85E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.9MB
- SHA256 dfd00fa5dcf8e0074d946076e00bc9518b2dc1186a027ee6d45114821182fc25
- MD5 cb3f7e7b0f75f3864923f053f1270c89
- SHA1 32982046426b44dd1fe20ebda2da76e963813ea1
- SHA512 784a291e26f576f43431f92cf404fb480383792b2268c1318195768d390fec09d3bddad32b0fed4cb4be2b730b9aa8b12fbdd7f348bde1cb147ebc017c7e69a0
- SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7FklK/6XkSv7EIzp6R4kYRoBnvAHN7A9YzssAw:rNc/zEOVHFZ/+7EaqvIHpA9Ybp
- TLSH T189959D1623E901E4F5BBE1BE897B9546FAB17865533086CF0291811B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Sgrm\SgrmBroker.exe
- Size 1.1MB
- SHA256 0a8e58edcbc7d82d622242fee224da518d06a6d3f76f88f34ac3480cc68f021c
- MD5 202b090cbe37bb9248aabd824388f097
- SHA1 6c9765fae138fef292096e8ebd6cf0ad259305fc
- SHA512 6521a4681d24421454dcbbf20a14ce0ce03497b5273ad79d46b8b53577d90ee05fa13d8587dcba8fd806148fdf1d89f570dcae705e897c5f609bcde0d5cf418e
- SSDEEP 24576:qD3FHshBIYQgA9K/6XkSv7EIzp6R4kYRoBnvAHN7A9YzssAw:qDVHeBIAAI/+7EaqvIHpA9Ybp
- TLSH T13145F13EE79C04E4E47AD17CD9638A06E7B138B90361A6CB02D481B51F6BED46D3AF50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.1MB
- SHA256 21c97befce68dbffc793e90232181bc7a567555ddfd94bef20a6328208925cac
- MD5 d184f2af547fc4cb7050c512fdfb9e93
- SHA1 2d45bdd7e52129691494bab2d88f3561480c41c9
- SHA512 2d9933622cef669c6fa38879dfda856cb036701e5a4f772801b28283f05cb3834dd8e7096578f101c4aa332059dd82bcd3e8c1cbc97ca82e7a8435b3afc8fdf4
- SSDEEP 24576:vJnJPbzB4SpK/6XkSv7EIzp6R4kYRoBnvAHN7A9YzssAw:vJnJv6S0/+7EaqvIHpA9Ybp
- TLSH T15B35F13DD2A810E4E4B7C274811A1B99FF71387D2B1169C759B8D5303F12ED0AA79F68
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.2MB
- SHA256 06e51611c15f421676f5bd01cfceb3a28dc2ce8b79fc00af80e781920e0059df
- MD5 793e5ca8c14d29a418de4b4607b7a677
- SHA1 cf4b4a5117879887d586684e3cb7a1edc6f551c2
- SHA512 e692ff42c7bb33f78c84ed06012d35b2fdef14e10e09d5d607ed09a81928d6da113a8410b8970106b84eb9a4def5f420f0e51d359daf7cdfe6d248c4fae6b4fd
- SSDEEP 49152:pCLHGeeV5ijCmlDWDkATxVXzuxGKlvzC:w+VDuxU
- TLSH T154A57C05E7EB5184E8F3CAF5C92294169A327C549B34F7EF4A80CA6E1E32BD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 952KB
- SHA256 763e0a9cd22b2b2c99b777259bd9c5a02f03a611dc9939f3cdad24c20341f59e
- MD5 8929fd84a87563a4b56eeab68e6c3698
- SHA1 bb600ae34068be5766e5c903648725655306821e
- SHA512 4c612d3212c6e342288123c3048382e2a6421ecd31b96895d2121b0982423bc7bc943ab336e30be420b51fca55b4a83ba3171889f164099df50dea32054c1db0
- SSDEEP 24576:D1DIIBK/6XkSv7EIzp6R4kYRoBnvAHN7A9YzssAw:D1DIIc/+7EaqvIHpA9Ybp
- TLSH T13525011D33BA10F5D07BD03AC5830541E2B2B17193919ADF8BD8C5B94EA7DC8B939EA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 936KB
- SHA256 2b9b8333c8dd3f9f1fc44e91dd73da0a51865dbcfd19ee4125382b73f25f286a
- MD5 c77f60ca687f26a67c872cfa413a0636
- SHA1 5f253f0f3677bf1493e80ccabcece9227351b58e
- SHA512 a30fa9bd2823b471bd1955845f8e7e88ca3ecf48dc80f7c9a6f0c9bc944708b66e52131aeae41b1721ccf5ecdfff6f3db31d87fdb1f985e42dcd780e482468f9
- SSDEEP 24576:ZtyqK/6XkSv7EIzp6R4kYRoBnvAHN7A9YzssAw:Zt+/+7EaqvIHpA9Ybp
- TLSH T1A115220533D4A8C0E9799634D82781D09A75BC30A790D3DF96E4E7392F3A6C18971BFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msiexec.exe
- Size 944KB
- SHA256 e48678eb4774f169d38d71dd384ca7419b7e32b1baf341cad18ffc7f761cea20
- MD5 ec2f033bcce4ae0b5df548ba2de92699
- SHA1 351a57fe6e2648d00e76312bfc23470a203ba550
- SHA512 34d4342c913124a6e73e8f1106732889fb75b2b0755b71057c38ba76c3965ae5f01a36707cf6b46522c4cf4b5aba74fcac25ed83ed35c9d5ee2fae13a2487f32
- SSDEEP 24576:L6UqjpKK/6XkSv7EIzp6R4kYRoBnvAHN7A9YzssAw:L6Uo/+7EaqvIHpA9Ybp
- TLSH T10525231E33D058E0E4399230E82B816581B5FD3263E0D6EFA6DC96754B3A9C1853BFB5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 808KB
- SHA256 a1c26b3e92b73e2236d0bb983227055cf16415e93320d98aa1d730171903380d
- MD5 5d7e0220913f169c4683504ca96e0aa3
- SHA1 444e0df197861abdecea6179b5f6953174b099a6
- SHA512 b0948a8ea3ad5473e32f0aac8f3a980a6ec1f3e4beadf8ded3f30277befff8abf402afad34350ef0ee393b42f6182e04f85a6d605f1b416adf3483130305ff7b
- SSDEEP 24576:rAK/6XkSv7EIzp6R4kYRoBnvAHN7A9YzssAw:r1/+7EaqvIHpA9Ybp
- TLSH T1EA05231E32969DC0E834E536D42F49D461B5F730B7C0D6D7DADCA670062E4C24A71AF9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 ed4b72956ef0a98a0169a6950f3ecb104cb0a0c84fa5458b3d6d51d79b521d75
- MD5 4c1411fb27d5f8d649c1e26f486acafe
- SHA1 430b9eb6a5ce9a1f0ae8f139f5271c09c0b3691a
- SHA512 61005bea49fea2d560fd12da7f3e0c43791b8023948f3f9ff9c51797ac01e17771baabfa19aa0b12458bbd0a8a821fd0bf6f9e910e6aa62d18e5d2fd7fe40252
- SSDEEP 24576:7+g8LoTfaidZiWLa7JTK+lXojonzuNbRs13Aa4lvv7C:agLTrZ8TxVXzuxGKlvzC
- TLSH T15665AE1DA7E909CAE2B2D679D8721493D633B4311772C6DF2448C03A4DABED8AE74F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 968KB
- SHA256 b91cd009ce397cd26424ca2ae3eb4b03a35028354a96dae4f3368251c052e3d0
- MD5 b7b053c0756a778285e523fd49a87a1e
- SHA1 a2658b068233790b12aa59c590fab6f29e8a0abf
- SHA512 dc39c6874bf8d3ae3b3828684113ecef62fe51e81a33f77b079338b0f43d2085e4602d9b3859e307ba4ddf13bb6d693604cb85a02d24b6cb859db5cad90be4cb
- SSDEEP 24576:2rcmRXWLa7JTK+lXojonzuNbRs13Aa4lvv7C:AcmR3TxVXzuxGKlvzC
- TLSH T16D25015EB3AE40A6D1B7D23C8C82421AF6B3707117125BDF52A0C77D4E2B5EA7D38A11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.2MB
- SHA256 38b1b4b6ed85572b8c2182025bdafaf00290e2a6853f4f6bf102236422087bbb
- MD5 9de6e3ee73686bee1bc0b25441af2606
- SHA1 5cc4e7b2d471ab1f5e8054456d029b6b054ed85f
- SHA512 65e26f445bd68ba71cf325d472873c6e0ab3461d5b955ee86f2527736ce93f0aa3c80f245ce7be7b30455a64b92c37ebf22022e3dfd97022dac63107c393ecce
- SSDEEP 49152:vDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3kTxVXzuxGKlvzC:E3Upow8sB7VDuxU
- TLSH T16DB59D3DA2E810A8C9AAC379C54213A6EA71742E3F3015DB0174C578BF1BDF19A39F59
- MD5 SHA1 SHA512 SSDEEP TLSH