Analysis
- max time kernel
150s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/11/2026, 22:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
- Size 7.4MB
- Sample261110-166apsbf97
- SHA256 fd609e0e14580f183b1956436478f10f3b22f398704c3b3ff4ce59ec1d6907d8
- MD5 3bc23f413c381f8e847920a9d9b230e9
- SHA1 0eb2c1ae375c187b2c0b2b7a4d27ef17e8321112
- SHA512 c0a3550b433ad86a9bdb6336942d770afbc05a8f9323b18082656ac9c662112b8e21adc1a7ac7aa1b4a4ebbd7e1c5d764a4cf1177544221c50c7ceea852d35b9
- SSDEEP 49152:DSkU6GEi1PXegT+fijaDk77GkfYhcIrlx/jyR+OuFilq7eSaSwPeP+1fClcK9IQx:s7GbhlcRPecClcSPouC+F7n+cUJTy
- TLSH T101767B47EAB250E5C8BAC23886536223FEB1B8498730A7D7469456170F73BF0AE3D754
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\alg.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\locator.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\vds.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe -
resource yara_rule behavioral1/files/0x000100000001700a-215.dat upx behavioral1/files/0x0001000000017047-219.dat upx behavioral1/files/0x0001000000017bd0-223.dat upx behavioral1/files/0x000100000001742d-227.dat upx behavioral1/files/0x00010000000233db-239.dat upx behavioral1/files/0x000100000000c51a-243.dat upx behavioral1/files/0x000100000000c53b-247.dat upx behavioral1/files/0x0002000000021c0d-251.dat upx behavioral1/files/0x0001000000017ec4-255.dat upx behavioral1/files/0x000100000000fa66-259.dat upx behavioral1/files/0x000100000000c401-263.dat upx behavioral1/files/0x00010000000177ec-267.dat upx behavioral1/files/0x0001000000017812-271.dat upx behavioral1/files/0x000100000000c8e3-275.dat upx behavioral1/files/0x0001000000017850-279.dat upx behavioral1/files/0x0001000000017ebe-283.dat upx behavioral1/files/0x00010000000178ca-287.dat upx behavioral1/files/0x0001000000017035-291.dat upx behavioral1/files/0x0001000000017979-295.dat upx behavioral1/files/0x0001000000017998-299.dat upx behavioral1/files/0x000100000001799e-303.dat upx behavioral1/files/0x00010000000180ae-307.dat upx behavioral1/files/0x0001000000016791-311.dat upx behavioral1/files/0x00010000000177c6-315.dat upx behavioral1/files/0x00010000000233df-472.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107609\javaws.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 5720 2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5720
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
- Size 6.4MB
- SHA256 432a5e84cb8e824ae3cbf9e20a5f87d2b22dd598f3fda6f0cce3fc3e16dfaaf1
- MD5 de66bbd0a50c9f527eb68a9cd6f1f7e6
- SHA1 b052e7deabd90c85156732d29d7e37e00f24e741
- SHA512 0612d09d121c4c037afda5a567b55152e7b4ad892a491fd155d272a49fb755d02e35fa25b72175c1d2f84f19c93f50759191d56bc52eb00970d04d8ba431c69f
- SSDEEP 196608:Dog1P9fIlOuz6IgF+I3m2MXP6HG8EzBZSdlu4e:DognqO86IgF+qbM/6HG8ELP
- TLSH T1FC669C23A4E08035E5F733756D2CA73959327BA29F3145CB86906C946FB83D3293936B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.9MB
- SHA256 fa1614da8af8db9972b166bcdb495f0077f6debb47618aa36be07258ad694161
- MD5 87096c68a8dfb25bf5b5e4873fae9fd5
- SHA1 8a4a45b052f8d05034e5f78915a394a013b98dcd
- SHA512 a9ffc3ba2c4729c83b4f7863b6ab2f0765c7d41952e0f000f4cb014251432bfa9902d83391cffc870cd22c5fad8aaf85fe6d492eb1dcff530ef33cfdaa9227ab
- SSDEEP 49152:Fb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnIarSj8RoTCCW:b3q6gjB3JTy
- TLSH T1C3E59D03F2D901E8E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
- Size 820KB
- SHA256 cc27a2e6ffda35b3c993bfe23326d6346c15138889c4448635abf3997173df18
- MD5 f095a5b381f33c4b3a51cdf3fbeefa32
- SHA1 a94210f7adeba710f928323b48dc9bbeb3e2fb36
- SHA512 3d80bc2073c0ff595f7f12d3fee35da6cd877a023d07b54affe61ccb051f28677db7b207b0734f513fb20962579eee92ce42bfdee36c7bf7f9db6be22ef8a6cd
- SSDEEP 24576:LT8zpwfrk8JNUNlfusNCpknZw7PNo7QqrsW936X:LTkrlfZkdlo7Qq4y3
- TLSH T104052341EA91D262E9DD1B7017BB8B73EA9DEC9BA0F02C4787607F56DA32343D50C4A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1017KB
- SHA256 187ce89deab02dda364b3be998194d05ec93565ae73bbbe1473f904a951e61a5
- MD5 3f116b54caf5e8907e0d3c5ab99d022f
- SHA1 db50c22ff0d70fdfba11f18009dd20c8139b6b9e
- SHA512 a14ca856c17dca11e9b2140d8f4c07f1781e7dcc6fc26e4f0f5719ee7b8b0fceaf19e40bc49dc7039bd6f4ccc5034fa558d6c2cc3e21d7696a778fee316a8e51
- SSDEEP 24576:UXY5DAczAiaKngL2jdshRTdG1YxITqvfPkbIcbjLm:tAcParSj8RoTCCW
- TLSH T1FE250229A7D009F8EC6B927CCDA2C905EA7378554764E78F03E099691F233D85E3EB50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 997KB
- SHA256 3e0a02ef483d1673813b362713528f0b50812c9380d0b27d1fe6a6df40b6e6dd
- MD5 17db84b025dcfceb6b47a0e5648a7665
- SHA1 dae6d66b4f5c7389433d8be9a0fd23f35dcfce86
- SHA512 0e8c3775afa9e258f612d2b07374a8e9a8b1384e3c5e1ceb2a49bed21a73a0796e8cb86bf49447fe7e1f677573e2377b5691ae62bad70743f6d21c3222f4516d
- SSDEEP 24576:dwu7OW5YaKngL2jdshRTdG1YxITqvfPkbIcbjL:dwIORarSj8RoTCC
- TLSH T11D25014A67D40CF8E96756388697C536FBF3B8052A26CB0F07A0C65A5F373616D2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.8MB
- SHA256 2b765e08616a11d734a4949dd6396cd4ea060362fc200e9f0c4613924850353c
- MD5 3985d05165f77592cc9f63a8c2883cc0
- SHA1 b2315e44727408a501b1123c8d7b9958bf300599
- SHA512 533878eaba9616c3dc73c1e4036010cee8dd30ba5bef5cece357117921049d4f3ffd931ad5cf2068a8e2e883a5461b62588083d88f82cadc5890c4f37f3cadd2
- SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UJ:aQRQyi36YOcP8Lvw2gAf+PN36JTy
- TLSH T143667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 1589691edaf9995d0de440c98d30cc13389dd43026b17945e17b8ce267d86a82
- MD5 08a8c491431a05ee87694b894a7a6d6a
- SHA1 de5f0164c40fbd40d22f795dd47af39169288ee6
- SHA512 60b3ff1605c4cae3e7358b0d2982bd231909031b9875b2abb727c1c5e142d0b55797ff28dc9877bee802098bf9f8e03bfda7bdf3f3ce6a973bb7a7f21c4111c7
- SSDEEP 49152:hB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glGarSj8RoTCCW:3u6JmTxd2dGJTy
- TLSH T148E5AD13F2DA01E8D06ED178974A9233E962BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.7MB
- SHA256 2610da6ab56323dc42557c102cee66747ac0f3b8f47be7d28f0a25ee2fadf7e6
- MD5 735323c02ed51162646779760309c6f0
- SHA1 c0d67672c75d984c3d83ae72ba06c1e18ac99545
- SHA512 a80a73324a8762a17cff95f3ecfb62a201a029b223c02bae5df88ef325c14d452d01cf56ff57a49c9ba808690106a5a66deb05757e70923c415fc26c7ec9a7c0
- SSDEEP 24576:ZcP4mcvIjkGOxhKP2l71zNKbrh/8KBwfaKngL2jdshRTdG1YxITqvfPkbIcbjLm:uP4m4IpOO6768KoarSj8RoTCCW
- TLSH T18385BE2DABDC0195D0BA927886658A49FAB1742E1F3286CF1160933C3F77EE54E35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 777KB
- SHA256 401a7ae31da6ce9cfb5475791fb79ba8e8d3c53574102466e381394568286ca4
- MD5 870514be875b6adc379334ac49e32268
- SHA1 04d55b44c9aa162a97eb5d59eb22d1d9f4aa7423
- SHA512 7e1b492dac67048cbdfec012dde2e06b322403e8cf6a3f83b8c4683a8d8ef447be359d08b9a0526e921d42c4f91c526d2b1d992d2f39850d26ad2f10915606dc
- SSDEEP 24576:XMaKngL2jdshRTdG1YxITqvfPkbIcbjLm:XMarSj8RoTCCW
- TLSH T15E05237FDBC88F54E56B3B703AAAE84D3CA33B6C990B860DC9E0169C197A7D1593C504
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.9MB
- SHA256 bba7b73d86ce1beb124681b55b5ee66b391a24361e7e6d37f87f79ff6de99905
- MD5 2eca2c875d641ff5d734b4fb38bbae8b
- SHA1 1b6a5eea2e92210dc4efa588e4d37280691f2e4a
- SHA512 cb235428e924027578fcb9bb9b000c328ed43040383d47b9060ae7d3569dab10c9425344c60ea83e0100435982ce839b09e0d4bbc0956627fba7a42c00e42901
- SSDEEP 49152:La0h2GEkuAe73q3ppt6zwwQQarSj8RoTCCW:La0hNYGtJw/JTy
- TLSH T1CF95AF1E67DC82B5D0BAD278C9A6854BE6B2B4260B3156CF1190853D3F37EE44E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppVClient.exe
- Size 1.5MB
- SHA256 aa806643f108c3091144f1f0be6ebdbdaf14cdaf83a3b2fa64d5be923148cc17
- MD5 03f4dbaead0f23e1daaa42087f21b4da
- SHA1 0a67d194aa80316bc5d1f3c142a768eee1640b79
- SHA512 6782c961a1fd23b81b19c3e7d58ab22671f2f3f226b921f601deb12fd4188ca4388ccd652e6ca3d42fa26150db912c4e9cd596d86d8d0b82573699cec5dea01d
- SSDEEP 24576:N1QT7EcpfxR+N5AWAz3ooiYhjMqbSUaKngL2jdshRTdG1YxITqvfPkbIcbjLm:4TDxR+N5YzTTjM3UarSj8RoTCCW
- TLSH T16E75C12EA7F815E9D17E86799B23C506FA727821033193CF42A0C17E1E6B5D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 848KB
- SHA256 6eb7fa0e98691b73c5da176ea76475f0032fe56351918427b33c8ea567b74ddb
- MD5 657330e34578e76665883e7640422e24
- SHA1 210c3a19daf420f07b1580369d7174b0e610cdef
- SHA512 489100cb37e29274fd24a7b1ea8e7be4267b15c0c00a019e1f40b8a8b5a79c5e65ba0f959eccb1a92a40f896962042351b175106778a558d6ecfd66d32c6bbb1
- SSDEEP 24576:chbHjP5aKngL2jdshRTdG1YxITqvfPkbIcbjLm:chbHjharSj8RoTCCW
- TLSH T11905127E57DC11D4E172B37C6AA6894AEA72B929170683DF46D0827D0F3BBE41D38B40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.4MB
- SHA256 dd27e36fbc6f4adaef9b61cabad796488f5fec824dd1581cd7af0730a552279a
- MD5 8292e8048a2a5aa04a9f57bb06602752
- SHA1 4387bd67de6c4f01c908047515d11a81a38d0c79
- SHA512 c200f52d273166d79f2169f89043c1ec194cb1dede2b30c53c921b01faee1177527e5a1a22c4fa1a0ad945a050d11f92a442d69218fd155473b02f201e448cbd
- SSDEEP 24576:PFYgnJcRTk4yti+R5dUR/qfaKngL2jdshRTdG1YxITqvfPkbIcbjLm:POgnaTk46pUR/YarSj8RoTCCW
- TLSH T1CD65C02EF3B910B8D8A6D236450147B5BB71782D1F219ACB0170C538AF1AEE85F39F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 767KB
- SHA256 5b9ee61543602bf67df641a0eb5db33d731e20ee31cdf48cdcf6f600a4dbafcc
- MD5 abd786b81fb106b5329c7a782970d3d4
- SHA1 8f0c30766ebe225cad451396b591543e4dfc084c
- SHA512 b549e7e13858f29b6e75fba57f9efefe0468caddf39435dac30115083aafe5b3d574d10c864e5da91feb459ce21842e761d095c63d37ede22314b40a40693b5d
- SSDEEP 12288:PMacZlnnaA4BL2jacsxvRTdG1PZ6xITq02h1RPkb8mnU034cbd3PFLQWlA:PMaKngL2jdshRTdG1YxITqvfPkbIcbjK
- TLSH T13DF423AFDBC58F64D51A7BB43EAAE98D3CA33B5C950B470C8CE0559C19BA7E1263C140
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 587258dc4ef7376ad58c8429504bbd870d5e8db355fa2bbacd70017aa31eb99b
- MD5 b8afde3e4e12dce0ad8039017ad3c82b
- SHA1 ad6f39be0817437575edc03a59d924fec3b41e87
- SHA512 4cf9a672263a687888a0653d3cdc9fd20397d24b56f4e96d0846ca48e1a78b3eef72c20a84520998b08dd691ef01675557d1d24cd0405d06f4e9cd9b905d236d
- SSDEEP 24576:NaL3UTdaKngL2jdshRTdG1YxITqvfPkbIcbjLm:NaL3U5arSj8RoTCCW
- TLSH T183350259E7D400F8E86B923CC9B69906E6B2789D0355E7DF03A84B691F237E14E3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 860KB
- SHA256 989cb9b1b101b32a0a818512762900643a3aef8b013e268638e9058cb9a26f53
- MD5 dadcc99a5a3dd074dbf93dc35691378c
- SHA1 3db2afe27032f22a01225e97ba5199956a683725
- SHA512 24bd21356fc08b60e408a9b114a24694fda19ef0b281382ed91ab1de4a34402c8b129ab51e939eb414ad1c7d8ae6764922d08b47af9b76dcb8bb246707b66ee7
- SSDEEP 24576:bOOaKngL2jdshRTdG1YxITqvfPkbIcbjLm:bOOarSj8RoTCCW
- TLSH T17015122E77CC01E4E17AA23C5A93964DE6B27969070343DF46E081BD1FA7BF46C39A50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.6MB
- SHA256 ae3dfb0904301e6c664af790e1ab32235747124e65691623eb48f3b89a8ea328
- MD5 cd443141b161169bb1812cd5567b9a33
- SHA1 9a40f256c57ca08b090900fa15b84f14bfd15684
- SHA512 53e617e0c6e36d4af73ae1e95f6d0c58982ecc7164267c62021be36c84a92b6400640eb042c375e5a7f6de16f84eac3c85c50176b8cd17af3b3db4987a5e187c
- SSDEEP 24576:x7NM9YeZqmWMUkPjZM48Mv6bEhsQOmaKngL2jdshRTdG1YxITqvfPkbIcbjLm:x7cBWMpPjN8DbEhOmarSj8RoTCCW
- TLSH T1DC85AE2E6BEC81E5D477D13DC9A28205F6B2B4611B318ACF5162833E6F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.9MB
- SHA256 c645392402d3f36baa0693c12dd17c0926374da5d99a60ea8dc0c194d118c368
- MD5 03a9c4cdad951d9a00bc4efdec443430
- SHA1 d3050c3347fd9ebbcc94003f665f65e659d387fc
- SHA512 f60ed949faf37af09f2509b45622d1c2de2133b8e88de4e7f2d75c0b06257d00d969149aa5e24ce9b2313255f1c2152108dd5f79613ef9c1c6dcd1c2bcfd3c72
- SSDEEP 24576:/W6BApg2YuyuNDYTabvc1vNYf8km1OaKngL2jdshRTdG1YxITqvfPkbIcbjLm:/F2YuHNETovIvNYf8kmwarSj8RoTCCW
- TLSH T121959E2A27ED80A4E0BBD27D45B7D246F9B2B8551B3056CF0255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SgrmBroker.exe
- Size 1.0MB
- SHA256 373b6d06bc3125b48612ae575c078260b20eb09634bb7198be4bdaaca1965c83
- MD5 f37a4a22e42ed7d0ad372d6871539f36
- SHA1 978cd5d0aaa93274a3cc3cdeaf35a032d9bba65e
- SHA512 3bac0c36d1fa007d27c887281ce39e9c9bf48b4ec9e414097de1680b6bf884a53de8acce1571887ea1d75be816a5ae4aac219e26662cdad5bbbb0b7dd793f46b
- SSDEEP 24576:STMdOz0FFS+HmSLz/aKngL2jdshRTdG1YxITqvfPkbIcbjLm:+0K+HmSLz/arSj8RoTCCW
- TLSH T17935F17EA79D04E4E47BD27C9A53890AE97234650312A6DB06E0C1BD2F5BFE4393DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.6MB
- SHA256 d9f587f0efa253fbcf9b486c9de10ea9727f22599bf0e0da4e47c5a986555677
- MD5 0f8734d89466b5bdae9c2769062fa05c
- SHA1 2d98a985b358b98636a5ae5cff85e2ce0882e1a3
- SHA512 2096135e90032d3ce07e9ceb60f8324ef060bb34a5e1db4641d436588864df2d139f1c7fa8188b29549b6934d7a6e8d675639fc7c26132ea30543adb274f449d
- SSDEEP 24576:8AFs06+OmlfzNXEbTotaKngL2jdshRTdG1YxITqvfPkbIcbjLm:RFs060lBXugarSj8RoTCCW
- TLSH T16575BF2F62EC00D5D07ED27D8A97C91AF6B1746707255ACB0160863E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.0MB
- SHA256 a361ecab1072b6049979e79c27484880768c572843b293e6e8b93d525801f3a7
- MD5 91572466fb10df2beeeaf39dc9d4e7f5
- SHA1 9ace40c510f1503e6f7df48b2cbb26015c03dc81
- SHA512 07b86103219ba101531ceb8ed97c0cbc9c880e5dc908498968d7545c845accaaa2caa55d2ef9e744db46875551eb3dc727ba5bd76035c04de1ff53d6edbcdf16
- SSDEEP 24576:qJnJ5D3W2fhaKngL2jdshRTdG1YxITqvfPkbIcbjLm:qJnJ5DG2fharSj8RoTCCW
- TLSH T1DD35E13DD29810E4D4B7D374829A5B46BEB2386D2F226ACB18B4D5353F12FE09979F04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.1MB
- SHA256 864b7ff7df51048975085125ed812eb3a51c121f0d81ff56de366ca56752fe1e
- MD5 5daef5b01d27c62bd9021e2152a07478
- SHA1 f50f4f4f15b21051b1d8c2c435c493a272ee43dd
- SHA512 308cd546a99c9d7c6e42f0baa6377d2daa55cf51a882abec8fee41bea9571cfd95a8334b48822665ec35a7e9ae7f3b8b150a5773cd059712c4784356c22b1fbb
- SSDEEP 24576:HEPFhm6/7IIXdwcXrif7qQncjlP65i3VuBaKngL2jdshRTdG1YxITqvfPkbIcbjK:gF06DIKdwc+eQnSt65aVkarSj8RoTCCW
- TLSH T113A57D16B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1D33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 850KB
- SHA256 819f056f467ea00de405a6693878785db2f3090089b920884bee8a56095d6352
- MD5 a216eeae6602639fdff32b490c56b9ca
- SHA1 8344fd5729df0585186ead45cddd0656811ece41
- SHA512 4b00b4d5673688e00df5ce85aef77ab1ec28f9861c62e6c7e8bc45a9f7c05d33780b742c1c73b484c6a91ff572b85759e14d19d5e17a922c44b95df803c7ce8c
- SSDEEP 24576:Ai1aKngL2jdshRTdG1YxITqvfPkbIcbjLm:Ai1arSj8RoTCCW
- TLSH T17805226EABCC61E4D12AA27C69A18549E7B3F178570317DF45E0823D4E77BE52E3CA00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 901KB
- SHA256 ce55f55486f753073c4b7a625815a10900ae7165ee71112d90fc3e633560f1b1
- MD5 f92a25846a9f42b9eee5b3dae6d4b8de
- SHA1 13f3c9fff3785a215d1e0b6b278f6e7abcaa29e8
- SHA512 11d627e6ed4edf7a7f97c0df1921f6e986897c34600a18555bb5725e3579c37718b58829f941283babe04e063a98db07d8e0801abea271a0962f6fc2998ab956
- SSDEEP 24576:2IyHaKngL2jdshRTdG1YxITqvfPkbIcbjLm:2IcarSj8RoTCCW
- TLSH T14515231AE7C49694E57A1B386EB385882D727D249F0683CF84D0E63D6F77BD06938B00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msiexec.exe
- Size 824KB
- SHA256 d8a1607f7030fd4a42442f56ae3a7b5c676183c129c7ea575a34a31b44da5949
- MD5 f2b8c2902a53b13d98f0996a4400a0f2
- SHA1 1b4c80a85a45f737c9425f2fbe183f8d175488c5
- SHA512 1feae91d27998c2506aaf05e99d36890afd6a1febf9fd09a369127ba81c1262e664098012788ccc8b1593953f0761a7460f38e76d784668674063a9f33babf6e
- SSDEEP 24576:DHaKngL2jdshRTdG1YxITqvfPkbIcbjLm:DHarSj8RoTCCW
- TLSH T1FE05222EA7C825E4F43767746A76954968B2BA79130A47EF18E0C9BD0F37BD0953CB00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 773KB
- SHA256 e751eb28f763ef910587c047db453bc341fe7329c6faaaeaece05f16f8e1b3d1
- MD5 117c609a2eb22432f4555b6fd06e009f
- SHA1 fc3ecd77e6498fdea56918a0e1e09f694953630b
- SHA512 ce2ea36f4af9fff5f66de36d731c5dd60cd0b08160fad4d83e854b6c4cacf1c2ceb584da7ab50ed2dbd9a5a1d32631306e9dea458ebc8b35af6718298817dc76
- SSDEEP 24576:sCaKngL2jdshRTdG1YxITqvfPkbIcbjLm:sCarSj8RoTCCW
- TLSH T158F4236EDBC55B64E9173B743ABAAD8D2CB3376C960B464F88E0957C4E7A7D1213C800
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 0794a82ef39d09e8044b0daa133dcebde0601d628df3dae1ea0363c213c032d3
- MD5 bd764e94dd9a314043d5f3be1e6ae822
- SHA1 a18680bc388df8ff62ffabc6e8336458e27676c0
- SHA512 3e6f698706fce1ef8eb7a8fa520c32ef786172af77424ab55405182b833e88427c0856dc07e7b3bd4ec87ecd61458239c0f9d2e8a402520c5ec3a3552c2d56b4
- SSDEEP 24576:4Q9MxZKdcz9ew35aKngL2jdshRTdG1YxITqvfPkbIcbjLm:4VKi5arSj8RoTCCW
- TLSH T1E465AD2DABE90999E177D23595A250C3A673B4301B35C6CF2448D03D4D7BEE8AE78F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 961KB
- SHA256 4addeea56f991ddcd31b2c71bdb9adeffa1f995d1223c2122b2cb71883404f5d
- MD5 fbc1025d045454a31d3a24a65f801a1e
- SHA1 29bcde9c171dbaf50a41a387ed07189a925f0b9e
- SHA512 0c8a18b886edaae905fdfd37dfd6a3d512de4be323d3b7d553cd5d18e6325bacf8aece3b94632af11278b4f466450a2f0dd608cdb2ffad01f654cc1ea009b77a
- SSDEEP 24576:Qyoc8ApYtaKngL2jdshRTdG1YxITqvfPkbIcbjLm:doc8ApIarSj8RoTCCW
- TLSH T1F825F11FBBA940A1E176923C89858649FBB3B0345B5253CF9591C33D4F67AE8BD38B01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.3MB
- SHA256 7523b35be518f99f25ce56d8748b0488c651d863d01cfe7a7cb8a823f486e0b8
- MD5 772e1f5548eef22067ce222befbcdeb1
- SHA1 56efb7e5c66e9bc12deb339ffcc8eac65c19015c
- SHA512 d80b635a77d850aa4a5db2bdf31222cd32c25b49464256422c6ec2f1764cf0cb7044cde88ead0efb69ca5e1c7c9aa9c4eb3cfd0453cefc428b77be9c05e6d59f
- SSDEEP 49152:jjcnPqQUGpuphwC0DNLDpaRFXrLuWGMK2IKyarSj8RoTCCW:c0zuNIyJTy
- TLSH T165B58C3DA2E800A8D9AAC375C54513A6EE71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH