Analysis
- max time kernel
150s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
23/05/2026, 13:27
General
- Target 2026-05-23_05d84a63621f70770e15f6a068661fea_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe
- Size 24.5MB
- Sample260523-qqbfaacy8w
- SHA256 0f98314f752bc4b05982a5b194ebca3e10de81a8f8aa74749825a1d490283403
Score
10/10
Malware Config
Signatures
- Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
- Detected Nirsoft tools 2 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
- Modifies Windows Firewall 2 TTPs 8 IoCs
- Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 28 IoCs
- Loads dropped DLL 46 IoCs
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
- Drops file in System32 directory 2 IoCs
- Drops file in Windows directory 11 IoCs
- Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 28 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_05d84a63621f70770e15f6a068661fea_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_05d84a63621f70770e15f6a068661fea_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\2026-05-23_05d84a63621f70770e15f6a068661fea_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exec:\users\admin\appdata\local\temp\2026-05-23_05d84a63621f70770e15f6a068661fea_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe2⤵
- Sets service image path in registry
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c copy C:\Windows\system32\Tasks\KMSAuto "C:\Users\Admin\AppData\Local\Temp\KMSAuto.tmp" /Y3⤵
-
-
\??\c:\users\admin\appdata\local\temp\OInstallLite.exe"c:\users\admin\appdata\local\temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "c:\users\admin\appdata\local\temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c sc.exe stop KMSEmulator3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc.exe stop KMSEmulator4⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c pdk.dat -y -pkmsauto4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pdk.datpdk.dat -y -pkmsauto5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c bin.dat -y -pkmsauto4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bin.datbin.dat -y -pkmsauto5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c cscript.exe MSActBackup.vbs //NoLogo4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe MSActBackup.vbs //NoLogo5⤵
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c pdk.dll /nosavereg /IEKeys 0 /WindowsKeys 1 /OfficeKeys 1 /sort 3 /ExtractEdition 1 /stext4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PDK\pdk.dllpdk.dll /nosavereg /IEKeys 0 /WindowsKeys 1 /OfficeKeys 1 /sort 3 /ExtractEdition 1 /stext5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c net stop sppsvc /y4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet stop sppsvc /y5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sppsvc /y6⤵
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c net stop sppsvc /y4⤵
-
C:\Windows\system32\net.exenet stop sppsvc /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sppsvc /y6⤵
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c sc.exe delete KMSEmulator3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc.exe delete KMSEmulator4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exeNetsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exeNetsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\KMS"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\KMS"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exeNetsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=16883⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exeNetsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=16884⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe" /F /Q3⤵
-
-
\??\c:\users\admin\appdata\local\temp\OInstallLite.exe"c:\users\admin\appdata\local\temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "c:\users\admin\appdata\local\temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exeNetsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS2 dir=out action=allow protocol=TCP localport=16883⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exeNetsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS2 dir=out action=allow protocol=TCP localport=16884⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c sc.exe create KMSEmulator binpath= temp.exe type= own start= auto3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc.exe create KMSEmulator binpath= temp.exe type= own start= auto4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c sc.exe start KMSEmulator3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc.exe start KMSEmulator4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exeNetsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=16883⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exeNetsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=16884⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c sc.exe create KMSEmulator binpath= temp.exe type= own start= auto3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc.exe create KMSEmulator binpath= temp.exe type= own start= auto4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c sc.exe start KMSEmulator3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc.exe start KMSEmulator4⤵
- Launches sc.exe
-
-
-
\??\c:\users\admin\appdata\local\temp\OInstallLite.exe"c:\users\admin\appdata\local\temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "c:\users\admin\appdata\local\temp\OInstallLite.exe" /F /Q3⤵
-
-
\??\c:\users\admin\appdata\local\temp\OInstallLite.exe"c:\users\admin\appdata\local\temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "c:\users\admin\appdata\local\temp\OInstallLite.exe" /F /Q3⤵
-
-
\??\c:\users\admin\appdata\local\temp\OInstallLite.exe"c:\users\admin\appdata\local\temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "c:\users\admin\appdata\local\temp\OInstallLite.exe" /F /Q3⤵
-
-
\??\c:\users\admin\appdata\local\temp\OInstallLite.exe"c:\users\admin\appdata\local\temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "c:\users\admin\appdata\local\temp\OInstallLite.exe" /F /Q3⤵
-
-
\??\c:\users\admin\appdata\local\temp\OInstallLite.exe"c:\users\admin\appdata\local\temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "c:\users\admin\appdata\local\temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /k color 1E && prompt $G && Title && mode con cols=100 lines=20 && DISM /Online /Cleanup-Image /RestoreHealth && sfc.exe /scannow3⤵
-
C:\Windows\system32\mode.commode con cols=100 lines=204⤵
-
-
C:\Windows\system32\Dism.exeDISM /Online /Cleanup-Image /RestoreHealth4⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\5D514FCE-E86A-4739-B856-BC2D5A6CC651\dismhost.exeC:\Users\Admin\AppData\Local\Temp\5D514FCE-E86A-4739-B856-BC2D5A6CC651\dismhost.exe {247862DA-825F-42F9-9743-8538480341AF}5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe" /F /Q3⤵
-
-
\??\c:\users\admin\appdata\local\temp\OInstallLite.exe"c:\users\admin\appdata\local\temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "c:\users\admin\appdata\local\temp\OInstallLite.exe" /F /Q3⤵
-
-
\??\c:\users\admin\appdata\local\temp\OInstallLite.exe"c:\users\admin\appdata\local\temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "c:\users\admin\appdata\local\temp\OInstallLite.exe" /F /Q3⤵
-
-
\??\c:\users\admin\appdata\local\temp\OInstallLite.exe"c:\users\admin\appdata\local\temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "c:\users\admin\appdata\local\temp\OInstallLite.exe" /F /Q3⤵
-
-
\??\c:\users\admin\appdata\local\temp\OInstallLite.exe"c:\users\admin\appdata\local\temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "c:\users\admin\appdata\local\temp\OInstallLite.exe" /F /Q3⤵
-
-
\??\c:\users\admin\appdata\local\temp\OInstallLite.exe"c:\users\admin\appdata\local\temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "c:\users\admin\appdata\local\temp\OInstallLite.exe" /F /Q3⤵
-
-
\??\c:\users\admin\appdata\local\temp\OInstallLite.exe"c:\users\admin\appdata\local\temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "c:\users\admin\appdata\local\temp\OInstallLite.exe" /F /Q3⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /k color 1E && prompt $G && Title && mode con cols=100 lines=20 && DISM /Online /Cleanup-Image /RestoreHealth && sfc.exe /scannow3⤵
-
C:\Windows\system32\mode.commode con cols=100 lines=204⤵
-
-
C:\Windows\system32\Dism.exeDISM /Online /Cleanup-Image /RestoreHealth4⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\08FA64D5-8032-4247-81C3-85B038386DCD\dismhost.exeC:\Users\Admin\AppData\Local\Temp\08FA64D5-8032-4247-81C3-85B038386DCD\dismhost.exe {A89FB2F3-BD7E-4935-9AFF-E6707E6AACFE}5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe" /F /Q3⤵
-
-
\??\c:\users\admin\appdata\local\temp\OInstallLite.exe"c:\users\admin\appdata\local\temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "c:\users\admin\appdata\local\temp\OInstallLite.exe" /F /Q3⤵
-
-
\??\c:\users\admin\appdata\local\temp\OInstallLite.exe"c:\users\admin\appdata\local\temp\OInstallLite.exe" /x=100 /y=1003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c del "c:\users\admin\appdata\local\temp\OInstallLite.exe" /F /Q3⤵
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Windows\KMS\bin\KMSSS.exe"C:\Windows\KMS\bin\KMSSS.exe" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -PO16 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
2026-05-23_05d84a63621f70770e15f6a068661fea_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe
DismCorePS.dll
DismHost.exe
DismProv.dll
EdgeProvider.dll
Ffuprovider.dll
ImagingProvider.dll
LogProvider.dll
OSProvider.dll
ProvProvider.dll
ServicingCommon.dll
TransmogProvider.dll
Vhdprovider.dll
Wimprovider.dll
MSActBackUp.ini
MSActBackUpPath.ini
MSActBackup.exe
OInstallLite.exe
pdk.dll
bin.dat
MSActBackup.vbs
pdk.dat
KMSSS.exe
KMSSS.log
dism.log
dism.log
explorer.exe
icsys.icn.exe
spoolsv.exe
svchost.exe
memory/652-0-0x0000000000400000-0x000000000041F000-memory.dmp
memory/652-47-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1676-144-0x0000000000400000-0x000000000041F000-memory.dmp
memory/2352-44-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4140-20-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4140-143-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4792-45-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4904-46-0x0000000000400000-0x000000000041F000-memory.dmp