f776c6078636fa5e9bc085d5ae6401f7ec6432338b80bb830ab1f95b5eea6b7e

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe
Size 2.6MB
Sample260708-vtdr2aev4y
SHA256 f776c6078636fa5e9bc085d5ae6401f7ec6432338b80bb830ab1f95b5eea6b7e
MD5 a1d7f80a036a93bc4b1636307421218c
SHA1 604281f60496de0d0cfe092c5743623b95fc3eab
SHA512 7c67c9f9f36a07e8ff9fe4f233ce598ee338f2c73817c64ef7bcde937397ce1d49b27fae81beec7eabc0a4c5905ddaa5799231c53f7b6812774676f367fcb222
SSDEEP 49152:+hnnoBdqTDtSQWGtKTpbTChxKCnFnQXBbrtgb/iQvu0UHOF:EoqTB32p6hxvWbrtUTrUHOF
TLSH
T17BC5F0107740CC21F25FC036C2D59EB5B5376C21AB32DD87AB483A352BB1A9EDBE1295
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence upx

Malware Config

Signatures

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral1/memory/888-635-0x0000000000910000-0x0000000000A8A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/888-647-0x0000000000910000-0x0000000000A8A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs

resource	yara_rule
behavioral1/memory/888-635-0x0000000000910000-0x0000000000A8A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/888-647-0x0000000000910000-0x0000000000A8A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects executables built or packed with MPress PE compressor 4 IoCs

resource	yara_rule
behavioral1/files/0x000700000002442b-14.dat	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000900000002442d-320.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/4108-379-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/4108-599-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_EXE_Packed_MPress

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/files/0x000700000002442b-14.dat	UPX
behavioral1/files/0x0008000000024439-325.dat	UPX
behavioral1/memory/888-324-0x0000000000910000-0x0000000000A8A000-memory.dmp	UPX
behavioral1/memory/888-635-0x0000000000910000-0x0000000000A8A000-memory.dmp	UPX
behavioral1/memory/888-647-0x0000000000910000-0x0000000000A8A000-memory.dmp	UPX

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	WdExt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	launch.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	wehzpzknyq.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	@AE3534.tmp.exe

Executes dropped EXE 11 IoCs

pid	Process
4808	@AE3534.tmp.exe
2132	2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe
2892	WdExt.exe
2056	launch.exe
4544	wtmps.exe
4480	launch.exe
4444	mscaps.exe
4404	wehzpzknyq.exe
888	huttyatdcp.exe
4108	2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe
2960	bindsvc.exe

Loads dropped DLL 2 IoCs

pid	Process
4808	@AE3534.tmp.exe
2892	WdExt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Defender\\launch.exe\""	launch.exe

Drops desktop.ini file(s) 14 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	regsvr32.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	regsvr32.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	regsvr32.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\desktop.ini	regsvr32.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	regsvr32.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	huttyatdcp.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	huttyatdcp.exe
File created	C:\Windows\SysWOW64\racfg.exe	huttyatdcp.exe
File created	C:\Windows\system32\msfte.dll	huttyatdcp.exe
File created	C:\Windows\system32\oci.dll	huttyatdcp.exe
File created	C:\Windows\SysWOW64\mscaps.exe	wtmps.exe
File opened for modification	C:\Windows\SysWOW64\mscaps.exe	wtmps.exe
File created	C:\Windows\SysWOW64\wideshut.exe	huttyatdcp.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	huttyatdcp.exe
File created	C:\Windows\System32\bindsvc.exe	huttyatdcp.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000024439-325.dat	upx
behavioral1/memory/888-324-0x0000000000910000-0x0000000000A8A000-memory.dmp	upx
behavioral1/memory/888-635-0x0000000000910000-0x0000000000A8A000-memory.dmp	upx
behavioral1/memory/888-647-0x0000000000910000-0x0000000000A8A000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\desktop.ini	regsvr32.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4776	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WdExt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtmps.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wehzpzknyq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huttyatdcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@AE3534.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launch.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a75af58bfd0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab81fc8bfd0edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017e4fe8bfd0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064a7228cfd0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e4bdd88bfd0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae108a8bfd0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002483dd8bfd0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039e13c8cfd0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.glx\ = "Advisor"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{286E6F1B-7113-4355-9562-96B7E9D64C54}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{286E6F1B-7113-4355-9562-96B7E9D64C54}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{286E6F1B-7113-4355-9562-96B7E9D64C54}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{286E6F1B-7113-4355-9562-96B7E9D64C54}\TypeLib\ = "{50A7E9B0-70EF-11D1-B75A-00A0C90564FE}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9C013DC-3C23-4041-8E39-CFB402F7EA59}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9C013DC-3C23-4041-8E39-CFB402F7EA59}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9C013DC-3C23-4041-8E39-CFB402F7EA59}\TypeLib\ = "{50A7E9B0-70EF-11D1-B75A-00A0C90564FE}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Advisor\Shell	cmd.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{50A7E9B0-70EF-11D1-B75A-00A0C90564FE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{50A7E9B0-70EF-11D1-B75A-00A0C90564FE}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\SHELL32.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{286E6F1B-7113-4355-9562-96B7E9D64C54}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9C013DC-3C23-4041-8E39-CFB402F7EA59}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{286E6F1B-7113-4355-9562-96B7E9D64C54}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Advisor\Shell\Open\Command	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.adv	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{286E6F1B-7113-4355-9562-96B7E9D64C54}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{286E6F1B-7113-4355-9562-96B7E9D64C54}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9C013DC-3C23-4041-8E39-CFB402F7EA59}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9C013DC-3C23-4041-8E39-CFB402F7EA59}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.glx	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{286E6F1B-7113-4355-9562-96B7E9D64C54}\ = "IShellDispatch6"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{286E6F1B-7113-4355-9562-96B7E9D64C54}\ = "IShellDispatch6"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9C013DC-3C23-4041-8E39-CFB402F7EA59}\ = "IWebWizardHost2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{286E6F1B-7113-4355-9562-96B7E9D64C54}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{286E6F1B-7113-4355-9562-96B7E9D64C54}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9C013DC-3C23-4041-8E39-CFB402F7EA59}\ = "IWebWizardHost2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9C013DC-3C23-4041-8E39-CFB402F7EA59}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Advisor	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.adv\ = "Advisor"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{286E6F1B-7113-4355-9562-96B7E9D64C54}\TypeLib\ = "{50A7E9B0-70EF-11D1-B75A-00A0C90564FE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9C013DC-3C23-4041-8E39-CFB402F7EA59}\TypeLib\ = "{50A7E9B0-70EF-11D1-B75A-00A0C90564FE}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9C013DC-3C23-4041-8E39-CFB402F7EA59}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9C013DC-3C23-4041-8E39-CFB402F7EA59}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Advisor\Shell\Open	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Advisor\Shell\Open\Command\ = "\"C:\\Program Files\\Sarin Technologies\\Advisor\\Advisor.exe\" \"%1\" /opennewtab "	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{286E6F1B-7113-4355-9562-96B7E9D64C54}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9C013DC-3C23-4041-8E39-CFB402F7EA59}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9C013DC-3C23-4041-8E39-CFB402F7EA59}\ProxyStubClsid32	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4808	@AE3534.tmp.exe
4808	@AE3534.tmp.exe
2892	WdExt.exe
2892	WdExt.exe
2056	launch.exe
2056	launch.exe
2056	launch.exe
2056	launch.exe
2056	launch.exe
2056	launch.exe
2056	launch.exe
2056	launch.exe
2056	launch.exe
2056	launch.exe
2056	launch.exe
2056	launch.exe
4480	launch.exe
4480	launch.exe
4480	launch.exe
4480	launch.exe
4480	launch.exe
4480	launch.exe
4480	launch.exe
4480	launch.exe
4480	launch.exe
4480	launch.exe
4480	launch.exe
4480	launch.exe
888	huttyatdcp.exe
888	huttyatdcp.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	1140	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4600	4648	2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe	87
PID 4648 wrote to memory of 4600	4648	2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe	87
PID 4648 wrote to memory of 4600	4648	2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe	87
PID 4600 wrote to memory of 4808	4600	explorer.exe	88
PID 4600 wrote to memory of 2132	4600	explorer.exe	89
PID 4808 wrote to memory of 4584	4808	@AE3534.tmp.exe	90
PID 4808 wrote to memory of 4756	4808	@AE3534.tmp.exe	91
PID 4584 wrote to memory of 2892	4584	cmd.exe	94
PID 2892 wrote to memory of 2504	2892	WdExt.exe	95
PID 2504 wrote to memory of 2056	2504	cmd.exe	97
PID 2056 wrote to memory of 5004	2056	launch.exe	98
PID 5004 wrote to memory of 4544	5004	cmd.exe	100
PID 4544 wrote to memory of 4444	4544	wtmps.exe	103
PID 2132 wrote to memory of 4404	2132	2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe	105
PID 2132 wrote to memory of 888	2132	2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe	106
PID 1140 wrote to memory of 4280	1140	SearchIndexer.exe	108
PID 1140 wrote to memory of 1832	1140	SearchIndexer.exe	109
PID 4404 wrote to memory of 4108	4404	wehzpzknyq.exe	110
PID 4108 wrote to memory of 2368	4108	2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe	112
PID 2368 wrote to memory of 116	2368	cmd.exe	113
PID 888 wrote to memory of 2944	888	huttyatdcp.exe	115
PID 2944 wrote to memory of 4776	2944	cmd.exe	117
PID 888 wrote to memory of 4824	888	huttyatdcp.exe	118
PID 888 wrote to memory of 2960	888	huttyatdcp.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Users\Admin\AppData\Local\Temp\@AE3534.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\@AE3534.tmp.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4808
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4584
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2892
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 2892
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\wtmps.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wtmps.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\SysWOW64\mscaps.exe
        
        "C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe
        10⤵
        Executes dropped EXE
        
        PID:4444
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:4756
- - C:\Users\Admin\AppData\Local\Temp\2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\wehzpzknyq.exe
      "C:\Users\Admin\AppData\Local\Temp\wehzpzknyq.exe" "C:\Users\Admin\AppData\Local\Temp\slwigdbmnm.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4108
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4726.tmp\Open ADV On New Tab.bat""
        6⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2368
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /i shell32.dll
        7⤵
        Drops desktop.ini file(s)
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:116
  - - C:\Users\Admin\AppData\Local\Temp\huttyatdcp.exe
      C:\Users\Admin\AppData\Local\Temp\huttyatdcp.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:888
    - - C:\Windows\System32\cmd.exe
        
        /c sc config msdtc obj= LocalSystem
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2944
      - C:\Windows\system32\sc.exe
        
        sc config msdtc obj= LocalSystem
        6⤵
        Launches sc.exe
        
        PID:4776
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4DEl9SiY.bat"
        5⤵
        
        PID:4824
    - - C:\Windows\System32\bindsvc.exe
        
        "C:\Windows\System32\bindsvc.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2960

C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4480

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4280
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini

Path C:\Program Files (x86)\desktop.ini
Size 174B
SHA256 66403205bc86d98b75f2449958f717f2f971fca0d33b0d211f03971484e9b567
MD5 5b8a2ba3138573583ff9e0158096ec48
SHA1 fdb99bdc4e7016132b9efcefb5bd4c7210958927
SHA512 9c329baf537ee23da9fb1bcec4838a70c5776195b42868dac9be21749a0fdb06186c8468c26ef93bdf654996cd620ffe3b9021523ceeda4bd96fcb3d3c5a02ad
TLSH
T1DEC08018D2E9311141718D12FD749001DBB1B8216C17CF5E07C0518F04A0605E631743
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
Size 2KB
SHA256 7371ffe6f09dd1dd94b83528ae65e3f415ea4845e21a15398d1234ff1bc3ac49
MD5 6b187d7111adf94784aa15ac7c47905c
SHA1 4f164fafb6c3930fecacf2e11b11d637d86f0717
SHA512 d87eaf7ec3ce2edaf0ad96b6278cb98045251bd329a4170f5a69fe2eb2094302331ef0865db0e0817ce4f9b94fccccc304fc9eb430c856a6ac265b0a07d4c844
TLSH
T1DC516716A2FD1751E6714F26B8F8C0158BB27C217C2BCB9D17C0A28D58A0D94F577B63
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini
Size 174B
SHA256 cdb11958506a5ba5478e22ed472fa3ae422fe9916d674f290207e1fc29ae5a76
MD5 7f1698bab066b764a314a589d338daae
SHA1 524abe4db03afef220a2cc96bf0428fd1b704342
SHA512 4f94ad0fe3df00838b288a0ef4c12d37e175c37cbf306bdb1336ff44d0e4d126cd545c636642c0e88d8c6b8258dc138a495f4d025b662f40a9977d409d6b5719
TLSH
T119C08C38D2E9322141728D33BCB4A002DBB1F8212C1BCF9E06C0918B08A0A09EB32B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
Size 400B
SHA256 fe3822a07cc8b36314988bffe9f9ef32aed34a7178b6fd1a57ff89fff708002d
MD5 0356e89930845d5feae7cddfda539da9
SHA1 7bee5dfc9bb58ae863114061b7ba6ba186b1d9ee
SHA512 d367e50b2d002a63c26a9beedcbc119de8d31ea7c8df17d44b5b1b99c306423b66e45f55e085bf3fa831687f5be890955da4c7614d7886acbedb199233467cde
TLSH
T1A4E0125593FD2150A5738F517CB594519BF1BC206C2ADB5D12C8518E05B0944D632BA3
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini
Size 174B
SHA256 8e00a24ae458effe00a55344f7f34189b4594613284745ff7d406856a196c531
MD5 a2d31a04bc38eeac22fca3e30508ba47
SHA1 9b7c7a42c831fcd77e77ade6d3d6f033f76893d2
SHA512 ed8233d515d44f79431bb61a4df7d09f44d33ac09279d4a0028d11319d1f82fc923ebbc6c2d76ca6f48c0a90b6080aa2ea91ff043690cc1e3a15576cf62a39a6
TLSH
T1A6C08028D2E9311041718D32BC749002DBB1F4213C17CF5E16C0518F04A0605E732743
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-08_a1d7f80a036a93bc4b1636307421218c_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymai.exe
Size 865KB
SHA256 12ca962dc3397f038dec0ff55ac84d8b71f1c56b28e611e44ee3ef094fbd3b6e
MD5 ea4ef49de041aa33b7291a8f99876fbf
SHA1 6a8d3bafceac1d59d34e83345fdff0106e42132b
SHA512 22924a2ecbfe6f29ddbe9dbd56b9bc6da2bf967cf7746042867e3382dd54cc009ef3d8c967303bcce2f4b63a0553b5eade63757319f2f2c9cccf413dce342b19
SSDEEP 24576:jh1DXWalj3DSudvGM3MXTVhtSQWGtxkDXX:jh1aoBdqTDtSQWGtKb
TLSH
T1B515F150B740E43AF0638939C869C2F29629AD52DF505ACBF3583F193D317D49EB13AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

463B.tmp

Path C:\Users\Admin\AppData\Local\Temp\463B.tmp
Size 406B
SHA256 27e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f
MD5 37512bcc96b2c0c0cf0ad1ed8cfae5cd
SHA1 edf7f17ce28e1c4c82207cab8ca77f2056ea545c
SHA512 6d4252ab5aa441a76ce2127224fefcb221259ab4d39f06437b269bd6bfdaae009c8f34e9603ec734159553bc9f1359bdd70316cd426d73b171a9f17c41077641
TLSH
T1C5E0A238F30DCC2AE1D032092011CE86F23C128AE6A1FBA82AB421A3B00350CC2346E3
MD5 SHA1 SHA512 TLSH

Submit Download

Open ADV On New Tab.bat

Path C:\Users\Admin\AppData\Local\Temp\4726.tmp\Open ADV On New Tab.bat
Size 160B
SHA256 49a64fd554f23a3d87ca4c5e015aecc94ce2e28e2098ad0fcc94ba70e1937fd5
MD5 789eb0179e0a612c3100e9d4104a91f8
SHA1 eed34da8da3405c184a72c134248c9101e3b899f
SHA512 5fede4d206d9fb2d036fe0b264d2dd7e8c626aec70416d2f8c33f77b3d7a98271d13af23910c49012fc37992db3f20e2035cee062f11608d2211c2626d246de6
TLSH
T158C08C0CFA108764AD0A50809700281E244FED884B3C3B32A36A126A61E502584EC6E8
MD5 SHA1 SHA512 TLSH

Submit Download

4DEl9SiY.bat

Path C:\Users\Admin\AppData\Local\Temp\4DEl9SiY.bat
Size 196B
SHA256 77380cd65fd14275577f45e65d5b02f40c77fe672ebaf446d82d4c95faad980e
MD5 a1e55129b72532a8a656818d8c279d2e
SHA1 528a0501faed4d9aabecadfd2c66542afa0c19ee
SHA512 eacbc7ad1ea13bddc99124176bc2cb51f8327821a06fc2d61ffefde0beb75003fb0a53c033796e7080a6abd821890eb13bdb837b712400c14acfca5196940b41
TLSH
T1B4D0C95186FBCAAF0848956F0EA1628D8565886A3F6A2B116634C88C21CA80DBAC2381
MD5 SHA1 SHA512 TLSH

Submit Download

@AE3534.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\@AE3534.tmp.exe
Size 1.7MB
SHA256 2d925e55028021bd00ada6d5c92318ce8e2c9456a788c48694c2396d4eb66050
MD5 452ff8e74a5a27e42ffbbdeddd8968f8
SHA1 93f6d32b44d7bfb2f6558bdbf5a1e7bf23a15e56
SHA512 a97d8e769820e5a7c2fdfe4524bce00c82f27aab4728815c17c71e8b87d9d4a997481a8ac394cc674545d2d5e42cd5533bef8b80c4b8c85cabcf4c26ea25872e
SSDEEP 24576:OXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UN6:mbTChxKCnFnQXBbrtgb/iQvu0UHOz
TLSH
T17585DE252790CD61F36FC07683E16E79B5B329213733D886AE4855312BF2E2FE781196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

huttyatdcp.exe

Path C:\Users\Admin\AppData\Local\Temp\huttyatdcp.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

slwigdbmnm.exe

Path C:\Users\Admin\AppData\Local\Temp\slwigdbmnm.exe
Size 92KB
SHA256 3faf24aa799233d1967475aab9debda84277c44a35385e799060136106753a9b
MD5 60abcbecb0b558d69084bc7f3486e792
SHA1 a575b681a1595ea82a2e18d8ce909cd4f6c5d99b
SHA512 fc77621753e34843316f1bbec0d64ad3512146562eabe52b6b0365ecdebcdd23c9f58bdb67976952d36d38592bec11e838c1ef094be33ce6ebc981419a5a53f0
SSDEEP 1536:eXmMyMWO0S9iRAK9WgF3SF/IXCEbamLzbDq5zXVZO:5OZ9kAK9nBSF/IXzbam3gl
TLSH
T1F0933A80BB04F82EF4978D3EC4A991FAE1249D52DD005F17F2257F0978393A59ED22E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp39B8.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp39B8.tmp
Size 1.0MB
SHA256 07ffcde2097d0af67464907fec6a4079b92da11583013bae7d3313fa32312fe8
MD5 df2c63605573c2398d796370c11cb26c
SHA1 efba97e2184ba3941edb008fcc61d8873b2b1653
SHA512 d9726e33fcfa96415cc906bdb1b0e53eba674eaf30ed77d41d245c1c59aa53e222246f691d82fa3a45f049fbf23d441768f9da21370e489232770ad5ae91d32f
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyK:O
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp39C9.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp39C9.tmp
Size 229KB
SHA256 70a392389aecd0f58251e72c3fd7e9159f481061d14209ff8708a0fd9ff584dc
MD5 6f90e1169d19dfde14d6f753f06c862b
SHA1 e9bca93c68d7df73d000f4a6e6eb73a343682ac5
SHA512 f0c898222e9578c01ebe1befac27a3fb68d8fb6e76c7d1dec7a8572c1aa3201bacf1e69aa63859e95606790cf09962bcf7dc33b770a6846bed5bd7ded957b0b3
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyq:u
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp39DA.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp39DA.tmp
Size 120KB
SHA256 01631353726dc51bcea311dbc012572cf96775e516b1c79a2de572ef15954b7a
MD5 f558c76b0376af9273717fa24d99ebbf
SHA1 f84bcece5c6138b62ef94e9d668cf26178ee14cc
SHA512 2092d1e126d0420fec5fc0311d6b99762506563f4890e4049e48e2d87dde5ac3e2e2ecc986ab305de2c6ceb619f18879a69a815d3241ccf8140bc5ea00c6768d
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy:u
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp39DB.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp39DB.tmp
Size 126KB
SHA256 ae5697f849fa48db6d3d13455c224fcf6ceb0602a1e8ac443e211dd0f32d50f4
MD5 02ae22335713a8f6d6adf80bf418202b
SHA1 4c40c11f43df761b92a5745f85a799db7b389215
SHA512 727d16102bfc768535b52a37e4e7b5d894f5daa268d220df108382c36dcce063afdbc31fd495a7a61305263ec4cd7e92713d894faa35b585c0b379217a1d929c
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyK:u
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp39EB.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp39EB.tmp
Size 89KB
SHA256 63149ad45db380f5dd15f65d9ceb2611d53a0a66e022483bee4ce2ff7d2610e2
MD5 09203a9741b91f3a9ed01c82dcb8778d
SHA1 13e6f3fb169cd6aa5e4d450417a7e15665a2e140
SHA512 9e9e6fe0dd713417d0e28ba787cf862d55ecda9ee9f3df1eada144657f6a3b6ada1984fd05a3fffcd597a9715383225a8e40b6e5d0d8d39ec0d3a64b8dea9846
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyS:O
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp39EC.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp39EC.tmp
Size 99KB
SHA256 5ec8093ef5939d1abce1c576097b584fb600b94ad767c1da897f7cb7f0063d26
MD5 9a27bfb55dd768ae81ca8716db2da343
SHA1 55da0f4282bd838f72f435a5d4d24ac15b04482b
SHA512 d9bb49d2f282ed09c351a1d8eb2540781e6a7fb39265473fd59d146bfc162f27a4ab1405301ed7395c12929a80551a399437d7d794d7ac48650e9037b60eb69c
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyq:u
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp39FD.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp39FD.tmp
Size 172KB
SHA256 27c945ccb84aa024f1f063701327e829a7ef3a7ede4a43b2febbb1dddbdf8740
MD5 2634fa3a332c297711cb59d43f54ffce
SHA1 8e2b68d0ee4e792efb1945ba86eceb87f07087d2
SHA512 84e4799b9b18a7cc7be685c793a9b4fb135ea331d1d235fe823e1d7091130f131ab2fbad1da4dea795e82547aa16b00f4e2a9faaa96cb522d795f9abfda2fc53
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyK:u
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp39FE.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp39FE.tmp
Size 276KB
SHA256 d2fa6f9686386a92253a9c5ea25ace702a111483540b60c1300789235cea7fdc
MD5 e07c6a9e595f045fadc463dfda44ab16
SHA1 e6b199272ade02613f2003c365a4cb1487431e23
SHA512 f3c630ae8381b99519aeeadbc2918810e7fb09a909f73ee6c46f4e9d3cf8c5051a5cf763db6a775d6cd8713ccf95a63b18df9ed756fa28276e8d7ab6a47f2cbf
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyX:T
MD5 SHA1 SHA512 SSDEEP

Submit Download

wehzpzknyq.exe

Path C:\Users\Admin\AppData\Local\Temp\wehzpzknyq.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtmps.exe

Path C:\Users\Admin\AppData\Local\Temp\wtmps.exe
Size 276KB
SHA256 3b20c853d4ca23240cd338b8cab16f1027c540ddfe9c4ffdca1624d2f923b373
MD5 75c1467042b38332d1ea0298f29fb592
SHA1 f92ea770c2ddb04cf0d20914578e4c482328f0f8
SHA512 5c47c59ad222e2597ccdf2c100853c48f022e933f44c279154346eacf9e7e6f54214ada541d43a10424035f160b56131aab206c11512a9fd6ea614fbd3160aa0
SSDEEP 6144:Xaz/zwzFEN3MmUGvSQagFwDeSv3BU9T4/XGOUYM/mVz:Iz8qamFVa1D69T4RMmVz
TLSH
T16354121B18B78123F4665570A9E107C18F7E5A0732A58B2FCF61CC3E46E09698967EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launch.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
Size 172KB
SHA256 6a7093440420306cf7de53421a67af8a1094771e0aab9535acbd748d08ed766c
MD5 daac1781c9d22f5743ade0cb41feaebf
SHA1 e2549eeeea42a6892b89d354498fcaa8ffd9cac4
SHA512 190a7d5291e20002f996edf1e04456bfdff8b7b2f4ef113178bd42a9e5fd89fe6d410ae2c505de0358c4f53f9654ac1caaa8634665afa6d9691640dd4ee86160
SSDEEP 3072:ng2TyMj3tEcWMkc5tTBfZOVxtDH2g3zd3jceABCODJRCyA:n7xqcWxc5tTBsJWKFGUOfCl
TLSH
T10E04BE193A9089B2C0BFD0B7C0D5BB28F77732321322D94B679C96750D62776F6122DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WdExt.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
Size 1.7MB
SHA256 6424423af89f62e1459ec6e21e1f5d982cd3fe4d6072dd8e469d95690ac240bf
MD5 7718d1f65af48ced1fcba3204cd3f691
SHA1 573ca2819b17fa8d979992e77f6a38644586ca89
SHA512 5ede1232a02c4ace25b51ff541d3228c2283eafb446f0a2fa354ae5a9bfb63cc19e3f0a7835b0cb47d0c2cff42968f1838492d744be44c6ae2455ec43aa94ac9
SSDEEP 24576:OXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UNb:mbTChxKCnFnQXBbrtgb/iQvu0UHOQ
TLSH
T14685DE252790CD61F36FC07683E16E79B5B329213B33D885AE4855306BF2E2FE781196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Admin0.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
Size 129B
SHA256 b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020
MD5 d1073c9b34d1bbd570928734aacff6a5
SHA1 78714e24e88d50e0da8da9d303bec65b2ee6d903
SHA512 4f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f
TLSH
T1B6B09B1243C8C70E7C67B1974B75544C517446C57B447509DB45C48D325191CFCDD556
MD5 SHA1 SHA512 TLSH

Submit Download

Admin1.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
Size 196B
SHA256 9c415314ade7de23f4ad0f270467a29ab394c01752de3df82a37f187aac56560
MD5 3160639eab6a58e30bebfa47f6ac72fb
SHA1 c593b32c09b605364aad100f5dc8b43515d3d79b
SHA512 84b8371a837d0934b53d748f211b69baa37fc245c5ae858e10b6c0a0bc1e35e9f072e7ac734b95083b50e9cb6230140a0ce66c24897333716f8649e5651f9cc0
TLSH
T178D0224A02C2C7CD640460170B39928CC1B97AE83F8A330B8612C44E248060CB983600
MD5 SHA1 SHA512 TLSH

Submit Download

Admin1.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
Size 102B
SHA256 00e5f00b8ea8adfa2ebc74110fa32c920b25ce8d447dc65f367f5eae12458942
MD5 aca8fb2d8abe1a36a06584a491e51af1
SHA1 fd989834258db1e2637365f1dd47bd0e1aa0194f
SHA512 717f665916a1347a7b2671afd8b328539d70d15d5c0bb6a788fa20d65dfa000f2ed00a40b791d4b3d9960071b98f47fb79cb8f0e0d16eda610666d3de12bc090
TLSH
T111B0121543CBCF0D144060D7077691CCC0744D983F947714DF01C84C314080DFDC2A01
MD5 SHA1 SHA512 TLSH

Submit Download

Admin2.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat
Size 126B
SHA256 202648759badb056ec028c429d54c96bae9a8b5bad081eb23a01c2b82cd0f47d
MD5 ec684badd1bb3477dbc2ba499267761e
SHA1 19395893f726009b7a7231af44d30adb4406a610
SHA512 2d9b63aadb9590c5f6fbdd938bd4017cfd57b6efe94028a6d39d359be941e592ed0d56b85b2636c8b50ebae3ee78500ca00edaf08f14864aef813a9e5377f63c
TLSH
T170B09B1317DDC74EB45260970775555D507C49D23E98B505C611849C354180CFC5E545
MD5 SHA1 SHA512 TLSH

Submit Download

mydll.dll

Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
Size 388KB
SHA256 93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a
MD5 8d7db101a7211fe3309dc4dc8cf2dd0a
SHA1 6c2781eadf53b3742d16dab2f164baf813f7ac85
SHA512 8b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83
SSDEEP 12288:PDCOy/psISIHbl9f/mnmO/5Se71RpNJmq3CrP:RyRznmnp5SedNJBCL
TLSH
T1E3843A12B7A98025D6F30A74263DB536A4397C750F50EEEB73250B6DA830FC1DB79A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mydll.dll

Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
Size 388KB
SHA256 26950da09a736a90503419a5253dfbb9bcc061b22724b6f499bae56c4db16e45
MD5 c3125a26d4cc87ed2e9818a291e89cab
SHA1 ef4347af4b5aa36fe85a5fb3d5f581f1efbe9b1a
SHA512 5d3cf9dbaed71a87d457adabd4eaa1c4bdf26d27348c83ef5cb1fa2fbd66b6e10735d5cfa06229df9f11b3bafbe4e46bd843746819dfe243420e296e68fbe44f
SSDEEP 12288:PDCOy/psISIHbl9f/mnmO/5Se71RpNJmq3Cs:RyRznmnp5SedNJBCs
TLSH
T11D842A12BAA58025D6B30674263DA637E4397C710F94EEDB73250F6DE830BC1DB79A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Public\Desktop\desktop.ini
Size 174B
SHA256 7148fbbf1aac8b5a54d248df19b60c00d3c0dcb2fd5bb2a1efd4e0f0eac6dd0f
MD5 dc723b859dec1526568ad581aec334d5
SHA1 74e7432df4a66f246b5214d60b190b67e2f6ce52
SHA512 9bb97339f18dc8744bfb7cb8fd9392c580765e707ddc228ef5045150375510b43f1f4c310274e20fc1c0c51f50f40d4430f40561d5cff46ff42214e465490074
TLSH
T16BC08018D6E9313041718D12BC749001DBB1F4212C17CF5E06C0518B04A0604E735743
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Public\Documents\desktop.ini
Size 278B
SHA256 b18f9a899844d82f60ff3a1ab7fc9efc4a7297d78c04bcda65362b7bce2c02a8
MD5 ec659b643b3dc5a57dafa797bbc83871
SHA1 1279184f609ae3d548d88ae02a586e341baa590e
SHA512 f9096ec72096b15629f3153908e2f51da316b68b754daef91728c8ae86fcc51bf540709d85166538e2766864d69f906b5a67dcb1b65ed78f2bdc49ba2f4d7c96
TLSH
T149D05B0492FC221052714E22FCB8E001DBB1B8212C17CF9E478091CB19E1A44EA32B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Public\Downloads\desktop.ini
Size 174B
SHA256 6783e0a9fea5beb9ff2bff02264784e42e5890f89da6c0395f6325591c823fbb
MD5 81594cbb270b4099912612cd3c20306a
SHA1 1d96ac453b2bb9457550358b2479810a05f00c83
SHA512 2a145cbaabed1ede8c78a40d7903fa48124dbfc506d881627ec3a5b34746ad24e5456955e5b6c06ecd2b486b731db1e1407aeb8c405c257b14f0a88c668c1d51
TLSH
T1D6C0801892E9311041718D12FCB49002DBB1B4212C17CF9E56C0518B08A1605FA32743
MD5 SHA1 SHA512 TLSH

Submit Download

RecordedTV.library-ms

Path C:\Users\Public\Libraries\RecordedTV.library-ms
Size 936B
SHA256 1b2fd8f67230f58de50bb0b04e9a9e6d300c202959b4ead7ae36d371028f9fe4
MD5 fe790969fd4b35ddef14eec4c9b692dd
SHA1 7168b44538958375eacc8d4615440bd116c228ec
SHA512 d1ec10d9aab26acb2340c5fa654abd8a5c259a061a2fd8ae016b9ffabcda47099ed6f08e96971dab1e3b248bca297502a92fe13204f35b0ee5f1b0d954e3342c
TLSH
T17711970549F0E25033FBC2538922F14CE976874F865A8920F4DC83235F35AEDCA237A2
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Public\Libraries\desktop.ini
Size 175B
SHA256 1efc1dc35230c0812630135f042918692572cd0689d6dabd9787f7086794770f
MD5 203abc35ee1b804c770321d392cac58c
SHA1 6b277aef54c3bc11b904754bbb85ce4eef211a73
SHA512 20e7169c9b9d812797ba2d3be940fae0314d40af9edfb5afe04f79166adca3370cfd88c01967cf5c5586d5bea83e2b5bb85997d305e613cc0fe91244418d65d3
TLSH
T1F9C0121E82079638B68DD14AA830415EA03D345E0112D3004AE0B293E47511C0734E78
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Public\Music\desktop.ini
Size 380B
SHA256 f09a1312cd41aadc809249dc3a6f5d5318266b40fd74b9e714571419810131de
MD5 48f5ac70aaedafe403b362e41da1e1d6
SHA1 d40e48c5d0ba5f764c2b8d064a4ff3c6b85d7719
SHA512 d2a2d5db0fcc41dcde5b0797f1c917d050b75e5ffdac5a09cefef3aa386ced22f94f2719d76eeb03d063d0d199b8cd1705b563b70f4334c4de01d1264b1a5dd2
TLSH
T17CE01209A2F9221052718E27FCB8D0019BB1B8222C1BCF9E4784A18A18D5A14F632B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Public\Pictures\desktop.ini
Size 380B
SHA256 73671d1ba8a835e74033f7e62afb9371c98f01efdd760a2d7093abbfcab7fafa
MD5 2f145cca0196fb928ee5656f2cfc2934
SHA1 1e90a311b867131811fe6faafd75aa17c3af64e9
SHA512 30c434daf25be9c1f2b6f972b7f0d47e5ee2495feff5982cf8ff0cea96765d505e112a2132cd00b24bf42ec5eb4e0e8b92cef387f9a3fe2ffa5478c0b85ab525
TLSH
T1B5E01209A2F9221052718E27FCB8D0019BB1B8212C1BCF9E57C4A18A18D6A15F632B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Public\Videos\desktop.ini
Size 380B
SHA256 d719c6796022f1e7c94a3208b6a488191e83c135067b6640dc5f7fcb872604e8
MD5 582bd0facb013808c1c4804d894cd9fd
SHA1 110a526a7a56b6df5bfc547b33cb852e590bb893
SHA512 f65f6015b14149b8b5da1ec4b5c84151b3e3146fe9020e237b9e727393636b64448da4600156e0b930ae85d52da7cfea1ef2ef744ce754d9d71d3699f0193073
TLSH
T1BDE01209A2F9261052718E27BCB8E0019BB1B8212C1BCF9E47C4A1CA18D5A14F636B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Public\desktop.ini
Size 174B
SHA256 6de1a716b5c49541ebc9692b16efa6fdb75b18c2a210974f94f83dcfdf8800d7
MD5 7220fad57a4b3d9d9755c51198cc0386
SHA1 bd2d52d62d3e9810e1072cc5ca6285da5e5c3853
SHA512 e46df475a3e52535913ae369fe56a1230fa11656b6fe31cfd160302a56f599cde45841d10f5faa53ac4c7f2da4a1de34d362153c35dc47cf87a4a8358625b9bf
TLSH
T1C1C0801C92E9321041718D12FC749001DBB1B4217C17CF5E07C0518F04A0605E631743
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\desktop.ini
Size 174B
SHA256 8f6c28c6f4ef09a335123af11dfd7a45ffdec661acdef2c151e871a7e060e71e
MD5 6b1a6a9959ce35fa0df98f8e602bb191
SHA1 ae54a61fe5715a7a23f2f517dc13d23dd28b56f9
SHA512 6b31800757d371e3ca9b723d328fad7260d5b7728ca8f61d294a97b3aac4bcdadae289588e4288027e93f76c00b2b0899a7a7db46b411817482f9c5c33f79cb5
TLSH
T13EC0801892ED311041718D12FC749001DBB1B4216C17CF5E07C0518B04A0649E631743
MD5 SHA1 SHA512 TLSH

Submit Download

mscaps.exe

Path C:\Windows\SysWOW64\mscaps.exe
Size 200KB
SHA256 2c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905
MD5 78d3c8705f8baf7d34e6a6737d1cfa18
SHA1 9f09e248a29311dbeefae9d85937b13da042a010
SHA512 9a3c3175276da58f1bc8d1138e63238c8d8ccfbfa1a8a1338e88525eca47f8d745158bb34396b7c3f25e4296be5f45a71781da33ad0bbdf7ad88a9c305b85609
SSDEEP 3072:34LGpbMkFAIk2GOytDDE1wYa+6NjQYryupFsjzuoAxWhZWkZu4pUBRrwCP8T:FbnDk2HcMZYQYcSovhc7AAcCPe
TLSH
T15114F15B2CB38933F462497542E046FA4FFDAD1332F664EFCF2849C11DA09659528AF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bindsvc.exe

Path C:\Windows\System32\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/888-647-0x0000000000910000-0x0000000000A8A000-memory.dmp

Download

memory/888-324-0x0000000000910000-0x0000000000A8A000-memory.dmp

Download

memory/888-635-0x0000000000910000-0x0000000000A8A000-memory.dmp

Download

memory/1140-368-0x000001F900900000-0x000001F900908000-memory.dmp

Download

memory/1140-363-0x000001F97F680000-0x000001F97F688000-memory.dmp

Download

memory/1140-347-0x000001F9772C0000-0x000001F9772D0000-memory.dmp

Download

memory/1140-331-0x000001F977090000-0x000001F9770A0000-memory.dmp

Download

memory/1832-562-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-596-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-554-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-557-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-558-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-556-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-564-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-565-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-566-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-567-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-572-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-571-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-573-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-582-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-581-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-579-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-580-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-578-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-577-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-576-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-575-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-574-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-570-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-569-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-568-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-563-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-561-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-560-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-559-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-598-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-597-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-555-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-595-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-593-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-592-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-594-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-591-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-590-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-589-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-588-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-587-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-586-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-585-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-584-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-583-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-551-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-609-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-608-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-607-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-606-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-605-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-604-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-603-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-602-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-601-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-600-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-553-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/1832-552-0x000001F0DFB10000-0x000001F0DFB20000-memory.dmp

Download

memory/4108-599-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4108-379-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4808-17-0x0000000010000000-0x0000000010015000-memory.dmp

Download