22c7a190c2c5cf51703ff91d7ab11b91484ef33eca8412abd088445da9bd43c3

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
Size 12.0MB
Sample260730-ehebesswgw
SHA256 22c7a190c2c5cf51703ff91d7ab11b91484ef33eca8412abd088445da9bd43c3
MD5 0e2b52d9cf27c441a6a7bb34ddf219d5
SHA1 106a6b992e31fbaafcf636625adeceb646abe6e2
SHA512 7dcc98674691e5df7fd8428c8bed37bc30db478d1f4fc959672ac0ddc5199902e95cf098a390d1ec4a132c408ace316ee05edf6a790cbe703dc3ab0ffea5ea0c
SSDEEP 196608:4EYMEdKHYlQ7mkYY73j66vLUCc4qMGPcBAd:47MvHYlQnT7m0LBA
TLSH
T19AD6CF47F8A545E4C0EED235C9629263BA717C485B3023D76BA0F7782F76BD0AAB5340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
4744	agent.exe
1816	hw-temp.exe
2356	hw-temp.exe
216	smartctl.exe
3232	smartctl.exe
4792	agent.exe

Loads dropped DLL 4 IoCs

pid	Process
1816	hw-temp.exe
1816	hw-temp.exe
2356	hw-temp.exe
2356	hw-temp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\THACO HELPDESK = "\"C:\\Program Files\\HelpdeskMonitor\\Thaco Helpdesk.exe\""	agent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
17	api.ipify.org
13	api.ipify.org

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	smartctl.exe
File opened for modification	\??\PhysicalDrive0	smartctl.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\hw-temp.exe.log	hw-temp.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl	explorer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1836	wscript.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\HelpdeskMonitor\agent.exe	2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
File created	C:\Program Files\HelpdeskMonitor\agent.exe.new	agent.exe
File created	C:\Program Files\HelpdeskMonitor\agent.exe_update.vbs	agent.exe
File created	C:\Program Files\HelpdeskMonitor\bridge.txt	agent.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4708	powershell.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1756	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3980	powershell.exe
3640	powershell.exe
2092	powershell.exe
2908	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2968	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	agent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	agent.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowStatusBar = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerStartupTraceRecorded = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden = "2"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	agent.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2952	2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
4744	agent.exe
4792	agent.exe
3640	powershell.exe
3980	powershell.exe
4708	powershell.exe
4708	powershell.exe
2092	powershell.exe
2908	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3640	powershell.exe
Token: SeDebugPrivilege	3980	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	2908	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 4320	2952	2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	86
PID 4320 wrote to memory of 3108	4320	net.exe	87
PID 2952 wrote to memory of 1756	2952	2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	88
PID 2952 wrote to memory of 1192	2952	2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	89
PID 2952 wrote to memory of 2880	2952	2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	90
PID 2880 wrote to memory of 2524	2880	net.exe	91
PID 4744 wrote to memory of 3784	4744	agent.exe	93
PID 1192 wrote to memory of 3720	1192	csc.exe	95
PID 2952 wrote to memory of 1816	2952	2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	96
PID 4744 wrote to memory of 2356	4744	agent.exe	97
PID 4744 wrote to memory of 216	4744	agent.exe	103
PID 4744 wrote to memory of 3232	4744	agent.exe	105
PID 4744 wrote to memory of 1836	4744	agent.exe	107
PID 1836 wrote to memory of 2968	1836	wscript.exe	108
PID 2968 wrote to memory of 768	2968	cmd.exe	110
PID 768 wrote to memory of 5080	768	net.exe	111
PID 2968 wrote to memory of 2456	2968	cmd.exe	112
PID 2456 wrote to memory of 2288	2456	net.exe	113
PID 4792 wrote to memory of 3980	4792	agent.exe	115
PID 4792 wrote to memory of 3640	4792	agent.exe	116
PID 4792 wrote to memory of 2024	4792	agent.exe	119
PID 4792 wrote to memory of 4708	4792	agent.exe	127
PID 4792 wrote to memory of 2092	4792	agent.exe	130
PID 4792 wrote to memory of 2908	4792	agent.exe	139

C:\Users\Admin\AppData\Local\Temp\2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\system32\net.exe
  net stop HelpdeskMonitorAgent
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop HelpdeskMonitorAgent
    3⤵
    PID:3108
- C:\Windows\system32\sc.exe
  sc create HelpdeskMonitorAgent binPath= "C:\Program Files\HelpdeskMonitor\agent.exe" start= auto
  2⤵
  - Launches sc.exe
  PID:1756
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /nologo /r:LibreHardwareMonitorLib.dll /out:hw-temp.exe hw-temp.cs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4486.tmp" "c:\ProgramData\HelpdeskMonitor\LHM\CSCCF8C87B1A09C4BA78DBED194482BCC50.TMP"
    3⤵
    PID:3720
- C:\Windows\system32\net.exe
  net start HelpdeskMonitorAgent
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start HelpdeskMonitorAgent
    3⤵
    PID:2524
- C:\ProgramData\HelpdeskMonitor\LHM\hw-temp.exe
  C:\ProgramData\HelpdeskMonitor\LHM\hw-temp.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1816

C:\Program Files\HelpdeskMonitor\agent.exe
"C:\Program Files\HelpdeskMonitor\agent.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /nologo /r:LibreHardwareMonitorLib.dll /out:hw-temp.exe hw-temp.cs
  2⤵
  PID:3784
- C:\ProgramData\HelpdeskMonitor\LHM\hw-temp.exe
  C:\ProgramData\HelpdeskMonitor\LHM\hw-temp.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:2356
- C:\ProgramData\HelpdeskMonitor\smartctl.exe
  C:\\ProgramData\\HelpdeskMonitor\\smartctl.exe --scan
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  PID:216
- C:\ProgramData\HelpdeskMonitor\smartctl.exe
  C:\\ProgramData\\HelpdeskMonitor\\smartctl.exe -A -i /dev/sda
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  PID:3232
- C:\Windows\system32\wscript.exe
  wscript "C:\Program Files\HelpdeskMonitor\agent.exe_update.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net stop HelpdeskMonitorAgent & move /y "C:\Program Files\HelpdeskMonitor\agent.exe" "C:\Program Files\HelpdeskMonitor\agent.exe.bak" & move /y "C:\Program Files\HelpdeskMonitor\agent.exe.new" "C:\Program Files\HelpdeskMonitor\agent.exe" & net start HelpdeskMonitorAgent
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Windows\system32\net.exe
      net stop HelpdeskMonitorAgent
      4⤵
      Suspicious use of WriteProcessMemory
      PID:768
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop HelpdeskMonitorAgent
        5⤵
        
        PID:5080
  - - C:\Windows\system32\net.exe
      net start HelpdeskMonitorAgent
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2456
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start HelpdeskMonitorAgent
        5⤵
        
        PID:2288

C:\Program Files\HelpdeskMonitor\agent.exe
"C:\Program Files\HelpdeskMonitor\agent.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\ProgramData\HelpdeskMonitor\zalo-scan.ps1
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -File C:\ProgramData\HelpdeskMonitor\hw-scan.ps1 -DllPath C:\ProgramData\HelpdeskMonitor\LibreHardwareMonitorLib.dll
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3640
- C:\Windows\explorer.exe
  explorer.exe "C:\Program Files\HelpdeskMonitor\Thaco Helpdesk.exe"
  2⤵
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:2024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $mons = Get-WmiObject -Namespace root\wmi -Class WmiMonitorID -ErrorAction SilentlyContinue $res = @() foreach ($m in $mons) { $name = \"\" if ($m.UserFriendlyName) { foreach ($c in $m.UserFriendlyName) { if ($c -eq 0) { break } $name += [char]$c } } $serial = \"\" if ($m.SerialNumberID) { foreach ($c in $m.SerialNumberID) { if ($c -eq 0) { break } $serial += [char]$c } } if ($name -or $serial) { if (!$name) { $name = \"Generic Monitor\" } if (!$serial) { $serial = \"Unknown\" } $res += \"$name (SN: $serial)\" } } $res -join \" | \" "
  2⤵
  - Drops file in System32 directory
  - Hide Artifacts: Ignore Process Interrupts
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -File C:\ProgramData\HelpdeskMonitor\hw-scan.ps1 -DllPath C:\ProgramData\HelpdeskMonitor\LibreHardwareMonitorLib.dll
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -File C:\ProgramData\HelpdeskMonitor\hw-scan.ps1 -DllPath C:\ProgramData\HelpdeskMonitor\LibreHardwareMonitorLib.dll
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.exe

Path C:\Program Files\HelpdeskMonitor\agent.exe
Size 12.0MB
SHA256 22c7a190c2c5cf51703ff91d7ab11b91484ef33eca8412abd088445da9bd43c3
MD5 0e2b52d9cf27c441a6a7bb34ddf219d5
SHA1 106a6b992e31fbaafcf636625adeceb646abe6e2
SHA512 7dcc98674691e5df7fd8428c8bed37bc30db478d1f4fc959672ac0ddc5199902e95cf098a390d1ec4a132c408ace316ee05edf6a790cbe703dc3ab0ffea5ea0c
SSDEEP 196608:4EYMEdKHYlQ7mkYY73j66vLUCc4qMGPcBAd:47MvHYlQnT7m0LBA
TLSH
T19AD6CF47F8A545E4C0EED235C9629263BA717C485B3023D76BA0F7782F76BD0AAB5340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.exe.new

Path C:\Program Files\HelpdeskMonitor\agent.exe.new
Size 5.0MB
SHA256 fcdbb13bed0af92e4b559f6bf69fa41999f7b4d271f9416e0599e65415df98d0
MD5 2eb021739c8ab2d419937068111f56ba
SHA1 6ecc8be2493adebbca776d7d3e29b03ada83ee2d
SHA512 f37e0a3e9869def90c04b1bbb63387e6290efd220abcdaf8253ad603bb6b9302eb0f6736a681894446e1a5c040340d20e79d065b858a8cc54722fa54fd813067
SSDEEP 49152:HcwoYq3vtjFbJbrb/TrvO90dL3BmAFd4A64nsfJpqSqUcS/Ggk8yzQkTDhdDjLc2:83TJljY4fz5EAcfU4
TLSH
T121363A07F85591E8C1AAD130C565D292BA327C895B3023D33F20FBB92B76BD4AE79354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.exe_update.vbs

Path C:\Program Files\HelpdeskMonitor\agent.exe_update.vbs
Size 475B
SHA256 159aa7dd8b67ca2f08a99e77851c26ffb0b42fc060482dbd3d61f071314682af
MD5 61702738b3ac0bb4b883f1f2e0efb8be
SHA1 c5841e36aed7936229b3db455b328c625c102e44
SHA512 124adad9908cbc7c3d894f2fee522fbc82bafc17ab22f238c6406505d4cf7cb15367f383672e215efe80c122d2c2797ec664d04f90b2ff545a9e6d39027ec085
TLSH
T11AF05C12FD36C46735AA79F5A3F6DE1FE2919E843214D92937C4C70AC1931D00A5A0F4
MD5 SHA1 SHA512 TLSH

Submit Download

bridge.txt

Path C:\Program Files\HelpdeskMonitor\bridge.txt
Size 9B
SHA256 12ca17b49af2289436f303e0166030a21e525d266e209267433801a8fd4071a0
MD5 f528764d624db129b32c21fbca0cb8d6
SHA1 4b84b15bff6ee5796152495a230e45e3d7e947d9
SHA512 2f8748abdbb42c16f5d62251f8adea1f65443b6ed0ec063b49be332a6c8cc200892828deee3bbc44bffff040677446dfe0fe5d9dc5a2150d342dd93456b54e22
MD5 SHA1 SHA512

Submit Download

System.Memory.dll

Path C:\ProgramData\HelpdeskMonitor\LHM\System.Memory.dll
Size 141KB
SHA256 d5e8e4866f9cfa66f7765660f84b210198893e55335487afe5ebda342c0e913d
MD5 bd7f42207f4fdb9c7eafb0013abd7334
SHA1 96c87b7148805a0adcd4b9e23162deb06d7a4702
SHA512 a903fda3c5585af8978918c6fa5dd7649e84bee41d0dfa09667e151819d74e16cff626595eb9760588bec12c0b8ec31f527e7dc84800378683156309c3247240
SSDEEP 3072:IPgSRYPuMbrhcabqwwwUumu36xNOIRJAW:OuPaaWwww4u2HX
TLSH
T161E35CBC67C6DD12CB5F8C70A028621A5A31873FAD43F7E615C8E4F425A37A936193D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\ProgramData\HelpdeskMonitor\LHM\System.Runtime.CompilerServices.Unsafe.dll
Size 18KB
SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
MD5 cb5b861883d2bddd9833c9fe956406f7
SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
TLSH
T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hw-temp.exe

Path C:\ProgramData\HelpdeskMonitor\LHM\hw-temp.exe
Size 4KB
SHA256 510b156ec6638a06ea34994f54b98c022531835b4595955d262126146a6b1a08
MD5 55ffc19fd463a0c4753e1ce3b55ecf21
SHA1 2bf278b46aaee55c884841a668c5b02cd8d1415a
SHA512 2f86ae78966282f36448c19e503e037b88d1fb7dd55717f8ca4e041fd11102b3b95ef6a62f6a3142f2b433136130cac05eda520803c734050e407a1a29cbdd8d
SSDEEP 48:6nnmjkbCnx+e7CBRBJwEWXvXSt8uul1xiqXSfbNtm:BjFxGsEmSSHxKzNt
TLSH
T1E5919515A3D8D77EE1A647384DE303103378B5A6ED76575E2C94031EAD223540B63BF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smartctl.exe

Path C:\ProgramData\HelpdeskMonitor\smartctl.exe
Size 1.1MB
SHA256 b5db94e5082c042be44994b7a4fa8f7b5c8e713b2ab1c9a560d8f7a7995ea27d
MD5 c1d1d016a33b09014517636c61d30947
SHA1 c35f8c73fb3415fab6429e5a5f8ee7eedd865621
SHA512 f6340936494603472691e67a7d68c712294387c9d2fb58c55b0780a553cbe85ce24a8c5171f6e1f5f5a094a0d9d3faeace3c4cb5380f5da5e2bada5d09509db0
SSDEEP 24576:NdcpnKLt0sFgyz6Vn1JwR0QHHP8gcShgxg+aIow9j:NdcpnKLt0sxCJPQHHP8gc8gxg+aIow
TLSH
T148455A1EE32244F8C957C0B44A3A52737571FC5A0134EA6ABED8DB381F62E705E6DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES4486.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4486.tmp
Size 1KB
SHA256 3e15858dfb3fd4e4f3f22d1778316bf368ffb144f0698c142b0c073d0dac9276
MD5 daf40f625605bd101e864d43eaaf8f6a
SHA1 b5ecc564dc3b41f8f77f1770c4c0219cc1a2ee54
SHA512 6e8f11a720ec4d091d8f3bb08ecd288f8e1d196181e4d7f4118179ded571a311741e52c2f37959262db1b899bc1089e45e334b2cdac2c77704f8300b969aed74
TLSH
T101413100D3E8471FF172073129FB9712A638FE92ABA9435E7484123E1F12780DD936B2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_msuibktn.toy.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_msuibktn.toy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 1KB
SHA256 3c6d5ecae46dd9f6756e444bc51635cdd9696f3ed9fe0601cf41059a04085f88
MD5 25d7ac29d798600ddc5fd880b162958b
SHA1 a2ba91e14155cfa5c26670e17ac606f3f28b0be2
SHA512 d91a9028c0fdf3761edbccddaa460573281b7d390efc7dfe3ebef46ce5ede53d36a7148c523e312b5daedc91c11cdb2cc8d0f8b475339cd35dba044595778d45
TLSH
T15731CE3133B5A0D889163F471E3855C053BF4355F694AF48B688626ED9324179F221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

CSCCF8C87B1A09C4BA78DBED194482BCC50.TMP

Path \??\c:\ProgramData\HelpdeskMonitor\LHM\CSCCF8C87B1A09C4BA78DBED194482BCC50.TMP
Size 1KB
SHA256 5f26b7c11af1a8369e3435089efdcfbd33e36aeab772bd0d1a8ea0df7d4d3756
MD5 9ee25b8f2ccb30cc20d69122eea2e74c
SHA1 a67729e5cfc89b01624de773ee1bc2cfdf27dff3
SHA512 0ba26058761d5ea21abd7344097b213a4a2807a80d25c90a0082b71a28f39e73aa0849ce0eaa1680c901a040a2c3fd7dad55269ab692354dd3af9daa0185b2d6
TLSH
T15F21AB41A2E8521EF2B3477069F2D362A16CBEA68D7A43EC3488175F2F159108583AB1
MD5 SHA1 SHA512 TLSH

Submit Download

LibreHardwareMonitorLib.dll

Path \??\c:\ProgramData\HelpdeskMonitor\LHM\LibreHardwareMonitorLib.dll
Size 1.1MB
SHA256 6ebc194316536ba61af5be24508ad9fcbb2ecc685e716c12e787c79530f66bf0
MD5 ecc49bd21fc187ba1a39b2f84bcfb9af
SHA1 eea8552e5ed715ffa6882a2c6335d4c1f9fe5ea9
SHA512 34573db40fa4482953146e852015d3a802cac263aa78910cb33f0aee271e2412494a4a6c219c785f6c7696d3fab0f79d2b257b69c5ba7b62fb424e473ec7e03a
SSDEEP 12288:oULSvX11MU8+ylPuOvUnp5U5y2Cobblutpd6d3BEv1Gy7:oWSktWpw/lgdm
TLSH
T1C645290176DC6E76C49E0A7A28705D0293B4BD53E729B71F70ACBA4E0ABB7412F54393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hw-temp.cs

Path \??\c:\ProgramData\HelpdeskMonitor\LHM\hw-temp.cs
Size 549B
SHA256 42295a2350c42dee91ac67442a36dfb365220faa8e94e69ab9f158823e7ce803
MD5 44dce54dd03c208da9359b1caa9fc33e
SHA1 bf819b97157f7a5bd2792436d8f4f0940ed89ffd
SHA512 a6292b354c1d2ebe80e7456343550eb6f3b8c01cc317c2c29adc2e5691d8bfbc7e1de53e43f5459bc28a6983d6813217b467d18e0002b6f6ebd6c8b93b1137c0
TLSH
T140F0592628E941B5552730BD8F1A68A42623A643A53A8EA2790C9200DFC12280F74FBB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/216-62-0x00007FF717EF0000-0x00007FF718028000-memory.dmp

Download

memory/1816-49-0x000000001AD20000-0x000000001AE4A000-memory.dmp

Download

memory/1816-51-0x0000000000830000-0x0000000000858000-memory.dmp

Download

memory/1816-46-0x0000000000050000-0x0000000000058000-memory.dmp

Download

memory/2356-56-0x0000000001600000-0x0000000001608000-memory.dmp

Download

memory/3232-65-0x00007FF717EF0000-0x00007FF718028000-memory.dmp

Download

memory/3640-72-0x0000022B72100000-0x0000022B72122000-memory.dmp

Download