22c7a190c2c5cf51703ff91d7ab11b91484ef33eca8412abd088445da9bd43c3

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
Size 12.0MB
Sample260730-ehebesswgw
SHA256 22c7a190c2c5cf51703ff91d7ab11b91484ef33eca8412abd088445da9bd43c3
MD5 0e2b52d9cf27c441a6a7bb34ddf219d5
SHA1 106a6b992e31fbaafcf636625adeceb646abe6e2
SHA512 7dcc98674691e5df7fd8428c8bed37bc30db478d1f4fc959672ac0ddc5199902e95cf098a390d1ec4a132c408ace316ee05edf6a790cbe703dc3ab0ffea5ea0c
SSDEEP 196608:4EYMEdKHYlQ7mkYY73j66vLUCc4qMGPcBAd:47MvHYlQnT7m0LBA
TLSH
T19AD6CF47F8A545E4C0EED235C9629263BA717C485B3023D76BA0F7782F76BD0AAB5340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
2960	agent.exe
256	hw-temp.exe
5392	hw-temp.exe
460	smartctl.exe
5592	smartctl.exe
5224	agent.exe

Loads dropped DLL 4 IoCs

pid	Process
256	hw-temp.exe
256	hw-temp.exe
5392	hw-temp.exe
5392	hw-temp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\THACO HELPDESK = "\"C:\\Program Files\\HelpdeskMonitor\\Thaco Helpdesk.exe\""	agent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
7	api.ipify.org

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	smartctl.exe
File opened for modification	\??\PhysicalDrive0	smartctl.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl	explorer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4208	wscript.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\HelpdeskMonitor\agent.exe	2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
File created	C:\Program Files\HelpdeskMonitor\agent.exe.new	agent.exe
File created	C:\Program Files\HelpdeskMonitor\agent.exe_update.vbs	agent.exe
File created	C:\Program Files\HelpdeskMonitor\bridge.txt	agent.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_cpoqfyay.uet.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_rkkshbsj.kf3.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_2d5pkioq.tjv.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_sq0wvvmy.vmt.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_qfhojt21.34b.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_iy2wz1cv.kva.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1a43c2hy.z55.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_kmxkjitt.itw.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_s4ykmsac.dk5.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_t5fgd1qh.5tw.psm1	powershell.exe
File opened for modification	C:\Windows\SystemTemp\RES616F.tmp	cvtres.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2544	powershell.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3016	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3804	powershell.exe
988	powershell.exe
5492	powershell.exe
3492	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6124	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	agent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	agent.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	agent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	agent.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	agent.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3424	2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
2960	agent.exe
5224	agent.exe
3804	powershell.exe
3804	powershell.exe
988	powershell.exe
988	powershell.exe
2544	powershell.exe
2544	powershell.exe
2544	powershell.exe
5492	powershell.exe
5492	powershell.exe
3492	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3804	powershell.exe
Token: SeDebugPrivilege	988	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	5492	powershell.exe
Token: SeDebugPrivilege	3492	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 3776	3424	2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	90
PID 3776 wrote to memory of 1056	3776	net.exe	91
PID 3424 wrote to memory of 3016	3424	2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	92
PID 3424 wrote to memory of 5324	3424	2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	93
PID 5324 wrote to memory of 2528	5324	net.exe	94
PID 3424 wrote to memory of 2572	3424	2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	95
PID 2960 wrote to memory of 4216	2960	agent.exe	97
PID 2572 wrote to memory of 2216	2572	csc.exe	99
PID 3424 wrote to memory of 256	3424	2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	100
PID 4216 wrote to memory of 2664	4216	csc.exe	101
PID 2960 wrote to memory of 5392	2960	agent.exe	102
PID 2960 wrote to memory of 460	2960	agent.exe	105
PID 2960 wrote to memory of 5592	2960	agent.exe	107
PID 2960 wrote to memory of 4208	2960	agent.exe	109
PID 4208 wrote to memory of 6124	4208	wscript.exe	110
PID 6124 wrote to memory of 5244	6124	cmd.exe	112
PID 5244 wrote to memory of 3888	5244	net.exe	113
PID 6124 wrote to memory of 4264	6124	cmd.exe	114
PID 4264 wrote to memory of 1276	4264	net.exe	115
PID 5224 wrote to memory of 3804	5224	agent.exe	117
PID 5224 wrote to memory of 988	5224	agent.exe	119
PID 5224 wrote to memory of 4284	5224	agent.exe	121
PID 5224 wrote to memory of 2544	5224	agent.exe	124
PID 5224 wrote to memory of 5492	5224	agent.exe	127
PID 5224 wrote to memory of 3492	5224	agent.exe	129

C:\Users\Admin\AppData\Local\Temp\2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_0e2b52d9cf27c441a6a7bb34ddf219d5_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\system32\net.exe
  net stop HelpdeskMonitorAgent
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop HelpdeskMonitorAgent
    3⤵
    PID:1056
- C:\Windows\system32\sc.exe
  sc create HelpdeskMonitorAgent binPath= "C:\Program Files\HelpdeskMonitor\agent.exe" start= auto
  2⤵
  - Launches sc.exe
  PID:3016
- C:\Windows\system32\net.exe
  net start HelpdeskMonitorAgent
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5324
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start HelpdeskMonitorAgent
    3⤵
    PID:2528
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /nologo /r:LibreHardwareMonitorLib.dll /out:hw-temp.exe hw-temp.cs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES60D3.tmp" "c:\ProgramData\HelpdeskMonitor\LHM\CSC9C4A75D4E7054940831FCAB52F555450.TMP"
    3⤵
    PID:2216
- C:\ProgramData\HelpdeskMonitor\LHM\hw-temp.exe
  C:\ProgramData\HelpdeskMonitor\LHM\hw-temp.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:256

C:\Program Files\HelpdeskMonitor\agent.exe
"C:\Program Files\HelpdeskMonitor\agent.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /nologo /r:LibreHardwareMonitorLib.dll /out:hw-temp.exe hw-temp.cs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RES616F.tmp" "c:\ProgramData\HelpdeskMonitor\LHM\CSC45B8ACED31564E6CB4A6D64B505E882.TMP"
    3⤵
    - Drops file in Windows directory
    PID:2664
- C:\ProgramData\HelpdeskMonitor\LHM\hw-temp.exe
  C:\ProgramData\HelpdeskMonitor\LHM\hw-temp.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5392
- C:\ProgramData\HelpdeskMonitor\smartctl.exe
  C:\\ProgramData\\HelpdeskMonitor\\smartctl.exe --scan
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  PID:460
- C:\ProgramData\HelpdeskMonitor\smartctl.exe
  C:\\ProgramData\\HelpdeskMonitor\\smartctl.exe -A -i /dev/sda
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  PID:5592
- C:\Windows\system32\wscript.exe
  wscript "C:\Program Files\HelpdeskMonitor\agent.exe_update.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net stop HelpdeskMonitorAgent & move /y "C:\Program Files\HelpdeskMonitor\agent.exe" "C:\Program Files\HelpdeskMonitor\agent.exe.bak" & move /y "C:\Program Files\HelpdeskMonitor\agent.exe.new" "C:\Program Files\HelpdeskMonitor\agent.exe" & net start HelpdeskMonitorAgent
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6124
  - - C:\Windows\System32\net.exe
      net stop HelpdeskMonitorAgent
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5244
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop HelpdeskMonitorAgent
        5⤵
        
        PID:3888
  - - C:\Windows\System32\net.exe
      net start HelpdeskMonitorAgent
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4264
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start HelpdeskMonitorAgent
        5⤵
        
        PID:1276

C:\Program Files\HelpdeskMonitor\agent.exe
"C:\Program Files\HelpdeskMonitor\agent.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\ProgramData\HelpdeskMonitor\zalo-scan.ps1
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -File C:\ProgramData\HelpdeskMonitor\hw-scan.ps1 -DllPath C:\ProgramData\HelpdeskMonitor\LibreHardwareMonitorLib.dll
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:988
- C:\Windows\explorer.exe
  explorer.exe "C:\Program Files\HelpdeskMonitor\Thaco Helpdesk.exe"
  2⤵
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:4284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $mons = Get-WmiObject -Namespace root\wmi -Class WmiMonitorID -ErrorAction SilentlyContinue $res = @() foreach ($m in $mons) { $name = \"\" if ($m.UserFriendlyName) { foreach ($c in $m.UserFriendlyName) { if ($c -eq 0) { break } $name += [char]$c } } $serial = \"\" if ($m.SerialNumberID) { foreach ($c in $m.SerialNumberID) { if ($c -eq 0) { break } $serial += [char]$c } } if ($name -or $serial) { if (!$name) { $name = \"Generic Monitor\" } if (!$serial) { $serial = \"Unknown\" } $res += \"$name (SN: $serial)\" } } $res -join \" | \" "
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Hide Artifacts: Ignore Process Interrupts
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -File C:\ProgramData\HelpdeskMonitor\hw-scan.ps1 -DllPath C:\ProgramData\HelpdeskMonitor\LibreHardwareMonitorLib.dll
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -File C:\ProgramData\HelpdeskMonitor\hw-scan.ps1 -DllPath C:\ProgramData\HelpdeskMonitor\LibreHardwareMonitorLib.dll
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.exe

Path C:\Program Files\HelpdeskMonitor\agent.exe
Size 12.0MB
SHA256 22c7a190c2c5cf51703ff91d7ab11b91484ef33eca8412abd088445da9bd43c3
MD5 0e2b52d9cf27c441a6a7bb34ddf219d5
SHA1 106a6b992e31fbaafcf636625adeceb646abe6e2
SHA512 7dcc98674691e5df7fd8428c8bed37bc30db478d1f4fc959672ac0ddc5199902e95cf098a390d1ec4a132c408ace316ee05edf6a790cbe703dc3ab0ffea5ea0c
SSDEEP 196608:4EYMEdKHYlQ7mkYY73j66vLUCc4qMGPcBAd:47MvHYlQnT7m0LBA
TLSH
T19AD6CF47F8A545E4C0EED235C9629263BA717C485B3023D76BA0F7782F76BD0AAB5340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.exe.new

Path C:\Program Files\HelpdeskMonitor\agent.exe.new
Size 5.0MB
SHA256 fcdbb13bed0af92e4b559f6bf69fa41999f7b4d271f9416e0599e65415df98d0
MD5 2eb021739c8ab2d419937068111f56ba
SHA1 6ecc8be2493adebbca776d7d3e29b03ada83ee2d
SHA512 f37e0a3e9869def90c04b1bbb63387e6290efd220abcdaf8253ad603bb6b9302eb0f6736a681894446e1a5c040340d20e79d065b858a8cc54722fa54fd813067
SSDEEP 49152:HcwoYq3vtjFbJbrb/TrvO90dL3BmAFd4A64nsfJpqSqUcS/Ggk8yzQkTDhdDjLc2:83TJljY4fz5EAcfU4
TLSH
T121363A07F85591E8C1AAD130C565D292BA327C895B3023D33F20FBB92B76BD4AE79354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.exe_update.vbs

Path C:\Program Files\HelpdeskMonitor\agent.exe_update.vbs
Size 475B
SHA256 159aa7dd8b67ca2f08a99e77851c26ffb0b42fc060482dbd3d61f071314682af
MD5 61702738b3ac0bb4b883f1f2e0efb8be
SHA1 c5841e36aed7936229b3db455b328c625c102e44
SHA512 124adad9908cbc7c3d894f2fee522fbc82bafc17ab22f238c6406505d4cf7cb15367f383672e215efe80c122d2c2797ec664d04f90b2ff545a9e6d39027ec085
TLSH
T11AF05C12FD36C46735AA79F5A3F6DE1FE2919E843214D92937C4C70AC1931D00A5A0F4
MD5 SHA1 SHA512 TLSH

Submit Download

bridge.txt

Path C:\Program Files\HelpdeskMonitor\bridge.txt
Size 9B
SHA256 12ca17b49af2289436f303e0166030a21e525d266e209267433801a8fd4071a0
MD5 f528764d624db129b32c21fbca0cb8d6
SHA1 4b84b15bff6ee5796152495a230e45e3d7e947d9
SHA512 2f8748abdbb42c16f5d62251f8adea1f65443b6ed0ec063b49be332a6c8cc200892828deee3bbc44bffff040677446dfe0fe5d9dc5a2150d342dd93456b54e22
MD5 SHA1 SHA512

Submit Download

System.Memory.dll

Path C:\ProgramData\HelpdeskMonitor\LHM\System.Memory.dll
Size 141KB
SHA256 d5e8e4866f9cfa66f7765660f84b210198893e55335487afe5ebda342c0e913d
MD5 bd7f42207f4fdb9c7eafb0013abd7334
SHA1 96c87b7148805a0adcd4b9e23162deb06d7a4702
SHA512 a903fda3c5585af8978918c6fa5dd7649e84bee41d0dfa09667e151819d74e16cff626595eb9760588bec12c0b8ec31f527e7dc84800378683156309c3247240
SSDEEP 3072:IPgSRYPuMbrhcabqwwwUumu36xNOIRJAW:OuPaaWwww4u2HX
TLSH
T161E35CBC67C6DD12CB5F8C70A028621A5A31873FAD43F7E615C8E4F425A37A936193D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\ProgramData\HelpdeskMonitor\LHM\System.Runtime.CompilerServices.Unsafe.dll
Size 18KB
SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
MD5 cb5b861883d2bddd9833c9fe956406f7
SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
TLSH
T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hw-temp.exe

Path C:\ProgramData\HelpdeskMonitor\LHM\hw-temp.exe
Size 4KB
SHA256 1fdb45b0cc5b616c6a0ae40d5e7eb3d14099d7c55fdc0d394e9c8229f8182a9f
MD5 7bb277dddde12f2691ca4b66bd38203c
SHA1 8be6d290e5bc379a92b1cffa57b0e45666af91b8
SHA512 b86a5efeda1e5cb8cc9ad6da1fb1b0b3e608e92a27da5ffcc401b6f57eb583866812f38106af4298d4c9e764a4a71d00bba245637284e14d3d751d496c7d23f7
SSDEEP 48:6RmjkbCnx+e7CBRBJwEWXvX2t8uul1xiqXSfbNtm:/jFxGsEmmSHxKzNt
TLSH
T13E919555A3E8973EE1BA47384DE303103378B5A2AD66575E2C94031EAD223540B63BF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smartctl.exe

Path C:\ProgramData\HelpdeskMonitor\smartctl.exe
Size 1.1MB
SHA256 b5db94e5082c042be44994b7a4fa8f7b5c8e713b2ab1c9a560d8f7a7995ea27d
MD5 c1d1d016a33b09014517636c61d30947
SHA1 c35f8c73fb3415fab6429e5a5f8ee7eedd865621
SHA512 f6340936494603472691e67a7d68c712294387c9d2fb58c55b0780a553cbe85ce24a8c5171f6e1f5f5a094a0d9d3faeace3c4cb5380f5da5e2bada5d09509db0
SSDEEP 24576:NdcpnKLt0sFgyz6Vn1JwR0QHHP8gcShgxg+aIow9j:NdcpnKLt0sxCJPQHHP8gc8gxg+aIow
TLSH
T148455A1EE32244F8C957C0B44A3A52737571FC5A0134EA6ABED8DB381F62E705E6DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES60D3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES60D3.tmp
Size 1KB
SHA256 758295daa2e68bea7b31ccc4ae8ec806ef4fa00d25748b3c1448c479744dbfc3
MD5 48fcaa9456ecead98498334d313963c3
SHA1 93d78054b8111db88fe29a457ead97a543d0ad24
SHA512 3a14da5f487696529add375c256a1d5dc4f0cc27d92a133608bb98c4b93b6428c20f1dd0535854f121d480a76c267855149e4be0ab011666c989ed2340d63da7
TLSH
T100413101E3D8471FF172437169FB9716A678BE52BAAA879E74C4132F1E02780DD822B1
MD5 SHA1 SHA512 TLSH

Submit Download

RES616F.tmp

Path C:\Windows\SystemTemp\RES616F.tmp
Size 1KB
SHA256 10933415a7c2cbc20961c7b14286f06ecd02c7d7f297d71233255c60f9b9b4d2
MD5 fe6be03100c34a4b241119813d65cbd6
SHA1 0e74a800aa0cbdeac68f66973e645da2d1bbb287
SHA512 df407b116e6365eaf2c6be82fe979a8805f64bc885e779c0ba3332c6ffa173d366d29ed1d952f2198db6165afbd85fc29f40ad7b09a005f1722a881643899594
TLSH
T111413141A3D8071FF172073068FB9711A778FE91EAA987AD74C8026E1E123809D825B1
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_sq0wvvmy.vmt.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_sq0wvvmy.vmt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

CSC9C4A75D4E7054940831FCAB52F555450.TMP

Path \??\c:\ProgramData\HelpdeskMonitor\LHM\CSC9C4A75D4E7054940831FCAB52F555450.TMP
Size 1KB
SHA256 5f26b7c11af1a8369e3435089efdcfbd33e36aeab772bd0d1a8ea0df7d4d3756
MD5 9ee25b8f2ccb30cc20d69122eea2e74c
SHA1 a67729e5cfc89b01624de773ee1bc2cfdf27dff3
SHA512 0ba26058761d5ea21abd7344097b213a4a2807a80d25c90a0082b71a28f39e73aa0849ce0eaa1680c901a040a2c3fd7dad55269ab692354dd3af9daa0185b2d6
TLSH
T15F21AB41A2E8521EF2B3477069F2D362A16CBEA68D7A43EC3488175F2F159108583AB1
MD5 SHA1 SHA512 TLSH

Submit Download

LibreHardwareMonitorLib.dll

Path \??\c:\ProgramData\HelpdeskMonitor\LHM\LibreHardwareMonitorLib.dll
Size 1.1MB
SHA256 6ebc194316536ba61af5be24508ad9fcbb2ecc685e716c12e787c79530f66bf0
MD5 ecc49bd21fc187ba1a39b2f84bcfb9af
SHA1 eea8552e5ed715ffa6882a2c6335d4c1f9fe5ea9
SHA512 34573db40fa4482953146e852015d3a802cac263aa78910cb33f0aee271e2412494a4a6c219c785f6c7696d3fab0f79d2b257b69c5ba7b62fb424e473ec7e03a
SSDEEP 12288:oULSvX11MU8+ylPuOvUnp5U5y2Cobblutpd6d3BEv1Gy7:oWSktWpw/lgdm
TLSH
T1C645290176DC6E76C49E0A7A28705D0293B4BD53E729B71F70ACBA4E0ABB7412F54393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hw-temp.cs

Path \??\c:\ProgramData\HelpdeskMonitor\LHM\hw-temp.cs
Size 549B
SHA256 42295a2350c42dee91ac67442a36dfb365220faa8e94e69ab9f158823e7ce803
MD5 44dce54dd03c208da9359b1caa9fc33e
SHA1 bf819b97157f7a5bd2792436d8f4f0940ed89ffd
SHA512 a6292b354c1d2ebe80e7456343550eb6f3b8c01cc317c2c29adc2e5691d8bfbc7e1de53e43f5459bc28a6983d6813217b467d18e0002b6f6ebd6c8b93b1137c0
TLSH
T140F0592628E941B5552730BD8F1A68A42623A643A53A8EA2790C9200DFC12280F74FBB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/256-49-0x000000001BA00000-0x000000001BB2A000-memory.dmp

Download

memory/256-46-0x0000000000CC0000-0x0000000000CC8000-memory.dmp

Download

memory/460-65-0x00007FF75F220000-0x00007FF75F358000-memory.dmp

Download

memory/2544-88-0x0000023B368F0000-0x0000023B36912000-memory.dmp

Download

memory/5392-59-0x0000000001740000-0x0000000001768000-memory.dmp

Download

memory/5392-61-0x0000000001720000-0x0000000001728000-memory.dmp

Download

memory/5592-68-0x00007FF75F220000-0x00007FF75F358000-memory.dmp

Download