4908f59b4f5260ae415bc45a1b7b31d1dbfe4bf26147995fb5c2594b724e3454

Analysis

max time kernel
151s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 02:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_aa89e5e6001e06322dc4d0c0b99836e9_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe
Size 96.6MB
Sample260824-cg2zzssbpg
SHA256 4908f59b4f5260ae415bc45a1b7b31d1dbfe4bf26147995fb5c2594b724e3454
MD5 aa89e5e6001e06322dc4d0c0b99836e9
SHA1 7d0867d361de041eb4bd69af94f8918dc86be67e
SHA512 d26e7fa3d6ea45dc3512e3f04331cce0a08cb4c047278c035cde1a94073c51f6446f1409a178a64624427ac48fc39ed0c736c8e4601cfb26686a567c88bd1c07
SSDEEP 1572864:yEr0mMfJSwBOnP2qKxTWQoiAyUGoKNLiJAvI9dEgdJV+vYLRBxp:1wHk21qKxTWQoKNLiD9dEeLRbp
TLSH
T1AB2823C0EBD787F2E91215347097A37B53305E258B3C8787DA40FE69E9B75522A22D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6008	powershell.exe

Executes dropped EXE 9 IoCs

pid	Process
1816	GuZoYNSMafLLtPd.exe
1808	GuZoYNSMafLLtPd.exe
1596	DemonstrateExplain.exe
4424	GovernLocate.exe
5396	kerLxoedDNoTdHmR.exe
2460	kerLxoedDNoTdHmR.exe
3392	GovernLocate.exe
3672	GovernLocate.exe
4800	HuntOversee.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5396-83-0x00007FF6FF5F0000-0x00007FF7005F0000-memory.dmp	upx

Drops file in Program Files directory 29 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ShowcaseDefine\GuZoYNSMafLLtPd.exe	msiexec.exe
File opened for modification	C:\Program Files\ShowcaseDefine\ExplorePresent.exe	GuZoYNSMafLLtPd.exe
File opened for modification	C:\Program Files\ShowcaseSimplify	DemonstrateExplain.exe
File created	C:\Program Files (x86)\ShowcaseDefine\bdeuiMMreplece.dll	msiexec.exe
File created	C:\Program Files\ShowcaseDefine\bdeuiMMreplece.dll	MsiExec.exe
File opened for modification	C:\Program Files\ShowcaseDefine\OperatorObserve.xml	GuZoYNSMafLLtPd.exe
File opened for modification	C:\Program Files\ShowcaseSimplify\GovernLocate.wrapper.log	GovernLocate.exe
File opened for modification	C:\Program Files\ShowcaseDefine\DeployMediatorNimble	GuZoYNSMafLLtPd.exe
File opened for modification	C:\Program Files\ShowcaseSimplify\GovernLocate.wrapper.log	GovernLocate.exe
File created	C:\Program Files (x86)\ShowcaseDefine\SimplifyAnalystSleek	msiexec.exe
File created	C:\Program Files (x86)\ShowcaseDefine\HxCommModel.dll	msiexec.exe
File created	C:\Program Files\ShowcaseDefine\SimplifyAnalystSleek	MsiExec.exe
File opened for modification	C:\Program Files\ShowcaseDefine\ObserveTrack.sys	GuZoYNSMafLLtPd.exe
File opened for modification	C:\Program Files\ShowcaseDefine\OperatorObserve.exe	GuZoYNSMafLLtPd.exe
File created	C:\Program Files\ShowcaseDefine\HuntOversee.exe	MsiExec.exe
File opened for modification	C:\Program Files\DirectorAdminister	DemonstrateExplain.exe
File opened for modification	C:\Program Files\ShowcaseDefine\2_DemonstrateExplain.exe	GuZoYNSMafLLtPd.exe
File opened for modification	C:\Program Files\ShowcaseDefine\2_PartitionPresent.exe	GuZoYNSMafLLtPd.exe
File opened for modification	C:\Program Files\ShowcaseSimplify\GovernLocate.wrapper.log	GovernLocate.exe
File created	C:\Program Files\ForwardUnderline\kerLxoedDNoTdHmR.exe	2026-08-23_aa89e5e6001e06322dc4d0c0b99836e9_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe
File created	C:\Program Files\ShowcaseDefine\GuZoYNSMafLLtPd.exe	MsiExec.exe
File opened for modification	C:\Program Files\ShowcaseDefine\2_HuntOversee.exe	GuZoYNSMafLLtPd.exe
File opened for modification	C:\Program Files\ShowcaseDefine\ExplorePresent.xml	GuZoYNSMafLLtPd.exe
File opened for modification	C:\Program Files\ShowcaseDefine\GovernLocate.xml	GuZoYNSMafLLtPd.exe
File opened for modification	C:\Program Files\ShowcaseDefine	DemonstrateExplain.exe
File created	C:\Program Files\ShowcaseDefine\HxCommModel.dll	MsiExec.exe
File opened for modification	C:\Program Files\ShowcaseDefine\GovernLocate.exe	GuZoYNSMafLLtPd.exe
File created	C:\Program Files\ShowcaseDefine\DemonstrateExplain.exe	MsiExec.exe
File created	C:\Program Files\ShowcaseDefine\PartitionPresent.exe	MsiExec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIE48A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_2eamwmyi.1sh.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_oovf2exd.vgx.ps1	powershell.exe
File created	C:\Windows\Installer\e59e0a6.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF991F9BF522F2A3A1.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF43618A7E578160F1.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2A5E9D32E99FADE1.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5D96A8B3BD4AE916.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_21aeksr4.hp0.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ee2vrzio.f5g.psm1	powershell.exe
File created	C:\Windows\Installer\e59e0a2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e0a2.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A7A517BB-C707-43EB-B74D-D2C3F97BEC16}	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4160	cmd.exe
4132	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4712	1596	WerFault.exe	103

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_aa89e5e6001e06322dc4d0c0b99836e9_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GuZoYNSMafLLtPd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DemonstrateExplain.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HuntOversee.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	11	Go-http-client/1.1

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	kerLxoedDNoTdHmR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DemonstrateExplain.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DemonstrateExplain.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe\VBScriptSetScriptStateStarted = "240782687"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	DemonstrateExplain.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	DemonstrateExplain.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	kerLxoedDNoTdHmR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DemonstrateExplain.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	kerLxoedDNoTdHmR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties	kerLxoedDNoTdHmR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DemonstrateExplain.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DemonstrateExplain.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	DemonstrateExplain.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	kerLxoedDNoTdHmR.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput\VID_0222&PID_0001\Calibration\0\GUID = 00874bc03e9ff1118001444553540000	kerLxoedDNoTdHmR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DemonstrateExplain.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DemonstrateExplain.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DemonstrateExplain.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DemonstrateExplain.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	kerLxoedDNoTdHmR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DemonstrateExplain.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DemonstrateExplain.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DemonstrateExplain.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DemonstrateExplain.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DemonstrateExplain.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DemonstrateExplain.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DemonstrateExplain.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DemonstrateExplain.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput	kerLxoedDNoTdHmR.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput\VID_0222&PID_0001	kerLxoedDNoTdHmR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DemonstrateExplain.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BB715A7A707CBE347BD42D3C9FB7CE61\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB715A7A707CBE347BD42D3C9FB7CE61\ProductName = "ShowcaseDefine"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB715A7A707CBE347BD42D3C9FB7CE61\Language = "2052"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB715A7A707CBE347BD42D3C9FB7CE61\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5ABA8537E24F6DF4CB999CDAD7E9AABC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5ABA8537E24F6DF4CB999CDAD7E9AABC\BB715A7A707CBE347BD42D3C9FB7CE61	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB715A7A707CBE347BD42D3C9FB7CE61\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB715A7A707CBE347BD42D3C9FB7CE61\SourceList\PackageName = "ykkBKSsrqOqNnJqD"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB715A7A707CBE347BD42D3C9FB7CE61\PackageCode = "C202A327220701D459C3AA869E626AA4"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB715A7A707CBE347BD42D3C9FB7CE61\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB715A7A707CBE347BD42D3C9FB7CE61\SourceList\Net\1 = "C:\\ProgramData\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB715A7A707CBE347BD42D3C9FB7CE61\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BB715A7A707CBE347BD42D3C9FB7CE61	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB715A7A707CBE347BD42D3C9FB7CE61\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB715A7A707CBE347BD42D3C9FB7CE61\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB715A7A707CBE347BD42D3C9FB7CE61\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB715A7A707CBE347BD42D3C9FB7CE61	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB715A7A707CBE347BD42D3C9FB7CE61\Version = "33947655"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB715A7A707CBE347BD42D3C9FB7CE61\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB715A7A707CBE347BD42D3C9FB7CE61\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB715A7A707CBE347BD42D3C9FB7CE61\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BB715A7A707CBE347BD42D3C9FB7CE61\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3428	msiexec.exe
3428	msiexec.exe
6008	powershell.exe
6008	powershell.exe
6008	powershell.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe
1596	DemonstrateExplain.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5128	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5128	msiexec.exe
Token: SeSecurityPrivilege	3428	msiexec.exe
Token: SeCreateTokenPrivilege	5128	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5128	msiexec.exe
Token: SeLockMemoryPrivilege	5128	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5128	msiexec.exe
Token: SeMachineAccountPrivilege	5128	msiexec.exe
Token: SeTcbPrivilege	5128	msiexec.exe
Token: SeSecurityPrivilege	5128	msiexec.exe
Token: SeTakeOwnershipPrivilege	5128	msiexec.exe
Token: SeLoadDriverPrivilege	5128	msiexec.exe
Token: SeSystemProfilePrivilege	5128	msiexec.exe
Token: SeSystemtimePrivilege	5128	msiexec.exe
Token: SeProfSingleProcessPrivilege	5128	msiexec.exe
Token: SeIncBasePriorityPrivilege	5128	msiexec.exe
Token: SeCreatePagefilePrivilege	5128	msiexec.exe
Token: SeCreatePermanentPrivilege	5128	msiexec.exe
Token: SeBackupPrivilege	5128	msiexec.exe
Token: SeRestorePrivilege	5128	msiexec.exe
Token: SeShutdownPrivilege	5128	msiexec.exe
Token: SeDebugPrivilege	5128	msiexec.exe
Token: SeAuditPrivilege	5128	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5128	msiexec.exe
Token: SeChangeNotifyPrivilege	5128	msiexec.exe
Token: SeRemoteShutdownPrivilege	5128	msiexec.exe
Token: SeUndockPrivilege	5128	msiexec.exe
Token: SeSyncAgentPrivilege	5128	msiexec.exe
Token: SeEnableDelegationPrivilege	5128	msiexec.exe
Token: SeManageVolumePrivilege	5128	msiexec.exe
Token: SeImpersonatePrivilege	5128	msiexec.exe
Token: SeCreateGlobalPrivilege	5128	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeDebugPrivilege	6008	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	6008	powershell.exe
Token: SeIncreaseQuotaPrivilege	6008	powershell.exe
Token: SeSecurityPrivilege	6008	powershell.exe
Token: SeTakeOwnershipPrivilege	6008	powershell.exe
Token: SeLoadDriverPrivilege	6008	powershell.exe
Token: SeBackupPrivilege	6008	powershell.exe
Token: SeRestorePrivilege	6008	powershell.exe
Token: SeShutdownPrivilege	6008	powershell.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5128	msiexec.exe
3428	msiexec.exe
240	MsiExec.exe
2460	kerLxoedDNoTdHmR.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 5128	3420	2026-08-23_aa89e5e6001e06322dc4d0c0b99836e9_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe	90
PID 3428 wrote to memory of 240	3428	msiexec.exe	92
PID 240 wrote to memory of 6008	240	MsiExec.exe	94
PID 240 wrote to memory of 4160	240	MsiExec.exe	97
PID 4160 wrote to memory of 1816	4160	cmd.exe	99
PID 240 wrote to memory of 4132	240	MsiExec.exe	100
PID 4132 wrote to memory of 1808	4132	cmd.exe	102
PID 240 wrote to memory of 1596	240	MsiExec.exe	103
PID 1596 wrote to memory of 5396	1596	DemonstrateExplain.exe	106
PID 5396 wrote to memory of 2460	5396	kerLxoedDNoTdHmR.exe	107
PID 3672 wrote to memory of 4800	3672	GovernLocate.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-23_aa89e5e6001e06322dc4d0c0b99836e9_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_aa89e5e6001e06322dc4d0c0b99836e9_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\SysWOW64\msiexec.exe
  msiexec /i C:\ProgramData\ykkBKSsrqOqNnJqD /qn
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5128

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E172A55427B340DD827FAF69E068A197 E Global\MSI0000
  2⤵
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\ShowcaseDefine','C:\Program Files\ShowcaseSimplify','C:\Program Files\DirectorAdminister'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6008
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""C:\Program Files\ShowcaseDefine\GuZoYNSMafLLtPd.exe" x "C:\Program Files\ShowcaseDefine\SimplifyAnalystSleek." -f -to "C:\Program Files\ShowcaseDefine" -key "2${55iqFSiQWEnhanceChampionBright""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\Program Files\ShowcaseDefine\GuZoYNSMafLLtPd.exe
      "C:\Program Files\ShowcaseDefine\GuZoYNSMafLLtPd.exe" x "C:\Program Files\ShowcaseDefine\SimplifyAnalystSleek." -f -to "C:\Program Files\ShowcaseDefine" -key "2${55iqFSiQWEnhanceChampionBright"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:1816
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""C:\Program Files\ShowcaseDefine\GuZoYNSMafLLtPd.exe" x "C:\Program Files\ShowcaseDefine\DeployMediatorNimble." -not "1_DemonstrateExplain.exe" -not "sss" -not "hgYKbwkauJKgpeP" -not "1_//__EDRFILENAME1__" -not "" -not "1_HuntOversee.exe" -not "1_PartitionPresent.exe" -not "sa" -f -to "C:\Program Files\ShowcaseDefine" -key "!7(71aJlxozGDeployEvaluatorEager""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Program Files\ShowcaseDefine\GuZoYNSMafLLtPd.exe
      "C:\Program Files\ShowcaseDefine\GuZoYNSMafLLtPd.exe" x "C:\Program Files\ShowcaseDefine\DeployMediatorNimble." -not "1_DemonstrateExplain.exe" -not "sss" -not "hgYKbwkauJKgpeP" -not "1_//__EDRFILENAME1__" -not "" -not "1_HuntOversee.exe" -not "1_PartitionPresent.exe" -not "sa" -f -to "C:\Program Files\ShowcaseDefine" -key "!7(71aJlxozGDeployEvaluatorEager"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:1808
- - C:\Program Files\ShowcaseDefine\DemonstrateExplain.exe
    "C:\Program Files\ShowcaseDefine\DemonstrateExplain.exe" -ShowcaseDefined Showcas -ShowcaseDefineS eDefine -ShowcaseDefineP 1108
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Program Files\ForwardUnderline\kerLxoedDNoTdHmR.exe
      "C:\Program Files\ForwardUnderline\kerLxoedDNoTdHmR.exe"
      4⤵
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:5396
    - - C:\Program Files\ForwardUnderline\kerLxoedDNoTdHmR.exe
        
        "C:\Program Files\ForwardUnderline\kerLxoedDNoTdHmR.exe" --mod=install --admin=1
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of SetWindowsHookEx
        
        PID:2460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 1768
      4⤵
      Program crash
      PID:4712

C:\Program Files\ShowcaseSimplify\GovernLocate.exe
"C:\Program Files\ShowcaseSimplify\GovernLocate.exe" install
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4424

C:\Program Files\ShowcaseSimplify\GovernLocate.exe
"C:\Program Files\ShowcaseSimplify\GovernLocate.exe" start
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1596 -ip 1596
1⤵
PID:5280

C:\Program Files\ShowcaseSimplify\GovernLocate.exe
"C:\Program Files\ShowcaseSimplify\GovernLocate.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Program Files\ShowcaseSimplify\HuntOversee.exe
  "C:\Program Files\ShowcaseSimplify\HuntOversee.exe" -ShowcaseSimplifyd Showcase -ShowcaseSimplifyS Simplify -ShowcaseSimplifyP 1111
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59e0a5.rbs

Path C:\Config.Msi\e59e0a5.rbs
Size 7KB
SHA256 8283754857a8b5e7ba682849ae747f9ffd09a2641d950df837ee271eb97b6566
MD5 391988c6f1f4119071d08a9f8ec75835
SHA1 ffb4b8bb32b2bd40658e8444a088f2f15e763197
SHA512 f64d30e26d0d858fa465f7be942f9b32b86dcdfd72055f9c8b75102a2d8a6265a7d6ab2b3cbb9471816918ae33ca863207ee7db36e78338d5991a9eb54c14479
SSDEEP 192:2L7PpSJYaLCjaLWqwZjldAej/uUFp3gEmHSfyMh:2L7RSOaKaSqwVjAej/uUgEmHSfyMh
TLSH
T1AAF10F02360181F2E9471F70D75B2B603BB2D2DE4390335F1ACD92744E977456AD9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GuZoYNSMafLLtPd.exe

Path C:\Program Files (x86)\ShowcaseDefine\GuZoYNSMafLLtPd.exe
Size 1.0MB
SHA256 7e2642901ff6760edfa8204e1f1261e6acb826d4f36b2fcf017de42ccbd506d4
MD5 0c28f2ab0db226962e61a1bbf39d0c2a
SHA1 5096f4959c0f4ba1d27ddd7181a1848d21603bd9
SHA512 7412d8e9327e111f83651bb9078bb6a72ffd750b6e1e4d8862fabb376901362b1ce507a5fafacd19d084610e2a82ab2eb72112c0f7fd467d8a9670469be5e9b3
SSDEEP 12288:5GVFM7FrwEP8YEWYpwqmh2KgqgUfEDQG39RFnyfBC/AeCrvaIV/cD66mis:CM7FUZWnh5gHUcjhnyf2srv3V/ce
TLSH
T18F354999EB4385F1D95304F1090BF7FBA634AB254420CCAAF688DD59FBB3C52246E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SimplifyAnalystSleek

Path C:\Program Files (x86)\ShowcaseDefine\SimplifyAnalystSleek
Size 15.3MB
SHA256 590c2e548a8e46a2eb5cc91d50077c832f4d6d984cfb09bb96a3fbc6ee6ed51d
MD5 03e14f8e0e5880afb46383d78a2814ac
SHA1 b9953980c5dc5d539e1f7a3f0dbf819dc74369c6
SHA512 8e5e61862bc37b9ac8055bf46ad85f536779db1f76de21f02b8042a95db973cbd12b571ca258f52497ad1bdd3dc1060e0537773cd55b907c83418c53c39f67b8
SSDEEP 393216:Wf+B6aX15jS7xqkKVrvqJPuPfoF4JGn/RMMVBJSoh:ck6aX1MO2JPen85MMVBB
TLSH
T16BF633FBD19540CC8C494701A773FD42CAF7B9053F58F6853121BAEA690BE89B19728D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bdeuiMMreplece.dll

Path C:\Program Files (x86)\ShowcaseDefine\bdeuiMMreplece.dll
Size 211KB
SHA256 9e90ca7b5b79811b13b4c395d2d255200f9c432d1eb6dbc73430476da58cd300
MD5 cdc4f8d59c67e9fb34d63506f8066fc3
SHA1 49848298a4a44887e2e09eaa19f9f08bfae58b7e
SHA512 3263dd60c2fdb8773f186124b8ce39ffb7766da11a4b40efddb3b61346aa6a82b711f23023577f5eb22cc373951441e360d5b7cf82ef6b6f4402096fddf7de0c
SSDEEP 3072:zZugmWe/2a9UXP/EQnrsZEIuYWbSwYEx08nj:dug/e/2aOEmrsZBCbvT08n
TLSH
T114243B3E31BA10A6E937903885078656F2F37C71231166EB09D0E17C9B7BAE87279F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2_DemonstrateExplain.exe

Path C:\Program Files\ShowcaseDefine\2_DemonstrateExplain.exe
Size 8.7MB
SHA256 3a96ec1f68983320e91a64c79cda624f97d5708f5cbfc5878088d6420f74b48c
MD5 7afc3e598aea8d15883e4a1a1f32852d
SHA1 f59a756cd6330b94eaa6143fa2d9064387b0f118
SHA512 cf4423ea9b84dc72bbac8971d59a4e485ccbd7d68a1410acc156f60aa5eefa5c11a17132c9d8eba1c3ff86f31be7df820733cb4e928c3e4b66dc34ad860a5097
SSDEEP 98304:tnDrCc4scD7QKfhMHDbJ/5naBZzaOekPtJINefw286gkla:hDrBRnJRnaBZ+OeklJI+w286gk8
TLSH
T153968D80F9DB24F1DE42183044AB527F67346D068B24DFC7EA24BB7AF8379910A37659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2_HuntOversee.exe

Path C:\Program Files\ShowcaseDefine\2_HuntOversee.exe
Size 12.6MB
SHA256 c5512d2616f076970415db3526a62ff69a1f3f38228fc3a8385102e377783266
MD5 9085f9a64c85ab04fbb0f090d005bfdb
SHA1 bcd5fb2dbdf3d292f7fea7d88654b1474878c93b
SHA512 d8e084cd642213d7ffaebaaec7835926db87c6835ba0e082fcdd622bb3250ff1a75fe6839a38ea1983931ed6429ae62ec5b1d251f6a56debbfb89d962dae0e5c
SSDEEP 98304:suxi5sSgNPieNYkZ3tsp6IfalcAWnH1Pznm72Fru8SV6mq/dLBCgmUV:DxjPXm1ilQnHtn9tuxV6LdtqU
TLSH
T12CD68D41FA9F10F5EF43193084AB627F27305D148B34CB87DB64BF69E87BA921932649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2_PartitionPresent.exe

Path C:\Program Files\ShowcaseDefine\2_PartitionPresent.exe
Size 10.5MB
SHA256 a719c9f0444d54bc291fb3b844ee89781c3a8ed2f1bc9eb822a343333c5f5640
MD5 d4c885ff05786fb3fd7505061aab2bcb
SHA1 89e1891fbcd8d6f5654d0f48f8d30f77e67fb271
SHA512 bf3c1a3e11aa9a553619d8dda0f5a08839e1888cfa7da280f1eab2ded1ae96abadbb41650132eef0fd4736ab6ef8620aafdabbc0238d730d71da8fcc70b2b377
SSDEEP 49152:bKykkXu7b8cGxkOpunSw+edz6g08erMa+OrF+sglm1sQVNgC1ZNcIEl1agn4k1ES:bKe+5GWOp4LZ6AcGQICzN3El4gY/WFi
TLSH
T183B62A40FE9B40B1EE031971545B627F67306D0A8B28CB87EF60BF59E87BA921D73509
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DeployMediatorNimble

Path C:\Program Files\ShowcaseDefine\DeployMediatorNimble
Size 15.3MB
SHA256 ec1cbd728055766d3d5029d13dda59e6f48c45429c2fe89d781e162d5bb92639
MD5 8ee147ae766b646896377890bbd01282
SHA1 3c891f030f18251593f7aef70816e1d5da199580
SHA512 adb874c49ebc1ae4bc307b59f1686858798e77326589abb13b1e45786d6d801b60548de84d10473c98307c7a26075b5084e2b23f9290165109b729d5f81b34c2
SSDEEP 393216:kU3Ez1NmI44OMDWibSgbHYZxe4FgjSgqfkzAsnn6T4:Rk1N44OMX14ZI4FESV/Em4
TLSH
T13AF633545C2C3BB3AD36CF33D3A6F89BA8637981FB5FD158E058C55F04928A0F661892
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExplorePresent.xml

Path C:\Program Files\ShowcaseDefine\ExplorePresent.xml
Size 476B
SHA256 af3324462d98b96fee4dd53fabde9f0da618a7901d13fd488073babd31965c63
MD5 0adcfc1c19d3fe716e982329fa8cf6fc
SHA1 1a9a4affa11d57d79bfc2031114a25e666172c17
SHA512 fcf7f99bb2215236b88191ff874ad2f1b798502b35540e154f079a2d93ab49edb5e0d2e0dd27a3cba2897964d9b3db387e253cccab69dab16ed66e1e0b583784
TLSH
T127F09780B0CB7BA11DABB0C1BA2157181036C2D8388C18D1BBD08322B5C28C6CABBF17
MD5 SHA1 SHA512 TLSH

Submit Download

GovernLocate.xml

Path C:\Program Files\ShowcaseDefine\GovernLocate.xml
Size 479B
SHA256 41f0076bc83cc8d3c5a46bce5fbf31f4947b9faf984ffe6b301a173a91d0b646
MD5 dca044c70c65e2a115ecba2537415f86
SHA1 9ac45d07aba050b0e57072138e937a5a8703aad4
SHA512 0928149d85b71bbb48a53200e376ce64cb6c45566f05ef08f7cac438770728a0273cd6e355d0d7c9d3a478d79b868d2b6070cd6abf1b1d276b1cd9dcd99a365c
TLSH
T161F0E98088C17BF3182D60F26A22B3391C61FB4660480D6277E6D7520584CED485FF83
MD5 SHA1 SHA512 TLSH

Submit Download

ObserveTrack.sys

Path C:\Program Files\ShowcaseDefine\ObserveTrack.sys
Size 470KB
SHA256 362b5742b816fafce9f7a5e34ae4293953b1f076f29c31d0e9211bbe2a9a617a
MD5 24cf8f4fb6d69bc7a4e107cc1daf8924
SHA1 0a7c68589c7fb1f9a59ac517d2c898193bd8d863
SHA512 0bba6f64dd9b1acfe68fba0395e57aa12fff043ece15531452cd8f94be88d22102fd8bc3f7e37ec7b71d8e409fc247e07dbbe5fbdbfc16d339384389beff1b55
SSDEEP 12288:zDP32UgQWzYi6g4dVmwFlqpTBw4spasQnUzOQFLZpRk+:zDkzgEX/sUs2UzOYL77
TLSH
T19BA423C164787017FE691D68E1330B7CB6FB910F284468134795AF9989C132BABCFA9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperatorObserve.exe

Path C:\Program Files\ShowcaseDefine\OperatorObserve.exe
Size 606KB
SHA256 7b36e127e1fa53e0c6462312777c5d004ea83bde67e6df32fb8920b6c001d664
MD5 4e85cc36adc996c3ddd3a9825d4b7f73
SHA1 e5aa0e5db7d9fd27e2a0484f3fd6c322fc5ee97f
SHA512 2d7b7c5eb54cf68a218fca7239c0e194af0b81796e621bc039edccea64b60a202670a47af207988467a8c25584cef96a6652f52d53464ce3cf01006c680f2980
SSDEEP 6144:HcNM+RCns3iTVqKxGE5eYHM2GevEYlm3NI0vHhaL3gEXm//mAm+snmFMuImPSyqj:8NvRWVqceY1Emm9t2QEQmNONI
TLSH
T1F4D427103BF8961BF2BE37B1A97006249BB4F956E7BAE74F598415AC1C637008D2137B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperatorObserve.xml

Path C:\Program Files\ShowcaseDefine\OperatorObserve.xml
Size 465B
SHA256 6a2597556d44c4557ae8112759ecb3365be0a92e41cd1704852a1833ca2e2efb
MD5 d204cfe35ad99a7d6587c4a424df52d4
SHA1 1933f2d01d21627d252a407c4e118fc839b70642
SHA512 be77854f3f2c9eb6487bf96cd06b163b7d0bbab806cf3c187a90342baeac5cf5c776568c0590b4651c1ee0d54c3ed8917b704e6d5ab80677ea7e0c62a655634f
TLSH
T127F02E4119D5B5B3652B6476BB2272140832EA9614494C60B3D99E23DD815C9A0FBF81
MD5 SHA1 SHA512 TLSH

Submit Download

GovernLocate.wrapper.log

Path C:\Program Files\ShowcaseSimplify\GovernLocate.wrapper.log
Size 646B
SHA256 e984e19d60ac9395ad598a7de5eb5204a53e64f830ba10d0c27570be969daa6b
MD5 f048ffbf4b7001e8e82eeaf6eb00878f
SHA1 b6ab33d8cbf9d8e1bb3fbdcd555c31cb530c3c4a
SHA512 9415dd597df4267cada5f90d8ce955351efcc8818f1c4ac6fc22cbd637eaa163f6319360cf31ffe010c438c494c857c842b6696544fb6bb3b24a64ca54bd9402
TLSH
T1B2F08FB64BF6157B1BAF11DA620E364EFE033622DB0624223770590A928159BBD687E0
MD5 SHA1 SHA512 TLSH

Submit Download

GovernLocate.wrapper.log

Path C:\Program Files\ShowcaseSimplify\GovernLocate.wrapper.log
Size 204B
SHA256 f034649668e211f9b4e7ab9035dd52cb1b5835ee9630023de5ba4ce2c0af1acd
MD5 e626c95861c22e61fb9b67c6cb9b3f48
SHA1 62823c4b539e92d7a5b27087be2bf4edad7f491c
SHA512 6c5b395a9ca4ce775b3d1660e0864c13d4586d92c06fb03fc857cfe1b50e1469c1ef4ea9560d0ce17a6486fc4f90c0a1798090137def63a1895c8eb3c3449d3a
TLSH
T157D0A9B203F6003E2EA7028AA20E288EFE423220DF0620413A70080E928118BB8687E1
MD5 SHA1 SHA512 TLSH

Submit Download

GovernLocate.wrapper.log

Path C:\Program Files\ShowcaseSimplify\GovernLocate.wrapper.log
Size 415B
SHA256 73eb2f614d128f00f1c796f17ab79fac79cf6102ad713863e9152bc805d707b2
MD5 1c899a0c650b903a5b4fe5b005c1fb5d
SHA1 01dbd1b21dcfbd695a6e93a0e9c67424d27e1f99
SHA512 635e9cdcb488d3f324d879617432906ead90741f0f5003dbcc62e073a05768d8397aaef80035e6b0875d0a697c3a3cb361e77a5d0fee9d4b6bb3a4a90e094044
TLSH
T1A6E030F207F6153E6FA7168A620E698EFF073721DF0620113670180A928129BBC643E5
MD5 SHA1 SHA512 TLSH

Submit Download

GovernLocate.wrapper.log

Path C:\Program Files\ShowcaseSimplify\GovernLocate.wrapper.log
Size 474B
SHA256 b2f8ba110f770dc3d752ffdac90e596c82b4e64a8787da40b470201bb750e063
MD5 a924df73e164e1af72490933377da7ff
SHA1 21bcf2a0b052f94537ba3625a1b97cb9a2861199
SHA512 7dd7b8f9609620d2d89caa79915eda5c4bb7b6e09a95f0a716a106634bd0a63235c3512fafa695a121d844b7b0dbc8c4c527b40cfc231ee57bb7f41b3bdf891a
TLSH
T104F054F607F6153D1FA7128A620F658EFE473335DF0620113A70080A9281197B9643E1
MD5 SHA1 SHA512 TLSH

Submit Download

ykkBKSsrqOqNnJqD

Path C:\ProgramData\ykkBKSsrqOqNnJqD
Size 15.9MB
SHA256 caaae79d5e4b55d8eed8d94090bc55c7e92ea3afc27a15af366ab44838a79c3a
MD5 90b1a4220a23fc6b0742ed5b01312608
SHA1 566c78b73770f8c82db5bb617474c68da56d33a4
SHA512 a97228eda5d066ef1de3e3f5ac8051d489335107232504ff5f9f176bbfc7db38f801b928f860847d016586e88eee08f2c6daf9a9ea9db2b1c0250c353bc89e16
SSDEEP 393216:aC6tjpvtXTR2UCHhkcoxnrxqTCjKMYNBAfjtUk8M4L:aC6tvtXTfTZxqmGLgtUk8
TLSH
T1AAF633BBE0858B9CCC0942319673BD058AF6BD052F14BA417114FBFA253BD5A72A76CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

check_sign_test.log

Path C:\Users\Admin\AppData\Local\Temp\check_sign_test.log
Size 288B
SHA256 66bae277d1c143e3bbb466351b2c7fe44e4dede56c35c7f5e29fcf5554a3764f
MD5 97d7cc1affa1a861339d2b8f5c89431e
SHA1 48efbb49ce0549b39fa4b4f5a66efaa9aba0cb46
SHA512 ee6f2b36dde570ed6ad6f6c37bfc2c97eba661f37361727c2a12315fc52000c292b53f64eec52e830fd3119378f3a31c98646684d88ef8cd9246af89d3cba889
TLSH
T1B8D0172123F90185B6F377D1EAF10A609F36FD62A471814C5481065A0A72E410A85B2A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1596-75-0x000000002AAD0000-0x000000002AB18000-memory.dmp

Download

memory/1596-58-0x000000002AA50000-0x000000002AA7C000-memory.dmp

Download

memory/1596-80-0x000000002AAD0000-0x000000002AB18000-memory.dmp

Download

memory/1808-53-0x0000000000400000-0x0000000000510000-memory.dmp

Download

memory/1816-27-0x0000000000400000-0x0000000000510000-memory.dmp

Download

memory/4424-78-0x0000000000B50000-0x0000000000BEE000-memory.dmp

Download

memory/5396-83-0x00007FF6FF5F0000-0x00007FF7005F0000-memory.dmp

Download

memory/6008-15-0x0000020AED1B0000-0x0000020AED1D2000-memory.dmp

Download

memory/6008-20-0x0000020AED4F0000-0x0000020AED50E000-memory.dmp

Download

memory/6008-21-0x0000020AED510000-0x0000020AED5C2000-memory.dmp

Download

memory/6008-22-0x0000020AED5D0000-0x0000020AED5DA000-memory.dmp

Download