2f3e2a07c625f3497a53dcfb501c6b9ca827162f7028f07fb65ff6b5070cc8b1

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.exe
Size 44.4MB
Sample261030-ctc7dsda82
SHA256 2f3e2a07c625f3497a53dcfb501c6b9ca827162f7028f07fb65ff6b5070cc8b1
MD5 6f33b0183fcf0886fe0601b7319b8fe8
SHA1 1bb0de5eff4696b003e34a647b4c3d6401aea95c
SHA512 808f89fb4baf20dcfc7fab42b354d08430c366f3129ef684b89df542ddd3f29301938f9ea49b91910b50f5433ba8dc899bb84679f652a87cee14234f247cb1e9
SSDEEP 786432:lO6WKFCLSjnUFOn+3bU/qMyhkDfrvpc+MGRS7+zryxeg4FfJ:g6WWswYOn+rU/RTpcjGISI4JJ
TLSH
T114A7115667A400E9E1B3D23CC562C726E6B27C6547309BCB42D0BA6F2F37AD58E39710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution installer persistence privilege_escalation ransomware

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 1784 created 3280	1784	elevation_service.exe	56

Detects Windows executables referencing non-Windows User-Agents 11 IoCs

resource	yara_rule
behavioral1/memory/620-335-0x000001FA933C0000-0x000001FA96631000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/620-396-0x000001FA933C0000-0x000001FA96631000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/620-397-0x000001FA933C0000-0x000001FA96631000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/620-398-0x000001FA933C0000-0x000001FA96631000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/620-399-0x000001FA933C0000-0x000001FA96631000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/620-478-0x000001FA933C0000-0x000001FA96631000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/620-479-0x000001FA933C0000-0x000001FA96631000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/620-480-0x000001FA933C0000-0x000001FA96631000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/620-487-0x000001FA933C0000-0x000001FA96631000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/620-634-0x000001FA933C0000-0x000001FA96631000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/620-635-0x000001FA933C0000-0x000001FA96631000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4416	attrib.exe
1672	attrib.exe

Executes dropped EXE 5 IoCs

pid	Process
892	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp
4764	Unspokensignature5813.exe
392	Unspokensignature5813.exe
4292	Unspokensignature5813.exe
3076	Unspokensignature5813.exe

Loads dropped DLL 4 IoCs

pid	Process
4764	Unspokensignature5813.exe
392	Unspokensignature5813.exe
4292	Unspokensignature5813.exe
3076	Unspokensignature5813.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4564	icacls.exe
4488	icacls.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2772	cmd.exe
2016	cmd.exe
6124	cmd.exe
2864	cmd.exe
2164	cmd.exe
952	cmd.exe
764	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/624-0-0x0000000000400000-0x0000000000442000-memory.dmp	innosetup
behavioral1/memory/624-164-0x0000000000400000-0x0000000000442000-memory.dmp	innosetup

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	66	Go-http-client/1.1
HTTP User-Agent header	226	Go-http-client/1.1

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
5588	taskkill.exe
2980	taskkill.exe
5040	taskkill.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	waitfor.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
892	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp
892	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp
4764	Unspokensignature5813.exe
4764	Unspokensignature5813.exe
1784	elevation_service.exe
1784	elevation_service.exe
1784	elevation_service.exe
1784	elevation_service.exe
1784	elevation_service.exe
1784	elevation_service.exe
1784	elevation_service.exe
1784	elevation_service.exe
1784	elevation_service.exe
1784	elevation_service.exe
620	waitfor.exe
620	waitfor.exe
4292	Unspokensignature5813.exe
4292	Unspokensignature5813.exe
620	waitfor.exe
620	waitfor.exe
3076	Unspokensignature5813.exe
3076	Unspokensignature5813.exe
620	waitfor.exe
620	waitfor.exe

Suspicious behavior: MapViewOfSection 1 TTPs 5 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
4764	Unspokensignature5813.exe
1784	elevation_service.exe
1784	elevation_service.exe
4292	Unspokensignature5813.exe
3076	Unspokensignature5813.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	5588	taskkill.exe
Token: SeDebugPrivilege	2980	taskkill.exe
Token: SeDebugPrivilege	5040	taskkill.exe
Token: SeDebugPrivilege	4764	Unspokensignature5813.exe
Token: SeShutdownPrivilege	1784	elevation_service.exe
Token: SeShutdownPrivilege	620	waitfor.exe
Token: SeDebugPrivilege	620	waitfor.exe
Token: SeDebugPrivilege	620	waitfor.exe
Token: SeBackupPrivilege	4720	vssvc.exe
Token: SeRestorePrivilege	4720	vssvc.exe
Token: SeAuditPrivilege	4720	vssvc.exe
Token: SeDebugPrivilege	392	Unspokensignature5813.exe
Token: SeDebugPrivilege	3216	whoami.exe
Token: SeDebugPrivilege	4292	Unspokensignature5813.exe
Token: SeDebugPrivilege	3076	Unspokensignature5813.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
892	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
620	waitfor.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 892	624	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.exe	86
PID 892 wrote to memory of 5588	892	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp	87
PID 892 wrote to memory of 2980	892	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp	90
PID 892 wrote to memory of 5040	892	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp	92
PID 892 wrote to memory of 4764	892	2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp	97
PID 1784 wrote to memory of 2772	1784	elevation_service.exe	104
PID 2772 wrote to memory of 620	2772	cmd.exe	106
PID 1784 wrote to memory of 2016	1784	elevation_service.exe	107
PID 2016 wrote to memory of 4564	2016	cmd.exe	109
PID 1784 wrote to memory of 6124	1784	elevation_service.exe	110
PID 6124 wrote to memory of 4488	6124	cmd.exe	112
PID 1784 wrote to memory of 1672	1784	elevation_service.exe	113
PID 620 wrote to memory of 4468	620	waitfor.exe	114
PID 1784 wrote to memory of 4416	1784	elevation_service.exe	116
PID 1784 wrote to memory of 5140	1784	elevation_service.exe	118
PID 620 wrote to memory of 1596	620	waitfor.exe	120
PID 2864 wrote to memory of 392	2864	cmd.exe	129
PID 620 wrote to memory of 2164	620	waitfor.exe	131
PID 2164 wrote to memory of 2896	2164	cmd.exe	132
PID 2164 wrote to memory of 3216	2164	cmd.exe	133
PID 952 wrote to memory of 4292	952	cmd.exe	136
PID 764 wrote to memory of 3076	764	cmd.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4416	attrib.exe
1672	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3280
- C:\Users\Admin\AppData\Local\Temp\2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Users\Admin\AppData\Local\Temp\is-LNV55.tmp\2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-LNV55.tmp\2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp" /SL5="$402F0,46113230,229376,C:\Users\Admin\AppData\Local\Temp\2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:892
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Unspokensignature5813.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5588
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Unspokensignature5813.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2980
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Unspokensignature5813.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5040
  - - C:\Drivers\GeometryBarista\Unspokensignature5813.exe
      "C:\Drivers\GeometryBarista\Unspokensignature5813.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:4764
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c waitfor.exe ZqIdleHeartbeat3f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\System32\waitfor.exe
    waitfor.exe ZqIdleHeartbeat3f
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:620
  - - C:\Windows\system32\cmd.exe
      cmd ver
      4⤵
      PID:4468
  - - C:\Windows\system32\w32tm.exe
      w32tm /resync
      4⤵
      PID:1596
  - - C:\Windows\system32\cmd.exe
      cmd.exe /K "chcp 65001 >nul"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2164
    - - C:\Windows\System32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2896
    - - C:\Windows\System32\whoami.exe
        
        whoami
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /deny Users:(D)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\system32\icacls.exe
    icacls \"C:\Drivers\" /deny Users:(D)
    3⤵
    - Modifies file permissions
    PID:4564
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Windows\system32\icacls.exe
    icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)
    3⤵
    - Modifies file permissions
    PID:4488
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers +s +h
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:1672
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers\* +s +h /S /D
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4416
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn QPTPDGCNrVMzRsOAGMPBaYXT /tr "cmd /c cd /d \"C:\Drivers\GeometryBarista\" && start \"\" \"C:\Drivers\GeometryBarista\Unspokensignature5813.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5140

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:3080

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4720

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\GeometryBarista" && start "" "C:\Drivers\GeometryBarista\Unspokensignature5813.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Drivers\GeometryBarista\Unspokensignature5813.exe
  "C:\Drivers\GeometryBarista\Unspokensignature5813.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:392

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\GeometryBarista" && start "" "C:\Drivers\GeometryBarista\Unspokensignature5813.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:952
- C:\Drivers\GeometryBarista\Unspokensignature5813.exe
  "C:\Drivers\GeometryBarista\Unspokensignature5813.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:4292

C:\Windows\system32\schtasks.exe
schtasks /query /tn QPTPDGCNrVMzRsOAGMPBaYXT
1⤵
PID:4400

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\GeometryBarista" && start "" "C:\Drivers\GeometryBarista\Unspokensignature5813.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:764
- C:\Drivers\GeometryBarista\Unspokensignature5813.exe
  "C:\Drivers\GeometryBarista\Unspokensignature5813.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:3076

C:\Windows\system32\schtasks.exe
schtasks /query /tn QPTPDGCNrVMzRsOAGMPBaYXT
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Process Injection

T1055

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cheesespreading4359.exe

Path C:\Drivers\FameHandling\Cheesespreading4359.exe
Size 276KB
SHA256 ebe3614a4adbd3c87aa68360545ec474795ab977fcb7d46a6b59537e3164b246
MD5 36079e3f1b2d278bfaad7a85d9c4e24d
SHA1 eddda8a071170ec86a561f1dad17b82332dd7226
SHA512 d29322276a2dbaac315ba3d900ddb8b6d9c3dc8d88b8ba873ae712bee5bcab55312a0a5bb9c992c48c749a01677425e90328bf0cf403a74b6a004463b9c86d4d
SSDEEP 6144:5FWPGAoGpA0ta/xdybQGLWy3ngvxJ8XtJ7dQnEvpqDl:58GAot0tMbyHb3ngpJ8X3yEYl
TLSH
T158547C29B3944DF9EC67C23CCDB28412F63178564760EAEB13A48A391F336D45A3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChronicDevalue6594.1zZpO

Path C:\Drivers\FameHandling\ChronicDevalue6594.1zZpO
Size 4.4MB
SHA256 9b41eab968e38d1feb9a5d33ccb5c47e1f4cc8d359acb14b7909d15edc11235d
MD5 32e91bdc757f6d9695ef3b07cd91f5c5
SHA1 4bf1e5a15ef66f2091b637c8a25d61c1fe51a1c9
SHA512 3804fab78860732df9f913c659864d52e5d4bf3b86cf0a98ee3c1a6d8a70b5dc9c9d4f060cd426f288b9a6883c3032307839ced73dfded7303adaaebfc10c472
SSDEEP 49152:b9DcDbLw2foltKF14XOkaV4toQncXEaleu+DWENpTlJBGgoBoj0ZYQ:FkVfoWHIOBV4KocXEtu+99Rov
TLSH
T19226BF3132116A19E16F471AD1F84E1CC5BC294863B79B9C5E23BEE27E86702EF7815C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FuryToshiba8669.PHZ

Path C:\Drivers\GeometryBarista\FuryToshiba8669.PHZ
Size 4.4MB
SHA256 d266349904115202d9087f81597753f85ca4d5b80373a7a890acb115dbba78fa
MD5 f6d42d9025ebdcfe632fe96b3d1eb153
SHA1 3bae6837475d5950d353d6f8883ce8414339914e
SHA512 e489e80e6303e2c6252c283992beb23a20df20e885c36ffd67041ba10391b00e3d6ddcb09257248a1320e792ece33f9d543b093da5ab895043971e51e26475e2
SSDEEP 49152:FQ8pUGcQSZWCXFKKSSjOeiwF445Jg+Wo95s798yzBl8H4U/Y8Jkz8e:FQ4xCXFKjSCO4KJg+Wa5s79F8H0qkV
TLSH
T12226CF313200AA05E17F471BD1F81E1CD67D1608A7B69A9C8F23BFE67D56702FA78198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unspokensignature5813.exe

Path C:\Drivers\GeometryBarista\Unspokensignature5813.exe
Size 3.2MB
SHA256 f0084fa6d7c7e86e2fe0b3d66a9c61e2a3a4ac7288a8d742190dc808aaae0e1c
MD5 b5a4dd047f72e7f8f045d4ecafe71a04
SHA1 fc520d70c0c3cf86c7b34bc9ac63f802fb1e1e48
SHA512 35ebd6c7791c922189c9bd7d03a328decc16f720055da53a29d279c494b0028ba70019f78a5c6198e46dcb0e0b59bbf0934f9583a8fd15db9dddaba3c17f02c5
SSDEEP 49152:4U165F3QfiJC/1qhpsyQ32AJItY6dKxs1TGakkunfeoYPGBVBV:4K/FysInK3ksRFVBV
TLSH
T19DF59D4177A410E5F0B2E139C532875BE7B238598731F7CF8680866A1F7BAD68D35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TorchTelecom1475.OY0U

Path C:\Drivers\MillEngineers\TorchTelecom1475.OY0U
Size 4.4MB
SHA256 2cb3937e11d5d167b75d018dd759dff83bef7f9b225bb69121326b7e0434df82
MD5 e3c61022e9a9960493a5c09796b7c8a8
SHA1 c52c289dd343c5e1be844322400ea00e2aa583ee
SHA512 1bb35e5c65092f1868747d844e4eda1e938d7a0817d70fa0eb61244bcd4a50343f472a24620cf429f76e896628150889db5ecbdee877c7d6998e7c8524560d8f
SSDEEP 98304:hYDCChZE/sbpkLRveMEASQhTWcqf3ZMkM:hYDbDgsbgvZTNhTVC5M
TLSH
T18A26BF312251A919E06F472AD0F85E1CC27D664897778B8C8E63BFF66D96302EF7814C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Upgradeschili8690.exe

Path C:\Drivers\MillEngineers\Upgradeschili8690.exe
Size 240KB
SHA256 bcac830682396cc5d1b6e2b3d071cc7ae0897eda5679b2f7e461d0fe507e7254
MD5 3f4665d1091fd11fb86a7f2477e8d8bf
SHA1 20b1ed324a386e3776980f93c885ff6cf79dac9d
SHA512 664377a49c8c03d5285d2baecb042cd6ccbe997cec1220aab9ff7508f8351939a14db6ea45847a1d9593f9b831b32a02d014ba913049bff6e580e0729bea84d2
SSDEEP 1536:/QE7wIPcMhZmymaw0YzbVsyImWGg7TtMR:/L7wscMXqbV7ImWGg1G
TLSH
T1BC34086066545869DCA1C038C2F7C73AD875BCD9272592CB97FB7E8B3E703822C2A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WUlXB.ico

Path C:\Drivers\Qualmquiver6232\WUlXB.ico
Size 112KB
SHA256 6fd2bb5c3935626ae95878d5596dd8281bc42c00c1768dd1b6d1a5acb15fafe5
MD5 4234b0b7c484a20220b5b7ebd2c28bee
SHA1 6302247ee12bfdc8528a4aa13d3c9b46c95776d4
SHA512 5bbed4396ced4652e57f2923a204b97e67a465bc761e8a4a65046463fd290d1b4a4064b17f89988dcca3a9bef6eb443e13b0f0479f533d41584e373dbd5b1d64
SSDEEP 768:SxYdOUUidtxH+Hglwp0nbcFefkMQ897Lqj4/wXJHChe+JT4nqiRfRs4Rc1u/dxZf:S5U1fxHLSp0noFfOe+JT4qiRfjR/zV
TLSH
T1BFB30B93FD49D0A8F5658E31C863E16D2E5A3D71ED8EAD24F270BE0C1B32A415B83587
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurvyTuna-8807.XpE

Path C:\Drivers\RocklikeAnimated\CurvyTuna-8807.XpE
Size 4.4MB
SHA256 aeb660895040f1d6edc9c007418745ad2878f49402d4ba2d3ff2e6dc514df701
MD5 61e64fa187fd33fb7b8deeb3a8fb83f5
SHA1 68ae01a0cc4c0ae093605030abef2b0156026286
SHA512 8ad276a8961272c237402e35b6d29834d620debe43ed648dc295774621320f6e136c32b5f92faa73c389a594c3b9af50879859dfda7ae3e99d3a00f34456f910
SSDEEP 49152:hMQearXa3QCjj8mXxelPynucHzXrVbWAY431fGD2tEVl:hKCORv8mXyP0ro3GfSv
TLSH
T1AD26BF313211AA15E17F471AD1B84D1CC57D6A48A7BA8B8C9F23BAF26D86302FF7415C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reshapeboat5322.exe

Path C:\Drivers\RocklikeAnimated\Reshapeboat5322.exe
Size 6.6MB
SHA256 52ec8946e1351cce60f41efdc03c82ca0e9e73a0287eccb0c1cd4cec5acdbcf9
MD5 a15229b2c81c06034e97258db9cb6f49
SHA1 ec7860cc2289b1c05a226f6858144c7c513de9d1
SHA512 dae920cb2050227873eadd21e0a33e29bf0db2b8322fe43cdf7d13303fcd0c93618472f7bea0bbcf90dfaee8af5baf37c128debe00859f6f3ab0b9194fb77486
SSDEEP 49152:ZJ8JXWvvo2ikatBz6VEE0hP2oVhLM4PkP5OmlwCJMboL/99DNRiaZmhPH66N7ZJ/:ZCmDVErPqlDNURhP8+IKWbLyV
TLSH
T1DA666A5B67A801DDD2BBD27CC6838B16F2B6BC5607318BCF019172B90E77AD49E39610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 17KB
SHA256 d95e0372fafecebf80966a6392a0a2b3e53343b8924721e89ac649008d820ef0
MD5 f2018d130a2b2515a099cfd0ae89ce04
SHA1 3946f8ae5077405ad274bfafe1e675a48db51e2d
SHA512 b81b6bea4f0ebd7e5979bbe82c3a601c4f2e45a5254472a4599c6f9bc63817ab23d14dfc2b0b3e1ec0377cfc24d86746678dee8b416a75718934f8bf83a015c6
SSDEEP 384:8pGy4QqojVv8CHS1QVs9OOByFV64t4fP6mmZ0lrEjGTW3vM3nxbRMaK6zf:8pG1Q3VUgS1QWxByFV6C4nUquiTW3InN
TLSH
T1E882BFA7687271E75C54995104E3F70EEBF90E853403AA3597229D2FBD67C2290C748A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 28KB
SHA256 28268ce76f8c8605d4c6ebd7626aa4e05e4a0780c878f94afdf4fdf7d94302ce
MD5 3ba586e0d9c7db993fb03c973d819915
SHA1 da9a711ffe39c58c4390b31b106bdc3a5f9df77c
SHA512 1b3a22957cdffb788881fd0f74e63abfc97f9dc17c2b6c2cc79374bb720b4b1d9e09813a8c071a33ca50c0b4cbc85103a870395279e04e39c0f531a0133bf1b6
SSDEEP 768:8pG1Q3VUgS1QWxByFV6C4nUquiTW3InLMaAoCpHJF9f:sEQKgS1M/4niiHREJFl
TLSH
T133D2D02338717AD65D349A6105D6DB0FF2EA5A8D3847AE36CB31A81FBDA3C10D089C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 35KB
SHA256 deb6843f93307084d11ad36d2e088ac077ccbb9b3acb8de10e939d9d69de4871
MD5 d940a0c796cbf1c7ca7ab42185c405f3
SHA1 c62bd1ba86bbc92c05f023ffd167e7e63914d312
SHA512 8c4dc31c3477038173f5e1efd6b53740507e8b3a99794d9b73d493ac601b53fc7c77651f9be586a5be375fa48d10629e98aa3aacf9fefa4d5d4816c1c10e8c24
SSDEEP 768:8pG1Q3VUgS1QWxByFV6C4nUquiTW3InLMaAoCpHJF9LyBvgXj4:sEQKgS1M/4niiHREJFIBc4
TLSH
T1F4F2E0773A3176C20D34696101C9DB2FF2DA89CA3987FE358A35991FBC93C50D8C9855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 42KB
SHA256 20b6441d3c0babfe15b2017210100176be728432376c0d22f03fa0234a9b0b8f
MD5 52d2cc2dc029c153c6df7f615e9463d5
SHA1 342bf5e4331cbb9f23bba90e2f9df432f62b773f
SHA512 43fcdca85749d707904940afe7ab00bedc0cd74e668d50d9635eab769d2b53932d4e09a66076459aa4bf3208640c92e9786161b16cf125545aaf08e03751329b
SSDEEP 768:8pG1Q3VUgS1QWxByFV6C4nUquiTW3InLMaAoCpHJF9LyBvgXjA3045QHqL1C:sEQKgS1M/4niiHREJFIBcA30uMqLk
TLSH
T12813F16B3E707AD50D74246202DACB2AF3DA94CE3883BE358E3A191F7C56821C8C9C55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 43KB
SHA256 304725816270a570e74cc93e21e29a45185df3047d3a012ff30a60bb88b961f2
MD5 6e7df9b43c6c1f228b152555b2ab6201
SHA1 36ef3240fb19b8a3ec136baf0b7fde72cb5c45a1
SHA512 44ea555e958f534752fa11280212c06deec54cf2d472e9b2e71adadc432b1556ea15f5d4393a6a33cf8d927440bd7b25ca8c5508837c4d3a336514b282308a50
SSDEEP 768:8pG1Q3VUgS1QWxByFV6C4nUquiTW3InLMaAoCpHJF9LyBvgXjA3045QHqL1/N5:sEQKgS1M/4niiHREJFIBcA30uMqLP5
TLSH
T19513F16B3E707AD50D7424A202D6CB2AF3DA84CE3883AE358E39591F7C56821C8C9C55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 50KB
SHA256 af7f5063c0950c9d475a51eeab76c49fbfd6373cd7d520ee322cf55129e922a0
MD5 2b3d398e643d16cac6c152db81029a4c
SHA1 2a4ce3c32da54448f78775b2034bb98250be4c82
SHA512 89458c07f6d9657707c153d94397c54e851ace3392454d931f3f0ee2949a990899ab583043172f64b67ad69eec3b38847748ae4c33c40c93d9b4f5d3f9363ae6
SSDEEP 1536:sEQKgS1M/4niiHREJFIBcA30uMqLPaKsU+6:sQgS8niHgUp
TLSH
T10B33F1BB393576C6183428A203D6D76AF3CA95CD3947EE358E320D8B3C96861C8C9C52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 58KB
SHA256 f2da0addadffa6d91fbe06615701527b5892db86b0f6ec5502b04a21c5def7c7
MD5 a76a20fcfddbb88d8c40f934e6199b60
SHA1 ebd2369633bd217fe61c73949e31543584e91542
SHA512 efff4b3f6309987c2fb0c50d0e319cfdd44c35b052e00b687559b77f7aa780a3d706defcab713451a1b740c060c7fb26992f0200e528be4d4159d5ebd91084c9
SSDEEP 1536:sEQKgS1M/4niiHREJFIBcA30uMqLPaKsU+YLVa3wt0:sQgS8niHgUpLVIwS
TLSH
T1EC4302AF2C3137C51C7428A30AEAD769F2D995DA3447EA368E220C8B7C42956CCC9C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 63KB
SHA256 bc9758d79c839ef2f87a030aee47d6c835e633128c1642df279cd758609cadf5
MD5 6f5a3f468fe5b4b733ffc7eb9c01722c
SHA1 05672ebd722863e9898dfd88a28539e0a4941357
SHA512 beff1adf257a5d8633c99eee93ebfc8664834b87c812446cc52451becac90cebb7d7a92a0bccf398c761f48f326460ae323d3c4f2da9ca959e6138e004b1dd5c
SSDEEP 1536:sEQKgS1M/4niiHREJFIBcA30uMqLPaKsU+YLVa3wtDT0:sQgS8niHgUpLVIwm
TLSH
T19053027B6D3276D51C3828B346DAC696F2D8E5CE3847EA3689220D8F7D45862C9CCD02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 2KB
SHA256 df6d970b4ce81809cb6e228d695338be951e4b0c71a35dbe7074b7e25b3d6c47
MD5 64fdfb2448cfa1eaad3a18ae3fcf2b9d
SHA1 4987e74080bf05deeacfa3c4124f190bafdd8e1c
SHA512 aebaaf911a84be72862fb5da9a0b66c1bdddf3cb0eb7bf048c35cee168d7c473cf0d0929fc667290dcafc5e2353a49ac90f6d2c8f61838d73c3573333f241a04
TLSH
T118517C834B12AB892F11DD8D78DBEB1ED0790B08BC35652C91312D572DEBD00C44ACBD
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 93KB
SHA256 ec43814d3ddd1b12ee9e550358e5acaba62b38bf8d3994f63858656efc74d6d9
MD5 3952106de6349d7db25211fe496b2af8
SHA1 d2bd5636fb41d18d9ffd28dc165f4ee490ab6726
SHA512 b2666b64012093f87cd15911d7cd8a13937beef4fae9007e1ac22efb160d3560cca464d3c1017b8fe53db04579c2dab47ea0575031812ab50a6509f3c4d03b27
SSDEEP 1536:sEQKgS1M/4niiHREJFIBcA30uMqLPaKsU+YLVa3wtDTAxWneZO3Fyol/KTVenwem:sQgS8niHgUpLVIw4W8O1yMm
TLSH
T163931237593233E40979A5A301DADAC7F2C8DACE7C43DD768921098A7D96852CDCCE52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 3KB
SHA256 2b74d1b46cdda4958335364fbd38014f522679b8f76979b31fcd7321820bde7c
MD5 0aea6b82a3b62d6ba3be17337261453a
SHA1 b167f535ffa57bc46728070d7b0c8dac5e5cde63
SHA512 48bc1b6a15c620004a87b929725715f60023ff6eefd763cdc1fbe1d6b1bd0d38a9069102ad2ccf0804b126958be273636d4d32b419263d9e73b96f4d212691d8
TLSH
T1F6716C874752B7492E21E95C34DBE65AF8B50F44B87A212CE0320D0B5DA7D00D45ACBC
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 3KB
SHA256 df29b2c47fde4ea1a83629957597718b13a65faf967dd25f3782cf4b26dbe0f7
MD5 5b02fd204f7e70cc9001f7a31f3a05aa
SHA1 c4c36f095436b9d6bf6e6bd05722f0672bc6fc18
SHA512 2ad53d255bfe61a9d00f448e3acfe084c42f07582434980ac112392e8ca223b2f5e40dc8465ef01270dc9d42117c96ecf69965137a5ac353cc272be3d3f2bc9f
TLSH
T1D7818E52971177452A129E5D38DBF25DF9F50F48B47A212CE5328D1F8D97D00D41A87C
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 31KB
SHA256 73ac63982c47f686c1d619a15d3bf0c805fbc1b97518da5cf5c718fec64603ed
MD5 414f2bd3f3234b20c5c23254da223f25
SHA1 5261e92c2f3892372310b602c76347dee38fd82c
SHA512 f60837e0bc7240d5a1d7a4087d58ab3744ef7827d51d6f946f85d531d289739cc74afa47a6ce1a038f84dbe6c7be117897fe7d1268566036f7078b482ae1f560
SSDEEP 768:8pG1Q3VUgS1QWxByFV6C4nUquiTW3InLMaAoCpHJF9LyBv8:sEQKgS1M/4niiHREJFIB0
TLSH
T19CE2D037397176C24D345A6105CADB1FF3DA8ACA3847EF358A22A81FBCA3C50D4C6856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 58KB
SHA256 169cd15cbbcf45c0a2afd01c15b2541d1b39b8c692cca708fa7ddb9b9fdc0f92
MD5 96f7c690e79cac709e87d527bc65c0ea
SHA1 885d2b7036e2ec3c24e7b911cbf14ba7bbf88d12
SHA512 62f44d705b7cd4b0ea22231401ae30c92f2da7efda07b8796f07dda8f852fcad7e54342eb36b41ca6be824b7e83904d9d38d8351b18a1654aabf615bfd5bff91
SSDEEP 1536:sEQKgS1M/4niiHREJFIBcA30uMqLPaKsU+YLVa3wi:sQgS8niHgUpLVIwi
TLSH
T1E64301AF6C3137C51C7468A307E6D7AAF2D995CE3847EA318A270C8B7C46955CCC9C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 1KB
SHA256 564e4777c0ec7f68af6052294aa2985cea118426d8fa6b38b5f99ab3fd0e71cd
MD5 bed06d127eca1ce052fe3c43592f7516
SHA1 c239394beefe6c094cb50d2957afccda80508beb
SHA512 2c0200ff193023c4484788630a79a9bb444b2d95620543121b22827d102dfba405e87fc325e78745f6c969b0d87e19cbfa47977fe7529ca13ea03ded20b77611
TLSH
T19C21B78D9961979862414D8C30FFAA65E1AA1F88F430555E90231D271DF5520CCA8CEC
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 2KB
SHA256 8e09b0f1926d6cb7e7a8a61510c607a3cb20dc5c1df850b08ecdd6fbe92bbdc5
MD5 5810df2e56898163b7106d89d0587ddd
SHA1 8e15c8237845aec8375376c70aad5d5f0a3accf0
SHA512 f88ea0279dc3120be0479c9376484df7856c0a3d6fc9b34aff476af136ff65c2046be52c5bcad681259bb408c9c9fd64105175297ef1fca313328c7b9e430ee5
TLSH
T11741188E4A2257482396CDCC34EBEB2BD16E1B49B435671890361E130CA7D50C8AACBC
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 2KB
SHA256 f40aff213f99b6c3bcb7e5b91bf4fbfa6a444c1f0b64f2135ee10f5edeccc098
MD5 67163ef564a5e90f8f591bb0bcda8fce
SHA1 337c8978ac55481a73484afb7c43407fb7c2490d
SHA512 929896027bf282633e24f2adedc9c69aac14550d2b3d712485eecf82ddb1a6b087917186d32f0fe1fe2fda63e1995f0b01125a48f57ff45e3f5bfce4f74ecbf6
TLSH
T10A513B878B226B052B618D8D249FEB1BD5790B44BC35661CE1315D971CB7D40C85ACBD
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 4KB
SHA256 a61ffda95ae63908f75054ebc140dbee5f0c1788bfa289f4d7b7e106b73dd414
MD5 4c7b0d047eab47a5972bb10c715cf2b3
SHA1 b5e3486a9905cd84b4002a3abf5fd9510ef9f54b
SHA512 88b20bae5285b724cda8c080f33668ac3ff7b0353fd8f2919c15a038dbcffeab7606f5914f99f502d792193f86f942c6c06fda2acbf1125e9e994b8d3eb39b30
SSDEEP 96:QsutlBGa4pS34N3vImLoIxhZRKVpeTrFS8M6Pkse1cI4yE6a/22r1xuxYaV/:Q/pGlI43gqoIfaVMg8hPkseBI/1lQ/
TLSH
T12BA18D728721724929126A5938DBE34DE9F60F09B877212E9A32CD5B5D9FD00D01ACAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-R41HH.tmp

Path C:\Drivers\sleetspank45\is-R41HH.tmp
Size 10.3MB
SHA256 2604761e24c7656dbd77883217eb6131f499c0792863e17c5dbfaedd66208ee0
MD5 69c414daf9537b09ef0395c7509e8442
SHA1 6afb2e678322de1860db6cd1421b7cc95fd2e29e
SHA512 93495652ae6eab038a071045c3e049e348b94598a867f19708c21ec1a1f653257ec32ad7cee14f839b376f024d84db045f18dd91389c27e8d2894cf8b6850401
SSDEEP 196608:0E7P4mMFeJLvS282g/58hhga/LN8pCawXhnrvVHVl4+pHhVIuMG:LbMFeJSZhkjN9frvpVK+MG
TLSH
T148B633BB497810CB6413B2DF526BE74FCF2B6188348AF9D5B39609D877425C85382CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-LNV55.tmp\2026-10-28_6f33b0183fcf0886fe0601b7319b8fe8_cobalt-strike_coinminer_darkgate_elex_gcleaner_glassworm.tmp
Size 1.2MB
SHA256 3b5f8709cabc449b2156452348f1c86c05ef13b1b75c034e9390c08665c35ed3
MD5 b682b35a8347458f85b0b3af30a6088f
SHA1 88022a4f14fd25edeca1a563ed66c74a4a05f61c
SHA512 9f772fc95d9089384c081ef68279694796c5f29de7cbd795843a81ac231584c049141fd5b2c828cf6e5f60c1f76165ba6c24be8c677eb2f1ac4f95fffa151105
SSDEEP 24576:fEZXjiinrzY5tO+uKE3LMT0jECZQEbLBDBEnFWsyTM7x99M:cdmbjTKlD00T+Q
TLSH
T108553B22A7D58437D4731E358D6BC2985C367D306EA8D85ABEF8AE0C0E39B417D35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/392-512-0x0000000000F00000-0x000000000112B000-memory.dmp

Download

memory/620-398-0x000001FA933C0000-0x000001FA96631000-memory.dmp

Download

memory/620-480-0x000001FA933C0000-0x000001FA96631000-memory.dmp

Download

memory/620-635-0x000001FA933C0000-0x000001FA96631000-memory.dmp

Download

memory/620-634-0x000001FA933C0000-0x000001FA96631000-memory.dmp

Download

memory/620-335-0x000001FA933C0000-0x000001FA96631000-memory.dmp

Download

memory/620-487-0x000001FA933C0000-0x000001FA96631000-memory.dmp

Download

memory/620-399-0x000001FA933C0000-0x000001FA96631000-memory.dmp

Download

memory/620-329-0x000001FA921B0000-0x000001FA933B8000-memory.dmp

Download

memory/620-397-0x000001FA933C0000-0x000001FA96631000-memory.dmp

Download

memory/620-396-0x000001FA933C0000-0x000001FA96631000-memory.dmp

Download

memory/620-479-0x000001FA933C0000-0x000001FA96631000-memory.dmp

Download

memory/620-478-0x000001FA933C0000-0x000001FA96631000-memory.dmp

Download

memory/624-0-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/624-164-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/892-163-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/892-5-0x0000000000730000-0x0000000000731000-memory.dmp

Download

memory/1784-388-0x0000021203680000-0x000002120376B000-memory.dmp

Download

memory/1784-197-0x0000021203590000-0x0000021203678000-memory.dmp

Download

memory/1784-221-0x0000021203680000-0x000002120376B000-memory.dmp

Download

memory/1784-203-0x0000021203680000-0x000002120376B000-memory.dmp

Download

memory/1784-254-0x0000021203680000-0x000002120376B000-memory.dmp

Download

memory/1784-304-0x0000021203680000-0x000002120376B000-memory.dmp

Download

memory/3076-868-0x0000000001420000-0x000000000164B000-memory.dmp

Download

memory/4292-638-0x00000000013D0000-0x00000000015FB000-memory.dmp

Download

memory/4764-50-0x0000000001520000-0x000000000174B000-memory.dmp

Download