9f4132eb0a2789efa525bad82985eecd66df89b80cfe157111115d6a875ceea0

Analysis

max time kernel
36s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/05/2026, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
Size 2.9MB
Sample260519-1d2rtac16t
SHA256 9f4132eb0a2789efa525bad82985eecd66df89b80cfe157111115d6a875ceea0
MD5 5d2c0aa1dc4a754ea95eec11a34df042
SHA1 8d94b5bd9808ac9273ab46196050e587db9f8a9c
SHA512 157835bbfeb6accd731b594bedc55fbec7cab13c16f5e840a643d5cf8ff44da291f1d0ab732484ecd934297debc55425d5e273481af6acd8f710da0d90263f10
SSDEEP 24576:eIGZZJkLzJ+AUTpldX2BL96H0QeZjA56lzf96H084WX29W96H0NLMI96H0/6LM1i:eI3LhB8H9CXlMHOWX29rHbHCcHqBCBi4
TLSH
T129D52901A7635177ED623570846A6B540660BFB02F37E2DBEE10751AFD317C26A323BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 7 IoCs

pid	Process
5048	spfirewall.exe
3800	35.#.exe
2400	859.#.exe
2332	275.#.exe
3104	405.#.exe
3376	188.#.exe
3300	714.#.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	275.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	35.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	405.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	405.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	714.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	spfirewall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	35.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	859.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	188.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	188.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	spfirewall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	275.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	714.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	859.#.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\systemlog.log	405.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.log	714.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.log	spfirewall.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.log	859.#.exe

Drops file in Program Files directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe$	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\	275.#.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
File created	C:\Program Files\7-Zip\7z.exe	spfirewall.exe
File opened for modification	C:\Program Files\7-Zip\Lang\	859.#.exe
File opened for modification	C:\Program Files\7-Zip\	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	275.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	35.#.exe
File opened for modification	C:\Program Files\7-Zip\	275.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	spfirewall.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	spfirewall.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	spfirewall.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
File created	C:\Program Files\7-Zip\7zFM.exe	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\	35.#.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\	35.#.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	spfirewall.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	35.#.exe
File opened for modification	C:\Program Files\7-Zip\	859.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	859.#.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	35.#.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	spfirewall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	35.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	35.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	859.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	35.#.exe
File opened for modification	C:\Program Files\7-Zip\Lang\	spfirewall.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	35.#.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	859.#.exe
File opened for modification	C:\Program Files\7-Zip\Lang\	275.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	35.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	35.#.exe
File opened for modification	C:\Program Files\7-Zip\Lang\	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	35.#.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\	859.#.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	275.#.exe
File opened for modification	C:\Program Files\7-Zip\Lang\	35.#.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	859.#.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\	spfirewall.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\	spfirewall.exe
File created	C:\Program Files\7-Zip\7zG.exe	275.#.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	35.#.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	spfirewall.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	35.#.exe

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	188.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spfirewall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	275.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	405.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	714.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	859.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131630-480C-11D2-B1F9-00C04F86C324}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.asp	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\ = "FileSystem Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.asp	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.asp	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Encoder	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary\ = "Scripting.Dictionary"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\Version	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cdx	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\ = "FileSystem Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cdx	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile\ScriptHostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile\ScriptHostEncode	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary\ = "Scripting.Dictionary"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary\ = "Scripting.Dictionary"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Encoder	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode\ = "{85131631-480C-11D2-B1F9-00C04F86C324}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\ = "FileSystem Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CF774D0-F077-11D1-B1BC-00C04F86C324}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile\ScriptHostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cdx	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}\1.0	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\ProgID	regsvr32.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	35.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	275.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	188.#.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3984	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
5048	spfirewall.exe
3800	35.#.exe
2400	859.#.exe
2332	275.#.exe
3104	405.#.exe
3376	188.#.exe
3300	714.#.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 2176	3984	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe	81
PID 5048 wrote to memory of 2956	5048	spfirewall.exe	86
PID 3984 wrote to memory of 2180	3984	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe	87
PID 5048 wrote to memory of 4432	5048	spfirewall.exe	88
PID 3984 wrote to memory of 3800	3984	2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe	89
PID 3800 wrote to memory of 2944	3800	35.#.exe	90
PID 5048 wrote to memory of 2400	5048	spfirewall.exe	91
PID 2400 wrote to memory of 3128	2400	859.#.exe	92
PID 3800 wrote to memory of 4924	3800	35.#.exe	93
PID 2400 wrote to memory of 3900	2400	859.#.exe	94
PID 3800 wrote to memory of 2332	3800	35.#.exe	95
PID 2332 wrote to memory of 2292	2332	275.#.exe	96
PID 2400 wrote to memory of 3104	2400	859.#.exe	97
PID 3104 wrote to memory of 3908	3104	405.#.exe	98
PID 2332 wrote to memory of 2284	2332	275.#.exe	99
PID 3104 wrote to memory of 3248	3104	405.#.exe	100
PID 2332 wrote to memory of 3376	2332	275.#.exe	101
PID 3376 wrote to memory of 5064	3376	188.#.exe	102
PID 3104 wrote to memory of 3300	3104	405.#.exe	103
PID 3300 wrote to memory of 1576	3300	714.#.exe	104
PID 3376 wrote to memory of 2312	3376	188.#.exe	105
PID 3300 wrote to memory of 1220	3300	714.#.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-19_5d2c0aa1dc4a754ea95eec11a34df042_amadey_cobalt-strike_elex_emotet_hijackloader_smoke-loader_stop.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s scrrun.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2176
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\312633.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2180
- C:\Users\Admin\AppData\Local\Temp\35.#.exe
  C:\Users\Admin\AppData\Local\Temp\35.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s scrrun.dll
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2944
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\651745.vbs"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4924
- - C:\Users\Admin\AppData\Local\Temp\275.#.exe
    C:\Users\Admin\AppData\Local\Temp\275.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s scrrun.dll
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2292
  - - C:\Windows\SysWOW64\wscript.exe
      wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\138805.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\188.#.exe
      C:\Users\Admin\AppData\Local\Temp\188.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3376
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5064
    - - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\868053.vbs"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\61.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\61.#.exe
        5⤵
        
        PID:3576
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        6⤵
        
        PID:1912
      - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\129970.vbs"
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\585.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\585.#.exe
        6⤵
        
        PID:780
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        7⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\795009.vbs"
        7⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\831.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\831.#.exe
        7⤵
        
        PID:844
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        8⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\533291.vbs"
        8⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\94.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\94.#.exe
        8⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        9⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\374248.vbs"
        9⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\440.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\440.#.exe
        9⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        10⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\684795.vbs"
        10⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\324.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\324.#.exe
        10⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        11⤵
        
        PID:4848

C:\Windows\system32\regsvr32.exe
regsvr32.exe /s scrrun.dll
1⤵
- Modifies registry class
PID:3152

C:\10a0699fa37928d39c\spfirewall.exe
C:\10a0699fa37928d39c\spfirewall.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s scrrun.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2956
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\954967.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4432
- C:\10a0699fa37928d39c\859.#.exe
  C:\10a0699fa37928d39c\859.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s scrrun.dll
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3128
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\537487.vbs"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3900
- - C:\10a0699fa37928d39c\405.#.exe
    C:\10a0699fa37928d39c\405.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s scrrun.dll
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:3908
  - - C:\Windows\SysWOW64\wscript.exe
      wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\32070.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3248
  - - C:\10a0699fa37928d39c\714.#.exe
      C:\10a0699fa37928d39c\714.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3300
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1576
    - - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\705654.vbs"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1220
    - - C:\10a0699fa37928d39c\715.#.exe
        
        C:\10a0699fa37928d39c\715.#.exe
        5⤵
        
        PID:4916
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        6⤵
        
        PID:2184
      - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\558193.vbs"
        6⤵
        
        PID:1976
      - C:\10a0699fa37928d39c\23.#.exe
        
        C:\10a0699fa37928d39c\23.#.exe
        6⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        7⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\900722.vbs"
        7⤵
        
        PID:2136
        
        C:\10a0699fa37928d39c\298.#.exe
        
        C:\10a0699fa37928d39c\298.#.exe
        7⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        8⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\287197.vbs"
        8⤵
        
        PID:1520
        
        C:\10a0699fa37928d39c\889.#.exe
        
        C:\10a0699fa37928d39c\889.#.exe
        8⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        9⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\967022.vbs"
        9⤵
        
        PID:1156
        
        C:\10a0699fa37928d39c\759.#.exe
        
        C:\10a0699fa37928d39c\759.#.exe
        9⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        10⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\751201.vbs"
        10⤵
        
        PID:4476
        
        C:\10a0699fa37928d39c\753.#.exe
        
        C:\10a0699fa37928d39c\753.#.exe
        10⤵
        
        PID:648
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        11⤵
        
        PID:1272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

753.#.exe

Path C:\10a0699fa37928d39c\753.#.exe
Size 2.6MB
SHA256 4e9aaf96fec5a0d2f6a2aef8cdcbfba4b7d55acf6d0f537d0558183fa62a3a51
MD5 e906a8f616778fa6bc1c530c5ac3e814
SHA1 21359dad3a9ae8dbbe0e5cb1ca56b4f92ad17fe9
SHA512 556ff2f393a0ecc4316ad0334c9f05ac86801b413a0fdc8e9bf2b02fa5756e6e6d1aaef7e5b153f47b61b35595bb22bb71b62eeaed8fcdb10962768651f2eaea
SSDEEP 24576:eIGZZJkLzJ+AUTpldX2BL96H0QeZjA56lzf96H084WX29W96H0NLMI96H0/6LM1+:eI3LhB8H9CXlMHOWX29rHbHCcHqBCBH
TLSH
T1A6C53A01ABA39137ED672530847AA7204670BF701F36E2CBAB51751EBD717C26A32376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spfirewall.exe

Path C:\10a0699fa37928d39c\spfirewall.exe
Size 2.9MB
SHA256 9f4132eb0a2789efa525bad82985eecd66df89b80cfe157111115d6a875ceea0
MD5 5d2c0aa1dc4a754ea95eec11a34df042
SHA1 8d94b5bd9808ac9273ab46196050e587db9f8a9c
SHA512 157835bbfeb6accd731b594bedc55fbec7cab13c16f5e840a643d5cf8ff44da291f1d0ab732484ecd934297debc55425d5e273481af6acd8f710da0d90263f10
SSDEEP 24576:eIGZZJkLzJ+AUTpldX2BL96H0QeZjA56lzf96H084WX29W96H0NLMI96H0/6LM1i:eI3LhB8H9CXlMHOWX29rHbHCcHqBCBi4
TLSH
T129D52901A7635177ED623570846A6B540660BFB02F37E2DBEE10751AFD317C26A323BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe$

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe$
Size 2.9MB
SHA256 3d65cd4222b63afd96241c31086e3443162591941b4146b966d413ee4bb6e38f
MD5 d8df483c5e7b5c3a3ee72d2697f3dd6a
SHA1 a2923d3f78e310e840277fa27d713fb5538a590e
SHA512 37225ca294d5d260a1e90c700368b518208cd6e041bed0f082cb6b086f2aa01084277db5efa164354e96ca71fa3601a2f67402aeb8d1350907aaf5858ef77ce4
SSDEEP 24576:eIGZZJkLzJ+AUTpldX2BL96H0QeZjA56lzf96H084WX29W96H0NLMI96H0/6LM1C:eI3LhB8H9CXlMHOWX29rHbHCcHqBCBiU
TLSH
T132E52901A7635177ED623570846A6B540660BFB02F37E2DBEE10751AFD317C26A323BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe$

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe$
Size 2.9MB
SHA256 4e6daf3a8c23219741d39ef1ec4b40316d56d2363abe1d2345cc9ab9dc2f9ce5
MD5 5ccc50561e468c18a6611d6653cf603e
SHA1 2d11061aa178a76abb6591dd81f5616de7dac8e7
SHA512 c27ce85f96c263f4a76f86dad88742ce7eef28c30506276783c3aa98bcf0d524ff72e6194eb52e32ef1de912e48e57a90167d5231bba11954a07dfe8b7638939
SSDEEP 24576:eIGZZJkLzJ+AUTpldX2BL96H0QeZjA56lzf96H084WX29W96H0NLMI96H0/6LM1x:eI3LhB8H9CXlMHOWX29rHbHCcHqBCBib
TLSH
T131E52901A7635177ED623570846A6B540660BFB02F37E2DBEE10751AFD317C26A323BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe$

Path C:\Program Files\Java\jre-1.8\bin\kinit.exe$
Size 2.9MB
SHA256 a6b39bc02e39e97e4546db6d0e16258a243cffdd69ad2a4063d793a4d74d4ba8
MD5 a2e230a7ba79f5ea47d36067fa6b7124
SHA1 07c9f25d078e0b9b7e624939f196b23de7831777
SHA512 1ff70af9058eb3286ce326970c6730ee6cfa7ac78339f3d1aad9a36f191265274bb454d7c472c2cdf6f3d048e957ba0b4d35ab87910d57f36f75df4339a69825
SSDEEP 24576:eIGZZJkLzJ+AUTpldX2BL96H0QeZjA56lzf96H084WX29W96H0NLMI96H0/6LM1b:eI3LhB8H9CXlMHOWX29rHbHCcHqBCBiR
TLSH
T122E52901A7635177ED623570846A6B540660BFB02F37E2DBEE10751AFD317C26A323BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

312633.vbs

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2C10A89\312633.vbs
Size 4KB
SHA256 c7fea76beb75e7bbfe86eba7d4ed0b49fcddfc24cbf3e5539ad9497e922b5872
MD5 ea9949eaf20d407557943a8d2f6439db
SHA1 c510d51adaf9eaf483e4b2f49ebde641a06db16b
SHA512 3f22dafce013696bb09ca4192f97645093f07902df14649aa29639fbaa06c1123bd64802e4a1488ce9077dd86c8ef52033971e14887eb438ff82540f06ebbb9b
SSDEEP 96:ec0nKAhFw4rJWAm+CQBD4kTj4CPYb1k9RiO7TKVfJlMcfa/JVF9:InKAhFw4rJWAm+CQBD4kTj4CPYb1k9R5
TLSH
T1FA815439EC2E817A8307A2E60BF344DCEB4EEC4934A6F01C4611F98DA2F4171471A5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

312633.vbs

Path C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\312633.vbs
Size 19KB
SHA256 68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a
MD5 e98740f59246b23b0d7f73f141f24d47
SHA1 1bfd55b3f13c85f94e1694bffa89a2d79a61a630
SHA512 d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928
SSDEEP 192:InKAhFw4rJWAm+CQBD4kTj4CPYb1k9RiO7TKVBlMcfWJVFsPXnMqqDvGs1OPqYc4:TyRi2mpCC
TLSH
T17E925435EC2E817A8317A2E60BF740DCFB8EEC5924A5F01C0652F98DA2F1671471A5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3984-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads