81dd8cb26165f17013f08f97a8e1a05bdae519a9c22beb3b2c4c9009490d5d63

Analysis

max time kernel
22s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_85967ce02856a6f5e75a591ccc04087a_cobalt-strike_coinminer_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe
Size 2.5MB
Sample260710-2b2vgafs91
SHA256 81dd8cb26165f17013f08f97a8e1a05bdae519a9c22beb3b2c4c9009490d5d63
MD5 85967ce02856a6f5e75a591ccc04087a
SHA1 b60a4743f04ee1bf856ad810627bc2761438a80b
SHA512 4a971e4cb85cd4dac3f36c10bbbe3c6fa1de14509430f3ee7f21e3fbd720021a3cec454ab47ebc0859f91721562608e170d0597e0b5893b37ebfe73bb92a2be7
SSDEEP 49152:bLNLNLkqCdHq+V8tgJd8tVsxlzVsqqC6Btx:o1s+CgatVsxlzVsq1Gx
TLSH
T123C54B01A79340B7DC5624708866A7341274BFB12F36D2DBBB40B91ABE717D259333BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence privilege_escalation upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 29 IoCs

resource	yara_rule
behavioral1/memory/3024-0-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/files/0x00020000000232bb-215.dat	UPX
behavioral1/memory/5040-216-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/3024-857-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/5040-860-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/5092-1291-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/3328-1294-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/3648-1513-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/3688-1735-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/5920-1748-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/2564-1757-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/4420-2239-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/5976-2241-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/3548-2713-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/2100-2937-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/files/0x0002000000023665-2990.dat	UPX
behavioral1/memory/4716-3226-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/1048-3237-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/files/0x00070000000168f3-3714.dat	UPX
behavioral1/files/0x000d00000001da2c-3975.dat	UPX
behavioral1/memory/5552-3985-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/2532-4022-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/files/0x000e0000000202ba-4110.dat	UPX
behavioral1/files/0x00100000000168f3-4102.dat	UPX
behavioral1/memory/4428-4688-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/4072-4726-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/3308-5243-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/5748-5469-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/5844-5764-0x0000000000400000-0x0000000000412000-memory.dmp	UPX

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 7 IoCs

pid	Process
5040	spfirewall.exe
5092	279.#.exe
3328	637.#.exe
3648	222.#.exe
3688	456.#.exe
5920	324.#.exe
2564	556.#.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	279.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	222.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	456.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	324.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	spfirewall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	spfirewall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	279.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	637.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	637.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	222.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	456.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	324.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	2026-07-10_85967ce02856a6f5e75a591ccc04087a_cobalt-strike_coinminer_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	2026-07-10_85967ce02856a6f5e75a591ccc04087a_cobalt-strike_coinminer_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\systemlog.log	637.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.log	456.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.log	spfirewall.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3024-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/files/0x00020000000232bb-215.dat	upx
behavioral1/memory/5040-216-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/3024-857-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/5040-860-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/5092-1291-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/3328-1294-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/3648-1513-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/3688-1735-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/5920-1748-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/2564-1757-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/4420-2239-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/5976-2241-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/3548-2713-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/2100-2937-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/files/0x0002000000023665-2990.dat	upx
behavioral1/memory/4716-3226-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/1048-3237-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/files/0x00070000000168f3-3714.dat	upx
behavioral1/files/0x000d00000001da2c-3975.dat	upx
behavioral1/memory/5552-3985-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/2532-4022-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/files/0x000e0000000202ba-4110.dat	upx
behavioral1/files/0x00100000000168f3-4102.dat	upx
behavioral1/memory/4428-4688-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/4072-4726-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/3308-5243-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/5748-5469-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/5844-5764-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-10_85967ce02856a6f5e75a591ccc04087a_cobalt-strike_coinminer_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\	2026-07-10_85967ce02856a6f5e75a591ccc04087a_cobalt-strike_coinminer_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-10_85967ce02856a6f5e75a591ccc04087a_cobalt-strike_coinminer_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\	spfirewall.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	spfirewall.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	spfirewall.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	2026-07-10_85967ce02856a6f5e75a591ccc04087a_cobalt-strike_coinminer_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-07-10_85967ce02856a6f5e75a591ccc04087a_cobalt-strike_coinminer_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	456.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spfirewall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	222.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	324.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_85967ce02856a6f5e75a591ccc04087a_cobalt-strike_coinminer_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	279.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	556.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	637.#.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.asa	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\Version	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D0-F077-11D1-B1BC-00C04F86C324}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\ = "FileSystem Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Implemented Categories	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.asp	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cdx	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131630-480C-11D2-B1F9-00C04F86C324}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}\1.0	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode\ = "{85131631-480C-11D2-B1F9-00C04F86C324}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cdx	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode\ = "{0CF774D0-F077-11D1-B1BC-00C04F86C324}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Encoder	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D0-F077-11D1-B1BC-00C04F86C324}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary\ = "Scripting.Dictionary"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode	regsvr32.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	324.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	2026-07-10_85967ce02856a6f5e75a591ccc04087a_cobalt-strike_coinminer_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	279.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	222.#.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3024	2026-07-10_85967ce02856a6f5e75a591ccc04087a_cobalt-strike_coinminer_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe
5040	spfirewall.exe
5092	279.#.exe
3328	637.#.exe
3648	222.#.exe
3688	456.#.exe
5920	324.#.exe
2564	556.#.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 5324	3024	2026-07-10_85967ce02856a6f5e75a591ccc04087a_cobalt-strike_coinminer_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe	86
PID 5040 wrote to memory of 1644	5040	spfirewall.exe	91
PID 3024 wrote to memory of 4688	3024	2026-07-10_85967ce02856a6f5e75a591ccc04087a_cobalt-strike_coinminer_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe	92
PID 5040 wrote to memory of 2100	5040	spfirewall.exe	93
PID 3024 wrote to memory of 5092	3024	2026-07-10_85967ce02856a6f5e75a591ccc04087a_cobalt-strike_coinminer_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe	94
PID 5092 wrote to memory of 2964	5092	279.#.exe	95
PID 5040 wrote to memory of 3328	5040	spfirewall.exe	96
PID 3328 wrote to memory of 5704	3328	637.#.exe	97
PID 5092 wrote to memory of 5104	5092	279.#.exe	98
PID 3328 wrote to memory of 1352	3328	637.#.exe	99
PID 5092 wrote to memory of 3648	5092	279.#.exe	100
PID 3648 wrote to memory of 420	3648	222.#.exe	101
PID 3328 wrote to memory of 3688	3328	637.#.exe	102
PID 3688 wrote to memory of 3752	3688	456.#.exe	110
PID 3648 wrote to memory of 5712	3648	222.#.exe	104
PID 3688 wrote to memory of 5808	3688	456.#.exe	105
PID 3648 wrote to memory of 5920	3648	222.#.exe	106
PID 5920 wrote to memory of 5960	5920	324.#.exe	107
PID 3688 wrote to memory of 2564	3688	456.#.exe	108
PID 2564 wrote to memory of 4984	2564	556.#.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-10_85967ce02856a6f5e75a591ccc04087a_cobalt-strike_coinminer_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_85967ce02856a6f5e75a591ccc04087a_cobalt-strike_coinminer_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s scrrun.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:5324
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\368145.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4688
- C:\Users\Admin\AppData\Local\Temp\279.#.exe
  C:\Users\Admin\AppData\Local\Temp\279.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s scrrun.dll
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2964
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\308361.vbs"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5104
- - C:\Users\Admin\AppData\Local\Temp\222.#.exe
    C:\Users\Admin\AppData\Local\Temp\222.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s scrrun.dll
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:420
  - - C:\Windows\SysWOW64\wscript.exe
      wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\560161.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\324.#.exe
      C:\Users\Admin\AppData\Local\Temp\324.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5920
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5960
    - - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\852825.vbs"
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\90.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\90.#.exe
        5⤵
        
        PID:4420
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        6⤵
        
        PID:4416
      - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\748821.vbs"
        6⤵
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\837.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\837.#.exe
        6⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        7⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\922313.vbs"
        7⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\372.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\372.#.exe
        7⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        8⤵
        
        PID:560
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\22319.vbs"
        8⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\818.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\818.#.exe
        8⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        9⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\70781.vbs"
        9⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\486.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\486.#.exe
        9⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        10⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\777019.vbs"
        10⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\33.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\33.#.exe
        10⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        11⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\756908.vbs"
        11⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\192.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\192.#.exe
        11⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        12⤵
        
        PID:4236

C:\10a0699fa37928d39c\spfirewall.exe
C:\10a0699fa37928d39c\spfirewall.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s scrrun.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1644
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\780529.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2100
- C:\10a0699fa37928d39c\637.#.exe
  C:\10a0699fa37928d39c\637.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s scrrun.dll
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5704
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\563488.vbs"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1352
- - C:\10a0699fa37928d39c\456.#.exe
    C:\10a0699fa37928d39c\456.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s scrrun.dll
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:3752
  - - C:\Windows\SysWOW64\wscript.exe
      wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\598644.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5808
  - - C:\10a0699fa37928d39c\556.#.exe
      C:\10a0699fa37928d39c\556.#.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2564
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4984
    - - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\205822.vbs"
        5⤵
        
        PID:1728
    - - C:\10a0699fa37928d39c\51.#.exe
        
        C:\10a0699fa37928d39c\51.#.exe
        5⤵
        
        PID:5976
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        6⤵
        
        PID:2952
      - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\858410.vbs"
        6⤵
        
        PID:3880
      - C:\10a0699fa37928d39c\135.#.exe
        
        C:\10a0699fa37928d39c\135.#.exe
        6⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        7⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\509533.vbs"
        7⤵
        
        PID:868
        
        C:\10a0699fa37928d39c\197.#.exe
        
        C:\10a0699fa37928d39c\197.#.exe
        7⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        8⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\692760.vbs"
        8⤵
        
        PID:1012
        
        C:\10a0699fa37928d39c\260.#.exe
        
        C:\10a0699fa37928d39c\260.#.exe
        8⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        9⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\194469.vbs"
        9⤵
        
        PID:5620
        
        C:\10a0699fa37928d39c\871.#.exe
        
        C:\10a0699fa37928d39c\871.#.exe
        9⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        10⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\37609.vbs"
        10⤵
        
        PID:4516
        
        C:\10a0699fa37928d39c\958.#.exe
        
        C:\10a0699fa37928d39c\958.#.exe
        10⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        11⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\141979.vbs"
        11⤵
        
        PID:3456
        
        C:\10a0699fa37928d39c\262.#.exe
        
        C:\10a0699fa37928d39c\262.#.exe
        11⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        12⤵
        
        PID:1120

C:\Windows\system32\regsvr32.exe
regsvr32.exe /s scrrun.dll
1⤵
- Modifies registry class
PID:3092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

spfirewall.exe

Path C:\10a0699fa37928d39c\spfirewall.exe
Size 2.5MB
SHA256 81dd8cb26165f17013f08f97a8e1a05bdae519a9c22beb3b2c4c9009490d5d63
MD5 85967ce02856a6f5e75a591ccc04087a
SHA1 b60a4743f04ee1bf856ad810627bc2761438a80b
SHA512 4a971e4cb85cd4dac3f36c10bbbe3c6fa1de14509430f3ee7f21e3fbd720021a3cec454ab47ebc0859f91721562608e170d0597e0b5893b37ebfe73bb92a2be7
SSDEEP 49152:bLNLNLkqCdHq+V8tgJd8tVsxlzVsqqC6Btx:o1s+CgatVsxlzVsq1Gx
TLSH
T123C54B01A79340B7DC5624708866A7341274BFB12F36D2DBBB40B91ABE717D259333BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe$

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$
Size 2.7MB
SHA256 0726be40fa8ffb0bb61f55cb304fad466ff3f1cbc5b212ec9ee29481bae5395d
MD5 6a8812bae60c33d6dfa9a3154e64f82a
SHA1 bac74203403f52d32c4393a378cb073482dcfcd2
SHA512 51fdba8b573d1be515515fd2e27b75fdf0efe3c392f8f7ac5aa30a6615d966b46050be9149c1ba8cb1ad9802f314478ae76ce06b358f6ecccce53752780426d5
SSDEEP 49152:bLNLNLkqCdHq+V8tgJd8tVsxlzVsqqC6BtJ:o1s+CgatVsxlzVsq1GJ
TLSH
T18BD53A01E35340B7DC5A1430C656A7242266BEB01FB6D2D7AA80F53EBF717C259723AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe$

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$
Size 2.5MB
SHA256 9b93d7e7e115eb29eab0bcc44ffbec564fa57482bf58c86d592ef5616ab17a67
MD5 a94e25b33c959843506d77ba9dc42a24
SHA1 f6cb823552dfc5774017e1e1d133f3f179e50366
SHA512 dc740f8997f0ef03f3394b36066d183c54ed770d8282888a23add6913b1e8c333087bc4bc49efd5264451e2ed8fe832072e75f665c3d22c901275e7b93f82e41
SSDEEP 49152:bLNLNLkqCdHq+V8tgJd8tVsxlzVsqqC6Btm:o1s+CgatVsxlzVsq1Gm
TLSH
T1D5C54B01A79340B7DC5624708866A7341274BFB12F36D2DBBB40B91ABE717D259333BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$
Size 2.6MB
SHA256 b2ea25ee0b62ce6ed11a9799680d56fb35038c4bdba1000fb22f6631d28871e4
MD5 6152cf56db231ba9658c6fd6c9cfcf58
SHA1 4a184a9112349ff42b085a20dc897e08646dd660
SHA512 10c18850a1a81a46c3818c87ddb94ff2875acac0674a91f4bb4faa9f07e74e05744cfa7477ed69ad0e2a8d46a0a2e6b7512d4ec74f645ec5c3b1e7538bc844c0
SSDEEP 49152:bLNLNLkqCdHq+V8tgJd8tVsxlzVsqqC6BtD:o1s+CgatVsxlzVsq1GD
TLSH
T1F8C54B01A79340B7DC5624308866A7345374BFB12F36D2DBBB40B91ABE717D259323BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
Size 2.6MB
SHA256 8cbf40933b53088cfac6b6c195f6ca310b948bc9adccd18a3a75b37b72474aa1
MD5 852490b0648dc810a03b811d5a1f4bdd
SHA1 0bb300663fb5b336437111d084d7d72380a6794b
SHA512 c698c0780cb96a2964bb2975ff38953620c05792edf4e7afb5a9d6159ba45f9c0e901b19bf0afba1c50b48f6eacd96bce0703fc5b887b90cab02ee4732daf150
SSDEEP 49152:bLNLNLkqCdHq+V8tgJd8tVsxlzVsqqC6Bt97:o1s+CgatVsxlzVsq1GZ
TLSH
T101C55B01A39340B7EC5225308866A7345374BFB12F36D6DBBB40B51ABE717D259323BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
Size 2.5MB
SHA256 8935c7e5226cd86f415538e28b9e6bbd7e7566b6ba53261ffc1447ab4d17e046
MD5 b9b292103f9ea7e4bcdc4195eef99c81
SHA1 67d1fd892e9b03c52da871677cde97cabd3a3647
SHA512 dc7abd6ab7a86181689b4404ec6b04d4500c63994ca32921b14c3458ab7f9d876fe25ea96bb7a0f71029f77e7e424ae1a93f595985a3f470ac9b6794075ea866
SSDEEP 49152:bLNLNLkqCdHq+V8tgJd8tVsxlzVsqqC6Btr:o1s+CgatVsxlzVsq1Gr
TLSH
T170C54B01A79340B7DC5624708866A7341274BFB12F36D2DBBB40B91ABE717D259333BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

368145.vbs

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2C10A89\368145.vbs
Size 753B
SHA256 5207c55e16e442c4d0b32e88ad5632bc9f6ac3fc4966927dedb8a3ba9a60f8f1
MD5 e42cb93276aa399ead89c12fe4101285
SHA1 8c7d159591af95e06101ac0405a0f70321f48bd5
SHA512 45a3ac0ae83449a2f53d19fe5cad592e757a043757c789f2832a54078b0663811001e00c0c08450f85b312e4c93ee768ea800e54bd7960e5940449ac4b3d8c9e
TLSH
T177017535DC1EC17A4317A1D64AE744CCFB9AEC4920B5F41C4645FD8E62F45704B1A1EA
MD5 SHA1 SHA512 TLSH

Submit Download

368145.vbs

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2C10A89\368145.vbs
Size 2KB
SHA256 01c9c577bef64ade8995c89b7aafa1a991270e75a2e1d3ab117fa841f567cba9
MD5 e83ec29a1bb5b6853b0b3118f175b310
SHA1 65760a8c33e1547c431920e93ed39321b9156abb
SHA512 64af745208216a51726d63f07e567da4bdab1b98660265c264a3de713f2c1515daefa844a1aee8d747f767368b7efd5466648a57458db69722afc03f24515e23
TLSH
T1D85145399C2E857A4317A2E60BE740CCFB4EEC4920B5F01C4655F98DA2F45714B1A5E9
MD5 SHA1 SHA512 TLSH

Submit Download

368145.vbs

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2C10A89\368145.vbs
Size 19KB
SHA256 68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a
MD5 e98740f59246b23b0d7f73f141f24d47
SHA1 1bfd55b3f13c85f94e1694bffa89a2d79a61a630
SHA512 d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928
SSDEEP 192:InKAhFw4rJWAm+CQBD4kTj4CPYb1k9RiO7TKVBlMcfWJVFsPXnMqqDvGs1OPqYc4:TyRi2mpCC
TLSH
T17E925435EC2E817A8317A2E60BF740DCFB8EEC5924A5F01C0652F98DA2F1671471A5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1048-3237-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2100-2937-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2532-4022-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2564-1757-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3024-857-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3024-0-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3308-5243-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3328-1294-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3548-2713-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3648-1513-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3688-1735-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4072-4726-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4420-2239-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4428-4688-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4716-3226-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/5040-860-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/5040-216-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/5092-1291-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/5552-3985-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/5748-5469-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/5844-5764-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/5920-1748-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/5976-2241-0x0000000000400000-0x0000000000412000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads