Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 03:50
General
- Target 2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe
- Size 654KB
- Sample260802-ed73yatflb
- SHA256 d1591ff196de27f8bca20a63c06f23bfe74fe99c62c39c330b964e5893898e97
Malware Config
Signatures
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs
- Modifies firewall policy service 3 TTPs 2 IoCs
- Modifies security service 2 TTPs 2 IoCs
- Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
- Windows security bypass 2 TTPs 2 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
- UPX dump on OEP (original entry point) 45 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 13 IoCs
- Windows security modification 2 TTPs 6 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs
Using powershell.exe command.
- Indicator Removal: Clear Persistence 1 TTPs 1 IoCs
remove IFEO.
- Modifies Security services 2 TTPs 6 IoCs
Modifies the startup behavior of a security service.
- AutoIT Executable 41 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 8 IoCs
- UPX packed file 46 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 11 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Kills process with taskkill 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 20 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 60 IoCs
- Suspicious use of SendNotifyMessage 55 IoCs
- Suspicious use of SetWindowsHookEx 17 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exec:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exec:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /TI4⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- Modifies security service
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Windows security modification
- Indicator Removal: Clear Persistence
- Modifies Security services
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender://Threatsettings5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|5732|5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 15⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|6544|7068|5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|5⤵
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender://Threatsettings5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|6388|5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 15⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|5⤵
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender://Threatsettings5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|7084|5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|7084|6280|5⤵
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender://Threatsettings5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|7084|6280|6688|5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|7084|6280|6688|4216|3620|5⤵
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender://Threatsettings5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|7084|6280|6688|4216|3620|6516|5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 15⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|5⤵
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender://Threatsettings5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|5840|5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 15⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|5⤵
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender://Threatsettings5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|4308|5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 15⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|1596|6984|3008|5472|2680|236|5⤵
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender://Threatsettings5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|1596|6984|3008|5472|2680|236|1188|992|5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 15⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|1596|6984|3008|5472|2680|236|5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|1596|6984|3008|5472|2680|236|5⤵
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender://Threatsettings5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|1596|6984|3008|5472|2680|236|5760|5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 15⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|1596|6984|3008|5472|2680|236|5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|1596|6984|3008|5472|2680|236|5⤵
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender://Threatsettings5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|1596|6984|3008|5472|2680|236|4920|5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 15⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|1596|6984|3008|5472|2680|236|5⤵
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender://Threatsettings5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|1596|6984|3008|5472|2680|236|6408|5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 15⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|1596|6984|3008|5472|2680|236|5⤵
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender://Threatsettings5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|1596|6984|3008|5472|2680|236|5928|5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 15⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|1596|6984|3008|5472|2680|236|5⤵
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender://Threatsettings5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|1596|6984|3008|5472|2680|236|6472|5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 15⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|1596|6984|3008|5472|2680|236|5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|1596|6984|3008|5472|2680|236|5⤵
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender://Threatsettings5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|1596|6984|3008|5472|2680|236|6656|5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 15⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|5⤵
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable5⤵
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender://Threatsettings5⤵
-
-
\??\c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe"c:\users\admin\appdata\local\temp\2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe " /EXP |820|4928|2768|5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 15⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Program Files\Windows Defender\MsMpEng.exe"C:\Program Files\Windows Defender\MsMpEng.exe"1⤵
- Modifies Windows Defender TamperProtection settings
- Modifies firewall policy service
- Windows security bypass
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbem\mofcomp.exeC:\Windows\system32\wbem\mofcomp.exe "C:\Program Files\Windows Defender\ProtectionManagement.mof"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exeC:\Windows\system32\taskkill.exe /f /FI "MODULES eq protectionmanagement.dll" /IM WmiPrvSE.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exeC:\Windows\system32\wevtutil.exe uninstall-manifest C:\Windows\SystemTemp\C89043CC-1517-DDC1-F91A-75C619775F6F.man2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exeC:\Windows\system32\wevtutil.exe install-manifest C:\Windows\SystemTemp\C89043CC-1517-DDC1-F91A-75C619775F6F.man "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService2⤵
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
- Drops file in Windows directory
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Program Files\Windows Defender\MsMpEng.exe"C:\Program Files\Windows Defender\MsMpEng.exe"1⤵
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges2⤵
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges2⤵
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" GetDeviceTicket -AccessKey 1FD2E697-ADA3-10B6-DB51-4E55F06F44FA2⤵
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Program Files\Windows Defender\MsMpEng.exe"C:\Program Files\Windows Defender\MsMpEng.exe"1⤵
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService2⤵
-
-
C:\Windows\system32\WerFaultSecure.exeC:\Windows\system32\WerFaultSecure.exe -u -p 3772 -s 8122⤵
-
-
C:\Program Files\Windows Defender\MpDefenderCoreService.exe"C:\Program Files\Windows Defender\MpDefenderCoreService.exe"1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\WerFaultSecure.exe"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 3772 -i 3772 -h 436 -j 448 -s 440 -d 01⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Program Files\Windows Defender\MsMpEng.exe"C:\Program Files\Windows Defender\MsMpEng.exe"1⤵
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges2⤵
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges2⤵
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Program Files\Windows Defender\MsMpEng.exe"C:\Program Files\Windows Defender\MsMpEng.exe"1⤵
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Program Files\Windows Defender\MsMpEng.exe"C:\Program Files\Windows Defender\MsMpEng.exe"1⤵
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Program Files\Windows Defender\MsMpEng.exe"C:\Program Files\Windows Defender\MsMpEng.exe"1⤵
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Program Files\Windows Defender\MsMpEng.exe"C:\Program Files\Windows Defender\MsMpEng.exe"1⤵
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Program Files\Windows Defender\MsMpEng.exe"C:\Program Files\Windows Defender\MsMpEng.exe"1⤵
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService2⤵
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService2⤵
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Program Files\Windows Defender\MsMpEng.exe"C:\Program Files\Windows Defender\MsMpEng.exe"1⤵
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Program Files\Windows Defender\MsMpEng.exe"C:\Program Files\Windows Defender\MsMpEng.exe"1⤵
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges2⤵
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges2⤵
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Program Files\Windows Defender\MsMpEng.exe"C:\Program Files\Windows Defender\MsMpEng.exe"1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
6Disable or Modify System Firewall
1Disable or Modify Tools
4Indicator Removal
1Clear Persistence
1Modify Registry
10Replay Monitor
Loading Replay Monitor...
Downloads
mpengine.dll
C4EE2A5B-0000-0000-0000-D08302000000-0.bin
0
mpcache-3771EBC2B9E590AA1ED09A59F79FE6ABDF3A0243.bin
mpcache-3771EBC2B9E590AA1ED09A59F79FE6ABDF3A0243.bin.01
mpcache-3771EBC2B9E590AA1ED09A59F79FE6ABDF3A0243.bin.67
mpcache-3771EBC2B9E590AA1ED09A59F79FE6ABDF3A0243.bin.6C
mpcache-3771EBC2B9E590AA1ED09A59F79FE6ABDF3A0243.bin.7C
mpcache-3771EBC2B9E590AA1ED09A59F79FE6ABDF3A0243.bin.7E
mpcache-3771EBC2B9E590AA1ED09A59F79FE6ABDF3A0243.bin.80
mpcache-3771EBC2B9E590AA1ED09A59F79FE6ABDF3A0243.bin.83
mpcache-3771EBC2B9E590AA1ED09A59F79FE6ABDF3A0243.bin.87
mpcache-3771EBC2B9E590AA1ED09A59F79FE6ABDF3A0243.bin.A0
mpcache-3771EBC2B9E590AA1ED09A59F79FE6ABDF3A0243.bin.DB
mpcache-3771EBC2B9E590AA1ED09A59F79FE6ABDF3A0243.bin.E6
mpcache-E558256462D814111127AE94E84354AC78405FCB.bin
MPDetection-20260802-045046.log
MPDetection-20260802-045046.log
MPDeviceControl-20260802-045046.log
MPDeviceControl-20260802-045046.log
MPDeviceControl-20260802-045046.log
MPLog-20260802-045046.log
MPLog-20260802-045046.log
MPScanSkip-20260802-045046.log
MpDiag.bin
2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe
2026-08-01_eaf8cb103928bc66d24c6d13bcccaa3f_coinminer_elex_swisyn.exe .ini
explorer.exe
icsys.icn.exe
spoolsv.exe
svchost.exe
Registry.pol
Registry.pol
gpt.ini
C89043CC-1517-DDC1-F91A-75C619775F6F.man
MpCmdRun.log
MpCmdRun.log
MpCmdRun.log
MpCmdRun.log
MpCmdRun.log
MpCmdRun.log
__PSScriptPolicyTest_scd3uizi.1cf.ps1
3e5n9x6p.tmp
aut4423.tmp
aut4424.tmp
aut4425.tmp
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
memory/572-2101-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/1228-2097-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/1432-2852-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/1432-2818-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/1800-88-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1832-3398-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2164-7369-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/2404-197-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/2404-204-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/2544-825-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/2652-4029-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/2676-200-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/2820-6746-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/2896-213-0x000001BFA41A0000-0x000001BFA41BE000-memory.dmp
memory/2896-208-0x000001BFA40F0000-0x000001BFA4112000-memory.dmp
memory/2896-215-0x000001BFA41C0000-0x000001BFA41CA000-memory.dmp
memory/2896-214-0x000001BFA4410000-0x000001BFA44C2000-memory.dmp
memory/2964-5645-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3056-2303-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3152-2095-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3556-6186-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3564-0-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3564-107-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3596-87-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3656-4582-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4204-2854-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4320-5643-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4324-4031-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4576-3479-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4684-100-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4812-4034-0x000002B075730000-0x000002B0757E2000-memory.dmp
memory/4868-6188-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4928-3307-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4948-104-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4988-415-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5032-202-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5260-46-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5260-11-0x00000000004CC000-0x00000000004CD000-memory.dmp
memory/5260-9-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5332-2305-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5772-1391-0x00000221F31E0000-0x00000221F3292000-memory.dmp
memory/5904-3335-0x000001C679C40000-0x000001C679CF2000-memory.dmp
memory/6016-319-0x000002221FF40000-0x000002221FF41000-memory.dmp
memory/6016-266-0x000002221FD40000-0x000002221FD44000-memory.dmp
memory/6016-261-0x00000221F8E60000-0x00000221F8E64000-memory.dmp
memory/6016-262-0x000002220BFF0000-0x000002220BFF4000-memory.dmp
memory/6016-263-0x000002221FCD0000-0x000002221FCD4000-memory.dmp
memory/6016-267-0x000002221FD50000-0x000002221FD54000-memory.dmp
memory/6016-268-0x000002220BA90000-0x000002220BA94000-memory.dmp
memory/6016-269-0x000002220BAA0000-0x000002220BAA4000-memory.dmp
memory/6016-270-0x000002220BAB0000-0x000002220BAB4000-memory.dmp
memory/6016-238-0x000002220AD50000-0x000002220B297000-memory.dmp
memory/6016-271-0x000002220BAD0000-0x000002220BAD4000-memory.dmp
memory/6016-273-0x000002220BAF0000-0x000002220BAF4000-memory.dmp
memory/6016-274-0x000002220BB00000-0x000002220BB04000-memory.dmp
memory/6016-275-0x000002220BB10000-0x000002220BB14000-memory.dmp
memory/6016-276-0x000002220BB20000-0x000002220BB24000-memory.dmp
memory/6016-277-0x000002220BB30000-0x000002220BB34000-memory.dmp
memory/6016-278-0x000002220BB40000-0x000002220BB44000-memory.dmp
memory/6016-279-0x000002220BB50000-0x000002220BB54000-memory.dmp
memory/6016-280-0x000002220BB60000-0x000002220BB64000-memory.dmp
memory/6016-281-0x000002220BB70000-0x000002220BB74000-memory.dmp
memory/6016-282-0x000002220BB80000-0x000002220BB84000-memory.dmp
memory/6016-259-0x000002220B380000-0x000002220BA50000-memory.dmp
memory/6016-260-0x000002220BAC0000-0x000002220BAC1000-memory.dmp
memory/6016-291-0x00000221F8FD0000-0x00000221F8FD1000-memory.dmp
memory/6016-288-0x00000222209A0000-0x0000022220A66000-memory.dmp
memory/6016-289-0x00000221F8EB0000-0x00000221F8EB1000-memory.dmp
memory/6016-290-0x00000221F8FC0000-0x00000221F8FC1000-memory.dmp
memory/6016-293-0x00000221F8FF0000-0x00000221F8FF1000-memory.dmp
memory/6016-295-0x00000221FCB90000-0x00000221FCB91000-memory.dmp
memory/6016-296-0x00000221FCBE0000-0x00000221FCBE1000-memory.dmp
memory/6016-297-0x00000221FCCF0000-0x00000221FCCF1000-memory.dmp
memory/6016-265-0x000002221FD30000-0x000002221FD34000-memory.dmp
memory/6016-298-0x000002220BDC0000-0x000002220BDC1000-memory.dmp
memory/6016-286-0x000002220BC20000-0x000002220BC88000-memory.dmp
memory/6016-299-0x000002220BE90000-0x000002220BE91000-memory.dmp
memory/6016-285-0x000002220BBB0000-0x000002220BC20000-memory.dmp
memory/6016-300-0x000002220BFA0000-0x000002220BFA1000-memory.dmp
memory/6016-301-0x000002221FE20000-0x000002221FE21000-memory.dmp
memory/6016-264-0x000002221FD20000-0x000002221FD24000-memory.dmp
memory/6016-302-0x000002221FE30000-0x000002221FE31000-memory.dmp
memory/6016-303-0x000002221FE40000-0x000002221FE41000-memory.dmp
memory/6016-304-0x000002221FE50000-0x000002221FE51000-memory.dmp
memory/6016-272-0x000002220BAE0000-0x000002220BAE4000-memory.dmp
memory/6016-305-0x000002221FE60000-0x000002221FE61000-memory.dmp
memory/6016-306-0x000002221FE70000-0x000002221FE71000-memory.dmp
memory/6016-307-0x000002221FE80000-0x000002221FE81000-memory.dmp
memory/6016-308-0x000002221FE90000-0x000002221FE91000-memory.dmp
memory/6016-309-0x000002221FEA0000-0x000002221FEA1000-memory.dmp
memory/6016-310-0x000002221FEB0000-0x000002221FEB1000-memory.dmp
memory/6016-311-0x000002221FEC0000-0x000002221FEC1000-memory.dmp
memory/6016-312-0x000002221FED0000-0x000002221FED1000-memory.dmp
memory/6016-287-0x000002220BC90000-0x000002220BC91000-memory.dmp
memory/6016-313-0x000002221FEE0000-0x000002221FEE1000-memory.dmp
memory/6016-314-0x000002221FEF0000-0x000002221FEF1000-memory.dmp
memory/6016-284-0x000002220BBA0000-0x000002220BBA4000-memory.dmp
memory/6016-315-0x000002221FF00000-0x000002221FF01000-memory.dmp
memory/6016-316-0x000002221FF10000-0x000002221FF11000-memory.dmp
memory/6016-317-0x000002221FF20000-0x000002221FF21000-memory.dmp
memory/6016-318-0x000002221FF30000-0x000002221FF31000-memory.dmp
memory/6016-320-0x000002221FF50000-0x000002221FF51000-memory.dmp
memory/6016-321-0x000002221FF60000-0x000002221FF61000-memory.dmp
memory/6016-292-0x00000221F8FE0000-0x00000221F8FE1000-memory.dmp
memory/6016-283-0x000002220BB90000-0x000002220BB94000-memory.dmp
memory/6072-4187-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/6172-6184-0x00000278B21E0000-0x00000278B2292000-memory.dmp
memory/6240-3477-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/6364-5119-0x00000293F5250000-0x00000293F5302000-memory.dmp
memory/6404-903-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/6456-2301-0x00000169742F0000-0x00000169743A2000-memory.dmp
memory/6484-2100-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/6552-823-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/6600-7367-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/6648-901-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/6720-3622-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/6768-5116-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/6856-2103-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/6876-5112-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/6876-6692-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/6924-3482-0x0000016367930000-0x00000163679E2000-memory.dmp
memory/6952-4580-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/6952-4544-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/7032-2135-0x0000026E234F0000-0x0000026E235A2000-memory.dmp
memory/7100-6744-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/7156-1956-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/7156-2093-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/7164-2728-0x0000000000400000-0x00000000004CD000-memory.dmp