cobaltstrike | a1664724da2198b5a457c41ff1183414d65d571720e02720803b8a9e6d6a253a

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 5.7MB
Sample260822-eejfza1bjd
SHA256 a1664724da2198b5a457c41ff1183414d65d571720e02720803b8a9e6d6a253a
MD5 92ebe23f3268c3fa7dfd5c746c63f224
SHA1 441db200d906f7c099a7e8b8d35c1956ea06fc13
SHA512 0433664007753df27af1ae0996ec036cef683a2f36d47be39e87b6972fe964cd302292696f9c90091b97b6e136367af4065586bbe328eaa887aeb70a619089e7
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUp:j+R56utgpPF8u/7p
TLSH
T1A9565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000c00000001b1b7-6.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c586-10.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c587-11.dat	cobalt_reflective_dll
behavioral2/files/0x000e00000001c583-23.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c588-28.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c589-36.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c58a-42.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c58e-47.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c58f-51.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c591-65.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c592-71.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c594-83.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c597-94.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c599-106.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c59a-113.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c59c-124.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c59b-119.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c598-101.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c595-89.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c593-77.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c590-59.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001b1b7-6.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c586-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c587-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000e00000001c583-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c588-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c589-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c58a-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c58e-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c58f-51.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c591-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c592-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c594-83.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c597-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c599-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c59a-113.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c59c-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c59b-119.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c598-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c595-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c593-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c590-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/5956-0-0x00007FF6B2590000-0x00007FF6B28DD000-memory.dmp	xmrig
behavioral2/files/0x000c00000001b1b7-6.dat	xmrig
behavioral2/memory/5608-7-0x00007FF6FF790000-0x00007FF6FFADD000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c586-10.dat	xmrig
behavioral2/files/0x000c00000001c587-11.dat	xmrig
behavioral2/memory/1296-13-0x00007FF712810000-0x00007FF712B5D000-memory.dmp	xmrig
behavioral2/memory/248-19-0x00007FF7F64C0000-0x00007FF7F680D000-memory.dmp	xmrig
behavioral2/files/0x000e00000001c583-23.dat	xmrig
behavioral2/memory/3504-25-0x00007FF7FED30000-0x00007FF7FF07D000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c588-28.dat	xmrig
behavioral2/memory/2520-31-0x00007FF6506C0000-0x00007FF650A0D000-memory.dmp	xmrig
behavioral2/memory/5452-37-0x00007FF74CAF0000-0x00007FF74CE3D000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c589-36.dat	xmrig
behavioral2/files/0x000c00000001c58a-42.dat	xmrig
behavioral2/memory/5844-43-0x00007FF607570000-0x00007FF6078BD000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c58e-47.dat	xmrig
behavioral2/memory/5456-49-0x00007FF742C20000-0x00007FF742F6D000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c58f-51.dat	xmrig
behavioral2/memory/3424-54-0x00007FF761DB0000-0x00007FF7620FD000-memory.dmp	xmrig
behavioral2/memory/6080-60-0x00007FF6D1C20000-0x00007FF6D1F6D000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c591-65.dat	xmrig
behavioral2/memory/5680-66-0x00007FF732EE0000-0x00007FF73322D000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c592-71.dat	xmrig
behavioral2/memory/5696-72-0x00007FF665420000-0x00007FF66576D000-memory.dmp	xmrig
behavioral2/memory/1620-78-0x00007FF6D7210000-0x00007FF6D755D000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c594-83.dat	xmrig
behavioral2/files/0x000c00000001c597-94.dat	xmrig
behavioral2/files/0x000c00000001c599-106.dat	xmrig
behavioral2/files/0x000c00000001c59a-113.dat	xmrig
behavioral2/memory/3552-120-0x00007FF7D93D0000-0x00007FF7D971D000-memory.dmp	xmrig
behavioral2/memory/3020-125-0x00007FF6DA810000-0x00007FF6DAB5D000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c59c-124.dat	xmrig
behavioral2/files/0x000c00000001c59b-119.dat	xmrig
behavioral2/memory/2296-114-0x00007FF674860000-0x00007FF674BAD000-memory.dmp	xmrig
behavioral2/memory/5048-108-0x00007FF768FD0000-0x00007FF76931D000-memory.dmp	xmrig
behavioral2/memory/3744-102-0x00007FF782640000-0x00007FF78298D000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c598-101.dat	xmrig
behavioral2/memory/1108-96-0x00007FF66E000000-0x00007FF66E34D000-memory.dmp	xmrig
behavioral2/memory/3044-90-0x00007FF672130000-0x00007FF67247D000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c595-89.dat	xmrig
behavioral2/memory/1916-84-0x00007FF7019F0000-0x00007FF701D3D000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c593-77.dat	xmrig
behavioral2/files/0x000c00000001c590-59.dat	xmrig

Executes dropped EXE 21 IoCs

pid	Process
5608	eXAiRpB.exe
1296	hOUyKXr.exe
248	SfRmrKZ.exe
3504	pQPJkNk.exe
2520	gMsOIbK.exe
5452	tMrANoG.exe
5844	lvkMxKt.exe
5456	dhCtVKl.exe
3424	yYAmmhC.exe
6080	lIEUvUD.exe
5680	winMeEu.exe
5696	nuUHKMY.exe
1620	wQQyxFb.exe
1916	hVkUcYH.exe
3044	YvYpCsP.exe
1108	olpjHlw.exe
3744	uDbQZfG.exe
5048	EfCKPcP.exe
2296	kZipuAr.exe
3552	hFiFXnx.exe
3020	hrXZPBK.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\wQQyxFb.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\hOUyKXr.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\gMsOIbK.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\lIEUvUD.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\YvYpCsP.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\hrXZPBK.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\dhCtVKl.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\winMeEu.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\hVkUcYH.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\pQPJkNk.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\tMrANoG.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\lvkMxKt.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\yYAmmhC.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\nuUHKMY.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\olpjHlw.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\uDbQZfG.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\hFiFXnx.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\eXAiRpB.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\SfRmrKZ.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\EfCKPcP.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\kZipuAr.exe	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5956 wrote to memory of 5608	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 5956 wrote to memory of 1296	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 5956 wrote to memory of 248	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 5956 wrote to memory of 3504	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 5956 wrote to memory of 2520	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 5956 wrote to memory of 5452	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 5956 wrote to memory of 5844	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 5956 wrote to memory of 5456	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 5956 wrote to memory of 3424	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 5956 wrote to memory of 6080	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 5956 wrote to memory of 5680	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 5956 wrote to memory of 5696	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 5956 wrote to memory of 1620	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 5956 wrote to memory of 1916	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 5956 wrote to memory of 3044	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 5956 wrote to memory of 1108	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 5956 wrote to memory of 3744	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 5956 wrote to memory of 5048	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 5956 wrote to memory of 2296	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 5956 wrote to memory of 3552	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109
PID 5956 wrote to memory of 3020	5956	2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_92ebe23f3268c3fa7dfd5c746c63f224_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5956
- C:\Windows\System\eXAiRpB.exe
  C:\Windows\System\eXAiRpB.exe
  2⤵
  - Executes dropped EXE
  PID:5608
- C:\Windows\System\hOUyKXr.exe
  C:\Windows\System\hOUyKXr.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\SfRmrKZ.exe
  C:\Windows\System\SfRmrKZ.exe
  2⤵
  - Executes dropped EXE
  PID:248
- C:\Windows\System\pQPJkNk.exe
  C:\Windows\System\pQPJkNk.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\gMsOIbK.exe
  C:\Windows\System\gMsOIbK.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\tMrANoG.exe
  C:\Windows\System\tMrANoG.exe
  2⤵
  - Executes dropped EXE
  PID:5452
- C:\Windows\System\lvkMxKt.exe
  C:\Windows\System\lvkMxKt.exe
  2⤵
  - Executes dropped EXE
  PID:5844
- C:\Windows\System\dhCtVKl.exe
  C:\Windows\System\dhCtVKl.exe
  2⤵
  - Executes dropped EXE
  PID:5456
- C:\Windows\System\yYAmmhC.exe
  C:\Windows\System\yYAmmhC.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\lIEUvUD.exe
  C:\Windows\System\lIEUvUD.exe
  2⤵
  - Executes dropped EXE
  PID:6080
- C:\Windows\System\winMeEu.exe
  C:\Windows\System\winMeEu.exe
  2⤵
  - Executes dropped EXE
  PID:5680
- C:\Windows\System\nuUHKMY.exe
  C:\Windows\System\nuUHKMY.exe
  2⤵
  - Executes dropped EXE
  PID:5696
- C:\Windows\System\wQQyxFb.exe
  C:\Windows\System\wQQyxFb.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\hVkUcYH.exe
  C:\Windows\System\hVkUcYH.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\YvYpCsP.exe
  C:\Windows\System\YvYpCsP.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\olpjHlw.exe
  C:\Windows\System\olpjHlw.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\uDbQZfG.exe
  C:\Windows\System\uDbQZfG.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\EfCKPcP.exe
  C:\Windows\System\EfCKPcP.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\kZipuAr.exe
  C:\Windows\System\kZipuAr.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\hFiFXnx.exe
  C:\Windows\System\hFiFXnx.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\hrXZPBK.exe
  C:\Windows\System\hrXZPBK.exe
  2⤵
  - Executes dropped EXE
  PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

EfCKPcP.exe

Path C:\Windows\System\EfCKPcP.exe
Size 5.7MB
SHA256 265fffa9b8b6c3d1fae84d42cae15a8badf7e00132bbb1951449a54976d73476
MD5 0121643fab55f38a55f41183c66eb590
SHA1 c6a7c228c097aeb8323d3958a6843598025a2279
SHA512 06ea10583f6196028c38eb897fc48a0e9b85229545e04e3ecd5261f3b1e47c85cc84296e935c46cc101344ebdc248990f9c85cb3a55ba31d3d23a752b2922eae
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUL:j+R56utgpPF8u/7L
TLSH
T1B0565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SfRmrKZ.exe

Path C:\Windows\System\SfRmrKZ.exe
Size 5.7MB
SHA256 9729112e8e293329ad65f8496ef0cbd2a50f60162aca4c100cd30cab523ba2e0
MD5 87a481e70c1bd156492c4d859b012158
SHA1 53b15c7648c2e0ec56f6375da857cb5cb8e97032
SHA512 99ed2ac65cd6c9087d7dddf07d76fe0257e831e43999b92f4b14fc6985dfa340c4b7ef31eaa73e932da4f8505c7ab8bb374d4c236376a1601029c54ff90d1b91
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUj:j+R56utgpPF8u/7j
TLSH
T159565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YvYpCsP.exe

Path C:\Windows\System\YvYpCsP.exe
Size 5.7MB
SHA256 ae8f96865cbafa3aaffb58f4dd169c68d8fee68992222b5e112635b545339c39
MD5 dccde25de8beacb5ea9ff16a264cb4e6
SHA1 5bd7414f5d377b462c3f85d6ed3c882ce0171084
SHA512 cfe60a36b0645d2662e64e97d1decb8c037956f1da3899b55c9e0b8d319b97783af64c13c45e4466d17b2956d085981a99386bb698130b1d3bbc01b2fd8bbe7a
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUN:j+R56utgpPF8u/7N
TLSH
T1B2565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dhCtVKl.exe

Path C:\Windows\System\dhCtVKl.exe
Size 5.7MB
SHA256 582cd12ac39933ac8843459b89973878978cecceaeba0707de7ae3fd78de4e50
MD5 6c7c69802c18a71a6b3c6ff9e1bdd613
SHA1 be12d24d37d30b52658abd7553362986c25f5086
SHA512 50bf00241533bd8dfa16bb47bf929233e517c2ba86f7cb6209054e031ed024edb8af6bf71c6eac56da8cb788ab6946bf5743e9f34a1ea0c4818d300ad5f9e87a
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lU7:j+R56utgpPF8u/77
TLSH
T1F3565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eXAiRpB.exe

Path C:\Windows\System\eXAiRpB.exe
Size 5.7MB
SHA256 58159ffdc954273f994c68915a6b3cd4383c855f1700f55041033a3a4b6dd92e
MD5 1f9585ea0406f4a3eaaea449ab3ab5e0
SHA1 4409c4d779c6433a96e0c3a09406a60c3cfb769f
SHA512 a3ed8aa4a8f86689a7873fac378d3c0d87b5f74e195913ff2dcb020dcc144b4eec391f74f022f25433156c12215524f9bdcaa3a5efda648c29739cafc95c370c
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUR:j+R56utgpPF8u/7R
TLSH
T1CA565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gMsOIbK.exe

Path C:\Windows\System\gMsOIbK.exe
Size 5.7MB
SHA256 9e3cceab51193ce185060268c06d0e86d9e3bb5798221a671d27fde3e50cc4b8
MD5 b6561af924e3084b098f1f07ddcb8325
SHA1 c24286411c2213824eac19fb0f983f84e29e394c
SHA512 b5874b7738dcc8b65dac90877c717de5d750ff21d0336e1cc77240b07a44c3f7a9548e27e95157848ad7f71313ddca2ba1209efe2a65660f0ef76f9ab36d8d1e
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUs:j+R56utgpPF8u/7s
TLSH
T1BC565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hFiFXnx.exe

Path C:\Windows\System\hFiFXnx.exe
Size 5.7MB
SHA256 be447c7592056c9f08f5a8899dc11e1bcb642d2088d0cb475763ba799ea80678
MD5 a7be06868e11fdbffd665cb52fd768de
SHA1 06c5f6e9e664107b11fc361322232e0cf576836d
SHA512 564d4953481810c407ff4a0d2d50874fe0e85fd814bab34434cc72ef7928645edfb4733656e623cfb55a8ea2992bae70319af007a5d4dd1c9bf31af298451634
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUt:j+R56utgpPF8u/7t
TLSH
T1D4565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hOUyKXr.exe

Path C:\Windows\System\hOUyKXr.exe
Size 5.7MB
SHA256 6cc95b823274ff843cb02519bcefcc66c93451565b9c47aaec8c5626188e1407
MD5 47d4ed08cd783ee04e903ca26a38af39
SHA1 62fbe255dc9f01e0f76f7a27e275ab4b42135964
SHA512 898f252a9f23d0858b9ae9f9afea3301813c813f4de281a9c606bc855dcac1397e7bf6dfc36b6a1e1898209340f13e6a1bb649a50f9e96877d45a35af30a2769
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUJ:j+R56utgpPF8u/7J
TLSH
T1A0565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hVkUcYH.exe

Path C:\Windows\System\hVkUcYH.exe
Size 5.7MB
SHA256 18ae2c650fec7fbe73b9549db042a3d0f304aa148f0396650bdb786c04b405bc
MD5 2fb740f1e415c348c0d08e67ee36cc05
SHA1 0bbb50fb8b6b934792bd69edc5febf3c3591c7d4
SHA512 3e6785a65738be437253331d4eaf0da79e2991abb85af8d3417d0141347776cf28d8878225cc313d18ac84a503d2e951fbf8163cb9cdb5c1fa0317388a20a5f2
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUk:j+R56utgpPF8u/7k
TLSH
T1A8565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hrXZPBK.exe

Path C:\Windows\System\hrXZPBK.exe
Size 5.7MB
SHA256 1cc77990129d6cf37e901766b43d18bd49486ae0fa53729d13d6ab3cbb32fcce
MD5 d7790e6edb3ad2f15f6e228c045fc152
SHA1 1927ad923bc5661858ec223671007ee61570fc91
SHA512 3676f9a865c29097f2fba23c40d66ed31c1b69d1f64456b60cc3dd36f9668ddd5165daca5f777efe55699e09ebe510a6107547fc04178996816c6c34853b5f3b
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUY:j+R56utgpPF8u/7Y
TLSH
T19A565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kZipuAr.exe

Path C:\Windows\System\kZipuAr.exe
Size 5.7MB
SHA256 6a828ad4b2b47fabf7dc21b025aa8a507eb1309a979373767927a7562d098fb8
MD5 c9a740d99ca5212712e623b02a705e0d
SHA1 5ba92c3507f02f5e28bb4071e290f040c0e21783
SHA512 3131e04b7cf228be11252481b4bd03099d62bfd2b9e98a23393c0138be44e9f1e6626c6b94df8c60fa12eb826c206ab827227e5b364aa7004f31629cb1c7277b
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUV:j+R56utgpPF8u/7V
TLSH
T108565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lIEUvUD.exe

Path C:\Windows\System\lIEUvUD.exe
Size 5.7MB
SHA256 facdbd2c4c5475b3f7306590a47cd88fbe622ffb48b80931816cb960aeb87424
MD5 6f4e32a05e6f7953f08db5ef6b7efc6e
SHA1 1f0c78ef7d254cbfd535922898ec91714dde4734
SHA512 3f8c6ae0b00d706494be034e96f90247af8d0bfb902e81be4d6b1d3ffe16ccb47d397d63181c1fd0e7632e933ae39b09d6681c50852a487eb73f56853e954374
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUe:j+R56utgpPF8u/7e
TLSH
T1D0565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lvkMxKt.exe

Path C:\Windows\System\lvkMxKt.exe
Size 5.7MB
SHA256 3a1e139d1ac991442e1c4b03e2ce0b7e8873fb82d7b33f13997ec63ce1d1d334
MD5 b504a8052a03175c77b50a7ab6d62a5e
SHA1 3ce38974d5376e2d8394ace9fc0bb067ee0f0a92
SHA512 6dfe61f219d58acfbd137d2ecd9b42d2361d7c701b857cf144fbf716a4b866f27c22f2ca17b4cd4ad92286f02be06f490e39b73f30260879f3e9534f12d46808
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUx:j+R56utgpPF8u/7x
TLSH
T181565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nuUHKMY.exe

Path C:\Windows\System\nuUHKMY.exe
Size 5.7MB
SHA256 b51aea06d0434adf72ab2b03ded3f28226e862ea1b194962b4328016c575f89d
MD5 106e266a6de91f3775011a7b6d59b821
SHA1 8b561fc14d77951bad600869ca0962f3fe63b746
SHA512 9195eb9a5a92f25f0572c183902765c2db337a159edfdf419356f68c9e83cb484a21856627abb7421c558cad33577d309289a274f66e3cfeecad8db57378d575
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUQ:j+R56utgpPF8u/7Q
TLSH
T101565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olpjHlw.exe

Path C:\Windows\System\olpjHlw.exe
Size 5.7MB
SHA256 7681fc140c88a8c25e5114e07236d823af84fee387ac8ac15efc2f7d0f042f2d
MD5 c817594888a1d0d54f4f6dff37695c78
SHA1 e8142512fbf55d8213e7593f077d1f2f421bbd51
SHA512 1199ad2a2577dfb7bc590f7eeb88f6703bbef4ba357d8c51c2151e66bf9c39b0b910da8b05b81c632d7b34210fac3eecf9c08ad1da2ad2c45849551a1aff6063
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUa:j+R56utgpPF8u/7a
TLSH
T111565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pQPJkNk.exe

Path C:\Windows\System\pQPJkNk.exe
Size 5.7MB
SHA256 2df3512791c9477dfffef1e75378aa27283138abb170c7be38ed9387474e25c4
MD5 82f44508ed1141ae7f3ccf07d84f255c
SHA1 3935386eac5c454ee09259ac4b5de7db7b4152a9
SHA512 a177808d56e79150a46660aa498c11ceea7868416724b0bde3852937d7484ae389fe512bc97ef93a884b7b7b008cac6b0a55ae758964af05b865a698f2247e5a
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lU8:j+R56utgpPF8u/78
TLSH
T120565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tMrANoG.exe

Path C:\Windows\System\tMrANoG.exe
Size 5.7MB
SHA256 8caecc8892c9185ad3e4e6e054b3cc9fb6fce5e47b429e36c0f0c2da77639a4a
MD5 cb7b6f7a77b84c8a405898a1fff6ada6
SHA1 08cbd5c05e8f4e33afea23a5410b49bfb442066c
SHA512 ef7328614d90bbc3c1ba4f3c25b96e9605982da03ee1c6e0c614af7969639a7843423647fea54a24c57d5e82d30e682ae64f3a152c56483d103e6b60820e7e1e
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lU5:j+R56utgpPF8u/75
TLSH
T18B565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uDbQZfG.exe

Path C:\Windows\System\uDbQZfG.exe
Size 5.7MB
SHA256 17865c4d556c554ff5808a97508c966d02eab108214e73c631b6159b0aabd473
MD5 40bd1becbd7667dc6ffe57f53c72dcf5
SHA1 f8a8310e38c91bdcb7543253da14e0fcb4b93eeb
SHA512 e3f706046d153a25e9514aeccd9261925319e205f27b030151f2572958b29727513da1184411d8e76c707e3426de3ffe2395a420d12c3e2fb136569a4d756ceb
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUT:j+R56utgpPF8u/7T
TLSH
T158565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wQQyxFb.exe

Path C:\Windows\System\wQQyxFb.exe
Size 5.7MB
SHA256 37da557b3b5927066a5b7dd1ba73128c2165054ec4810517675f210a3e4250f9
MD5 c1953e343445634fb0eff1c3bc5a302c
SHA1 15946a79625a5eae366d9d8d67a619eb325aa9d6
SHA512 d4bf317c201b3716fb6f0a6f61e3e9cf74cfd467048a54da1708f7dc8bde3b0978e6f52289e93c1170b029a92d16265e233521151ec19b88b87aa3b91cb593ee
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUF:j+R56utgpPF8u/7F
TLSH
T1C1565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winMeEu.exe

Path C:\Windows\System\winMeEu.exe
Size 5.7MB
SHA256 25e305a8a72d64108c7f601bfb349892b982d767f15055da418cebbcde0f8dbb
MD5 53ced767097a0cd1b6307c05c8491635
SHA1 2636ba84504af3106c597e4cb4ca11b5a5ce5336
SHA512 660ff181ff2b0783510b5c2a86224ec16c558e6d4f4029d93ce9ba500504de8914026d86f51d13a8c86dbe735e7cd27551554deb8228106534d2f284920f49d1
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUh:j+R56utgpPF8u/7h
TLSH
T154565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yYAmmhC.exe

Path C:\Windows\System\yYAmmhC.exe
Size 5.7MB
SHA256 37a25a7482dc6711a636a4d8871e3698b9285ad728fdeb3ad0c820e36e746b88
MD5 da16c0032c1823c521eb9dac436510af
SHA1 d9bc55c2292661b17a0bd044b2e4bbf5a0fb1c1c
SHA512 69d8e13d8cce29a2799975bda66709e095d207175a61aa19d5732561d19291df2dbe33ee2f8b5e743569b0c3454596806e3fc6eb1c5ee8e084dcb065111aa1d2
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUg:j+R56utgpPF8u/7g
TLSH
T197565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-19-0x00007FF7F64C0000-0x00007FF7F680D000-memory.dmp

Download

memory/1108-96-0x00007FF66E000000-0x00007FF66E34D000-memory.dmp

Download

memory/1296-13-0x00007FF712810000-0x00007FF712B5D000-memory.dmp

Download

memory/1620-78-0x00007FF6D7210000-0x00007FF6D755D000-memory.dmp

Download

memory/1916-84-0x00007FF7019F0000-0x00007FF701D3D000-memory.dmp

Download

memory/2296-114-0x00007FF674860000-0x00007FF674BAD000-memory.dmp

Download

memory/2520-31-0x00007FF6506C0000-0x00007FF650A0D000-memory.dmp

Download

memory/3020-125-0x00007FF6DA810000-0x00007FF6DAB5D000-memory.dmp

Download

memory/3044-90-0x00007FF672130000-0x00007FF67247D000-memory.dmp

Download

memory/3424-54-0x00007FF761DB0000-0x00007FF7620FD000-memory.dmp

Download

memory/3504-25-0x00007FF7FED30000-0x00007FF7FF07D000-memory.dmp

Download

memory/3552-120-0x00007FF7D93D0000-0x00007FF7D971D000-memory.dmp

Download

memory/3744-102-0x00007FF782640000-0x00007FF78298D000-memory.dmp

Download

memory/5048-108-0x00007FF768FD0000-0x00007FF76931D000-memory.dmp

Download

memory/5452-37-0x00007FF74CAF0000-0x00007FF74CE3D000-memory.dmp

Download

memory/5456-49-0x00007FF742C20000-0x00007FF742F6D000-memory.dmp

Download

memory/5608-7-0x00007FF6FF790000-0x00007FF6FFADD000-memory.dmp

Download

memory/5680-66-0x00007FF732EE0000-0x00007FF73322D000-memory.dmp

Download

memory/5696-72-0x00007FF665420000-0x00007FF66576D000-memory.dmp

Download

memory/5844-43-0x00007FF607570000-0x00007FF6078BD000-memory.dmp

Download

memory/5956-1-0x000001B6BAB00000-0x000001B6BAB10000-memory.dmp

Download

memory/5956-0-0x00007FF6B2590000-0x00007FF6B28DD000-memory.dmp

Download

memory/6080-60-0x00007FF6D1C20000-0x00007FF6D1F6D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads