Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems

Four random-looking executable names began sending an unusual stream of Bing China visitors to Gridinsoft ThreatInfo in July 2026. The names looked unrelated, but our retained endpoint telemetry tied them to one polymorphic CoinMiner cluster observed on Chinese Windows systems. Across 34 installations, we recorded 57 CoinMiner observations, 45 whole-file MD5 hashes, and only ten reused filename and path templates.

The cluster changes the miner’s hash frequently while reusing short waves of eight-character filenames such as YT1hbBAQ.exe, 1nS0FKs7.exe, jc5cYQ58.exe, and 9XPhPTDx.exe. Behind those rotating payloads is a more stable chain: a signed launcher placed in a randomized Program Files folder, a polymorphic xpsplog.dll beside it, and redundant Run-key and scheduled-task persistence disguised with Alibaba, Tencent, and Microsoft Edge-themed labels.

The company names in those labels and file metadata are not attribution. The evidence indicates camouflage and abuse of a legitimate signed executable, not participation by Alibaba, Tencent, Philips, or Speech Processing Solutions.

Key findings

• The four high-traffic filenames belong to one cluster. Their names recur across independent installations while their whole-file MD5 hashes change.
• The main payload is strongly polymorphic. We observed 45 payload hashes across 34 installations but only ten stable random-name path templates.
• A fixed signed launcher anchors the chain. The same 149,320-byte launcher hash appears in randomized Program Files folders and is registered through fake Alibaba-themed Run values.
• A changing DLL probably provides the malicious side-loading stage. The launcher and a polymorphic xpsplog.dll share a directory in every retained installation that contains both components.
• Persistence is redundant. A second stable component is launched through a Tencent-themed Run value and randomized or Microsoft Edge-like scheduled tasks.
• At least part of the Bing China traffic is victim-driven. Two retained endpoint records capture users searching Bing for the exact random process name later detected on the same installation.

Methodology and scope

This report uses retained completed-scan logs and parsed startup collections from July 15, 2026 at 01:13 UTC through July 21 at 17:56 UTC. We grouped anonymized installations by the final CoinMiner payload’s size, detection family, randomized ProgramData path structure, co-occurring launcher and DLL components, and startup or scheduled-task artifacts.

The counts describe the retained cohort, not the campaign’s total prevalence. Thirty-nine CoinMiner observations were recorded as Unknown on demo licenses, while 18 were quarantine or restart events on trial or full licenses. We interpret that difference primarily as a licensing and remediation split, not as contradictory malware verdicts.

The original scan rows for the first two supplied landing-page MD5s aged out before the retained collector window. Their filenames and path templates recur later inside the same cluster with new hashes. We therefore use the first two hashes as representative historical landing-page indicators while reserving direct retained-scan confirmation for the latter two.

One cluster behind four high-traffic filenames

The investigation began with four ThreatInfo pages receiving hundreds of sessions from cn.bing.com. The supplied landing-page hashes are historical representatives of the cluster, not a complete detection set.

Retained scan and startup-collection records cover July 15 at 01:13 UTC through July 21 at 17:56 UTC. The first two exact landing-page MD5s appeared before that retention window, but their filenames and path templates returned later with different hashes. The latter two representative hashes were present in retained scans and detected as Trojan.Win64.CoinMiner.oa!s2.

The reuse pattern is important. Gridinsoft observed jc5cYQ58.exe 13 times across eight installations and eight MD5s. It observed 9XPhPTDx.exe 13 times across nine installations and ten MD5s. A filename identifies a short campaign wave; a single hash identifies only one transient build.

Names and hashes rotate, but the payload shape remains stable

The final CoinMiner payload is an unsigned 64-bit Windows executable measuring 679,424 bytes. It runs from a path that follows this pattern:

%ProgramData%\????????\????????.exe

Both the directory and executable normally use eight alphanumeric characters. Ten path/name templates recurred across the retained cohort, including:

%ProgramData%\tp8an6uf\YT1hbBAQ.exe
%ProgramData%\rpip8bvu\1nS0FKs7.exe
%ProgramData%\8umbrsew\jc5cYQ58.exe
%ProgramData%\iboaqok4\9XPhPTDx.exe

Different installations can receive the same path and filename but a different MD5. Detection logic, incident response, and search content therefore should not depend on one hash. File size, execution path, signature state, persistence, co-located components, and detection family are more durable signals.

This differs from a normal user-installed miner. Legitimate mining software may trigger security-tool warnings, but it should have a source the user recognizes, a deliberate configuration, and an expected installation path. A surprise unsigned miner under a randomized ProgramData directory, backed by disguised startup entries, should be treated as an infection. The broader Coin Miner malware guide covers the usual high-CPU, fan-noise, heat, and performance symptoms.

A stable signed launcher starts the chain

One of the cluster’s most persistent components is a 149,320-byte executable with MD5:

5251b98614acffe5c856f4039ca03da3

The file carries a valid signature and metadata associated with Speech Processing Solutions GmbH, while one product field remains the unfinished string TODO: <Product name>. Across the 34-installation CoinMiner cohort, scan records associate this launcher hash with 27 installations. Among 25 installations with retained startup collections, it appears in 22.

The launcher is copied into randomized paths under %ProgramFiles(x86)% and started through one or both of these machine-wide Run values:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealthA
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealthB

A valid signature does not make this installation benign. The hash corresponds to a signed executable that can be clean in its legitimate context. Its unexpected randomized location, startup registration, and pairing with a changing DLL are the suspicious behaviors. Public sandbox reports also show the same launcher hash appearing under different random names and folders beside XPSPLOG.dll, independently supporting the repeated-layout finding.

The launcher probably side-loads a polymorphic xpsplog.dll

A 4,812,816-byte file named xpsplog.dll appears beside the signed launcher. In this cluster it is unsigned or metadata-poor and is detected primarily as Trojan.Heur!.022120A0.

The structural evidence for DLL side-loading is strong:

• 27 of 34 cluster installations contain detections for xpsplog.dll.
• Those installations contain 52 distinct DLL MD5s.
• 26 installations contain both the fixed launcher hash and xpsplog.dll.
• In all 26, the launcher and DLL share at least one parent directory.
• The retained data contains 48 same-directory launcher/DLL pairs.

This supports a probable DLL side-loading chain: Windows starts a trusted signed program, and the program loads a malicious DLL placed beside it. The retained endpoint data does not include the API-level trace needed to prove the exact load call, so side-loading remains a high-confidence working model rather than a directly captured event.

The filename alone is not enough to condemn every xpsplog.dll. Legitimate historical versions of the logging library exist in normal vendor locations. The cluster version becomes suspicious through the combined evidence: a random Program Files directory, the fixed launcher, a changing unsigned DLL, fake SecurityHealth startup values, and the accompanying CoinMiner payload.

Redundant persistence uses Tencent and Edge-themed labels

The cluster also deploys a 139,088-byte component with MD5:

9ec587911e501b73b7cf09f05d0ae17d

It is referenced by another machine-wide Run value:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth

The same hash is launched through randomized scheduled tasks. Some task names imitate Microsoft Edge update tasks, including names shaped like MicrosoftEdgeUpdateTaskMachineCore1{GUID}. Retained startup collections show the component in task entries for 20 installations, spanning 35 distinct task identities, and in the Tencent-themed Run entry for 20 installations.

These labels should be read as camouflage. They are designed to blend into Chinese Windows environments where legitimate Alibaba or Tencent software may already exist. They do not establish a relationship between the malware operator and either company.

A correlated ProcessImpostor component adds another changing layer

An additional unsigned executable measuring 2,949,632 bytes appears under ProgramData in 18 of the 34 installations. Its hashes change while a smaller group of filenames is reused, including upYrZJOf.exe, 2rktgk1x.exe, and 1ttqnc2t.exe. Gridinsoft detects these files as Trojan.Win32.ProcessImpostor.an!s6.

The telemetry establishes association and execution within the same cohort. It does not establish whether this component directly launches the miner, performs injection, or represents another payload installed by the same loader. It is therefore best treated as a correlated intermediate component, not a proven parent process.

Bing searches show the victim response loop

The unusual search traffic is not only an analytics correlation. Startup collections contain host-side evidence that affected users searched Bing for the process name they saw on the computer.

• One Edge process opened a Bing query for jc5cYQ58.exe jc5cYQ58.exe. A scan from the same installation detected the matching campaign path minutes later.
• Another Edge process was launched from Windows Search with a Bing query for oedud0lz.exe, including cc=cn and setlang=zh-cn. Subsequent scans on the same installation found the matching CoinMiner path.

This closes the loop between infection and high-intent traffic. A user notices an unfamiliar process or file, searches its exact random name, reaches the matching ThreatInfo report, and requests the scanner. The malware’s rotating filenames create the search demand.

Behavioral indicators are more useful than a hash-only list

Because the main payload and DLL are polymorphic, defenders should prioritize the following combinations:

%ProgramData%\????????\????????.exe
    unsigned 64-bit executable, 679,424 bytes

%ProgramFiles(x86)%\{random}\{random}.exe
    signed launcher, 149,320 bytes

%ProgramFiles(x86)%\{same-random}\xpsplog.dll
    unsigned or metadata-poor DLL, 4,812,816 bytes

HKLM\...\Run\Alibaba SecurityHealthA
HKLM\...\Run\Alibaba SecurityHealthB
HKLM\...\Run\Tencent SecurityHealth

Randomized or Edge-themed scheduled task
    → random executable under a public-profile directory

The two stable component hashes are useful for hunting, but neither should be used without context:

• 5251b98614acffe5c856f4039ca03da3 — signed 149,320-byte launcher abused in the observed layout.
• 9ec587911e501b73b7cf09f05d0ae17d — 139,088-byte Run/task persistence component.

What rotates and what stays stable

The cluster is easier to identify as a behavioral system than as a list of files. The miner and DLL hashes rotate quickly, while their sizes, directory relationships, launcher, persistence component, and startup mechanisms remain comparatively stable.

This distinction defines the hunting strategy. A hash match is useful for confirming one known build. The durable detection is a correlation: random ProgramData miner, signed launcher and unsigned same-directory DLL, SecurityHealth Run values, and Edge-themed or randomized scheduled tasks.

MITRE ATT&CK mapping

The mapping below is deliberately limited to behavior present in the retained cohort. The DLL side-loading entry is marked probable because the directory-level evidence is strong but an API-level image-load trace was not retained.

Detection and hunting opportunities

Randomized CoinMiner payload

ImagePath matches %ProgramData%\[A-Za-z0-9]{8}\[A-Za-z0-9]{8}.exe
AND FileSize == 679424
AND Architecture == "x64"
AND SignatureStatus != "Valid"

Raise confidence when the file is detected as Trojan.Win64.CoinMiner.oa!s2, consumes sustained CPU, or appears with one of the persistence patterns below. The size and path rule is a campaign pivot, not a universal malware verdict.

Signed launcher and same-directory DLL

ProcessImage MD5 == 5251b98614acffe5c856f4039ca03da3
OR ProcessImageSize == 149320

AND LoadedModuleName == "xpsplog.dll"
AND LoadedModuleDirectory == ProcessImageDirectory
AND LoadedModuleSize == 4812816
AND LoadedModuleSignature != "Valid"

A matching image-load event would directly test the side-loading model. Without image-load telemetry, hunt for the fixed launcher and xpsplog.dll created in the same randomized Program Files directory and executed shortly afterward.

Run-key and scheduled-task persistence

RegistryPath endswith \Software\Microsoft\Windows\CurrentVersion\Run
AND ValueName in (
  "Alibaba SecurityHealthA",
  "Alibaba SecurityHealthB",
  "Tencent SecurityHealth"
)

OR TaskName startswith "MicrosoftEdgeUpdateTaskMachineCore1"
OR TaskAction points to a random executable under ProgramData or a public-profile directory

Do not alert on the words Alibaba, Tencent, SecurityHealth, or Microsoft Edge alone. Correlate the label with its command, signer, target directory, creation time, and the miner or launcher/DLL artifacts.

Telemetry sources for confirmation

What affected users should do

1. Disconnect the computer if it is overheating or actively mining. This limits additional downloads while the system is investigated.
2. Record the process path and hash before removing it. Use Task Manager’s Open file location option and PowerShell Get-FileHash. Do not run an unknown file to test it.
3. Quarantine the random ProgramData executable. Deleting only that EXE is not enough because the loader and persistence components can recreate it.
4. Review the three SecurityHealth Run values. Confirm what command each value launches before disabling or removing it. A legitimate vendor name does not validate a command pointing to a random directory.
5. Inspect scheduled tasks. Look for recently created random names and Edge-update lookalikes that launch files from Public, ProgramData, or other unexpected directories.
6. Remove the suspicious launcher/DLL pair together. A random Program Files directory containing the fixed launcher beside an unsigned 4,812,816-byte xpsplog.dll matches the observed cluster pattern.
7. Run a full malware scan and reboot. Gridinsoft Anti-Malware can check the miner, loader, side-loaded DLL, scheduled tasks, startup entries, and correlated payloads. After rebooting, scan again if the random process or CPU load returns.

If a miner returns after deletion, use the Windows miner persistence guide to review services and scheduled tasks systematically. Do not restore or allow a detected file merely because its filename or signature resembles a legitimate product.

What the evidence does not establish

The retained telemetry strongly connects the rotating payloads, fake SecurityHealth persistence, fixed launcher, and same-directory DLL. It does not reveal a mining-pool or command-and-control domain, the original installer that placed the first component, or an actor behind the operation.

Chinese-language systems and Chinese software/PUP co-detections support regional targeting or distribution through a Chinese download and bundling ecosystem. They do not prove which site, bundle, or distributor started the infection. Likewise, the signed publisher metadata and Alibaba/Tencent strings should not be treated as attribution.

Confidence assessment

High confidence: the four rotating names belong to the same CoinMiner cluster; the 679,424-byte payload is polymorphic; fake Alibaba and Tencent SecurityHealth persistence belongs to the cluster; and at least some Bing China searches come from affected users investigating the filename visible on their system.

High confidence working model: the fixed signed launcher and polymorphic same-directory xpsplog.dll form a DLL side-loading chain. The directory-level association is consistent across the retained cohort, although API-level load traces are unavailable.

Moderate confidence: the 2,949,632-byte ProcessImpostor family is an intermediate stage in the same delivery chain, and the initial distribution is connected to Chinese download or software-bundling channels.

Not established: a command-and-control or mining-pool domain, the original installer or referrer, the exact parent process for every stage, an actor identity, or participation by any legitimate company whose name or certificate appears in the artifacts.

FAQ

References

1. Gridinsoft ThreatInfo. “XPSPLOG.dll Trojan.Heur! Detection.” Gridinsoft, accessed July 21, 2026. https://threatinfo.net/files/XPSPLOG.dll-1f01406786f3911c525ced72754e48c6.
2. Gridinsoft Online Virus Scanner. “dMsFTa.exe (Philips Speech Driver Client Configuration) File Analysis.” Gridinsoft, accessed July 21, 2026. https://gridinsoft.com/online-virus-scanner/id/6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8.
3. Joe Security. “Automated Malware Analysis: Launcher MD5 5251B98614ACFFE5C856F4039CA03DA3.” Joe Sandbox, accessed July 21, 2026. https://www.joesandbox.com/analysis/1682889.