605e6fc6ae7e0b86a45c33e58004f3e09c29697f49fcf5d5b2b1dd840c9ef4c2

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
07/05/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_96c9618ca007189b85afbc0f0517809f_elex_glassworm_gobot_icedid_njrat.exe
Size 3.1MB
Sample260507-exxfjsey21
SHA256 605e6fc6ae7e0b86a45c33e58004f3e09c29697f49fcf5d5b2b1dd840c9ef4c2
MD5 96c9618ca007189b85afbc0f0517809f
SHA1 f483745141fb80e7ec42a7cc7f0a89c09109ecba
SHA512 c595fa7422bf1df12b0685c10274f6dbf19bfada03f2fc567773bcee454418f700c2581e515e96614a69375f37fd0b7230f2061de51751cf597eda1f6d4be049
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFA:IhnLrHp/qKm2/Sb/gqAZjA
TLSH
T1E5E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (2468) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 29 IoCs

pid	Process
3156	hr6Hz.exe
4372	cAeNc4K6h.exe
2400	lsm3ivPdjY9gH.exe
5076	tCI9S8R.exe
1464	MHnTCi9lP7B0em.exe
5608	l71K6bn.exe
4604	XsdXuXw7Azybv.exe
2996	8Sunw8.exe
1596	K5vb22c6tK.exe
248	GGinap8.exe
5296	14PsVe.exe
3056	T2OkSAIJ4h.exe
5580	1NXm3lIwhSHRpBo.exe
3472	Lr1s8nRwJi1VOkp.exe
1532	UKp2JMim6J4tCn.exe
920	cSv7j.exe
6308	YFHzx4D31sMbuH.exe
6612	QNrSKKWcL9EI.exe
6924	6ntMXTgca9.exe
6236	xJJ9w7q48lp.exe
6316	Zj7huMcvxy68j.exe
6576	RHaa9A1u81.exe
6892	BuH9rmxzeGKIyJ.exe
6304	1kNL3oLcA27oWSc.exe
2496	1jvJ8xBv.exe
6884	1mMTj0ay.exe
7324	u542SPSnMDq.exe
7572	wlJjzXG1VNv3k.exe
7824	jYQH7joF7.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCRSCAN = "C:\\Windows\\K5vb22c6tK.exe"	8Sunw8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F-STOPW = "C:\\Windows\\QNrSKKWcL9EI.exe"	YFHzx4D31sMbuH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CCEVTMGR = "C:\\Windows\\u542SPSnMDq.exe"	1mMTj0ay.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WFINDV32 = "C:\\Windows\\cAeNc4K6h.exe"	hr6Hz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DEFWATCH = "C:\\Windows\\XsdXuXw7Azybv.exe"	l71K6bn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVNT = "C:\\Windows\\xJJ9w7q48lp.exe"	6ntMXTgca9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TCM = "C:\\Windows\\RHaa9A1u81.exe"	Zj7huMcvxy68j.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\POPROXY = "C:\\Windows\\1kNL3oLcA27oWSc.exe"	BuH9rmxzeGKIyJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ICLOAD95 = "C:\\Windows\\1mMTj0ay.exe"	1jvJ8xBv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATUPDATER = "C:\\Windows\\jYQH7joF7.exe"	wlJjzXG1VNv3k.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PROCESSMONITOR = "C:\\Windows\\l71K6bn.exe"	MHnTCi9lP7B0em.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVWINNT = "C:\\Windows\\UKp2JMim6J4tCn.exe"	Lr1s8nRwJi1VOkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATUPDATER = "C:\\Windows\\BuH9rmxzeGKIyJ.exe"	RHaa9A1u81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IAMAPP = "C:\\Windows\\wlJjzXG1VNv3k.exe"	u542SPSnMDq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IAMAPP = "C:\\Windows\\hr6Hz.exe"	2026-05-07_96c9618ca007189b85afbc0f0517809f_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFIAUDIT = "C:\\Windows\\lsm3ivPdjY9gH.exe"	cAeNc4K6h.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NVSVC32 = "C:\\Windows\\T2OkSAIJ4h.exe"	14PsVe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VPTRAY = "C:\\Windows\\YFHzx4D31sMbuH.exe"	cSv7j.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFINET32 = "C:\\Windows\\1jvJ8xBv.exe"	1kNL3oLcA27oWSc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NPROTECT = "C:\\Windows\\8Sunw8.exe"	XsdXuXw7Azybv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NUPGRADE = "C:\\Windows\\6ntMXTgca9.exe"	QNrSKKWcL9EI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IFACE = "C:\\Windows\\GGinap8.exe"	K5vb22c6tK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VBCMSERV = "C:\\Windows\\Lr1s8nRwJi1VOkp.exe"	1NXm3lIwhSHRpBo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAVPROXY = "C:\\Windows\\14PsVe.exe"	GGinap8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IAMAPP = "C:\\Windows\\1NXm3lIwhSHRpBo.exe"	T2OkSAIJ4h.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFIAUDIT = "C:\\Windows\\Zj7huMcvxy68j.exe"	xJJ9w7q48lp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PORTMONITOR = "C:\\Windows\\MHnTCi9lP7B0em.exe"	tCI9S8R.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUALL = "C:\\Windows\\cSv7j.exe"	UKp2JMim6J4tCn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCVSRTE = "C:\\Windows\\tCI9S8R.exe"	lsm3ivPdjY9gH.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\XsdXuXw7Azybv.exe	l71K6bn.exe
File opened for modification	C:\Windows\T2OkSAIJ4h.exe	14PsVe.exe
File created	C:\Windows\1mMTj0ay.exe	1jvJ8xBv.exe
File opened for modification	C:\Windows\l71K6bn.exe	MHnTCi9lP7B0em.exe
File opened for modification	C:\Windows\14PsVe.exe	GGinap8.exe
File created	C:\Windows\cSv7j.exe	UKp2JMim6J4tCn.exe
File created	C:\Windows\GGinap8.exe	K5vb22c6tK.exe
File created	C:\Windows\BuH9rmxzeGKIyJ.exe	RHaa9A1u81.exe
File created	C:\Windows\hr6Hz.exe	2026-05-07_96c9618ca007189b85afbc0f0517809f_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\K5vb22c6tK.exe	8Sunw8.exe
File created	C:\Windows\YFHzx4D31sMbuH.exe	cSv7j.exe
File opened for modification	C:\Windows\YFHzx4D31sMbuH.exe	cSv7j.exe
File opened for modification	C:\Windows\Zj7huMcvxy68j.exe	xJJ9w7q48lp.exe
File opened for modification	C:\Windows\BuH9rmxzeGKIyJ.exe	RHaa9A1u81.exe
File created	C:\Windows\wlJjzXG1VNv3k.exe	u542SPSnMDq.exe
File opened for modification	C:\Windows\hr6Hz.exe	2026-05-07_96c9618ca007189b85afbc0f0517809f_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\XsdXuXw7Azybv.exe	l71K6bn.exe
File created	C:\Windows\14PsVe.exe	GGinap8.exe
File created	C:\Windows\RHaa9A1u81.exe	Zj7huMcvxy68j.exe
File opened for modification	C:\Windows\1jvJ8xBv.exe	1kNL3oLcA27oWSc.exe
File created	C:\Windows\lsm3ivPdjY9gH.exe	cAeNc4K6h.exe
File created	C:\Windows\l71K6bn.exe	MHnTCi9lP7B0em.exe
File opened for modification	C:\Windows\Lr1s8nRwJi1VOkp.exe	1NXm3lIwhSHRpBo.exe
File opened for modification	C:\Windows\1mMTj0ay.exe	1jvJ8xBv.exe
File created	C:\Windows\MHnTCi9lP7B0em.exe	tCI9S8R.exe
File opened for modification	C:\Windows\MHnTCi9lP7B0em.exe	tCI9S8R.exe
File opened for modification	C:\Windows\1NXm3lIwhSHRpBo.exe	T2OkSAIJ4h.exe
File created	C:\Windows\1jvJ8xBv.exe	1kNL3oLcA27oWSc.exe
File created	C:\Windows\K5vb22c6tK.exe	8Sunw8.exe
File created	C:\Windows\6ntMXTgca9.exe	QNrSKKWcL9EI.exe
File opened for modification	C:\Windows\RHaa9A1u81.exe	Zj7huMcvxy68j.exe
File opened for modification	C:\Windows\1kNL3oLcA27oWSc.exe	BuH9rmxzeGKIyJ.exe
File created	C:\Windows\xJJ9w7q48lp.exe	6ntMXTgca9.exe
File created	C:\Windows\Zj7huMcvxy68j.exe	xJJ9w7q48lp.exe
File opened for modification	C:\Windows\lsm3ivPdjY9gH.exe	cAeNc4K6h.exe
File opened for modification	C:\Windows\8Sunw8.exe	XsdXuXw7Azybv.exe
File opened for modification	C:\Windows\cAeNc4K6h.exe	hr6Hz.exe
File created	C:\Windows\8Sunw8.exe	XsdXuXw7Azybv.exe
File created	C:\Windows\UKp2JMim6J4tCn.exe	Lr1s8nRwJi1VOkp.exe
File opened for modification	C:\Windows\UKp2JMim6J4tCn.exe	Lr1s8nRwJi1VOkp.exe
File opened for modification	C:\Windows\cSv7j.exe	UKp2JMim6J4tCn.exe
File created	C:\Windows\u542SPSnMDq.exe	1mMTj0ay.exe
File opened for modification	C:\Windows\wlJjzXG1VNv3k.exe	u542SPSnMDq.exe
File created	C:\Windows\jYQH7joF7.exe	wlJjzXG1VNv3k.exe
File created	C:\Windows\tCI9S8R.exe	lsm3ivPdjY9gH.exe
File opened for modification	C:\Windows\GGinap8.exe	K5vb22c6tK.exe
File created	C:\Windows\T2OkSAIJ4h.exe	14PsVe.exe
File opened for modification	C:\Windows\tCI9S8R.exe	lsm3ivPdjY9gH.exe
File opened for modification	C:\Windows\6ntMXTgca9.exe	QNrSKKWcL9EI.exe
File created	C:\Windows\1kNL3oLcA27oWSc.exe	BuH9rmxzeGKIyJ.exe
File opened for modification	C:\Windows\u542SPSnMDq.exe	1mMTj0ay.exe
File opened for modification	C:\Windows\jYQH7joF7.exe	wlJjzXG1VNv3k.exe
File created	C:\Windows\cAeNc4K6h.exe	hr6Hz.exe
File created	C:\Windows\Lr1s8nRwJi1VOkp.exe	1NXm3lIwhSHRpBo.exe
File created	C:\Windows\QNrSKKWcL9EI.exe	YFHzx4D31sMbuH.exe
File created	C:\Windows\1NXm3lIwhSHRpBo.exe	T2OkSAIJ4h.exe
File opened for modification	C:\Windows\QNrSKKWcL9EI.exe	YFHzx4D31sMbuH.exe
File opened for modification	C:\Windows\xJJ9w7q48lp.exe	6ntMXTgca9.exe

Program crash 13 IoCs

pid	pid_target	Process	procid_target
2452	2400	WerFault.exe	84
2856	1464	WerFault.exe	88
2164	4604	WerFault.exe	95
6200	3472	WerFault.exe	113
6516	1532	WerFault.exe	115
6816	920	WerFault.exe	117
7132	6308	WerFault.exe	121
1168	6236	WerFault.exe	133
8124	5076	WerFault.exe	86
1336	3056	WerFault.exe	109
5924	7572	WerFault.exe	151
8088	6576	WerFault.exe	137
7516	5608	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lr1s8nRwJi1VOkp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cAeNc4K6h.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xJJ9w7q48lp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlJjzXG1VNv3k.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8Sunw8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	T2OkSAIJ4h.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cSv7j.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1kNL3oLcA27oWSc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1jvJ8xBv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_96c9618ca007189b85afbc0f0517809f_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XsdXuXw7Azybv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	14PsVe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YFHzx4D31sMbuH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l71K6bn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RHaa9A1u81.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BuH9rmxzeGKIyJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	u542SPSnMDq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hr6Hz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tCI9S8R.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	K5vb22c6tK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6ntMXTgca9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zj7huMcvxy68j.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsm3ivPdjY9gH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MHnTCi9lP7B0em.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GGinap8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UKp2JMim6J4tCn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QNrSKKWcL9EI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1mMTj0ay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jYQH7joF7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1NXm3lIwhSHRpBo.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-07_96c9618ca007189b85afbc0f0517809f_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_96c9618ca007189b85afbc0f0517809f_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1016

C:\Windows\hr6Hz.exe
C:\Windows\hr6Hz.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3156

C:\Windows\cAeNc4K6h.exe
C:\Windows\cAeNc4K6h.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4372

C:\Windows\lsm3ivPdjY9gH.exe
C:\Windows\lsm3ivPdjY9gH.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 2028
  2⤵
  - Program crash
  PID:2452

C:\Windows\tCI9S8R.exe
C:\Windows\tCI9S8R.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 2136
  2⤵
  - Program crash
  PID:8124

C:\Windows\MHnTCi9lP7B0em.exe
C:\Windows\MHnTCi9lP7B0em.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 2028
  2⤵
  - Program crash
  PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2400 -ip 2400
1⤵
PID:4728

C:\Windows\l71K6bn.exe
C:\Windows\l71K6bn.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5608 -s 2360
  2⤵
  - Program crash
  PID:7516

C:\Windows\XsdXuXw7Azybv.exe
C:\Windows\XsdXuXw7Azybv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 2028
  2⤵
  - Program crash
  PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1464 -ip 1464
1⤵
PID:5332

C:\Windows\8Sunw8.exe
C:\Windows\8Sunw8.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2996

C:\Windows\K5vb22c6tK.exe
C:\Windows\K5vb22c6tK.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4604 -ip 4604
1⤵
PID:1352

C:\Windows\GGinap8.exe
C:\Windows\GGinap8.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:248

C:\Windows\14PsVe.exe
C:\Windows\14PsVe.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5296

C:\Windows\T2OkSAIJ4h.exe
C:\Windows\T2OkSAIJ4h.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 2136
  2⤵
  - Program crash
  PID:1336

C:\Windows\1NXm3lIwhSHRpBo.exe
C:\Windows\1NXm3lIwhSHRpBo.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5580

C:\Windows\Lr1s8nRwJi1VOkp.exe
C:\Windows\Lr1s8nRwJi1VOkp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 2028
  2⤵
  - Program crash
  PID:6200

C:\Windows\UKp2JMim6J4tCn.exe
C:\Windows\UKp2JMim6J4tCn.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 2032
  2⤵
  - Program crash
  PID:6516

C:\Windows\cSv7j.exe
C:\Windows\cSv7j.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 2036
  2⤵
  - Program crash
  PID:6816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3472 -ip 3472
1⤵
PID:6176

C:\Windows\YFHzx4D31sMbuH.exe
C:\Windows\YFHzx4D31sMbuH.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6308 -s 2040
  2⤵
  - Program crash
  PID:7132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1532 -ip 1532
1⤵
PID:6496

C:\Windows\QNrSKKWcL9EI.exe
C:\Windows\QNrSKKWcL9EI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 920 -ip 920
1⤵
PID:6796

C:\Windows\6ntMXTgca9.exe
C:\Windows\6ntMXTgca9.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6308 -ip 6308
1⤵
PID:7108

C:\Windows\xJJ9w7q48lp.exe
C:\Windows\xJJ9w7q48lp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6236 -s 2036
  2⤵
  - Program crash
  PID:1168

C:\Windows\Zj7huMcvxy68j.exe
C:\Windows\Zj7huMcvxy68j.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6316

C:\Windows\RHaa9A1u81.exe
C:\Windows\RHaa9A1u81.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6576 -s 2256
  2⤵
  - Program crash
  PID:8088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 6236 -ip 6236
1⤵
PID:6808

C:\Windows\BuH9rmxzeGKIyJ.exe
C:\Windows\BuH9rmxzeGKIyJ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6892

C:\Windows\1kNL3oLcA27oWSc.exe
C:\Windows\1kNL3oLcA27oWSc.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6304

C:\Windows\1jvJ8xBv.exe
C:\Windows\1jvJ8xBv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2496

C:\Windows\1mMTj0ay.exe
C:\Windows\1mMTj0ay.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6884

C:\Windows\u542SPSnMDq.exe
C:\Windows\u542SPSnMDq.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7324

C:\Windows\wlJjzXG1VNv3k.exe
C:\Windows\wlJjzXG1VNv3k.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7572 -s 2144
  2⤵
  - Program crash
  PID:5924

C:\Windows\jYQH7joF7.exe
C:\Windows\jYQH7joF7.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5076 -ip 5076
1⤵
PID:5164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3056 -ip 3056
1⤵
PID:8000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 7572 -ip 7572
1⤵
PID:5864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6576 -ip 6576
1⤵
PID:5720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5608 -ip 5608
1⤵
PID:7728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

14PsVe.exe

Path C:\Windows\14PsVe.exe
Size 3.1MB
SHA256 386283dc76069cfef6dbca729127d77618cc94b83ab46339f8acfce27064db26
MD5 7d994aab392514c98ec89e7fbb4ec099
SHA1 ae7e20b70bfe8098c632b4ff69225550dee32df6
SHA512 41bcc2276d5986e1dbba2f13da1d6d1a852c392ece16b20b39a9ec89e937972a44c659d38b35708143ce0f4a63cf1f543fc353fa30b4d347b2abb648ec9acbc3
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblF+:IhnLrHp/qKm2/Sb/gqAZj+
TLSH
T1A4E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1NXm3lIwhSHRpBo.exe

Path C:\Windows\1NXm3lIwhSHRpBo.exe
Size 3.1MB
SHA256 4b7fd34255d9f9c3dae0054f9a2b07b936d0fb731889ff243f5bf2606dee173c
MD5 5da4f238ddb4a29326c64a49bddc6743
SHA1 3767b96728695a4841137d91b40f0f90d402d7a0
SHA512 45c6a041961397662b4d78bfe62a10a741e7c5f6556aba8fed1de0f0f9212ad757490ea882917b53314edab0872c831a43f4f7d20df87cc06accff9e3f2f3241
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFQ:IhnLrHp/qKm2/Sb/gqAZjQ
TLSH
T117E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1jvJ8xBv.exe

Path C:\Windows\1jvJ8xBv.exe
Size 3.1MB
SHA256 336ba3016e57111882f8bce998a8f03e3615acc0aea1402a814e7d74842f5e16
MD5 809fa5a922e855937a21338a219895e4
SHA1 86ddbef157859b36f99fbc57cb80be7957d940ee
SHA512 d5fae85e9b01bfb2c52b5275a8cc345807736ce7493a5e805edf9571eae4b075f757dfd1aaf7a6ef38993dee751d5f4885cd7ae1ccdd2b1f27f0510b4e35db62
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFA:IhnLrHp/qKm2/Sb/gqAZjA
TLSH
T18FE59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1kNL3oLcA27oWSc.exe

Path C:\Windows\1kNL3oLcA27oWSc.exe
Size 3.1MB
SHA256 6cb5e779912219d853c6e8ebb6b95ed14ddc1c8ad5ae72e0a010ec62d03d431f
MD5 dee060ac3fd8150e16b5b1a98612a3bc
SHA1 e918fc9c512c24aa8b6e6786233b9936d59fb7e5
SHA512 999b900dccf4b62f375347b1af9d9f413f8d9c9603641a078d7b8ad49d1bf06070eb88bfcac4257650ef8f0dab88d299ae4b6d09190e93fddc3fe7f7bb1e556b
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFu:IhnLrHp/qKm2/Sb/gqAZju
TLSH
T107E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1mMTj0ay.exe

Path C:\Windows\1mMTj0ay.exe
Size 3.1MB
SHA256 b25e038e89622cecf840b3a4ec666831234aa6993ff83553db1568a74c157c1e
MD5 96e839feb13b92846d1146bd20449732
SHA1 ae017149fb1d0b7768262e31c7dfce3453f79f24
SHA512 e58ef030a1c9675bf582b899c774cf396268d1a5a522b8ea12a7e8b6fba032c5137d2e7dee084fb42c22f948c0f12e2aa37559bd62d4a5335979b85cdcc8189f
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFN:IhnLrHp/qKm2/Sb/gqAZjN
TLSH
T1CEE59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ntMXTgca9.exe

Path C:\Windows\6ntMXTgca9.exe
Size 3.1MB
SHA256 48bbfb2ef0a8d31aacc650b27629098d57f59b73805fb87dc84271d319df9fe4
MD5 e81ac6016a62b89a8b2c461d494ffbea
SHA1 e277a4e52c2aa0ea5af6ed2c06ce8c10c3161022
SHA512 2428bbeba9f8ef543df0c0bd1bb7431983e82f1f34fcb5d5015861e064b4fbfaa57eaa7b0efef7970437ea315bd3ad604518b0b613ff4bb55d9c6e5cd2c7a0d9
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFI:IhnLrHp/qKm2/Sb/gqAZjI
TLSH
T1FEE59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8Sunw8.exe

Path C:\Windows\8Sunw8.exe
Size 3.1MB
SHA256 c4641f6b25f33438d3a4b79494486f10ad9d35bafd2e768fb4201a21f1573388
MD5 39f20576992b5257afb83d7097170cc6
SHA1 bdb9c0d7ebcd680401ff938b5ed55e729eb8dab5
SHA512 b7b1242660f1cd6e03d9d42520e18dadb9f7a02ec2a3a3bae852558a570f2afac871ce2d67012d56d427a7fe4b3c75962b54be3ba581447da324d17a3980c351
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFG:IhnLrHp/qKm2/Sb/gqAZjG
TLSH
T1ACE59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BuH9rmxzeGKIyJ.exe

Path C:\Windows\BuH9rmxzeGKIyJ.exe
Size 3.1MB
SHA256 0d35501bc48f39f8be04eb9123853cc6b5e7f4aa9009ac7ad668edbd41c502a5
MD5 d4c7895b575b30e19aea3bc362ad874a
SHA1 ccb4992b2e843ee45a4e2d242b54d26c9d018589
SHA512 311b7aececd9832d80f33142f4466e00f4f1f426b8c4fff8bbb130252c76460f2c0e2feebd97d9d39d9da23e4e041399113c48d6892c6536718ce8208d7e145f
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblF2:IhnLrHp/qKm2/Sb/gqAZj2
TLSH
T1F8E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GGinap8.exe

Path C:\Windows\GGinap8.exe
Size 3.1MB
SHA256 61ad439af1a74cbe9854d43853f26ac7bfd20b727a7b99a4145c4fec94ba3e05
MD5 116709d9899f433f68dfbafcf922563a
SHA1 df2d9d1d07257f1467b609ff74f701a5ef510e8e
SHA512 900511cf67d7326e37b0fc78e550ee07218218de76e92d9e2ae6339cf62989876e9772d918cd682418b45bb483332ee943c3bddc26ab1069b3b0c8be8e378dd6
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFq:IhnLrHp/qKm2/Sb/gqAZjq
TLSH
T100E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

K5vb22c6tK.exe

Path C:\Windows\K5vb22c6tK.exe
Size 3.1MB
SHA256 85506fac9a8760d5227f6c486da5d2bd6a76d485d87411fcd7f85906aa6999a9
MD5 26ecca202eb4438cec64603d1ed0357e
SHA1 da4e256fb2c2eb619ccd3c4feffc63aec4ca2d5d
SHA512 23d5ccaea6b8879cc02e405db30d22c67aa6f5a434df7e3c35514f8d5d7b45125d6661644ebab80628ac53ee5633eecf0d99ba506e8276860585886f8c576934
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblF7:IhnLrHp/qKm2/Sb/gqAZj7
TLSH
T1CBE59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lr1s8nRwJi1VOkp.exe

Path C:\Windows\Lr1s8nRwJi1VOkp.exe
Size 3.1MB
SHA256 b6709286646cef2c8520b7f3fc4d4da1004698545b30960c2c822e8c8642f765
MD5 d744311b37959f8a2e875834d9218b11
SHA1 f147e43472d7157ff0f055324df43fb9111ec220
SHA512 91a051f4bad677b79aeb4e5c8f5023d7de0a76d214220163ec5cd98020f5b7c3c80497f7ec52fc7a6d2f8852bbdf3778467d70aeb488fc67042b30bcfb7515f1
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFS:IhnLrHp/qKm2/Sb/gqAZjS
TLSH
T10AE59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MHnTCi9lP7B0em.exe

Path C:\Windows\MHnTCi9lP7B0em.exe
Size 3.1MB
SHA256 835f95ee3b572659fd20778e64dd8dd62359b4647390bed52099631e989b917d
MD5 a775b865ad7dad268a8fd8551460c468
SHA1 51595287068f1a150565e56dd9dc0118dc6cd7a0
SHA512 b13f7cf72f357afe48585ca2309640d94025a3d345533139a136962d0fb900072a7517c43be15e9fe3871a2e9b8e3db5b8f0b3e8cd2e509b8170044bd854e5b2
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblF8:IhnLrHp/qKm2/Sb/gqAZj8
TLSH
T1C6E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QNrSKKWcL9EI.exe

Path C:\Windows\QNrSKKWcL9EI.exe
Size 3.1MB
SHA256 f58245c392c83a3e36fde47c2b70dc2c072872277abc86727bb7f851f13b0a3e
MD5 03051ccf17293891c52c0bfa30b61562
SHA1 7509c922fb374eee515b72cd62ba32f47c23f006
SHA512 dee0ea4f1232d612e3830847eaa733f9de761ddacaf95d74fbe6b96c1c4018e638614bfab3be7c3faaf20b0f8795068fbe61f6b03489f0738a12453bb0bc30ea
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFD:IhnLrHp/qKm2/Sb/gqAZjD
TLSH
T18EE59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RHaa9A1u81.exe

Path C:\Windows\RHaa9A1u81.exe
Size 3.1MB
SHA256 d7c12c277803bfd43e776be626906c5407bbb9e22a6a7fbe79381ddc7b64116c
MD5 a5556a54d529b82593607d85e9687cf0
SHA1 30f62432403bede7ca491b31cef20d3bbeb33e59
SHA512 090837073dd4e7785c6631dbaf78fb67d7a9c3cfa595d593e8d36b4d16079642b06c56fc2b61c75735a821b9477840e1c050f59232470164a6dc37bf166c7ff0
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFV:IhnLrHp/qKm2/Sb/gqAZjV
TLSH
T189E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

T2OkSAIJ4h.exe

Path C:\Windows\T2OkSAIJ4h.exe
Size 3.1MB
SHA256 7ce563cfa69308f2b084add02342592faaf2020af017b8f2eefb46435f4f2147
MD5 7f1d3e4a12666a96f888ef68063c3f71
SHA1 27bb40719e76feb661efaf33d9982504a4eab363
SHA512 e9fb429909707daff566349d14a1f3b9534dc038ac7bd954ec1f093ac3a172150d2b631bcb865154c2ca1f536a0cb8d9c71cdeb04312ab0dc01d22c3eed6a5cb
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFB:IhnLrHp/qKm2/Sb/gqAZjB
TLSH
T1C5E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UKp2JMim6J4tCn.exe

Path C:\Windows\UKp2JMim6J4tCn.exe
Size 3.1MB
SHA256 920f28376fff7b918a8c9a39759e176febaad8598a28cc642a654feaf49200d3
MD5 db6d7c472f1d7eed154a06d14b0018dc
SHA1 b28eb06637ccb2a3d53f021339741dcf360c323b
SHA512 b9bddad2763ac7a87067de4aee82bf5975af33653ef0a62427987f577404b74f70784d85e0efc8daa6d58587b1d5d0701f054728cf7bd19c1da18c084dcfd47b
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFL:IhnLrHp/qKm2/Sb/gqAZjL
TLSH
T127E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XsdXuXw7Azybv.exe

Path C:\Windows\XsdXuXw7Azybv.exe
Size 3.1MB
SHA256 11f5fbf0d0bdaef6db6d54208b08f4ab8337915c6c9b3a727b8002ac569c525d
MD5 42a56bc184be278304136727412d8ed6
SHA1 ae8a4a911a2f9db73af55f6e4cf5e7e56cdfc692
SHA512 a8056eb62f8a5cfd35e9caee47f5b1f723c5f16a78d83ee26cd4c0a81799f8b7e48d7675d51a8781b64af83faf61fdacbc62cebbc6944792d7bb2b663d815e0b
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblF1:IhnLrHp/qKm2/Sb/gqAZj1
TLSH
T187E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YFHzx4D31sMbuH.exe

Path C:\Windows\YFHzx4D31sMbuH.exe
Size 3.1MB
SHA256 34804ed4ca9772425bee2d0285e129ed72e07b59c16f0f3d65d8c87260a73320
MD5 c904748c5c837d88bcd126a8f2d25002
SHA1 aa517a55aeb8b1ce6f07fd1c1aaf8657e01a7e0b
SHA512 6696349a3519c36abecb963f654c123a1f97d0aced4565be8e5a3f552d89ec653a308e59fc19cb09354f4f2d14289b853cb08eab438a5e2438d0689d9ed5984d
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFG:IhnLrHp/qKm2/Sb/gqAZjG
TLSH
T173E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Zj7huMcvxy68j.exe

Path C:\Windows\Zj7huMcvxy68j.exe
Size 3.1MB
SHA256 28bb1e998d1cc984fb0244f3f91ad9f507a080240ea9493bd3c4a2a90218165f
MD5 524ac0615b01032104d1cfc07e0c66a0
SHA1 dabb7538c8668fe0a8702ab139bfb02abee87985
SHA512 340df8327973b36c3dd12b1eb86a19a46822b591cdfe2af3d6fbe4858297e6cb51391b826ae704de04c898db0fb028e225c9904ad0c3e66bbf9557ca1004fd80
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFS:IhnLrHp/qKm2/Sb/gqAZjS
TLSH
T1B1E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cAeNc4K6h.exe

Path C:\Windows\cAeNc4K6h.exe
Size 3.1MB
SHA256 60191ab382cce429932f32fd4a93d51d463dc6c573fdfe4144ecaba1cf0d0293
MD5 d97a3451b97bbe2255b3787d10b88909
SHA1 40965a3d28d8417c0981a4ada653cc6bc9617217
SHA512 f8a61d3357ac031e93dece41b17bd95a131931d4350329b24abd5d63173b2bea471ad092ad9c1a659418e60d6aff3d950076aa52350c992f8a47d583e44453f8
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFw:IhnLrHp/qKm2/Sb/gqAZjw
TLSH
T10AE59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cSv7j.exe

Path C:\Windows\cSv7j.exe
Size 3.1MB
SHA256 513d112dfcea3c3299f027d7a8886e874bdd55fcc839f4ec33eed266b7aaf874
MD5 8e09ffd9dbe5a68d20910dce65f0245d
SHA1 32d5f862ef9271db3ccd98a9b18f5505d7cd4637
SHA512 3dfe9d4f3c6cf5861da4c8a1755c69f7873f0e1ade5741113de60ffb6a823c8da55a8373d625019654126b16a1d71f8cc58150c44b1eed9b65c833c1873bc3de
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFW:IhnLrHp/qKm2/Sb/gqAZjW
TLSH
T16DE59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr6Hz.exe

Path C:\Windows\hr6Hz.exe
Size 3.1MB
SHA256 c10a708450c9a264b181653cb181908c07fe6685b845d507a05c8191c9bfb302
MD5 5f848b20e24b7dc8538e2f906e66f94d
SHA1 c5be66437e62b6d1744e49893c47dd2f2ed83b10
SHA512 5f8a158ea7dcc08f676c43cc95c967557a2108a073c7e67f2ca537ace1af5411f634c9d95688802ab95b72d3f961612b5a5b8c576399695890767a2d7a2148a7
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFC:IhnLrHp/qKm2/Sb/gqAZjC
TLSH
T16DE59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jYQH7joF7.exe

Path C:\Windows\jYQH7joF7.exe
Size 3.1MB
SHA256 50fad172524b3d5d7f8089482d78ba3a9465e80919e011b6ed518f93ffabb7e4
MD5 74fa6b3151976aaceb5b1a7b12165963
SHA1 6b3bef77f7d9c0f31038798c0e55cc653d3ba010
SHA512 36d9b3c3187b893f1478cb80d08b432d615fce7f0645fb497cc2cf50c8def0aa0eb4732e4f1b5a38bc5cbb641beb64941f355aea261ccdf5440b28510d6d6e46
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFu:IhnLrHp/qKm2/Sb/gqAZju
TLSH
T194E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

l71K6bn.exe

Path C:\Windows\l71K6bn.exe
Size 3.1MB
SHA256 3e6c7c8962974a1e5eeb935065ca9401333387af64bcc91a9430bf74fe53ed97
MD5 b8e6e1381d0a4a4bb5ac69e6384d47ff
SHA1 66327ec5a0c8ca125b964b2b94a6ed92b5abb3c1
SHA512 c3814b8de9d55c75730c91357a772919073d1a7751562d4dbadbfe9ffd3342ed3210cc63d61f96b50e5b6ac15a1234fd755cb9c28da4694ce8a722f9a9943021
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFm:IhnLrHp/qKm2/Sb/gqAZjm
TLSH
T149E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsm3ivPdjY9gH.exe

Path C:\Windows\lsm3ivPdjY9gH.exe
Size 3.1MB
SHA256 77631b5f1ac0895ecc20c266c4a8016c639cff15c25041d7848b741352b4f5ad
MD5 3060b03fab13b1857be376a59e084704
SHA1 e35910b381edf0738ed0af0b0a64ab6069eef024
SHA512 ee062b91468eb3afd676907da3b1cc34dc5fc7c220c55157c9c86ed4c0a95d7fc5fb0bbeeb88266d91d2c37a17c64887bc87b8e581106cab6fa3dcaa858ea96f
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFt:IhnLrHp/qKm2/Sb/gqAZjt
TLSH
T186E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tCI9S8R.exe

Path C:\Windows\tCI9S8R.exe
Size 3.1MB
SHA256 c6ef7eb18fa495a4260a402c9b0263b1e40cf2558ac7c1bdbe05da473b156e35
MD5 38bc9d42904f1fb895ee9db618d25f51
SHA1 bf852bd9077b9db985b1e49d16f8a5a975185405
SHA512 33018ebd91176154f7b37fa88dda2bff2a36ffd7e60a0f694362bd0126981256ae4b602562ad5fa342a4d90b000abe78826c038d330964679c0ec9cff508857d
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFs:IhnLrHp/qKm2/Sb/gqAZjs
TLSH
T106E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

u542SPSnMDq.exe

Path C:\Windows\u542SPSnMDq.exe
Size 3.1MB
SHA256 7d482b57ee75a99a7ca13a2a5185158e1f424ac0745b6ec429ff3326cb675c00
MD5 fb72cb2377e645000041f94cb45693e6
SHA1 7a8dfa978a7c1f181596a54f27a4b3349be4d094
SHA512 0ba3e9b0b3760ab8a737a9a1eb773392fac2f71cbeda418440df8b0b2e76c709482cb2356a3571e606dbb61025a6e3484b3f28b44dd17442fc8880e2580ae45f
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFo:IhnLrHp/qKm2/Sb/gqAZjo
TLSH
T1D7E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlJjzXG1VNv3k.exe

Path C:\Windows\wlJjzXG1VNv3k.exe
Size 3.1MB
SHA256 d7e2d0d2a2212f73b7289ca05597d10ddc5530d4e978a69d4f7c8053c1c2a5e5
MD5 ed83ad789dc7b035d265d97e4124a38a
SHA1 ec0c3a305bdb0d7b3f10ccdc34a75c8d31ffc6e7
SHA512 37675432c27dffbc67740e47a573cc961927623b595692594a2f9b21b757fe3d33f5c0b49b555530fc1738701cfa18243a61de5b4886999e056ea2f75de0cec9
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblF/:IhnLrHp/qKm2/Sb/gqAZj/
TLSH
T130E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xJJ9w7q48lp.exe

Path C:\Windows\xJJ9w7q48lp.exe
Size 3.1MB
SHA256 72fb0923d91dcd020e863e9008e65fc129e816cb04ad71a98ca4cb2fa04f3b67
MD5 18def305f44233e283bff1c7e1d19cd0
SHA1 745fc7eacee6fcf90dbfa95e844bc37c4c02fe51
SHA512 f71ef6da28ec1e73b3b692d98d80f1e7e063fc64eb4801ae30793b8df8e009fb95d23cbbfc29e2ed414d99565239ee7c5f2460cca0892836ac6bf5e18fd27013
SSDEEP 49152:I2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblFK:IhnLrHp/qKm2/Sb/gqAZjK
TLSH
T199E59C53EBD24AE8F78D05365B584140D72EEA219A4F2321346C225CDFA73878F65E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-136-0x00000000063B0000-0x0000000006471000-memory.dmp

Download

memory/920-114-0x00000000063F0000-0x00000000064B1000-memory.dmp

Download

memory/1016-60-0x0000000006830000-0x00000000068F1000-memory.dmp

Download

memory/1464-41-0x00000000063B0000-0x0000000006471000-memory.dmp

Download

memory/1532-107-0x0000000006050000-0x0000000006111000-memory.dmp

Download

memory/1596-127-0x00000000063E0000-0x00000000064A1000-memory.dmp

Download

memory/2400-29-0x00000000063A0000-0x0000000006461000-memory.dmp

Download

memory/2496-228-0x0000000006430000-0x00000000064F1000-memory.dmp

Download

memory/2996-116-0x0000000006440000-0x0000000006501000-memory.dmp

Download

memory/3056-318-0x00000000063E0000-0x00000000064A1000-memory.dmp

Download

memory/3056-154-0x00000000063E0000-0x00000000064A1000-memory.dmp

Download

memory/3156-67-0x00000000051F0000-0x00000000052B1000-memory.dmp

Download

memory/3472-98-0x0000000005550000-0x0000000005611000-memory.dmp

Download

memory/4372-74-0x00000000063A0000-0x0000000006461000-memory.dmp

Download

memory/4604-53-0x00000000064B0000-0x0000000006571000-memory.dmp

Download

memory/5076-282-0x00000000063B0000-0x0000000006471000-memory.dmp

Download

memory/5076-86-0x00000000063B0000-0x0000000006471000-memory.dmp

Download

memory/5296-145-0x00000000063B0000-0x0000000006471000-memory.dmp

Download

memory/5580-163-0x0000000006070000-0x0000000006131000-memory.dmp

Download

memory/5608-100-0x00000000063E0000-0x00000000064A1000-memory.dmp

Download

memory/5608-626-0x00000000063E0000-0x00000000064A1000-memory.dmp

Download

memory/6236-152-0x00000000051E0000-0x00000000052A1000-memory.dmp

Download

memory/6304-224-0x00000000063E0000-0x00000000064A1000-memory.dmp

Download

memory/6308-123-0x0000000007C50000-0x0000000007D11000-memory.dmp

Download

memory/6316-214-0x00000000060A0000-0x0000000006161000-memory.dmp

Download

memory/6576-218-0x00000000064E0000-0x00000000065A1000-memory.dmp

Download

memory/6576-530-0x00000000064E0000-0x00000000065A1000-memory.dmp

Download

memory/6612-194-0x00000000063A0000-0x0000000006461000-memory.dmp

Download

memory/6884-230-0x0000000006480000-0x0000000006541000-memory.dmp

Download

memory/6892-222-0x0000000006050000-0x0000000006111000-memory.dmp

Download

memory/6924-204-0x0000000006450000-0x0000000006511000-memory.dmp

Download

memory/7324-234-0x00000000065C0000-0x0000000006681000-memory.dmp

Download

memory/7572-240-0x0000000006590000-0x0000000006651000-memory.dmp

Download

memory/7572-394-0x0000000006590000-0x0000000006651000-memory.dmp

Download

memory/7824-248-0x0000000004D30000-0x0000000004DF1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads