97adcdc53555b182455fe35efc378dc3cb3a39162b74a4d9d6861702ab803ee3

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
Size 2.0MB
Sample260720-dfct5sds6k
SHA256 97adcdc53555b182455fe35efc378dc3cb3a39162b74a4d9d6861702ab803ee3
MD5 7d51b31b3e8263b431e9823311f8e7c3
SHA1 17cc5e39ac54bcc990a6f88032eeebf1ed57da7f
SHA512 4b2f204a84344840a3120f93e40216a79e1f54e56f39ad8740cb68a3d5703c75fcc80bc03a73b02339a1bdcfce96e33b43020069899d4897453ccfe54333328d
SSDEEP 24576:6hqNgjiuCDZXicr4M3zAIooBpBnTeH2uPjI550xcbwqz+NnvCpG3fr6:6RizNvboInTrNkAwqz+9Q++
TLSH
T155A57C13E29280A1F078267156B60735FE74AEA14D3496DBB7E4CCB81F326708BA771D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 42 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4556	netsh.exe
4312	netsh.exe
4684	netsh.exe
4828	netsh.exe
5884	netsh.exe
1632	netsh.exe
4796	netsh.exe
2672	netsh.exe
3508	netsh.exe
2072	netsh.exe
2860	netsh.exe
5956	netsh.exe
4128	netsh.exe
2808	netsh.exe
3692	netsh.exe
4332	netsh.exe
3644	netsh.exe
1600	netsh.exe
1976	netsh.exe
2716	netsh.exe
3976	netsh.exe
4884	netsh.exe
5920	netsh.exe
932	netsh.exe
4224	netsh.exe
6000	netsh.exe
3228	netsh.exe
3348	netsh.exe
2356	netsh.exe
4700	netsh.exe
3720	netsh.exe
5316	netsh.exe
3172	netsh.exe
4672	netsh.exe
5872	netsh.exe
1372	netsh.exe
2500	netsh.exe
4592	netsh.exe
5264	netsh.exe
4168	netsh.exe
3812	netsh.exe
5196	netsh.exe

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	7	139.224.142.99	1464	nslookup.exe
Destination IP	6	139.224.142.99	1464	nslookup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3792	cmd.exe
2780	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2072	PING.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2072	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4944	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4944	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4220	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
4220	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe

Suspicious use of SendNotifyMessage 23 IoCs

pid	Process
4220	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4220	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
4220	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 3792	4220	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	89
PID 3792 wrote to memory of 2072	3792	cmd.exe	91
PID 3792 wrote to memory of 1820	3792	cmd.exe	92
PID 1820 wrote to memory of 2780	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	93
PID 2780 wrote to memory of 1464	2780	cmd.exe	95
PID 1820 wrote to memory of 5316	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	96
PID 1820 wrote to memory of 3172	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	97
PID 1820 wrote to memory of 5260	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	100
PID 1820 wrote to memory of 3348	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	103
PID 1820 wrote to memory of 4168	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	104
PID 1820 wrote to memory of 2808	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	107
PID 1820 wrote to memory of 5920	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	108
PID 1820 wrote to memory of 2716	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	112
PID 1820 wrote to memory of 3976	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	113
PID 1820 wrote to memory of 4672	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	116
PID 1820 wrote to memory of 3692	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	117
PID 1820 wrote to memory of 4884	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	120
PID 1820 wrote to memory of 5872	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	121
PID 1820 wrote to memory of 932	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	124
PID 1820 wrote to memory of 2356	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	125
PID 1820 wrote to memory of 4224	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	128
PID 1820 wrote to memory of 4332	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	129
PID 1820 wrote to memory of 2672	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	132
PID 1820 wrote to memory of 3644	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	133
PID 1820 wrote to memory of 1372	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	136
PID 1820 wrote to memory of 3812	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	137
PID 1820 wrote to memory of 5196	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	140
PID 1820 wrote to memory of 5884	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	141
PID 1820 wrote to memory of 5956	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	144
PID 1820 wrote to memory of 4556	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	145
PID 1820 wrote to memory of 3720	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	148
PID 1820 wrote to memory of 4128	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	149
PID 1820 wrote to memory of 5264	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	152
PID 1820 wrote to memory of 1632	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	153
PID 1820 wrote to memory of 1600	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	156
PID 1820 wrote to memory of 4700	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	157
PID 1820 wrote to memory of 3508	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	160
PID 1820 wrote to memory of 2500	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	161
PID 1820 wrote to memory of 2072	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	164
PID 1820 wrote to memory of 4312	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	165
PID 1820 wrote to memory of 4684	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	168
PID 1820 wrote to memory of 4592	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	169
PID 1820 wrote to memory of 4796	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	172
PID 1820 wrote to memory of 4828	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	173
PID 1820 wrote to memory of 2860	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	176
PID 1820 wrote to memory of 1976	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	177
PID 1820 wrote to memory of 6000	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	180
PID 1820 wrote to memory of 3228	1820	2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe	181

C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Restart.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2072
- - C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c nslookup -qt=txt quellgtaver.mageangela.cn dns29.hichina.com >C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\nsVer.txt
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2780
    - - C:\Windows\SysWOW64\nslookup.exe
        
        nslookup -qt=txt quellgtaver.mageangela.cn dns29.hichina.com
        5⤵
        Unexpected DNS network traffic destination
        System Location Discovery: System Language Discovery
        
        PID:1464
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:5316
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3172
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-20-3-57-0.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:5260
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3348
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4168
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2808
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:5920
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2716
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3976
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4672
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      System Location Discovery: System Language Discovery
      PID:3692
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4884
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:5872
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:932
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2356
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4224
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4332
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      System Location Discovery: System Language Discovery
      PID:2672
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      System Location Discovery: System Language Discovery
      PID:3644
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1372
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3812
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      System Location Discovery: System Language Discovery
      PID:5196
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:5884
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      System Location Discovery: System Language Discovery
      PID:5956
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4556
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3720
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4128
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:5264
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1632
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1600
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4700
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      System Location Discovery: System Language Discovery
      PID:3508
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2500
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2072
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4312
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4684
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4592
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4796
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4828
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      System Location Discovery: System Language Discovery
      PID:2860
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1976
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:6000
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d51b31b3e8263b431e9823311f8e7c3_elex_emotet_icedid_remcos.exe" action=allow enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3228

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004BC 0x00000000000004C4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QuellGTA_log_2026-7-20-3-57-0.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-20-3-57-0.txt
Size 543B
SHA256 6f0f430747906fbf3311aa1127147c18a42b56307f05a9dbd77c5384d4bf38fb
MD5 0666c0027425ac6ed1679ee541694658
SHA1 e719a8dd59e8efbdb3bccbe13a6a611d4008a6e1
SHA512 ca336ee449265f89a66dadd83be7927c68c19d2ee13340f192ded3a8f88c7eb43b7608c4d8592f29c70520c40a34e3dd1723911a9d0d08466bf70632ea1ed960
TLSH
T130F0C00D83785037AE600390C29B128AD77C764B131C47759C56A08D57341DB8EAA4D4
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 302B
SHA256 d99f9f36979929c0d0c0c6edb2a4b6bb7ee793017b316c6530aabe3324c69ef9
MD5 24e394ac282bfe1c91e83f40977bb6da
SHA1 4310b479a5eda3d43660875dcb692e700e514889
SHA512 ef45ccc970d1145a4050e23379bf0b286080163e00770f905e9df01cf577653576a3fdf36484d97106c1723d05cc922fd2c45c28a8c4f4d63f3c79019302eccf
TLSH
T143E0E78DA0D42530D30C11410E5253F1F0B813F29438C8FB8CCE411675C373CC30421A
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 302B
SHA256 073a86ef402b8705b0eaf5ebc9c74cb06eff7d21d2f6b01e8092663b615180bc
MD5 63d526f0afdda585f00c91af94fc5833
SHA1 754b3b6819dfce54e1d846d9860c00b8ec92db03
SHA512 adde138020c9626d7044993b4ea7c27fa3f46bb356f083e5fc381e4ae08757e86b1d3c7ed8cbbdc3523c6eecdbd8b397dc2d6ba3bbb30d2d08c082f0f9d4a64e
TLSH
T1A8E0CD8D60D45570D24C55410E5267E1A4B412F29439D8E79C894515658663D8315659
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 146B
SHA256 481390a6b6953c00c23effd6ce6bef7afdf51b8e0fe3add7a036168f6a2f59af
MD5 158ee6a5ad3168d229f0d9bcf20760a8
SHA1 3748b60f5c5ddc883270d6332e6e1558e68cd5cc
SHA512 cfb8257b961d20694a34c3d6a639eaf75b2e94097b2fd0d36e29a6269b6557a1e9dbc9e9d2b1809663afb69cb2acb81bdb4b3c1a461d35c3299f4ffc9e712767
TLSH
T148C08C4C419C1630834D628604E133B1A89823B5A43068A3A8884621728686C8024013
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 302B
SHA256 e4a3b803295dbf7b47a1c15b544612d32a29dcd96f739795e0def5ae0fe2831a
MD5 583abb28d3d45caac5c8ecf2508f8992
SHA1 5833efb14a3a08db7445a27c33188fa15f08aa0e
SHA512 d640e7eac02ec4ec07a4cdeea83d8ab384db5859d7ad0bd11e834f2a0e22a537001531953a8805ff1f97146dff8030a43ec7e593eee89a413f6242cb01d283de
TLSH
T1B9E07D8D60D42570D20C15410E5257E1A0B412F29438C8EB8CCA4116658263C8305219
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 302B
SHA256 af70474446b25c705d11da2efc7626cc997abdba5bade514c61bd28b85e5da1f
MD5 d6604db155fa42a4558b374054433749
SHA1 3980db84ebe3c3a288ed30328478f58b8f5525c5
SHA512 7fb27ed44ac43ca4daa1ea9ba5414ea1e0cc5205ea0994f63cfa36db3caa93740e22e613e65a64d4480966adbe229a8f99fb63c225ee981b88064e1b6a499a29
TLSH
T167E0278DA0D45570D34C51410E5263E1E4F413F2943DD8F7DC8D451575C663DC31465A
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 237B
SHA256 87d7a91bd563c2bab9c1c173a93988b05336016b789311d0be7b970cf7d0b735
MD5 3674d5a55026db5a4f905c7418f2f9fe
SHA1 6fdd56e86fca59130a47aacbd2d9e1f89c35cabd
SHA512 afed100f0f5389e7dc832738024764c58569bd9bfcf6f357b687fd0b3ca1e77f0921416fdd4b11fd5423dfed1219beb515624278b9c89d01102a6a69c5b4683b
TLSH
T125D0A78E60A82670D34C56460DA167E1F4E852F5E030DCEB9DC58621758663DC21955A
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 302B
SHA256 cc1c6facf43e20a3e481b68a9831c5f4c58a426a7124680e034f7f4674716cdb
MD5 d62015308586281e6140c31228e00a38
SHA1 712e5dda30bff74a1f4119387fa9da57432f0021
SHA512 2d31696e001ffc9ec0293333024f93adb55015e51a6326069e6aa739d74f9e023ffa11ef4a1200f4053496126172ab52d93542e95e7a7e4fce2f5520420411cd
TLSH
T12CE0CD8DA0D41570D24C51410E5253E1A4B412F29439D8E79C8A4516658663D931565A
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 302B
SHA256 7e43d3d6ee0c04bd81f93c262fec185877cd7cfeb63acd280839384c07121477
MD5 fdf6c166bfab225a18a4546733e5b3a9
SHA1 3577ab5de2969c45672273e214c335ee4ad7187c
SHA512 c26ada7adcdbf34575438eb8f9db84211fb09c70555b6c09ff9aea2fe5e21e69f40cfe055457d0113ba42596557b43cedf420a0cd6299a8936a9707023b3e919
TLSH
T10CE0E78D60D42570D30C15410F5267E1E0F413F29439C8FBCCC9411575C363CC304219
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 30B
SHA256 5b0dee7ab0aa70e91fcc8f4823eea250aa1be3872ba0ca4b354f4862d954436c
MD5 ddbc9fd7175e4cd47b40e652498a90c2
SHA1 5181ae0fe9af2dc74f59cc4e1197dd0a69a2a774
SHA512 f599042f41121c03a263e08931be044c9742eeee5f2cb90a4c5c2a8cbf0dc54eb2fd074285048c98a19ef095806e8e43ad505b7b208dfcbd9e8b571f01c04b4d
MD5 SHA1 SHA512

Submit Download

Restart.bat

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Restart.bat
Size 191B
SHA256 6aa834e5dcad0d03ce44408c5e66b3173f033de2e57b10d7c0352dec048beb93
MD5 070ea0493c5919dd42667edc60ebfa10
SHA1 8a34b553b4f4ac89f0f707153d6f2a404e431915
SHA512 b3145ae63584473aafcf0d6936f4575316d04eba77d2ef34edd3a0021bb7755c52983e518a4e2e844e17241cae8b2fe33197037c0431732ef3b5ec5c544d3767
TLSH
T113C0220295140D948807663A00AF2B0EE0A8888D274215C49602CC910683C30B2EC210
MD5 SHA1 SHA512 TLSH

Submit Download

nsVer.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\nsVer.txt
Size 91B
SHA256 fc18740a5c3e0639d5351dbe087f77b11371ba588bab997fe0586edc95c709fa
MD5 e0136c064e4232e0446ecbd37cd7a221
SHA1 9f84a90dfae83b5952851243b09a002d56917b39
SHA512 b736cda7484d8b89f0667416f46dd3bd360fc7b5127f73891309c7b892c2a5d8e9112ef361c666d0de7fec3ff171dfc70764aca698667e31a5fe258c7bd41329
TLSH
T1C1B0126841E3C9A0C548459530B23580034448C0944DD404308C4B1C052010C5F1A00C
MD5 SHA1 SHA512 TLSH

Submit Download