e85d3a25c89f9b331bb76b86800d36e2bbfc8427c305573a4efa4056aaf3854c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 05:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_dbac7a58667051370e80d6fa74790022_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260804-fxf91agl3x
SHA256 e85d3a25c89f9b331bb76b86800d36e2bbfc8427c305573a4efa4056aaf3854c
MD5 dbac7a58667051370e80d6fa74790022
SHA1 1090c33ce162d40bcf1590d040ac2063b7aa69a8
SHA512 3c113632784397ade936fd387e1c0e73ba1182227b2fd54308e57dfaf6096dd33c774b0b32e78ea4200ea86be38e18fbb2e607a1b56d664f86ce434eb51a301a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFous:0NA1Yakeer5+nso/
TLSH
T11405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (3307) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 36 IoCs

pid	Process
4888	LZvrv0vT.exe
3308	7CAuzb4v8W.exe
4332	2mnHpFvXcUs.exe
3188	r5HtWsvHix.exe
2000	7rWCLGG1.exe
228	eqjD9VE9v.exe
5196	9JWau1sSah.exe
5680	ZgKDjxXcqBgQXs9.exe
6028	WUliSeMwuTix.exe
3040	6B7qp.exe
6408	YScuwvVcDolo.exe
6676	LVEwqMmM.exe
6912	p3RUXzwMqeiTPF.exe
7156	sluELF.exe
2740	PUSgHF.exe
5676	zYKEq67l.exe
7324	23xbHLsNzrgQLc.exe
7568	yqx8q.exe
7812	EV1wg9P8OwL02mp.exe
8056	ZEYMKqDS.exe
7820	FOaDAKX8.exe
8364	bnDoalRshg69a.exe
8600	OFMjCDl4OsIkWgv.exe
8848	ULSV9x7t.exe
9096	HP4MOCAysQgg.exe
9036	1y601cOWvJ3sDr.exe
9472	7LY6wns8xo4SGC.exe
9720	zjH7i.exe
10020	3mmWKCdkoV.exe
8852	ZM2ZoUnE93GuXNX.exe
9756	p186HvLP9qzNHDj.exe
10276	xNp3v90Foz3.exe
10576	6QmOxeXzC.exe
10828	CND9MbyzA4zNp.exe
11080	C4ZvKQ4z35.exe
10284	Nayp4BNCi9uHV.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F-PROT = "C:\\Windows\\LZvrv0vT.exe"	2026-08-04_dbac7a58667051370e80d6fa74790022_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SWNETSUP = "C:\\Windows\\2mnHpFvXcUs.exe"	7CAuzb4v8W.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RULAUNCH = "C:\\Windows\\PUSgHF.exe"	sluELF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MGAVRTCL = "C:\\Windows\\yqx8q.exe"	23xbHLsNzrgQLc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVKSERV = "C:\\Windows\\1y601cOWvJ3sDr.exe"	HP4MOCAysQgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCAN32, = "C:\\Windows\\7CAuzb4v8W.exe"	LZvrv0vT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVKPOP = "C:\\Windows\\FOaDAKX8.exe"	ZEYMKqDS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZONEALARM = "C:\\Windows\\ZM2ZoUnE93GuXNX.exe"	3mmWKCdkoV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TDS2-98 = "C:\\Windows\\xNp3v90Foz3.exe"	p186HvLP9qzNHDj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPM = "C:\\Windows\\7rWCLGG1.exe"	r5HtWsvHix.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFIADMIN = "C:\\Windows\\6B7qp.exe"	WUliSeMwuTix.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCAFEE = "C:\\Windows\\sluELF.exe"	p3RUXzwMqeiTPF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ALERTSVC = "C:\\Windows\\ZEYMKqDS.exe"	EV1wg9P8OwL02mp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PROGRAMAUDITOR = "C:\\Windows\\HP4MOCAysQgg.exe"	ULSV9x7t.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVGCC32 = "C:\\Windows\\6QmOxeXzC.exe"	xNp3v90Foz3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GBPOLL = "C:\\Windows\\eqjD9VE9v.exe"	7rWCLGG1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GUARD = "C:\\Windows\\9JWau1sSah.exe"	eqjD9VE9v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MGHTML = "C:\\Windows\\ZgKDjxXcqBgQXs9.exe"	9JWau1sSah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SBSERV = "C:\\Windows\\zYKEq67l.exe"	PUSgHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CLAW95C = "C:\\Windows\\ULSV9x7t.exe"	OFMjCDl4OsIkWgv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SERV95 = "C:\\Windows\\p186HvLP9qzNHDj.exe"	ZM2ZoUnE93GuXNX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCCWIN97 = "C:\\Windows\\Nayp4BNCi9uHV.exe"	C4ZvKQ4z35.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VET32 = "C:\\Windows\\WUliSeMwuTix.exe"	ZgKDjxXcqBgQXs9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NPROTECT = "C:\\Windows\\EV1wg9P8OwL02mp.exe"	yqx8q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVSCHED32 = "C:\\Windows\\zjH7i.exe"	7LY6wns8xo4SGC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FSAA = "C:\\Windows\\r5HtWsvHix.exe"	2mnHpFvXcUs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCANPM = "C:\\Windows\\bnDoalRshg69a.exe"	FOaDAKX8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DVP95_0 = "C:\\Windows\\CND9MbyzA4zNp.exe"	6QmOxeXzC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUSPT = "C:\\Windows\\YScuwvVcDolo.exe"	6B7qp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RTVSCN95 = "C:\\Windows\\LVEwqMmM.exe"	YScuwvVcDolo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCAN95 = "C:\\Windows\\p3RUXzwMqeiTPF.exe"	LVEwqMmM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SWEEPSRV = "C:\\Windows\\23xbHLsNzrgQLc.exe"	zYKEq67l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EXPERT = "C:\\Windows\\7LY6wns8xo4SGC.exe"	1y601cOWvJ3sDr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUSPT = "C:\\Windows\\OFMjCDl4OsIkWgv.exe"	bnDoalRshg69a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NPSCHECK = "C:\\Windows\\3mmWKCdkoV.exe"	zjH7i.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IAMAPP = "C:\\Windows\\C4ZvKQ4z35.exe"	CND9MbyzA4zNp.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\eqjD9VE9v.exe	7rWCLGG1.exe
File opened for modification	C:\Windows\9JWau1sSah.exe	eqjD9VE9v.exe
File created	C:\Windows\7CAuzb4v8W.exe	LZvrv0vT.exe
File created	C:\Windows\r5HtWsvHix.exe	2mnHpFvXcUs.exe
File opened for modification	C:\Windows\r5HtWsvHix.exe	2mnHpFvXcUs.exe
File opened for modification	C:\Windows\6B7qp.exe	WUliSeMwuTix.exe
File created	C:\Windows\EV1wg9P8OwL02mp.exe	yqx8q.exe
File created	C:\Windows\3mmWKCdkoV.exe	zjH7i.exe
File created	C:\Windows\6B7qp.exe	WUliSeMwuTix.exe
File created	C:\Windows\OFMjCDl4OsIkWgv.exe	bnDoalRshg69a.exe
File opened for modification	C:\Windows\xNp3v90Foz3.exe	p186HvLP9qzNHDj.exe
File created	C:\Windows\CND9MbyzA4zNp.exe	6QmOxeXzC.exe
File opened for modification	C:\Windows\ULSV9x7t.exe	OFMjCDl4OsIkWgv.exe
File created	C:\Windows\9JWau1sSah.exe	eqjD9VE9v.exe
File created	C:\Windows\2mnHpFvXcUs.exe	7CAuzb4v8W.exe
File created	C:\Windows\ZgKDjxXcqBgQXs9.exe	9JWau1sSah.exe
File created	C:\Windows\YScuwvVcDolo.exe	6B7qp.exe
File created	C:\Windows\zYKEq67l.exe	PUSgHF.exe
File created	C:\Windows\ZEYMKqDS.exe	EV1wg9P8OwL02mp.exe
File opened for modification	C:\Windows\3mmWKCdkoV.exe	zjH7i.exe
File created	C:\Windows\eqjD9VE9v.exe	7rWCLGG1.exe
File opened for modification	C:\Windows\1y601cOWvJ3sDr.exe	HP4MOCAysQgg.exe
File opened for modification	C:\Windows\CND9MbyzA4zNp.exe	6QmOxeXzC.exe
File opened for modification	C:\Windows\LZvrv0vT.exe	2026-08-04_dbac7a58667051370e80d6fa74790022_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\LVEwqMmM.exe	YScuwvVcDolo.exe
File opened for modification	C:\Windows\23xbHLsNzrgQLc.exe	zYKEq67l.exe
File opened for modification	C:\Windows\FOaDAKX8.exe	ZEYMKqDS.exe
File created	C:\Windows\HP4MOCAysQgg.exe	ULSV9x7t.exe
File opened for modification	C:\Windows\sluELF.exe	p3RUXzwMqeiTPF.exe
File created	C:\Windows\LZvrv0vT.exe	2026-08-04_dbac7a58667051370e80d6fa74790022_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\7rWCLGG1.exe	r5HtWsvHix.exe
File created	C:\Windows\PUSgHF.exe	sluELF.exe
File opened for modification	C:\Windows\HP4MOCAysQgg.exe	ULSV9x7t.exe
File opened for modification	C:\Windows\7CAuzb4v8W.exe	LZvrv0vT.exe
File opened for modification	C:\Windows\OFMjCDl4OsIkWgv.exe	bnDoalRshg69a.exe
File opened for modification	C:\Windows\zjH7i.exe	7LY6wns8xo4SGC.exe
File opened for modification	C:\Windows\C4ZvKQ4z35.exe	CND9MbyzA4zNp.exe
File created	C:\Windows\Nayp4BNCi9uHV.exe	C4ZvKQ4z35.exe
File opened for modification	C:\Windows\ZEYMKqDS.exe	EV1wg9P8OwL02mp.exe
File opened for modification	C:\Windows\ZM2ZoUnE93GuXNX.exe	3mmWKCdkoV.exe
File created	C:\Windows\xNp3v90Foz3.exe	p186HvLP9qzNHDj.exe
File opened for modification	C:\Windows\WUliSeMwuTix.exe	ZgKDjxXcqBgQXs9.exe
File opened for modification	C:\Windows\EV1wg9P8OwL02mp.exe	yqx8q.exe
File opened for modification	C:\Windows\7LY6wns8xo4SGC.exe	1y601cOWvJ3sDr.exe
File created	C:\Windows\ZM2ZoUnE93GuXNX.exe	3mmWKCdkoV.exe
File created	C:\Windows\C4ZvKQ4z35.exe	CND9MbyzA4zNp.exe
File opened for modification	C:\Windows\YScuwvVcDolo.exe	6B7qp.exe
File created	C:\Windows\yqx8q.exe	23xbHLsNzrgQLc.exe
File opened for modification	C:\Windows\LVEwqMmM.exe	YScuwvVcDolo.exe
File created	C:\Windows\p3RUXzwMqeiTPF.exe	LVEwqMmM.exe
File opened for modification	C:\Windows\yqx8q.exe	23xbHLsNzrgQLc.exe
File created	C:\Windows\ULSV9x7t.exe	OFMjCDl4OsIkWgv.exe
File opened for modification	C:\Windows\6QmOxeXzC.exe	xNp3v90Foz3.exe
File opened for modification	C:\Windows\7rWCLGG1.exe	r5HtWsvHix.exe
File created	C:\Windows\bnDoalRshg69a.exe	FOaDAKX8.exe
File created	C:\Windows\1y601cOWvJ3sDr.exe	HP4MOCAysQgg.exe
File opened for modification	C:\Windows\ZgKDjxXcqBgQXs9.exe	9JWau1sSah.exe
File created	C:\Windows\WUliSeMwuTix.exe	ZgKDjxXcqBgQXs9.exe
File created	C:\Windows\sluELF.exe	p3RUXzwMqeiTPF.exe
File created	C:\Windows\23xbHLsNzrgQLc.exe	zYKEq67l.exe
File created	C:\Windows\7LY6wns8xo4SGC.exe	1y601cOWvJ3sDr.exe
File created	C:\Windows\zjH7i.exe	7LY6wns8xo4SGC.exe
File opened for modification	C:\Windows\p186HvLP9qzNHDj.exe	ZM2ZoUnE93GuXNX.exe
File opened for modification	C:\Windows\2mnHpFvXcUs.exe	7CAuzb4v8W.exe

Program crash 19 IoCs

pid	pid_target	Process	procid_target
2780	4332	WerFault.exe	93
9368	8848	WerFault.exe	153
11272	11080	WerFault.exe	180
11348	10284	WerFault.exe	182
11892	5196	WerFault.exe	111
12104	2740	WerFault.exe	135
11296	7812	WerFault.exe	143
11308	7820	WerFault.exe	147
10600	8852	WerFault.exe	169
11712	4888	WerFault.exe	87
11780	3188	WerFault.exe	101
5280	7324	WerFault.exe	139
5348	7568	WerFault.exe	141
6664	3308	WerFault.exe	89
12244	6028	WerFault.exe	118
3212	6408	WerFault.exe	127
11304	6676	WerFault.exe	129
7816	6912	WerFault.exe	131
7876	7156	WerFault.exe	133

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PUSgHF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zYKEq67l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yqx8q.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	p186HvLP9qzNHDj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	r5HtWsvHix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6B7qp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23xbHLsNzrgQLc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_dbac7a58667051370e80d6fa74790022_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LZvrv0vT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LVEwqMmM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C4ZvKQ4z35.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eqjD9VE9v.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9JWau1sSah.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	p3RUXzwMqeiTPF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ULSV9x7t.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zjH7i.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZM2ZoUnE93GuXNX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xNp3v90Foz3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nayp4BNCi9uHV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZgKDjxXcqBgQXs9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sluELF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FOaDAKX8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bnDoalRshg69a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6QmOxeXzC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7CAuzb4v8W.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZEYMKqDS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7LY6wns8xo4SGC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2mnHpFvXcUs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EV1wg9P8OwL02mp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CND9MbyzA4zNp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUliSeMwuTix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YScuwvVcDolo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OFMjCDl4OsIkWgv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1y601cOWvJ3sDr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3mmWKCdkoV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HP4MOCAysQgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7rWCLGG1.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_dbac7a58667051370e80d6fa74790022_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_dbac7a58667051370e80d6fa74790022_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3976

C:\Windows\LZvrv0vT.exe
C:\Windows\LZvrv0vT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 2208
  2⤵
  - Program crash
  PID:11712

C:\Windows\7CAuzb4v8W.exe
C:\Windows\7CAuzb4v8W.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 2308
  2⤵
  - Program crash
  PID:6664

C:\Windows\2mnHpFvXcUs.exe
C:\Windows\2mnHpFvXcUs.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 1984
  2⤵
  - Program crash
  PID:2780

C:\Windows\r5HtWsvHix.exe
C:\Windows\r5HtWsvHix.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 2208
  2⤵
  - Program crash
  PID:11780

C:\Windows\7rWCLGG1.exe
C:\Windows\7rWCLGG1.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4332 -ip 4332
1⤵
PID:3908

C:\Windows\eqjD9VE9v.exe
C:\Windows\eqjD9VE9v.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:228

C:\Windows\9JWau1sSah.exe
C:\Windows\9JWau1sSah.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5196 -s 2104
  2⤵
  - Program crash
  PID:11892

C:\Windows\ZgKDjxXcqBgQXs9.exe
C:\Windows\ZgKDjxXcqBgQXs9.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5680

C:\Windows\WUliSeMwuTix.exe
C:\Windows\WUliSeMwuTix.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6028 -s 2308
  2⤵
  - Program crash
  PID:12244

C:\Windows\6B7qp.exe
C:\Windows\6B7qp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3040

C:\Windows\YScuwvVcDolo.exe
C:\Windows\YScuwvVcDolo.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6408 -s 2308
  2⤵
  - Program crash
  PID:3212

C:\Windows\LVEwqMmM.exe
C:\Windows\LVEwqMmM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6676 -s 2316
  2⤵
  - Program crash
  PID:11304

C:\Windows\p3RUXzwMqeiTPF.exe
C:\Windows\p3RUXzwMqeiTPF.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6912 -s 2308
  2⤵
  - Program crash
  PID:7816

C:\Windows\sluELF.exe
C:\Windows\sluELF.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 2316
  2⤵
  - Program crash
  PID:7876

C:\Windows\PUSgHF.exe
C:\Windows\PUSgHF.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 2108
  2⤵
  - Program crash
  PID:12104

C:\Windows\zYKEq67l.exe
C:\Windows\zYKEq67l.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5676

C:\Windows\23xbHLsNzrgQLc.exe
C:\Windows\23xbHLsNzrgQLc.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7324 -s 2208
  2⤵
  - Program crash
  PID:5280

C:\Windows\yqx8q.exe
C:\Windows\yqx8q.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7568 -s 2208
  2⤵
  - Program crash
  PID:5348

C:\Windows\EV1wg9P8OwL02mp.exe
C:\Windows\EV1wg9P8OwL02mp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7812 -s 1980
  2⤵
  - Program crash
  PID:11296

C:\Windows\ZEYMKqDS.exe
C:\Windows\ZEYMKqDS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8056

C:\Windows\FOaDAKX8.exe
C:\Windows\FOaDAKX8.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7820 -s 2096
  2⤵
  - Program crash
  PID:11308

C:\Windows\bnDoalRshg69a.exe
C:\Windows\bnDoalRshg69a.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8364

C:\Windows\OFMjCDl4OsIkWgv.exe
C:\Windows\OFMjCDl4OsIkWgv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8600

C:\Windows\ULSV9x7t.exe
C:\Windows\ULSV9x7t.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8848 -s 1976
  2⤵
  - Program crash
  PID:9368

C:\Windows\HP4MOCAysQgg.exe
C:\Windows\HP4MOCAysQgg.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9096

C:\Windows\1y601cOWvJ3sDr.exe
C:\Windows\1y601cOWvJ3sDr.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 8848 -ip 8848
1⤵
PID:9324

C:\Windows\7LY6wns8xo4SGC.exe
C:\Windows\7LY6wns8xo4SGC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9472

C:\Windows\zjH7i.exe
C:\Windows\zjH7i.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9720

C:\Windows\3mmWKCdkoV.exe
C:\Windows\3mmWKCdkoV.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10020

C:\Windows\ZM2ZoUnE93GuXNX.exe
C:\Windows\ZM2ZoUnE93GuXNX.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8852 -s 2096
  2⤵
  - Program crash
  PID:10600

C:\Windows\p186HvLP9qzNHDj.exe
C:\Windows\p186HvLP9qzNHDj.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9756

C:\Windows\xNp3v90Foz3.exe
C:\Windows\xNp3v90Foz3.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10276

C:\Windows\6QmOxeXzC.exe
C:\Windows\6QmOxeXzC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10576

C:\Windows\CND9MbyzA4zNp.exe
C:\Windows\CND9MbyzA4zNp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10828

C:\Windows\C4ZvKQ4z35.exe
C:\Windows\C4ZvKQ4z35.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:11080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 11080 -s 1968
  2⤵
  - Program crash
  PID:11272

C:\Windows\Nayp4BNCi9uHV.exe
C:\Windows\Nayp4BNCi9uHV.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:10284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10284 -s 1832
  2⤵
  - Program crash
  PID:11348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 11080 -ip 11080
1⤵
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 10284 -ip 10284
1⤵
PID:11328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5196 -ip 5196
1⤵
PID:11872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2740 -ip 2740
1⤵
PID:12084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 7812 -ip 7812
1⤵
PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 7820 -ip 7820
1⤵
PID:11120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 8852 -ip 8852
1⤵
PID:10764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4888 -ip 4888
1⤵
PID:11688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 3188 -ip 3188
1⤵
PID:1172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 7324 -ip 7324
1⤵
PID:5284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 7568 -ip 7568
1⤵
PID:5276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3308 -ip 3308
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6028 -ip 6028
1⤵
PID:12216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6408 -ip 6408
1⤵
PID:12272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6676 -ip 6676
1⤵
PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 6912 -ip 6912
1⤵
PID:11088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 7156 -ip 7156
1⤵
PID:7904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1y601cOWvJ3sDr.exe

Path C:\Windows\1y601cOWvJ3sDr.exe
Size 804KB
SHA256 42283ac9b4e348b209a2d6e5c4ff4927a5fcc03bddf7f83d6434a473ba523cf3
MD5 6a5546eb607302056911863d123ab46d
SHA1 7fb028f48bad9deeb0136f6515af3fa98fcd010e
SHA512 d2da50555ccbc4006e15391e9051fab0bca7c723d5d7908c34f15501d5069b050c9080b831a44073ca95758e7823b1c95837b737b32d3e83d7da25b51a3c4a5e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouZ:0NA1Yakeer5+nsoS
TLSH
T1C805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23xbHLsNzrgQLc.exe

Path C:\Windows\23xbHLsNzrgQLc.exe
Size 804KB
SHA256 35568e54eb7025693c6207e468b0dc5c73ebd1d511cdc7f3b096e73946d2abb4
MD5 fd3c77e1f2cd316d74e616965a36b83d
SHA1 9b686bf341e5da9d3ca7f22206f002570d5800d2
SHA512 f02df93a7d6afabc63bf402fd7e1d216a94e7f0a258e8f5871b09ae85b5c8b0f7b6b965e7efd54a8a7ec441b604685c5493e93ce6b3f89aa0f338602d14896bd
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouW:0NA1Yakeer5+nsoH
TLSH
T1E705A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2mnHpFvXcUs.exe

Path C:\Windows\2mnHpFvXcUs.exe
Size 804KB
SHA256 e4d357e3dea31ec31b310ac9ec9ce7aa4e1826eea0930baa165579db2d20470b
MD5 6c9c2d19246a9c2486148870c3569485
SHA1 9fa184588298414a8e5caec7f00ed193b34363c4
SHA512 2d9a78e2ca51372d9741e6f0bc469815e3e667d759983e4ebf3174cf01fa1928dac14599f108e31f350d84a45f735d1283c374bac9d2b15a2368de2e10b5525f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouT:0NA1Yakeer5+nsoo
TLSH
T10905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3mmWKCdkoV.exe

Path C:\Windows\3mmWKCdkoV.exe
Size 804KB
SHA256 e565d940ba101096572f50c02859e497796273638f8676f5bc70c7bd2447d724
MD5 3df6a1be02bcc17d04751b369a6791da
SHA1 73ad5c6725cf1d2305e123a7c63412f24388d413
SHA512 fabcdfce89ecc3d8ade80c16fd85906cd3d87bc0f67fb9203707a7bf56c432e2ded57acaa2175301985a6720d6131dbc493d875ce27796b143dde1449d3bd864
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouG:0NA1Yakeer5+nson
TLSH
T1F705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6B7qp.exe

Path C:\Windows\6B7qp.exe
Size 804KB
SHA256 e0e26f7a30119f53321a3de3efe61d1ca3f456f3a7bea2819c4d9b95ec7c2d7f
MD5 8efd19184d88f9ffd223385a55aa88ec
SHA1 64330eeae80ae6b1d660566141b24df94aad58d3
SHA512 eb00371e2ad42d6329aca92d2a1ee52f1050fe8e7e34226176e5de8795b3c0e55e43901c65273bb7e5c975ecf4195ffac6e5d1a18d454059fe9f1d905f69a742
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouu:0NA1Yakeer5+nsor
TLSH
T1A205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7CAuzb4v8W.exe

Path C:\Windows\7CAuzb4v8W.exe
Size 804KB
SHA256 3566301b4e5df057313628f8573422d929001658ad16c3a454f44e0a6688a317
MD5 d4ce3c1fbfeb5b7487b278db9f247771
SHA1 f753266484db0c88fd20c748a0a07a763b4363e4
SHA512 51139e9a8bef3c3ac8e1eb3f2c859fc576122bff159c598a7954c186d4e17cdb42701971b4e97109e7dddb390da45c04ccfe224b97d6e269608229621697ca9a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouJ:0NA1Yakeer5+nso2
TLSH
T1A105A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7LY6wns8xo4SGC.exe

Path C:\Windows\7LY6wns8xo4SGC.exe
Size 804KB
SHA256 9d2247cc5b45ad6963b536754f0e25a522b481a00a4821e0361522c978a09e53
MD5 858152e19933e56d2c1ed191a6f5e773
SHA1 0a70743a3e95d248fe511c6a183f83b797f46671
SHA512 de796878b2bf80976164f871f3a446d0dca906769021cca1f439ddb4050776bac442aa7db71b6bdb7f774dc546ad8606519e9640ca676c90b36b0fa177321255
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoux:0NA1Yakeer5+nsoq
TLSH
T13B05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7rWCLGG1.exe

Path C:\Windows\7rWCLGG1.exe
Size 804KB
SHA256 2067fdb0fa659dfbd09bbae190eaeaf0359d40cb0e0be86df5024853edc23e38
MD5 8e57abe75acf9878fe6b29220840e6ed
SHA1 96c4d7854586f1d4efcb90028e8f255236755c38
SHA512 6f31d2f254c22b9164dceb9591360f65faa87d070c279534d73b1f970f4de828b2181277571f9f352c8cfaf9d08fdcfceb6767284edec5a89b7ae89fc2def1aa
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouM:0NA1Yakeer5+nsoZ
TLSH
T13305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9JWau1sSah.exe

Path C:\Windows\9JWau1sSah.exe
Size 804KB
SHA256 ddd381e2f62a419b44e04b333b8abfd0991a79b94a49450dab3edfd70a713d56
MD5 cfe3fdf5aeed862c930ea488307f605e
SHA1 191a6ed5ddec3466d2f74810ee81e5f8ca5cb2f4
SHA512 1693a88508a4d749d6a07d197881608cf0256cd869f585c3aad054d9a18ac33db4a87a52d74ae31cc64ddccc1fbb48c0ba2d36c1de56d0662a58944961c7c376
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nsoF
TLSH
T15505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EV1wg9P8OwL02mp.exe

Path C:\Windows\EV1wg9P8OwL02mp.exe
Size 804KB
SHA256 8d8d09da13fce113e682931ca5f8365bdeb84da082c0eb25a0d3b675fb2389fb
MD5 14122926ae027fe814f5f11e78a222bb
SHA1 707af4e793336782797c28e3dac666823e1fe6fc
SHA512 6fb6e292bcaa6d083ed1e372b671c213e2120879209185d647e8e4e72e0457adaf96d973d59c48aed1efc8dc361c70014b441e15ad51cf1072b00406b83d1ad2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoue:0NA1Yakeer5+nsoT
TLSH
T1C405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FOaDAKX8.exe

Path C:\Windows\FOaDAKX8.exe
Size 804KB
SHA256 cbbc226e710060c17789ad7e8d3dce17fddb847c1a6f60841f94377e2fe98936
MD5 4c936641ef40ce8bee2bea6407cf4088
SHA1 55e716b86986030906b367d4288b0be9bc57b621
SHA512 9df0c87e4d685667bea4415d04c5c1ea693c23d09c5e8c43be75a22a183b61deb240accaf1e592158ea9cb2f8c3db8d0f0c7648667dad3315dc4d1039a993207
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouZ:0NA1Yakeer5+nso4
TLSH
T14A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HP4MOCAysQgg.exe

Path C:\Windows\HP4MOCAysQgg.exe
Size 804KB
SHA256 3774ae8f88be1b0f04d4ed7100b5382ea0887cbf36d28ef46dc0ecfa471b6d3c
MD5 0e5914b010398c54cb6bb1b19e1c472e
SHA1 8cdc1549f8b670a9a98519611a7cb49d695cc075
SHA512 83edee5aaf720a1ec270869ae24c8864d714f3885a1a792318d47a7f015f742cf69d07c2049a02da77d9fbf62aed8c7bdad0649c82501781c70405b333d8b622
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouF:0NA1Yakeer5+nsoC
TLSH
T13D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LVEwqMmM.exe

Path C:\Windows\LVEwqMmM.exe
Size 804KB
SHA256 d8a8be260e4ed725be93ce02a4bde70bee2aec77a9b89b91b5c81c47e22deb7f
MD5 605299c1fe06b195307793a4d140b2c2
SHA1 68ea000f95849b47ea5073de90646f5c0a43af2a
SHA512 657ee53d5d5ddc21d40d165f84f4d88d38fee2326083a1e38ca06f7f063c0bb44a49eb7d84852e3441fcdafe04bf501e32597e4b2a7c32c50d9adff9ed59bfd1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+M:0NA1Yakeer5+nsoO
TLSH
T1B405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LZvrv0vT.exe

Path C:\Windows\LZvrv0vT.exe
Size 804KB
SHA256 990aa0dacd1521338a75c499a85ad265574b15cfa5791a63fa9229629e0b25f0
MD5 7be92cbeabd1f33f59127019a34a8a1e
SHA1 ee4595a151885d9dd31851ca37f0cf9ea163c760
SHA512 30d765bb6550171eaa6e410b45187f4544f2ffb33499afe20731a7a255a1abd3a150c3538350507177f1c08a1349356b50f6f397bfd8e66f531ed4e3ca47fc01
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFounl:0NA1Yakeer5+nsou
TLSH
T19005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OFMjCDl4OsIkWgv.exe

Path C:\Windows\OFMjCDl4OsIkWgv.exe
Size 804KB
SHA256 1efa312282d35cce148f25232b9ff352d9fbe079b0dcba40bc29df01e05daad1
MD5 122105e3594beb716def6121e7976fc5
SHA1 0388acd50b34b95f61c60ebbb065361e4744eb1d
SHA512 a191fe396484cb73409612f281e11ebf0f2797674418f4275ae57d997802c582a92b5118ba99d76b3bfc3a19db2c6a25f4a6ed849758c8d91779b08ae1aac40f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouw:0NA1Yakeer5+nso3
TLSH
T19805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PUSgHF.exe

Path C:\Windows\PUSgHF.exe
Size 804KB
SHA256 88bda16381c8e183fe0ea9dc4c10b712004fb10f597f03c0588cce25516de593
MD5 f2cbfc7222325822c97b62c4c48cf055
SHA1 dbf29ad47c83a2f0b3d6c10ae140e1db9bc6a4c4
SHA512 623c5b5f19f06c3d74451009b4df4bb8a4ee9872a3be153508052b34e3d921453bfe275053441d5d51335b44b312a8fa5bc5479d7ad00d6ec7a61e4be035cf18
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou6:0NA1Yakeer5+nsoL
TLSH
T17005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ULSV9x7t.exe

Path C:\Windows\ULSV9x7t.exe
Size 804KB
SHA256 c3e48c3158c0f63e45b1d7ef52208e72d3255229972889c17c1504d9442c6bc1
MD5 2868d46f72a8e57ab0ef26cac4ebd8f5
SHA1 978ccb6e759d17cb4af696376d7b138ffa6c2f96
SHA512 c0f0736d369e717a52446a23ea1078b792ebafcf47b6266a9cda65c39563ae260a09b912b85c3d4ca901b441103b63a73dfccaa4ecee0a8bb2cdb019b1334854
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouj:0NA1Yakeer5+nso6
TLSH
T1F105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WUliSeMwuTix.exe

Path C:\Windows\WUliSeMwuTix.exe
Size 804KB
SHA256 eb8cb8e3590d660beab4fce81015d781a9f5f4697cd21b524120afc751070cc1
MD5 8c6996b1c7b4c17aabf4e003aceeac55
SHA1 f86d43786544c02921551a85f523f7b627058c25
SHA512 570b814541547bff8f70433102e1e42a03f285d31406bceb44e8643dbdc281ab45d22b039ddd74336ccf1c983bb92b00f519352ff32984073efe44d01f9ad465
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoud:0NA1Yakeer5+nsom
TLSH
T1B505A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YScuwvVcDolo.exe

Path C:\Windows\YScuwvVcDolo.exe
Size 804KB
SHA256 9d24f69fc08f078f10d2653df90d45300079bb684b07fac1811bec84284afd7f
MD5 a3800fc117672e4f4376dd3cd3454d42
SHA1 ef49499b4713fa48782800d1e6e34c16761cd036
SHA512 21ce8cf483a8fce45e6095dc7cb9b62f4aa58be3f915cbc47b97b96d328bab8875e40b9a86924ab0489013eabc80ce816c513102d41d4905eb4416191362a7ff
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA:0NA1Yakeer5+nsoH
TLSH
T17905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZEYMKqDS.exe

Path C:\Windows\ZEYMKqDS.exe
Size 804KB
SHA256 8e299579e426ab0ecef85f5c4553545162f882f18843bbbdf26ffa9a5f0e461c
MD5 0fe6b52e638e2afd3c4597050592ddf6
SHA1 39cf63e5c9ed05831fb494890e3dc3fc419dccd1
SHA512 c242366d56942769efad37a46c7cef9e4ec33dfbd3d3bb86ab152c2ade9f9a6f12242f217f307a4b4c4f5bc530a629e368d7030cd7040388f2b44bc1db86a733
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou0:0NA1Yakeer5+nsoh
TLSH
T1CD05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZM2ZoUnE93GuXNX.exe

Path C:\Windows\ZM2ZoUnE93GuXNX.exe
Size 804KB
SHA256 e8b00a792a3ca5cf28114bd848b9bd248ef0207150c6988bd6c5b7d89483250d
MD5 24b775ccfb2cd80e5c81b639b6cff72c
SHA1 976fffce7a2b9031371637a7a5f92736c5a826e8
SHA512 20f1f763d8a3ef4d71bd5e3cf42fd91d07566eb4d10fc6d72fe3c723f311e03bfc192703ea2cb153a358b4c38faf6331a0ae3585c72ff4e53d18881953679888
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nso6
TLSH
T1C805A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZgKDjxXcqBgQXs9.exe

Path C:\Windows\ZgKDjxXcqBgQXs9.exe
Size 804KB
SHA256 86897ad6958dcfed2b30918890185047162dd2d62204eb990f866c510efd74cd
MD5 7d80ffa862c9b61d47dd745f49deb6d4
SHA1 25f786e00cf3ac5433d7f22f78c2014eb2a3f1da
SHA512 1ca34cf6dceeada7ed6d71490318f91387ce13c4da54fd8dddc86d92d1c73f512279113236c6210fbd0ddc9b73102862c5761089e9af834eef0c984b33e01b98
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouz:0NA1Yakeer5+nsoi
TLSH
T1AD05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bnDoalRshg69a.exe

Path C:\Windows\bnDoalRshg69a.exe
Size 804KB
SHA256 8c5e85c233a932f72bb257127c8b03ccc980c731e1d6a3f47a6ea4a4ae3d9255
MD5 367785b7f1264e64a814d1fa641e2028
SHA1 95002ccbb6ce5a0cd0f15ac20279ad0da647e689
SHA512 5c79406f67bb7b7fef264246d7a9fd26f25769033776df9a638806b09cd1cc67004c86f9ed843714eeb4a56467087d45ac9b999c7f4605b958b90fcb05dd4cbd
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou2:0NA1Yakeer5+nso1
TLSH
T1D905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eqjD9VE9v.exe

Path C:\Windows\eqjD9VE9v.exe
Size 804KB
SHA256 9bbb51ae0a470c5f758b9554787f026201cdb7f3e69db65c86abf08f846bc9be
MD5 a596d4e2d365ca7040a9707263b4f879
SHA1 abfe99636007e632c973fbdeed94e53e9c4cb5a4
SHA512 374accb59a3c79958f268a11126b0bc83e0f9a56e0196844f02fcd384df2af01bf924367617054a5d5ee75e977713346cc183e1d39f153e02699f744414e1fe8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouj:0NA1Yakeer5+nsos
TLSH
T10005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

p186HvLP9qzNHDj.exe

Path C:\Windows\p186HvLP9qzNHDj.exe
Size 804KB
SHA256 b278d0fcfb2f7c03120aabcfaee15b0bc548369914770c0c7cd79443b82f1517
MD5 d964b4a391fdba96dae8752f15a628be
SHA1 12ee3acece331132e5a8977803e0d2b078811ce5
SHA512 2560923ecd0ce5cd183edbfe7a382cac6fdfc2de3988a31e75d9e61261c7b0e6c48b6b84ad4d04a40785593bad955a3a865eabe1792eda3408d70fade8bd9e4c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nsoQ
TLSH
T1A605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

p3RUXzwMqeiTPF.exe

Path C:\Windows\p3RUXzwMqeiTPF.exe
Size 804KB
SHA256 1f8c69149d05676360e92f457bdd7d1d93d3a89bd4ebecc671a034fafbfbc8b3
MD5 e05f4895bc65aaa17bbba2d83c09b2b8
SHA1 451b83ac09b87bce91f508aab7cb15d101ae4449
SHA512 eb9df55c520b15bdebb8aec7d8484383ae614a4e55d2af9b9b60e0efd38852f4c428bf98787f9d76f89b0d8f427940792a1cbb31ad85bc105bb506faefd86ba7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou7:0NA1Yakeer5+nsoW
TLSH
T16D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r5HtWsvHix.exe

Path C:\Windows\r5HtWsvHix.exe
Size 804KB
SHA256 2d04fafa8df73059f2e5f506e95479743ed82835984004dd061face22bc0726c
MD5 d1fb6e1ad9699549b3d2e5176d3e4316
SHA1 17fea7435b17d3c15b4872c16be7c3ca0d687fae
SHA512 844d3236919bc47d3dfdccd2c6fa2245619db4bdd90b5e30b585ddfdffa2dbaada752c0831ac44cfd71323bd9411038e0532a49d802131b23589f28439c2c813
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoup:0NA1Yakeer5+nsoa
TLSH
T1E405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sluELF.exe

Path C:\Windows\sluELF.exe
Size 804KB
SHA256 89c0d5fd15b4c4e929fd1beccdcaa9ad620e110e968211dbd62104b37f40cb10
MD5 277f794486bebbc0e27a3491a191c88d
SHA1 1607aae3b73ea3e723e7f8033572133288f2c31c
SHA512 4d52de2d474360e5fde7ff1b064096dcfe8dd524552e2832fc9d3bd83c10e903b4652ea7b499697f2a6b3d6e83f6392fec6fc4deab2a3b987392ba7be5592562
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFout:0NA1Yakeer5+nsoC
TLSH
T1B505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xNp3v90Foz3.exe

Path C:\Windows\xNp3v90Foz3.exe
Size 804KB
SHA256 0f20ee3f70e68ecb6ce8506c73def15bd32e08322120834c14c1a321632c8409
MD5 cc1ccb176962b7546179762d2828f611
SHA1 56149887a47c6d957fb97e5920e19375aee80303
SHA512 08c3bfe4c361895f32d4f7d433f74f2ee98e215961eaf36317001c2ab7912119e0436ab98b5704b41a8e9f7653b9ed4940be777d4dab75cb814c91469c82d0e6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoui:0NA1Yakeer5+nsoz
TLSH
T11905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yqx8q.exe

Path C:\Windows\yqx8q.exe
Size 804KB
SHA256 491312149ffda022af330817d6134d3bd15051c8e2eac80726359dab4958403d
MD5 390104766a8f1f05735c1202abf84302
SHA1 7c42282d847c8819798c3326fb7013bea8cc4240
SHA512 32157979be01f6dafa54552fe1068119f7be0df12e17ec2d02e407eeeba66caa3e3b84dc23ff365e819a381b4b5f96b01d21918c4475fafe26ce871bbd01c0b1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoue:0NA1Yakeer5+nsol
TLSH
T17F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zYKEq67l.exe

Path C:\Windows\zYKEq67l.exe
Size 804KB
SHA256 7e84cf30c6d7950c575cf9a92a2ad4a0a6df65226ef443daa923e9c60493b7b9
MD5 efcba288e4646d7329fbfffb24dff9f9
SHA1 a159ec296c75aa9e6afb1e68c606cfc1af9a1bba
SHA512 eb73ef48765e02977300c2d30ecf268aa963c9fc80c0f206b581daede1bef7344b3247877a732155983f44857a7731c8b37e498845b762b10048cc0743d5a040
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouF:0NA1Yakeer5+nso4
TLSH
T1A105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zjH7i.exe

Path C:\Windows\zjH7i.exe
Size 804KB
SHA256 cd47582a998e3dc347f2e85579a8819f450435737f1a0d313c054f09b1a2ed25
MD5 3e2a1ba08e0f667561c71ecf8b7ffa50
SHA1 4412dfed7405e8e82ce55d13b38fc3af166b9c44
SHA512 4b0557a82b7b93458e8f54b0b45e1072acef412aecc8ab3f0553fbee3366f662e094ec15eb440c069016574e0b60b9bd68bf22c5873856627eebb1de2e9aabba
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouN:0NA1Yakeer5+nsoE
TLSH
T1D605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads