60a40989b05fd201902bccc20a72fd4ef38a07feb3cc018f73eb984bf17fe0b9

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_a47f068a8d21f75e5ca48f5c1a9ed950_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260812-d3e8saac67
SHA256 60a40989b05fd201902bccc20a72fd4ef38a07feb3cc018f73eb984bf17fe0b9
MD5 a47f068a8d21f75e5ca48f5c1a9ed950
SHA1 00fa5a7f28cc8b56bb1eefeb2ec81df66b1dbe1c
SHA512 9eac4b33ff014744b9eea7f26b077e2892f8b657a75f9e00a0fa0c49b92b386db0c5df538e795f2187a9c442e9aa097a20726e3ceea33b86c461056db4bf0624
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoul:0NA1Yakeer5+nso2
TLSH
T11705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (2879) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 32 IoCs

pid	Process
1032	BKLS2GRgNv.exe
4720	wZWD6FY1ByG4ysV.exe
5492	gaE1j2IWQXM.exe
632	wKSmCazt3YcvHh2.exe
1676	GRrcqrFOnQmnpwY.exe
3768	ZXInt.exe
2248	aEW7ovm07UGuGYO.exe
6100	TiOELsiKFLN.exe
2128	vmccGvK8uzMy.exe
4640	rIn7Q7Ojr2.exe
6200	F41W9b3vxyUa.exe
6456	17I9X1IT5Kc.exe
6708	L148ZHEhIsQF.exe
7008	NhldpR5jEd6Z3.exe
6896	xKbIxpmUryYZ.exe
6160	VQx19aaWaRU1.exe
7356	JMdEwMQv2v.exe
7656	WK8v4sX.exe
7904	4ehOHyow6OJCDHn.exe
8156	ToT8IMMMhkT8oK.exe
6224	eTHld.exe
8248	cx55VQ5j.exe
8496	8Y0FO3Cxg5A.exe
8748	lI5W7WixPy0DyK.exe
9004	MbLojCCgCad.exe
8524	FiIuv.exe
9428	ETbwW4h.exe
9688	JRJRJPZEkcvW.exe
9952	lCFAnVEC.exe
10208	PiHSByH.exe
9416	k3z6eT.exe
10380	YOZ42CvVpp.exe

Adds Run key to start application 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MGHTML = "C:\\Windows\\vmccGvK8uzMy.exe"	TiOELsiKFLN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NWTOOL16 = "C:\\Windows\\JMdEwMQv2v.exe"	VQx19aaWaRU1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPTC32 = "C:\\Windows\\ToT8IMMMhkT8oK.exe"	4ehOHyow6OJCDHn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PADMIN = "C:\\Windows\\lI5W7WixPy0DyK.exe"	8Y0FO3Cxg5A.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVWUPD32 = "C:\\Windows\\GRrcqrFOnQmnpwY.exe"	wKSmCazt3YcvHh2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NSCHED32 = "C:\\Windows\\PiHSByH.exe"	lCFAnVEC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PVIEW95 = "C:\\Windows\\BKLS2GRgNv.exe"	2026-08-12_a47f068a8d21f75e5ca48f5c1a9ed950_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\P-WIN = "C:\\Windows\\wZWD6FY1ByG4ysV.exe"	BKLS2GRgNv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CCEVTMGR = "C:\\Windows\\F41W9b3vxyUa.exe"	rIn7Q7Ojr2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NISSERV = "C:\\Windows\\WK8v4sX.exe"	JMdEwMQv2v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IOMON98 = "C:\\Windows\\4ehOHyow6OJCDHn.exe"	WK8v4sX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DVP95 = "C:\\Windows\\MbLojCCgCad.exe"	lI5W7WixPy0DyK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPDOS32 = "C:\\Windows\\k3z6eT.exe"	PiHSByH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ICLOAD95 = "C:\\Windows\\YOZ42CvVpp.exe"	k3z6eT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NEOWATCHLOG = "C:\\Windows\\17I9X1IT5Kc.exe"	F41W9b3vxyUa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVXMONITOR9X = "C:\\Windows\\NhldpR5jEd6Z3.exe"	L148ZHEhIsQF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JEDI = "C:\\Windows\\FiIuv.exe"	MbLojCCgCad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RAPAPP = "C:\\Windows\\ZXInt.exe"	GRrcqrFOnQmnpwY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EVPN = "C:\\Windows\\L148ZHEhIsQF.exe"	17I9X1IT5Kc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCSHIELD = "C:\\Windows\\xKbIxpmUryYZ.exe"	NhldpR5jEd6Z3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RTVSCN95 = "C:\\Windows\\cx55VQ5j.exe"	eTHld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVWNT = "C:\\Windows\\8Y0FO3Cxg5A.exe"	cx55VQ5j.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SS3EDIT = "C:\\Windows\\gaE1j2IWQXM.exe"	wZWD6FY1ByG4ysV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BLACKD = "C:\\Windows\\eTHld.exe"	ToT8IMMMhkT8oK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CMGRDIAN = "C:\\Windows\\TiOELsiKFLN.exe"	aEW7ovm07UGuGYO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVWIN95 = "C:\\Windows\\VQx19aaWaRU1.exe"	xKbIxpmUryYZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CPD = "C:\\Windows\\JRJRJPZEkcvW.exe"	ETbwW4h.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVW32 = "C:\\Windows\\lCFAnVEC.exe"	JRJRJPZEkcvW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GENERICS = "C:\\Windows\\wKSmCazt3YcvHh2.exe"	gaE1j2IWQXM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TFAK = "C:\\Windows\\aEW7ovm07UGuGYO.exe"	ZXInt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CONNECTIONMONITOR = "C:\\Windows\\rIn7Q7Ojr2.exe"	vmccGvK8uzMy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPFAGENT = "C:\\Windows\\ETbwW4h.exe"	FiIuv.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\vmccGvK8uzMy.exe	TiOELsiKFLN.exe
File created	C:\Windows\PiHSByH.exe	lCFAnVEC.exe
File created	C:\Windows\gaE1j2IWQXM.exe	wZWD6FY1ByG4ysV.exe
File opened for modification	C:\Windows\GRrcqrFOnQmnpwY.exe	wKSmCazt3YcvHh2.exe
File opened for modification	C:\Windows\aEW7ovm07UGuGYO.exe	ZXInt.exe
File created	C:\Windows\rIn7Q7Ojr2.exe	vmccGvK8uzMy.exe
File created	C:\Windows\VQx19aaWaRU1.exe	xKbIxpmUryYZ.exe
File opened for modification	C:\Windows\JMdEwMQv2v.exe	VQx19aaWaRU1.exe
File created	C:\Windows\WK8v4sX.exe	JMdEwMQv2v.exe
File opened for modification	C:\Windows\ToT8IMMMhkT8oK.exe	4ehOHyow6OJCDHn.exe
File opened for modification	C:\Windows\17I9X1IT5Kc.exe	F41W9b3vxyUa.exe
File opened for modification	C:\Windows\WK8v4sX.exe	JMdEwMQv2v.exe
File opened for modification	C:\Windows\eTHld.exe	ToT8IMMMhkT8oK.exe
File opened for modification	C:\Windows\8Y0FO3Cxg5A.exe	cx55VQ5j.exe
File created	C:\Windows\lCFAnVEC.exe	JRJRJPZEkcvW.exe
File created	C:\Windows\ETbwW4h.exe	FiIuv.exe
File opened for modification	C:\Windows\VQx19aaWaRU1.exe	xKbIxpmUryYZ.exe
File created	C:\Windows\4ehOHyow6OJCDHn.exe	WK8v4sX.exe
File opened for modification	C:\Windows\BKLS2GRgNv.exe	2026-08-12_a47f068a8d21f75e5ca48f5c1a9ed950_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\ZXInt.exe	GRrcqrFOnQmnpwY.exe
File opened for modification	C:\Windows\TiOELsiKFLN.exe	aEW7ovm07UGuGYO.exe
File created	C:\Windows\17I9X1IT5Kc.exe	F41W9b3vxyUa.exe
File opened for modification	C:\Windows\lI5W7WixPy0DyK.exe	8Y0FO3Cxg5A.exe
File opened for modification	C:\Windows\wZWD6FY1ByG4ysV.exe	BKLS2GRgNv.exe
File created	C:\Windows\ZXInt.exe	GRrcqrFOnQmnpwY.exe
File opened for modification	C:\Windows\F41W9b3vxyUa.exe	rIn7Q7Ojr2.exe
File created	C:\Windows\NhldpR5jEd6Z3.exe	L148ZHEhIsQF.exe
File opened for modification	C:\Windows\4ehOHyow6OJCDHn.exe	WK8v4sX.exe
File created	C:\Windows\cx55VQ5j.exe	eTHld.exe
File opened for modification	C:\Windows\cx55VQ5j.exe	eTHld.exe
File created	C:\Windows\FiIuv.exe	MbLojCCgCad.exe
File opened for modification	C:\Windows\lCFAnVEC.exe	JRJRJPZEkcvW.exe
File opened for modification	C:\Windows\rIn7Q7Ojr2.exe	vmccGvK8uzMy.exe
File created	C:\Windows\JRJRJPZEkcvW.exe	ETbwW4h.exe
File created	C:\Windows\MbLojCCgCad.exe	lI5W7WixPy0DyK.exe
File created	C:\Windows\wZWD6FY1ByG4ysV.exe	BKLS2GRgNv.exe
File created	C:\Windows\wKSmCazt3YcvHh2.exe	gaE1j2IWQXM.exe
File opened for modification	C:\Windows\k3z6eT.exe	PiHSByH.exe
File opened for modification	C:\Windows\gaE1j2IWQXM.exe	wZWD6FY1ByG4ysV.exe
File created	C:\Windows\8Y0FO3Cxg5A.exe	cx55VQ5j.exe
File opened for modification	C:\Windows\MbLojCCgCad.exe	lI5W7WixPy0DyK.exe
File opened for modification	C:\Windows\FiIuv.exe	MbLojCCgCad.exe
File opened for modification	C:\Windows\JRJRJPZEkcvW.exe	ETbwW4h.exe
File created	C:\Windows\BKLS2GRgNv.exe	2026-08-12_a47f068a8d21f75e5ca48f5c1a9ed950_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\L148ZHEhIsQF.exe	17I9X1IT5Kc.exe
File created	C:\Windows\xKbIxpmUryYZ.exe	NhldpR5jEd6Z3.exe
File created	C:\Windows\lI5W7WixPy0DyK.exe	8Y0FO3Cxg5A.exe
File opened for modification	C:\Windows\PiHSByH.exe	lCFAnVEC.exe
File created	C:\Windows\aEW7ovm07UGuGYO.exe	ZXInt.exe
File created	C:\Windows\F41W9b3vxyUa.exe	rIn7Q7Ojr2.exe
File opened for modification	C:\Windows\NhldpR5jEd6Z3.exe	L148ZHEhIsQF.exe
File created	C:\Windows\ToT8IMMMhkT8oK.exe	4ehOHyow6OJCDHn.exe
File created	C:\Windows\k3z6eT.exe	PiHSByH.exe
File opened for modification	C:\Windows\L148ZHEhIsQF.exe	17I9X1IT5Kc.exe
File opened for modification	C:\Windows\ETbwW4h.exe	FiIuv.exe
File created	C:\Windows\YOZ42CvVpp.exe	k3z6eT.exe
File opened for modification	C:\Windows\YOZ42CvVpp.exe	k3z6eT.exe
File created	C:\Windows\GRrcqrFOnQmnpwY.exe	wKSmCazt3YcvHh2.exe
File opened for modification	C:\Windows\xKbIxpmUryYZ.exe	NhldpR5jEd6Z3.exe
File opened for modification	C:\Windows\wKSmCazt3YcvHh2.exe	gaE1j2IWQXM.exe
File created	C:\Windows\TiOELsiKFLN.exe	aEW7ovm07UGuGYO.exe
File opened for modification	C:\Windows\vmccGvK8uzMy.exe	TiOELsiKFLN.exe
File created	C:\Windows\JMdEwMQv2v.exe	VQx19aaWaRU1.exe
File created	C:\Windows\eTHld.exe	ToT8IMMMhkT8oK.exe

Program crash 15 IoCs

pid	pid_target	Process	procid_target
4664	4720	WerFault.exe	92
6912	6200	WerFault.exe	113
7560	6896	WerFault.exe	123
9328	8748	WerFault.exe	143
10592	9416	WerFault.exe	160
10980	1032	WerFault.exe	90
11064	5492	WerFault.exe	94
200	7008	WerFault.exe	121
10604	6160	WerFault.exe	125
4616	8156	WerFault.exe	135
1332	10208	WerFault.exe	158
5372	9688	WerFault.exe	153
3704	9952	WerFault.exe	156
11228	3768	WerFault.exe	103
6208	4640	WerFault.exe	111

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZXInt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eTHld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MbLojCCgCad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wZWD6FY1ByG4ysV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wKSmCazt3YcvHh2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GRrcqrFOnQmnpwY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xKbIxpmUryYZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JRJRJPZEkcvW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WK8v4sX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8Y0FO3Cxg5A.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F41W9b3vxyUa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VQx19aaWaRU1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cx55VQ5j.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lI5W7WixPy0DyK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ETbwW4h.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lCFAnVEC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YOZ42CvVpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_a47f068a8d21f75e5ca48f5c1a9ed950_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aEW7ovm07UGuGYO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ToT8IMMMhkT8oK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k3z6eT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TiOELsiKFLN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NhldpR5jEd6Z3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JMdEwMQv2v.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ehOHyow6OJCDHn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FiIuv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BKLS2GRgNv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17I9X1IT5Kc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PiHSByH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vmccGvK8uzMy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rIn7Q7Ojr2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	L148ZHEhIsQF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaE1j2IWQXM.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-12_a47f068a8d21f75e5ca48f5c1a9ed950_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_a47f068a8d21f75e5ca48f5c1a9ed950_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4260

C:\Windows\BKLS2GRgNv.exe
C:\Windows\BKLS2GRgNv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 2216
  2⤵
  - Program crash
  PID:10980

C:\Windows\wZWD6FY1ByG4ysV.exe
C:\Windows\wZWD6FY1ByG4ysV.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 2076
  2⤵
  - Program crash
  PID:4664

C:\Windows\gaE1j2IWQXM.exe
C:\Windows\gaE1j2IWQXM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5492 -s 2216
  2⤵
  - Program crash
  PID:11064

C:\Windows\wKSmCazt3YcvHh2.exe
C:\Windows\wKSmCazt3YcvHh2.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4720 -ip 4720
1⤵
PID:4416

C:\Windows\GRrcqrFOnQmnpwY.exe
C:\Windows\GRrcqrFOnQmnpwY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1676

C:\Windows\ZXInt.exe
C:\Windows\ZXInt.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 2420
  2⤵
  - Program crash
  PID:11228

C:\Windows\aEW7ovm07UGuGYO.exe
C:\Windows\aEW7ovm07UGuGYO.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2248

C:\Windows\TiOELsiKFLN.exe
C:\Windows\TiOELsiKFLN.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6100

C:\Windows\vmccGvK8uzMy.exe
C:\Windows\vmccGvK8uzMy.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2128

C:\Windows\rIn7Q7Ojr2.exe
C:\Windows\rIn7Q7Ojr2.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 2420
  2⤵
  - Program crash
  PID:6208

C:\Windows\F41W9b3vxyUa.exe
C:\Windows\F41W9b3vxyUa.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 2076
  2⤵
  - Program crash
  PID:6912

C:\Windows\17I9X1IT5Kc.exe
C:\Windows\17I9X1IT5Kc.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6456

C:\Windows\L148ZHEhIsQF.exe
C:\Windows\L148ZHEhIsQF.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6200 -ip 6200
1⤵
PID:6892

C:\Windows\NhldpR5jEd6Z3.exe
C:\Windows\NhldpR5jEd6Z3.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 2212
  2⤵
  - Program crash
  PID:200

C:\Windows\xKbIxpmUryYZ.exe
C:\Windows\xKbIxpmUryYZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6896 -s 2076
  2⤵
  - Program crash
  PID:7560

C:\Windows\VQx19aaWaRU1.exe
C:\Windows\VQx19aaWaRU1.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6160 -s 2212
  2⤵
  - Program crash
  PID:10604

C:\Windows\JMdEwMQv2v.exe
C:\Windows\JMdEwMQv2v.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6896 -ip 6896
1⤵
PID:7540

C:\Windows\WK8v4sX.exe
C:\Windows\WK8v4sX.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7656

C:\Windows\4ehOHyow6OJCDHn.exe
C:\Windows\4ehOHyow6OJCDHn.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7904

C:\Windows\ToT8IMMMhkT8oK.exe
C:\Windows\ToT8IMMMhkT8oK.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8156 -s 2212
  2⤵
  - Program crash
  PID:4616

C:\Windows\eTHld.exe
C:\Windows\eTHld.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6224

C:\Windows\cx55VQ5j.exe
C:\Windows\cx55VQ5j.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8248

C:\Windows\8Y0FO3Cxg5A.exe
C:\Windows\8Y0FO3Cxg5A.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8496

C:\Windows\lI5W7WixPy0DyK.exe
C:\Windows\lI5W7WixPy0DyK.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8748 -s 2076
  2⤵
  - Program crash
  PID:9328

C:\Windows\MbLojCCgCad.exe
C:\Windows\MbLojCCgCad.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9004

C:\Windows\FiIuv.exe
C:\Windows\FiIuv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 8748 -ip 8748
1⤵
PID:8696

C:\Windows\ETbwW4h.exe
C:\Windows\ETbwW4h.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9428

C:\Windows\JRJRJPZEkcvW.exe
C:\Windows\JRJRJPZEkcvW.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9688 -s 2308
  2⤵
  - Program crash
  PID:5372

C:\Windows\lCFAnVEC.exe
C:\Windows\lCFAnVEC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9952 -s 2308
  2⤵
  - Program crash
  PID:3704

C:\Windows\PiHSByH.exe
C:\Windows\PiHSByH.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10208 -s 2204
  2⤵
  - Program crash
  PID:1332

C:\Windows\k3z6eT.exe
C:\Windows\k3z6eT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9416 -s 2080
  2⤵
  - Program crash
  PID:10592

C:\Windows\YOZ42CvVpp.exe
C:\Windows\YOZ42CvVpp.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:10380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 9416 -ip 9416
1⤵
PID:10572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1032 -ip 1032
1⤵
PID:10948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5492 -ip 5492
1⤵
PID:11044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 7008 -ip 7008
1⤵
PID:11244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 6160 -ip 6160
1⤵
PID:10580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 8156 -ip 8156
1⤵
PID:9700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 10208 -ip 10208
1⤵
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 9688 -ip 9688
1⤵
PID:11072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 9952 -ip 9952
1⤵
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3768 -ip 3768
1⤵
PID:11216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4640 -ip 4640
1⤵
PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

17I9X1IT5Kc.exe

Path C:\Windows\17I9X1IT5Kc.exe
Size 804KB
SHA256 a05dfc0f3402ef7b705ca4e00010c2bc45d926440b7d164228f75855888f3e50
MD5 28dd9aefaf57d110b5e9aaa965c01949
SHA1 43a29b055339ac03be41d54b5b44820a58e2e7d2
SHA512 e465d88d7631104384d431f365302f39ad40f39b91f405a36c734bf159d65ca55187a2782ecad60cb18601f7e30839be38fbff98670c3bd26edec74b01525a42
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouJO:0NA1Yakeer5+nsowO
TLSH
T1E005A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ehOHyow6OJCDHn.exe

Path C:\Windows\4ehOHyow6OJCDHn.exe
Size 804KB
SHA256 7918519e75754a27b3e2c8994240ffbd9e71a77d0d1d91efe162f95f4fb29c81
MD5 127c5330d5e562ffebcf9326d86a9683
SHA1 5eab8b88681575c969341273786b99bc6b6fb526
SHA512 4d58f9773dde8e6d9157e39d3b252146662534a281b6f90374d5b15eb2a7bb914f738f4731df327dcd2641668c15d73881e4cd09b487c29e48d8271b330b3aa8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoud:0NA1Yakeer5+nsoE
TLSH
T13205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8Y0FO3Cxg5A.exe

Path C:\Windows\8Y0FO3Cxg5A.exe
Size 804KB
SHA256 a3947446d83e8879c596d94def12b67e564c6d7703fad8e3a2e449566ceeda8e
MD5 38caf8ff76b6dd76c7d6c3ed4afa8f0f
SHA1 7d01a45f3e58d73116341f1ae9992acf8c3f0af4
SHA512 bc25bd67022c0935ec1896d516bc2795e09018249da8a7a635d5fea4c508e65f458c3efc012dc3e3ed9979da28b33c5c5fbee0984f29b81d1dfb0cbb130458de
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nso4
TLSH
T19B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BKLS2GRgNv.exe

Path C:\Windows\BKLS2GRgNv.exe
Size 804KB
SHA256 c54f469d7d98afc7c2197d79f202fb9d406b26221cadce13f8511ed05e996093
MD5 6d8ebb9735caed6297ea9e023f07c31a
SHA1 3843a460fa4150cf921b5136a5eda2f10cefbb4e
SHA512 382ac702944b26ae74cd1215f60e6526c640b7ba8587b9fb27ac3d865f22602b79ec7362e0fab5d14e6cba246adeecffcfe94dee41c2c784454c3a36b7a6e48d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoun:0NA1Yakeer5+nsoo
TLSH
T1A405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ETbwW4h.exe

Path C:\Windows\ETbwW4h.exe
Size 804KB
SHA256 499a613a3b079c80e8b017967342025d7a5cc3c6513aa0b14e6a125cd16793ab
MD5 f5a145ea42aab072c29966fbafbe7779
SHA1 bd944fdd164d6aa8bfaf307d96e7f1faefed5178
SHA512 8c0b8d5a382d24e53d72165051361a6ef7a029c530200a8ec202edc12f761651a62bc3c79c3a69075996deece390cf3b00fa5aee31fc1d8eaa574b4a963e1296
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouY:0NA1Yakeer5+nso7
TLSH
T17D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F41W9b3vxyUa.exe

Path C:\Windows\F41W9b3vxyUa.exe
Size 804KB
SHA256 0d529acdaab169158e8099048d1ce383187b03f20ff8182ed7ab0b2aa6a810ab
MD5 2526459c5255661fb259287a9e363afc
SHA1 bfed75cf90f912f6927182faab3a80024bce1c83
SHA512 724a7413fe9e490b5e9ebf01e66da464900cae37e411149c28a47c4ce910e4faf4f887a3f323ba23aeb37ae9595d9eba2a126df36fa2c6eb729d5c29ea7e139d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nsoO
TLSH
T1A305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FiIuv.exe

Path C:\Windows\FiIuv.exe
Size 804KB
SHA256 5a29a7d72e327fecc23cb9048810fc74c4cc00010e4000f9ab2a68ec6389ac09
MD5 4193b4a634de00d4a3d44413bd79ec1d
SHA1 5c75a9c6022d17d6ac436bf27749513b4a718a75
SHA512 fe6a9bf9e54f023a5bb8808ed15104271e6332de6e4f23f3a94489e5ece17aec313d7e64b07712375c07387ffbfebd712347a3a5307f40d3d5543a2d6aea2485
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFour:0NA1Yakeer5+nsoc
TLSH
T18505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GRrcqrFOnQmnpwY.exe

Path C:\Windows\GRrcqrFOnQmnpwY.exe
Size 804KB
SHA256 41e75d2256acf97bcf58d403124c1599cf91ef075c8283867da6642f2391fd85
MD5 ae2283639d3779335943caa6e39c1671
SHA1 ff68577321e285aed284d39c017560f592afa8e1
SHA512 620753c237b69004038597101c5e13bee4f3c841791df300303d507ee274acf07c55cc604b07f42011fe8f6e1f1c117fa4a4242de57bc1aa3a707bec7af6bf00
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouQ:0NA1Yakeer5+nsov
TLSH
T12605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JMdEwMQv2v.exe

Path C:\Windows\JMdEwMQv2v.exe
Size 804KB
SHA256 11b08ff84433a2158e9e302bf70730bfc96676ff0af79f051ba2ab98dfc535fe
MD5 b895bb88ce078d393d592730095880f2
SHA1 2ec6150b76c984d80c3758355b1ceff82205cc71
SHA512 e3c080fc28728936a14727e78c292e08c9039227b8f600bcfd15f933dea854a6714d333e1526df1a503d70b25b7d587264955fcd071ab0b6118c0d059df620fa
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouS:0NA1Yakeer5+nsob
TLSH
T1A005A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JRJRJPZEkcvW.exe

Path C:\Windows\JRJRJPZEkcvW.exe
Size 804KB
SHA256 870c94734a7ca1272b43b2af1a1ba248d2b4c8851413843c6671407e4e4bb77b
MD5 d5d598038b1c826a5636505df8541228
SHA1 08c3b3a320d9cf5f4e9fccf7b1e273a897ebd407
SHA512 bb23d755e28415cb2df0e376f0b9521908cdb5100319c2300de1e4123aa7217d7e3eeccaf8b9061a649cbe8abdf00b0a0e04ff41e85d95ab34556b17f19a14f5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouR:0NA1Yakeer5+nsoG
TLSH
T1A605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

L148ZHEhIsQF.exe

Path C:\Windows\L148ZHEhIsQF.exe
Size 804KB
SHA256 4e3a46d5b9f6dd2daca4a2bc7dc9c54543e3523dde18f25a523fea3a3f38e3b8
MD5 c3c6cc7841195f2b7f97f5972f6aedaf
SHA1 3aac7a7ce05b215e4ddbf3f35d57baac7603980a
SHA512 d0bccab6fa1738b9fff26a83973666f5b10255d25cd129584a3ec9e1734f4dbae5199e24427315909215bcdef7af0710baca79882e4506ff3c1ee25ccd2d2c22
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouK:0NA1Yakeer5+nso7
TLSH
T11605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MbLojCCgCad.exe

Path C:\Windows\MbLojCCgCad.exe
Size 804KB
SHA256 272b457b1a3a9305533467870673adf0277941d1809a4e0757124123112b35d1
MD5 7162db331ff0a7a0b420edb9ad89dfd9
SHA1 04539f962473aee1eb44b4f6700827395504c1c1
SHA512 35b97a4fbc6479a0fa665e4717619f24685358c504d5e0c505bb0630f7a3f72672bb8077c5d2516a06f0ee18db6b9f88221f67aeb7cc089ea251889433055f07
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoup:0NA1Yakeer5+nsoo
TLSH
T17D05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NhldpR5jEd6Z3.exe

Path C:\Windows\NhldpR5jEd6Z3.exe
Size 804KB
SHA256 84ff64727e1c53e23a156292b7647326f1b5b6acd66b74015aa3af0b1a140fa5
MD5 65e158a813b42c6c2513b529f089ff2a
SHA1 aeaf756cb278908c42c3dac6edac0b530d79056d
SHA512 61d9cb937a361b16f00f3f0351a9fd585ee59151ba02ed4b633159ea67879d3d03717ddfac54677e3a9e1248257f9cb80b5b6f67e4c808ef66267802a9c0ea90
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoux:0NA1Yakeer5+nsoo
TLSH
T19005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PiHSByH.exe

Path C:\Windows\PiHSByH.exe
Size 804KB
SHA256 f40b87d6268b0715a3d60fa73ce909ec62c17d2bf107b8162a6871cb6b4728e2
MD5 f82d99920d0a7d085f0ef1e970247715
SHA1 8838b5f487470b844512207c43f67c1ef877ca6a
SHA512 e3f7b86d62eb2dd7cfbba65aa07b628398315bf07ca0a58fa48098ecf65e2bea0dfc7788af39b57a3c9e774febf2e57d5e16663b7ffe64c2e3d3ec511770f468
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouV:0NA1Yakeer5+nsoG
TLSH
T14705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TiOELsiKFLN.exe

Path C:\Windows\TiOELsiKFLN.exe
Size 804KB
SHA256 313bcbac9696781a6768a6bb243700dceac8bf78e4b0ea6007d5f313344f89d2
MD5 255917e9d3721af2d788f0e3165fe4e4
SHA1 cc1be9ae7055d1df68f2230cfa436a375ce5c33c
SHA512 da76531bed2bea3a0cd0604189d1fd285d3f73064bdd6b61b24e3a909058ca164719a6c44b8ef5ea728a89f4df88ce8ac2eeef971656ac733b26eff6cd061cba
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou/:0NA1Yakeer5+nso+
TLSH
T1B605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ToT8IMMMhkT8oK.exe

Path C:\Windows\ToT8IMMMhkT8oK.exe
Size 804KB
SHA256 3d84d430d12b6b8387ad43008791126191f5496c67ee07a4aaaff087a4b7f17e
MD5 9fb24dc25bbc8316fbdab9a16a93d59f
SHA1 a4edd0062b2f531c77e2859788c6522642df81a9
SHA512 ec1aaa385c7914fcfbb678cfcfe27d7770c0a2decd0fddab3c4b2e11bde744671a4ff027d37f60979682020a3ea9b0fe2c318a5be3450bea280ef086d8b1dd39
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouI:0NA1Yakeer5+nsod
TLSH
T1BD05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VQx19aaWaRU1.exe

Path C:\Windows\VQx19aaWaRU1.exe
Size 804KB
SHA256 f4dfbe226bb8910c9657a1a42949a639f57e1278d541b3a6f888bd60944a6838
MD5 899ed0d615d7722245aafab06117f7da
SHA1 cab738ab03daac04f09d5eb5b1c7de1445e9c208
SHA512 4de9b110a037e88b43e925c1e24d2ba4226792eac6da92167cc0c69b0e35550cfc456926b23f898b3adf7d111dca6004a12af3cf12e66fe47e1096bf8f37755e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouSm:0NA1Yakeer5+nsoU
TLSH
T14705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WK8v4sX.exe

Path C:\Windows\WK8v4sX.exe
Size 804KB
SHA256 caf0a385759e2c9b9cc78ae7338345d624689c4a9f48f5929498e05185f5abca
MD5 8b94176e7223b47f06e1e27d368e7895
SHA1 61ce92770a1e4d2b32ab88de6150eb1348ac534d
SHA512 446af7019e5784d11fb71a0cbf00e9487c883f964f1adbc762e245e9e987554d712f734d27ee14dd98c2df8dd52e38620010b211f27098bca36413b02c9c6647
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nsoq
TLSH
T13805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YOZ42CvVpp.exe

Path C:\Windows\YOZ42CvVpp.exe
Size 804KB
SHA256 384504d2ad4c29100253531a7b75a66ac689c8ef269f68f5c2e61780598c9426
MD5 14d1cb7274ff64be8dff4d41c1e37be2
SHA1 f80069587088a39ebc5f110e7bbef6ff70e14e86
SHA512 6e559e4198641b77c7d194bdbb03af33cdbae1fcae9135074cdfe4bff85e83363896f8af82b705b1787afe428cda37ca2f57817a86da0211c68a8d528a6d5408
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+:0NA1Yakeer5+nsoj
TLSH
T15B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZXInt.exe

Path C:\Windows\ZXInt.exe
Size 804KB
SHA256 8f0f6caf2aae6b48b9948cb5696be4d5cf5686ac71f2af76d720cc59aab0300d
MD5 c7662f6fd62a3dc97ed3a997637a3238
SHA1 8daea2e717f8dabbff358686b0799598237b2026
SHA512 1976edc2c20f70d3445efb454cf7223f5b340db35e8343ab7cbbe4f1e93eeb4b5eb1b1146f0efcd613a43ed248f5f8c0740d487d981913e5aa4178f5fc3f9f49
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nsoE
TLSH
T18A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aEW7ovm07UGuGYO.exe

Path C:\Windows\aEW7ovm07UGuGYO.exe
Size 804KB
SHA256 fa545d95892adb1416c094e0b0f6581dbadf130c8ae518b60d87e5bc8b73c967
MD5 ecc81bcc0cc179b354f8c138f9a7ad06
SHA1 8339febba4c44720c751178d8b55f09ceeca5cb0
SHA512 d188a71c217bbce02b9f643f4f402483c02a1106f79fd09595e365342077ab4b613d4ea0b4f6f124a9ffc60caa9f0423898c7d9bd62056981a2a28d67b4443b4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouG:0NA1Yakeer5+nsoj
TLSH
T14305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cx55VQ5j.exe

Path C:\Windows\cx55VQ5j.exe
Size 804KB
SHA256 f7cd381f5c5822d740e6a28a3cbbe3d0bfb1df4205700038c5b18e1d085dce4f
MD5 30b71db936b5cabf1679119c54e62614
SHA1 1478008ed5b7fb96624fbd967b3ea2ff1ca132c0
SHA512 52c82dfe89b434ac219d67e57c3f62ed1b7349a4f1248caec376fedb0ede84cfceb7c6616a21d0fafc801e7389a9fbda9435374b3e21574f879b4ce394c1bcf8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouq:0NA1Yakeer5+nso9
TLSH
T14F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eTHld.exe

Path C:\Windows\eTHld.exe
Size 804KB
SHA256 f119a3b3b0508e937714cddbf31efad2970722df40ee95088598e89819d77d32
MD5 62bbead3cae7ae1101d2cd3287d5c98f
SHA1 aa03d910ee676efea73af7e46fbf258739eb1824
SHA512 b2c39680f6a4c6a5864b56f0495cdce9979a957e594e246662fbbbd9a797e78283556fe42fefd13a2ff3d97df11caafda8bd5cbf3581c38acf807799d5b453d9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+:0NA1Yakeer5+nsop
TLSH
T1E505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaE1j2IWQXM.exe

Path C:\Windows\gaE1j2IWQXM.exe
Size 804KB
SHA256 79840708a78855fbe357044dcda8ea1096b4313ddc4d24bbb8caf4d8d52eca6f
MD5 b628fd0b81188e50e316252101126eb4
SHA1 4e4db654e86f1fffb130035073b34511e3096c65
SHA512 8a3c0518c0633d34eb9dcf18899c2a9726169f5988b245e59cbb0eb3f17f9f3cc68658f0f9c2687c1aa82cb9ca1785dc4c909df3aea7e0d3a3dce80448cdd5bd
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou1:0NA1Yakeer5+nsoS
TLSH
T13E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k3z6eT.exe

Path C:\Windows\k3z6eT.exe
Size 804KB
SHA256 f2b5e7ed35e6db4e6fb564394142c551feebaabb8b469ad734acccb592f3b57f
MD5 240c3de97f19aab3e80b2005219394c2
SHA1 5684eab429c90e3b458061d92ac5a57a3d44dbec
SHA512 afd763c4a5ca95c82686cfbd15ff9ced05c32cb4d13a4eb9780887f8f094947e43f2096b2b13024945c66e6b1775a29b6ba53c951228569ffdd879333527ba3a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouC:0NA1Yakeer5+nsof
TLSH
T14505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lCFAnVEC.exe

Path C:\Windows\lCFAnVEC.exe
Size 804KB
SHA256 20d16f32839bf52c93af9fc690886011f3ecbd86f0722ba0435148589705ad5a
MD5 b9da91ab6e35bdf7211b98326062e6af
SHA1 d957c2db9c416d1afdf991f9a4b6b82fc2e57f4b
SHA512 8262b36a62cf674d8736743466caef835945e502233ec9ec8b7d57f1db4ae67570a4e2a484a00b622872b81145703d6a74aad62a680d69243769fb09ebb1add8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou2:0NA1Yakeer5+nsoj
TLSH
T19205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lI5W7WixPy0DyK.exe

Path C:\Windows\lI5W7WixPy0DyK.exe
Size 804KB
SHA256 993ddd15fdaf89d5c8d718cc154fa58f6a27c852529c9f3ac8db24e2af46faaa
MD5 97791725f729d736ee091be8f78ae2ea
SHA1 a31da8a15df56c45b94453a96330da33c3155706
SHA512 3f17f5778ec8ccb8043790ce00afb3c7370a550ec66daef1de2ca48d076c4fa7aef979a501b25174e9114a68e287a69e08662055c3a5dd3684e1f1217d8b3d97
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou:0NA1Yakeer5+nso
TLSH
T1A305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rIn7Q7Ojr2.exe

Path C:\Windows\rIn7Q7Ojr2.exe
Size 804KB
SHA256 29580753ed813d68736204c3cf1583d1e7d855c60017df87a88dc4e3bfb60965
MD5 72e454c8255676c91bfa28a939166038
SHA1 30ca9a776921bcb803418791784ceaefd4f5728d
SHA512 7e5b9181027636662becb7851873a5a7646467fbf02b41277a48a127bead4ba9365e530bc7d3eba5d3258d7380f649d0011b879da0b27fad30743c83374a5f30
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouS:0NA1Yakeer5+nsoF
TLSH
T14505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmccGvK8uzMy.exe

Path C:\Windows\vmccGvK8uzMy.exe
Size 804KB
SHA256 eacd6facb344da911111eeda22eccca23f2921e042db703b3352da32021c57d9
MD5 0bdfcfcf113886d6d70003a43dc5135d
SHA1 3ff83ddf3be7b4d5456a0555b721afafdbea099f
SHA512 646d7c5c7c8766c72b233fecd76c937a8ccfb2ac39fd2ed362c9d429fa63d375a1d010577e4ea79b62f9577e853f916d7e142bf80f30c96634a6b87402104a1b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nsom
TLSH
T18005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wKSmCazt3YcvHh2.exe

Path C:\Windows\wKSmCazt3YcvHh2.exe
Size 804KB
SHA256 ad2a184168f1dfc9f41f961bd1c6761fc8791326135c3a2ad0de9ec2bcf9a19b
MD5 9e338ade854cbb34d598932053de8014
SHA1 72128acf62c27411300acbf570f89fc16505b3c9
SHA512 70cdd67777224ebe044ac2befb59d91c87a2f04e0e77291d793b808c7dc23cc222df139df079bb412b99863a87474811ab0d84cbc1ce562a391aed4eb79e917c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouR:0NA1Yakeer5+nsoe
TLSH
T1AE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wZWD6FY1ByG4ysV.exe

Path C:\Windows\wZWD6FY1ByG4ysV.exe
Size 804KB
SHA256 cc02521bdd8893e3e491853ab0d81b14594962f0bcca1339253721fe133da664
MD5 d125769196c4f02047f39078c79665bd
SHA1 7130d98b6a5494e0b41a5699a496d973b3c1a06e
SHA512 f12be20e285ce986524f94a71706234186ce371718df565d14b7b89e6a7572ccae8039aaa55299ee7f4ba3de1b40bdb7a5a4154e39def96ebc45f8d39bb0b97e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouT:0NA1Yakeer5+nsoO
TLSH
T18E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xKbIxpmUryYZ.exe

Path C:\Windows\xKbIxpmUryYZ.exe
Size 804KB
SHA256 a043dc713b2b4d459ba8270923be185be85f73c3563c6f101e8c80ce1d5edc4d
MD5 01d885554af792b38644d9c0fb43b739
SHA1 9cb942d78d46d0ea8ee2d669a8f90db0c39a44c8
SHA512 c7cce6af12201f275057429f40ae1364739c23de35010aaff4206ca8f337c96b84c4896bac4c23fb8adbffee68f333b38f142b0ffbb74f5e522846dc1c500a78
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouq:0NA1Yakeer5+nsol
TLSH
T1AC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads