316469377e8136d1f5a9386a4be0e2c9cccec5b4c7e61886935d763352f95f46

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_477e232d610c743cdcb920e77725210f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260819-nt7lsaef88
SHA256 316469377e8136d1f5a9386a4be0e2c9cccec5b4c7e61886935d763352f95f46
MD5 477e232d610c743cdcb920e77725210f
SHA1 fdb2a06b443291ce48c41d7edf50ecc2c162b35b
SHA512 c6360b89fddf8dbb1ab3226f6482e84a9129d922214e119d894b9c795530c3e6a9996dc4767c7e65fe6f735606385fb77d077c3e2324d9f52d56cf098ffcafd5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouP:0NA1Yakeer5+nsoy
TLSH
T15705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (2815) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 25 IoCs

pid	Process
5000	swl36RuFUU9seJ.exe
1864	n1P2Z.exe
836	TAOncIQK6tv.exe
3960	aWD1lvvEY3GLcsv.exe
1568	3lom6.exe
3132	v7qP2vrKt7nZDRe.exe
4788	Ks2ntk6Sls65.exe
3680	V7Cqsg.exe
5280	FZ6D2mVyOyPZwx.exe
5520	WHhv7R9kNYbd5x.exe
5764	3RrYstPURys4G.exe
6012	UyeJx.exe
3364	0EW4yqWP.exe
6216	yGgTtp.exe
6556	EeTsI8eZZC.exe
6816	NTXpva1.exe
7080	vaOVmrASthl.exe
1944	tlNvOW4Eq.exe
3320	ZWOxNjtT4O.exe
7416	oxPAIpUxAy.exe
7864	neSWGJWvgYY.exe
8112	uAqqkpYmbQr.exe
7876	J5hulxOlDw.exe
8464	UGXV258VF0cG.exe
8712	e3UH5qq1T.exe

Adds Run key to start application 2 TTPs 25 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FINDVIRU = "C:\\Windows\\aWD1lvvEY3GLcsv.exe"	TAOncIQK6tv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPUPD = "C:\\Windows\\NTXpva1.exe"	EeTsI8eZZC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PERSFW = "C:\\Windows\\ZWOxNjtT4O.exe"	tlNvOW4Eq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVNT = "C:\\Windows\\J5hulxOlDw.exe"	uAqqkpYmbQr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ETRUSTCIPE = "C:\\Windows\\e3UH5qq1T.exe"	UGXV258VF0cG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GUARDDOG = "C:\\Windows\\3lom6.exe"	aWD1lvvEY3GLcsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CPDCLNT = "C:\\Windows\\v7qP2vrKt7nZDRe.exe"	3lom6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KAVDOS32 = "C:\\Windows\\EeTsI8eZZC.exe"	yGgTtp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCSCAN = "C:\\Windows\\vaOVmrASthl.exe"	NTXpva1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAVPROXY = "C:\\Windows\\TAOncIQK6tv.exe"	n1P2Z.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CCPXYSVC = "C:\\Windows\\V7Cqsg.exe"	Ks2ntk6Sls65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTRL = "C:\\Windows\\FZ6D2mVyOyPZwx.exe"	V7Cqsg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RAPAPP = "C:\\Windows\\0EW4yqWP.exe"	UyeJx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MWATCH = "C:\\Windows\\tlNvOW4Eq.exe"	vaOVmrASthl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DOORS = "C:\\Windows\\neSWGJWvgYY.exe"	oxPAIpUxAy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SWEEP95 = "C:\\Windows\\UGXV258VF0cG.exe"	J5hulxOlDw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GBPOLL = "C:\\Windows\\n1P2Z.exe"	swl36RuFUU9seJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCAFEE = "C:\\Windows\\Ks2ntk6Sls65.exe"	v7qP2vrKt7nZDRe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IOMON98 = "C:\\Windows\\WHhv7R9kNYbd5x.exe"	FZ6D2mVyOyPZwx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMC = "C:\\Windows\\3RrYstPURys4G.exe"	WHhv7R9kNYbd5x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GBPOLL = "C:\\Windows\\UyeJx.exe"	3RrYstPURys4G.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IOMON98 = "C:\\Windows\\yGgTtp.exe"	0EW4yqWP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPUPD = "C:\\Windows\\oxPAIpUxAy.exe"	ZWOxNjtT4O.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCVSSHLD = "C:\\Windows\\uAqqkpYmbQr.exe"	neSWGJWvgYY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVXQUAR = "C:\\Windows\\swl36RuFUU9seJ.exe"	2026-08-19_477e232d610c743cdcb920e77725210f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 50 IoCs

description	ioc	Process
File created	C:\Windows\V7Cqsg.exe	Ks2ntk6Sls65.exe
File created	C:\Windows\0EW4yqWP.exe	UyeJx.exe
File opened for modification	C:\Windows\EeTsI8eZZC.exe	yGgTtp.exe
File opened for modification	C:\Windows\swl36RuFUU9seJ.exe	2026-08-19_477e232d610c743cdcb920e77725210f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\aWD1lvvEY3GLcsv.exe	TAOncIQK6tv.exe
File created	C:\Windows\EeTsI8eZZC.exe	yGgTtp.exe
File created	C:\Windows\neSWGJWvgYY.exe	oxPAIpUxAy.exe
File created	C:\Windows\J5hulxOlDw.exe	uAqqkpYmbQr.exe
File created	C:\Windows\FZ6D2mVyOyPZwx.exe	V7Cqsg.exe
File created	C:\Windows\3RrYstPURys4G.exe	WHhv7R9kNYbd5x.exe
File created	C:\Windows\oxPAIpUxAy.exe	ZWOxNjtT4O.exe
File opened for modification	C:\Windows\J5hulxOlDw.exe	uAqqkpYmbQr.exe
File created	C:\Windows\UGXV258VF0cG.exe	J5hulxOlDw.exe
File opened for modification	C:\Windows\n1P2Z.exe	swl36RuFUU9seJ.exe
File created	C:\Windows\WHhv7R9kNYbd5x.exe	FZ6D2mVyOyPZwx.exe
File opened for modification	C:\Windows\0EW4yqWP.exe	UyeJx.exe
File created	C:\Windows\vaOVmrASthl.exe	NTXpva1.exe
File opened for modification	C:\Windows\ZWOxNjtT4O.exe	tlNvOW4Eq.exe
File created	C:\Windows\uAqqkpYmbQr.exe	neSWGJWvgYY.exe
File opened for modification	C:\Windows\e3UH5qq1T.exe	UGXV258VF0cG.exe
File opened for modification	C:\Windows\3lom6.exe	aWD1lvvEY3GLcsv.exe
File opened for modification	C:\Windows\UyeJx.exe	3RrYstPURys4G.exe
File created	C:\Windows\yGgTtp.exe	0EW4yqWP.exe
File opened for modification	C:\Windows\vaOVmrASthl.exe	NTXpva1.exe
File created	C:\Windows\tlNvOW4Eq.exe	vaOVmrASthl.exe
File created	C:\Windows\ZWOxNjtT4O.exe	tlNvOW4Eq.exe
File opened for modification	C:\Windows\uAqqkpYmbQr.exe	neSWGJWvgYY.exe
File opened for modification	C:\Windows\3RrYstPURys4G.exe	WHhv7R9kNYbd5x.exe
File opened for modification	C:\Windows\yGgTtp.exe	0EW4yqWP.exe
File created	C:\Windows\Ks2ntk6Sls65.exe	v7qP2vrKt7nZDRe.exe
File opened for modification	C:\Windows\Ks2ntk6Sls65.exe	v7qP2vrKt7nZDRe.exe
File created	C:\Windows\swl36RuFUU9seJ.exe	2026-08-19_477e232d610c743cdcb920e77725210f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\v7qP2vrKt7nZDRe.exe	3lom6.exe
File opened for modification	C:\Windows\FZ6D2mVyOyPZwx.exe	V7Cqsg.exe
File opened for modification	C:\Windows\WHhv7R9kNYbd5x.exe	FZ6D2mVyOyPZwx.exe
File created	C:\Windows\UyeJx.exe	3RrYstPURys4G.exe
File opened for modification	C:\Windows\NTXpva1.exe	EeTsI8eZZC.exe
File opened for modification	C:\Windows\tlNvOW4Eq.exe	vaOVmrASthl.exe
File opened for modification	C:\Windows\oxPAIpUxAy.exe	ZWOxNjtT4O.exe
File opened for modification	C:\Windows\UGXV258VF0cG.exe	J5hulxOlDw.exe
File created	C:\Windows\e3UH5qq1T.exe	UGXV258VF0cG.exe
File opened for modification	C:\Windows\v7qP2vrKt7nZDRe.exe	3lom6.exe
File created	C:\Windows\n1P2Z.exe	swl36RuFUU9seJ.exe
File created	C:\Windows\TAOncIQK6tv.exe	n1P2Z.exe
File opened for modification	C:\Windows\aWD1lvvEY3GLcsv.exe	TAOncIQK6tv.exe
File opened for modification	C:\Windows\V7Cqsg.exe	Ks2ntk6Sls65.exe
File created	C:\Windows\NTXpva1.exe	EeTsI8eZZC.exe
File opened for modification	C:\Windows\neSWGJWvgYY.exe	oxPAIpUxAy.exe
File opened for modification	C:\Windows\TAOncIQK6tv.exe	n1P2Z.exe
File created	C:\Windows\3lom6.exe	aWD1lvvEY3GLcsv.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
6460	6012	WerFault.exe	111
5492	4788	WerFault.exe	101
996	6556	WerFault.exe	120
4660	8112	WerFault.exe	138

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EeTsI8eZZC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tlNvOW4Eq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oxPAIpUxAy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	neSWGJWvgYY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_477e232d610c743cdcb920e77725210f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	swl36RuFUU9seJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aWD1lvvEY3GLcsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yGgTtp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UGXV258VF0cG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TAOncIQK6tv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	V7Cqsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3RrYstPURys4G.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UyeJx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NTXpva1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	J5hulxOlDw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3UH5qq1T.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3lom6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WHhv7R9kNYbd5x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0EW4yqWP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vaOVmrASthl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZWOxNjtT4O.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uAqqkpYmbQr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	n1P2Z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v7qP2vrKt7nZDRe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ks2ntk6Sls65.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FZ6D2mVyOyPZwx.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-19_477e232d610c743cdcb920e77725210f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_477e232d610c743cdcb920e77725210f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4192

C:\Windows\swl36RuFUU9seJ.exe
C:\Windows\swl36RuFUU9seJ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5000

C:\Windows\n1P2Z.exe
C:\Windows\n1P2Z.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1864

C:\Windows\TAOncIQK6tv.exe
C:\Windows\TAOncIQK6tv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:836

C:\Windows\aWD1lvvEY3GLcsv.exe
C:\Windows\aWD1lvvEY3GLcsv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3960

C:\Windows\3lom6.exe
C:\Windows\3lom6.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1568

C:\Windows\v7qP2vrKt7nZDRe.exe
C:\Windows\v7qP2vrKt7nZDRe.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3132

C:\Windows\Ks2ntk6Sls65.exe
C:\Windows\Ks2ntk6Sls65.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 2212
  2⤵
  - Program crash
  PID:5492

C:\Windows\V7Cqsg.exe
C:\Windows\V7Cqsg.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3680

C:\Windows\FZ6D2mVyOyPZwx.exe
C:\Windows\FZ6D2mVyOyPZwx.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5280

C:\Windows\WHhv7R9kNYbd5x.exe
C:\Windows\WHhv7R9kNYbd5x.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5520

C:\Windows\3RrYstPURys4G.exe
C:\Windows\3RrYstPURys4G.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5764

C:\Windows\UyeJx.exe
C:\Windows\UyeJx.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6012 -s 1976
  2⤵
  - Program crash
  PID:6460

C:\Windows\0EW4yqWP.exe
C:\Windows\0EW4yqWP.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3364

C:\Windows\yGgTtp.exe
C:\Windows\yGgTtp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6012 -ip 6012
1⤵
PID:6420

C:\Windows\EeTsI8eZZC.exe
C:\Windows\EeTsI8eZZC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6556 -s 2200
  2⤵
  - Program crash
  PID:996

C:\Windows\NTXpva1.exe
C:\Windows\NTXpva1.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6816

C:\Windows\vaOVmrASthl.exe
C:\Windows\vaOVmrASthl.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7080

C:\Windows\tlNvOW4Eq.exe
C:\Windows\tlNvOW4Eq.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1944

C:\Windows\ZWOxNjtT4O.exe
C:\Windows\ZWOxNjtT4O.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3320

C:\Windows\oxPAIpUxAy.exe
C:\Windows\oxPAIpUxAy.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7416

C:\Windows\neSWGJWvgYY.exe
C:\Windows\neSWGJWvgYY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7864

C:\Windows\uAqqkpYmbQr.exe
C:\Windows\uAqqkpYmbQr.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8112 -s 2208
  2⤵
  - Program crash
  PID:4660

C:\Windows\J5hulxOlDw.exe
C:\Windows\J5hulxOlDw.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7876

C:\Windows\UGXV258VF0cG.exe
C:\Windows\UGXV258VF0cG.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8464

C:\Windows\e3UH5qq1T.exe
C:\Windows\e3UH5qq1T.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4788 -ip 4788
1⤵
PID:5260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6556 -ip 6556
1⤵
PID:5220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 8112 -ip 8112
1⤵
PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0EW4yqWP.exe

Path C:\Windows\0EW4yqWP.exe
Size 804KB
SHA256 36b2600e49e58a016e1334988d4aeacfa973e23f31ee36c66bf639c715becb6e
MD5 0ffdab8d84e0f10df4d6bcf5074ce44e
SHA1 b7b6f5f87a3bee46983d2e70e4e5442bd7977e71
SHA512 757cba3491c0e255c6ff20d2c2b8ad4192570844c958211db5676bbf8b04ebe84455e9150474ac93c83f49ac78c1defdae60dc564d7da6f5c410974c9f84ec9e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoutz:0NA1Yakeer5+nsoS
TLSH
T12705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3RrYstPURys4G.exe

Path C:\Windows\3RrYstPURys4G.exe
Size 804KB
SHA256 496b15d179aea0c9aab50d4ded94ba94e36a29eee671f231811e64155f29d136
MD5 900927ac54912427b342178114b4b659
SHA1 1783fae08dcb875b72b0e77783e2169ce980015e
SHA512 d163d8384170d88aa4d19b03389909d6c148f245f6e99f20cd0f77f8a8a1ce081f90a0a6792c8f135d0f06e36e9388baab78baae7b7e37639269a9e049315c6b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouM:0NA1Yakeer5+nsob
TLSH
T1AC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3lom6.exe

Path C:\Windows\3lom6.exe
Size 804KB
SHA256 80480920d326c335b572c29397d5b0def2bdca27743b6a2a68e3fe340e7ca1d9
MD5 7f4780df6a7e40c83b44fe1e75c6bf89
SHA1 60032f2a3188096e18fa268dd2326b7030967d47
SHA512 e74ba4e1e01da08c17376f8e03e0fd09439e11af2354a100e3f0d0aab5a526574faf2d6cf0c9e061e3e8622398b8ea1ade45b52da4b7698464f7e5e335973817
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouo:0NA1Yakeer5+nsoL
TLSH
T1B105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EeTsI8eZZC.exe

Path C:\Windows\EeTsI8eZZC.exe
Size 804KB
SHA256 97dec982d87efa929f8630030268af919802ed639a6cf5670c31cba7cc129abf
MD5 0d54bd26ba6181c8620ac8afceec0c59
SHA1 65150d27c1bc6626f19f44d1e933a1f3e136ef31
SHA512 7a4369d6eaa3a2f94563f8f4a580b106bc0380bdb3309d9083bbfa507dba389f6cba3a6ad5860f06aab3cdeafa317d53a935e575128ce45af793366227d0f758
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouj:0NA1Yakeer5+nsoi
TLSH
T11205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FZ6D2mVyOyPZwx.exe

Path C:\Windows\FZ6D2mVyOyPZwx.exe
Size 804KB
SHA256 fe81c5e831e4616450ada28eb5e1e13fa78c6af4b12a5832490ca6d1fd7fee9d
MD5 7a5a838db8d614c9fb05e53ef112942a
SHA1 c855064985160e164e980c53e79cabc84caebeec
SHA512 bf4117649084cb5815a3a557d815b6f036ba1cd4687c6e1a8abd9a180167e624b32f4ccf3cb7d37be77d0094ac0e05372d8f9077794e0385b2a7d60f44dee4db
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoux:0NA1Yakeer5+nsoc
TLSH
T1FA05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

J5hulxOlDw.exe

Path C:\Windows\J5hulxOlDw.exe
Size 804KB
SHA256 cb04855b582951c33830a2d905b9d17eddc266144a76887e53e334961cd46641
MD5 69b52c7c9f4494d233bfec35f5362f9c
SHA1 c5ff8944c0e290ce2bd00152a7902b17d26d616c
SHA512 742762a52e8ce64caee466fc00bb32dd0c9c82f4c93bf5e5cc04fa06e7b9d34ddaaab56b70bdd8fd8bc3812ce92bc75b7730c0b5a12a94a4e9a1355ded0cdea2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouV:0NA1Yakeer5+nsoa
TLSH
T11B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ks2ntk6Sls65.exe

Path C:\Windows\Ks2ntk6Sls65.exe
Size 804KB
SHA256 41fd747aabcc14dda90d63aaa819454b6b050eeb6c46c4dd2055f9bd8f568e3f
MD5 aa41d84fc500cbbf9fab9949ec071903
SHA1 f34235fe8d887c54101a7f2d940609b0f41c53a1
SHA512 d1f598562fdd1fa6ec231ded12dab9e32742fbcac7699cdda4e19683fb8f8448a54ce7dd8a773e03186d36cdd3cede231a48a6878a1a18b6f230b59994815634
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nsoQ
TLSH
T15005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NTXpva1.exe

Path C:\Windows\NTXpva1.exe
Size 804KB
SHA256 76a6b54ebd059e82cfd13f7ee6a4c1956aa98a238df320ac49fb9d9ac6b0b840
MD5 28a1c5900b17fd7bd3d20e3cad71ddac
SHA1 c492dd16983716dbf645b198260c088ece873598
SHA512 cb287a6e74106b927f72a025ffbe27f9b8dda1ab2efa5bf8a8ed3b8f927f07bca806bd194344697f12a7798076ae7ab4ccb6d47653d6da83b84b0392eb762ef8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouR:0NA1Yakeer5+nsoo
TLSH
T15205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAOncIQK6tv.exe

Path C:\Windows\TAOncIQK6tv.exe
Size 804KB
SHA256 0e720aa6e5867605f7487edcaae5624880ad5c9869a10fc19a16f1f4e7ba5611
MD5 7383d034dc9acf7597caac36e5949d5f
SHA1 ca3cfcc40fdb6c802bc2de46765505f1ef777ccd
SHA512 92129bb7869d169c6eccbb829c1de2afd7a727998cb5ea5c7083197a85d8ef989c02ed54136a73af6fe77b290c411fae799eef0f94c873c48f2b787ae1445d55
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA:0NA1Yakeer5+nsoZ
TLSH
T11D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UGXV258VF0cG.exe

Path C:\Windows\UGXV258VF0cG.exe
Size 804KB
SHA256 4dabd214cc8d8edd5b1c6ed556217578d35ad69ac79b19d1b6c949783617d1f2
MD5 f703b2439e2f120e122d312317113003
SHA1 ef50c5b7f48094893d5aa2274a9b1a2a6050aefa
SHA512 fc67208b6004c11124d5216abddf841df5d46755fad2431b1215fd406fcd829e6103aeb3039aa8479105b58fcbd612cd3dc78868ec8c8df5721792806cd208c6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFour:0NA1Yakeer5+nsoq
TLSH
T14D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UyeJx.exe

Path C:\Windows\UyeJx.exe
Size 804KB
SHA256 389adcb530cf4e3a0ea83c2bf8c443f49f5c2f0de7a32624040de68558545ef0
MD5 25d91467ef663f12aa5ea3fe5ca1246b
SHA1 29c00f5639c866da481049374d2ae9e1bdad76dc
SHA512 58aa91bd79b19157a2bcdb5d29922206ba41af1321c0f23f6a0ce101ca78b4dd7cb2307f6fd113bbde98826ba1da3e410b9237bb7f757ec1a471a6d3dea96bc7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoug:0NA1Yakeer5+nsox
TLSH
T18005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

V7Cqsg.exe

Path C:\Windows\V7Cqsg.exe
Size 804KB
SHA256 ac8a97875a52173eab7736c8f9cfab481dcaeb36a07983904dacc8e4e07c2c5f
MD5 28735a4c09a9587a994d9e90222daa33
SHA1 4ebaf4aa41113ee32449d542e1ae46d678cf9f90
SHA512 48989d6779613c60707c4a566dc72eb7855220eb15d7617e3c0c72d11cbd8a75e50ede28d209883e79d707f76680725b9b2a14005e3e482bf2f00828f28dc6b6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouH:0NA1Yakeer5+nsoC
TLSH
T1DF05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WHhv7R9kNYbd5x.exe

Path C:\Windows\WHhv7R9kNYbd5x.exe
Size 804KB
SHA256 f27a213a2c280e8492ea68c424f2210994a839080ed1bb8c9bfde4e793cc9219
MD5 515ba6fb2e66e142817602bb27d3813b
SHA1 381268266351b674dd45a565ff414194e3d04ba8
SHA512 028cba602cc7a4f9570acb72544d4f719790f270e5ba8d8c1b2a4fc96b51e2b11cb3bf09f410db13ec72b862447c6ce77dac541002412769ab918f3a9a326a8e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouN:0NA1Yakeer5+nsog
TLSH
T16E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZWOxNjtT4O.exe

Path C:\Windows\ZWOxNjtT4O.exe
Size 804KB
SHA256 d95f507904a4f3a2bc294516e094c100c9f4ea53af435da9303667cc0a9e29ea
MD5 8a4357cd1a8be63d3a2a060475dc69c2
SHA1 a7734eb871ac8c94f95e8fa995d95900efdd18d4
SHA512 2b43525173f35ac3d0f8072e4fa6de859a2d08fcd48888cc2ba31a5d2448085fc1fd5782165d92959ec8c133e08a4450f3058abe203ab97ccc90927681b7db64
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+:0NA1Yakeer5+nsov
TLSH
T1EB05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aWD1lvvEY3GLcsv.exe

Path C:\Windows\aWD1lvvEY3GLcsv.exe
Size 804KB
SHA256 c693f9514b1fe20e2aeff01d93ff01260f20029f76d739787766ec2f39ad581c
MD5 58a933d92ce5c97409aff80ff3a765f0
SHA1 2bd4bda70e4c8579c1159579520ba4262f7225d8
SHA512 e3cce61848a4352f0fbe7cf7bd35fdec8f1e43d9995f0afd08ae16a897a44e680bcc68032bf95ff8a40b93761a82ebbc21180f3173b0b77b053c9072ec452ed5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouCJ:0NA1Yakeer5+nso1J
TLSH
T12905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3UH5qq1T.exe

Path C:\Windows\e3UH5qq1T.exe
Size 804KB
SHA256 bb4a7ad4bdb8936208381c2c0e6ddf99a33db5ed8e8cd7dc6588e4d69c838823
MD5 aaa95206a9c95713b05e3f541eb72dba
SHA1 40ea2efe6efef4aa14d9bf9010a8af0fc3ec24b9
SHA512 9088ede4abf6b4b17f272a76c9d4fa3bd6b9a3b7eb16cdba06b8a171c83362eb5663fdf6889fde61fded984398bac8da05d4dbdba1a148b71a8434e03d61edb0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFous:0NA1Yakeer5+nsoT
TLSH
T12605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

n1P2Z.exe

Path C:\Windows\n1P2Z.exe
Size 804KB
SHA256 7ddd9d5ddb5a2f150dd02a713974145d498fde02649794863345301f3958d54c
MD5 4010330a60a76bfb70f1c8a5cea96381
SHA1 b6b6b72131915241ae234c354e583907edfbee82
SHA512 e84cf4f1764de022bf49aac6aa167be3bca7c8200bb9710387bc0988040c9e913079ed7c3bc463a9374940c9c8a43f283da0519de7cd1807e62d6cc7da01421a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoud:0NA1Yakeer5+nsog
TLSH
T12905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

neSWGJWvgYY.exe

Path C:\Windows\neSWGJWvgYY.exe
Size 804KB
SHA256 6ce933cd2920f4298fb41a9e8e316e0d3b25d7c25bbe9b693e4adb1ebfb15b23
MD5 8513f40c17059e69de6491a405799698
SHA1 a0194325ccfa1a32e7a606eb50e73f2f8826cb09
SHA512 937c957bf94fa245efe2abcfe6eb23cc3409344a429893f7be3c22c3612e70fbd1756cd193e05eba7f89169c65469f6a79791a8f384d0564599d7faf83a3919c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nsoE
TLSH
T1FC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oxPAIpUxAy.exe

Path C:\Windows\oxPAIpUxAy.exe
Size 804KB
SHA256 101bbeff8a9400d408daf31dd24ce4af47171249fc110f1e5c2c833a158d97d3
MD5 4cc750a6e1613ef1864aaa330fa1a9ea
SHA1 365de3c383064dd511c2b4d883193861c7d32eae
SHA512 9f4eba34969e016cad0a9a8307c946d01d5d447553a206c1bf45045ff578fdf2c71820fc175dde394f7e16cd4b950c3026ea53b3113ffe972f1cdd53726cd851
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nso/
TLSH
T15905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

swl36RuFUU9seJ.exe

Path C:\Windows\swl36RuFUU9seJ.exe
Size 804KB
SHA256 9fbd44f29a81d4430d9a197f11b94e40523484873046675e0aefaed7b1df6ca9
MD5 54f1f421bd6a798dd65397943381dc2d
SHA1 fe4478921b9a5a685442f66b1f5a2c474d9586be
SHA512 7d2ca43c779277fe47bc78c3d6aa65f65dcbea7287a5448f4bcbbe343d21cdf19229320263c78cedf57cc120ad5e24ef77eca7113e8455bda2f8b9efe1498fb2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouP:0NA1Yakeer5+nsoe
TLSH
T14B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tlNvOW4Eq.exe

Path C:\Windows\tlNvOW4Eq.exe
Size 804KB
SHA256 e6829ec6f0ffac0b839796eabffcf8b51e8e068ddf28740898a8244c8d5153ba
MD5 09ed953374a585e911423dde492746b9
SHA1 f7701bbaf05ee361c031de7bc4dfeef019408caf
SHA512 5ec7f81c86cbb90aaf3f46f72dc2a24f241a8348309fe58e9fd66acc7ac45c1ce6f296c959344cc8d3cc56586822c76ff879871799e100891441cbf91973f125
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoud1:0NA1Yakeer5+nsoq1
TLSH
T1E705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uAqqkpYmbQr.exe

Path C:\Windows\uAqqkpYmbQr.exe
Size 804KB
SHA256 8739620fe4c30067220ea8cd6efcfb6958facaa056027a6b64b4af6afefebaca
MD5 a6f00f1849059362f2e70fe2bdde99c5
SHA1 f42d17a225936a16d614962afde89e6dc7fb6835
SHA512 5174055b966fa581fdabe4ec4938448c9cf7d0dfba9c710de1b89c5eedebdd542f41fbcc6a7888eddfbb6a84b49d6dee65eec46c487d160e82f4b0335e088e00
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou6:0NA1Yakeer5+nsoD
TLSH
T1A105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v7qP2vrKt7nZDRe.exe

Path C:\Windows\v7qP2vrKt7nZDRe.exe
Size 804KB
SHA256 5344916e2d4d58638d8a0db62b4c27f70ce897b793111a3b88d6a5fe267cdfbc
MD5 1e03548157878b04e649267d5bdc193e
SHA1 653a732702a56ce791fe7767b3823ba4e98eb6aa
SHA512 6c237f088c14c32d8b38be91244512d3a0a6a33a787cfbf79b16829f3868e70e7dce670a00b3ba310214893d623c648083925ecbdefa36efdb4698f1e41d365a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouw:0NA1Yakeer5+nsoX
TLSH
T1B005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vaOVmrASthl.exe

Path C:\Windows\vaOVmrASthl.exe
Size 804KB
SHA256 3c3ffa9ae5664f3d7c8a01cb865922189f1739ec651b9cb0a5578c4281c39f8c
MD5 4e01fe5bbbf7f492e955d98477708d71
SHA1 cbf5513e0a7de0fdafca869052d916b9c538645b
SHA512 16f9ccc76ea4a5f4526fb5089b3f8b65c5fd052300789e4af2a8fbad5c132b3ac4a7dbcbbfda52ed2e328efab5254b38a3e79a7c7b16048df2e1fff51b519e28
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouD:0NA1Yakeer5+nsoe
TLSH
T1F705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yGgTtp.exe

Path C:\Windows\yGgTtp.exe
Size 804KB
SHA256 093d2c3d5d11ab12b6fc1c7a8797e8afabd1feae895410e35540af279fc9ca39
MD5 0f2cf97ab23d514cc1e4947f59dd5ca1
SHA1 6b5025a8d3eddf1c60ae124580f0b9eb72af4707
SHA512 944e65e5fa54d61643c2dcdce6f74a75fc14f79472901508962a83900f1bdf56bffc031191e00e57a487bf7170b94a424f47c0e9531e6494c354fb77a75a99be
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoug:0NA1Yakeer5+nsoj
TLSH
T16B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads