1174beea42f08f54fac0eb2d7a28dde8a3dac2cdc605db2616891edf573c1dd9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_f732008848b97ac4e4763780005739a2_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260826-bysbfaxyhw
SHA256 1174beea42f08f54fac0eb2d7a28dde8a3dac2cdc605db2616891edf573c1dd9
MD5 f732008848b97ac4e4763780005739a2
SHA1 28bc1581ccbfa313041ec38dd53d90879b07f2ca
SHA512 9d6f5a0e7beb98359d614f0534077cd54033978e463d8d5749f907871f776b80c5900c5cda12b93e6a32969f4453a0c4c0343d2e119f62daf2c1a3007407a936
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFourZ:0NA1Yakeer5+nsoW
TLSH
T1DC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (4286) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 48 IoCs

pid	Process
2540	lcX4w7Cc46.exe
4684	3Qoeqq.exe
4216	86tPhY.exe
3788	xlZ2Wijs8v0z4jj.exe
3396	kYOH1Vq.exe
2548	wpHBYkmFwBo.exe
2700	uRKSwb.exe
1464	vVEXSQH1gT.exe
5192	bNtJp.exe
5552	kviUa2Tc.exe
5800	i85HkvS2iqwvE7.exe
6044	L5ezd5JFxGE9CgE.exe
4484	Ut7vg6lKaa.exe
6052	aNz68oj.exe
6332	BNQoE3wE8.exe
6576	8tVks.exe
6820	jjwUJu.exe
7060	2Pn6DW99bDpQ.exe
7020	Ulb5nKFZ1vk.exe
7372	EW9XUEmLOIv.exe
7668	6YC1CknlvAe.exe
7916	L8VUD2q.exe
8168	YeO7cQ.exe
7104	e19954Hvq2vJh.exe
6848	19sA2.exe
8376	aaWFTbCqo3.exe
8624	6XGtWEAHzD60.exe
8916	9kIX3IwgwQI.exe
8652	BUh31wLdFRPqbm.exe
8884	5vBY92FiSRS.exe
9380	K3eSkoLi9kZL0d.exe
9656	sbSeqjoMsvohh.exe
9940	ILpB6.exe
10188	poJQJlH0d0v.exe
10156	LVoxhuXJ37Vz78O.exe
9652	zNK63Ft1Dnj1YU.exe
10328	3neR4.exe
10580	IMa5ovQw7DDVyMk.exe
10824	RDgZSOsDv.exe
11112	g1udka7FrNi.exe
10764	o52yKC5Qe02.exe
11408	BbN6rgVZ406rN.exe
11784	PqGl2HuSyjkvjhX.exe
12036	rBPy4XyObT.exe
10852	TSyhev1.exe
3784	AGZmuT.exe
12536	GOtkcb1tdkIWF.exe
12832	Lz6v7X1d.exe

Adds Run key to start application 2 TTPs 49 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCMNHDLR = "C:\\Windows\\i85HkvS2iqwvE7.exe"	kviUa2Tc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVP32 = "C:\\Windows\\YeO7cQ.exe"	L8VUD2q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NISUM = "C:\\Windows\\e19954Hvq2vJh.exe"	YeO7cQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAVPROXY = "C:\\Windows\\aaWFTbCqo3.exe"	19sA2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SWEEPNET = "C:\\Windows\\LVoxhuXJ37Vz78O.exe"	poJQJlH0d0v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TCM = "C:\\Windows\\PqGl2HuSyjkvjhX.exe"	BbN6rgVZ406rN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NTXCONFIG = "C:\\Windows\\wpHBYkmFwBo.exe"	kYOH1Vq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FNRB32 = "C:\\Windows\\Zel4nzyuAB3LC.exe"	wpHBYkmFwBo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FSMB32 = "C:\\Windows\\L5ezd5JFxGE9CgE.exe"	i85HkvS2iqwvE7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ICSUPPNT = "C:\\Windows\\8tVks.exe"	BNQoE3wE8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CLEANER = "C:\\Windows\\jjwUJu.exe"	8tVks.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFINET32 = "C:\\Windows\\6YC1CknlvAe.exe"	EW9XUEmLOIv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MGAVRTE = "C:\\Windows\\o52yKC5Qe02.exe"	g1udka7FrNi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NISSERV = "C:\\Windows\\rBPy4XyObT.exe"	PqGl2HuSyjkvjhX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVAP = "C:\\Windows\\aNz68oj.exe"	Ut7vg6lKaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RTVSCN95 = "C:\\Windows\\9kIX3IwgwQI.exe"	6XGtWEAHzD60.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GUARD = "C:\\Windows\\IMa5ovQw7DDVyMk.exe"	3neR4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FSAA = "C:\\Windows\\BbN6rgVZ406rN.exe"	o52yKC5Qe02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CCPXYSVC = "C:\\Windows\\AGZmuT.exe"	TSyhev1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\POP3TRAP = "C:\\Windows\\lcX4w7Cc46.exe"	2026-08-25_f732008848b97ac4e4763780005739a2_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCVSRTE = "C:\\Windows\\3Qoeqq.exe"	lcX4w7Cc46.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ETRUSTCIPE = "C:\\Windows\\BNQoE3wE8.exe"	aNz68oj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FIH32 = "C:\\Windows\\Ulb5nKFZ1vk.exe"	2Pn6DW99bDpQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F-PROT95 = "C:\\Windows\\sbSeqjoMsvohh.exe"	K3eSkoLi9kZL0d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVAPSVC = "C:\\Windows\\TSyhev1.exe"	rBPy4XyObT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATWATCH = "C:\\Windows\\GOtkcb1tdkIWF.exe"	AGZmuT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUALL = "C:\\Windows\\6XGtWEAHzD60.exe"	aaWFTbCqo3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NVSVC32 = "C:\\Windows\\86tPhY.exe"	3Qoeqq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NEOWATCHLOG = "C:\\Windows\\EW9XUEmLOIv.exe"	Ulb5nKFZ1vk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GENERICS = "C:\\Windows\\K3eSkoLi9kZL0d.exe"	5vBY92FiSRS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F-STOPW = "C:\\Windows\\ILpB6.exe"	sbSeqjoMsvohh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVSYNMGR = "C:\\Windows\\uRKSwb.exe"	Zel4nzyuAB3LC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVGW = "C:\\Windows\\vVEXSQH1gT.exe"	uRKSwb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ESPWATCH = "C:\\Windows\\L8VUD2q.exe"	6YC1CknlvAe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CCEVTMGR = "C:\\Windows\\RDgZSOsDv.exe"	IMa5ovQw7DDVyMk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TCA = "C:\\Windows\\Lz6v7X1d.exe"	GOtkcb1tdkIWF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ANTS = "C:\\Windows\\kYOH1Vq.exe"	xlZ2Wijs8v0z4jj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVAPW32 = "C:\\Windows\\bNtJp.exe"	vVEXSQH1gT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MINILOG = "C:\\Windows\\Ut7vg6lKaa.exe"	L5ezd5JFxGE9CgE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\POPROXY = "C:\\Windows\\2Pn6DW99bDpQ.exe"	jjwUJu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NUI = "C:\\Windows\\5vBY92FiSRS.exe"	BUh31wLdFRPqbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVSYNMGR = "C:\\Windows\\poJQJlH0d0v.exe"	ILpB6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFINET = "C:\\Windows\\19sA2.exe"	e19954Hvq2vJh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATUPDATER = "C:\\Windows\\BUh31wLdFRPqbm.exe"	9kIX3IwgwQI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SPHINX = "C:\\Windows\\zNK63Ft1Dnj1YU.exe"	LVoxhuXJ37Vz78O.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RAPAPP = "C:\\Windows\\3neR4.exe"	zNK63Ft1Dnj1YU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVKPOP = "C:\\Windows\\g1udka7FrNi.exe"	RDgZSOsDv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ICLOADNT = "C:\\Windows\\xlZ2Wijs8v0z4jj.exe"	86tPhY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NEOWATCHLOG = "C:\\Windows\\kviUa2Tc.exe"	bNtJp.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\8tVks.exe	BNQoE3wE8.exe
File created	C:\Windows\L8VUD2q.exe	6YC1CknlvAe.exe
File created	C:\Windows\ILpB6.exe	sbSeqjoMsvohh.exe
File created	C:\Windows\zNK63Ft1Dnj1YU.exe	LVoxhuXJ37Vz78O.exe
File opened for modification	C:\Windows\3neR4.exe	zNK63Ft1Dnj1YU.exe
File opened for modification	C:\Windows\GOtkcb1tdkIWF.exe	AGZmuT.exe
File created	C:\Windows\5vBY92FiSRS.exe	BUh31wLdFRPqbm.exe
File created	C:\Windows\poJQJlH0d0v.exe	ILpB6.exe
File opened for modification	C:\Windows\zNK63Ft1Dnj1YU.exe	LVoxhuXJ37Vz78O.exe
File created	C:\Windows\kYOH1Vq.exe	xlZ2Wijs8v0z4jj.exe
File opened for modification	C:\Windows\Lz6v7X1d.exe	GOtkcb1tdkIWF.exe
File opened for modification	C:\Windows\kYOH1Vq.exe	xlZ2Wijs8v0z4jj.exe
File opened for modification	C:\Windows\i85HkvS2iqwvE7.exe	kviUa2Tc.exe
File opened for modification	C:\Windows\L5ezd5JFxGE9CgE.exe	i85HkvS2iqwvE7.exe
File opened for modification	C:\Windows\Ut7vg6lKaa.exe	L5ezd5JFxGE9CgE.exe
File opened for modification	C:\Windows\YeO7cQ.exe	L8VUD2q.exe
File opened for modification	C:\Windows\6XGtWEAHzD60.exe	aaWFTbCqo3.exe
File opened for modification	C:\Windows\5vBY92FiSRS.exe	BUh31wLdFRPqbm.exe
File created	C:\Windows\RDgZSOsDv.exe	IMa5ovQw7DDVyMk.exe
File created	C:\Windows\lcX4w7Cc46.exe	2026-08-25_f732008848b97ac4e4763780005739a2_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\wpHBYkmFwBo.exe	kYOH1Vq.exe
File opened for modification	C:\Windows\6YC1CknlvAe.exe	EW9XUEmLOIv.exe
File opened for modification	C:\Windows\L8VUD2q.exe	6YC1CknlvAe.exe
File opened for modification	C:\Windows\e19954Hvq2vJh.exe	YeO7cQ.exe
File opened for modification	C:\Windows\aaWFTbCqo3.exe	19sA2.exe
File created	C:\Windows\BbN6rgVZ406rN.exe	o52yKC5Qe02.exe
File created	C:\Windows\PqGl2HuSyjkvjhX.exe	BbN6rgVZ406rN.exe
File created	C:\Windows\9kIX3IwgwQI.exe	6XGtWEAHzD60.exe
File opened for modification	C:\Windows\3Qoeqq.exe	lcX4w7Cc46.exe
File opened for modification	C:\Windows\aNz68oj.exe	Ut7vg6lKaa.exe
File created	C:\Windows\K3eSkoLi9kZL0d.exe	5vBY92FiSRS.exe
File opened for modification	C:\Windows\sbSeqjoMsvohh.exe	K3eSkoLi9kZL0d.exe
File created	C:\Windows\rBPy4XyObT.exe	PqGl2HuSyjkvjhX.exe
File opened for modification	C:\Windows\TSyhev1.exe	rBPy4XyObT.exe
File created	C:\Windows\bNtJp.exe	vVEXSQH1gT.exe
File opened for modification	C:\Windows\bNtJp.exe	vVEXSQH1gT.exe
File created	C:\Windows\aNz68oj.exe	Ut7vg6lKaa.exe
File opened for modification	C:\Windows\jjwUJu.exe	8tVks.exe
File created	C:\Windows\BUh31wLdFRPqbm.exe	9kIX3IwgwQI.exe
File opened for modification	C:\Windows\poJQJlH0d0v.exe	ILpB6.exe
File opened for modification	C:\Windows\o52yKC5Qe02.exe	g1udka7FrNi.exe
File opened for modification	C:\Windows\rBPy4XyObT.exe	PqGl2HuSyjkvjhX.exe
File opened for modification	C:\Windows\lcX4w7Cc46.exe	2026-08-25_f732008848b97ac4e4763780005739a2_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\6YC1CknlvAe.exe	EW9XUEmLOIv.exe
File created	C:\Windows\YeO7cQ.exe	L8VUD2q.exe
File created	C:\Windows\19sA2.exe	e19954Hvq2vJh.exe
File opened for modification	C:\Windows\ILpB6.exe	sbSeqjoMsvohh.exe
File created	C:\Windows\LVoxhuXJ37Vz78O.exe	poJQJlH0d0v.exe
File opened for modification	C:\Windows\IMa5ovQw7DDVyMk.exe	3neR4.exe
File opened for modification	C:\Windows\PqGl2HuSyjkvjhX.exe	BbN6rgVZ406rN.exe
File created	C:\Windows\kviUa2Tc.exe	bNtJp.exe
File opened for modification	C:\Windows\BNQoE3wE8.exe	aNz68oj.exe
File created	C:\Windows\e19954Hvq2vJh.exe	YeO7cQ.exe
File opened for modification	C:\Windows\RDgZSOsDv.exe	IMa5ovQw7DDVyMk.exe
File created	C:\Windows\TSyhev1.exe	rBPy4XyObT.exe
File opened for modification	C:\Windows\xlZ2Wijs8v0z4jj.exe	86tPhY.exe
File created	C:\Windows\uRKSwb.exe	Zel4nzyuAB3LC.exe
File opened for modification	C:\Windows\vVEXSQH1gT.exe	uRKSwb.exe
File opened for modification	C:\Windows\EW9XUEmLOIv.exe	Ulb5nKFZ1vk.exe
File opened for modification	C:\Windows\8tVks.exe	BNQoE3wE8.exe
File created	C:\Windows\jjwUJu.exe	8tVks.exe
File opened for modification	C:\Windows\19sA2.exe	e19954Hvq2vJh.exe
File created	C:\Windows\6XGtWEAHzD60.exe	aaWFTbCqo3.exe
File created	C:\Windows\GOtkcb1tdkIWF.exe	AGZmuT.exe

Program crash 16 IoCs

pid	pid_target	Process	procid_target
1192	2540	WerFault.exe	88
5464	2700	WerFault.exe	105
7572	7060	WerFault.exe	131
8824	6848	WerFault.exe	147
9848	9656	WerFault.exe	165
9824	9940	WerFault.exe	167
12736	10852	WerFault.exe	201
13044	2548	WerFault.exe	101
13128	2088	WerFault.exe	103
12760	6820	WerFault.exe	129
12800	7372	WerFault.exe	135
9128	8916	WerFault.exe	155
2524	11112	WerFault.exe	189
13228	10764	WerFault.exe	191
1388	8168	WerFault.exe	143
7468	9652	WerFault.exe	179

System Location Discovery: System Language Discovery 1 TTPs 50 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2Pn6DW99bDpQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	K3eSkoLi9kZL0d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LVoxhuXJ37Vz78O.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zel4nzyuAB3LC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vVEXSQH1gT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ut7vg6lKaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jjwUJu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EW9XUEmLOIv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	L8VUD2q.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sbSeqjoMsvohh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ILpB6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kYOH1Vq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ulb5nKFZ1vk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6YC1CknlvAe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3neR4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BbN6rgVZ406rN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3Qoeqq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86tPhY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kviUa2Tc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aNz68oj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8tVks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	19sA2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDgZSOsDv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g1udka7FrNi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpHBYkmFwBo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uRKSwb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i85HkvS2iqwvE7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e19954Hvq2vJh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aaWFTbCqo3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9kIX3IwgwQI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	o52yKC5Qe02.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rBPy4XyObT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_f732008848b97ac4e4763780005739a2_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lcX4w7Cc46.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xlZ2Wijs8v0z4jj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	L5ezd5JFxGE9CgE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BUh31wLdFRPqbm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IMa5ovQw7DDVyMk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GOtkcb1tdkIWF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bNtJp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BNQoE3wE8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6XGtWEAHzD60.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5vBY92FiSRS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PqGl2HuSyjkvjhX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TSyhev1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lz6v7X1d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YeO7cQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poJQJlH0d0v.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zNK63Ft1Dnj1YU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AGZmuT.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-25_f732008848b97ac4e4763780005739a2_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_f732008848b97ac4e4763780005739a2_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4600

C:\Windows\lcX4w7Cc46.exe
C:\Windows\lcX4w7Cc46.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 1980
  2⤵
  - Program crash
  PID:1192

C:\Windows\3Qoeqq.exe
C:\Windows\3Qoeqq.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4684

C:\Windows\86tPhY.exe
C:\Windows\86tPhY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2540 -ip 2540
1⤵
PID:452

C:\Windows\xlZ2Wijs8v0z4jj.exe
C:\Windows\xlZ2Wijs8v0z4jj.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3788

C:\Windows\kYOH1Vq.exe
C:\Windows\kYOH1Vq.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3396

C:\Windows\wpHBYkmFwBo.exe
C:\Windows\wpHBYkmFwBo.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 2068
  2⤵
  - Program crash
  PID:13044

C:\Windows\Zel4nzyuAB3LC.exe
C:\Windows\Zel4nzyuAB3LC.exe
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 2092
  2⤵
  - Program crash
  PID:13128

C:\Windows\uRKSwb.exe
C:\Windows\uRKSwb.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 1980
  2⤵
  - Program crash
  PID:5464

C:\Windows\vVEXSQH1gT.exe
C:\Windows\vVEXSQH1gT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1464

C:\Windows\bNtJp.exe
C:\Windows\bNtJp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2700 -ip 2700
1⤵
PID:5424

C:\Windows\kviUa2Tc.exe
C:\Windows\kviUa2Tc.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5552

C:\Windows\i85HkvS2iqwvE7.exe
C:\Windows\i85HkvS2iqwvE7.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5800

C:\Windows\L5ezd5JFxGE9CgE.exe
C:\Windows\L5ezd5JFxGE9CgE.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6044

C:\Windows\Ut7vg6lKaa.exe
C:\Windows\Ut7vg6lKaa.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4484

C:\Windows\aNz68oj.exe
C:\Windows\aNz68oj.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6052

C:\Windows\BNQoE3wE8.exe
C:\Windows\BNQoE3wE8.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6332

C:\Windows\8tVks.exe
C:\Windows\8tVks.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6576

C:\Windows\jjwUJu.exe
C:\Windows\jjwUJu.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:6820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6820 -s 2076
  2⤵
  - Program crash
  PID:12760

C:\Windows\2Pn6DW99bDpQ.exe
C:\Windows\2Pn6DW99bDpQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:7060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7060 -s 1972
  2⤵
  - Program crash
  PID:7572

C:\Windows\Ulb5nKFZ1vk.exe
C:\Windows\Ulb5nKFZ1vk.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7020

C:\Windows\EW9XUEmLOIv.exe
C:\Windows\EW9XUEmLOIv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7372 -s 2076
  2⤵
  - Program crash
  PID:12800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 7060 -ip 7060
1⤵
PID:7532

C:\Windows\6YC1CknlvAe.exe
C:\Windows\6YC1CknlvAe.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7668

C:\Windows\L8VUD2q.exe
C:\Windows\L8VUD2q.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7916

C:\Windows\YeO7cQ.exe
C:\Windows\YeO7cQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8168 -s 2224
  2⤵
  - Program crash
  PID:1388

C:\Windows\e19954Hvq2vJh.exe
C:\Windows\e19954Hvq2vJh.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7104

C:\Windows\19sA2.exe
C:\Windows\19sA2.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6848 -s 1976
  2⤵
  - Program crash
  PID:8824

C:\Windows\aaWFTbCqo3.exe
C:\Windows\aaWFTbCqo3.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8376

C:\Windows\6XGtWEAHzD60.exe
C:\Windows\6XGtWEAHzD60.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6848 -ip 6848
1⤵
PID:8808

C:\Windows\9kIX3IwgwQI.exe
C:\Windows\9kIX3IwgwQI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8916 -s 2064
  2⤵
  - Program crash
  PID:9128

C:\Windows\BUh31wLdFRPqbm.exe
C:\Windows\BUh31wLdFRPqbm.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8652

C:\Windows\5vBY92FiSRS.exe
C:\Windows\5vBY92FiSRS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8884

C:\Windows\K3eSkoLi9kZL0d.exe
C:\Windows\K3eSkoLi9kZL0d.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9380

C:\Windows\sbSeqjoMsvohh.exe
C:\Windows\sbSeqjoMsvohh.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9656 -s 1972
  2⤵
  - Program crash
  PID:9848

C:\Windows\ILpB6.exe
C:\Windows\ILpB6.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9940 -s 1988
  2⤵
  - Program crash
  PID:9824

C:\Windows\poJQJlH0d0v.exe
C:\Windows\poJQJlH0d0v.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 9656 -ip 9656
1⤵
PID:9668

C:\Windows\LVoxhuXJ37Vz78O.exe
C:\Windows\LVoxhuXJ37Vz78O.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 9940 -ip 9940
1⤵
PID:9772

C:\Windows\zNK63Ft1Dnj1YU.exe
C:\Windows\zNK63Ft1Dnj1YU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9652 -s 2212
  2⤵
  - Program crash
  PID:7468

C:\Windows\3neR4.exe
C:\Windows\3neR4.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10328

C:\Windows\IMa5ovQw7DDVyMk.exe
C:\Windows\IMa5ovQw7DDVyMk.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10580

C:\Windows\RDgZSOsDv.exe
C:\Windows\RDgZSOsDv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:10824

C:\Windows\g1udka7FrNi.exe
C:\Windows\g1udka7FrNi.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:11112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 11112 -s 2000
  2⤵
  - Program crash
  PID:2524

C:\Windows\o52yKC5Qe02.exe
C:\Windows\o52yKC5Qe02.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10764 -s 2064
  2⤵
  - Program crash
  PID:13228

C:\Windows\BbN6rgVZ406rN.exe
C:\Windows\BbN6rgVZ406rN.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:11408

C:\Windows\PqGl2HuSyjkvjhX.exe
C:\Windows\PqGl2HuSyjkvjhX.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:11784

C:\Windows\rBPy4XyObT.exe
C:\Windows\rBPy4XyObT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:12036

C:\Windows\TSyhev1.exe
C:\Windows\TSyhev1.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:10852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10852 -s 1964
  2⤵
  - Program crash
  PID:12736

C:\Windows\AGZmuT.exe
C:\Windows\AGZmuT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3784

C:\Windows\GOtkcb1tdkIWF.exe
C:\Windows\GOtkcb1tdkIWF.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:12536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 10852 -ip 10852
1⤵
PID:12712

C:\Windows\Lz6v7X1d.exe
C:\Windows\Lz6v7X1d.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:12832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2548 -ip 2548
1⤵
PID:13024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2088 -ip 2088
1⤵
PID:13108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6820 -ip 6820
1⤵
PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 7372 -ip 7372
1⤵
PID:12264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 8916 -ip 8916
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 11112 -ip 11112
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 10764 -ip 10764
1⤵
PID:13200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 8168 -ip 8168
1⤵
PID:6036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 9652 -ip 9652
1⤵
PID:7424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

19sA2.exe

Path C:\Windows\19sA2.exe
Size 804KB
SHA256 cbb9c4df84ff770aadebb41fa70ae564a945f348b9ce7c9fc3288d72cecb360d
MD5 94445be4c4ab135f7e4307551efb110a
SHA1 97a1d34f6043f9f04300087b9b67545bbd71dea6
SHA512 741138bc2fb5b52e46aa918e21225d0886bf6e39d6e69ec766c19422e358dc00790090c9970c6e9f4b02e5ca7151c6c340199d1fb6a2efc0be35698bb6180e5a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouF:0NA1Yakeer5+nsoY
TLSH
T1F405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2Pn6DW99bDpQ.exe

Path C:\Windows\2Pn6DW99bDpQ.exe
Size 804KB
SHA256 a7bc4bfb518b6ac2f0db689022ab23ec76076b175d5217b8a8451a1d01dbc8bf
MD5 484b1c1b498399cfbcd42a988a658b6a
SHA1 e5e99f01ac16cc8d8594c63e5dd2455cdcfed55b
SHA512 2fd7059b80e4c4fc9636e7d9c052076292e279d59ad3508aaa897c4521d2eded9b342ce59053ab31cfdd9dd4748512c777765a3d92f7969ea480b23cc44271af
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouE:0NA1Yakeer5+nsod
TLSH
T11205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3Qoeqq.exe

Path C:\Windows\3Qoeqq.exe
Size 804KB
SHA256 9c1237d8a0a85f8526e74bc6c1e6424c23c4cab9563b98e525f49814bb1c271a
MD5 6533bf406fb57fac4381aa012cc76a33
SHA1 8e7b2bbfb76a2d90a7341d5dd20aa2ce5b8dd101
SHA512 a16f77f23ea87f7aef7ad42c360bd69f6043716b445b3d65ca94a3a3697c63be58fe4b9f616d4ad1a3aad6361e15a3d0d03e38623632065df185147f04dbd977
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouE:0NA1Yakeer5+nsoZ
TLSH
T17C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5vBY92FiSRS.exe

Path C:\Windows\5vBY92FiSRS.exe
Size 804KB
SHA256 95a7b6c0303af67e8ece0f951a22827ad13d9a988cadab2acd8ac613b616aa73
MD5 dc6c7bc4276d6a2afd41dad60a64f32c
SHA1 59f812b4544fc6197d371078e8df0b2883eeca15
SHA512 f60c86780ff9a413f5c5c4eaed7749e26eaa721658721ed5e86aca225dbb7736d9f5c211c682f4be167fbb00c8776b738a92a31f74ccd4c7082f1583596d9821
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouH:0NA1Yakeer5+nsoc
TLSH
T12805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6XGtWEAHzD60.exe

Path C:\Windows\6XGtWEAHzD60.exe
Size 804KB
SHA256 4aa8ad47b3893d5a0904728b204c0776cd8450e0d99dd011494d74ffbb3bdb25
MD5 9f45198ba846982da664f2c7059ab65b
SHA1 9996207811f5005372a1250e3e2e8a525ebb5aa0
SHA512 544bb2bbd858cf8f3fed5905f7d22d32681f5f537be208e4c3eab1ee800b6ac1c40e7d032944515758e08a15670a105fba0f073d2fd7f09f3c88aafebbfdfd48
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou4:0NA1Yakeer5+nsod
TLSH
T18305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6YC1CknlvAe.exe

Path C:\Windows\6YC1CknlvAe.exe
Size 804KB
SHA256 41555b12faa426eb9a3d6331d96502c4a99d939f5b54115a146721408ff4e932
MD5 5fdf1b67a33476975374c3ff529d4b25
SHA1 07e1341e61f0739cdb10e41c414bd4bfa5104a12
SHA512 794bfa5a401fa202a7924ef8fed360175b20e63efb18b59e118d8a2581c562283633c3942fbc76181cd80bf0012b4137beb41f116ed6e493c1369d1c760eb50f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouK:0NA1Yakeer5+nsol
TLSH
T12605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86tPhY.exe

Path C:\Windows\86tPhY.exe
Size 804KB
SHA256 6260d004b17e90a60ab1d0cb1e35d663392543212b09fe0e26dc7af396b1f730
MD5 6b688363e7455a518d2a1664c51d5425
SHA1 5a291161e08ba6777effe22b57a3ecf1c41532b8
SHA512 b5d427b8eb34095adc87ace16c5934e712db12f9c3ce8beb0df6c0907589a6da86e9cf00ef93eedcb3c311a6119e202bad3fbe60ff6e214c74d8f404d4e5cc55
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouI:0NA1Yakeer5+nso5
TLSH
T12A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8tVks.exe

Path C:\Windows\8tVks.exe
Size 804KB
SHA256 f764b7167fec18b3a762a4270c8d07dbde23132c00d0b1850e97d219c4ea3e64
MD5 8d43dc8fb17a0b9702c7760f33882e1d
SHA1 8c80d6f1a09af75cddf80f0a73982d7ef16bfea5
SHA512 fd1cc553122a293f4519c4f32e884af66e9fac91623ed7d2b1918ee8f71baca160c7dd997c4ca85139beae01edbec0c17b916928f7e2415959d130af4bb85beb
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA:0NA1Yakeer5+nsoT
TLSH
T1E905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9kIX3IwgwQI.exe

Path C:\Windows\9kIX3IwgwQI.exe
Size 804KB
SHA256 3ccbd1fbc3cf3cd0572dd7928725d7c565f367381e4fc86d370a4884282756e2
MD5 ac90f6ebadbcee1ca35215a17d36b36d
SHA1 8b7c96e1faf3ce9619bcf721e0977dbebd2f768b
SHA512 c7749dcaf73db8541f023d12fa9c4ffe187cd468f09fc1142c650c9a8462af473ddf3877cb9e1cd1b436615694d6e916cd7948a8eae9be1460114e9398170b0c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoup:0NA1Yakeer5+nsoy
TLSH
T1B805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BNQoE3wE8.exe

Path C:\Windows\BNQoE3wE8.exe
Size 804KB
SHA256 99fbb3b9303a07885c56f137e5b2b10e06db948063789b49c0c6c1e567a503d3
MD5 dbb12ed1f18ade1c6083ab5d17d9f799
SHA1 122f3c6adfc406d93c9c887ba36e713b08d2cfaf
SHA512 30f04f6d14dfbc3b7da734463c21e9421645e31c1aea1ecd76241666b5e0affc8b061cef77ff071a8c5a15318d3122f75ffd6147b3733123bd1b26737641dc18
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouv:0NA1Yakeer5+nso6
TLSH
T1F205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BUh31wLdFRPqbm.exe

Path C:\Windows\BUh31wLdFRPqbm.exe
Size 804KB
SHA256 7551a2190dd9e6cc6c504e68f1c739d72d5a5f5a807356a7b6e6a5e274479a63
MD5 242c4fb4bbd0aa8d7199fa1cab4c2c6d
SHA1 e54763c14a9a3b0d90ea5f19b1b55861ca6f1fa8
SHA512 87c38b7091d237d49852c6db7abe1c968e045eab497120cce64c09de80b4df17446c17612e8a4bca3685e646e61d712138d97133c6fcd850c73e7cae016eea62
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouP:0NA1Yakeer5+nsoE
TLSH
T1E405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EW9XUEmLOIv.exe

Path C:\Windows\EW9XUEmLOIv.exe
Size 804KB
SHA256 1739e23c4f897f94963916356d14e4a7168a829b3b6d6aba22425f456d563e87
MD5 1644892914c5097a60e2a7755eadd78d
SHA1 4e93095cdb392187f8aa610f8bbe3cd890612bf1
SHA512 a2d392abd44630c2f9aaaf7a7c6be28bc8590acc0a2042af23942cc729255423e661299b812adfc31f12961060bac7ad72abb9bbf81f518fd6bfb49857944354
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoupm:0NA1Yakeer5+nsoN
TLSH
T13405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ILpB6.exe

Path C:\Windows\ILpB6.exe
Size 804KB
SHA256 fbe5053f3389c102dd9620b2ce4d2a52cb6bae2aff2bf60e618b311b91c703eb
MD5 f2c57f6b9d4f45b7e7aa29c79d9217ae
SHA1 fd60e15f7a2cd367e297c1a9c9b9dff8da190e86
SHA512 a55b8581945e36bce48c46f03017970b0d8d24ce9275505cdf3769d671ce46f6f88de06adea5b476449a3349a51555f40afc433b3fa66c81e1b334ca2f60b6c8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoud:0NA1Yakeer5+nsoI
TLSH
T11E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

K3eSkoLi9kZL0d.exe

Path C:\Windows\K3eSkoLi9kZL0d.exe
Size 804KB
SHA256 66df36504100b659cfcf12bfc7326d1c93c91da0a576d0c5d027cc213c093a2d
MD5 c26b4af5e99cdffcae839f34c995345a
SHA1 058e73dbe6a4d032e1ec90d53d5fdd408535a17a
SHA512 70e51f3946e4125939faf6b7fefedc4799ed8276a1962657fe6d4588e8b90f3ba5ce396021b6bd2b527fdbc2f6e96a881b6450680ed60e1ee48db0f2afe17301
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouQ:0NA1Yakeer5+nsoZ
TLSH
T1DE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

L5ezd5JFxGE9CgE.exe

Path C:\Windows\L5ezd5JFxGE9CgE.exe
Size 804KB
SHA256 ec03db5c53f114624a7b0187741c6ba12d6b52681ef3076fa610ceac6e8144f4
MD5 f394f8e19c626923d51b5f11f1cbcdb0
SHA1 e3f5683c13892e02fc8026e452ab7409026cae31
SHA512 3f8e30e18477ddd66483d35f44a84a518f5a3c715ec8102ec17b844d0b32f5808d8903552b6eb84b94b840448d7ba16e32eb046db3d0bd5d30e8f3d84820f2ac
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouH:0NA1Yakeer5+nsoK
TLSH
T11F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

L8VUD2q.exe

Path C:\Windows\L8VUD2q.exe
Size 804KB
SHA256 500218f390e8a3c0b015bcd21db71ae3930991d026d4fb513e5fd797d7659cf4
MD5 6c9d704ff770b38fc292df7f1e1e3e80
SHA1 a681ffd35a9f6ee5a5f2bbbae0b536511f7fa9ab
SHA512 007d2826c8187bed1cbc6163aa0c94ebbb1f1d8dcf528b13d0c3dc80101928dd288afaffb275bc537f09b8fc27b4a9c25b17929aa6decb66fab9b8f0820af769
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouK:0NA1Yakeer5+nsoR
TLSH
T1FA05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ulb5nKFZ1vk.exe

Path C:\Windows\Ulb5nKFZ1vk.exe
Size 804KB
SHA256 97c24773e2e840c42b8e3cfeaf6302324d11d86d7443b26f7fde8bfc8b2f0ab7
MD5 4cba67be3b4db93b9aeae04f08c9bcba
SHA1 a83378d08f4099f20e0af200b41c65e7c64041fb
SHA512 c50ca639ba43612c73d476e11d1b9209c980850c62aa1da38ba866b6da8c0d2be77b2cb2ef08381d5301f2af207ff6eb9ebc7b432949d4570173bfc54330d0a1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouZ:0NA1Yakeer5+nsoO
TLSH
T1CD05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ut7vg6lKaa.exe

Path C:\Windows\Ut7vg6lKaa.exe
Size 804KB
SHA256 86d2fc7c342ba16b2155c14bf66fd1629c9352320f154f33184153080fc80e3f
MD5 ba352dff531e97f09d72ce43bf891539
SHA1 c5b7e002bab9e63e9cebc7d51f1652f0abf94cbd
SHA512 f7cd61d13e915320fd579e976cc5cc857b0cc9ee7f35f4517a987afa5498a096376b05411c1f9039b737943df815c64b2f0d5ff18f6a3c993ec6b46ec24f8381
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoua:0NA1Yakeer5+nsop
TLSH
T1DC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YeO7cQ.exe

Path C:\Windows\YeO7cQ.exe
Size 804KB
SHA256 1d395adfe6e8eefd2e79bdf201e71de8a63fdb441149c132ec928663570f5313
MD5 15dfbf4445210e12abbf49f04e438474
SHA1 d3380d5acea3a23cc38abc6f32ec395d5e1be616
SHA512 24476022d555387fbc1ed1e9010ef9ff775cf255a7c486b5c6ee7b2d20a6563739e2fc288bf52f74e39c5d427706d95fc371114c6b8a05ff318ed8bbcfdb595c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nso0
TLSH
T12605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aNz68oj.exe

Path C:\Windows\aNz68oj.exe
Size 804KB
SHA256 8e2cadfffdec9c38e93b3ac8049a1ca500e3cb316336a4219655f460cdcacfa4
MD5 a65d938975ef7f8c28231d77e0331238
SHA1 a445a0931a53988b9b0bed263685db71c029a3d5
SHA512 4fbb6684db1e026c16be05e3edf9faf6d39ad907f97fea41a45433d6ab37a93a07b3844eec3f6f55bf78011e02ea766b9f7caead17fbf0de29fd29baaa70ce27
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nsoG
TLSH
T1AE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aaWFTbCqo3.exe

Path C:\Windows\aaWFTbCqo3.exe
Size 804KB
SHA256 a31fa1e30a77dd5e87160be40a3592aca7ab1aa6c51b0a6d604a49855096ce23
MD5 ac7a1bb7c19d657358c6fddb8f6af711
SHA1 44c9798a58835d8b2c3e86119c7b10d28900d43d
SHA512 b78b44be8872db59419208de8b4a49119452760ad6e6b738a0ce66526182c60609883f14395b80a5f54f81cff0235cf94ccb141bcc536f7726f8d2817f3d7865
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nso2
TLSH
T13205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bNtJp.exe

Path C:\Windows\bNtJp.exe
Size 804KB
SHA256 7feb315134e44979696d6ef0b747a7629e422b97cc19924c61b8fb31dd467ca4
MD5 193a44eecf2af9b73930ad4c81dd1169
SHA1 6cac5cb9c576db7b7b0279608ad3bbf8933abd36
SHA512 cab55d6edf09fda9d1197c1c65249f00d3bcdd144e47a5762e67852e5be0be2d9997a6383525d670bbc4e56ef29c645fe52d9861dad6dc9118fc6d51c910badc
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouP:0NA1Yakeer5+nsoY
TLSH
T19B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e19954Hvq2vJh.exe

Path C:\Windows\e19954Hvq2vJh.exe
Size 804KB
SHA256 1faa2e299bd0c8af6a02912ce6c9466f627aadecc90251faabfec9b2ef7a23de
MD5 cc097de9726fa864538bcf284f1ef0af
SHA1 95e16aae24b9da6545b1a658ae84406dd0390da8
SHA512 8f083690a035a2ab7061ac1f5a78745ee41c537d3a404c61ee19dee3f86831653d5fd47f8f6ce9ef8e1176f9b463598e67071f88b5d5448692eb906cafeefd98
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouu:0NA1Yakeer5+nsoP
TLSH
T13505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i85HkvS2iqwvE7.exe

Path C:\Windows\i85HkvS2iqwvE7.exe
Size 804KB
SHA256 3ba31eaef29b478314192848e93bcaec0ff1c9976916dbdc5f00758325adc10e
MD5 ba162d1e646d05f2886b8114aabae4a9
SHA1 79b984009a0505ab5f2141c0a1b3e778cb33302c
SHA512 7ea7e17fa2f1f113b81a02da514319c277d3b0096e41703f94e228912df20d6173e0b592fdb5b208d6c7515e4e098bcfd2c8eb0ebd9fa23f8592467a441ec722
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouy:0NA1Yakeer5+nsor
TLSH
T11005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjwUJu.exe

Path C:\Windows\jjwUJu.exe
Size 804KB
SHA256 a6a1c728b2992113ee74870f24c53a71f0f8dd07c02af31c54f9fd0cde080ee8
MD5 f51eafcfd138772ee55ef8cc58ef462f
SHA1 8e5cbf39bce4f4d4bf7a4a5ba63777c8d130768e
SHA512 430540711124333692a961dde992c0e9a35f73404d69e706bddb451f13f9a5d08bdf3fe067fdc5f7321bbb4b5982d5a1583615cf6d7bb704b9e44a31e4e61aaf
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouK:0NA1Yakeer5+nsoZ
TLSH
T19B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kYOH1Vq.exe

Path C:\Windows\kYOH1Vq.exe
Size 804KB
SHA256 d0462bd700d74cddc10d259eadcc5db4d5bc4ef4c80514aa5e9791468dad4260
MD5 3284bc9678db1a18727738dcf857b5fb
SHA1 ae72f75265d61f8c45fcb8f075ffb52ae66ea947
SHA512 7c75ef2b8b8073cf25d434c9afb10ccb8f6e4c01bd10e72e0130132dff1cfc20d735632dbdf60e6bdad84315847e80d9c94371a146caf9deed524509a65b7b0a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou/:0NA1Yakeer5+nsoW
TLSH
T1A005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kviUa2Tc.exe

Path C:\Windows\kviUa2Tc.exe
Size 804KB
SHA256 86c03ddf432f51d1e9773cf43c08b015b11108f861fefe1c4336a3ca9093d129
MD5 889738140e736f78a746be1710a0c1fd
SHA1 72df9f1af39120632953784d8af77ef1d6d83dc4
SHA512 863cb78842c4c8a25b3ec7beed64aa3af12153c6a3167419ce0022a1d2da8b6475b4c0a04993713a8f971190457f162c6b593a853565ed5db439bcf65f430e2b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouN:0NA1Yakeer5+nsoC
TLSH
T18305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lcX4w7Cc46.exe

Path C:\Windows\lcX4w7Cc46.exe
Size 804KB
SHA256 46f38fa584ebfe4e7764f8be27398021e6b96a266739c1a5af1ec9a58fa3b87d
MD5 314852cd33211ca63386eea7ecf41bb4
SHA1 faa7a8a0c94940625f82c0ecf7cd62ef9cca0158
SHA512 d209217c19e80502dda2faf164bd0c52b80085ee0337077161015a677d95a4f2e2fccb693cfacd6525b042f887ddd6eaacf6c6d86f25b6b7e95f05e5e705c81a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nsoy
TLSH
T1A905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sbSeqjoMsvohh.exe

Path C:\Windows\sbSeqjoMsvohh.exe
Size 804KB
SHA256 d81cf1940a54f33a55dbbfdf2ed49f4d8f790f3e64b49a7a34d5eff7b793fda8
MD5 ddba1e7ea25b48bfb3b73784ecaf71ff
SHA1 4da53552d61b55edd550abe58f38626b5d91d7ad
SHA512 f3586a3e8760a8d6f4be62bc2102e53c8c13a91bfdeb9c8b12e9c2994d3a09d26f80349086fc197c1e7e0f8c9266da32fcf9d4103c4bb30d282f6660ba285a09
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouY:0NA1Yakeer5+nsoZ
TLSH
T10105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uRKSwb.exe

Path C:\Windows\uRKSwb.exe
Size 804KB
SHA256 5f7438dad029644448d0b5160f1b0a7d5534cf4e529de1faf51d1de7fcff23b9
MD5 b580b074c8734046863c1d035c6b25de
SHA1 a6c7c7c187d4da3b3b6b99e36aaddfc5f8e9e0e9
SHA512 1d669a5d3f190db00eb548f612e3d221db1c2390127e061a989c156ba541d77dfb1d1028d1307501f30bd14645ec5c7097ba116326e10a5e5c708bed4386d25c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoud:0NA1Yakeer5+nso0
TLSH
T12905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vVEXSQH1gT.exe

Path C:\Windows\vVEXSQH1gT.exe
Size 804KB
SHA256 58075c946dd5041e1d065f5c2e05d602ce8f8c1c133c180f3aa52501e977ead1
MD5 f14c2bee17a237ec29a481638b9e33fd
SHA1 65ec26935d0bbbb25372fe749805f2b4f034573f
SHA512 416f70529793df6af67efdfe1e833f6299b5053b5af01599f7410968c59a9af5e77b6a4cfca6a48ceb80a53475778b78e4e2a78c720a283b0e79861a67b31fa5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouH:0NA1Yakeer5+nsoO
TLSH
T10A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpHBYkmFwBo.exe

Path C:\Windows\wpHBYkmFwBo.exe
Size 804KB
SHA256 1d0ca7f5d5e57c9880e8f44cfce9fdce1a64e72de6384debabe5f64b5fe18cca
MD5 a3bdcb045f8d2958bb5ceaab24881357
SHA1 47edbffa85b8b5a67e6a41324ebb076fe9d03b82
SHA512 2dfc4176bd48208a20f04b665a49db274b49a513dc26b664c5006b40fbbd24d2690db4233fd37809aeeebf74420d34c0571df49b696e370a5393c99d60ede2bf
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouz:0NA1Yakeer5+nsoi
TLSH
T10205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xlZ2Wijs8v0z4jj.exe

Path C:\Windows\xlZ2Wijs8v0z4jj.exe
Size 804KB
SHA256 498113ffb188aba2d3e5b1af900a4c23d1ea827164caa0e89bc66ea177080586
MD5 2b850906cce5c6f2ee3381d6a00610a7
SHA1 b2285b0f9a913426c892596a359032bd61c7ef1b
SHA512 a946868701eb76162b5b5ced2da9ac1dc6f7c2fc0263c60494951f0429a1ef2134aadf2509f9e7848164a98828445f8ca0b60c8ddd418f4b063f009ade79db51
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouu:0NA1Yakeer5+nsoJ
TLSH
T11705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads