eb094a924f68001d800145263afd3993fc39d903e7613c6c66c9506b72d25c21

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_256e93529f0d22826ec4f6e3ddc14eba_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample261002-wqa3eathrg
SHA256 eb094a924f68001d800145263afd3993fc39d903e7613c6c66c9506b72d25c21
MD5 256e93529f0d22826ec4f6e3ddc14eba
SHA1 7ec1eb2d433137bab20a96c6671592728eedcf12
SHA512 b707cac00a776cf52f20d3a5454f4304e3716b91cda59922b80d221c2132cba925b898b539c6a8cc92c6d0a6c6c26f662a901f838290e92864047054c57a4394
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA:0NA1Yakeer5+nsoL
TLSH
T1C005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (3540) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 39 IoCs

pid	Process
4800	hQITK0P.exe
2644	bMplCDxVXTGvkD.exe
1204	UTAlVLZYjG4p.exe
4740	GKWDvTzlHWTMK.exe
4408	OG4vXcOir5hbxE.exe
3324	XPBc9wdh0abS.exe
5252	QHeokgThNpJ.exe
5532	gwAht5u.exe
5772	P9kmBrbxUiVBW4K.exe
6012	D4YaoMdbL4AzXp.exe
6268	bqO2bdGN6.exe
6608	NH5O23L0kbVSD.exe
6864	H19MHSqN.exe
7120	wH7RCZeoSq8SQ.exe
5856	Ja9Nz1.exe
7084	v1YVMGI0.exe
6568	pC4ivv0.exe
7284	6j5bO0t.exe
7536	OhVPesTY.exe
7780	UUbvShP.exe
8028	ptD3dg.exe
8236	EPtD8T.exe
8484	7ENsvWu.exe
8752	AnvM3J10aiS.exe
9012	wr9Pnl.exe
8760	v2SuSmEZ.exe
8624	UDBVTEQtER1Q.exe
9344	4JlLPu95.exe
9592	11EazoQ.exe
9928	XeGaSElVLcQUPoA.exe
10200	ZnQB8ltSOvwyMay.exe
10228	NxXI7m1q6k.exe
2812	vhkohEWI.exe
9536	yRHc8.exe
10440	Gxcv0yge2knGQ.exe
10780	tzGqC.exe
11188	ZRlyMjj6d.exe
10680	bwiVnaA.exe
11324	ReSSe.exe

Adds Run key to start application 2 TTPs 39 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVKSERV = "C:\\Windows\\XPBc9wdh0abS.exe"	OG4vXcOir5hbxE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RAV7WIN = "C:\\Windows\\wH7RCZeoSq8SQ.exe"	H19MHSqN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVWUPD32 = "C:\\Windows\\v1YVMGI0.exe"	Ja9Nz1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FNRB32 = "C:\\Windows\\pC4ivv0.exe"	v1YVMGI0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F-AGNT95 = "C:\\Windows\\6j5bO0t.exe"	pC4ivv0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVKWCTL9 = "C:\\Windows\\UDBVTEQtER1Q.exe"	v2SuSmEZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DOORS = "C:\\Windows\\gwAht5u.exe"	QHeokgThNpJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PROCESSMONITOR = "C:\\Windows\\ptD3dg.exe"	UUbvShP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PERSWF = "C:\\Windows\\wr9Pnl.exe"	AnvM3J10aiS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVWINNT = "C:\\Windows\\vhkohEWI.exe"	NxXI7m1q6k.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ESPWATCH = "C:\\Windows\\UTAlVLZYjG4p.exe"	bMplCDxVXTGvkD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NWTOOL16 = "C:\\Windows\\H19MHSqN.exe"	NH5O23L0kbVSD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VSMAIN = "C:\\Windows\\tzGqC.exe"	Gxcv0yge2knGQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IFACE = "C:\\Windows\\OhVPesTY.exe"	6j5bO0t.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FCH32 = "C:\\Windows\\UUbvShP.exe"	OhVPesTY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TAUMON = "C:\\Windows\\EPtD8T.exe"	ptD3dg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\APVXDWIN = "C:\\Windows\\XeGaSElVLcQUPoA.exe"	11EazoQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCAN32, = "C:\\Windows\\NxXI7m1q6k.exe"	ZnQB8ltSOvwyMay.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ICLOADNT = "C:\\Windows\\bMplCDxVXTGvkD.exe"	hQITK0P.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\N32SCANW = "C:\\Windows\\Ja9Nz1.exe"	wH7RCZeoSq8SQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ACKWIN32 = "C:\\Windows\\AnvM3J10aiS.exe"	7ENsvWu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVP32 = "C:\\Windows\\11EazoQ.exe"	4JlLPu95.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FSGK32 = "C:\\Windows\\bwiVnaA.exe"	ZRlyMjj6d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVXW = "C:\\Windows\\ReSSe.exe"	bwiVnaA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CONNECTIONMONITOR = "C:\\Windows\\GKWDvTzlHWTMK.exe"	UTAlVLZYjG4p.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVXQUAR = "C:\\Windows\\bqO2bdGN6.exe"	D4YaoMdbL4AzXp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPFSERVICE = "C:\\Windows\\v2SuSmEZ.exe"	wr9Pnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVSCHED32 = "C:\\Windows\\4JlLPu95.exe"	UDBVTEQtER1Q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ISRV95 = "C:\\Windows\\ZnQB8ltSOvwyMay.exe"	XeGaSElVLcQUPoA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FSAV32 = "C:\\Windows\\yRHc8.exe"	vhkohEWI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MGAVRTCL = "C:\\Windows\\QHeokgThNpJ.exe"	XPBc9wdh0abS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FRW = "C:\\Windows\\P9kmBrbxUiVBW4K.exe"	gwAht5u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RESCUE = "C:\\Windows\\hQITK0P.exe"	2026-10-01_256e93529f0d22826ec4f6e3ddc14eba_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TCM = "C:\\Windows\\D4YaoMdbL4AzXp.exe"	P9kmBrbxUiVBW4K.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZONEALARM = "C:\\Windows\\NH5O23L0kbVSD.exe"	bqO2bdGN6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\POP3TRAP = "C:\\Windows\\7ENsvWu.exe"	EPtD8T.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NPSCHECK = "C:\\Windows\\Gxcv0yge2knGQ.exe"	yRHc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVAPW32 = "C:\\Windows\\ZRlyMjj6d.exe"	tzGqC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MGHTML = "C:\\Windows\\OG4vXcOir5hbxE.exe"	GKWDvTzlHWTMK.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\OhVPesTY.exe	6j5bO0t.exe
File created	C:\Windows\UDBVTEQtER1Q.exe	v2SuSmEZ.exe
File opened for modification	C:\Windows\OG4vXcOir5hbxE.exe	GKWDvTzlHWTMK.exe
File opened for modification	C:\Windows\gwAht5u.exe	QHeokgThNpJ.exe
File opened for modification	C:\Windows\UUbvShP.exe	OhVPesTY.exe
File opened for modification	C:\Windows\7ENsvWu.exe	EPtD8T.exe
File opened for modification	C:\Windows\NxXI7m1q6k.exe	ZnQB8ltSOvwyMay.exe
File created	C:\Windows\yRHc8.exe	vhkohEWI.exe
File opened for modification	C:\Windows\yRHc8.exe	vhkohEWI.exe
File created	C:\Windows\UTAlVLZYjG4p.exe	bMplCDxVXTGvkD.exe
File created	C:\Windows\XPBc9wdh0abS.exe	OG4vXcOir5hbxE.exe
File created	C:\Windows\bqO2bdGN6.exe	D4YaoMdbL4AzXp.exe
File created	C:\Windows\H19MHSqN.exe	NH5O23L0kbVSD.exe
File created	C:\Windows\wH7RCZeoSq8SQ.exe	H19MHSqN.exe
File created	C:\Windows\pC4ivv0.exe	v1YVMGI0.exe
File created	C:\Windows\7ENsvWu.exe	EPtD8T.exe
File created	C:\Windows\gwAht5u.exe	QHeokgThNpJ.exe
File created	C:\Windows\NH5O23L0kbVSD.exe	bqO2bdGN6.exe
File created	C:\Windows\Ja9Nz1.exe	wH7RCZeoSq8SQ.exe
File opened for modification	C:\Windows\hQITK0P.exe	2026-10-01_256e93529f0d22826ec4f6e3ddc14eba_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\OG4vXcOir5hbxE.exe	GKWDvTzlHWTMK.exe
File created	C:\Windows\v1YVMGI0.exe	Ja9Nz1.exe
File created	C:\Windows\ptD3dg.exe	UUbvShP.exe
File opened for modification	C:\Windows\P9kmBrbxUiVBW4K.exe	gwAht5u.exe
File created	C:\Windows\6j5bO0t.exe	pC4ivv0.exe
File opened for modification	C:\Windows\EPtD8T.exe	ptD3dg.exe
File created	C:\Windows\v2SuSmEZ.exe	wr9Pnl.exe
File created	C:\Windows\vhkohEWI.exe	NxXI7m1q6k.exe
File created	C:\Windows\Gxcv0yge2knGQ.exe	yRHc8.exe
File created	C:\Windows\EPtD8T.exe	ptD3dg.exe
File created	C:\Windows\4JlLPu95.exe	UDBVTEQtER1Q.exe
File created	C:\Windows\hQITK0P.exe	2026-10-01_256e93529f0d22826ec4f6e3ddc14eba_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\bMplCDxVXTGvkD.exe	hQITK0P.exe
File opened for modification	C:\Windows\ZRlyMjj6d.exe	tzGqC.exe
File opened for modification	C:\Windows\v1YVMGI0.exe	Ja9Nz1.exe
File created	C:\Windows\UUbvShP.exe	OhVPesTY.exe
File opened for modification	C:\Windows\11EazoQ.exe	4JlLPu95.exe
File created	C:\Windows\XeGaSElVLcQUPoA.exe	11EazoQ.exe
File created	C:\Windows\ZnQB8ltSOvwyMay.exe	XeGaSElVLcQUPoA.exe
File created	C:\Windows\D4YaoMdbL4AzXp.exe	P9kmBrbxUiVBW4K.exe
File opened for modification	C:\Windows\GKWDvTzlHWTMK.exe	UTAlVLZYjG4p.exe
File opened for modification	C:\Windows\XPBc9wdh0abS.exe	OG4vXcOir5hbxE.exe
File created	C:\Windows\P9kmBrbxUiVBW4K.exe	gwAht5u.exe
File created	C:\Windows\NxXI7m1q6k.exe	ZnQB8ltSOvwyMay.exe
File created	C:\Windows\tzGqC.exe	Gxcv0yge2knGQ.exe
File opened for modification	C:\Windows\tzGqC.exe	Gxcv0yge2knGQ.exe
File created	C:\Windows\ReSSe.exe	bwiVnaA.exe
File created	C:\Windows\bMplCDxVXTGvkD.exe	hQITK0P.exe
File opened for modification	C:\Windows\ptD3dg.exe	UUbvShP.exe
File opened for modification	C:\Windows\ZnQB8ltSOvwyMay.exe	XeGaSElVLcQUPoA.exe
File opened for modification	C:\Windows\AnvM3J10aiS.exe	7ENsvWu.exe
File created	C:\Windows\wr9Pnl.exe	AnvM3J10aiS.exe
File opened for modification	C:\Windows\UDBVTEQtER1Q.exe	v2SuSmEZ.exe
File created	C:\Windows\11EazoQ.exe	4JlLPu95.exe
File opened for modification	C:\Windows\vhkohEWI.exe	NxXI7m1q6k.exe
File opened for modification	C:\Windows\bwiVnaA.exe	ZRlyMjj6d.exe
File opened for modification	C:\Windows\ReSSe.exe	bwiVnaA.exe
File opened for modification	C:\Windows\H19MHSqN.exe	NH5O23L0kbVSD.exe
File created	C:\Windows\OhVPesTY.exe	6j5bO0t.exe
File opened for modification	C:\Windows\v2SuSmEZ.exe	wr9Pnl.exe
File opened for modification	C:\Windows\Gxcv0yge2knGQ.exe	yRHc8.exe
File created	C:\Windows\bwiVnaA.exe	ZRlyMjj6d.exe
File opened for modification	C:\Windows\UTAlVLZYjG4p.exe	bMplCDxVXTGvkD.exe
File created	C:\Windows\GKWDvTzlHWTMK.exe	UTAlVLZYjG4p.exe

Program crash 16 IoCs

pid	pid_target	Process	procid_target
6512	5772	WerFault.exe	113
5936	6608	WerFault.exe	125
8244	8484	WerFault.exe	149
9836	9592	WerFault.exe	163
9648	9928	WerFault.exe	167
11792	2644	WerFault.exe	93
11916	3324	WerFault.exe	106
12144	5856	WerFault.exe	133
11036	7536	WerFault.exe	141
11496	8760	WerFault.exe	157
5016	10228	WerFault.exe	173
4580	6568	WerFault.exe	137
3960	10200	WerFault.exe	169
6828	9536	WerFault.exe	180
5756	10780	WerFault.exe	185
4404	10680	WerFault.exe	191

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-01_256e93529f0d22826ec4f6e3ddc14eba_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-01_256e93529f0d22826ec4f6e3ddc14eba_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4JlLPu95.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D4YaoMdbL4AzXp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NxXI7m1q6k.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxcv0yge2knGQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZRlyMjj6d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QHeokgThNpJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gwAht5u.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OhVPesTY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZnQB8ltSOvwyMay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yRHc8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tzGqC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XPBc9wdh0abS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wH7RCZeoSq8SQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wr9Pnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwiVnaA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bMplCDxVXTGvkD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bqO2bdGN6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ja9Nz1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v2SuSmEZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_256e93529f0d22826ec4f6e3ddc14eba_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hQITK0P.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v1YVMGI0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnvM3J10aiS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UDBVTEQtER1Q.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11EazoQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XeGaSElVLcQUPoA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EPtD8T.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ENsvWu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	H19MHSqN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UTAlVLZYjG4p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OG4vXcOir5hbxE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NH5O23L0kbVSD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6j5bO0t.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vhkohEWI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	P9kmBrbxUiVBW4K.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ptD3dg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReSSe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GKWDvTzlHWTMK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pC4ivv0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UUbvShP.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-01_256e93529f0d22826ec4f6e3ddc14eba_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_256e93529f0d22826ec4f6e3ddc14eba_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3856

C:\Windows\hQITK0P.exe
C:\Windows\hQITK0P.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4800

C:\Windows\bMplCDxVXTGvkD.exe
C:\Windows\bMplCDxVXTGvkD.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 2096
  2⤵
  - Program crash
  PID:11792

C:\Windows\UTAlVLZYjG4p.exe
C:\Windows\UTAlVLZYjG4p.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1204

C:\Windows\GKWDvTzlHWTMK.exe
C:\Windows\GKWDvTzlHWTMK.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4740

C:\Windows\OG4vXcOir5hbxE.exe
C:\Windows\OG4vXcOir5hbxE.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4408

C:\Windows\XPBc9wdh0abS.exe
C:\Windows\XPBc9wdh0abS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 2100
  2⤵
  - Program crash
  PID:11916

C:\Windows\QHeokgThNpJ.exe
C:\Windows\QHeokgThNpJ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5252

C:\Windows\gwAht5u.exe
C:\Windows\gwAht5u.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5532

C:\Windows\P9kmBrbxUiVBW4K.exe
C:\Windows\P9kmBrbxUiVBW4K.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5772 -s 1736
  2⤵
  - Program crash
  PID:6512

C:\Windows\D4YaoMdbL4AzXp.exe
C:\Windows\D4YaoMdbL4AzXp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6012

C:\Windows\bqO2bdGN6.exe
C:\Windows\bqO2bdGN6.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5772 -ip 5772
1⤵
PID:6488

C:\Windows\NH5O23L0kbVSD.exe
C:\Windows\NH5O23L0kbVSD.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6608 -s 1972
  2⤵
  - Program crash
  PID:5936

C:\Windows\H19MHSqN.exe
C:\Windows\H19MHSqN.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6864

C:\Windows\wH7RCZeoSq8SQ.exe
C:\Windows\wH7RCZeoSq8SQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6608 -ip 6608
1⤵
PID:7148

C:\Windows\Ja9Nz1.exe
C:\Windows\Ja9Nz1.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 2096
  2⤵
  - Program crash
  PID:12144

C:\Windows\v1YVMGI0.exe
C:\Windows\v1YVMGI0.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7084

C:\Windows\pC4ivv0.exe
C:\Windows\pC4ivv0.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6568 -s 2212
  2⤵
  - Program crash
  PID:4580

C:\Windows\6j5bO0t.exe
C:\Windows\6j5bO0t.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7284

C:\Windows\OhVPesTY.exe
C:\Windows\OhVPesTY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7536 -s 2108
  2⤵
  - Program crash
  PID:11036

C:\Windows\UUbvShP.exe
C:\Windows\UUbvShP.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7780

C:\Windows\ptD3dg.exe
C:\Windows\ptD3dg.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8028

C:\Windows\EPtD8T.exe
C:\Windows\EPtD8T.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8236

C:\Windows\7ENsvWu.exe
C:\Windows\7ENsvWu.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8484 -s 1976
  2⤵
  - Program crash
  PID:8244

C:\Windows\AnvM3J10aiS.exe
C:\Windows\AnvM3J10aiS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8752

C:\Windows\wr9Pnl.exe
C:\Windows\wr9Pnl.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 8484 -ip 8484
1⤵
PID:9176

C:\Windows\v2SuSmEZ.exe
C:\Windows\v2SuSmEZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8760 -s 2112
  2⤵
  - Program crash
  PID:11496

C:\Windows\UDBVTEQtER1Q.exe
C:\Windows\UDBVTEQtER1Q.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8624

C:\Windows\4JlLPu95.exe
C:\Windows\4JlLPu95.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9344

C:\Windows\11EazoQ.exe
C:\Windows\11EazoQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9592 -s 1968
  2⤵
  - Program crash
  PID:9836

C:\Windows\XeGaSElVLcQUPoA.exe
C:\Windows\XeGaSElVLcQUPoA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9928 -s 1980
  2⤵
  - Program crash
  PID:9648

C:\Windows\ZnQB8ltSOvwyMay.exe
C:\Windows\ZnQB8ltSOvwyMay.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10200 -s 2204
  2⤵
  - Program crash
  PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 9592 -ip 9592
1⤵
PID:9812

C:\Windows\NxXI7m1q6k.exe
C:\Windows\NxXI7m1q6k.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10228 -s 2104
  2⤵
  - Program crash
  PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 9928 -ip 9928
1⤵
PID:9660

C:\Windows\vhkohEWI.exe
C:\Windows\vhkohEWI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2812

C:\Windows\yRHc8.exe
C:\Windows\yRHc8.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9536 -s 2212
  2⤵
  - Program crash
  PID:6828

C:\Windows\Gxcv0yge2knGQ.exe
C:\Windows\Gxcv0yge2knGQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10440

C:\Windows\tzGqC.exe
C:\Windows\tzGqC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10780 -s 2212
  2⤵
  - Program crash
  PID:5756

C:\Windows\ZRlyMjj6d.exe
C:\Windows\ZRlyMjj6d.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:11188

C:\Windows\bwiVnaA.exe
C:\Windows\bwiVnaA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10680 -s 2212
  2⤵
  - Program crash
  PID:4404

C:\Windows\ReSSe.exe
C:\Windows\ReSSe.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:11324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2644 -ip 2644
1⤵
PID:11768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3324 -ip 3324
1⤵
PID:11892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5856 -ip 5856
1⤵
PID:12124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 7536 -ip 7536
1⤵
PID:11092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 8760 -ip 8760
1⤵
PID:11596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 10228 -ip 10228
1⤵
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6568 -ip 6568
1⤵
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 10200 -ip 10200
1⤵
PID:12124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 9536 -ip 9536
1⤵
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 10780 -ip 10780
1⤵
PID:6888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 10680 -ip 10680
1⤵
PID:5896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

11EazoQ.exe

Path C:\Windows\11EazoQ.exe
Size 804KB
SHA256 e4bedd6806f4b45bcbc61aea68e5a338ca8c8e92eb540602b87f0cbd7c99b804
MD5 43da18d2ce1d90362e48d27091ed628b
SHA1 0078731b6d10f62a8e66920faa51b7e882be93ad
SHA512 c62665c8b387a66bf5b47fbc7c50b72979dd48e361eb2c6db76e593c5d026b4c086888df466d116e5e8e52b69c2cdc8f3b9a7d7c44a983f401b3bcccbbd01672
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoux:0NA1Yakeer5+nsoC
TLSH
T17B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4JlLPu95.exe

Path C:\Windows\4JlLPu95.exe
Size 804KB
SHA256 da3e810c05bd7574eca029a5c875bdd3dd00543db0d8ee56cb841983c8da9ad4
MD5 0a2afb807e6e87490a5e3601c1f3119d
SHA1 34ac65db9753ca1c306e50bd47430fe69cc4ab44
SHA512 80588191002b7efb2aa3a5f55c9c4f214164e5413cbf206dd7fe0284d829ef402d9f1bc433d2e93f4cd4bcab5675655f9984dafff47e100b801205a0e9fa7bf4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouq:0NA1Yakeer5+nso7
TLSH
T13005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6j5bO0t.exe

Path C:\Windows\6j5bO0t.exe
Size 804KB
SHA256 deae3af05da465a4f44cef08b0a4b87e65ab7d1c4947f8cecf29a69731a14680
MD5 42656827a051ddafbd08e6b744d834c5
SHA1 00eecc45c1bf41e66b821bb521eac57c44620674
SHA512 e50cd5c57bf24edbd5ab63b07e404af49767e1f31db55b8ff166774858d605a490550504a2de76618180f487b373d6b3d6440821b57e7d64f589610dc22caeb7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nso2
TLSH
T1F205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ENsvWu.exe

Path C:\Windows\7ENsvWu.exe
Size 804KB
SHA256 a470f14a8d1cccf8830496e250fa04070940b92d694d2a73427fbcef6d434b09
MD5 aa1d5793eca5bbe11a446e9193462f6c
SHA1 e12e3ebcaa5ccf3097488211101fbfd130d03c42
SHA512 20df5a7ff7252ffdd1b00a215e253bf455e32d937ed3903c5bc5730b7ad51acb9762263c5c16e25f78ca2dfa81fa9aa8e9d8e62e769be8894306957e79632ec3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou7:0NA1Yakeer5+nsou
TLSH
T1EE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnvM3J10aiS.exe

Path C:\Windows\AnvM3J10aiS.exe
Size 804KB
SHA256 86ea8ef48a5aa4298928abb67f3fb9fa8eabaf76d6705a488b17b7c4fbda6961
MD5 32e7682ab6e21a928431220585f1f626
SHA1 e53020a913357633329a1582ee7b05fb2a03f215
SHA512 13b39c23656ce74b11a80b04684f1548f291f550e51ba87c314493ea14a717525443e0e9e9bc083f43a149305ae3959dd3af6a2976d16d3602ec73d45ffdacdd
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nsoo
TLSH
T16305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D4YaoMdbL4AzXp.exe

Path C:\Windows\D4YaoMdbL4AzXp.exe
Size 804KB
SHA256 66c80fbc6b664c3a3db35eb04dc5ef7d7c83b82baf552c9f5d6ef94f94b41944
MD5 246823fd0b823ff6febd3a2faa1daa4a
SHA1 66334d150b267c3a509d54e262905f822b0cb88b
SHA512 5fe4192a7dec8593bbe112337a2425680b792f01534a479dc5be13687198e5e2de80df9879566b4f95771f94e0ab1ac060bf9c6772aa512542dc59fc69733b58
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouj:0NA1Yakeer5+nsoM
TLSH
T15505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EPtD8T.exe

Path C:\Windows\EPtD8T.exe
Size 804KB
SHA256 e7119409fc4f22985f0b0ea9f0da760d2bdbf62058c652b7c6582e38e6633e7a
MD5 3148d048758e4cf1bc668f8a99b9238d
SHA1 e59da8924cc758f0d96227e0cc8e7645a68dad94
SHA512 b9447be61c801bc0fe9796651129bd9331eae2e471b7ac139e27eeb3a93bcc9a274e9b1b7839ab1f8fea97bc0fe611bf76153eedbc92915dfaebe389c6a626fa
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouu:0NA1Yakeer5+nsoD
TLSH
T17D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GKWDvTzlHWTMK.exe

Path C:\Windows\GKWDvTzlHWTMK.exe
Size 804KB
SHA256 c50eb3826f4fd0ee40e3b608e006e0981b4c390c67348d90d7bb4a9f57d81f25
MD5 7d1e322f7a0e1cf7abe8cfc97f1f5b0a
SHA1 d07802d72e46b704fd48c60db9bd46eb7c3bd22f
SHA512 d7e97eb7e616397a82fe856c5c72577543a99c0cb818617b2b6ce40b2dbf7da8d6c749ee5f41f8df4f7fa2ce4bfd34ad0933d49746cee5ba005929596bec9023
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFout:0NA1Yakeer5+nsoS
TLSH
T19805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

H19MHSqN.exe

Path C:\Windows\H19MHSqN.exe
Size 804KB
SHA256 55684330fa43ef38b84a7a5b7877260f1222f4328141fed238a588c7c349d55f
MD5 72627abace4a9f2a05cc82a7b92c8e10
SHA1 2939e3385e59234bb341dc944e7a3a8840775f67
SHA512 c85b39cc22300909096cbc5010b6c7eaf558aaf8f80625ca1c1852f5ee3dd58139a1ec37fc7645bc6ab12c7e57eb15e391b4c2ff9ecd6f499e1fb4ec95a5fa19
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouM:0NA1Yakeer5+nso9
TLSH
T11A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ja9Nz1.exe

Path C:\Windows\Ja9Nz1.exe
Size 804KB
SHA256 964cb9a519b2ba19be8b8a1c3d7fe694aab195f62895df54eedde643a7efab8a
MD5 996f75b2d2ac765b92355c0e408cdae7
SHA1 f188b33ccf3dc7c31ac5e2e56c34aa617d6efb79
SHA512 d9178ce0d0e75f97a39dd6825fc1fb4e1a9c347af156447f46191f5060cefcd170655263b5714b6a4952915d38ee7546d90dd5f9670ea6cc5135a101adac0861
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouT:0NA1Yakeer5+nsoC
TLSH
T11705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NH5O23L0kbVSD.exe

Path C:\Windows\NH5O23L0kbVSD.exe
Size 804KB
SHA256 b1fbe158daea9423565f7ad370b3234fe71df84dca38b96a4d73d95eef3f6d41
MD5 8706e089c96ecb22f0a58f25c515efeb
SHA1 26a49cd5e53e07f5a2bfcc61e5dfcece993a9483
SHA512 3c471f522b2a0d7d287a9996a3230cc9e011efc7380ea314c9f40572066af57aefc809c5d4a5b9949308627e7066e4b32d8031547f52b3d7665dcf62f275d5f4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou5:0NA1Yakeer5+nso8
TLSH
T17F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NxXI7m1q6k.exe

Path C:\Windows\NxXI7m1q6k.exe
Size 804KB
SHA256 d7449dfb26668248210eb123aa79af135dbd2b1493fca5f0be40717af5e10308
MD5 8b843472ac3de8cf89a45989a6ef83a8
SHA1 b9fc140b4e7e2fc0010b22e0245c2c81a0ee814b
SHA512 7d7fe0cadca5d4465e5fe3e91ade0678c8ceace8a5a2f3d9a97964d1a8f2dffd4e54f73409ca1fd269b3c65e857189e5b23e76d39099c53e40776d1d4339c535
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouw:0NA1Yakeer5+nso3
TLSH
T12A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OG4vXcOir5hbxE.exe

Path C:\Windows\OG4vXcOir5hbxE.exe
Size 804KB
SHA256 d1b2a75f2a1a4cd7a82c7f6eafff6bb9980c7405d8d08f18ca4e9d1784a3888f
MD5 ce40bd8857df7be1022085e47f10f7b5
SHA1 20c09bbd2691c824a7de400e96d24485c9192026
SHA512 b9b3d2a8cd435bf5234a8bf80233623e9c3285bc362bccdef96056d94864c87524eccffd9d6335c168c5dcd2d8b0ae4c30ea5c6ea29a689990476b0effc309e7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouT:0NA1Yakeer5+nsoy
TLSH
T16405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OhVPesTY.exe

Path C:\Windows\OhVPesTY.exe
Size 804KB
SHA256 bbe39cb700d99658bcc65741163ca91cb7d682fed15029f82a94283efcba769f
MD5 0d6eb18e76cf0055050a769ea0671b24
SHA1 043fac92cb1da80fe0eec7a2288e902a4ce30c6d
SHA512 ebef12615fc0e06bc9748b3e02d9796f6ec2707eae7ce6b38afdf5c8d5db4a821b91193431f06853fe4aed7dc785e6e4443920d4ca7bb75b2cb8f029432ca116
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoup:0NA1Yakeer5+nsok
TLSH
T18505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

P9kmBrbxUiVBW4K.exe

Path C:\Windows\P9kmBrbxUiVBW4K.exe
Size 804KB
SHA256 5304d1f0ab7ae2c9f874f821273ca25c0a1971fa4b629c7571a73d0a04759569
MD5 7790f1b00a99160df8d744df730996a2
SHA1 f57e5dd2435251929155f704654ba86323f41bad
SHA512 be3542b815f981c0e613ae01632ab2acc7ea8fda2798256b95d245b2256d9be217bd8c87b752db1e282cd5620c807f43b62f1dca1918567623c3f303ff9e954e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoui:0NA1Yakeer5+nsoF
TLSH
T16905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QHeokgThNpJ.exe

Path C:\Windows\QHeokgThNpJ.exe
Size 804KB
SHA256 9f4ef9a9480ea94bac2a3e5b9e63eb00ff6068dee99b942460bd146cea543c16
MD5 4fa04c29f1a75c6162c14ab0ae3e7a8f
SHA1 095366037cbfbcecc5cae9acdfd9673331e390c6
SHA512 7896e628d277c5213207c118761e5fd94d016fb3967be6ae3e8a40d8d8ffbccee7f12e22514ba5e49ad8ef1cf228e2917d6be9aeb0311177fbeebffb99ee9667
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouG:0NA1Yakeer5+nsoD
TLSH
T11305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UDBVTEQtER1Q.exe

Path C:\Windows\UDBVTEQtER1Q.exe
Size 804KB
SHA256 1b5909bc6aebca578dd4e868547e2b6d6b9ef5a4adca31ddce96243e2c972908
MD5 667ecb8bcdd779b50ac1da299d59cec5
SHA1 a4fdf1b67d58bb0c171c9428fb89417fc10133d4
SHA512 c566a266c861b00aca76d1bb12b7416571299237d352e7373c89f5577fd021e1498e9a524daf6e5a4345bc07a4327299ecb7766433e0ea4c9e6539421d375a86
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoul:0NA1Yakeer5+nso8
TLSH
T1EC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UTAlVLZYjG4p.exe

Path C:\Windows\UTAlVLZYjG4p.exe
Size 804KB
SHA256 3ce9f3e5a776fdf0133c0a27dc04ee4b4805504381b357bc6835ab7a09400bcd
MD5 1729906c1697b9c483ddd8f9ca441950
SHA1 84238a1b13efde12f91ce169a49439855494ac59
SHA512 60ef531c3c6c936fcf9486e31e86c2cb1e4a2de94f3934eb74f8817508a2fdb65448c7287b1b137a3500dbeb2b99a5ced91f4d9c283ec73ddbc7cb22cc2f77c2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nsoQ
TLSH
T10D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UUbvShP.exe

Path C:\Windows\UUbvShP.exe
Size 804KB
SHA256 f843bda01333acd1b85bda1396e7aadd977122491d9aef36d95f77da140ccc87
MD5 752e3e9209f7debbbb0662c9d284e12b
SHA1 b9f0727d45841809a77d6280dbde0d58df1cc1de
SHA512 fb9c4f20d7e685b85e6fc104938ef3a43d63e25cd65010c34c13ed963f0e8ba84ba452b386a87c17758565c81b1ef8f6fcb4268e62c31cc1645c29114b186b62
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou0:0NA1Yakeer5+nsof
TLSH
T1C305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPBc9wdh0abS.exe

Path C:\Windows\XPBc9wdh0abS.exe
Size 804KB
SHA256 2afbf2b3f3c306db2aa4a0bf59b28eb1e624f9cd5fbdbd108758eafcaee6ee17
MD5 02193043887baaad8e5ab9845db94213
SHA1 82a4c64a768557841f4846ec35537c3b3a53ffa0
SHA512 efa43209ac78fde952c19adaab30626b34d9194daa20c21369a1bb573e82e4cd1a92c899cc6d20839864c99adb93f868a6a6f6e4100292d428e8b8f287b80187
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA:0NA1Yakeer5+nsoF
TLSH
T12805A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XeGaSElVLcQUPoA.exe

Path C:\Windows\XeGaSElVLcQUPoA.exe
Size 804KB
SHA256 87f8a6da57924577aaecc346833ec0e214d5679ac916c9f34a07ef2b6363dede
MD5 a31479cd7bbf9c94673d3923e74d477b
SHA1 9fe3287042bb2a443b7fcbf598d02d14637e64cd
SHA512 3ddbdfa4b7425e5df628948eb2b9f8603419787b2fdb83cf17dc71422b14a7aabb03bd74cd4b0cf374909e50cc204d9a4f07bcb73f29baff68dc2d03932451a7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouk:0NA1Yakeer5+nsov
TLSH
T13105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZnQB8ltSOvwyMay.exe

Path C:\Windows\ZnQB8ltSOvwyMay.exe
Size 804KB
SHA256 d5f55d63178f6ed7b3f77e1065f1eb8d135b21a11b1d58c1d680ec8820888933
MD5 4e0308d033710f942f798b30800eba9d
SHA1 773f4c7ee5b37aa545a8692543358815360e4600
SHA512 6e863da28554530e3c9e9963cd3aa456493b97739874554e0475eaceae2c3b8e8a753baccbd94b4533e007b86a368d8934be2e0498b55092fa4f0254290829fb
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nsoi
TLSH
T1D505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bMplCDxVXTGvkD.exe

Path C:\Windows\bMplCDxVXTGvkD.exe
Size 804KB
SHA256 5787813931d2dcad767e439fd2c5ce22698fcd6f0120c7fb3e16bb1039165ad9
MD5 31fcc61a65e8333b31e0d8846a65b752
SHA1 cc5efe4c6ec16d2dfc6a70e73be06f9bb03c4f06
SHA512 ef421d1b962e3504d6da33adc0baa694bca58896dbe02ca83131a0c866f9b1ad75681eb79df1ed6b817cdd27764e31da04807391b2c9972ca3147f2fff977f48
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouT:0NA1Yakeer5+nsoA
TLSH
T10205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bqO2bdGN6.exe

Path C:\Windows\bqO2bdGN6.exe
Size 804KB
SHA256 80876413428d874da6e8d661de069fa07087fc31b6335ce304cddc998ce841ac
MD5 5871ee163a30c99812e61da16e65c517
SHA1 e1415a67a5e32a9e1b9d0c3fcd69b6ec0f4d7db5
SHA512 97ebe8b191df8f872f23397777f13d8e8d16bf0c4ed140eec90741345364a80961948c0c3b02471a6c7ab8da90d40fb36c21c1c1842038b6a0fd131a0a8ca372
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouP:0NA1Yakeer5+nsoQ
TLSH
T1B505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gwAht5u.exe

Path C:\Windows\gwAht5u.exe
Size 804KB
SHA256 606fa50b1904e1926efb914ae588f14c62fec531f7cb384dad8495fba11e4a8d
MD5 19881b449f92d1d1765c3e00303e3542
SHA1 514016e9d3340d94dc92be04c529fe6ab6411965
SHA512 b6b52fe8cd5ad54157fb442dc62f8ea94c5f5474218dc48da4b55415af59786c4697571eb3cf9836abbff75a13fbaa67a1e89cb2a854bdaa70ab80be91787fec
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouF:0NA1Yakeer5+nsoa
TLSH
T19205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hQITK0P.exe

Path C:\Windows\hQITK0P.exe
Size 804KB
SHA256 5822c713cd0d43fe7676c469584a6abf1b41af80a0950c1eacc9777e2b423b6d
MD5 f899caa3b22006a356cbe034cffb7565
SHA1 f92496ce5015c594e08fad8a97214016db497741
SHA512 a11006bfcd09d488210d639c48911109243ba0dfd372cd344ea0a29dc48c25ec9a818410523a9518306ed31f8c8acef11e2a6bf2e13815b1d855f63d0d37c5c3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouF:0NA1Yakeer5+nsoU
TLSH
T11E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pC4ivv0.exe

Path C:\Windows\pC4ivv0.exe
Size 804KB
SHA256 8811b03956975fba16d8e9bd838a0c81d36816938577ac476fc12dc1925212c9
MD5 ad84ec328d539eb84380f0d6375d0a24
SHA1 b3f1cc203785a666bfc249ee25d4321d50c55352
SHA512 8eef660636b4d808594ad633a3eeeb2c4194dc5b8ca896f55dbc4168ad4efdf6b59651f0522c133b773f6981172bb96ca843a4c700d2271878ef2ab09ca3d70b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouj:0NA1Yakeer5+nsog
TLSH
T14305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ptD3dg.exe

Path C:\Windows\ptD3dg.exe
Size 804KB
SHA256 0be222cfe50e54eab964c7f8a09dcdd1282f77731cf677f06c8f2c366939fbd8
MD5 7d82bfef179bc7e160afe84bb8f2aa50
SHA1 32dafc67f078f9176bf68469731d52ed0ead86d8
SHA512 8545ea4e0d6b77ace63a8e831d068eb4c5f4ab8bb79141141899caa8785653d6c22015637446c8fe50b6fee5f2b5cfcf9ab2cbd5f35af9679d6e6d7ab17c3c0c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouD:0NA1Yakeer5+nsoM
TLSH
T1B105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1YVMGI0.exe

Path C:\Windows\v1YVMGI0.exe
Size 804KB
SHA256 01c788f91e21af58758bf387d28a162dfe4b00edb518fe7001ec34e60ae50aa0
MD5 9466fa2033570910f84aa87983421b12
SHA1 7241c4a5e37b9d3a5331f9a085bcef986656400f
SHA512 e9521d9f9437383750571a15e8e23879a80c4367142c6c6970be7e3aa390b2449c1bab1ce56ba2d03919b7ba0dff165278bcb0b2c7195f203443e6fa7f7e344b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou2:0NA1Yakeer5+nsoH
TLSH
T17C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v2SuSmEZ.exe

Path C:\Windows\v2SuSmEZ.exe
Size 804KB
SHA256 691c253fb75d110d236e8111cb5fa17ee719a5f23a7445a21938d64e90a3dbda
MD5 7d3906416101fc80a70b653b35952f30
SHA1 020e7e07222800995ec80e0149dd4c112e66bf84
SHA512 69ce3b2c6efe8895e17865f6ecff1e7fee83cad62140b2271578716f0d48fb32323871bb3d0f676f107a0830a707eeb66839226a069ad1b99a5e533629a05070
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouz:0NA1Yakeer5+nso+
TLSH
T1E605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wH7RCZeoSq8SQ.exe

Path C:\Windows\wH7RCZeoSq8SQ.exe
Size 804KB
SHA256 05d8d61ca1a3eef54c96a52acfd82ee21ac53bc9a8d605d0428791d8d846325d
MD5 570fbfc833b6da2580656acb6482c4cf
SHA1 6572ff092b53cc41a73f2de5070c6cd265e1978e
SHA512 ac28ec35d79e067e931f4872af37504ac4fa2ee55821a35fed766b38eda6c6950e9d70f0570df7c1666e84b46d173755c3432e78afc64d9bd530c7dc283937b9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouy:0NA1Yakeer5+nsof
TLSH
T1C205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wr9Pnl.exe

Path C:\Windows\wr9Pnl.exe
Size 804KB
SHA256 4be460c9f56f11900dbb10b25311ab9e28b5bd2fe7efa3711550d08f1809c728
MD5 4a016fc886a5794988bb81379248c079
SHA1 c6a90c634610449f6628ff1854af023cb767256d
SHA512 76d56b7d1e17358ccc9385f681548b5e87f6b2c07131a931e8709f172176c2a26e14c9011d21f233ad703709b6127bd3a6c34fda8512d0b0f8bd7d2eb3bfcdaf
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouP:0NA1Yakeer5+nsok
TLSH
T14305A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads