520f70801a407bae5c1a420880e946e31723e8d87a9c8f04cc3010a309ffcd52

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_7a1dee3cfc4f418f2c532e4a4029502f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample261003-lpgtfsxtbx
SHA256 520f70801a407bae5c1a420880e946e31723e8d87a9c8f04cc3010a309ffcd52
MD5 7a1dee3cfc4f418f2c532e4a4029502f
SHA1 3518d2d3ab244de351302bacc5de74639c400439
SHA512 d82b7534b9620a9b7f4a081a5f31d9f48cb52973785c6c2ba42bbf5f02b28e39bfc9a8af7603ba9d129dd8321fadb773a3df2fd338c7ba4c8295c192484b5561
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouF:0NA1Yakeer5+nsou
TLSH
T12405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (3394) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 38 IoCs

pid	Process
6136	v6bLvnqIaYdcv.exe
1796	cOwxM.exe
5844	4s6UpteLaS7.exe
1032	YRiebznNXaP1NwE.exe
4336	3vFm9yU8Tcrw.exe
2568	FwZ3dv1Hn4.exe
3416	FL5PqF.exe
5196	yKj6Lcvjx1gNJ25.exe
4184	XRCmXTR9.exe
3692	5v1FH.exe
5560	vntQ8l.exe
6392	lYRrIe5WBkU.exe
6672	qvOqETYBue8gCi.exe
6916	crXnqa.exe
7160	2aU9D48DTK8kSov.exe
7204	wPFwTP9aCnX.exe
7504	sA2x7xy0N4llmzp.exe
7748	DVSSi.exe
7992	kUqnG376xX.exe
6844	Peo0J1eE.exe
7092	yPTYN7coIMGx6Zj.exe
7780	C52LKEQa8Pw8cL.exe
7864	uQ9Ggy.exe
8236	Jhm42tLL6wvy.exe
8488	I7l1KQhTO.exe
8732	vsbqlXF8e4YCP.exe
8980	ocj6Atkhlr.exe
8244	7n79zv232Yb.exe
9300	861nRxnRKU.exe
9644	mK4DMYHg8.exe
9924	6qS5E1.exe
10196	DFThw3g.exe
10128	qyluQzE7aLH50Jh.exe
10432	rwYv0n.exe
10824	OwycJ9g.exe
11112	jJdWiU.exe
3352	zttiRRPjob4C7.exe
10428	dxn9xAX.exe

Adds Run key to start application 2 TTPs 38 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GENERICS = "C:\\Windows\\Jhm42tLL6wvy.exe"	uQ9Ggy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATCON = "C:\\Windows\\I7l1KQhTO.exe"	Jhm42tLL6wvy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MGAVRTE = "C:\\Windows\\XRCmXTR9.exe"	yKj6Lcvjx1gNJ25.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFIADMIN = "C:\\Windows\\mK4DMYHg8.exe"	861nRxnRKU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPTC32 = "C:\\Windows\\YRiebznNXaP1NwE.exe"	4s6UpteLaS7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVXMONITORNT = "C:\\Windows\\FL5PqF.exe"	FwZ3dv1Hn4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CLAW95C = "C:\\Windows\\yKj6Lcvjx1gNJ25.exe"	FL5PqF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CLEANER = "C:\\Windows\\5v1FH.exe"	XRCmXTR9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NSCHED32 = "C:\\Windows\\2aU9D48DTK8kSov.exe"	crXnqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NEOWATCHLOG = "C:\\Windows\\wPFwTP9aCnX.exe"	2aU9D48DTK8kSov.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RAPAPP = "C:\\Windows\\C52LKEQa8Pw8cL.exe"	yPTYN7coIMGx6Zj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EXPERT = "C:\\Windows\\ocj6Atkhlr.exe"	vsbqlXF8e4YCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VPC32 = "C:\\Windows\\lYRrIe5WBkU.exe"	vntQ8l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ETRUSTCIPE = "C:\\Windows\\crXnqa.exe"	qvOqETYBue8gCi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RAV7 = "C:\\Windows\\DVSSi.exe"	sA2x7xy0N4llmzp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DEFALERT = "C:\\Windows\\zttiRRPjob4C7.exe"	jJdWiU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVNT = "C:\\Windows\\v6bLvnqIaYdcv.exe"	2026-10-02_7a1dee3cfc4f418f2c532e4a4029502f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVAP = "C:\\Windows\\vntQ8l.exe"	5v1FH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FP-WIN = "C:\\Windows\\uQ9Ggy.exe"	C52LKEQa8Pw8cL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVKWCTL9 = "C:\\Windows\\6qS5E1.exe"	mK4DMYHg8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PROCESSMONITOR = "C:\\Windows\\qyluQzE7aLH50Jh.exe"	DFThw3g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FAMEH32 = "C:\\Windows\\cOwxM.exe"	v6bLvnqIaYdcv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NPROTECT = "C:\\Windows\\sA2x7xy0N4llmzp.exe"	wPFwTP9aCnX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WRADMIN = "C:\\Windows\\Peo0J1eE.exe"	kUqnG376xX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DVP95_0 = "C:\\Windows\\7n79zv232Yb.exe"	ocj6Atkhlr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VBCMSERV = "C:\\Windows\\861nRxnRKU.exe"	7n79zv232Yb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPDOS32 = "C:\\Windows\\DFThw3g.exe"	6qS5E1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NWSERVICE = "C:\\Windows\\dxn9xAX.exe"	zttiRRPjob4C7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\REALMON = "C:\\Windows\\3vFm9yU8Tcrw.exe"	YRiebznNXaP1NwE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DVP95 = "C:\\Windows\\FwZ3dv1Hn4.exe"	3vFm9yU8Tcrw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VSCHED = "C:\\Windows\\vsbqlXF8e4YCP.exe"	I7l1KQhTO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCFWALLICON = "C:\\Windows\\rwYv0n.exe"	qyluQzE7aLH50Jh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\POP3TRAP = "C:\\Windows\\OwycJ9g.exe"	rwYv0n.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCUPDATE = "C:\\Windows\\qvOqETYBue8gCi.exe"	lYRrIe5WBkU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVGSERV = "C:\\Windows\\kUqnG376xX.exe"	DVSSi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATCON = "C:\\Windows\\jJdWiU.exe"	OwycJ9g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATUPDATER = "C:\\Windows\\4s6UpteLaS7.exe"	cOwxM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ICLOAD95 = "C:\\Windows\\yPTYN7coIMGx6Zj.exe"	Peo0J1eE.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\sA2x7xy0N4llmzp.exe	wPFwTP9aCnX.exe
File opened for modification	C:\Windows\Peo0J1eE.exe	kUqnG376xX.exe
File opened for modification	C:\Windows\vsbqlXF8e4YCP.exe	I7l1KQhTO.exe
File created	C:\Windows\DVSSi.exe	sA2x7xy0N4llmzp.exe
File opened for modification	C:\Windows\sA2x7xy0N4llmzp.exe	wPFwTP9aCnX.exe
File created	C:\Windows\I7l1KQhTO.exe	Jhm42tLL6wvy.exe
File opened for modification	C:\Windows\861nRxnRKU.exe	7n79zv232Yb.exe
File opened for modification	C:\Windows\DFThw3g.exe	6qS5E1.exe
File created	C:\Windows\FwZ3dv1Hn4.exe	3vFm9yU8Tcrw.exe
File created	C:\Windows\v6bLvnqIaYdcv.exe	2026-10-02_7a1dee3cfc4f418f2c532e4a4029502f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\3vFm9yU8Tcrw.exe	YRiebznNXaP1NwE.exe
File created	C:\Windows\uQ9Ggy.exe	C52LKEQa8Pw8cL.exe
File opened for modification	C:\Windows\I7l1KQhTO.exe	Jhm42tLL6wvy.exe
File opened for modification	C:\Windows\6qS5E1.exe	mK4DMYHg8.exe
File opened for modification	C:\Windows\jJdWiU.exe	OwycJ9g.exe
File opened for modification	C:\Windows\7n79zv232Yb.exe	ocj6Atkhlr.exe
File created	C:\Windows\XRCmXTR9.exe	yKj6Lcvjx1gNJ25.exe
File created	C:\Windows\5v1FH.exe	XRCmXTR9.exe
File opened for modification	C:\Windows\uQ9Ggy.exe	C52LKEQa8Pw8cL.exe
File created	C:\Windows\Jhm42tLL6wvy.exe	uQ9Ggy.exe
File created	C:\Windows\dxn9xAX.exe	zttiRRPjob4C7.exe
File created	C:\Windows\cOwxM.exe	v6bLvnqIaYdcv.exe
File opened for modification	C:\Windows\5v1FH.exe	XRCmXTR9.exe
File created	C:\Windows\crXnqa.exe	qvOqETYBue8gCi.exe
File opened for modification	C:\Windows\Jhm42tLL6wvy.exe	uQ9Ggy.exe
File created	C:\Windows\qvOqETYBue8gCi.exe	lYRrIe5WBkU.exe
File opened for modification	C:\Windows\qvOqETYBue8gCi.exe	lYRrIe5WBkU.exe
File opened for modification	C:\Windows\wPFwTP9aCnX.exe	2aU9D48DTK8kSov.exe
File opened for modification	C:\Windows\DVSSi.exe	sA2x7xy0N4llmzp.exe
File created	C:\Windows\Peo0J1eE.exe	kUqnG376xX.exe
File created	C:\Windows\ocj6Atkhlr.exe	vsbqlXF8e4YCP.exe
File created	C:\Windows\861nRxnRKU.exe	7n79zv232Yb.exe
File opened for modification	C:\Windows\qyluQzE7aLH50Jh.exe	DFThw3g.exe
File created	C:\Windows\vntQ8l.exe	5v1FH.exe
File created	C:\Windows\vsbqlXF8e4YCP.exe	I7l1KQhTO.exe
File opened for modification	C:\Windows\mK4DMYHg8.exe	861nRxnRKU.exe
File opened for modification	C:\Windows\rwYv0n.exe	qyluQzE7aLH50Jh.exe
File created	C:\Windows\jJdWiU.exe	OwycJ9g.exe
File opened for modification	C:\Windows\zttiRRPjob4C7.exe	jJdWiU.exe
File opened for modification	C:\Windows\dxn9xAX.exe	zttiRRPjob4C7.exe
File created	C:\Windows\mK4DMYHg8.exe	861nRxnRKU.exe
File created	C:\Windows\DFThw3g.exe	6qS5E1.exe
File opened for modification	C:\Windows\OwycJ9g.exe	rwYv0n.exe
File opened for modification	C:\Windows\cOwxM.exe	v6bLvnqIaYdcv.exe
File opened for modification	C:\Windows\lYRrIe5WBkU.exe	vntQ8l.exe
File created	C:\Windows\wPFwTP9aCnX.exe	2aU9D48DTK8kSov.exe
File created	C:\Windows\kUqnG376xX.exe	DVSSi.exe
File created	C:\Windows\qyluQzE7aLH50Jh.exe	DFThw3g.exe
File opened for modification	C:\Windows\crXnqa.exe	qvOqETYBue8gCi.exe
File created	C:\Windows\C52LKEQa8Pw8cL.exe	yPTYN7coIMGx6Zj.exe
File created	C:\Windows\7n79zv232Yb.exe	ocj6Atkhlr.exe
File created	C:\Windows\6qS5E1.exe	mK4DMYHg8.exe
File opened for modification	C:\Windows\FwZ3dv1Hn4.exe	3vFm9yU8Tcrw.exe
File opened for modification	C:\Windows\FL5PqF.exe	FwZ3dv1Hn4.exe
File created	C:\Windows\4s6UpteLaS7.exe	cOwxM.exe
File opened for modification	C:\Windows\XRCmXTR9.exe	yKj6Lcvjx1gNJ25.exe
File opened for modification	C:\Windows\vntQ8l.exe	5v1FH.exe
File opened for modification	C:\Windows\yPTYN7coIMGx6Zj.exe	Peo0J1eE.exe
File created	C:\Windows\zttiRRPjob4C7.exe	jJdWiU.exe
File created	C:\Windows\FL5PqF.exe	FwZ3dv1Hn4.exe
File opened for modification	C:\Windows\ocj6Atkhlr.exe	vsbqlXF8e4YCP.exe
File created	C:\Windows\3vFm9yU8Tcrw.exe	YRiebznNXaP1NwE.exe
File created	C:\Windows\lYRrIe5WBkU.exe	vntQ8l.exe
File opened for modification	C:\Windows\kUqnG376xX.exe	DVSSi.exe

Program crash 15 IoCs

pid	pid_target	Process	procid_target
6328	6672	WerFault.exe	121
7408	6916	WerFault.exe	123
7232	7748	WerFault.exe	136
9672	10432	WerFault.exe	173
10524	10824	WerFault.exe	176
12092	1796	WerFault.exe	91
11336	5560	WerFault.exe	117
11428	6392	WerFault.exe	119
11040	7204	WerFault.exe	130
11820	9300	WerFault.exe	160
1996	10428	WerFault.exe	186
5060	6136	WerFault.exe	89
10952	7092	WerFault.exe	144
6464	1032	WerFault.exe	99
960	7992	WerFault.exe	138

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-02_7a1dee3cfc4f418f2c532e4a4029502f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-02_7a1dee3cfc4f418f2c532e4a4029502f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_7a1dee3cfc4f418f2c532e4a4029502f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FL5PqF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yKj6Lcvjx1gNJ25.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qvOqETYBue8gCi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sA2x7xy0N4llmzp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Peo0J1eE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yPTYN7coIMGx6Zj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3vFm9yU8Tcrw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vntQ8l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DVSSi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6qS5E1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FwZ3dv1Hn4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mK4DMYHg8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jJdWiU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YRiebznNXaP1NwE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XRCmXTR9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lYRrIe5WBkU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kUqnG376xX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsbqlXF8e4YCP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ocj6Atkhlr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qyluQzE7aLH50Jh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OwycJ9g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4s6UpteLaS7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wPFwTP9aCnX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C52LKEQa8Pw8cL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uQ9Ggy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhm42tLL6wvy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	I7l1KQhTO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DFThw3g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cOwxM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5v1FH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2aU9D48DTK8kSov.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7n79zv232Yb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	861nRxnRKU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zttiRRPjob4C7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v6bLvnqIaYdcv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crXnqa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rwYv0n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxn9xAX.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-02_7a1dee3cfc4f418f2c532e4a4029502f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_7a1dee3cfc4f418f2c532e4a4029502f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3696

C:\Windows\v6bLvnqIaYdcv.exe
C:\Windows\v6bLvnqIaYdcv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6136 -s 2200
  2⤵
  - Program crash
  PID:5060

C:\Windows\cOwxM.exe
C:\Windows\cOwxM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 1432
  2⤵
  - Program crash
  PID:12092

C:\Windows\4s6UpteLaS7.exe
C:\Windows\4s6UpteLaS7.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5844

C:\Windows\YRiebznNXaP1NwE.exe
C:\Windows\YRiebznNXaP1NwE.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 2316
  2⤵
  - Program crash
  PID:6464

C:\Windows\3vFm9yU8Tcrw.exe
C:\Windows\3vFm9yU8Tcrw.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4336

C:\Windows\FwZ3dv1Hn4.exe
C:\Windows\FwZ3dv1Hn4.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2568

C:\Windows\FL5PqF.exe
C:\Windows\FL5PqF.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3416

C:\Windows\yKj6Lcvjx1gNJ25.exe
C:\Windows\yKj6Lcvjx1gNJ25.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5196

C:\Windows\XRCmXTR9.exe
C:\Windows\XRCmXTR9.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4184

C:\Windows\5v1FH.exe
C:\Windows\5v1FH.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3692

C:\Windows\vntQ8l.exe
C:\Windows\vntQ8l.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5560 -s 2084
  2⤵
  - Program crash
  PID:11336

C:\Windows\lYRrIe5WBkU.exe
C:\Windows\lYRrIe5WBkU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6392 -s 2096
  2⤵
  - Program crash
  PID:11428

C:\Windows\qvOqETYBue8gCi.exe
C:\Windows\qvOqETYBue8gCi.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6672 -s 1988
  2⤵
  - Program crash
  PID:6328

C:\Windows\crXnqa.exe
C:\Windows\crXnqa.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:6916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6916 -s 1976
  2⤵
  - Program crash
  PID:7408

C:\Windows\2aU9D48DTK8kSov.exe
C:\Windows\2aU9D48DTK8kSov.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6672 -ip 6672
1⤵
PID:6952

C:\Windows\wPFwTP9aCnX.exe
C:\Windows\wPFwTP9aCnX.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7204 -s 2092
  2⤵
  - Program crash
  PID:11040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 6916 -ip 6916
1⤵
PID:7388

C:\Windows\sA2x7xy0N4llmzp.exe
C:\Windows\sA2x7xy0N4llmzp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7504

C:\Windows\DVSSi.exe
C:\Windows\DVSSi.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7748 -s 1988
  2⤵
  - Program crash
  PID:7232

C:\Windows\kUqnG376xX.exe
C:\Windows\kUqnG376xX.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7992 -s 2316
  2⤵
  - Program crash
  PID:960

C:\Windows\Peo0J1eE.exe
C:\Windows\Peo0J1eE.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 7748 -ip 7748
1⤵
PID:6620

C:\Windows\yPTYN7coIMGx6Zj.exe
C:\Windows\yPTYN7coIMGx6Zj.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7092 -s 2212
  2⤵
  - Program crash
  PID:10952

C:\Windows\C52LKEQa8Pw8cL.exe
C:\Windows\C52LKEQa8Pw8cL.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7780

C:\Windows\uQ9Ggy.exe
C:\Windows\uQ9Ggy.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7864

C:\Windows\Jhm42tLL6wvy.exe
C:\Windows\Jhm42tLL6wvy.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8236

C:\Windows\I7l1KQhTO.exe
C:\Windows\I7l1KQhTO.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8488

C:\Windows\vsbqlXF8e4YCP.exe
C:\Windows\vsbqlXF8e4YCP.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8732

C:\Windows\ocj6Atkhlr.exe
C:\Windows\ocj6Atkhlr.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8980

C:\Windows\7n79zv232Yb.exe
C:\Windows\7n79zv232Yb.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8244

C:\Windows\861nRxnRKU.exe
C:\Windows\861nRxnRKU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9300 -s 2096
  2⤵
  - Program crash
  PID:11820

C:\Windows\mK4DMYHg8.exe
C:\Windows\mK4DMYHg8.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9644

C:\Windows\6qS5E1.exe
C:\Windows\6qS5E1.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9924

C:\Windows\DFThw3g.exe
C:\Windows\DFThw3g.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10196

C:\Windows\qyluQzE7aLH50Jh.exe
C:\Windows\qyluQzE7aLH50Jh.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10128

C:\Windows\rwYv0n.exe
C:\Windows\rwYv0n.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10432 -s 1984
  2⤵
  - Program crash
  PID:9672

C:\Windows\OwycJ9g.exe
C:\Windows\OwycJ9g.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10824 -s 1996
  2⤵
  - Program crash
  PID:10524

C:\Windows\jJdWiU.exe
C:\Windows\jJdWiU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:11112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 10432 -ip 10432
1⤵
PID:9508

C:\Windows\zttiRRPjob4C7.exe
C:\Windows\zttiRRPjob4C7.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 10824 -ip 10824
1⤵
PID:10552

C:\Windows\dxn9xAX.exe
C:\Windows\dxn9xAX.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:10428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10428 -s 1968
  2⤵
  - Program crash
  PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1796 -ip 1796
1⤵
PID:12072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5560 -ip 5560
1⤵
PID:10964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6392 -ip 6392
1⤵
PID:11404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7204 -ip 7204
1⤵
PID:10720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 9300 -ip 9300
1⤵
PID:11824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 10428 -ip 10428
1⤵
PID:5640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6136 -ip 6136
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 7092 -ip 7092
1⤵
PID:10928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1032 -ip 1032
1⤵
PID:6532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 7992 -ip 7992
1⤵
PID:10688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2aU9D48DTK8kSov.exe

Path C:\Windows\2aU9D48DTK8kSov.exe
Size 804KB
SHA256 14854a37cb79ad6dcdbbf5cf9b7b5af677dfc78f303f634c65a7e468670dac5b
MD5 28bd4f96d12398c5daacddbbee44c0d5
SHA1 a45762fc604175e2a00b9edc9da4327e17473283
SHA512 0ee713c6fb17f361dc2d22024fcd916fc19bb5487bab4f7eda14f247f19eb433d74fa72a36cb28e63e5abc9c93c689d39cecff8c3e143fb88f8e9a3552f1aee7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+:0NA1Yakeer5+nsob
TLSH
T1B905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3vFm9yU8Tcrw.exe

Path C:\Windows\3vFm9yU8Tcrw.exe
Size 804KB
SHA256 d9fe610c813549e5893b25c3fbf94a1d678772d5d748789fc67efa3d946f15d5
MD5 09be0fb8bff93016ae53bde04109514e
SHA1 6d11a1c7da695e00a151ea8d4c990917c7ca5186
SHA512 dcccc182098adb76eb6798ebcf9f57de388fbde353b18cee4a3ec9b3e7cd97fffeab6c144ce2f0971ec2f4deac3d5741b9db54fda0d2b46e803749df56590d9b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouW:0NA1Yakeer5+nso5
TLSH
T10D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4s6UpteLaS7.exe

Path C:\Windows\4s6UpteLaS7.exe
Size 804KB
SHA256 5cb80289674f2e363e13faa00259f88638b2e89ceeaf917fda50b972374322d9
MD5 e0b0fc1a66fbb538a3c6378f0a3952a3
SHA1 4a551cece9d3187566e01d26b03d2106c71b96c2
SHA512 d8a02885a9f5976a21302fa0c62fb7ad93bffb29a594360c1c47f2780ec32a3c2cf23841e09b5d04a8f19b480bb5c1c4fd279e8e75d0cada83523d043a8ed0eb
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoum:0NA1Yakeer5+nsoR
TLSH
T12705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5v1FH.exe

Path C:\Windows\5v1FH.exe
Size 804KB
SHA256 1369be1b36b754c6d460c290d8831b189b126b4567df88e9acf4a3ec3e922003
MD5 cb20abb2cc3820735ca0e82767b16c4a
SHA1 684eaaf427ed65a5db380231850940c0d9f0945e
SHA512 1ea687f38135be52d3f6bc2ee55a25247c6190626b980ff8908a33358357a8a13d501adc319317926067b35316a9d9158eb67cb03ef209a35ede9b80bc015d79
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou/:0NA1Yakeer5+nsoe
TLSH
T1F705A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6qS5E1.exe

Path C:\Windows\6qS5E1.exe
Size 804KB
SHA256 e95c14fe3e191b9619712311ac9a3e60840c869ecbfdcfae3a85f8f660b6960e
MD5 6d0d2aef11941b1b1fa38781a25ebc81
SHA1 704ac732a4bbdd5e5ab109a185d2115da3eebbcb
SHA512 ea809d04264618336e144d857d40ae7171ff0b834a5d43b487af041356b3e3e7a8010b063293cd3aa78c076f1574bb052c839d514c9562095ada697a7cc6a5c0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouh:0NA1Yakeer5+nsos
TLSH
T18E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7n79zv232Yb.exe

Path C:\Windows\7n79zv232Yb.exe
Size 804KB
SHA256 b49a3cd3481acc63f149ddbc17a28dc6a14bb724da1204f529b6ddd0d0270125
MD5 b8c62a32d817767d9a38b1ffae91a065
SHA1 9662c11c3263941b803f03105db704cc304363c8
SHA512 b8eb7dd2799a3ff429625419d938af3dca9972c29d35fef56a35b7ac30d43e0957e857e15da0c5cc271d041b97d1b446d15eb0976455ed88a9c092df7630a63b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouf:0NA1Yakeer5+nsok
TLSH
T1AE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

861nRxnRKU.exe

Path C:\Windows\861nRxnRKU.exe
Size 804KB
SHA256 0062280b7e2e097444c9775c50f046b356b7f684ba2f93be9eafa833fcac9051
MD5 846d804ffb5eb59c311de260a8599036
SHA1 596cbd6ab3eff207b57c3ce1afb8c44580a7a504
SHA512 7f8f13309a6c4517640b25e6871cada32679ac5d4ac617c78972fe9e738d0b71fc3b315fb6373aa75e98d7891fe003a2e924c5ce13ddd457810803556d2e98e6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouQ:0NA1Yakeer5+nsof
TLSH
T12505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C52LKEQa8Pw8cL.exe

Path C:\Windows\C52LKEQa8Pw8cL.exe
Size 804KB
SHA256 3cfa92027994c6ffe981ee16989bd9bad14559b99f8a02490010453585f596bb
MD5 416c3c2fa1158f1ff482c25bc3ad7579
SHA1 a6d3c1fe0512dc237210222cf1f52b8589368abb
SHA512 0414f752feade265f89dfe1fcd48ef5d72a49cd2739a03403866c68dd029fb5c2e9510824f61db0bb3e8673fc14167f16008cbdbae729e4b00888c63b2db08de
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouB:0NA1Yakeer5+nsoS
TLSH
T12405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DFThw3g.exe

Path C:\Windows\DFThw3g.exe
Size 804KB
SHA256 dc31d6cc291e66d1f4bf228c5247bb125bed16b110338a96ae06d5e1b50d8071
MD5 f69ca5b1c2df88bc644289649105f7d3
SHA1 49bd05914c8c08770249c4816ccb029ad9c143ad
SHA512 91d716712ce3e3eaf496c2896335731f8e1c84c649b8b360ee00e613b7c66909a0001f9c451e83afa82536ae361b179001929e0499d6a9e1435adbb01adab523
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+:0NA1Yakeer5+nsoz
TLSH
T17305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DVSSi.exe

Path C:\Windows\DVSSi.exe
Size 804KB
SHA256 4de1f4b5d080353a2fb7c18cc4e580b9a9b188de356fa90b68edfeba11b171a0
MD5 0615026ffc6534c8bd31b60f91aad95d
SHA1 1034ff19495f7d4780a272c5296c47b8ca3e5dc9
SHA512 479050d8e82082c0365063932501eee03bf425a5e1262198546ce9e262a58a12329c8ad6a3df1c20375a9488fe55a6030d8f9a505b1c9829e800ad3c57a43289
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nsob
TLSH
T15C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FL5PqF.exe

Path C:\Windows\FL5PqF.exe
Size 804KB
SHA256 5b2aa6101a02642ab8b2051938be6105fe22daec11f5230915de594a6e4b6134
MD5 69d2a6a0003f624bb8c6781d8f220aa1
SHA1 404626fd84f04891537914cb5db9568b09e3fe5a
SHA512 96435078e6ca69a271deb6ca5d832a4dc7cafd41f0fafae9bd70e1bc72415dce4bd607c4aa95e1632b651b729f28653a267d4589766d2b2f18a6dec4b55e11d8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouy:0NA1Yakeer5+nsov
TLSH
T12405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FwZ3dv1Hn4.exe

Path C:\Windows\FwZ3dv1Hn4.exe
Size 804KB
SHA256 2763a6bfb865f3dc69b5b12545cff8a778573e8c2f66d2846535906090af6bf2
MD5 58cade758134afb3b336bc2fa86eed27
SHA1 ea8b9d67f4ee074f12b7f86ba26dc0b3022a1369
SHA512 c9c5c809e80afbf2e33c0dcca926ba22db10147d8537a5ada348a0d9443608674c9a682f94e14778f31e30371401fb05d1deff59eaea1a371f918af8877dcd5f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nsoa
TLSH
T13B05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

I7l1KQhTO.exe

Path C:\Windows\I7l1KQhTO.exe
Size 804KB
SHA256 0d505fd76ae210afbf92af97995a66b7f3af7be643eafe59269a8df419f6d526
MD5 2ae37665ae41b650ed86d55cabb6b35d
SHA1 8e6e24c0c948dc8aa31b013ab690b253592755da
SHA512 ad04662c94e2140e5270cdd11dc3abecc96f2396716e5f18eed592e2bb95df74344b9838c14166948dba1601b03bbb124f75563c009dca3371ab41006a15d300
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouV:0NA1Yakeer5+nsok
TLSH
T16005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jhm42tLL6wvy.exe

Path C:\Windows\Jhm42tLL6wvy.exe
Size 804KB
SHA256 f4b448153bdbd504cbe24e9a36ccac8b4f9ba7d7c67a75407416deab3e301137
MD5 4937bab6bb10fd643c0a210e59b1a284
SHA1 555499a300952344b7416f9970d5f6d866db1dd7
SHA512 0eab7261ffc19dee20cffb4c70acc310aba931d514679837188eaddb65cc3cf00cd5e76ec8cf0b0ecbcef4565967d0b843428a147758db0aee570c5863a47aa6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouP:0NA1Yakeer5+nsoM
TLSH
T19B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Peo0J1eE.exe

Path C:\Windows\Peo0J1eE.exe
Size 804KB
SHA256 48b19ae1e494614ccb97f6a73df155602cbb40fe7c8e2fa0ea9fe6f42b99fb68
MD5 a263704be3aa035e2eb467c871b34aec
SHA1 4c4ef2fa808c0c0f92af3e0ea769530a0b17239a
SHA512 a9e65c23519369c44b3ae3ad2fe327f0c0934cf43338f6f8e5fcd618ad94b9e5972c4e65f7b256bc7f156c9eb48bac5c347d85d622c5921532d1b8991443f9ff
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFout:0NA1Yakeer5+nso+
TLSH
T18005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XRCmXTR9.exe

Path C:\Windows\XRCmXTR9.exe
Size 804KB
SHA256 6d43d433d7970b050e4ab0895326a6c68b1fdd14aa77fc2c9b94e953be90b591
MD5 f76ed35c79f06b58c039ef11cf1c35c7
SHA1 9e077e8a7a6d8f00d5f166cd6a4d0ee4b1f081d6
SHA512 ddf48da346679a116c7844c8e45cd04ce9ec5eec4f9b8317606a56897cbd483d68ccc1d7750c9460bf50a49ab9b4b4bba9ff52edfab008949041bc3eb4427093
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouI:0NA1Yakeer5+nsoz
TLSH
T15F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YRiebznNXaP1NwE.exe

Path C:\Windows\YRiebznNXaP1NwE.exe
Size 804KB
SHA256 f56cc0d014c4b7219408c27380b971685250743e928f1f7687879fb71357f0ea
MD5 5b4d1b9c8b4f6c58abd59f834beb3a74
SHA1 9ec14a0a8958c53a4ab75b85ba722edcc7f523ef
SHA512 192826d4bc57a2822c61b27973bc595f2319605706da235d7851b0899c3fff58ceb5ac33e53f0a8b681b0636bee4400895079cfdd6a9e42ff297da11c8d395e8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouW:0NA1Yakeer5+nsoZ
TLSH
T16605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cOwxM.exe

Path C:\Windows\cOwxM.exe
Size 804KB
SHA256 67307e7b753b33271864f8615494bec31b5cc770108c81c05751084a95ef024a
MD5 fe425a797e3809843b710f1dfbfc9b21
SHA1 ec218c656fca4b0185a3e17b3b9cdca5b531d9b9
SHA512 423a30671222d2c5f7cadf8d0e0bb4dc3edead88c487352d3326085bad8d349dfdf210c8ea974571fea4e456b75df97bf229cd1c4e9b3032f177adb0cc75682d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFour:0NA1Yakeer5+nsoG
TLSH
T19705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crXnqa.exe

Path C:\Windows\crXnqa.exe
Size 804KB
SHA256 2cff34423dad552c799f15b32745ac1f706990fd34e4233d020372df8806ce9d
MD5 15cf8a44580e59de25ebcc84bc138e44
SHA1 ea5a8cd1c0afa2f18ebafd209c92ccb19486e996
SHA512 87e28c6005340740d0bacfcfa4780033ed64ddab48eab366ac47b212711819f697ca86dcafc10d4e2f815d4902c60e034705bab9dc90d9f7ab2f6b61764ecab3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFout:0NA1Yakeer5+nsoI
TLSH
T10E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kUqnG376xX.exe

Path C:\Windows\kUqnG376xX.exe
Size 804KB
SHA256 ec3359db0a9fff6b1382ba1f4991905ace28853240d2b22ad17fad094d57c9b5
MD5 11adadacabaab0233a8d900818c7074b
SHA1 33cfc12d970a1159c45a68cf703a1242bfaeb895
SHA512 ed960f0547dbc25d720a49641179d01537c9b5d5e4c3e64082389f432c20db041f383e7f33b8f0f7a8f36b7e094b82b9dca18f4e1e5393422eafcffef87cd7f8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou0:0NA1Yakeer5+nsor
TLSH
T19B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lYRrIe5WBkU.exe

Path C:\Windows\lYRrIe5WBkU.exe
Size 804KB
SHA256 b7c61a0137320a8d73380cb987168e71f2144832d98990b606ef91e9abf2b46f
MD5 9ffead894a1aca741dc3b0331ca67817
SHA1 b9261f305261a1300077a4345face8e962c3b4d5
SHA512 9f47c655513f03f833dbf77a072b38cdaa3c9ccb6053631ff8a4ed75819b1e5643daaf0d2336a08d30cf1c061fea1e0f8388d0f53873d816c0d4d15a96b224a8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouu:0NA1Yakeer5+nso5
TLSH
T18D05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mK4DMYHg8.exe

Path C:\Windows\mK4DMYHg8.exe
Size 804KB
SHA256 a876677fd79d93c959226c2cff383fcf9a075fa6e8f8b8786f7efc19438bac05
MD5 40049215d86f464d3816ae50f0205e96
SHA1 98f20195e3532aca9bfc6a9cc6b7c86153cfbdc9
SHA512 f4876178d3100db38630c4c07de4d65456e815938a6407e1d09d2227e1fe093e1af4f5c688043e53380d73455dffd2ea731e7ce5d4541de9e839ac61659222c6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouc:0NA1Yakeer5+nso7
TLSH
T1B605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ocj6Atkhlr.exe

Path C:\Windows\ocj6Atkhlr.exe
Size 804KB
SHA256 6bb9b19cdbae633609d61ea1275f7fbf44508dd17d3cf064c33da5dc1f921732
MD5 712199ac6fbc6ae5c32a35744a9a94a2
SHA1 5c5d57e942b68d11baee2880e80002a94d893408
SHA512 2d97ab21f352537bfe68bdb39c83680a1b7736fa08083a46cf188820529868f7c0a9dc107184e306e857aac3b69067eb5014e9ff92808f6b75458506d78625d1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouH:0NA1Yakeer5+nsog
TLSH
T1A805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qvOqETYBue8gCi.exe

Path C:\Windows\qvOqETYBue8gCi.exe
Size 804KB
SHA256 1d0056b2f5549a99b895b9500950545abaa057c9397323fd3f3ad72fde7d2dbe
MD5 36d354ba84591f4c5d41e424a5a4025c
SHA1 aeddfc71cc22e133fa043227605a48750546cbbd
SHA512 fbfe4c66f2ae0595150b37a5f2b5cd8b077f548ce5fb278a057a63232e09b5e960d4dd394cca1e8252ae897469c8cd007131fdfd076952a139ee986b2c0891c3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouZ:0NA1Yakeer5+nsoq
TLSH
T1A205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sA2x7xy0N4llmzp.exe

Path C:\Windows\sA2x7xy0N4llmzp.exe
Size 804KB
SHA256 40dae2d0206ba61ee7dfa1f33d92f53f21feb9c925666a27d0f0ac53294094dd
MD5 9bc8d8cbceebebfa217e7fcc8ee77d5e
SHA1 738e290c6e281652510ac07c158c5b9106ba9828
SHA512 122de900f92036a504c6d7a6c422dddccd931f840847b354ebd12ed8b6f4c6d8bc8f5792339edf56cfa452d1a990d4d7bd2c78ff9dfab010c51aee8c185f3a05
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou3:0NA1Yakeer5+nsoy
TLSH
T12705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uQ9Ggy.exe

Path C:\Windows\uQ9Ggy.exe
Size 804KB
SHA256 4da94abf7ea9fefc495440d61651c3a8a71c769cd6dea5d413bc0a06eeac4fd2
MD5 6ecda84e36c3dbb3e92641daaffb5939
SHA1 e465d480e53a83c17cd5fb8363f5a1d928799675
SHA512 a9dd7df4f88b056816494f8a202a60a690c1c10fa174658f5e0080ff1aeab511b0baca2d2e3c23a8308819a2929cbd91de85cb61cd9b65af8606264bd4eaa9e1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou0:0NA1Yakeer5+nsoB
TLSH
T16A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v6bLvnqIaYdcv.exe

Path C:\Windows\v6bLvnqIaYdcv.exe
Size 804KB
SHA256 2c18730050bac6bc0e85e3eaf3a1b1f28d318f959edad431be92c60b403f8ffe
MD5 868e8f5a87472b068aa2f8ecd03c678e
SHA1 b58bc389bd57c93e9fc9f0ed3c8205cafe91797c
SHA512 e9b32e15ffdfb15da2600ca1711afd1cc94cd9d40ba5acca7c6ec7d2dcf1935126daa8848713f3c2b4506618049c4c93cbf78be8a06a2bf74052a63a4863fbc9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou2:0NA1Yakeer5+nsoL
TLSH
T19005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vntQ8l.exe

Path C:\Windows\vntQ8l.exe
Size 804KB
SHA256 b156efdf674e0b01618fa4d700739333cd0415ff41bd9f671af81fbd803b1dda
MD5 7fbc8a4fed59ad8e8911394467c5afb6
SHA1 8273d57e0470d3633523058364882a10fdfc1aec
SHA512 25d2c4327cc305b818ed96a2ef90a0755263dac328937042a901261051ff9d4f26f51853da436c66a9cc6a42d03dee8ac8d9f5cae158a3af7aba0db28039770c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoul:0NA1Yakeer5+nsok
TLSH
T17F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsbqlXF8e4YCP.exe

Path C:\Windows\vsbqlXF8e4YCP.exe
Size 804KB
SHA256 b1010b817dab8ed6f5a438fdd3d27e46b73127fffbd90becd33d71aad9e38521
MD5 614a6fed803ba4d7c9205db0afcced8f
SHA1 6caab7cdf128303672760536a34b95c0a1789e96
SHA512 b290bf3df4e935fbe57c6dcbe5ef6b4a39d61331bad4302211e902ee4f42be33e681de726f764dd542f09c2bbe58ac95e9d9d03d7d95d07f78655d47120e29f2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouM:0NA1Yakeer5+nsoB
TLSH
T18505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wPFwTP9aCnX.exe

Path C:\Windows\wPFwTP9aCnX.exe
Size 804KB
SHA256 9229b3e558f8d8ab2e778758baca786e1dea4f29b97ffc5d4dca18fca1124386
MD5 e175f1b5466da588c0b7176f61165b11
SHA1 930de4943ba665b15b7445c476d5e4ff32e01f4a
SHA512 2f4915f537bfd9fa8c5e4812014065bb5f678ab6a9b23d2ee9a13ce79e2fabe0e6c0e805274974e458f988052f46f55063762b8db25dd0c7b1c18481c99549ab
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouy:0NA1Yakeer5+nsoF
TLSH
T13F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yKj6Lcvjx1gNJ25.exe

Path C:\Windows\yKj6Lcvjx1gNJ25.exe
Size 804KB
SHA256 9c7c521f828b945a75769d5b79609fa6f990c7c7c6260e429b23146eec28d2ab
MD5 c772d8026f063c435bda5a4556b64824
SHA1 aacb3fab39503996936d227a1a014fc49b546a20
SHA512 1304030f0154839b9c59f3e48c052ecebd4940adc39874c3b80b030d48d3b5c3f16b3b02543588d17631d12c9440fccb3959f8226175ebac81c2200c9ce0eda4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouZ:0NA1Yakeer5+nso8
TLSH
T15F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yPTYN7coIMGx6Zj.exe

Path C:\Windows\yPTYN7coIMGx6Zj.exe
Size 804KB
SHA256 098d0cc956a07c68862082891ea805bb0b1f81b3b3b7ccc788e0757bc37d3fda
MD5 96e2967dd24282eed30b36ffdf3ccdc1
SHA1 c5da61643d9e264e892013dc4e41f1b023ddb9c9
SHA512 e01a15921a1f3fb6c279188e78405ff2eb1e54ee8eb497d1530cb43f0cb15f5f50d8bc97fb0cf5567c294e65c018d032ce07b18069569702de2b486e2ed418c3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou5:0NA1Yakeer5+nsoO
TLSH
T19F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads