520f70801a407bae5c1a420880e946e31723e8d87a9c8f04cc3010a309ffcd52

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_7a1dee3cfc4f418f2c532e4a4029502f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample261003-lpgtfsxtbx
SHA256 520f70801a407bae5c1a420880e946e31723e8d87a9c8f04cc3010a309ffcd52
MD5 7a1dee3cfc4f418f2c532e4a4029502f
SHA1 3518d2d3ab244de351302bacc5de74639c400439
SHA512 d82b7534b9620a9b7f4a081a5f31d9f48cb52973785c6c2ba42bbf5f02b28e39bfc9a8af7603ba9d129dd8321fadb773a3df2fd338c7ba4c8295c192484b5561
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouF:0NA1Yakeer5+nsou
TLSH
T12405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (2377) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 25 IoCs

pid	Process
1176	GEgQuipa.exe
3248	JX9hY.exe
3156	lijI3ybq7v.exe
5536	95z6sdvxRhkR1XO.exe
5432	p1u1zy8VvXxUaL6.exe
4040	ENZvk.exe
5640	uskSICh4xiJMERt.exe
5372	aY4Ytiu2.exe
3948	OW5SE.exe
1464	lhDgsCz.exe
6488	3xOEcDmB5nMxv5g.exe
6744	jG6LEPb2GNw.exe
7000	Cnbv4.exe
5012	CjYDU5Is.exe
1316	Ur6FoZOLBQZ.exe
7360	wgjljXiu0U4y1G.exe
7628	Ip5hApspU4I.exe
7896	tQWcx56ZNZ5sO4.exe
7012	rLZBZbYadICEq5O.exe
7488	jnqNIFI.exe
8268	nFpQqqa1GEqrg2w.exe
8516	D6BwjikOzFOc.exe
8776	ax6FqhYiMve.exe
9032	ON0eaYPVrvID47.exe
8760	XmD0iv.exe

Adds Run key to start application 2 TTPs 25 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LDSCAN = "C:\\Windows\\ON0eaYPVrvID47.exe"	ax6FqhYiMve.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DVP95 = "C:\\Windows\\XmD0iv.exe"	ON0eaYPVrvID47.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GENERICS = "C:\\Windows\\GEgQuipa.exe"	2026-10-02_7a1dee3cfc4f418f2c532e4a4029502f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOCKDOWN = "C:\\Windows\\JX9hY.exe"	GEgQuipa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SWEEPSRV = "C:\\Windows\\95z6sdvxRhkR1XO.exe"	lijI3ybq7v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCAGENT = "C:\\Windows\\uskSICh4xiJMERt.exe"	ENZvk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RAV7WIN = "C:\\Windows\\OW5SE.exe"	aY4Ytiu2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MGAVRTE = "C:\\Windows\\rLZBZbYadICEq5O.exe"	tQWcx56ZNZ5sO4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVSYNMGR = "C:\\Windows\\nFpQqqa1GEqrg2w.exe"	jnqNIFI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCCWIN97 = "C:\\Windows\\ENZvk.exe"	p1u1zy8VvXxUaL6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GUARD = "C:\\Windows\\Cnbv4.exe"	jG6LEPb2GNw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NMAIN = "C:\\Windows\\wgjljXiu0U4y1G.exe"	Ur6FoZOLBQZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NTXCONFIG = "C:\\Windows\\lijI3ybq7v.exe"	JX9hY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PROCESSMONITOR = "C:\\Windows\\aY4Ytiu2.exe"	uskSICh4xiJMERt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PROCESSMONITOR = "C:\\Windows\\jG6LEPb2GNw.exe"	3xOEcDmB5nMxv5g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DEFWATCH = "C:\\Windows\\CjYDU5Is.exe"	Cnbv4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PROCESSMONITOR = "C:\\Windows\\Ur6FoZOLBQZ.exe"	CjYDU5Is.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCSCAN = "C:\\Windows\\Ip5hApspU4I.exe"	wgjljXiu0U4y1G.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FSGK32 = "C:\\Windows\\jnqNIFI.exe"	rLZBZbYadICEq5O.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FSGK32 = "C:\\Windows\\ax6FqhYiMve.exe"	D6BwjikOzFOc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MOOLIVE = "C:\\Windows\\p1u1zy8VvXxUaL6.exe"	95z6sdvxRhkR1XO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RAV7WIN = "C:\\Windows\\lhDgsCz.exe"	OW5SE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FAMEH32 = "C:\\Windows\\3xOEcDmB5nMxv5g.exe"	lhDgsCz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NETUTILS = "C:\\Windows\\tQWcx56ZNZ5sO4.exe"	Ip5hApspU4I.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVXMONITOR9X = "C:\\Windows\\D6BwjikOzFOc.exe"	nFpQqqa1GEqrg2w.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\JX9hY.exe	GEgQuipa.exe
File opened for modification	C:\Windows\p1u1zy8VvXxUaL6.exe	95z6sdvxRhkR1XO.exe
File opened for modification	C:\Windows\ENZvk.exe	p1u1zy8VvXxUaL6.exe
File created	C:\Windows\OW5SE.exe	aY4Ytiu2.exe
File created	C:\Windows\jG6LEPb2GNw.exe	3xOEcDmB5nMxv5g.exe
File opened for modification	C:\Windows\Ur6FoZOLBQZ.exe	CjYDU5Is.exe
File created	C:\Windows\Ip5hApspU4I.exe	wgjljXiu0U4y1G.exe
File opened for modification	C:\Windows\Ip5hApspU4I.exe	wgjljXiu0U4y1G.exe
File created	C:\Windows\95z6sdvxRhkR1XO.exe	lijI3ybq7v.exe
File created	C:\Windows\wgjljXiu0U4y1G.exe	Ur6FoZOLBQZ.exe
File created	C:\Windows\tQWcx56ZNZ5sO4.exe	Ip5hApspU4I.exe
File opened for modification	C:\Windows\jnqNIFI.exe	rLZBZbYadICEq5O.exe
File opened for modification	C:\Windows\D6BwjikOzFOc.exe	nFpQqqa1GEqrg2w.exe
File created	C:\Windows\ax6FqhYiMve.exe	D6BwjikOzFOc.exe
File created	C:\Windows\ON0eaYPVrvID47.exe	ax6FqhYiMve.exe
File created	C:\Windows\lijI3ybq7v.exe	JX9hY.exe
File created	C:\Windows\p1u1zy8VvXxUaL6.exe	95z6sdvxRhkR1XO.exe
File opened for modification	C:\Windows\uskSICh4xiJMERt.exe	ENZvk.exe
File opened for modification	C:\Windows\jG6LEPb2GNw.exe	3xOEcDmB5nMxv5g.exe
File created	C:\Windows\jnqNIFI.exe	rLZBZbYadICEq5O.exe
File created	C:\Windows\nFpQqqa1GEqrg2w.exe	jnqNIFI.exe
File opened for modification	C:\Windows\Cnbv4.exe	jG6LEPb2GNw.exe
File opened for modification	C:\Windows\CjYDU5Is.exe	Cnbv4.exe
File opened for modification	C:\Windows\tQWcx56ZNZ5sO4.exe	Ip5hApspU4I.exe
File created	C:\Windows\D6BwjikOzFOc.exe	nFpQqqa1GEqrg2w.exe
File created	C:\Windows\XmD0iv.exe	ON0eaYPVrvID47.exe
File opened for modification	C:\Windows\GEgQuipa.exe	2026-10-02_7a1dee3cfc4f418f2c532e4a4029502f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\lijI3ybq7v.exe	JX9hY.exe
File opened for modification	C:\Windows\OW5SE.exe	aY4Ytiu2.exe
File created	C:\Windows\rLZBZbYadICEq5O.exe	tQWcx56ZNZ5sO4.exe
File opened for modification	C:\Windows\rLZBZbYadICEq5O.exe	tQWcx56ZNZ5sO4.exe
File opened for modification	C:\Windows\ON0eaYPVrvID47.exe	ax6FqhYiMve.exe
File created	C:\Windows\ENZvk.exe	p1u1zy8VvXxUaL6.exe
File created	C:\Windows\uskSICh4xiJMERt.exe	ENZvk.exe
File created	C:\Windows\CjYDU5Is.exe	Cnbv4.exe
File created	C:\Windows\Ur6FoZOLBQZ.exe	CjYDU5Is.exe
File opened for modification	C:\Windows\wgjljXiu0U4y1G.exe	Ur6FoZOLBQZ.exe
File opened for modification	C:\Windows\ax6FqhYiMve.exe	D6BwjikOzFOc.exe
File created	C:\Windows\GEgQuipa.exe	2026-10-02_7a1dee3cfc4f418f2c532e4a4029502f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\JX9hY.exe	GEgQuipa.exe
File created	C:\Windows\aY4Ytiu2.exe	uskSICh4xiJMERt.exe
File created	C:\Windows\lhDgsCz.exe	OW5SE.exe
File created	C:\Windows\3xOEcDmB5nMxv5g.exe	lhDgsCz.exe
File opened for modification	C:\Windows\95z6sdvxRhkR1XO.exe	lijI3ybq7v.exe
File opened for modification	C:\Windows\aY4Ytiu2.exe	uskSICh4xiJMERt.exe
File opened for modification	C:\Windows\lhDgsCz.exe	OW5SE.exe
File opened for modification	C:\Windows\3xOEcDmB5nMxv5g.exe	lhDgsCz.exe
File created	C:\Windows\Cnbv4.exe	jG6LEPb2GNw.exe
File opened for modification	C:\Windows\nFpQqqa1GEqrg2w.exe	jnqNIFI.exe
File opened for modification	C:\Windows\XmD0iv.exe	ON0eaYPVrvID47.exe

Program crash 12 IoCs

pid	pid_target	Process	procid_target
6408	5372	WerFault.exe	104
8104	7360	WerFault.exe	123
10016	6488	WerFault.exe	113
10092	7000	WerFault.exe	117
10144	5012	WerFault.exe	119
4656	7488	WerFault.exe	133
5968	8268	WerFault.exe	135
9436	8516	WerFault.exe	137
1228	8776	WerFault.exe	139
8716	4040	WerFault.exe	100
6640	7896	WerFault.exe	127
5824	7628	WerFault.exe	125

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-02_7a1dee3cfc4f418f2c532e4a4029502f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-02_7a1dee3cfc4f418f2c532e4a4029502f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	p1u1zy8VvXxUaL6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uskSICh4xiJMERt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OW5SE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnbv4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CjYDU5Is.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tQWcx56ZNZ5sO4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmD0iv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JX9hY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lijI3ybq7v.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95z6sdvxRhkR1XO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ENZvk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3xOEcDmB5nMxv5g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wgjljXiu0U4y1G.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jnqNIFI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nFpQqqa1GEqrg2w.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_7a1dee3cfc4f418f2c532e4a4029502f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GEgQuipa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aY4Ytiu2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lhDgsCz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ip5hApspU4I.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rLZBZbYadICEq5O.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D6BwjikOzFOc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ax6FqhYiMve.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jG6LEPb2GNw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ur6FoZOLBQZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ON0eaYPVrvID47.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-02_7a1dee3cfc4f418f2c532e4a4029502f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_7a1dee3cfc4f418f2c532e4a4029502f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4228

C:\Windows\GEgQuipa.exe
C:\Windows\GEgQuipa.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1176

C:\Windows\JX9hY.exe
C:\Windows\JX9hY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3248

C:\Windows\lijI3ybq7v.exe
C:\Windows\lijI3ybq7v.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3156

C:\Windows\95z6sdvxRhkR1XO.exe
C:\Windows\95z6sdvxRhkR1XO.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5536

C:\Windows\p1u1zy8VvXxUaL6.exe
C:\Windows\p1u1zy8VvXxUaL6.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5432

C:\Windows\ENZvk.exe
C:\Windows\ENZvk.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 2312
  2⤵
  - Program crash
  PID:8716

C:\Windows\uskSICh4xiJMERt.exe
C:\Windows\uskSICh4xiJMERt.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5640

C:\Windows\aY4Ytiu2.exe
C:\Windows\aY4Ytiu2.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 2104
  2⤵
  - Program crash
  PID:6408

C:\Windows\OW5SE.exe
C:\Windows\OW5SE.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3948

C:\Windows\lhDgsCz.exe
C:\Windows\lhDgsCz.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5372 -ip 5372
1⤵
PID:6380

C:\Windows\3xOEcDmB5nMxv5g.exe
C:\Windows\3xOEcDmB5nMxv5g.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6488 -s 2216
  2⤵
  - Program crash
  PID:10016

C:\Windows\jG6LEPb2GNw.exe
C:\Windows\jG6LEPb2GNw.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6744

C:\Windows\Cnbv4.exe
C:\Windows\Cnbv4.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7000 -s 2224
  2⤵
  - Program crash
  PID:10092

C:\Windows\CjYDU5Is.exe
C:\Windows\CjYDU5Is.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 2216
  2⤵
  - Program crash
  PID:10144

C:\Windows\Ur6FoZOLBQZ.exe
C:\Windows\Ur6FoZOLBQZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1316

C:\Windows\wgjljXiu0U4y1G.exe
C:\Windows\wgjljXiu0U4y1G.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 2096
  2⤵
  - Program crash
  PID:8104

C:\Windows\Ip5hApspU4I.exe
C:\Windows\Ip5hApspU4I.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7628 -s 2512
  2⤵
  - Program crash
  PID:5824

C:\Windows\tQWcx56ZNZ5sO4.exe
C:\Windows\tQWcx56ZNZ5sO4.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7896 -s 2404
  2⤵
  - Program crash
  PID:6640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 7360 -ip 7360
1⤵
PID:8084

C:\Windows\rLZBZbYadICEq5O.exe
C:\Windows\rLZBZbYadICEq5O.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7012

C:\Windows\jnqNIFI.exe
C:\Windows\jnqNIFI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7488 -s 2216
  2⤵
  - Program crash
  PID:4656

C:\Windows\nFpQqqa1GEqrg2w.exe
C:\Windows\nFpQqqa1GEqrg2w.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8268 -s 2216
  2⤵
  - Program crash
  PID:5968

C:\Windows\D6BwjikOzFOc.exe
C:\Windows\D6BwjikOzFOc.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8516 -s 2220
  2⤵
  - Program crash
  PID:9436

C:\Windows\ax6FqhYiMve.exe
C:\Windows\ax6FqhYiMve.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8776 -s 2216
  2⤵
  - Program crash
  PID:1228

C:\Windows\ON0eaYPVrvID47.exe
C:\Windows\ON0eaYPVrvID47.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9032

C:\Windows\XmD0iv.exe
C:\Windows\XmD0iv.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6488 -ip 6488
1⤵
PID:9996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 7000 -ip 7000
1⤵
PID:10072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5012 -ip 5012
1⤵
PID:10124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 7488 -ip 7488
1⤵
PID:9340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 8268 -ip 8268
1⤵
PID:9348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 8516 -ip 8516
1⤵
PID:9416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 8776 -ip 8776
1⤵
PID:9456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4040 -ip 4040
1⤵
PID:9984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 7896 -ip 7896
1⤵
PID:6628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 7628 -ip 7628
1⤵
PID:10144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3xOEcDmB5nMxv5g.exe

Path C:\Windows\3xOEcDmB5nMxv5g.exe
Size 804KB
SHA256 e6e607e9bb10264830cb44c28de688fcd88d44161e14c39411302ccc18a556bf
MD5 0ab5e51ec64672e51bffdaab8c8d6613
SHA1 a19ec0b99e8012b942de3175f777f7c2aee67553
SHA512 e0f041ef2d7762dea063f708878458858947f202fa431ad0a44071f114ba792f13ab49bded039118ae0fcea2221c8e115f24186862012e1652ffa1bd22532db4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouS:0NA1Yakeer5+nso/
TLSH
T16905A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95z6sdvxRhkR1XO.exe

Path C:\Windows\95z6sdvxRhkR1XO.exe
Size 804KB
SHA256 2e9ac2d0f8528966edf130bb7566376f377e5cc8151c9ed8f70a8ca15e7143ae
MD5 03108765f0437892e3be68d582934887
SHA1 7dc5213914a1817b792c0fd41494a4575d485ec8
SHA512 caed0824a3c32267f96c8f5dce41dd34bfae78552b230c0b4b927e21875775a00259fd0bd3c273ad59d6b2236aca960e99d33239b77bc5cdf10af04469454a36
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouQ:0NA1Yakeer5+nso/
TLSH
T16105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CjYDU5Is.exe

Path C:\Windows\CjYDU5Is.exe
Size 804KB
SHA256 4d670f8efd14b9c1a4886e6185a2408d11d70ff13d680cf1c57d7a4841b34d5a
MD5 744f90b5d10841168218cf708b4eabed
SHA1 cebc83ab2282870cb6c2901a9896ffe2170e7f15
SHA512 c682b0b86e58d757b7a79751a6db4683841c85b77d053f89113bd976dfde8651a6165ef58d3760d2e2ebbba73bf75e5db822b220efb4e2ee5034488366dd614f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouR:0NA1Yakeer5+nsoy
TLSH
T1E005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cnbv4.exe

Path C:\Windows\Cnbv4.exe
Size 804KB
SHA256 d240071a54564119b0c116d5375f98432e0f53e322270ecbf384c91df8746a27
MD5 a4139a45601ed311958810e2a8e7597b
SHA1 a4dfe19f2398490eac4a6eb1d0b2aaea9c5fe854
SHA512 0c999f515397fb34ffeebb002b2242f712ea1fccbb4d366d27a74856532097280a17aa7eae2cf88d47d76ea1d49931a1ec53100747f074d77ec8ece3271a0cfa
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoum:0NA1Yakeer5+nso9
TLSH
T19105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D6BwjikOzFOc.exe

Path C:\Windows\D6BwjikOzFOc.exe
Size 804KB
SHA256 10a8b887d3623d94391f97997f37f442d4e7d9f5912de2265afab073ba607731
MD5 8d8afe0d755cb91c98f0849d8fe89ca1
SHA1 5eee711aa4c453fea0da14dabf593e425fa69147
SHA512 16b636cf997752019fb17099f1ec2a9ef4421ef3443a08bfc0033709bbb5f682a35ac6cf91c3acd19e355e0d37a88914b403d98c18efe57f691cb05af356e947
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou/:0NA1Yakeer5+nso0
TLSH
T1FA05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ENZvk.exe

Path C:\Windows\ENZvk.exe
Size 804KB
SHA256 3ed9d043b18f1712888775ecc25ddfa135921eb7ee77cf699388fc99859acbb4
MD5 691752372ed48d63f7ad2d3a0b2e3e4b
SHA1 00db9753a586cd5fa22b6a42a471581c37415acf
SHA512 06c583e1264254d83ea0e46de5a58c75a0aba46675f6cb6c058fd08831b49cd849343798038b4cf543e81ff2875e9508c619a4f7d61c60b7f0ba0928dcca055f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nsog
TLSH
T17305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GEgQuipa.exe

Path C:\Windows\GEgQuipa.exe
Size 804KB
SHA256 31f39b0946c89844d942760b40ce992cfdf0ce6ac9f6b12e12cb643559227f1e
MD5 18038573af733ee29636ae535d9793ec
SHA1 4342ea9b4002e13575518398c2f274cf3fd28b9b
SHA512 8a19c77490c7fe9b9ba98ca48bc5c2f546e913ce1666614a6e098789d4c2ad31b84c81cdca47aa667050f40f8e620f4a3f464218fac0521dffced2c2050620e9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFous:0NA1Yakeer5+nsoJ
TLSH
T17405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ip5hApspU4I.exe

Path C:\Windows\Ip5hApspU4I.exe
Size 804KB
SHA256 0a2eb5b04b847f10f69b247dc09c5ae8645e99261f4b3f59fa31fbc846b838ee
MD5 26231869e8b591ffe0b7d359a0f7aabf
SHA1 cf7dbc6f758e55a7b88c62c4006e54ef20247f3e
SHA512 9952d0f2193951265f2e6359622bd8ecdb39cafbdbc085f68220464294fb157a9c21b742bedf4d0e489ec6529d561bb94c54cb21e899838b1b02fb3ff62e7159
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoue:0NA1Yakeer5+nsoP
TLSH
T1AE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JX9hY.exe

Path C:\Windows\JX9hY.exe
Size 804KB
SHA256 dd6cfead7d52bf7d8c3fd13dfd815445e92d8831ee052897b6ba530ad7958450
MD5 cfcb71032c8156c5e5968f0da8248d69
SHA1 788941e164d5238473c971447dd3ae7ad82b5423
SHA512 b3fb267063ab95e4f5ab6a573ccd17f0ec68f200a54f94b9d7ab9d8a06619f9d240f9ac2df10ca178882a0a56f59b9acb99c606f5cf144b3c0b36fceae682766
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouy:0NA1Yakeer5+nso5
TLSH
T17A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ON0eaYPVrvID47.exe

Path C:\Windows\ON0eaYPVrvID47.exe
Size 804KB
SHA256 2fea79b1cddec406f94ba5f28bec883a2cefb6204e386a5224c5b6a7463d5506
MD5 f63fbcf9b8aa4ea088101f1dfdc8101d
SHA1 8853de88b3ba2c62e72aff1f034da1df9fb73139
SHA512 8742a3bcb26d466359295793beef463cb5f4c39ba32a23f490b1ad4adf4de90242b9bbabce5b49a3fcbcc98d70c8acc3832f4c026b370b6412adeb3d33f0f19e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nsor
TLSH
T1B605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OW5SE.exe

Path C:\Windows\OW5SE.exe
Size 804KB
SHA256 22666f4538fa08b3c8bf11d6e05e8734c5e99622cc47d3143bc1afc6f8550e30
MD5 6d06b616c812440f0491286f6b972a9d
SHA1 2ed749f82575fb8b09cc869871c7615ec9c2c6de
SHA512 b53f04c93afcb2c7d280edf7e4aa1f87cfb56a8c427c3ac8265af30bfb076809e038866a9d6d5c11e245532ca247126cf1d98bd7e75e5b577cbd477b6a1e4ead
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou7w:0NA1Yakeer5+nsof
TLSH
T16B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ur6FoZOLBQZ.exe

Path C:\Windows\Ur6FoZOLBQZ.exe
Size 804KB
SHA256 f0b26f3d1ddeff91a917f951294fe98707e3f5ae7d8c1493b232ce3d99fd637f
MD5 28fbda33723d9397e46342be0b675a41
SHA1 b546597d415b3a25297515e3c233228a3a577c1b
SHA512 ada5538f99926c6b1074f17a4fcb61f45a51eb56c4cc0ea2fd645c94fc06ee309cf483499d98621bea41681a24abafac46fa41ea8c0e3668a460cc70d7561a0e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouI:0NA1Yakeer5+nsoF
TLSH
T14305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XmD0iv.exe

Path C:\Windows\XmD0iv.exe
Size 804KB
SHA256 54d26fc67f8e0a788ec27b81a0c9fc4bcb116f2c893785efe04deea97d6ea0b1
MD5 3df562773bb5526d00be7004c62d18dd
SHA1 6246574ce5f25c1454ffb6d2529e97fcea7fcaef
SHA512 c2825853f8e23e058699641336a6afe9828919eef84fe1458c4cd8c2539f76b4f8391c384d65dc4fab207ede02a92024694fc32e6e67097d12841e309c926d41
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA:0NA1Yakeer5+nsob
TLSH
T12805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aY4Ytiu2.exe

Path C:\Windows\aY4Ytiu2.exe
Size 804KB
SHA256 2ca80a611f4e46d3d3d34564bd4da5f1e711d1a733c58b541686338edca271eb
MD5 e68ce2596db9013799f715a8adef822c
SHA1 2c7a457f4901d2e29e5df0b9676d8c984db83e9e
SHA512 1a10572bd2c1fb2bc53d7a277b7f082001dcc2bf3d1f0ed826e8bec6d99e694f71e541d999dbbe10c851c4e7f62c39f69941c9d08285e46ec6ea3ca3b04d9c2a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nsoo
TLSH
T1B905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ax6FqhYiMve.exe

Path C:\Windows\ax6FqhYiMve.exe
Size 804KB
SHA256 2a6eefba66dad602269ab461df1d9f8b86745fe7135b614ebb4ffa0863e3ed3c
MD5 17444a044f4b32d76efbd75b877999bf
SHA1 a436f43c1e881f4dfd7a96e68fa6fd5c248f9fcb
SHA512 f6b32c0e4aed6c10cb27e53bd2300fd56daedf74710dcc3b8adad1b17daf2d6d715d5fcb9e5a3c0da1c8a77412645362099eee4a9420dc24324a524d455562eb
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoun:0NA1Yakeer5+nsok
TLSH
T17505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jG6LEPb2GNw.exe

Path C:\Windows\jG6LEPb2GNw.exe
Size 804KB
SHA256 1ae859a4b768c19463763872780b9ddbf44e43ce0966ea9bd8ee7ee9d0a68229
MD5 b8c590142ba493da5290d662f26b77a8
SHA1 7f523711dbab9bb638dcc8e90cb71b5e2d32129d
SHA512 ba3078b5bbfd48733af226a7fcabaebb9e1fe5e3b34267e90bc36978cc988aae6de10bf9325b8aaacb524ba5063c3acea9765b42893b729b381a920798b449dc
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouy:0NA1Yakeer5+nsoR
TLSH
T15605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jnqNIFI.exe

Path C:\Windows\jnqNIFI.exe
Size 804KB
SHA256 e82ccf908bd950f6c7d3ad5b8cdf919e00df0b81e009b305fc7e5c44e7129351
MD5 608dedbba2220b236659eb8396fbd2fe
SHA1 5eba23c95a0ea599ff75f483786a44a9f9d02493
SHA512 bbcba899ff6aeb8ee637d546fa35ded924e64025e77e576802f6eeebc92936d02f3298657af40921d31eb467692d628fad6b208c04dddee02474162b1cb45de5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoug:0NA1Yakeer5+nsoN
TLSH
T15C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lhDgsCz.exe

Path C:\Windows\lhDgsCz.exe
Size 804KB
SHA256 e76c927920dd0c9353a37ed5dc474ab670131ee23e6d005aa678465f3de56903
MD5 706656621be24a7c71e3d0044b9a2404
SHA1 4323f90d0726e9ce6672fdb6450c98143b3d809e
SHA512 842de2a664dc01de315ed642593533a4a6d46f21439b07604eef96a7e2d84a1428713abf7f13bed0619484fbc3d5605e41716bb766d08366a022c85f37dbc21b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA:0NA1Yakeer5+nsoh
TLSH
T1AE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lijI3ybq7v.exe

Path C:\Windows\lijI3ybq7v.exe
Size 804KB
SHA256 383245eec7c64478f1bf291417ee5c89ec408cfbbf1964e19396edaba2ed8cf0
MD5 744ccfa0c6eb609e8180c6abf02d216d
SHA1 c457117a51d731b7d5656dcb8308d59c91e34357
SHA512 250bd4c440ce881de341aaafc2285c1b0b7f05eb7bd8e07647f439bab452560e664ef913d51af0433586981afdabe97b34ce69794894301c76aa879e5ada0660
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoun:0NA1Yakeer5+nsoo
TLSH
T13205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nFpQqqa1GEqrg2w.exe

Path C:\Windows\nFpQqqa1GEqrg2w.exe
Size 804KB
SHA256 6d633813a09e65ddd99cea40231fb3ffa61731ae11e172ddbc9a76bda96139b3
MD5 5c7aa2dddfe13ad1d10018323d2c734a
SHA1 e0be62fb39b92147a2e50ecbf7e6c5381d4cb0a5
SHA512 84fa3cadd4cddb00efe0c39040975246ec2ad297a7b09173a7d4bd832d2a3048536f3f4b196522ed3cfe040f03532725642e012f46e3f7fffc6c12bbee3e3dfd
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouT:0NA1Yakeer5+nsog
TLSH
T1AC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

p1u1zy8VvXxUaL6.exe

Path C:\Windows\p1u1zy8VvXxUaL6.exe
Size 804KB
SHA256 a4ef19ade05bc0dcc4d6f71380506cbd081a23271e88c2cb9ed2ab32567bd973
MD5 ed201dda970bb1be3c304136da2b7d20
SHA1 44468dc401493f721fc13d0a6aef8e75e7f28ca1
SHA512 fa44c8a849c047ace872ef46b5c30e0dec099433302bdeb22a766e5c3bfdd799e5957151a38318c4756e96ed7c53cf9c9a245b870cd1bf720ca34b0634de0cb4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouD:0NA1Yakeer5+nsoi
TLSH
T19805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rLZBZbYadICEq5O.exe

Path C:\Windows\rLZBZbYadICEq5O.exe
Size 804KB
SHA256 5e1485d563dcb12f54c7461aba0e131722e8db500d4d5db489f2bb564ae88a39
MD5 e2ae5ab7b983008291d744a912690df8
SHA1 9cc957814a6d6365ca2997b8e20ba3f7fbb39da5
SHA512 4d69a3443a67ac3f1bd85f3f49864e1028bbd7cd6965eddcdebe7b18d8ef1f65d936738bc6acbffd53f9a20d0b4c964f21e7fbe585ac2f57d453863c0d045c7c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoum:0NA1Yakeer5+nsoZ
TLSH
T17305A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tQWcx56ZNZ5sO4.exe

Path C:\Windows\tQWcx56ZNZ5sO4.exe
Size 804KB
SHA256 42dcc44c23a7b3e17036ac7bb726d0792c3a717300bc1031ba6c2f69d3e1fc96
MD5 77667a2adb9092cf28b7262c80f37217
SHA1 77797cda3a1ec7e526de9987036fc6e7d7ac9302
SHA512 8171b39013dd5078ce94b5d2cfcaf63da893e3c21edc44710e85b27e6e7c57a9b17163532e379eb039725fa2bb6a6bbe1cbf3123cb0dafe2abf15b6ff49eede2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFout:0NA1Yakeer5+nso8
TLSH
T1B805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uskSICh4xiJMERt.exe

Path C:\Windows\uskSICh4xiJMERt.exe
Size 804KB
SHA256 80e8e87952b2e82f9e59af1e872d29a068a94d50878e87cc3c469bb4251a45a7
MD5 8a371205fbcb763f4e496813554bf667
SHA1 b16b2d066d2950bac2b22bdd1f9a3c4a7d9932e8
SHA512 19ce3ce25ed628c8357241b0eb87ed03d7a6fac11340dcb8d3fdf8f8d55b79eaf256d378a0b939b227cc60c9470d59a69db436513fda22b7cb31e8456dad0c4b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouj:0NA1Yakeer5+nsoO
TLSH
T18605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wgjljXiu0U4y1G.exe

Path C:\Windows\wgjljXiu0U4y1G.exe
Size 804KB
SHA256 e43fc860307e0219bc0a2ec8bf07b6d009a9c8743f4720c723045db89e31dd3a
MD5 8f6257dfcf23a1c9cb728f8ec923aee7
SHA1 bb1a5700e8f0173adeeff55b9553a16c1377f2d9
SHA512 0c0e7f5a5f3b5d6ceba7894eb8925bc589a1abba0e901c732909d3497b3ff2025bb3ef75c17a78374998e39f23d19f765ab294b5e3d2842bb9b3cec4e5e7cad0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nsoQ
TLSH
T19A05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads