Overview

overview

10

Static

static

3

2026-07-18...ck.exe

windows10-2004-x64

10

2026-07-18...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 07:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe
  • Size 1.6MB
  • Sample260718-jexe2scv2n
  • SHA256 77258cd2c8a04d550b0570c510e4e785a1410109fa8eb4ca981ece84834ae3b4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 13 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 13 IoCs
    defense_evasiontrojan
  • Renames multiple (81) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 13 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 26 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Users\Admin\sikAIIAw\oeYkoYoc.exe
      "C:\Users\Admin\sikAIIAw\oeYkoYoc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:4212
    • C:\ProgramData\WyMYMkcI\dmMwQcIs.exe
      "C:\ProgramData\WyMYMkcI\dmMwQcIs.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:4792
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2332
      • C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4904
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2708
          • C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5460
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4288
              • C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5432
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4124
                  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4848
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4268
                      • C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3532
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:4584
                          • C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4196
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:6116
                              • C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock
                                15⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4132
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:3612
                                  • C:\Windows\System32\Conhost.exe
                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                    17⤵
                                      PID:844
                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe
                                      C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock
                                      17⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:1944
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock"
                                        18⤵
                                        • Executes a command shell one-liner
                                        • Suspicious use of WriteProcessMemory
                                        PID:2500
                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe
                                          C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock
                                          19⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:1316
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock"
                                            20⤵
                                            • Executes a command shell one-liner
                                            • System Location Discovery: System Language Discovery
                                            PID:1456
                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe
                                              C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock
                                              21⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2464
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock"
                                                22⤵
                                                • Executes a command shell one-liner
                                                • System Location Discovery: System Language Discovery
                                                PID:4360
                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe
                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock
                                                  23⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:5664
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock"
                                                    24⤵
                                                    • Executes a command shell one-liner
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5132
                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe
                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock
                                                      25⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5748
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock"
                                                        26⤵
                                                        • Executes a command shell one-liner
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5772
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                        26⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Modifies registry key
                                                        PID:3720
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                        26⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry key
                                                        PID:3808
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                        26⤵
                                                        • UAC bypass
                                                        • Modifies registry key
                                                        PID:1244
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NiMYsAQw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe""
                                                        26⤵
                                                        • Executes a command shell one-liner
                                                        PID:3360
                                                        • C:\Windows\SysWOW64\cscript.exe
                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                          27⤵
                                                          • Executes a VBScript file via the Windows Script Host.
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2916
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                    24⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry key
                                                    PID:3172
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                    24⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry key
                                                    PID:6108
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                    24⤵
                                                    • UAC bypass
                                                    • Modifies registry key
                                                    PID:3388
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ruwwUsAk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe""
                                                    24⤵
                                                    • Executes a command shell one-liner
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1264
                                                    • C:\Windows\SysWOW64\cscript.exe
                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                      25⤵
                                                      • Executes a VBScript file via the Windows Script Host.
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3512
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                22⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Modifies registry key
                                                PID:984
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                22⤵
                                                • Modifies registry key
                                                PID:6040
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                22⤵
                                                • UAC bypass
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry key
                                                PID:2432
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PoosUcso.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe""
                                                22⤵
                                                • Executes a command shell one-liner
                                                • System Location Discovery: System Language Discovery
                                                PID:3968
                                                • C:\Windows\SysWOW64\cscript.exe
                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                  23⤵
                                                  • Executes a VBScript file via the Windows Script Host.
                                                  PID:6064
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                            20⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry key
                                            PID:3204
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                            20⤵
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry key
                                            PID:5656
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                            20⤵
                                            • UAC bypass
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry key
                                            PID:4668
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qSwUAgco.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe""
                                            20⤵
                                            • Executes a command shell one-liner
                                            • System Location Discovery: System Language Discovery
                                            PID:1956
                                            • C:\Windows\SysWOW64\cscript.exe
                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                              21⤵
                                              • Executes a VBScript file via the Windows Script Host.
                                              • System Location Discovery: System Language Discovery
                                              PID:2992
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                        18⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry key
                                        PID:3480
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                        18⤵
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry key
                                        PID:1332
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                        18⤵
                                        • UAC bypass
                                        • Modifies registry key
                                        PID:3332
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EgcgIwEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe""
                                        18⤵
                                        • Executes a command shell one-liner
                                        • System Location Discovery: System Language Discovery
                                        PID:5528
                                        • C:\Windows\SysWOW64\cscript.exe
                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                          19⤵
                                          • Executes a VBScript file via the Windows Script Host.
                                          • System Location Discovery: System Language Discovery
                                          PID:1308
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                    16⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry key
                                    PID:4224
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                    16⤵
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry key
                                    PID:3588
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                    16⤵
                                    • UAC bypass
                                    • Modifies registry key
                                    PID:668
                                    • C:\Windows\System32\Conhost.exe
                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                      17⤵
                                        PID:6084
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HwIQkgcw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe""
                                      16⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:3008
                                      • C:\Windows\SysWOW64\cscript.exe
                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                        17⤵
                                        • Executes a VBScript file via the Windows Script Host.
                                        • System Location Discovery: System Language Discovery
                                        PID:3356
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                  14⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Modifies registry key
                                  PID:4716
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                  14⤵
                                  • Modifies registry key
                                  PID:6016
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                  14⤵
                                  • UAC bypass
                                  • Modifies registry key
                                  PID:1448
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fKMkMUQw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe""
                                  14⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:1084
                                  • C:\Windows\SysWOW64\cscript.exe
                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                    15⤵
                                    • Executes a VBScript file via the Windows Script Host.
                                    PID:2916
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                              12⤵
                              • Modifies visibility of file extensions in Explorer
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:3248
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                              12⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:3268
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                              12⤵
                              • UAC bypass
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:5412
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JowQQMco.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe""
                              12⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4216
                              • C:\Windows\SysWOW64\cscript.exe
                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                13⤵
                                • Executes a VBScript file via the Windows Script Host.
                                • System Location Discovery: System Language Discovery
                                PID:1064
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                          10⤵
                          • Modifies visibility of file extensions in Explorer
                          • System Location Discovery: System Language Discovery
                          • Modifies registry key
                          PID:1488
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                          10⤵
                          • System Location Discovery: System Language Discovery
                          • Modifies registry key
                          PID:5320
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                          10⤵
                          • UAC bypass
                          • System Location Discovery: System Language Discovery
                          • Modifies registry key
                          PID:2408
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aOkogIYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe""
                          10⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:4632
                          • C:\Windows\SysWOW64\cscript.exe
                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                            11⤵
                            • Executes a VBScript file via the Windows Script Host.
                            • System Location Discovery: System Language Discovery
                            PID:3964
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • System Location Discovery: System Language Discovery
                      • Modifies registry key
                      PID:1104
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                      8⤵
                      • Modifies registry key
                      PID:2088
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                      8⤵
                      • UAC bypass
                      • Modifies registry key
                      PID:596
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kKkAIAQs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe""
                      8⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1096
                      • C:\Windows\SysWOW64\cscript.exe
                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                        9⤵
                        • Executes a VBScript file via the Windows Script Host.
                        • System Location Discovery: System Language Discovery
                        PID:2404
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                  6⤵
                  • Modifies visibility of file extensions in Explorer
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:956
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:4548
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                  6⤵
                  • UAC bypass
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:5208
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ikIcwEMo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe""
                  6⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2924
                  • C:\Windows\SysWOW64\cscript.exe
                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                    7⤵
                    • Executes a VBScript file via the Windows Script Host.
                    • System Location Discovery: System Language Discovery
                    PID:2464
            • C:\Windows\SysWOW64\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
              4⤵
              • Modifies visibility of file extensions in Explorer
              • Modifies registry key
              PID:3416
            • C:\Windows\SysWOW64\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
              4⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:6084
            • C:\Windows\SysWOW64\reg.exe
              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
              4⤵
              • UAC bypass
              • Modifies registry key
              PID:5512
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FWocUAIY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe""
              4⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2260
              • C:\Windows\SysWOW64\cscript.exe
                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                5⤵
                • Executes a VBScript file via the Windows Script Host.
                • System Location Discovery: System Language Discovery
                PID:5224
        • C:\Windows\SysWOW64\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
          2⤵
          • Modifies visibility of file extensions in Explorer
          • Modifies registry key
          PID:844
        • C:\Windows\SysWOW64\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
          2⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:2780
        • C:\Windows\SysWOW64\reg.exe
          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
          2⤵
          • UAC bypass
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:3788
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iKUgkMws.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock.exe""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4912
          • C:\Windows\SysWOW64\cscript.exe
            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
            3⤵
            • Executes a VBScript file via the Windows Script Host.
            • System Location Discovery: System Language Discovery
            PID:6108
      • C:\ProgramData\diwIgcMA\lMsYAkMY.exe
        C:\ProgramData\diwIgcMA\lMsYAkMY.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        PID:3560
      • C:\Users\Admin\sikAIIAw\oeYkoYoc.exe
        C:\Users\Admin\sikAIIAw\oeYkoYoc.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:1612
      • C:\ProgramData\WyMYMkcI\dmMwQcIs.exe
        C:\ProgramData\WyMYMkcI\dmMwQcIs.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:548
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
        1⤵
          PID:2408

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              2
              T1059

              Visual Basic

              1
              T1059.005

              Windows Command Shell

              1
              T1059.003

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Privilege Escalation

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Defense Evasion

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Hide Artifacts

              1
              T1564

              Hidden Files and Directories

              1
              T1564.001

              Impair Defenses

              1
              T1562

              Disable or Modify Tools

              1
              T1562.001

              Modify Registry

              4
              T1112

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              System Information Discovery

              1
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              KMUE.txt
              • Path C:\ProgramData\KMUE.txt
              • Size 8KB
              • SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dmMwQcIs.exe
              • Path C:\ProgramData\WyMYMkcI\dmMwQcIs.exe
              • Size 1.6MB
              • SHA256 5b2f6765c569ae98e7115f6151f39da43020f3bf812ed6fe5fcde252307d36e4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              lMsYAkMY.exe
              • Path C:\ProgramData\diwIgcMA\lMsYAkMY.exe
              • Size 1.6MB
              • SHA256 aa402803fd2e4eaba8adced932acca2ee64c27af9ea40749280a550b5b87c33b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock
              • Path C:\Users\Admin\AppData\Local\Temp\2026-07-18_7346372a38aaf09086ab3e55f58b6275_elex_virlock
              • Size 2KB
              • SHA256 7e9997f40d13b32c724ca4ecef283f377ce9965d31534167994e654d6e6623b6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AYEu.exe
              • Path C:\Users\Admin\AppData\Local\Temp\AYEu.exe
              • Size 1.6MB
              • SHA256 e06a242725c0aab90cda8a2d87fd876e959ddbdbd8734929f142411b36451179
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AcQS.exe
              • Path C:\Users\Admin\AppData\Local\Temp\AcQS.exe
              • Size 2.9MB
              • SHA256 26584e275d09060bb2ec19ad08a37e74d17b1e4a46d61c18fa4c3a07824331c6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AsgG.exe
              • Path C:\Users\Admin\AppData\Local\Temp\AsgG.exe
              • Size 2.2MB
              • SHA256 dd4cdd44be25cbee9cacefb83b8a885e33f69f5231e22fcdda06e13de2226d13
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              EAco.exe
              • Path C:\Users\Admin\AppData\Local\Temp\EAco.exe
              • Size 1.6MB
              • SHA256 967961ec645c52599005740751f942a5ca554daa8310c2d726ab7e41920e331f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              EcEO.exe
              • Path C:\Users\Admin\AppData\Local\Temp\EcEO.exe
              • Size 1.6MB
              • SHA256 5fd3c009690b628a88f92e0a50f58b353c45885db4c4f9dc80ee35f3b1bd0544
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              GUou.exe
              • Path C:\Users\Admin\AppData\Local\Temp\GUou.exe
              • Size 1.9MB
              • SHA256 29f256cfc1ea46b143874f6896b0c9fed5479d3c8f324ba9078c6c63c667a1f7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Gowg.exe
              • Path C:\Users\Admin\AppData\Local\Temp\Gowg.exe
              • Size 1.9MB
              • SHA256 bb3180fb3b58da4d5e8629b1df581ce759e0bdc20e5e717e5c14c2f7498e4a1f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              GwgA.exe
              • Path C:\Users\Admin\AppData\Local\Temp\GwgA.exe
              • Size 2.6MB
              • SHA256 b8c7d94063491549ab64a22d1a4b361725fbebe60e5393ce560a6a45c9ed3d61
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IcQA.exe
              • Path C:\Users\Admin\AppData\Local\Temp\IcQA.exe
              • Size 1.6MB
              • SHA256 aa7fc16400ee5ae4b7f21d48035fdc89afbcf1eb681456709c562f4d3814f2ae
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              KgYE.exe
              • Path C:\Users\Admin\AppData\Local\Temp\KgYE.exe
              • Size 1.6MB
              • SHA256 2094e40d2a43be42aab63cc6c6624eef6a1dc48c964121cf3406ecb178612ab1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Kmcw.ico
              • Path C:\Users\Admin\AppData\Local\Temp\Kmcw.ico
              • Size 4KB
              • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              KsIg.exe
              • Path C:\Users\Admin\AppData\Local\Temp\KsIg.exe
              • Size 1.8MB
              • SHA256 7ef707adf23930b4b50295878065eef7ed3d6073dbff5f4f5d9d23891d04791a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Kswi.exe
              • Path C:\Users\Admin\AppData\Local\Temp\Kswi.exe
              • Size 1.6MB
              • SHA256 923b23902054513cf781a15df5947582159752735ea1439378ac395e5c235b80
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MEQS.exe
              • Path C:\Users\Admin\AppData\Local\Temp\MEQS.exe
              • Size 3.1MB
              • SHA256 5019a83c643ca207afd6aaf37e7ef7722c4cff1a4208ecbdb2ae13e6e0f4c124
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MGcY.ico
              • Path C:\Users\Admin\AppData\Local\Temp\MGcY.ico
              • Size 4KB
              • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MMEC.exe
              • Path C:\Users\Admin\AppData\Local\Temp\MMEC.exe
              • Size 1.6MB
              • SHA256 c2351579fd29f743169871bd493740df0e1f1cab03b338c869e6459dc43b97a3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MQQI.exe
              • Path C:\Users\Admin\AppData\Local\Temp\MQQI.exe
              • Size 1.6MB
              • SHA256 587948f50e4babe5843931a6c0bd5f438c63b298459e59eae17367e7ed50a16f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MUUY.exe
              • Path C:\Users\Admin\AppData\Local\Temp\MUUY.exe
              • Size 1.7MB
              • SHA256 9ebcbb5f7631c1b5647d9cbc5538b1e73a1905882d28aea1c8580a8843925fb3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              McMQ.exe
              • Path C:\Users\Admin\AppData\Local\Temp\McMQ.exe
              • Size 1.6MB
              • SHA256 b4d6e8bc275d6f9452a4afe1f78f898912a076a28da10987f84bd10ca5459748
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Mcwk.exe
              • Path C:\Users\Admin\AppData\Local\Temp\Mcwk.exe
              • Size 1.9MB
              • SHA256 3f5acafea32221b422907ff2536d0d6d085c0d3e4c39b8fd54fcdd2583b57614
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MsYw.exe
              • Path C:\Users\Admin\AppData\Local\Temp\MsYw.exe
              • Size 1.6MB
              • SHA256 69ada9b2f9f6f7095ed87b49f34874064ee0ccb88d1a0c34228985fe938ef353
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MuIs.ico
              • Path C:\Users\Admin\AppData\Local\Temp\MuIs.ico
              • Size 4KB
              • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OAMQ.exe
              • Path C:\Users\Admin\AppData\Local\Temp\OAMQ.exe
              • Size 2.2MB
              • SHA256 eedca8a8dba9211965812135037ba42382c8ef626c8120ae38da4a7423076959
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Okgg.exe
              • Path C:\Users\Admin\AppData\Local\Temp\Okgg.exe
              • Size 2.6MB
              • SHA256 0efd12f94b0238f698d7a5ff5ba9be37aa70ce5cf26cf88c1caef6ef102ed805
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Owog.exe
              • Path C:\Users\Admin\AppData\Local\Temp\Owog.exe
              • Size 2.3MB
              • SHA256 b3e758eddda35966e88de576ac6969f9132882b1e3097dfa0a6139c6ce4590e2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QEAo.exe
              • Path C:\Users\Admin\AppData\Local\Temp\QEAo.exe
              • Size 1.6MB
              • SHA256 32bf5d3c254eac39cf369ebf9d4ea58d2085e1e73ede7343a89c7fac7cb50c9d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QIAQ.exe
              • Path C:\Users\Admin\AppData\Local\Temp\QIAQ.exe
              • Size 1.6MB
              • SHA256 7cbb2afd84165e0279864740c41456330992ca2d88b90463168d1118c671672e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QQse.exe
              • Path C:\Users\Admin\AppData\Local\Temp\QQse.exe
              • Size 1.7MB
              • SHA256 ccb14f55c5a408ab6686875ad8a8995f2af70b958c50fa24f546ed649ce7319b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QUoM.exe
              • Path C:\Users\Admin\AppData\Local\Temp\QUoM.exe
              • Size 1.6MB
              • SHA256 22b838c558c622cc3f64b74b08134fa7dd482bc6ce3bcab36db6b165a9d15ca9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QwAQ.exe
              • Path C:\Users\Admin\AppData\Local\Temp\QwAQ.exe
              • Size 1.6MB
              • SHA256 0562bba71b6516fda9170de31ee3738db5b2bac8a772cd919900bf51adff3384
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QwQa.exe
              • Path C:\Users\Admin\AppData\Local\Temp\QwQa.exe
              • Size 2.8MB
              • SHA256 717a7686fedf7d3e006d2b7bcf9e1fafabe8e71c417f863c94b0caeed705921c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QwQm.exe
              • Path C:\Users\Admin\AppData\Local\Temp\QwQm.exe
              • Size 2.1MB
              • SHA256 f12e85f327611d0b95766e31866335df12dc35bfab50aa12675a85167580e3f1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SEkA.exe
              • Path C:\Users\Admin\AppData\Local\Temp\SEkA.exe
              • Size 1.9MB
              • SHA256 51e1824be15027232811b2b2e8ba2f9c5b511009ff8152680b358e025a02e15a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SUgA.exe
              • Path C:\Users\Admin\AppData\Local\Temp\SUgA.exe
              • Size 1.9MB
              • SHA256 baccd35c7291ee00da7aacbdbfe42e6a15063ee6efd34a0e111cb6b4f6882bf5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SYQu.exe
              • Path C:\Users\Admin\AppData\Local\Temp\SYQu.exe
              • Size 2.3MB
              • SHA256 3c0abd98f6a5794730ca5b025a1f1e37f233e9586c51607a96129a1e1b163113
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SkkU.ico
              • Path C:\Users\Admin\AppData\Local\Temp\SkkU.ico
              • Size 4KB
              • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SmUA.ico
              • Path C:\Users\Admin\AppData\Local\Temp\SmUA.ico
              • Size 4KB
              • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SsgS.exe
              • Path C:\Users\Admin\AppData\Local\Temp\SsgS.exe
              • Size 1.6MB
              • SHA256 f8169a9d7f597ac0bb5898ec5f8072794efe170a30f1ac1258337d0a8268f8cc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SwAA.exe
              • Path C:\Users\Admin\AppData\Local\Temp\SwAA.exe
              • Size 2.0MB
              • SHA256 545f42c15e759d4153a00956cae0548e1d900b6c3361b3d465f823ca7babccdf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SwwG.exe
              • Path C:\Users\Admin\AppData\Local\Temp\SwwG.exe
              • Size 1.6MB
              • SHA256 299dc1bb24d80e3768a8aa3cfde314d97708a39a402544b36f7a0ec39775e70b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              UAcY.exe
              • Path C:\Users\Admin\AppData\Local\Temp\UAcY.exe
              • Size 1.8MB
              • SHA256 504ab2447d2d505aaeddefe2f57faf7c8ac26010c509e3cda829311b73e1c346
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              UsAY.exe
              • Path C:\Users\Admin\AppData\Local\Temp\UsAY.exe
              • Size 2.8MB
              • SHA256 93cd05d890565d6810dba5bc87a9fffdd7a68d5d706e1cbd089f36ca95f06b61
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WIUS.exe
              • Path C:\Users\Admin\AppData\Local\Temp\WIUS.exe
              • Size 1.8MB
              • SHA256 a4c5ccee19b7eaaa5bad33a58ca86f9b52e5e92ca0d1c15d3f0fbcc49f4d8f0e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WUAm.exe
              • Path C:\Users\Admin\AppData\Local\Temp\WUAm.exe
              • Size 2.2MB
              • SHA256 f89a2e8bb32362534c634b41de9701856144d5f4ce323fbea7b819aa8d0fbab9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WYEU.exe
              • Path C:\Users\Admin\AppData\Local\Temp\WYEU.exe
              • Size 1.6MB
              • SHA256 3027a9360ec0a0772fb12ee1a4881282fb7cbaf1b3a708400c83f41905d22833
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WgMw.exe
              • Path C:\Users\Admin\AppData\Local\Temp\WgMw.exe
              • Size 1.6MB
              • SHA256 57b0975a43354f683891932106b6f471f7b1487b285ddcda68489849a904e286
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WkQU.ico
              • Path C:\Users\Admin\AppData\Local\Temp\WkQU.ico
              • Size 4KB
              • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WkwY.exe
              • Path C:\Users\Admin\AppData\Local\Temp\WkwY.exe
              • Size 2.0MB
              • SHA256 464e0d19bc298e8524e4b7e5ff241803da5c12655ed5360e8a054145f594667b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WsQY.ico
              • Path C:\Users\Admin\AppData\Local\Temp\WsQY.ico
              • Size 4KB
              • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              YYYg.exe
              • Path C:\Users\Admin\AppData\Local\Temp\YYYg.exe
              • Size 2.1MB
              • SHA256 0672c6946d7f524cb152064d0a4df010f4ab70a37fe40fad1007a6e1796017fc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              YgUi.exe
              • Path C:\Users\Admin\AppData\Local\Temp\YgUi.exe
              • Size 2.2MB
              • SHA256 094b412928f055e6ebc22cd1e891114e2ef0d581cdb41cf10c29a62cd458d734
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Yosi.exe
              • Path C:\Users\Admin\AppData\Local\Temp\Yosi.exe
              • Size 1.6MB
              • SHA256 7c66bd7ef472bfa0b6cdfa6866059c1d3fe943ea83183d7fd40cbff4ff16e44c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              accK.exe
              • Path C:\Users\Admin\AppData\Local\Temp\accK.exe
              • Size 2.5MB
              • SHA256 433044b6b6235c8c3d8c67b3c5361059038d1a0ba83db8ee890ca858a1a36486
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              akEI.exe
              • Path C:\Users\Admin\AppData\Local\Temp\akEI.exe
              • Size 1.6MB
              • SHA256 e8165bc3d8b7bc5ae5c298f2c33a5b7ed568f60e1f784d281b8bbad5af5acfe6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              aoAk.exe
              • Path C:\Users\Admin\AppData\Local\Temp\aoAk.exe
              • Size 1.9MB
              • SHA256 8a6e12a551c7df8a2c7526ce13f2169c562e2bbb6fb4535c4bed68a149409d54
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              asAK.exe
              • Path C:\Users\Admin\AppData\Local\Temp\asAK.exe
              • Size 1.9MB
              • SHA256 8e9fe4d4176669b6cec1925bfe492d1a23b50fea9605c07ea5b36e591a8e141e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              awMe.exe
              • Path C:\Users\Admin\AppData\Local\Temp\awMe.exe
              • Size 2.0MB
              • SHA256 06dbc2076ef6d416556a0098557e8c68f9dccd3cc650d04e0f038e11bfeb25ab
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cwEg.exe
              • Path C:\Users\Admin\AppData\Local\Temp\cwEg.exe
              • Size 2.0MB
              • SHA256 8ffa9cb969e39a2467d8c82792128a7446be4a8c23738dd0860a89d42b42e0c4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              eMko.exe
              • Path C:\Users\Admin\AppData\Local\Temp\eMko.exe
              • Size 1.6MB
              • SHA256 2d9a6c741fa8d3bab734640b33f0a646ec0778e4127973b0660c0b7391018fe1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              eYAs.exe
              • Path C:\Users\Admin\AppData\Local\Temp\eYAs.exe
              • Size 1.8MB
              • SHA256 2e23c3ae625428bbc192b6b76575af774748faf84374f501f0d71a4fd0863bbd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              eYYU.exe
              • Path C:\Users\Admin\AppData\Local\Temp\eYYU.exe
              • Size 1.6MB
              • SHA256 f109fd98c0fd645d5a0b5a664e239b3b7b8f9d6c5161788fbc982ebce57d7bb8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ekMc.exe
              • Path C:\Users\Admin\AppData\Local\Temp\ekMc.exe
              • Size 2.1MB
              • SHA256 b8b36fb437ac307bf213eac59a90429ffb5537efce332644735967fe29a29a5c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              esQi.exe
              • Path C:\Users\Admin\AppData\Local\Temp\esQi.exe
              • Size 2.0MB
              • SHA256 2827093bc3e265c3445b2a00ceb7ed10c289e8e3249a117aed0997d6e2c2d977
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ewow.exe
              • Path C:\Users\Admin\AppData\Local\Temp\ewow.exe
              • Size 2.0MB
              • SHA256 4139bcdba2d2d3de46ced77bca2ecac8df61ee6242e044e96eff6d34cf13cae9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              file.vbs
              • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
              • Size 19B
              • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
              • MD5 SHA1 SHA512
              Submit Download

              gAse.exe
              • Path C:\Users\Admin\AppData\Local\Temp\gAse.exe
              • Size 1.6MB
              • SHA256 0e282d4c161afeb9dae4e0ffa40a5b43b684df565c3b7a2db27418c090bf9b07
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              gEAO.exe
              • Path C:\Users\Admin\AppData\Local\Temp\gEAO.exe
              • Size 2.0MB
              • SHA256 699f21f58a2f3b2ba21e50cc218f9a6aea54e3f898fe1a0feb26a04c2b513cc2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              gEgW.exe
              • Path C:\Users\Admin\AppData\Local\Temp\gEgW.exe
              • Size 2.3MB
              • SHA256 03a9d65b8ed9e6bc964c957a7b98003231f48d52d7bb8ca2111db6bf3bebbc88
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              gcou.exe
              • Path C:\Users\Admin\AppData\Local\Temp\gcou.exe
              • Size 2.4MB
              • SHA256 057ca0d1dc7f53539ef3d808bb070a3f3aed955b312c2b8914d0d371f850d901
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              gkgw.exe
              • Path C:\Users\Admin\AppData\Local\Temp\gkgw.exe
              • Size 2.0MB
              • SHA256 62728ec85afe34cace27f979394a2a8eb12b4c34d35115f386f215b6711f12a6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              gksk.exe
              • Path C:\Users\Admin\AppData\Local\Temp\gksk.exe
              • Size 1.9MB
              • SHA256 4c7d9f6909dd35c1a0680446785bae3b9e4357c3beb1f31b7dac588495463007
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              iKUgkMws.bat
              • Path C:\Users\Admin\AppData\Local\Temp\iKUgkMws.bat
              • Size 112B
              • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              iUIm.exe
              • Path C:\Users\Admin\AppData\Local\Temp\iUIm.exe
              • Size 2.4MB
              • SHA256 8c3a65114ccc6c4fb2e56ab111d122e65050268d6eaf1005d663fe67b21b5d57
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              iwgm.exe
              • Path C:\Users\Admin\AppData\Local\Temp\iwgm.exe
              • Size 1.6MB
              • SHA256 aeb85829903c0710326fbb1bf3e8c64333bfab97107eb26c7cccda3744fea7b0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              kkka.exe
              • Path C:\Users\Admin\AppData\Local\Temp\kkka.exe
              • Size 1.6MB
              • SHA256 89c9878b957002ae58b814fd390b44b5067ebef9b5ab341328df53568da1d2c3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              kowO.exe
              • Path C:\Users\Admin\AppData\Local\Temp\kowO.exe
              • Size 1.7MB
              • SHA256 c5f64d825c4f85b5801a6a5bebc610837d359a9d71d941f0f382c9f25adca306
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              kssY.exe
              • Path C:\Users\Admin\AppData\Local\Temp\kssY.exe
              • Size 1.7MB
              • SHA256 183f946e33db48955ec33073a019dbca663c4c6dee9e20d4996d354f573a56a2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              mEge.exe
              • Path C:\Users\Admin\AppData\Local\Temp\mEge.exe
              • Size 2.2MB
              • SHA256 ce68468557b5f8c1a38c29c3ea5d35c85b4c5a24f1cbd5c1bb3e0af9bcef6241
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              mMcG.exe
              • Path C:\Users\Admin\AppData\Local\Temp\mMcG.exe
              • Size 2.0MB
              • SHA256 e366ec69f1e6ddd7909e730e9b5ad02d22b8e11629cf3ccf2453fc10d0b0a906
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              mMwi.exe
              • Path C:\Users\Admin\AppData\Local\Temp\mMwi.exe
              • Size 2.0MB
              • SHA256 a73495201d0df8b1d2bfa8761f6c0c7aa76541ef121a40b5dc9a8247ef6ae8b2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              mUck.exe
              • Path C:\Users\Admin\AppData\Local\Temp\mUck.exe
              • Size 2.0MB
              • SHA256 4fd0c9c065afba1628f4cfabe65f2e510314816b141ce2147e16ff3537b26038
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              mcsa.exe
              • Path C:\Users\Admin\AppData\Local\Temp\mcsa.exe
              • Size 2.1MB
              • SHA256 39f24faad3cc16da90d313f485bcd3ee54f5b8ad82c08b677cf6bd321a210856
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msQU.exe
              • Path C:\Users\Admin\AppData\Local\Temp\msQU.exe
              • Size 1.7MB
              • SHA256 59a5c69a732d6f13c380a1e73c72f00843dfcd6f84f57df8c473fd27bd75a268
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              mwQI.exe
              • Path C:\Users\Admin\AppData\Local\Temp\mwQI.exe
              • Size 2.1MB
              • SHA256 1b9f841b595384621355d1348e0c6e8b3d9340032cdd8cd62d75ee843a6949e8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              oIIW.exe
              • Path C:\Users\Admin\AppData\Local\Temp\oIIW.exe
              • Size 1.6MB
              • SHA256 14ae9dd16140d931acabd4ad94d38f6d01ee5fad381ec3242a8432e7e5e90e7b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              oIsU.exe
              • Path C:\Users\Admin\AppData\Local\Temp\oIsU.exe
              • Size 1.6MB
              • SHA256 dfa58ea83c8ac90e2db168a729aa59ae2ce38e3e8d38e4faaed03a2c828bbde5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              owEo.exe
              • Path C:\Users\Admin\AppData\Local\Temp\owEo.exe
              • Size 1.6MB
              • SHA256 4a1f3d1ab8d08851bc90a237c50ee1901043b198f6df4486907fcbda28ab8acf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              owgM.exe
              • Path C:\Users\Admin\AppData\Local\Temp\owgM.exe
              • Size 2.5MB
              • SHA256 964b53d86ac230c80ebb659bad7e5a71579bfb8e224c00ea9d157e25f623bc86
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qAcw.ico
              • Path C:\Users\Admin\AppData\Local\Temp\qAcw.ico
              • Size 4KB
              • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qEEE.exe
              • Path C:\Users\Admin\AppData\Local\Temp\qEEE.exe
              • Size 2.5MB
              • SHA256 2b05786d92cb08a7028830d6826b745b1c82bc57da6d3c65d508e4809be8f9e4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qMEQ.exe
              • Path C:\Users\Admin\AppData\Local\Temp\qMEQ.exe
              • Size 2.6MB
              • SHA256 17387750a288b24d38ff1a6bf5d05f4e8c07311382b48e5492be983fa2fc6667
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qUEa.exe
              • Path C:\Users\Admin\AppData\Local\Temp\qUEa.exe
              • Size 1.6MB
              • SHA256 52c1f80b47a8e8aa7371d781138b95fabb5797b8342e79bea673e17f9824a5ef
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qYAY.exe
              • Path C:\Users\Admin\AppData\Local\Temp\qYAY.exe
              • Size 1.9MB
              • SHA256 746df3972940a46c74acbadbf70c57d972090438a2a9e30a414f7ec8a3c8658e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qYMu.exe
              • Path C:\Users\Admin\AppData\Local\Temp\qYMu.exe
              • Size 1.6MB
              • SHA256 380d44b65d4b71cb237ac34440c757062cfc3ec54bc68a40d867bad5a3929feb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qgsQ.exe
              • Path C:\Users\Admin\AppData\Local\Temp\qgsQ.exe
              • Size 1.9MB
              • SHA256 be2da2bb1089cacd2f50ab1f093472ca3e9a896cb3de619e75cc84af32deafec
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              sEok.exe
              • Path C:\Users\Admin\AppData\Local\Temp\sEok.exe
              • Size 3.1MB
              • SHA256 02366d5206741d83b3a5fe24062cb671826d378893142106cbb11c3dcfae3f7e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              sYsO.exe
              • Path C:\Users\Admin\AppData\Local\Temp\sYsO.exe
              • Size 2.4MB
              • SHA256 91d0381d7a75b01335e96968acbf8108095de7b83a1e1ae950934ffbaa6e7215
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              soQG.exe
              • Path C:\Users\Admin\AppData\Local\Temp\soQG.exe
              • Size 1.6MB
              • SHA256 8966a0656590d4bf1ba86295bd57a6ab3a05d9288acaebeb6ab932d1ff155d9a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ukkA.exe
              • Path C:\Users\Admin\AppData\Local\Temp\ukkA.exe
              • Size 2.0MB
              • SHA256 6746814ff50c828a783fa497bef2ceef7d7cf861feae9994c21bd8c174d7ac2b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              usQe.exe
              • Path C:\Users\Admin\AppData\Local\Temp\usQe.exe
              • Size 1.6MB
              • SHA256 ff0f95bb03053c56c0404d478466b6dcedbd5dd923233c290c3c93b5df08d731
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              uwAU.exe
              • Path C:\Users\Admin\AppData\Local\Temp\uwAU.exe
              • Size 2.1MB
              • SHA256 20bd68b2494c11fd97d9c9e0b48fbcd5c2cec100217718d9e082412a5589dd94
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wIYy.exe
              • Path C:\Users\Admin\AppData\Local\Temp\wIYy.exe
              • Size 1.9MB
              • SHA256 13b0f27d05b586da9de7572756efffb6bba2c40800e3c3e21e1cf9b97385118b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wMMs.ico
              • Path C:\Users\Admin\AppData\Local\Temp\wMMs.ico
              • Size 4KB
              • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wQIs.exe
              • Path C:\Users\Admin\AppData\Local\Temp\wQIs.exe
              • Size 1.6MB
              • SHA256 cacfff142449b658fbf96153db87fddad0342237f3c054e3464c5a04a41534ec
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wgMA.exe
              • Path C:\Users\Admin\AppData\Local\Temp\wgMA.exe
              • Size 1.6MB
              • SHA256 42ecd7625c326b9c05243dcf07fd6a32ef0467660a6f64dba13dc73d0e426270
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wgYA.exe
              • Path C:\Users\Admin\AppData\Local\Temp\wgYA.exe
              • Size 2.0MB
              • SHA256 123d075387a3669ab24a2a4ff3d0d6db475090c132b5205908de42f684ef3355
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wggM.exe
              • Path C:\Users\Admin\AppData\Local\Temp\wggM.exe
              • Size 1.6MB
              • SHA256 4cc7746950872fca64da9b77a33894c68224a7daeb793aee2b929b0a583fb2c2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              yMkI.exe
              • Path C:\Users\Admin\AppData\Local\Temp\yMkI.exe
              • Size 2.2MB
              • SHA256 81f5dbd7be7befe135850697dc911ad46ed5e7f00b63faeb0208a99ec32fc9ba
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              yYcE.exe
              • Path C:\Users\Admin\AppData\Local\Temp\yYcE.exe
              • Size 2.2MB
              • SHA256 c0674c10d04a313fd1eb618fceed7fabc7a7645f023acbe20ac94307e3976209
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              oeYkoYoc.exe
              • Path C:\Users\Admin\sikAIIAw\oeYkoYoc.exe
              • Size 1.6MB
              • SHA256 4682919d026e19e0df88322b914ceebe3dc639fcc3da905bcfbabae16a89f808
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              oeYkoYoc.inf
              • Path C:\Users\Admin\sikAIIAw\oeYkoYoc.inf
              • Size 4B
              • SHA256 e402661470e54b3fed6dc1d0d0e749d5ed12bc1e3d02c9aea0f61080aeaac83f
              • MD5 SHA1 SHA512
              Submit Download

              oeYkoYoc.inf
              • Path C:\Users\Admin\sikAIIAw\oeYkoYoc.inf
              • Size 4B
              • SHA256 9d2e2128fab85891f64b7529508472e429b6a6136fa1d46c4aa585d1df804acc
              • MD5 SHA1 SHA512
              Submit Download

              oeYkoYoc.inf
              • Path C:\Users\Admin\sikAIIAw\oeYkoYoc.inf
              • Size 4B
              • SHA256 f0d0fc245cc5c4a28db579d3b5a7bc66d17a2d39472c4ca8a831d60599d180ef
              • MD5 SHA1 SHA512
              Submit Download

              oeYkoYoc.inf
              • Path C:\Users\Admin\sikAIIAw\oeYkoYoc.inf
              • Size 4B
              • SHA256 0c4dc4365d362b2bfe41aadbcc55425675e069eb9e87d6cdfce7e61a6f5858ab
              • MD5 SHA1 SHA512
              Submit Download

              oeYkoYoc.inf
              • Path C:\Users\Admin\sikAIIAw\oeYkoYoc.inf
              • Size 4B
              • SHA256 9ee4bab625f9b01d00df1ec53889c220ee0daa9ee6f1f53923441807bea55586
              • MD5 SHA1 SHA512
              Submit Download

              oeYkoYoc.inf
              • Path C:\Users\Admin\sikAIIAw\oeYkoYoc.inf
              • Size 4B
              • SHA256 cc541ad2e49693b9438f402dbb494a539b8bd20265c74e9d7e9a10cacdbc5ceb
              • MD5 SHA1 SHA512
              Submit Download

              memory/548-32-0x0000000000400000-0x0000000000590000-memory.dmp
              Download

              memory/548-1663-0x0000000000400000-0x0000000000590000-memory.dmp
              Download

              memory/1316-170-0x0000000000400000-0x0000000000591000-memory.dmp
              Download

              memory/1612-1658-0x0000000000400000-0x000000000058F000-memory.dmp
              Download

              memory/1944-158-0x0000000000400000-0x0000000000591000-memory.dmp
              Download

              memory/2108-34-0x0000000002200000-0x0000000002220000-memory.dmp
              Download

              memory/2108-0-0x0000000000400000-0x0000000000591000-memory.dmp
              Download

              memory/2108-1-0x0000000002200000-0x0000000002220000-memory.dmp
              Download

              memory/2108-33-0x0000000000400000-0x0000000000591000-memory.dmp
              Download

              memory/2464-187-0x0000000000400000-0x0000000000591000-memory.dmp
              Download

              memory/3532-113-0x0000000000400000-0x0000000000591000-memory.dmp
              Download

              memory/3560-1653-0x0000000000400000-0x0000000000590000-memory.dmp
              Download

              memory/3560-20-0x0000000000400000-0x0000000000590000-memory.dmp
              Download

              memory/4132-139-0x0000000000400000-0x0000000000591000-memory.dmp
              Download

              memory/4196-126-0x0000000000400000-0x0000000000591000-memory.dmp
              Download

              memory/4212-7-0x0000000000400000-0x000000000058F000-memory.dmp
              Download

              memory/4212-1643-0x0000000000400000-0x000000000058F000-memory.dmp
              Download

              memory/4792-17-0x0000000000400000-0x0000000000590000-memory.dmp
              Download

              memory/4792-1648-0x0000000000400000-0x0000000000590000-memory.dmp
              Download

              memory/4848-95-0x0000000000400000-0x0000000000591000-memory.dmp
              Download

              memory/4904-51-0x0000000000400000-0x0000000000591000-memory.dmp
              Download

              memory/5432-83-0x0000000000400000-0x0000000000591000-memory.dmp
              Download

              memory/5460-70-0x0000000000400000-0x0000000000591000-memory.dmp
              Download

              memory/5664-202-0x0000000000400000-0x0000000000591000-memory.dmp
              Download

              memory/5748-214-0x0000000000400000-0x0000000000591000-memory.dmp
              Download