Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/07/2026, 23:49

General

  • Target
    2026-07-26_83d23b0496dc62b7f72a42e945f6bd5a_elex_virlock.exe
  • Size 634KB
  • Sample260726-3vd37ashjc
  • SHA256 39a1da819a1095992f7fd69f757174403f367c95982d08fc01c68b8e19e2f310
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Renames multiple (85) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-26_83d23b0496dc62b7f72a42e945f6bd5a_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-26_83d23b0496dc62b7f72a42e945f6bd5a_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Users\Admin\nMEEgUYA\TAoosYwE.exe
      "C:\Users\Admin\nMEEgUYA\TAoosYwE.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:5308
    • C:\ProgramData\SyIcUssQ\bmkUcgQw.exe
      "C:\ProgramData\SyIcUssQ\bmkUcgQw.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:4292
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\setup.exe
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4916
      • C:\Users\Admin\AppData\Local\Temp\setup.exe
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3528
    • C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      2⤵
      • Modifies visibility of file extensions in Explorer
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:4104
    • C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:5100
    • C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      2⤵
      • UAC bypass
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:4908
  • C:\ProgramData\SyIcUssQ\bmkUcgQw.exe
    C:\ProgramData\SyIcUssQ\bmkUcgQw.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    PID:6088
  • C:\Users\Admin\nMEEgUYA\TAoosYwE.exe
    C:\Users\Admin\nMEEgUYA\TAoosYwE.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    PID:4700

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        bmkUcgQw.exe

        • Path C:\ProgramData\SyIcUssQ\bmkUcgQw.exe
        • Size 188KB
        • SHA256 771595b65294652fb98aed61126cd4fe728092911b0eab0c83a41475ead1f97e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bmkUcgQw.inf

        • Path C:\ProgramData\SyIcUssQ\bmkUcgQw.inf
        • Size 4B
        • SHA256 caa60a0e39900d6188351534004bb5d79ff44e48dcfe351dce4b4a46b2f73772
        • MD5 SHA1 SHA512

        AAYk.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AAYk.exe
        • Size 1.1MB
        • SHA256 a9bbf01ec51e357cd273937fc8cff5c1e894bb677717b82b2781ec2571017801
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AQgO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AQgO.exe
        • Size 318KB
        • SHA256 d54f750dda6cdf5d9841c3f1433ffe795076cb0bb59ef02666248161ff8735f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Ackc.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Ackc.exe
        • Size 209KB
        • SHA256 d3bc13869ffab143ffc0c492985ccfe9355b6e70c6b490421405488c1a3d89c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AswS.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AswS.exe
        • Size 1.4MB
        • SHA256 ad183c85587c06022bc75242199eaac0cb36eae54712cb10416832942fb76331
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CEEC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\CEEC.exe
        • Size 195KB
        • SHA256 16fc8adea1fb75eacef71a4d35d4eba02ddfed50b746c2dd2af5a89efc78f563
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CUAS.ico

        • Path C:\Users\Admin\AppData\Local\Temp\CUAS.ico
        • Size 4KB
        • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CYsg.exe

        • Path C:\Users\Admin\AppData\Local\Temp\CYsg.exe
        • Size 914KB
        • SHA256 e78e5c2da9a8aafb01d4a09bcbca9c5a4db6c00780a44bee0e0ef4d386f69b94
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CwYq.exe

        • Path C:\Users\Admin\AppData\Local\Temp\CwYq.exe
        • Size 629KB
        • SHA256 1087853598b0107ea2790a21ef246692e94774271a7aed50e354e20ec1805e6f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EcEk.exe

        • Path C:\Users\Admin\AppData\Local\Temp\EcEk.exe
        • Size 546KB
        • SHA256 7977670fc18b2e43e4fef13e3f4421fea0f96c9e2943322f80ab4bc3e770645d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Ekgq.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Ekgq.exe
        • Size 236KB
        • SHA256 5273d558534a5f92a3cb21e06ba930b7cf47003219494c6b983adea021b57d43
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GUAE.exe

        • Path C:\Users\Admin\AppData\Local\Temp\GUAE.exe
        • Size 601KB
        • SHA256 fdc897cc61a3f9ed73b783d40315a18fd2e9d3a30e5dfa9cb8de36c11a209f2a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GUcC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\GUcC.exe
        • Size 653KB
        • SHA256 f89d7b9a1ccfc021af8ed74c65c4cc80d5faf6d0a5b2f935b2861e26127e6604
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GcwI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\GcwI.exe
        • Size 196KB
        • SHA256 77971319ec2032dec5b404da3e1a436bc21176fc90f144e0e75126a3b7264040
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GwQS.exe

        • Path C:\Users\Admin\AppData\Local\Temp\GwQS.exe
        • Size 686KB
        • SHA256 1a50105c9a4a811b9546a0144bbd3030006ecd82da5f78608180c9f12f409f65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IQUE.exe

        • Path C:\Users\Admin\AppData\Local\Temp\IQUE.exe
        • Size 691KB
        • SHA256 19c8a5b2fd7673fde1aba4adc3645b5d741d0fde630a6d57f1e7a9b546c5b1fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IUkY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\IUkY.exe
        • Size 216KB
        • SHA256 f83d31a8e0d64244c130b4722ea185d99d6f653f66f2b81b8bd781ba745ccd97
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IoUC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\IoUC.exe
        • Size 805KB
        • SHA256 c8464e36a80dca2b56ddc3eb7eb756b1c73f0c45598b3b68f0220e57962e7f0c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IwIc.exe

        • Path C:\Users\Admin\AppData\Local\Temp\IwIc.exe
        • Size 442KB
        • SHA256 6fdf65147b353f4293f6db8bf20bf618543940e2c83cfd1874504335d3264fde
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KEoC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\KEoC.exe
        • Size 571KB
        • SHA256 e868abae77b66458a9840fbb9f10abf2863beeaf23fb71b885c64d5bef345aa0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Kccc.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Kccc.exe
        • Size 461KB
        • SHA256 d65ab39cb2c0777f5f7d42de83146da9c1a42774ec755964a2e58ccb4395f952
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KkEM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\KkEM.exe
        • Size 501KB
        • SHA256 d9fa7c0d7ce16692f2fa0d38360b8dd6cb40c9bfb90ec7ab8bee7d543dbeb65c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KwYO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\KwYO.exe
        • Size 702KB
        • SHA256 3a2bc03714f0c7f77be0c5bf5dabe4819cf1be565c59e7998549da225b34962a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OcQm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\OcQm.exe
        • Size 198KB
        • SHA256 f95fab6b74ec9bd133e591020eee91be6b7358bb6ea35c60e35dbb16eea6e425
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OoQE.exe

        • Path C:\Users\Admin\AppData\Local\Temp\OoQE.exe
        • Size 222KB
        • SHA256 8db88a8b6fdc82da4d894bfdc277a9d386dc851ecfeeeadada3daecf6a1b1953
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QAEe.exe

        • Path C:\Users\Admin\AppData\Local\Temp\QAEe.exe
        • Size 370KB
        • SHA256 716dbff44d96bf49fda24e6e8febda1618a575b3c4eeef46799a1ab8eaadb1e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QAUw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\QAUw.exe
        • Size 224KB
        • SHA256 ce03704ff12ce3799cf8e3d6009b1d6efff45aa169c245835e496c3f81345391
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Qkwq.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Qkwq.exe
        • Size 206KB
        • SHA256 5d86aa4df9a691bd203deeca45fd83aad9f909a668618a37f635ec25d6fb056e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QsUg.exe

        • Path C:\Users\Admin\AppData\Local\Temp\QsUg.exe
        • Size 720KB
        • SHA256 60327d2c2dbe90afd2d1c5d2700a1de2aae00b1d4d716fa2fb4439d38cba3d3f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SAUo.exe

        • Path C:\Users\Admin\AppData\Local\Temp\SAUo.exe
        • Size 647KB
        • SHA256 21ebcdace615c54721d78c4edb7d7c388c3098646f802e5b2fbf6de563f55f14
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SgwU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\SgwU.exe
        • Size 611KB
        • SHA256 db1dec892713bb3a4b39d3e55526d3111f276023a96a7acf418d7e182ee6f431
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UAgU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UAgU.exe
        • Size 193KB
        • SHA256 a0ec4b5507d817d6ba836cd88fcfd1e764a6f04ed05af5ef9fe86514665bb117
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UQIi.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UQIi.exe
        • Size 417KB
        • SHA256 f8581651ef35fa795bebd4f5294a50facb7cce75e17462cb8d9ca10df51f8a1c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UQcy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UQcy.exe
        • Size 733KB
        • SHA256 4a783155348613624d4a086ea17159209ac69dcf9546e0dbbaf253965a41d98b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UgAg.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UgAg.exe
        • Size 528KB
        • SHA256 5f3e6a44797c56a648eb298e838b547c4ab9b913fbc67e2be0f27c823f11c1e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UgUu.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UgUu.exe
        • Size 192KB
        • SHA256 c9e00277d93ee5d46b626cb0d286ac1c40fdb9951f7ff9d6aeeaca97cdcb7027
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UsQI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UsQI.exe
        • Size 623KB
        • SHA256 beffc8d187c7f365e1147c01a2a3307619c9dd346f5a5a265659ba5d843945bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WMEu.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WMEu.exe
        • Size 633KB
        • SHA256 756cb9a476d911eb97d7f701c128624f982286d8f8fb2d0d9c4311062a4a02e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WMgC.ico

        • Path C:\Users\Admin\AppData\Local\Temp\WMgC.ico
        • Size 4KB
        • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WYcw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WYcw.exe
        • Size 887KB
        • SHA256 6ff9c3ece19551e4bf469e773adfd855dae06f6851430fa2fdd67e38c9412775
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WYwO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WYwO.exe
        • Size 210KB
        • SHA256 8797c54e8392671831055b4648bef17ad855cd452a0a0764a79e180f96425198
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WwcO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WwcO.exe
        • Size 752KB
        • SHA256 fa64b5cc4bd3627b96cdf4f78479c94d10f5e694426d4669bc5b19aaa614be8a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YEEa.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YEEa.exe
        • Size 185KB
        • SHA256 99a1b8c16d2b72ad04812237233d52ec7f67aeeb9c70200fb51d8e8144b1ff76
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YQUa.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YQUa.exe
        • Size 227KB
        • SHA256 a19a302d1ccaa108275f44d730179b8a021f5e9d8b7cf10534e2cb11e9a0528c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YkkM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YkkM.exe
        • Size 223KB
        • SHA256 2d14fa962e8cc2150767fc7c435966b27aed5485f2319d3d9e0f551037452851
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aEEY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\aEEY.exe
        • Size 479KB
        • SHA256 cd716f6540a8e96469a741b2dcc7341a1c852bc07c4ff1d966c8d70bb6ce2ac3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        akYc.exe

        • Path C:\Users\Admin\AppData\Local\Temp\akYc.exe
        • Size 221KB
        • SHA256 6997742357dcb73ccc7218531cc51e0f7ff7efe0b0dce033f3eda4799fb195d4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cEMM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\cEMM.exe
        • Size 189KB
        • SHA256 4a001a0d64b2ec9b983bafc11374dc88b042cb1ce12386dd61660ccab1ebddcd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cIcc.exe

        • Path C:\Users\Admin\AppData\Local\Temp\cIcc.exe
        • Size 468KB
        • SHA256 83780a76cbc08707a1f48b354b1fc4c98c808f9ed71947cdf71d00e581a64d6b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cYkO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\cYkO.exe
        • Size 580KB
        • SHA256 e4788df206bd654a9e64971ded1897857b3bdc930eb615a2ee20b38d11d522f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        csge.exe

        • Path C:\Users\Admin\AppData\Local\Temp\csge.exe
        • Size 209KB
        • SHA256 4bb9e3d96339a00935c481603c14b24d854e1e4ab5e6ffc7db430daa70166790
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cssq.exe

        • Path C:\Users\Admin\AppData\Local\Temp\cssq.exe
        • Size 528KB
        • SHA256 753f534d3ace310f3bfd3f25cd408ee776418180a951f5bc2e3e67f3d0a1ecd5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        eEMi.exe

        • Path C:\Users\Admin\AppData\Local\Temp\eEMi.exe
        • Size 1.7MB
        • SHA256 652fb9fb2b0e4a1fe36e2c0fd46903e6d11e204778a9f42dfb914b6c52545c26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        eIEa.exe

        • Path C:\Users\Admin\AppData\Local\Temp\eIEa.exe
        • Size 640KB
        • SHA256 93a97632c6b1768e3d63f09e66ffa3689bb17336654bb3c6540f761e88c29c93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        eQws.exe

        • Path C:\Users\Admin\AppData\Local\Temp\eQws.exe
        • Size 469KB
        • SHA256 c8d477b5f7bd1acdff97ac9ce075fe14cd757be9760a2aafc95e3cd7082d1018
        • MD5 SHA1 SHA512 SSDEEP TLSH

        eYsG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\eYsG.exe
        • Size 206KB
        • SHA256 a928e9c27de534cf533bbca9896161ed330c7f0162cdf4679cf3309b9b8866b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ekAQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ekAQ.exe
        • Size 808KB
        • SHA256 3b8b011e449aee7f679235f6462ffb2d1b38e226be27775741c8ae27be3e3356
        • MD5 SHA1 SHA512 SSDEEP TLSH

        esgQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\esgQ.exe
        • Size 196KB
        • SHA256 cf7021768c6704c921ebd5c860da264d579eb2e1cd56baae7bc18196e6973a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ewAU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ewAU.exe
        • Size 192KB
        • SHA256 ba46c6e904cb2ea9f723a3a428fb6b38ac26f3cb462337f98ac866f2679cf760
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ewMQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ewMQ.exe
        • Size 713KB
        • SHA256 c4829b23a68bf7979371254d1336fce2e4be1a1bd5d34d609a038cc3bb90358e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ewgs.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ewgs.exe
        • Size 195KB
        • SHA256 690574bc8743bb5af9fce6d20ada87a9b3031512366c2451d68fc0997d403078
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gEQw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gEQw.exe
        • Size 306KB
        • SHA256 8305047c0596d742365032b74e102531eb96945756aa300a8e864018a8015930
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gMsw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gMsw.exe
        • Size 853KB
        • SHA256 50870e47fcbd01c49293caadc196d8397aea22239763d0cd8bcdb5422fde3db9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gQcm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gQcm.exe
        • Size 2.1MB
        • SHA256 4acbb85c6a70a9f56a9356d2a4b252d6e3dedd17e3711adc7a1d2a549ad1c22e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gcYY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gcYY.exe
        • Size 340KB
        • SHA256 bcca2184dd983894413e2b65a21d38cfa65629b00977deec928fb98fcd8c3aab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gkQW.ico

        • Path C:\Users\Admin\AppData\Local\Temp\gkQW.ico
        • Size 4KB
        • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gwgy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gwgy.exe
        • Size 424KB
        • SHA256 f21589511439980d785a61a193d510b70f17f15b851d29875f3d1657411d250f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iYYY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\iYYY.exe
        • Size 1.3MB
        • SHA256 b1c2345c9d913b193c20b574d2db49d71dc6bf5aef69f39d5c3e4facaa87fcac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iYkM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\iYkM.exe
        • Size 202KB
        • SHA256 19e94ae06ea8ac8f05a1879d6e528fd78df31ab221b1a2e6b60577f8391c50e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iYok.exe

        • Path C:\Users\Admin\AppData\Local\Temp\iYok.exe
        • Size 185KB
        • SHA256 fb4e1bf03bd7d20de2b8ae4a35d29dd3db042e88cd42c47612ac8727a111849e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kEcY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kEcY.exe
        • Size 1.0MB
        • SHA256 3539e878727e0017bfc021249e89e1cc2ded35993fcfa43ab07f2a1467cee65b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kEsU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kEsU.exe
        • Size 793KB
        • SHA256 c814a0ef68a09a30789e1428e9f5022392b2c8c67a505fa7aa047fdc5fc5d565
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kQgK.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kQgK.exe
        • Size 1.0MB
        • SHA256 7a9329e8141e366aa2f3f64f8d76bc1d61a64befd9e644b80702362303412554
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kUgU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kUgU.exe
        • Size 207KB
        • SHA256 eab78659f31fab96acfe880b4bf82b323fbac939d5e942d51463939aa248ff83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kwIw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kwIw.exe
        • Size 203KB
        • SHA256 52a44c95b4a8cfbc472e715c07c20cc6f81fa96c141dd588a331225953eb2310
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kwUE.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kwUE.exe
        • Size 206KB
        • SHA256 b042d6e5c2768f71b88fd0dd76ec8d39b89657ec2b342010697504fc3f03dcd0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mAgq.ico

        • Path C:\Users\Admin\AppData\Local\Temp\mAgq.ico
        • Size 4KB
        • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mkAQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\mkAQ.exe
        • Size 494KB
        • SHA256 fe868a8be9181971325c424e0dff9a9b8abe9c1522b1ae69c724f9a97c90ce56
        • MD5 SHA1 SHA512 SSDEEP TLSH

        oMkU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\oMkU.exe
        • Size 1.4MB
        • SHA256 e71a3aa33b3ac3d9709ccd5f0b8a18d197938492870a1cce12119a0ec158db49
        • MD5 SHA1 SHA512 SSDEEP TLSH

        oYoy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\oYoy.exe
        • Size 645KB
        • SHA256 4ad1386f18d5bf5d2bf312a86d5e9cb97112686c3b9c5317d09194c688e9d55c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ocEs.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ocEs.exe
        • Size 321KB
        • SHA256 4e4bd43f6262db595efe82efcd463619c6d141bd15776436c2f63bd05783233b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qAgK.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qAgK.exe
        • Size 763KB
        • SHA256 c3f70584a3d136473a5968f8a9b159cf0a2e577666db7045ab1d2c7618f00899
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qIUy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qIUy.exe
        • Size 593KB
        • SHA256 4a95ebbd48362f33bcd9ba5916b9f0d9f57ad36726b55104195daf94f133316b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qoYe.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qoYe.exe
        • Size 367KB
        • SHA256 070ec8c94f32bff6130699ef590db93f4d3526668882222ec0144ee1dd07ebda
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qows.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qows.exe
        • Size 999KB
        • SHA256 842d30fa37041c918905f7ea2ea143f87a8a120fb35c639dd7bb5fdd18fc478d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sAcC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\sAcC.exe
        • Size 1.4MB
        • SHA256 ab9a24c498830c5fbc34994eebafea415ae1c051e971ef88462e860fca8486d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sIwI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\sIwI.exe
        • Size 1.2MB
        • SHA256 fe513e681eab225d6090ee5c2edc55003e2bcbf887fefea015478080c4505448
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sUwI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\sUwI.exe
        • Size 191KB
        • SHA256 057cd23a9c53b7e081ce17cc7153c673af2182003e048365542a39e01f46bb5d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        scwQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\scwQ.exe
        • Size 435KB
        • SHA256 d7354014fd9e1127354cfe88ef73ececed7d01ed4f68deb581337d963731a793
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setup.exe

        • Path C:\Users\Admin\AppData\Local\Temp\setup.exe
        • Size 453KB
        • SHA256 d2893c55259772b554cb887d3e2e1f9c67f5cd5abac2ab9f4720dec507cdd290
        • MD5 SHA1 SHA512 SSDEEP TLSH

        swoS.exe

        • Path C:\Users\Admin\AppData\Local\Temp\swoS.exe
        • Size 603KB
        • SHA256 de17d4d7c900f7ab24d3924e5f0553ce68671f190c818628ec7d55c4a2017d0d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uAoW.exe

        • Path C:\Users\Admin\AppData\Local\Temp\uAoW.exe
        • Size 189KB
        • SHA256 69bb071716968b109f661187b62151f62e5fbc97a53436412d885dbed695877e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uEUe.exe

        • Path C:\Users\Admin\AppData\Local\Temp\uEUe.exe
        • Size 1.3MB
        • SHA256 fc05abffaac70f404d667d60f6dba0996689d23c60d0a57d2ed3da54c3b77f46
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uYwk.ico

        • Path C:\Users\Admin\AppData\Local\Temp\uYwk.ico
        • Size 4KB
        • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ukgq.ico

        • Path C:\Users\Admin\AppData\Local\Temp\ukgq.ico
        • Size 4KB
        • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wQUA.exe

        • Path C:\Users\Admin\AppData\Local\Temp\wQUA.exe
        • Size 768KB
        • SHA256 bb577ef200e445a189ac80dabe06afeb6837e6b02c1ac9095920b61c872820cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wUUi.exe

        • Path C:\Users\Admin\AppData\Local\Temp\wUUi.exe
        • Size 802KB
        • SHA256 480cad8888dd45cb11f26ab0cf336700bf2c60d639e88b701ddf5573fc70354b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yAcI.ico

        • Path C:\Users\Admin\AppData\Local\Temp\yAcI.ico
        • Size 4KB
        • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yQEq.exe

        • Path C:\Users\Admin\AppData\Local\Temp\yQEq.exe
        • Size 702KB
        • SHA256 e093d2df9b71dd6cdd2dbdbcc3e568953b4e00c64bf743a42c166a409c593be3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yUwe.exe

        • Path C:\Users\Admin\AppData\Local\Temp\yUwe.exe
        • Size 187KB
        • SHA256 cc28fd1d19755b376ff9f82b1353828360633c79e4cdde95fb03a3c199a73f52
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yYIU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\yYIU.exe
        • Size 639KB
        • SHA256 5adc60a38425ac6da00d092ffb106aa96c5dc71d59b851575feea4b6df4cecdc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ywQA.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ywQA.exe
        • Size 532KB
        • SHA256 edaa27930131f3cfd3b5983f26adb3ec6b821ae3e837a12c14ba924b3ec813c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ywYQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ywYQ.exe
        • Size 599KB
        • SHA256 25259e7ae18f9fb3b536549b167b17e9824be01814504db80b9538bd34d0306e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ywcK.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ywcK.exe
        • Size 195KB
        • SHA256 9005f0b4909227759795991ba65dbcefe67ba7b2a5d257f108d0c1f3a82b2167
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ywwM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ywwM.exe
        • Size 884KB
        • SHA256 7974e139c27327e316e8abd8478518095d628533482bee472bffd99776960817
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TAoosYwE.exe

        • Path C:\Users\Admin\nMEEgUYA\TAoosYwE.exe
        • Size 187KB
        • SHA256 bc7679680eeaba132a37a47c86e29c8829fab4193c89d9735b858bab297e2102
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TAoosYwE.inf

        • Path C:\Users\Admin\nMEEgUYA\TAoosYwE.inf
        • Size 4B
        • SHA256 372cf6c3064a1f9ead5bfbb5e2676d75be4aba207e8cb53aee54329b7c8709a9
        • MD5 SHA1 SHA512

        TAoosYwE.inf

        • Path C:\Users\Admin\nMEEgUYA\TAoosYwE.inf
        • Size 4B
        • SHA256 86f75a1c343cbec17e5cea9cbad259f4d89ef097ba094465bc83d12324e4a191
        • MD5 SHA1 SHA512

        TAoosYwE.inf

        • Path C:\Users\Admin\nMEEgUYA\TAoosYwE.inf
        • Size 4B
        • SHA256 f5f5669bc704764d7682eacddc6b9e7fa42f9420f413260a29fcccc75702e621
        • MD5 SHA1 SHA512

        TAoosYwE.inf

        • Path C:\Users\Admin\nMEEgUYA\TAoosYwE.inf
        • Size 4B
        • SHA256 581754807c0dc50b8db98d31d65379b09ea81911e4f7f2de2b48964d58272f91
        • MD5 SHA1 SHA512

        TAoosYwE.inf

        • Path C:\Users\Admin\nMEEgUYA\TAoosYwE.inf
        • Size 4B
        • SHA256 83b9831b60a65d93a6499d9c043b3e7cbae1f65b2425f370fcd3293f393c2e11
        • MD5 SHA1 SHA512

        TAoosYwE.inf

        • Path C:\Users\Admin\nMEEgUYA\TAoosYwE.inf
        • Size 4B
        • SHA256 c97f2cf8076f7458e15cea22910da782cc6bdb51f049a44705dae0b3dadc6ffb
        • MD5 SHA1 SHA512

        TAoosYwE.inf

        • Path C:\Users\Admin\nMEEgUYA\TAoosYwE.inf
        • Size 4B
        • SHA256 7daaa752d00783a35d41f184e2a68abe5da601995f0f873391732fad5009c5a2
        • MD5 SHA1 SHA512

        TAoosYwE.inf

        • Path C:\Users\Admin\nMEEgUYA\TAoosYwE.inf
        • Size 4B
        • SHA256 68ca8b761c5f8deb6c93f0c323f9e867baa47c896224732b19461bf82d2e3a8d
        • MD5 SHA1 SHA512

        TAoosYwE.inf

        • Path C:\Users\Admin\nMEEgUYA\TAoosYwE.inf
        • Size 4B
        • SHA256 4f0a2e1354aaee43546162bfb76a089814c6471f2f8928b365ec9a4d1366bd12
        • MD5 SHA1 SHA512

        TAoosYwE.inf

        • Path C:\Users\Admin\nMEEgUYA\TAoosYwE.inf
        • Size 4B
        • SHA256 fef4c7660c9a538f25403e17f4e02d7a1d51822da073fc096a4b4aa1a5a4ae5c
        • MD5 SHA1 SHA512

        TAoosYwE.inf

        • Path C:\Users\Admin\nMEEgUYA\TAoosYwE.inf
        • Size 4B
        • SHA256 ea7c063ac532f519974ce0b44d49debed37c4feb0dc935f5ebea49dc2f991b42
        • MD5 SHA1 SHA512

        TAoosYwE.inf

        • Path C:\Users\Admin\nMEEgUYA\TAoosYwE.inf
        • Size 4B
        • SHA256 1f50b640b0dffbb2e8d04642af64359366e8d55acae784bb767830079c3f7050
        • MD5 SHA1 SHA512

        TAoosYwE.inf

        • Path C:\Users\Admin\nMEEgUYA\TAoosYwE.inf
        • Size 4B
        • SHA256 7b0ce3818d6b154be3a39be74112e61899bb547087a6d2f4d12c3973f4f688c7
        • MD5 SHA1 SHA512

        TAoosYwE.inf

        • Path C:\Users\Admin\nMEEgUYA\TAoosYwE.inf
        • Size 4B
        • SHA256 f100c160e44ec91e3c4e711d96ae191fb11eb8c8974e93a5465a1d97b2bee22c
        • MD5 SHA1 SHA512

        memory/2164-0-0x0000000000400000-0x00000000004A1000-memory.dmp

        memory/2164-19-0x0000000000400000-0x00000000004A1000-memory.dmp

        memory/4292-17-0x0000000000400000-0x0000000000430000-memory.dmp

        memory/4292-1490-0x0000000000400000-0x0000000000430000-memory.dmp

        memory/4700-1500-0x0000000000400000-0x0000000000430000-memory.dmp

        memory/5308-9-0x0000000000400000-0x0000000000430000-memory.dmp

        memory/5308-1485-0x0000000000400000-0x0000000000430000-memory.dmp

        memory/6088-1495-0x0000000000400000-0x0000000000430000-memory.dmp