nabucur | d489e3bcf9ceaa726db7ef4221e13779e587b80e649e23c50ba657d9a7be67bc

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
Size 1.6MB
Sample260727-cezrvathnd
SHA256 d489e3bcf9ceaa726db7ef4221e13779e587b80e649e23c50ba657d9a7be67bc
MD5 f9438859bee7ff58d8830aa596adce78
SHA1 aa76ebabc419dce95f9a5beae523023798b2cee6
SHA512 b60c3ff007f0e2ffb8ea30328bbdf0a589586dd58f689823f2260054b1c6c23e609bbfbfea7b6b2c7af699ed660a0702ba16749e504f2d2ca63b9c505869a4fd
SSDEEP 12288:BXILsSLnOHUHTCT8r3xrOAVg6A8JxfsEYics4y2+FlZvHRsCxaGeIhJQG3iAI5Mr:6wr63n0EYi72cHWCxaGeYJQsip5MtV
TLSH
T1A2759A8153C28BAF58D781EA450775E026BE5E85C119DD37E0BA09EF4C30B37F52A98E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan

Malware Config

Signatures

Family: Nabucur
Nabucur is a ransomware first seen in 2015.
ransomware nabucur

Modifies visibility of file extensions in Explorer 2 TTPs 19 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

UAC bypass 3 TTPs 19 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Renames multiple (80) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 5 IoCs

pid	Process
3332	SOcAcEYQ.exe
4188	pUQYIoMg.exe
2856	usscoYQw.exe
5348	SOcAcEYQ.exe
1508	pUQYIoMg.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pUQYIoMg.exe = "C:\\ProgramData\\XKYkgosk\\pUQYIoMg.exe"	pUQYIoMg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\SOcAcEYQ.exe = "C:\\Users\\Admin\\UEUcoIwg\\SOcAcEYQ.exe"	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pUQYIoMg.exe = "C:\\ProgramData\\XKYkgosk\\pUQYIoMg.exe"	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\SOcAcEYQ.exe = "C:\\Users\\Admin\\UEUcoIwg\\SOcAcEYQ.exe"	SOcAcEYQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pUQYIoMg.exe = "C:\\ProgramData\\XKYkgosk\\pUQYIoMg.exe"	pUQYIoMg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pUQYIoMg.exe = "C:\\ProgramData\\XKYkgosk\\pUQYIoMg.exe"	usscoYQw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\SOcAcEYQ.exe = "C:\\Users\\Admin\\UEUcoIwg\\SOcAcEYQ.exe"	SOcAcEYQ.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\UEUcoIwg	usscoYQw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\UEUcoIwg\SOcAcEYQ	usscoYQw.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 19 IoCs

execution

Visual Basic

T1059.005

pid	Process
1888	cscript.exe
4208	cscript.exe
4868	cscript.exe
1288	cscript.exe
5116	cscript.exe
5912	cscript.exe
4692	cscript.exe
1988	cscript.exe
4760	cscript.exe
4252	cscript.exe
2192	cscript.exe
6092	cscript.exe
3456	cscript.exe
5128	cscript.exe
5712	cscript.exe
5548	cscript.exe
1112	cscript.exe
3876	cscript.exe
1804	cscript.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\sAAs.exe	SOcAcEYQ.exe
File created	C:\Windows\yAQw.exe	SOcAcEYQ.exe
File created	C:\Windows\YkkI.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\iYAK.exe	SOcAcEYQ.exe
File created	C:\Windows\SUws.exe	SOcAcEYQ.exe
File created	C:\Windows\gMYS.exe	SOcAcEYQ.exe
File created	C:\Windows\IIIW.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\eGUc.ico	SOcAcEYQ.exe
File created	C:\Windows\iYAK.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\qoYk.ico	SOcAcEYQ.exe
File created	C:\Windows\isEa.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\UYcm.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\QOsM.ico	SOcAcEYQ.exe
File opened for modification	C:\Windows\MKYc.ico	SOcAcEYQ.exe
File opened for modification	C:\Windows\QcIg.ico	SOcAcEYQ.exe
File opened for modification	C:\Windows\SYoC.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\KsIK.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\sIIk.exe	SOcAcEYQ.exe
File created	C:\Windows\oAcW.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\UKwQ.ico	SOcAcEYQ.exe
File created	C:\Windows\ugkW.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\MUsk.ico	SOcAcEYQ.exe
File created	C:\Windows\aAMg.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\qcQG.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\cYQo.ico	SOcAcEYQ.exe
File opened for modification	C:\Windows\kYQE.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\AQUw.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\oUAc.ico	SOcAcEYQ.exe
File opened for modification	C:\Windows\yAQw.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\QsMO.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\ygAq.exe	SOcAcEYQ.exe
File created	C:\Windows\qcQG.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\iEYQ.ico	SOcAcEYQ.exe
File opened for modification	C:\Windows\wQsS.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\SIgc.exe	SOcAcEYQ.exe
File created	C:\Windows\QsMO.exe	SOcAcEYQ.exe
File created	C:\Windows\sIgU.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\yAAc.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\yMgM.ico	SOcAcEYQ.exe
File created	C:\Windows\qEAG.exe	SOcAcEYQ.exe
File created	C:\Windows\cYsc.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\sCUc.ico	SOcAcEYQ.exe
File opened for modification	C:\Windows\QkYk.ico	SOcAcEYQ.exe
File created	C:\Windows\UEEe.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\IIIW.exe	SOcAcEYQ.exe
File created	C:\Windows\YYAi.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\UEEe.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\Ccgm.exe	SOcAcEYQ.exe
File created	C:\Windows\Wgow.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\WSAI.ico	SOcAcEYQ.exe
File opened for modification	C:\Windows\AwYS.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\SIUY.exe	SOcAcEYQ.exe
File created	C:\Windows\WUwk.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\AswY.ico	SOcAcEYQ.exe
File created	C:\Windows\ckUQ.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\esQw.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\SsoM.exe	SOcAcEYQ.exe
File created	C:\Windows\wQsU.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\cAsw.ico	SOcAcEYQ.exe
File created	C:\Windows\GwAg.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\aEMA.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\waYs.ico	SOcAcEYQ.exe
File opened for modification	C:\Windows\mwsg.exe	SOcAcEYQ.exe
File opened for modification	C:\Windows\wIoG.exe	SOcAcEYQ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 38 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4280	cmd.exe
1232	cmd.exe
2348	cmd.exe
2080	cmd.exe
1228	cmd.exe
6060	cmd.exe
4248	cmd.exe
5956	cmd.exe
3172	cmd.exe
692	cmd.exe
4948	cmd.exe
3000	cmd.exe
2960	cmd.exe
1328	cmd.exe
3348	cmd.exe
4884	cmd.exe
4348	cmd.exe
300	cmd.exe
4716	cmd.exe
3560	cmd.exe
1400	cmd.exe
120	cmd.exe
4508	cmd.exe
5500	cmd.exe
2680	cmd.exe
1340	cmd.exe
5052	cmd.exe
5444	cmd.exe
1552	cmd.exe
2448	cmd.exe
5796	cmd.exe
4112	cmd.exe
2800	cmd.exe
6020	cmd.exe
2592	cmd.exe
4664	cmd.exe
1120	cmd.exe
2676	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pUQYIoMg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SOcAcEYQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe

Modifies registry key 1 TTPs 57 IoCs

Modify Registry

T1112

pid	Process
2308	reg.exe
4068	reg.exe
4984	reg.exe
4976	reg.exe
5300	reg.exe
3816	reg.exe
1648	reg.exe
4948	reg.exe
1424	reg.exe
1864	reg.exe
2908	reg.exe
2360	reg.exe
3964	reg.exe
2172	reg.exe
5444	reg.exe
4164	reg.exe
2672	reg.exe
5616	reg.exe
2560	reg.exe
6116	reg.exe
4580	reg.exe
3112	reg.exe
5608	reg.exe
3584	reg.exe
2608	reg.exe
2472	reg.exe
2372	reg.exe
2636	reg.exe
1388	reg.exe
5356	reg.exe
1504	reg.exe
2100	reg.exe
4204	reg.exe
4068	reg.exe
4244	reg.exe
3692	reg.exe
4852	reg.exe
4984	reg.exe
3680	reg.exe
5272	reg.exe
3848	reg.exe
5692	reg.exe
2940	reg.exe
1808	reg.exe
5464	reg.exe
1228	reg.exe
5588	reg.exe
5724	reg.exe
1000	reg.exe
3128	reg.exe
2960	reg.exe
5476	reg.exe
5464	reg.exe
1832	reg.exe
1156	reg.exe
3216	reg.exe
248	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2260	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
2260	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
2260	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
2260	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
4824	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
4824	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
4824	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
4824	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
3476	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
3476	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
3476	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
3476	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
4180	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
4180	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
4180	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
4180	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
8	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
8	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
8	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
8	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
1296	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
1296	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
1296	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
1296	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
2140	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
2140	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
2140	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
2140	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
6036	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
6036	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
6036	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
6036	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
5564	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
5564	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
5564	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
5564	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
1080	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
1080	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
1080	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
1080	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
1116	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
1116	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
1116	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
1116	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
4320	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
4320	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
4320	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
4320	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
4712	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
4712	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
4712	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
4712	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
2732	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
2732	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
2732	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
2732	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
2308	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
2308	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
2308	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
2308	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
5132	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
5132	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
5132	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
5132	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe
5348	SOcAcEYQ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 3332	2260	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	90
PID 2260 wrote to memory of 4188	2260	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	91
PID 2260 wrote to memory of 5796	2260	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	96
PID 2260 wrote to memory of 2172	2260	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	98
PID 2260 wrote to memory of 3816	2260	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	99
PID 2260 wrote to memory of 1808	2260	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	100
PID 2260 wrote to memory of 4112	2260	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	101
PID 5796 wrote to memory of 4824	5796	cmd.exe	106
PID 4112 wrote to memory of 1112	4112	cmd.exe	263
PID 4824 wrote to memory of 4248	4824	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	109
PID 4248 wrote to memory of 3476	4248	cmd.exe	111
PID 4824 wrote to memory of 4984	4824	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	258
PID 4824 wrote to memory of 3680	4824	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	113
PID 4824 wrote to memory of 4580	4824	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	114
PID 4824 wrote to memory of 1120	4824	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	115
PID 3476 wrote to memory of 2676	3476	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	120
PID 1120 wrote to memory of 1988	1120	cmd.exe	121
PID 3476 wrote to memory of 1388	3476	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	199
PID 3476 wrote to memory of 4204	3476	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	200
PID 3476 wrote to memory of 5464	3476	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	195
PID 3476 wrote to memory of 1340	3476	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	126
PID 2676 wrote to memory of 4180	2676	cmd.exe	131
PID 1340 wrote to memory of 4760	1340	cmd.exe	132
PID 4180 wrote to memory of 3560	4180	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	133
PID 3560 wrote to memory of 8	3560	cmd.exe	135
PID 4180 wrote to memory of 5444	4180	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	211
PID 4180 wrote to memory of 1648	4180	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	137
PID 4180 wrote to memory of 5356	4180	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	138
PID 4180 wrote to memory of 3348	4180	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	139
PID 3348 wrote to memory of 5116	3348	cmd.exe	144
PID 8 wrote to memory of 4280	8	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	145
PID 4280 wrote to memory of 1296	4280	cmd.exe	147
PID 8 wrote to memory of 5272	8	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	148
PID 8 wrote to memory of 5476	8	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	149
PID 8 wrote to memory of 2960	8	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	307
PID 8 wrote to memory of 5956	8	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	151
PID 1296 wrote to memory of 4884	1296	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	156
PID 4884 wrote to memory of 2140	4884	cmd.exe	158
PID 5956 wrote to memory of 3456	5956	cmd.exe	159
PID 1296 wrote to memory of 3112	1296	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	160
PID 1296 wrote to memory of 4068	1296	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	233
PID 1296 wrote to memory of 3128	1296	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	162
PID 1296 wrote to memory of 3172	1296	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	163
PID 2140 wrote to memory of 5052	2140	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	168
PID 3172 wrote to memory of 3876	3172	cmd.exe	170
PID 5052 wrote to memory of 6036	5052	cmd.exe	171
PID 2140 wrote to memory of 4164	2140	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	313
PID 2140 wrote to memory of 5724	2140	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	309
PID 2140 wrote to memory of 4948	2140	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	241
PID 2140 wrote to memory of 120	2140	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	175
PID 120 wrote to memory of 4252	120	cmd.exe	180
PID 6036 wrote to memory of 1232	6036	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	181
PID 1232 wrote to memory of 5564	1232	cmd.exe	183
PID 6036 wrote to memory of 5608	6036	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	184
PID 6036 wrote to memory of 2472	6036	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	185
PID 6036 wrote to memory of 2308	6036	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	255
PID 6036 wrote to memory of 1400	6036	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	187
PID 5564 wrote to memory of 4508	5564	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	192
PID 1400 wrote to memory of 5128	1400	cmd.exe	193
PID 5564 wrote to memory of 5464	5564	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	195
PID 5564 wrote to memory of 3584	5564	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	196
PID 5564 wrote to memory of 5300	5564	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	197
PID 5564 wrote to memory of 4348	5564	2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe	198
PID 4508 wrote to memory of 1080	4508	cmd.exe	203

C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Users\Admin\UEUcoIwg\SOcAcEYQ.exe
  "C:\Users\Admin\UEUcoIwg\SOcAcEYQ.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3332
- C:\ProgramData\XKYkgosk\pUQYIoMg.exe
  "C:\ProgramData\XKYkgosk\pUQYIoMg.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5796
- - C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3476
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock"
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock"
        8⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock"
        10⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock
        11⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock"
        12⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock
        13⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock"
        14⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock
        15⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:6036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock"
        16⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock
        17⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock"
        18⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock
        19⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock"
        20⤵
        Executes a command shell one-liner
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock
        21⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock"
        22⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock
        23⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock"
        24⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock
        25⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock"
        26⤵
        Executes a command shell one-liner
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock
        27⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock"
        28⤵
        Executes a command shell one-liner
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock
        29⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock"
        30⤵
        Executes a command shell one-liner
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock
        31⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock"
        32⤵
        Executes a command shell one-liner
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock
        33⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock"
        34⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock
        35⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock"
        36⤵
        Executes a command shell one-liner
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock
        37⤵
        System Location Discovery: System Language Discovery
        
        PID:5540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock"
        38⤵
        Executes a command shell one-liner
        
        PID:1328
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        39⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        38⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3964
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        38⤵
        Modifies registry key
        
        PID:6116
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        38⤵
        UAC bypass
        Modifies registry key
        
        PID:2560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fEMYsUow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe""
        38⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4716
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        39⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1288
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        36⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:2940
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        36⤵
        Modifies registry key
        
        PID:2360
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        37⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        36⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\deQYgkEc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe""
        36⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        37⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:6092
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        34⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2908
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        34⤵
        Modifies registry key
        
        PID:5588
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        34⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CaAkossI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe""
        34⤵
        Executes a command shell one-liner
        
        PID:4664
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        35⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:2192
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        32⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3216
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        32⤵
        Modifies registry key
        
        PID:4852
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        32⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AGoUYYIs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe""
        32⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1228
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        33⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4868
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        30⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4976
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        30⤵
        Modifies registry key
        
        PID:5616
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        30⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oKYAYUoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe""
        30⤵
        Executes a command shell one-liner
        
        PID:300
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        31⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:5548
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        28⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1864
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        28⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1156
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        28⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4984
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        29⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cccYIEcQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe""
        28⤵
        Executes a command shell one-liner
        
        PID:2592
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        29⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4692
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        26⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1832
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        26⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1504
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        26⤵
        UAC bypass
        Modifies registry key
        
        PID:1000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\buQIkMYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe""
        26⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2080
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        27⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5912
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        24⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3692
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        24⤵
        Modifies registry key
        
        PID:2608
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        24⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pekAYMYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe""
        24⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2800
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        25⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:4208
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        22⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4244
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        22⤵
        Modifies registry key
        
        PID:3848
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        22⤵
        UAC bypass
        Modifies registry key
        
        PID:1424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PqAkIgAE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe""
        22⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:692
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        23⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1888
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        20⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1228
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        20⤵
        Modifies registry key
        
        PID:2372
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        20⤵
        UAC bypass
        Modifies registry key
        
        PID:2672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YsQQcMMU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe""
        20⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5444
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        21⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:1804
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        18⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5464
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        19⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        18⤵
        Modifies registry key
        
        PID:3584
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        19⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        18⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mEgcoYwk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe""
        18⤵
        Executes a command shell one-liner
        
        PID:4348
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        19⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5712
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        16⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5608
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        16⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2472
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        16⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wYooAUIw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe""
        16⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        17⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:5128
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        14⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4164
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        14⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5724
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        14⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tUQkIwQY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe""
        14⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:120
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        15⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4252
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        12⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3112
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        12⤵
        Modifies registry key
        
        PID:4068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        12⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fGoYwYco.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe""
        12⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3172
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        13⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3876
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        10⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:5272
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        10⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5476
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        10⤵
        UAC bypass
        Modifies registry key
        
        PID:2960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HQAAoAIs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe""
        10⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5956
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        11⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3456
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        8⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:5444
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1648
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        8⤵
        UAC bypass
        Modifies registry key
        
        PID:5356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QQskwEEk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe""
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3348
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        9⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5116
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        6⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1388
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4204
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        6⤵
        UAC bypass
        Modifies registry key
        
        PID:5464
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qwQQkwoo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4760
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4984
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      Modifies registry key
      PID:3680
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:4580
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AiYYIYEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1120
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:1988
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies registry key
  PID:2172
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:3816
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - UAC bypass
  - Modifies registry key
  PID:1808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RCkQEwkg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock.exe""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:1112

C:\ProgramData\UmQowQQM\usscoYQw.exe
C:\ProgramData\UmQowQQM\usscoYQw.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2856

C:\Users\Admin\UEUcoIwg\SOcAcEYQ.exe
C:\Users\Admin\UEUcoIwg\SOcAcEYQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:5348

C:\ProgramData\XKYkgosk\pUQYIoMg.exe
C:\ProgramData\XKYkgosk\pUQYIoMg.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1508

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HIEA.txt

Path C:\ProgramData\HIEA.txt
Size 8KB
SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
MD5 ccc17b64839af925f62b85721d3388e1
SHA1 64dad4a3e212e186f4fb96f182d427f6f1c93a0e
SHA512 be1cf90734f7f0b2dd5a6ffd7f4b1ccca671c85b83bcd6d2eeac4ee40ee34c6c6fc4110131a98548d3fe15a121bfa10bfbd8d81419a446ea044008df63c468ad
SSDEEP 48:U563KS01Cys3KSwM3KSqk3KSjM83vE1Cys3vzMUR:XKS01MKSjKSpKSjfvE1Mv9
TLSH
T1C2027E312AE8167FFBB751B1C3F108B16927F8526A14CC8EA076424A4477E825DD0F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usscoYQw.exe

Path C:\ProgramData\UmQowQQM\usscoYQw.exe
Size 1.6MB
SHA256 e8fa7a09a506bc87ab1783e354c47fba5044e2b1771a2e9946e51820798f4aba
MD5 30d4ff23151f8bdb2c3a50687703fb7f
SHA1 44782a1d8a8704f552f75d34d86bcf00f49e4a8d
SHA512 6fb434043f5921a0b06e44e78fe969f1d44d5c7aeb30820e789904cb18d1de07e8d683ffe46492f4d5c2099d4c9be27ee0981a1fdb682c019b964ebbde5c083c
SSDEEP 24576:j5XKq0TrVbzBuO/nY9/XfTG4JIvSL2+b:jWTBpuFxPKfvSx
TLSH
T1EF75424B3247EA3A5C0A4C805A0BD4E74C6CFF8F4A9D0DD5B5C8AC70E96E5F716DA122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUQYIoMg.exe

Path C:\ProgramData\XKYkgosk\pUQYIoMg.exe
Size 1.6MB
SHA256 5e88e68afe02002de7699ee1faef2eac75b204828c10bce354b417202dceb52d
MD5 3539e3bf7e2c435b2331abed13fea9aa
SHA1 bca95be0cdd4d0853a3abdc2286bc7cfcf8bc6bb
SHA512 23e242cbc5377d352d43d38bd4471fce890cc8621f9656c5e5ca2ce90605cd57d2dc7fceee7e2bc33abcdc751c1a04d4fa93512419f4b2d947a38b5a06fb49db
SSDEEP 24576:D6bT3QU9NKw3b6edqWuWilLZ4DxvK3cU86Fw2MEQgqu:MAJ2bsOxvK3c56Fw2R
TLSH
T1B875011EF1401536CBA9BA229DABEFBDF08DA1C4D6F4D5CAB100E5A79D0419EC7E00E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUQYIoMg.inf

Path C:\ProgramData\XKYkgosk\pUQYIoMg.inf
Size 4B
SHA256 9d9b76527f97b41550526292f22a96f97e1aa0681047dd1f3a812fda57818a79
MD5 a1a0716800a5b3279cbe33284e8b93d9
SHA1 fe1fcc0a4409556c5f1d2af1b1e84be01fa3b294
SHA512 09564bfba7885602c8f7691e42dedc90f2ad5e9193b99a902f58e0ebfc7843fad84a75d5ee935ec39f6ffbd21bfa09e5d3d292722f88fbd9a73b5a8fde3a86ec
MD5 SHA1 SHA512

Submit Download

pUQYIoMg.inf

Path C:\ProgramData\XKYkgosk\pUQYIoMg.inf
Size 4B
SHA256 2fc5e33e95b0e52c12d219eb1a1b163a1a352842e366a1970acd86c76c5cc51d
MD5 0c1d2afcfa45236fe5a4759833367209
SHA1 760c9d90f4ac19380557ae6ed469ea94d96443bc
SHA512 381ea2bee0b7b2a1b90f5e022e7485561f5e49d189952eb878514b70006007cbcc8bf03616beb73956c343055bf78b28aa49d0a230f3ef0121396ef15179d667
MD5 SHA1 SHA512

Submit Download

pUQYIoMg.inf

Path C:\ProgramData\XKYkgosk\pUQYIoMg.inf
Size 4B
SHA256 004992999668c2c0106d863b8f2c5589112c573781680b94fb0c4503266b1639
MD5 4731fee0e1dcb872e02510b72ebe97df
SHA1 ebe9220f22daeac4f6aac3a36d80e1bde313b416
SHA512 3d6b6eae653b0ed4ae3b32686834cd703fbf9da8d0e3d09e08eee96adc1eb64927ab52e8f091a3bfdb4a34ae6b865e223027d2c58fd1ed588a272f9447419ac1
MD5 SHA1 SHA512

Submit Download

pUQYIoMg.inf

Path C:\ProgramData\XKYkgosk\pUQYIoMg.inf
Size 4B
SHA256 5a2f3e8a9d5fa3310c8e97d89127ecd56ea89d8af41d318db3439e1db420b05f
MD5 b03f9ec80d5e222eb1e4081291de6706
SHA1 4b66b5acbbedad31a1390d144de50e288a40a81d
SHA512 5eb5f6bb8fc9e7046df076571b06f7c72b44ba6d8276454a0fca13fbe548a9199258c05ee1856416e5629e7b55f990e8a9a138c3f345cda09aaa00229a2d882b
MD5 SHA1 SHA512

Submit Download

2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock

Path C:\Users\Admin\AppData\Local\Temp\2026-07-27_f9438859bee7ff58d8830aa596adce78_elex_virlock
Size 5KB
SHA256 98817a572430813ca4ca2787dab20573f7864c5168ac6912f34d14b49e7bd7c9
MD5 d7ee4543371744836d520e0ce24a9ee6
SHA1 a6cda6aac3e480b269b9da2bd616bdb4d6fa87f0
SHA512 e15b6a50d9d498918a81488bf8d60860027f9a38f4d87e239f1c6e9d20fe4938e75861dad35c69e4087370c18b2cd5b482ab6ca694dfe205d053f1d303d17808
SSDEEP 96:WjhppppppppppppYgPTcHPzAia33mWn41j35kqbV+xkdqA3T0VczHZMKUz4k7Gcu:Wjhpppppppppppp1PoHc33hn4rbV1dqA
TLSH
T16DC11A2393A8A071FC1B7FAD092F427254395E1FB59A203142FC54EABE705E8B2B0D61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCkQEwkg.bat

Path C:\Users\Admin\AppData\Local\Temp\RCkQEwkg.bat
Size 112B
SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
MD5 bae1095f340720d965898063fede1273
SHA1 455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA512 4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
TLSH
T12DB0924C2C8880FC0D108E82881CC42AF1CCC0C1C394401AA0A30688E33CEA89ED6AC6
MD5 SHA1 SHA512 TLSH

Submit Download

file.vbs

Path C:\Users\Admin\AppData\Local\Temp\file.vbs
Size 19B
SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
MD5 4afb5c4527091738faf9cd4addf9d34e
SHA1 170ba9d866894c1b109b62649b1893eb90350459
SHA512 16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
MD5 SHA1 SHA512

Submit Download

SOcAcEYQ.exe

Path C:\Users\Admin\UEUcoIwg\SOcAcEYQ.exe
Size 1.6MB
SHA256 246896c241de3cfb1c630d3286ea18e7de2150fd48ce5590f9cad233457b68cf
MD5 50f7fadefe08436d258ea04d66e7961b
SHA1 41373ddfa1c764f49a1da7b98f394bebd1c4a992
SHA512 101f0092b104c607cb78038345807a2ff336704eae39f26f20fcc98b29cbe1a6e8bd7a07a0d3499ee64f1a69af9792345ee8b213f72edabb336137f79adef3dd
SSDEEP 49152:OmXNgL65yaZYGM1tfg3pL93fjsLI+iiWIhkP7H+m:OmXNgL65yaZYGM1tfg3pL93fjsLIZ6+
TLSH
T12B7531E40BC184C3C11BA1CC777ED89FA1BBD2DC5EDA58785598C90B842376D113AABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SOcAcEYQ.inf

Path C:\Users\Admin\UEUcoIwg\SOcAcEYQ.inf
Size 4B
SHA256 63819be3b2f5b0f5b4f66d1b6ad83a56dd4a0aded005add48b0b58b069de4fb9
MD5 4dc01c4baed60cb433dd3cb4e059e6da
SHA1 d2089f6cc7fb7f66132582c358229f523bf183e9
SHA512 d596575726dcd0f62d2b96dc271612a7bd07dda591ee4069207abca19ef1c49bb7913a22ee37daf311d124f8a11b54730b9232763806a9ee1b8a9695c95f6b9c
MD5 SHA1 SHA512

Submit Download

AAkw.exe

Path C:\Windows\AAkw.exe
Size 2.3MB
SHA256 3713b191367ea39420fdf4405eda49b9336ae6817ab0095ff0aae80e0e9a9b86
MD5 c59b2cb42d58058dcbb3e73c586e696c
SHA1 5c54d246fa0024dfb1fe2e441b7b4a85b3832cda
SHA512 b52d826e749283ce1ebe4539dcb910177947341aeecd1ef71bb6f125099d202844655553c3bbb598860b59a1392333693b5440f4604f467e0a0feb32b30e811f
SSDEEP 49152:XBf5RkIIN8efMyh0IydhUYa41QYjCVcO6E2:Rfobfe1rD11e
TLSH
T154B54F9AACF2EADC4CD92F866A31A10AD143C4FF599CA3419CB56FD061947063E34F93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AQUw.exe

Path C:\Windows\AQUw.exe
Size 1.6MB
SHA256 c40c23ab286e6deda76b2927f8184b5b2212a2481cec9b955922164845aa9779
MD5 7c13daa291bd6521554fa083dcd55e70
SHA1 cf40136a1e5b77375809b6db9d366889994b9e3e
SHA512 839dc9b465befda6955f5d79a9458bab55f3e7253db7be0136f83e04a1724812df40413d7f47bcc365d82b24b7e47d84384ddf9abf71a6648329ff474bd55ec9
SSDEEP 12288:pEfxuLB1Zz3fbA/IJMLUMZ3fXGdg3FI6/0L337HNWgURf8uwZqzjOHI6W2dbKIJY:Gutk/17PGu3FI6/0HRHo2dbKQEIB
TLSH
T1DA75AA0527A9515F7323D83ADF1B80947B113670E2F020A8910A27EBFE5987F795BB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AaMA.ico

Path C:\Windows\AaMA.ico
Size 4KB
SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
MD5 f7858e48b74b107ab160878eb400128e
SHA1 d8cdd8be514077e101a9f0a0fdbcdefaea6aa72f
SHA512 c2e950c96da0c901c550dddf953dee3eecbf9a1cb509100c93bb034351369e1547bf5b97d4aad78e2bdd516a09ea28e999e597fb0a91fb350da7b7d3ec08e9d7
SSDEEP 96:tzwwwwwATljxEbfbqacJHTTejtjmjFj+RIW:hTljxEbfbqacJHTTE
TLSH
T16E914A3723481C35FE514DF0BCAA9A9CE088BA1887C62C546BEEF59EB57E8C209F5441
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcEi.exe

Path C:\Windows\AcEi.exe
Size 3.3MB
SHA256 5ec0dd469404f0387b1b8e773f76717b1026d5f4808395d2efe0e72f52ecc49b
MD5 824c20dc784b0391420b386006a72909
SHA1 f1173101eb199dcb007ba35093a71583c67d16ef
SHA512 aea5a771cb3a3f5b8dbe5b3150fb324b06ac2c1f0bda5779bc2a9a835f0ab709c3f954021da7c3560376917dee75c394bb8cc9515554748bbefc6fd0b19903e5
SSDEEP 98304:BauQSrF79gOWqRIO6nw8euG5EiOh0JjY5f:IqRI68iE+JjSf
TLSH
T1F8F517FEC7616EF9326920D2E5B5272D6ADCDC364C910F7CAE4BC1B8266638193C604D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AwYS.exe

Path C:\Windows\AwYS.exe
Size 1.6MB
SHA256 94666b9ee69573a50d0aaa9e6c38cc1507c6aa57f0b13398eb00c2698505de13
MD5 8ab41305002c1b90464fa480063408ba
SHA1 e697c7a172e36c323fae5a645a3d340314a247b1
SHA512 3e82c1e5f104070cc7200e6af81fd1e6d75d054f1a2fbd59580d84767405ab3bd6381d316961ecd6fdddd470e69ef1433e46dd5c9222a488d0c709caa917f282
SSDEEP 12288:WHqRsknWQiCzZBc9itewTW0fl6EroVoCmjzjdP:WvkWQiqhew/6E82bjzR
TLSH
T1377589119C79F518428F6FA0051C2988F2EA85B8D70FBEE78EDAF5503C7091C576A29F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CIIW.exe

Path C:\Windows\CIIW.exe
Size 2.1MB
SHA256 223c371528466970c2c7ed0cfc33cb4dd8e87a6c07fc4954c9b6ca0ddc984f27
MD5 02bf419e9ac00e4bf6f8966fed901b14
SHA1 f07b2f2bd7f6278ea9b212b7b8ad710d9a53bc05
SHA512 1573ff5a8ad61afc4277d1cd1a9459a67965bd0f65fdabdd3a67da7f1dd7629f888134ab082664296b5dd0d8327d1aefc8c478fbb1d5247b7f21317639dca5f0
SSDEEP 24576:tpKgg4iJMWPf0t8wI01+wP0mTrSCiLRFYWGfwuC68EsIKfVQ41x7XlIq/X7bv:tpTg46hPfh0TnrqRMh81IEVZXn
TLSH
T1B8A52F9B6D7C88D8AC28B8B689DB65871166AE48CE3CB53D1F4C25B392DF1D51C0384F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CMwg.exe

Path C:\Windows\CMwg.exe
Size 2.0MB
SHA256 454f8bf8863ee8d17ff1ba56f7c1519eb08715673014f65b60ea15b9fd06f5e2
MD5 cde52abe71cdbb38c56c5455f5a463f5
SHA1 5fe3702b5100a5662c4d6c08e7445b2da3408682
SHA512 ea1f0582bc641e9e16836d968617b49375203f172cf94bc115333a1cc7207561417ac3ca0f4caad8fccac622c86e67333917c7d047d8c44e13c8791f0b4da65b
SSDEEP 24576:CWStjUGeV9gP9GcG1hTXknIRV7S2aB5tuahnCVRP:Cft+9gPEfkIRJeBvuahCz
TLSH
T196A5D68E7B2D406ABA4AD59B13A8A209B0B065738C1D73594D30FE230F5D387EDE56C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ccgm.exe

Path C:\Windows\Ccgm.exe
Size 2.4MB
SHA256 42fbe5048f87b646a1ed90a80988c4921e0bf173d60d8d949122fc8242e51790
MD5 a9e5d25522cdb96e1afcf52c8b4a6b59
SHA1 ff2a898057dddd70f41c2d27cd2c7c068b42de3f
SHA512 3b77b416ff14cab1b4e45f567bd02d604dc2397886226e5a1cff7a78b99972b2cdf08e74a9cc93aeb2addd308e9e6e25ccb8c26626128fc13924fd380caa67f3
SSDEEP 24576:PIDh3iWYNqBnRPk2ZIVfHxDxaKeq+L9arQjKksJNRg8q1yv0sKCTREfpBzjOo/0D:7iRPk9fHxEws8kgNO8qXrik9tks/
TLSH
T1A1C571C89C5E26A0D7843F2775B4C03E9F5B6B9322B9E6F2168CDF1D614E14E0E0D9A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CskS.exe

Path C:\Windows\CskS.exe
Size 2.0MB
SHA256 938b5ffd488d1e123becd5430e3bbfaa5654de2ca75e6c38e9a353a4158ad9ed
MD5 5ab7f84ca2d0d976e86f443fb23344b6
SHA1 2d8fd5c173ed8216635a175b05073e45547d0187
SHA512 a6ea06d07cb853a062d398c9a7794ddc0f2b2c718e256f30bba32a6dc01e14827b4a972b72a117c6adac384cf0387d86f5be171436377605c23af9aa19d4431f
SSDEEP 24576:Qz0lsznjT3YfzK7nFJDb/qHZGrHgBOFLpRuJqFJbEE89V4ESyJuU:IjznPDbMZSyERuJq9c1d
TLSH
T182A51ECEC58051B9FC8D32E80D930C1DFE0DD469EB41C9EED5B764696CA9C872528CAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EEsa.exe

Path C:\Windows\EEsa.exe
Size 1.6MB
SHA256 72d6f7a01c7b4bf440efd55311f9bf981487e9fa2cfcf013c604870a67ca6de0
MD5 891d8e84962be7b4723c696c2f6b64f4
SHA1 36971e209ff14017fb1a18b78460b894edf8b021
SHA512 a24872da751004822d8137ef667cd0533c607409b5b07daa51208acb1bf83114f2b9baa32a3cf3133a87428b25150a22585ba987059db6f1f8f3551839c2c525
SSDEEP 12288:YLv/XqA/ot9CUa1avcZn0zL8mXixHGHNOirhoD4+BjGUKGBS3l0Qkv/gXTDn7gL:YTG9ja1avM0DX1Mira4ej5Kf0Mz
TLSH
T14175ABAA1745741225C177C2E29D0ADF8758ADE70EB96D4FA8ACF0F3B564E031193B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EoYS.exe

Path C:\Windows\EoYS.exe
Size 1.6MB
SHA256 1e2de0c31b0aacf4d8724473df3fd7172c08fc84cbcee2b3e0e0f9f0b27a4206
MD5 56c9020ed87d54cb5cc1eea2a8c9334f
SHA1 3612f4113fcb8d6237556f1c0ad27a926ad50f56
SHA512 20fd5a79ec212bcba83cc9df66d03dd1dc008bdc4a3c850799f66d1031f0494e4d5773f356f05931b09dcac1552cbbfbafc9508f0837185b623c185d4cad2da5
SSDEEP 12288:yfhByQQUIr8csOnVl/TfrABKH9neU35jrWc9l7jBWWYAEOscO3zHAR1/6KIDp:Cfy8Mnr/TfFH4UVqchWescO30n/6KID
TLSH
T17D759504846D4CDE87CD2EEE03CA278ED1DFEA73A117A4C26DC0A985E8DD89FD55D890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GIQY.exe

Path C:\Windows\GIQY.exe
Size 1.9MB
SHA256 0ba497e1c76bc9f07325f81fe5a0f035becc1b08948d37760a72b17d15782999
MD5 57138b55163b07bf4f4c354fb8b0572a
SHA1 5f9a73417aca1ffa3b59672ff6b2e8892fed802b
SHA512 f727009ad3c2776968b3a96d20f1d9373b4ac4f11765ffa99be00b27e7d27e72531caad8514f0eab65cfb3adf7f027c61d228dae34eaddbc0667fa346feb5735
SSDEEP 24576:fkOETs8nnTGbcnZ+LIYSJnyh4fw5NKjFL9o/1Zln9Z3yq3q/Vo:NEGOHYSJkUJqlnNQ
TLSH
T1D0955E6D32FEE14E581042E8AE87B80240743C5D5D6688DD35AF23177BD88FD9E5B8AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GIQq.exe

Path C:\Windows\GIQq.exe
Size 4.0MB
SHA256 8dab4cbe7dd0b567e510f0a11d0e12ea39703992e440847c20ccb22dfc62d3ab
MD5 0ce93d6821210b4b19885dd18ff91ebb
SHA1 cfa8d7c621feb69dfdd57c517546c8a085f73b0a
SHA512 a357a57f5f682b07fb60b39d350b7b7eb4fbafffa2bbbbaa54e9703ac1cc892c06b291006f10f56c32a7484a7a1c8adefcda1b81900e70c56a9738e1058854a1
SSDEEP 98304:d+P6rbBsYDxN9/YCGJwRVJaQp/92fcs+wCL1GK9:sWFp3fmA5/98uL1GK
TLSH
T1F216C3CB27D090186C808DF66A712556CFDFD9A0496801DFBA293C65BB7A1C4BF8DC1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GUYe.exe

Path C:\Windows\GUYe.exe
Size 1.8MB
SHA256 f28b9739524eab6df19af8a1f505bbcec3a27c1cdfc80b89e181dd294bf1a4d0
MD5 780f9d3372fbb9923202438fac1ea851
SHA1 b2141433ef875906d15212aad9d3d24b64a15402
SHA512 391b3d1b9aa9b548f203b1368835c54c5149a4b502dba58e7a77c2642f028b924b1b4cac23f141ca96794861e3a233c1717072ab32f0f2bccb9817ddcbc835b6
SSDEEP 24576:RU/M3W3/DfkeCHyeR0sCqjfla4dWeCQ7UvyM:kfVCS20sCqbzdWV5
TLSH
T13195DDFE8C6E4298395EA191A76BF3D588AEF735D1528D9721102B30DCD9CC80FAC54B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GYMM.ico

Path C:\Windows\GYMM.ico
Size 4KB
SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
MD5 04e9ffd28b9cbb9ca06e99dfd0c7878b
SHA1 44d1ff600e81c6014965bb30684eed29ac7c538e
SHA512 22bf260e1ab53d90c8b3083cae8d9fcfcf6ee19fe30d61c6074ddf38823afa4bc6bd738441bdd3e221131f4e87a750c03f64ac78cffa5648cba737c0c623d888
SSDEEP 96:xB+p+3sHL25ogAJpogoMotGcz55Xxm/frxO1Q4Ni:xBK45LAJprLq5mCI
TLSH
T1A1919C6DD785C54EC0E94F76D3364C77E1679C2B8E79986E024C31EBAE321860829D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GgMe.exe

Path C:\Windows\GgMe.exe
Size 1.6MB
SHA256 2e12c78251fc44c965970da36e914ab084f36803154c31bf0c3f4dc6b0ff24c5
MD5 869b57e8bebe7855036124ccc77186e1
SHA1 02032fad8e817b3ea93a3252a941f91f156ee8aa
SHA512 5563a9f2714716fa90924fa8fc9ea702185cdd496c87969f24934aaed837a88b66677bab1af5840164865c91eaff05ac3b81e9dcc19c4a8fa56369c014c289b4
SSDEEP 24576:pbqjnRp2HfEOe9uOdIOovOgj6RuxyxhmnQsjOgBJo0fHX7AZAg7pxfZ:pbn1OuTOoH6R1nfZ
TLSH
T1A07578EA0750EA83F477B8A6FD7260CCC15CD29E97CB66C9D24969A732CC55C7B804C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GscE.exe

Path C:\Windows\GscE.exe
Size 1.7MB
SHA256 a3aec579d6b3f8e87147a413abe27daa08b5fd71502ca20e9de984d6594ae000
MD5 9309428c68fa42b35c34d82743551657
SHA1 03baefa1605e7fad7f3d8d59f37e291e277aab43
SHA512 90df16110ba65bc5fca5c8e2e88cd26c0a1f6756feafa31dc538e91694fa1e6bb86328fae9cb1e8276e6b3fba987dea18a3ab3f1fe2b0e8800f6a697d56a8fed
SSDEEP 49152:8HeTQvQzQQCd8AdeE5axdEYsY4zW0NvCy:EJQEAsFvH
TLSH
T1A885E9ED8173128FDB2224B88EB5CA19D31FB337B98D50A7C65925F247C41ADAA1C35C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GwAg.exe

Path C:\Windows\GwAg.exe
Size 1.6MB
SHA256 596de9bcb8f1f666597643178b2aea9e98ce012665431f8ca10e7f69f07de812
MD5 ec99ec5bacb6ee53d68fefc99e6da8a3
SHA1 6a041bdf0673ff8cf40649335d3fc132be279d8c
SHA512 d6a3e9a0d7e45ab08222d74be5e0c4d9ec4c9e272f45777e061c658ab6ded67da30efc6a5b37266c0156353c1eaed9492052208419cd5d9ce18096b9d2bc7ef1
SSDEEP 12288:OCxYj2/+pGAqr2ObQVVM6D19ZErC4fIjRpc3WG9WV/mRDYLti3Aczn5Kg63c7YrL:Xxy2/lAqrOVND19ZJUGYUtiQcR+c0v9
TLSH
T13A7575F565ACD890A0F0136FA4F62CF765760012B3AD7AF7F58A61C14784CEAE1A113B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IIIW.exe

Path C:\Windows\IIIW.exe
Size 2.5MB
SHA256 d346696bca856e3bc4e73b53b2f26fd4d4f965977166af186f92157143332f3a
MD5 2596cb96b5da390dbce29a191c9de6f2
SHA1 8ab3630afae1c233b4bb4ef4a07ff35c047a0cf3
SHA512 3ffac89048fdc6f117532c1cbc59f217ef99916c85b397ea4a1c911fc5b78c2b2e92da116644c5b441ac05479b251e870cc7fd3c14797592c2ea9fe069dc9848
SSDEEP 49152:AkVFGN68+thNSW2TJelGJ7NIiIWYZNg2iq288z/TH0a44wQMA8CzA72y6PkU:zVFGN68+thNSW2TJelGJ7NbIWaW2mr3x
TLSH
T16BC5D4292CC01EC9BE8111E463C6FD6EC40EE26E5ACAFB965D0E0EC5DB25F4944D90BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KQsi.exe

Path C:\Windows\KQsi.exe
Size 1.6MB
SHA256 67063d520a7cc6895ed123f72d7d4d5c90fe06abb9c21c16674da6d119cb6ef9
MD5 eb64701d5ae212d28c379ea113d6aef3
SHA1 1982d1a448fff04f8c0e89673354b6bc281f3c8d
SHA512 c6ff2805a41916bd4600f1ea1610e41c747deeaa48a78fef0a45612d7fbf74019a178ee7d96b85bdf938fe52ea3d5a72abc0857a61623c623161c845abbb72cf
SSDEEP 24576:EzOTCJnLwdbvlmBu73D+ngMJWAjmL0WKx6KvTpLj/dVB8h:0nLwdbJ6sOmgWKxxp8
TLSH
T16B75888A9197C40F179FC923897A1A5CA51FC7E0EE8F34C4CBE4052B5767AFAB721250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kgsy.exe

Path C:\Windows\Kgsy.exe
Size 1.9MB
SHA256 8a11fa462aa8c23806ba3686f5ee75320c144e1d06b340481815aacd0e24fcd9
MD5 88327751ac2d36e8a359c728c969ae47
SHA1 9edeb6662985072e7a6e8db674774aabf5730a05
SHA512 2b94c340614122e83b2f7c3d01e3839c37604bcf03fa93bdf66f1033047947645610e7010c7b718fbcc6126592eda488c59aebb15b3cd57fb43ae20f30ed3080
SSDEEP 24576:ehwfx8lhI53ImQBmVe5OIPPC6PSrdiiK4cj2wRWeH7tuqL:eh6xD3ImQNOkjPfi1O2uvtPL
TLSH
T1ED954F476DC61287A8BFD93074FEF66C7B01EA045D80FC6AEE06D7590A5416B7B3282C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KsIK.exe

Path C:\Windows\KsIK.exe
Size 2.8MB
SHA256 b1790162138aed6109a3893f109e8c97ff4bc49c4349cd3b5a2339efdb7154f8
MD5 7cb8ac1135a661253c65e5e1034ef8ef
SHA1 972dfd80d629c3b5b0d9222b12df21dd62b526c5
SHA512 fe74c705437ae5d8141c82c35197ae539b2fedcabd1af45b22d44d4165dfe5de006a8fcb87869beb656fc5810e25d8ab6fc511a36aaa472c7a9cc1bcfa887f15
SSDEEP 49152:O/jhAtYCVO33lAJL16BnUcTJIfek9DVOoIIdvTgg4R8lFzwwf1efLTXcQ5ADW:AjhAtYCVO33lAJL16BnUcTJfidvTgg4R
TLSH
T183D54B2B93B63033B47DA5B137C062389956FE416EA31140D92F3ED296D2D2E9F632D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MgAa.exe

Path C:\Windows\MgAa.exe
Size 1.6MB
SHA256 8d697a2e40d15bf4da2873d50fc9709d56aabd616a3c3ed4fbfa59606ab9a594
MD5 e203241e941882ccfd118e2dc8d87dee
SHA1 70643bb60f55a9aba4a2eabe972d770de1ee5be8
SHA512 6c425dc84368d0dfc13ae5d1ff912315039b449b4b8e269d0a496e29382ae0f0b23dd57e1b1215d41265650a53309d821141a0f063f4e747d62c8ac6ba95ceda
SSDEEP 12288:dl8vn4UpNPgp0SC2R7O5ceyQT3Iz7lRuuuuuuuuuuuuuuuu2GOvwCQJetCk73zqY:d6PjOeSC2pReFaloCXeJwy
TLSH
T18275FE11547A7052C7122BBDCB2F1BB1A38DD49CD96B72282D87074BB868681F7BE7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MyIg.ico

Path C:\Windows\MyIg.ico
Size 4KB
SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
MD5 03c62b34b94a861c4f99017a91bc749e
SHA1 2ca36583370792d9d56be7e5db98417188adf5a6
SHA512 4260811ca36c05c15db789932b24767db68b0dfa1a0590e8d4f69328e208c38693e978d892e0d229756a8ab9092265e19b0a0da132f0542f8460be54ba6371f3
SSDEEP 24:su7zwwwwwoRLM4IRS00000xwbU66INLbXxtRmcjtjmjFj+RIW:tzwwwwwGLZ+wA6nNnXlNjtjmjFj+RIW
TLSH
T1CC91282223494C36F8D4CFF0AC9ABA956188BA544FD52EDC2DADF01E117EBF649F5010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OAwa.exe

Path C:\Windows\OAwa.exe
Size 2.2MB
SHA256 ca35e7717a57b76316194273ae26062913ade8b42d1e45eb69734565dac808d9
MD5 8ef21a3112480af35967c481e077154c
SHA1 098478c0b43bbf2bf0174577f90c688f4e9ff001
SHA512 3eead52a3dce5dd0f5fbefb215a7b65cb713f18194ac58ca66cd34d43cd0e3d48de0fba07a23211dd791c46c5588e7546484e9fde56d79a49aec30cce3947f5a
SSDEEP 12288:QUeFNmKSnSI92eTB/UjgI5sGN0IQFSm5cw8GHZgsmxFAY8mLaSj1NL96H1zjx6y5:HeXm1r2OQf5h0OAcwZZXmhbul6jNrq
TLSH
T112A541CFD536C7A78C43D69724E912712950002A44F539CCA91FEE4FEF46B4EDE2AA48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QIEI.exe

Path C:\Windows\QIEI.exe
Size 2.2MB
SHA256 00340674ccf80a39997c7c12af83e0ff04c035a8af9359f28c0d55a24738ccd8
MD5 70659366342e930406fe321d890df41b
SHA1 e3906e3c75a9d46d92d2f0490fafb8b2bde6c018
SHA512 41b81e7453657295fc4e784d3665178603a0b6e82882f683d06a5be70dd9d3bf3e006bec85545b5e9013448b93177b37a8ded7b040a9f04ef218763d733307c9
SSDEEP 24576:enX6DOj/Q/yeQMKVdVDEmouSUQX14pkfuzlrnMchiEgVAv:8HKyeQPd6mZiGpkwlwc9gVAv
TLSH
T1E5B571E250D5886CD0B6A1639FD24DEF129E3100AA4CCE554FBBC6A14363C4DEFED2A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qgwu.exe

Path C:\Windows\Qgwu.exe
Size 2.1MB
SHA256 aa4492a130c5e05c2e1caa658bf65af95eca2c81941f950b8db1a1fcd1b3d6b9
MD5 d95ca9900ca482dc4a86eb46225d1af0
SHA1 f64efd65de27b1ba6fbdd7a069ea021272edb72b
SHA512 affb77779f4ab1e3f1d2b48d3e66f2241a4d2217312b2ee93356cfe45bee049839b4514c77f783eca29aba878fbe503bdc95688a0244109fd8cf24c11f735b1a
SSDEEP 24576:az/s1LxjHpmaI7isNJGMWB2XYJ7Cw332EIvpAfms6rHIkRqUIBPCyafm7bg8V:Y67IWsNJGMWx6rHIXTBVzs
TLSH
T13FA5FC9F0B011BBFC147E63B8E6E9E8E1DFC384959CB157A0D8215B18E324B5A1A7D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QkIK.exe

Path C:\Windows\QkIK.exe
Size 2.1MB
SHA256 11342c30b3bba4dec8a5b2794b40ed1dc2b505c4c2ba415b647689407b38ed8f
MD5 193701bf85694e93903636a4a7453b3e
SHA1 68d53442858c4d3d14172eda5fa71f1075dfdf9f
SHA512 ad5bbb01e4452252af64a4050be59e5817bfd1136f2e28035d39c3e8fed67e5d40e6dfefc49d528faa81f33f3de5f16508429a0cb907d5c644816391f536a374
SSDEEP 24576:EWUah/5/e//////n/d/u/afJvTOx+kMgHqEnMyQUNJcVrXmbigLC5hSEP4peZOyZ:EP8a9EMxUNJ0OC5hl5ZOYh0ei2
TLSH
T1DDA51E43497BAB6C7D98146085CF1F4004349AB6B38F75563BE33EC71678AE72C692A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QsMO.exe

Path C:\Windows\QsMO.exe
Size 1.6MB
SHA256 b054679dbbcf6057658062eebd5b07bf3befaec46ad86a6a0657b5ea68414f70
MD5 d468f051c1de241bda6090fd6b38062f
SHA1 e529b6368c5e8314eed7cba164597ea8f0bbf308
SHA512 f5dbe75f4dc5ed247a4881cbc8971eb049c4de27dca3721029ed015182444c1de04aa545f6db2535c85ed80e4022adf49d6475050f25d7fc201cb01ea39dc888
SSDEEP 24576:5XjqDCMGf03Eo1qTCcHvUEmKEi8DTlT81+vw:5X2DCMGs0oeCcHvpmKEi8vlQk
TLSH
T12B756495B6F39249A995BF72436484E882921C1ADEEDB881CE33CD4E3C7FEE5425140F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SEwq.exe

Path C:\Windows\SEwq.exe
Size 2.5MB
SHA256 a71d80e03764a11838927a625b078b183582802647d96754da053fce197e4762
MD5 854fc501842d71281d49f7f15d2185ba
SHA1 3cdd94add5a2f9e01a90af64689bcb64145ac50c
SHA512 852df75c6eb6c98c081fab673f7baa7341b8029e3453f8aaf6fe19df9805a9ebfbefe810778b8d2844e19d8cf8cfe8489707b383ebc51784139eba65f16df8d1
SSDEEP 24576:d2zHqBFcU9EueeDzVJD8rrqb5IftHYXCVO8pIRAK4KNkXcH/jAXQS/o1dn:dQHqBeURe2zP95UEAK4FQjAX5Q1dn
TLSH
T1EAC55D925F628BFFC840358E914F2D0DA6E98A7D8DB714126E76704FF4BB315826703A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SIUY.exe

Path C:\Windows\SIUY.exe
Size 1.9MB
SHA256 5b9f089894d1ad7fd26a88176b140d57fbd46e022a7aa75f5a766ab642aab850
MD5 bf74d4bc23ac1aaf0994490d7da9dbd8
SHA1 f22323722cc41a24fb431eecf4f028643d8499f3
SHA512 67e6e17a281b1f42332546f0e649a8879b76c24bd1f8b6461a3230b9a142e561f450856e0896656076c07dfe8fa9d6b24b07de169e4789afbf2f45b0f18292a3
SSDEEP 24576:4CHELmvnoJ5ZQcFdEi1cM6YoEdK+Jjtmy0khI:Nhvs5D9cM6YG+J5my0kh
TLSH
T14F9598CACBD706ED513DBB2281D7657A10A640FA0836F1DB5E8B45D4C9FA1A2ACD3313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SIgc.exe

Path C:\Windows\SIgc.exe
Size 1.9MB
SHA256 a122d723856e7de70a51c12ecaa3262ff122cfd0fd8529b015e5dbd5fa7a9f84
MD5 c35aaad432a529d9bd620b703f2da417
SHA1 5e37b3d177a5d8fb23b608a35485740f07f16176
SHA512 a7f3fbebd17da509fa3b767770fdfd81965fe498a0efd70fe7ed686b8de01cae13aade919f55b82945c54ab1b083d6c7c86f4bfa9e3afb9a8b5295296bd270aa
SSDEEP 24576:QhxXAJzpZgBJSNGWXcaUyKp0KSjyLrXRUtUvsIf7:mUzvgiNFsAryLt0j
TLSH
T16395BBB7D048B2BED8F8E67125E319A052CC4B9140CE553559960BA6331FAFED83C7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SUws.exe

Path C:\Windows\SUws.exe
Size 2.2MB
SHA256 4f32c81b434e5bcbfe0f315c30c1e6c0abbf409b303db3d854fe2951a030d015
MD5 1affd466dec80390f686ecaa5813ae3f
SHA1 c6ad5beb6495cbd7ee4a332f89a4e40863acbf3e
SHA512 96eeb6617f3145d0e7d2f54462bc80818f3efbaf20c8dc94b1b668e37d52675d37f51a754d5c99fab61273b273cf17499676b0e490655ad3351e2add26ef1098
SSDEEP 24576:Sp37pactkxcAZjPYBf8Ht1I02y+iS13RPr8Dv1mkyKov+T1WF8I:Sp46q+k/I02Q2PgD7fom1W1
TLSH
T1F4A50D720360BC3397A1F5CF98D966CE7E82916C8C76AAA453C9B4C8FF458A54FC4427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SYoC.exe

Path C:\Windows\SYoC.exe
Size 1.9MB
SHA256 5322db706ae9043ee7ae3db6dd0b48c9d879b946b8bb9d9e1ab1b1647970a5b4
MD5 89c2e076c178dd8e763a15070887574d
SHA1 4dff8fcbb1ba860e22b0fbe43148ed8a8c925d6c
SHA512 85012c2ddc1e3fcc4459025a6f6c08ccf1d6948419742192840a127bd12b6d661ea347e9e3a65e7c5e321b71c1ef4d3456da821f35aba39b8e15bd4fe4dfee68
SSDEEP 24576:ciylOjyFmQZYngZS6/5kyrheX1tSQTQO+MlEGUSuxWLr:TWFfUG/5kR1tZ+MaG
TLSH
T18E95741A185384DF326B24EE22381C7F96F12AED665D86D3C00B70BE75E1479AC3935B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SsoM.exe

Path C:\Windows\SsoM.exe
Size 1.6MB
SHA256 f4b2f397932a45904da99a6bc9c57a060289cd49ceaaf3bdfc147d4772566855
MD5 5386b19657030cf172bc4e8dec9bc643
SHA1 314be81411976852921f99a993b14359b0a65537
SHA512 e1e875b7e4fc56af0379b22937202f251234942a2deaee93061ec86f6f9a28cdc78e306ac577124279b962d3ca0376492736c1a8e6e736950fb471aaaaa7a32e
SSDEEP 24576:r8IVAEH5qbTy9Q3lMplC3yC39TTVPe997FuMuOjUL3Gk0MzNTM:rbAGDQ3lltdSgN
TLSH
T18675A973E527125F62B8C140EFD6DEAC4EA7FFE0BAD0251BA37B83658F24252455C4A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEEe.exe

Path C:\Windows\UEEe.exe
Size 1.9MB
SHA256 1ab8b6a466e36d0d52aff8898a3f0f861e3fb3556c6faa5bf95e6721d775dc71
MD5 be6bf58291c1f4884989fee03e0a4fd8
SHA1 ed54b1144d7a20984352f0191e98dc6b21ac9e76
SHA512 9289047dac01beed50e7a855d51a0b95b55ad8cdd39c5bb5bf70037d792e79258f40efd287d7593b61aff815985e93118162db0f22fb95e941f950cce82cb4bb
SSDEEP 24576:S5Bt8Wl8wLX6xJklI8w5Wx7o/4QbYSQ0G/bRkgxjF:EBiLMX6fkWV5W7C5b4t/b9
TLSH
T1CE9552EE689C7C73D5A91D49EE00FE058EC85D022640D113D0E67DE4A68EFABDB5432B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UYcm.exe

Path C:\Windows\UYcm.exe
Size 1.9MB
SHA256 94c40676e96766dbb408b9eb9c620d88d50df54ac826ed03a5873f3d3bbf4ca3
MD5 2a456d0b7ba58cce4682b3eb895c6324
SHA1 ef790d49081db8e453f26d94f4a0031402bff1b1
SHA512 b1019bf136a318c8e523b53adb2b9e46ccf562d883dba8b635c818ef2c96f71ace3958a7f43681ce7a3e18b7529f64433588261ed3eb7f3e6edbfe19d2d28405
SSDEEP 24576:HWAr/c7zw+KyPfJBJJdqJVGbka/xR9LsaZp0TLm:2Wcv2y5BJXqJVGbHDLsaZyT
TLSH
T1B895B58F7FF065870D56FF5E88B1B4E63025DBF89824615C9562E8CEB4CF3884B92126
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WUwk.exe

Path C:\Windows\WUwk.exe
Size 2.1MB
SHA256 7c33b1756e5f3ff2877b08158c713019436fa440043627fab7e1db5466f5be53
MD5 37d926881bc68d5af1c549a20bc3a42a
SHA1 046ade65d43b6fdb32d9d2b0bf99b2b7bc0cc2c1
SHA512 2b08f52e86ea759c8b304eb1177c9790c0fa58914084c4091d1e689cbafa8679af07e2fb13ab0a2a6a50bca564260b0a79df808ad9fcf94351722486dbc0b38b
SSDEEP 24576:kQcfya/XC+Uu0RMRF7Qp1GvcXytxYzSPtk9Zkyv0U1c:VjaPhuditxHFk9iyv0U1
TLSH
T19CA540D0DC3527983ADC8E11874E57727136984623D8F653ACB9786DEF00C19C7A8BBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wgow.exe

Path C:\Windows\Wgow.exe
Size 1.7MB
SHA256 2a5dc927b0d7a7fec04ed4ef0859049de13b79e794d5658025f4e6470f05d227
MD5 bb4ef24eb208f3b3c10d0338da99de30
SHA1 40efbc252083eba9afc18a9bda377752fd4656ba
SHA512 238691f909bc26890e661fc211ac64072ef5ba51452067659c16424307ee6eb8b8e5ffd3b9e0c80218ec7fba57de1790cb09615c5de015475bf8f6a0a560a977
SSDEEP 24576:UzpubKVaYgPHJdKY6t+wGs6ax+JmnWQSZmiG7zg9w9XPh4G9kRng8ErNzk:UFRIYvUQiNgqw9Z46Ing8ez
TLSH
T134858480F5982FCC92A6AE33541D9C3B53ABEA48053EB3BB0E65ECEC501B01D7A53575
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WsgQ.exe

Path C:\Windows\WsgQ.exe
Size 1.6MB
SHA256 496c41622e130479dc19f7f290553270cae0a554d415214a273c1cd3ac64e804
MD5 5e7740a4129e533caabad771b6dbec88
SHA1 5361dea0245dad664af72eee42357ef05e9ca2c7
SHA512 57e03e3f3334662f124f6537d9a58fa43840940edb0d3a7d2aba0fe05b3d67902ec6ab4f1da080f51fa708ebc5e79bb72c7e8c7a692ddb630741ed231b4016ac
SSDEEP 12288:Nw5XosuFGevimv2uG+QU0GUtNVsC5eL1ubSRdqVsqe8C1wd62RXSia/JkEe9E3Yd:NYosuFGeviW3vwaMa0C1ukzQy0
TLSH
T164758C8E21B407EBFCAB2ADC1143E5D630634ABB746F0CAD6779329EEF8556CA414D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YYAi.exe

Path C:\Windows\YYAi.exe
Size 1.9MB
SHA256 726cc0e8d4d3e6d68ff977df30c8a7389cbc9c67e4446e3413fd23d5c7b985b5
MD5 dfce7285f2389e50bd96dc85cd641c54
SHA1 a7c3d9e88de83852edd3af368c7c19f079051ba6
SHA512 b085bfa47251dc6c85018fbdab7ce1bad31027000b3c424c130af6856a828fdf57fe20b45b3000eb51c64cafa0046be67a4fecce2beb82e49b6ddef82725aff2
SSDEEP 24576:sGnsvcGtj0yqF+L2xvaTuHn1CPlUtXNCh/8ay1Zi72I3SDp:3nskGtj3qFe2xvaTuV5ih/MQ2Rp
TLSH
T1439547892F0ECCF3F972649802A6F7F87AF7090066D142FD5D245B66A4D34261F61CBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YkkI.exe

Path C:\Windows\YkkI.exe
Size 2.1MB
SHA256 6e835e7fb41218c61fc891c867fb6f3890326219b4f98ec169165de6a3bcc79b
MD5 757f388205730d7e74f36c21cca441e8
SHA1 95027cfc0c24fafcafa6ed5b9f69e34516d241c3
SHA512 41116656b7667a9809600dd18bd4235bcb2e04fa7eb1165efcfdaedfe52b8c33fd9831303e30e615eb01ad827d2a5122f331d3aee1241e0610473a59b681c2f9
SSDEEP 24576:/DnROQp1d5lCK8jbA12+TjCSPvWL+WV0tbV9/vRfTV90esyV:rRtpYA11Tj9vzW2tbH9TV5V
TLSH
T135A51D150B5C76DBFA3697651820CF6E3E8D710C024ECBF62FEC98B5264175D828ACB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YsMK.exe

Path C:\Windows\YsMK.exe
Size 1.7MB
SHA256 96806785fae5f011b3dc4556985bc7bab4fa637b72f5cb8406f38f425b649245
MD5 2a9dd2491921b3f5ed88d2995b4d8389
SHA1 a5021b207058cbb855e251fa3270e5a2e8f989ec
SHA512 15209701afbe43618eff804850aae5a0fa2566766e2c1641ee3f7f9fe2590d4b49f586f13b0212bc4bbd0d133d40262d2f67b5b83b64abdc6c0dd3c29f3d81ef
SSDEEP 24576:bGEIt44LrQms6LhN5UNfQDUjRL6lxV7eBhcRm6C:b3IrQmfhN5UNYDUj6CBhE
TLSH
T18285A41F998DB980150F3E5891A26E50ED493121DD3BC23BC0585AD8A5EE07EFB19FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YsUs.exe

Path C:\Windows\YsUs.exe
Size 1.8MB
SHA256 508b550323c51e22dda3cd72f1f4004ff7a0df950a6ffd0c955f689df54396e4
MD5 f5b48119f32993510bcd41f152908587
SHA1 57d1d94130c11a60c4c4312a5632d5069f225e76
SHA512 9d3822c4ae98dd95917a0bbaaa5e3f09508aa897619c48245e6e8c1c1f381cb52a94f8ef79b31c9c0fe124da940d4e9bcaac6be1d09a7885402f6f73ea904e7d
SSDEEP 24576:vJPM0xz0AnZth+aza2s7c2E5NDpD0tL6PqYPaA3FEaIuTlm8U8vG8uyx:v9sLYPauEanBvG8
TLSH
T1599502690A921FCDF74E4617F89D7DA368D39EA814CFAB941F55BC6000768EB34BC821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aAMg.exe

Path C:\Windows\aAMg.exe
Size 1.6MB
SHA256 39b59bc485c3aa9729936f74fd6f6dfb763cd8c7286f135faff9aaaff5621477
MD5 96ee2f4910422de54b30559a63dafbaf
SHA1 2b489ac78b689d68d9eb6076ff89d5aae8965bc5
SHA512 2dd2761f7f0155c85128fdcee39d7f619694d554ed435d70e5e9e526e8703cfc48fdd7229bd312b7934d6dd8a3ea4b76c7a50868e0527d1e650b2cf0052d05e2
SSDEEP 12288:jnFldEd3NwrGwz6OSWVbG4WvadNQtq9NhzZLTaHXvY:jrdEd3NwqaXt6vanCq9NhzZL0Xv
TLSH
T1BB759AA7C91415031F97CDBA5E23995EADBE21F58ED356A28F0403C9C077E72FC129A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aAkC.exe

Path C:\Windows\aAkC.exe
Size 1.6MB
SHA256 5402ff6201d5dbe94acca3d03110abf92491722fbf81cfdc9a8dd2f4d394a5cb
MD5 c65904418472265356284f0c80dcc20a
SHA1 9ff5b01a0ef30dfc1884f3dd59215d8840ad5fd8
SHA512 d1d3aa30a34c6ab99aa7064d63d3f19c17cc00331e47917d8112ff5fd5bb02081d38323c9362eece87bc258824d1ad2f473ef79aba2e3378d2ca0a26df31e9ad
SSDEEP 12288:Is6rKKyWML1iuWlW0QC7TFgaLi8gIKRXfmAund2GKG4dguPqOA8r:+g0QC7TF/LBgEkpPqO
TLSH
T1E875ADFE9947C6342ABD772DE84C9E92D34CA29DE4C153EC902AF67B6CD416C80B484D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aEMA.exe

Path C:\Windows\aEMA.exe
Size 2.0MB
SHA256 84a07f12f689d1d1558a7eb047590cf828be43c6b469b0c4140a765e1cd47893
MD5 76261f7354db87ba6ed114edb6bfed19
SHA1 35b3696aea7335d41ea595fda5c7a1b464521d56
SHA512 5f157228583810331faab759ac5bd978c3288d7ca58684ba7e0d4c1fddcf7c36ca6236b45a87d0d384e5f3945837734e12986111e2be8b3bbec8b895b5ea71fa
SSDEEP 24576:UBdEiZ8+25JGXFl6LBSxEQlkhhw1YzgqcfgRi7lJaRuEQvc5Uj:hiT2LGMBcZahw1fgE7lJaRWvW
TLSH
T1E4950EC1B5862C83E724E9830EDDAF91627611361F2A8CB1B5BF8F946749D0B17CF681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aUYo.exe

Path C:\Windows\aUYo.exe
Size 1.6MB
SHA256 94d3953d371832a118cc099e31e76bb91d6037e6ce18ac346d77c31e886dbb9f
MD5 e361a906fb3cfda474f2ed2693174f3a
SHA1 65a8047fcc7fae46de895f9c754185711b02bdf2
SHA512 fb35198cdd298f1a74a30d69d1608f00171cced83cb58ac761214456b629ea706f0869467bb2794ed0df8a6d7a81f366120ef3394b5110a0875ead9644749d1c
SSDEEP 12288:BYUSvPIWl1LGnIHvH8kTwsJYNcZy37OSS5kmLv93kBoLyAD4opSKsf:ml1LGW9OBrKv90uLyUxSKs
TLSH
T16D75322BE3DDF9E682E021AD94F9987061BB5EC14872FE4F39580BA315DDF8B8109D14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agMA.ico

Path C:\Windows\agMA.ico
Size 4KB
SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
MD5 6e9325e46193ec554308cdb9ec8a9cd5
SHA1 3e3c4a52ed1fd3a85f8ab172108c8fb61e45f70c
SHA512 071ece6913f89a4b1634daa9d650bfa8f9f406719c124a3819cbdd3cb617af419abc6010283dbb510891e9744ce03cadcceea7b137395c538f42df838b1f6322
SSDEEP 96:5wwwwww6W/rQPIEXv6KvzVqzd4sJvbZwwl/j+jNj2jly9:NQrXvfzwzRu
TLSH
T1C4911623531D1CB9FD2405F1ACF89A75A59CBA0153C63C642DEEF80F69AE8C69AF2444
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

akMU.ico

Path C:\Windows\akMU.ico
Size 4KB
SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
MD5 2fb613374fd9eef57a03c8a2d2e52d8e
SHA1 345eae2c0189099b5367e22315b663fe6d037232
SHA512 74ed79d3db6211b1bbec4ca6003fecc866d84abb38987fe4a442558a520490797bf0b54c643b6b4bfc687b3be56d011e204d89166cad33174df82a86fb036f99
SSDEEP 96:xguRJDhHREoYxoJooz1oj8vJBI+L6Y1X4Ni:xgZb+Hz1FaI
TLSH
T14291E5E8D341C55FE0E98B77C2360C77E2ABDC6E8A79896E024C31D27E31643196690B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

akMi.exe

Path C:\Windows\akMi.exe
Size 1.6MB
SHA256 66fecebf1f820e23b85712f843b10f355620d846bdb44a32b2e6206cc55b547c
MD5 2aa715fc759a89ddbca3013a9c417b2d
SHA1 465c39f1a73987742cab3be982ae4ce9c84b9ab7
SHA512 7a2b690a7601f60e64be669f19f1a77fb98788a27595e43ed2dfe6e5fa061f696f437fdec19f55e074e658deb796c54d5ee7914f72c3967f5b4a754aee21041b
SSDEEP 24576:rcbLgVbqxnkwTh7OzV4B016hGPjG02Is3:mtnb7OO08
TLSH
T1147588FE26E814E9280CA77D407ACD4AB3F9594DAF34DF7976D2C04A83580C7A8B5970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aosC.exe

Path C:\Windows\aosC.exe
Size 2.2MB
SHA256 59fbb575b4e4975377d728cda6f854da30a666ec35f81ac9640ec56d4b868e9e
MD5 ac12ff0f85f7216a21e4fe3127807490
SHA1 d954786fa2de2bf8559ace83bc99aad156a5e787
SHA512 a1b041f854aed6a356cf204fa3e9005e8bb791e03a25edc678ec45056f5e99073a670946dec09fc9f1b1576281b497287241c236832476bf584e69309345fd2d
SSDEEP 24576:tjjSnwHgyYBsRUdZ7+Z/mwztbR+uHdFftJiT8WMz+H7d:tHowA3sRUdZCdmYVriAF+
TLSH
T1B0B57F48442CC934D5E3B9361C8BAA97B25DD8519E04A7C2BF66793B38EE184FED4CD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cYsc.exe

Path C:\Windows\cYsc.exe
Size 1.6MB
SHA256 6e74c4adbb98f9075889b16ce911473c08d7bedcb0e1a41bfe56892bcf330224
MD5 bf77f935acb22751ef947105c3d8eac1
SHA1 1125cea113ef18d2d7e686e3125633a32117ec9d
SHA512 3194d44cd88f521f23cef36c52c95501f2b559ac38efa4df360e3f8a9fba656c7295f9e081ee40d4a261fbdfc4edda9029e2bc44fcd6488723d4e5e8e50a6671
SSDEEP 24576:AARWiVKn1qzqjtyjBPT2mHPbOxNEr45O:LRWiVK1wqjUT9TO4
TLSH
T10B75BEDC45CFA7DC7612B788DA40062AE68B35F73F4925B90CFE8104E64B1876854BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ckUG.exe

Path C:\Windows\ckUG.exe
Size 1.9MB
SHA256 eaa082042f642e6d8c234390c51cd45cec8f26b28db6c0291ab45133a6ca113d
MD5 12388e40e97c712da8cb0073f14adf0f
SHA1 09ff9a92d6e1cd0191a8decbd3293f986d84d81c
SHA512 fdf6f74a0cf5eeff886fc24d697e5b8af9421fcc1d2f8417b8a0e7df95acfbb7a5d18f8aa39a2ee0e5049f724adce97a1feab4ec066590f168891b4762eade9f
SSDEEP 24576:j1iHklazdIWMUx7YBqVEBaoKbw0lJJmrIK+Y9CQwI:wHklMlDEcRbw0lJQ5CQwI
TLSH
T1B4953E13FFC7DC027C020A5E86C11A73075DBB862EC71085F898B52EA394EBDA566B5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ckUQ.exe

Path C:\Windows\ckUQ.exe
Size 1.8MB
SHA256 5510197536cf0c538ce779f935a0cb9aa3db65ec0de372535df97b6d97a5e916
MD5 cfafb3c91bae26bf3d8c6e6b99fe9589
SHA1 ea5fb3671140c941e2f2c68280ad666f78fbbfa1
SHA512 8ea7308a716da940177c8cd4a02ff67a62c39075362f73301828c46b23f5c72c27b47c1b0a723b2201b44f1c3b21238a22fee0374706377ebbbed879401b4d8f
SSDEEP 24576:ImmgY+E4iFuwh68WsWbECneQmcaqeSJ8ORXga:X3HNwh6NbE3cdeS9P
TLSH
T1429500FBBF2F1DDA4B3097175A9A40F44CCD8D1141068BAE0AAC7753D3BC99498AD392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eAke.exe

Path C:\Windows\eAke.exe
Size 1.7MB
SHA256 c5a2db0ca74419e3e797184b519130ab15155aabd5ae533d13b773058316b0c3
MD5 c3e57fbea5f7141aef7bd2d093b2995e
SHA1 c4a93f8c6aa19fdd30bf1cab90e92173d167b6f1
SHA512 34c2272b42df09268715d24092aba01fe9ab23a96d7fb1226eb7d94de2fe626e78bf63c5a862a87373f072e7c95d806290950ac1252fb78796efe1fed846ad5d
SSDEEP 12288:qmdPLxUOnbPZFGH9Lrhr5Zvy7S5pmZKl+trE5hFZ3gJRzOQ9x2YQSDsFsC+dGMRh:bBjZFGH93dzEpZQLoJNOQ9YSgOl7y
TLSH
T18785438D1B71A85624A9CD1EC6776F6E36566E2B18B0BDC03C3C76B470720E6CD60DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eMAW.exe

Path C:\Windows\eMAW.exe
Size 1.6MB
SHA256 29192922e5bbd25feac38245e7b60909b4aea5c0e4be4349b4eed74ef13d02bb
MD5 5b4751f8c3c6ff936fa963f71d36aa32
SHA1 c7880539bcb18d9ac000a6a3296510821b2f2c8e
SHA512 24c59005e2bdbdbd703b4298ff3e332dad9560d62c74f8a3429af682ae339a9a29cd51f6086c8bb2612b766c8214b44c3fb2208e6a26e9055da7a6e4e488fc98
SSDEEP 49152:Vr4eSxijNpXLEPmsSfkZarnLsazw/m9w07Sb2R4UY6kAWeD9+Hcg73y3OkZ2HBI+:hQAjNpXLEPmsSfkZarnLsazw/m9w07Si
TLSH
T13D755B456A84F271E8F06054F3A32B5FE16B07A8CAD74FCF5B2315B7917B0418982E7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eMEE.exe

Path C:\Windows\eMEE.exe
Size 3.1MB
SHA256 7d014aa516cd4b6c6ed59c8bc7b0e149aac2288c246ffc94658237185d09d2e0
MD5 b2c170412af4021266b6a11016400725
SHA1 3ffd4ef6527911a5f14d92f739a517175f3f1c7c
SHA512 5345be95540b54d29e5e6d5b4c1b000a2702b08bf6eeda804444c8643a02f974d8ad5d59320639c45b1017ac7e115d331e12a543b8358286d86ac13e018c14df
SSDEEP 49152:dCMJuc8Px+26ZXoV/duufg7ryPlk77pfEw/G:Ec8vBoryqHpfx
TLSH
T122E5845E5DE232AC80E971FCB6AB079FD84D149435384CE4C4509B23A7C6FA9439E98F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eMMI.exe

Path C:\Windows\eMMI.exe
Size 1.8MB
SHA256 df86ca13c17249d691b945b6b95450677994186a6887603763b4801e31a04f1b
MD5 72a397a0882de342a5f765a4434d482a
SHA1 3212ed0a4231cba41b65409739cfd6df39aa5125
SHA512 5aa2e831d13d9714b910cefa69f4987b59cb79afc603a51371a25467bb37f92c8b2349c74eccab1afe90c154882b364006583d1e786c9cc1a46a7369011f87b9
SSDEEP 24576:u92rMUhcfPhDVDUB/7wppbdSkbUcJNeBISJDEx/:2O0ZRQBGpBS0JwB5JDK
TLSH
T11495A7734BFF9E2F1BCCF190E961DD225708079842BE9750C4D68E0D46A84A6D6CF2B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

esQw.exe

Path C:\Windows\esQw.exe
Size 1.6MB
SHA256 0fa9ed75dea5751f28b6310e08183ecacc2cd850bd1d38d9cfc61f203464d559
MD5 6cd4c9e97c32a431f3b9db0316c51e1f
SHA1 c1ecebebbb5a4fc8c70fec5cb159c581a9cc0c0d
SHA512 ee472a8dda2babc123895328b5b16790592f21feba21411f7f90ffe8acb5b7251a56f0962515c7dfe8f4562e49cd897ce2abf2cf4831332fbe50d25ee166b214
SSDEEP 24576:6pb5FSHpqim3gJksHRtYVokLPaXv46pN5SUXnCJPqyHG:ebu9m3gJkwta
TLSH
T12075CE441AA4AE91FA27C637CE0DCCDE0EBD0D09501060D729F7AED589A17D2FECA15B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gIUg.exe

Path C:\Windows\gIUg.exe
Size 2.2MB
SHA256 b0d623337c074fd2763c1b088b6d635081a6236a922ef130505919ae2e757900
MD5 9140a9f46b3001f954d9df150a5ed2c6
SHA1 ec1585d77bd87c557d0fecba8a54f6734fe6bb96
SHA512 03a6fb13985146c05bc4db0423a0c4da612083d9e3b73b09a37d73c4e962c40b0423cbc198d61414e416a03dbca2cea75ea1bf9daec383a3c5208369554e2ba3
SSDEEP 49152:RBXALyF9chqflszrBgTx+5UP6ZDa2KzI1:zXAI2sErQ56ZDu
TLSH
T16BB5204BDA6DDC0B3CBC9885D1015763396FF8912B89E88BE4A00E8DFFB52E9451D427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gIsm.exe

Path C:\Windows\gIsm.exe
Size 1.9MB
SHA256 cd77b5e4f7a1309258ac8e82f9c11f6966b4e33159b7c895127911f5fab8688c
MD5 784408f96821cad60910adc386c59607
SHA1 6279e65002d8f79e00c5a8769f1934e1f4c3c25c
SHA512 a73cd57d39979dd6484c2a19dcc550ede6aa0d5a02672e31d182fcd43f7fac5aafd58d0e88b41dafa570e32bde79d60de5427f2ede0278b7ac52c4ac35b36d24
SSDEEP 24576:wd3hme9PJx+aw07Ldoi1yZJHi1NJr9Rg21k1jz:wd3hZ1JoJ0ndocyDC1zYa+
TLSH
T1C495EB0EDEF3B3D380A92952594C2DAA44D5722B37D7C3E88266BF8C669E710734D85C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gMYS.exe

Path C:\Windows\gMYS.exe
Size 1.7MB
SHA256 2a26961bd45d98fb78fc0a16ba720f5b246171ef1861d4f132d5755f4d4923df
MD5 863a409cd22629fb2df37d71d4d5adfe
SHA1 6841e89fa7b913d5e3e00a1b8b0d3affff22bace
SHA512 73a06ab1ca1a573d545e0114ba0a71d24ea11ab22cf3f4559e6f7fe25b08f919d20b407dfa551ec354b3d13fe8245f8226e8b74fea9f0179b993ce255fb14229
SSDEEP 24576:2IjDDdsNqHo7t3DCnOSNFCv/gziV504fzxH4QFiUfHk86:285sMoB3DmOvpP1HFiUEF
TLSH
T171852CF0A831F1576AC768501B789E18A03FE78FFF9944319EE9E879738B4407358668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gQYG.exe

Path C:\Windows\gQYG.exe
Size 1.6MB
SHA256 2e6a1a723f793f6cf3a4532095b288988db37f69314349a4cafd913a4e47aa3d
MD5 50e4c4b7869fae7830a90b9ab30defbb
SHA1 aebd2fa053ea504f11d4b7cbe5d7dd46891d157b
SHA512 a58c1b30408e0c4bbe5ab026d3244d6e02af8a4f301998f287d360d21fd0112a1bd0a7b518e44b4507eff6d5d1d709fc1919ce7c9d77d990d5b4618460e35969
SSDEEP 12288:4MzEbf74DLLsl+DriA3z9dXp/j8k2qNNUJy+vy3qT4gKzBEp5usz+4:4MzEl7o9d9FQlvy3qT4gKu/uG
TLSH
T12D75CC6E2CA83A5A6023CD18960B1760C1980BD893FD17B3E9656431756BFCD41ABFCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goIO.exe

Path C:\Windows\goIO.exe
Size 2.3MB
SHA256 0324ac0edecf7b96fc08e0c2664bb667b0ce7999019204632c2d35e3b990f125
MD5 38535c4c4d25d6e202c07a0f9a03bce8
SHA1 19606c6305e616b78c3307fa2992ca5baf864e7c
SHA512 d85acae7ae0ebbaac3fbc5f8cd1c9cef8577e33f29699e2315e4f13f4c898ce140b6766b33bd6a14871808f7783ca2732c87aab2b82041de212755116f683c17
SSDEEP 49152:juJZU1pJ7VyZT0XAFiqITyHgH6ZxkrMlYWW4ak8y5MF8IoNogX2Q4FxMEBCg3fxR:jvX7VMkxjG2vGDZdxE
TLSH
T107B5C4D8E09B17A72393E075ACB854F5EBE683DD4ED0C982C4A65A4019293FE70E0DDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iYAK.exe

Path C:\Windows\iYAK.exe
Size 1.6MB
SHA256 f84481b7af399358dcfa971319508d338344b3dd6d2c9cc94b0d713bb66978e8
MD5 dd8d7b820cd057e1458bfc08b47c9bf1
SHA1 2287b091250fca69a34a8dce2664237178760f18
SHA512 0dc06dca5c10bfc3fafe305a484aad637152ee9bb0456426cc0dc6ab27caa614465412d65f3e7de64d145326211f91da751a663b0eb7b0e93ce231cf1bacd909
SSDEEP 12288:rwNa3DhbUHq7pls+Z5MDnS7Fb8LHWuiI3vear/8zjhRhSNcTOX4ezGEIkkbhI/gO:rn32kFwHWuiI3veayRecTKk8+w1pSD0
TLSH
T13675B7FE7589B79948B7AB67FD52BF00D3659D3004269E93AB18E323ED85C807A1C143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iYEa.exe

Path C:\Windows\iYEa.exe
Size 1.6MB
SHA256 1f2bd1266fb2ec5ad97da76940cb81cfe0fd0f35a07f7809d57485c0fac6380a
MD5 512b6b3a1e2b6c12cfe45f411b64b340
SHA1 a0731830a4d257de466c78c1ac559460e749ab4e
SHA512 6d6f6d86f15e24d7e96984e8653cae19950e4718968c09b226473ddbf6565a33c17b46e2f34bbf7039acd5c3efc39653e207c0e03bc05bee73da2f7359c6d2bf
SSDEEP 12288:52BS7N4LAod2j31TmPNcjCE37eic/ZloMq17QeRUqvuagRLPzMqNxPudDaZrRu:5oeGASWNav+7ZRUqvuhLPQqNxPuc9k
TLSH
T13A75CA9C21AF0224B5BD6C8397C632D79422FD02A4BFF7831B7432E592B67C1C994D96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

isEa.exe

Path C:\Windows\isEa.exe
Size 1.6MB
SHA256 30bb07264b24b2cb658a7b030eea5e8ffb649692f9d552dcbecef0c2342e6082
MD5 5c1bc2525b36c19df04993e70b199e40
SHA1 be0b8f7d07b1b5964ea19d17a842c35ffee8ae5d
SHA512 3f3b0d2a089b26e9572b72a2dbb25fe963eabc5bd22daa7b4bfb5a58ebc95ea3dc53a042686c1e65e4a7ed104e5783679fab071b139cdc4e465fb3a5eb268b77
SSDEEP 24576:XN73vwlg8VbOsjXZwaHpv8CLW7HEaSIkx/PIdvrDwp:XJvw+8VbOgpwY8CLmSXp
TLSH
T1D9757476157BB6D84CBD6B355E02A2337734E8B14DB3423E9E8B605EC23349A6C8CD58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kEsM.exe

Path C:\Windows\kEsM.exe
Size 1.8MB
SHA256 621796cc3a23fa36f63ef869da33b88916d49e00913e684c5d41bec10c4e6f86
MD5 5fda8069f906ac9dcf4cd30a0771b99b
SHA1 0816b203d22d2e6f1d4c98cc9cc5375822f7ca68
SHA512 4b1ebcc1882dbdc6f800ac259d62ff03098a731b408d1a2512dca2c731cbf11e10838279aa69a013a75b9228ee830dbdb03edd8f60efe694430f3abd9b68d02f
SSDEEP 24576:6rcUbvTMR6e15GlZNVTfly/FazaALToD1AWo/h:6hToRz5GlrVTs/qaAoiW6h
TLSH
T14395FBF9E858ED4077270D966E8DB95876378822831EE7EF41407D0989CC0D9BB8F6B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kIss.exe

Path C:\Windows\kIss.exe
Size 1.6MB
SHA256 e51a03751c293ab5645abd06f424f1bc999d59670b540fb1191776ac9da5d374
MD5 72901cef3d92f0fd9e402db65c74f911
SHA1 407b304cda606e216c2ee8672b87dfb958f692bf
SHA512 0762250277c5ad6c7afbdcc7001f98e1ec2bc9da766c83e33475768d9cdb184308c4ebc567fa091849fd9e9f74a5f84cbf80074307b669a21fc563665a3b1f97
SSDEEP 12288:R+YSHhDprbm4KK5vTsFaXKKSYHcEuYI8xfeT6dU:RvQFmWZq3rYHcEuYI8xfC
TLSH
T1C47599B6AE4802AB94CCED5A03E97A13BA58BDF16F1F087817A913DC905112F85D3F71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kMMU.ico

Path C:\Windows\kMMU.ico
Size 4KB
SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
MD5 5ba7883f40b96f2cb26db5c9d431a806
SHA1 c1b4562f081d4f5030ae725b5f33a09ccea11bfe
SHA512 01a105c64ddbd4ee08e440d11ddfb6c5eb87b7dc040e07b735cb5b227895c08327d182fec4a170b26e92a7159af3f1da16551f2ef225edcf61daf877a24807ed
SSDEEP 96:J5mUGqcGqGguZuZwMgB3lfca7qHTTejtjmjFj+RIvqqqqXyy/X:NoWXB3Nca7qHTTRvX
TLSH
T17891763313880D3AFD212EF07CB696ACC5983A1882CA2C54EFEDF54AB47E8C109F9151
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kUAs.exe

Path C:\Windows\kUAs.exe
Size 1.9MB
SHA256 23a0bf17ff0c8fc49566434d54fa2f7fcdcf2cad9771e595ce0ebe2c2c7be00f
MD5 4d4470c93ba277ad6a4578f3058b5906
SHA1 2800077c4ce01884595b8c64f8d8c2d88fe5c9c1
SHA512 9ea3b01ec8c1ae78b8af08ff25c63c4e9816653aebbdf2f1ad98389028405ed44f8913e1017ff0388a1b6e0f4a217e64f15e2b94cf652ea1ff7a74c81b6f86cd
SSDEEP 24576:ypLi9EU9gY9jCUZmEL1PFhPz/zS8q39F/RUSehW:IS9b9uUZBL1PFhPzBq3f/RCM
TLSH
T121950046F3595125ACCAFAB11AF0544DA50483ECAE8BAF0B3C13E5245CEFA15F1B3978
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kYII.exe

Path C:\Windows\kYII.exe
Size 2.0MB
SHA256 cdb53ad513ffd056407d6463d02e9708f57d7e5a4fbb333670183f4e1ad4dc01
MD5 178e9ddf51387fff504a8f0d915ee907
SHA1 f536aed1d86664a27774742d3d56242adbec02d8
SHA512 71ef453200a33473afc53330b2d9322ceb55e89d04b3290fc7eb68297dab9c684842c143c6353bb925df3f92d7c7d51eb427d7e95bc62e4c4f7bb74e9d465582
SSDEEP 49152:0pmp22222222222222w22222222222222ilJvHobnw1sWDwP+khKx2:0pO22222222222222w2222222222222V
TLSH
T1BAA50CC2C2D5AB184EBE037F8584DB8D5845DE426BA661C402102AE3C846DFFDDE7E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kYQE.exe

Path C:\Windows\kYQE.exe
Size 1.6MB
SHA256 b8386a3ad94c49121caa12c917990c342bf683b1d3de50a83534a78d74f25a89
MD5 b26a324137d66b00ed8d3c8d5c42371e
SHA1 ff61bfa12ba0a636ce16daada0923685e7081674
SHA512 ae30b1876063728ec6ce3ae55a81c6089a4ec9eff8a52cfec64626ddef8d4100044e7d075ceb820bb1c5ce0090b8d7658d58efbeb58b88c8105824ce1cbc8aec
SSDEEP 12288:7wp9LbD5eFfFoYFEaw0TAugYeeCER5/ML/lE1fVsj5tOKvFd7fUkm0d0lemtFmHH:0p9DWbualTA5Yc6mvQe
TLSH
T1BD75FDDF3984697EA6B1B5FD42E0542C92482A37C43DFBFBBBC12CE55121882DDC8925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kkoq.exe

Path C:\Windows\kkoq.exe
Size 1.6MB
SHA256 9dd2fd0460e972632dccaf978183f7194ca4cfd2a09705d0a17ba68798b4770e
MD5 ea000d4635c0fb5508253e76838996bb
SHA1 9ed51efd155f02e24260f241dd4dfc24f8ac19c0
SHA512 4f7d67a9afb10efa7c7bf4660d88bcb6b682ed410dd1c279962d13b1997267914dbcfee2af5cb0c10ee9d687d56e1f98f59c6de6a9357784c3f05dd2e442f083
SSDEEP 12288:j/4x8dH9r897wRGuCoN0VcNpAlqoIyFqgpswAh+aMkbg/foEbi/7IdkIltAD1/vL:cxGr897ht0oCgp0Z0/foEW/7Idpk/Lc
TLSH
T1B375AC1CB0C918DBC040F7A57939415278BE6F0A97F0A9509284DBDFCB2F9DB25D4AB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mKso.ico

Path C:\Windows\mKso.ico
Size 4KB
SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
MD5 7de70c5f9fde94ce0179324aa5720a58
SHA1 b34c69a980c52938d5b4377376adf15fad17dce6
SHA512 0b5b089bb8ae1a97e4a882f7e35c7295cb81127f0915379676590a2af296012782192381e2bf3d010f0a1c693e2eaaa2f083fd8fdd7c3191a8537b4553676ef1
SSDEEP 96:dic8fY4M1c/wHtOMreoBKc/0+ktbWrrdT+AP:dilkc6OMreSdStbSCA
TLSH
T10A91842274B416E8FA7DD977E242E0AB0E723C578B41422B71D3F7A70C710D81B0692E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mQEw.exe

Path C:\Windows\mQEw.exe
Size 1.6MB
SHA256 d57d1cb39e1a77fe120eb3c8396357bbe7771120b1a711ca1f1a9704cece25e1
MD5 cb356976d229234253a02c1a5365f27c
SHA1 2b3066bcf679cb05638c4cb07786d1ad0df82a0d
SHA512 4243596122bd606fdceb7fade46c0d33ffb9cff3859004f9924cc4f9f5260ba37240746938c75bb5cdb0b988b2dfb37a89a72a312077c673efbf66df377f8633
SSDEEP 12288:7hwmPaK2glHr3R/o5cWsPDwG95mIwbcJcqyZDXR7VeKEJW:7hwmJ2gL3RZrHdlChRxRE
TLSH
T11875CCEAE45614C822A4BF16E611AD6EC2D5574C7092B6CC0660DBF30ACD3B3EF8475E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mQoK.exe

Path C:\Windows\mQoK.exe
Size 1.6MB
SHA256 5ddcaeeb4ae0d5e30a29f8e0e021a70d9671a47cb036723ad9447373f91ee993
MD5 573df96c7975e1511c9fa2afbd8201fb
SHA1 74e0f28094591d2319c0ba0c9a0cd498904dbe96
SHA512 167bcff414250a441ea84e9dafaa3fc3dfcb17109c437e7d7e7dad981d4ee3bdd7ec5c6148019c191adada000330d14062dd7f5ea5f782ef67a65266022205cc
SSDEEP 12288:wFGz24BDC+MIfTo87e8hd2/6lqjYGpDfpOe4ozVARjdriWR/a0RXo2foZ2XvIP:wszfBDCTIfTH9lXODRBpAfvXtdA
TLSH
T19C75841C8614E6A4A46F3EA177A254E37FD78C6A1E003B8DF9B140D4E0E12F6D1A53ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkMW.exe

Path C:\Windows\mkMW.exe
Size 2.0MB
SHA256 7fe650cdbf2965e2736e0a6d1faca77f583bca804eda2ff5a318b3a934e89e14
MD5 eff98675817d47be71a598decbd8f072
SHA1 d70a114e9d38fcba7308bd31aaae51bbdfe6b08a
SHA512 66117dea525bed63f830c68778921c1e9eefaf6604779df28268e1659751a2750c0ffe9c92adc4c51827e6a2392c318261dfa34706806a159d6aed099669380d
SSDEEP 24576:6/iSLkqU1a+/pthr40jKCuJzOQZHKSqJ:6Ac+bq0jfoz55KS
TLSH
T16BA530FBE866D4937DFEF8B84C1859F4D660E62873608E78AE33C19AC72724047D5A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mwsg.exe

Path C:\Windows\mwsg.exe
Size 2.1MB
SHA256 9ca5a9605c09fb82fdd7630bd90fbd9755f802d9d5edf1f675d2a14172e74cbb
MD5 cc5501328d8332d274d2a26e46445354
SHA1 1c098a30aca693200912df69923a941aef25e41a
SHA512 a0146f4ba6dc602eba80ff5a44d15c3c5df292af1b65f06bbe31580f75416b54459bddadb362b79b90befe28a25a9b2d37dc76f083f349dd07817808ecc77125
SSDEEP 24576:naJzLEFAX8V7iNfBQfE2n2JUTIwrTBH4CbLy7aSzC2VXykn6:naJzLE28ZikfDI2TurzfJya
TLSH
T1A4A5FD16E7A5474C5862A2702D5F84CD094423071A72AB4F3CE5FD22B1BDBF6D8F622B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oAIg.exe

Path C:\Windows\oAIg.exe
Size 1.6MB
SHA256 1c0d3bb8782c0f89b64af3bbed41f9fbc4fcaa597af65645e5ce0a1cfb7cb0a9
MD5 92da1ae0deb25a1643d1a8df1249b9e3
SHA1 0011c7b0f1006b5626360df26654b957bcd2d6ba
SHA512 89c5c196f189ba0e84fa4c0da182020202ff4fdebcd7dcc1cbe66485ab022171d6896a1cb61ebbcc5ab44004f25ace20e6d5d1f70da2beb7edf72af763facf46
SSDEEP 49152:snib6wgOTrynZpd3awgDh2RMQJA/+WhrZ8hzGWCG6kR:jZ2KWCbkR
TLSH
T1A8759A30AE26349E466D65D61F72BCE643630EE16E9335228973749F33DB2C8B45E078
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oAcW.exe

Path C:\Windows\oAcW.exe
Size 1.6MB
SHA256 2c2d710d8448e0f8b32231bccd652f5623ec0a511443f801800da85eec8ad680
MD5 62d9f4d4d8a8883504fc6fcf0d6826a8
SHA1 5d78c33ffc9b93a1fe2afe6f86622e4d7e5ec46b
SHA512 4667d3277546491ca65bc2d3f4c618eee39a01ee7f1c403a464dee0c3dfb737845c174694e8c89e9b9ef822e27645777523e9978fbc654cf2ff53e6f03a6d5ec
SSDEEP 12288:xhc26DG5yRE59UmjaVGtSOT6DtF0FIonTY++0DsOcaYT/dnsCO7Kopc2H7Z:x2iyREtTKEFVR+0YOchDdn22oq2
TLSH
T13775DBDA5057E0A1F2692862C61E5CE39CCCAC8CED6242E6AD2071FC7FE06F645D507B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oeoY.ico

Path C:\Windows\oeoY.ico
Size 4KB
SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
MD5 11f567ee7cd81363d091bd0a1e6e57b0
SHA1 506bacdc816e7638ad6cf2c83e40a3924a72d8c4
SHA512 beebe8b70fc370737b5f4abba21a2301fd5341c3295e483f51eb03d5207090f662d2e19d3fa2b534ec51745d3eb399ccf0f1969aa3ae80b0543849133a8a9dc5
SSDEEP 96:hB3cOiEOiOvss4EVCd3jtjmjFj+RIvqqqqXyy/X:8CdkvX
TLSH
T13A91BBA223090D3AF9DDCFF06C9BB65595493A404EED29DC2CACF06A217EBF609F1000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qEAG.exe

Path C:\Windows\qEAG.exe
Size 1.6MB
SHA256 1b6d179505601c9f3d995738b652e4e0dccf6765348e010396df0c6667aca4cb
MD5 b8d3b8aadccdb34363caf2c516d7e508
SHA1 3a149234a545528268168edfdf14e59f9e790521
SHA512 89e70723083245520fb37ef1914537c73ba65766da06a2976181197402e58317f687a18970e215e2d6bb6d71afee1be3a8cc029f6f0823529a082e510a5e5aac
SSDEEP 12288:OQbZixd2qtiGvOVUKTMV80XzYPb4dmO6gARnM/NLrQFe/8SecokHvEN3KFq:tN4tNWAV8YzY8dmIARnM/NIFeLZc
TLSH
T1C7756520DEBDF9CC6E74BC1125AC4ED261EEE8714DB8FE8301461BB5EA504D985273AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qUkU.exe

Path C:\Windows\qUkU.exe
Size 1.6MB
SHA256 93fafeffa99e5d4addb40076c4a80ca0ccb2663458c745cff432788a556c3e5f
MD5 c5e9fd90d3297ba6e26e45a42a3e0522
SHA1 e3af29d30087d487c1912e7eefb5e670d94e8767
SHA512 4d0f0a2c9bc3857842fb29e69d1b9e627362cfd7f3da4f46e0c44de9d8c5f68e412e2a8abbf5c11fe3febdc5fbbcc94dfc35b396d3555bb9479996e9193436cc
SSDEEP 24576:0zimSY2viM0XhrfVY9RIffZ0qX8M5niV/ARaZtT86:0zJo9GfZeAniV/Ac
TLSH
T149756743C9273BB2E080C53C3B9A046DDA77A2B11E1B89A7765D3DEC27B90C92597DC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qcQG.exe

Path C:\Windows\qcQG.exe
Size 1.6MB
SHA256 0242e26ac2eff0101c0f4e4b419e01018eb3040ac59f8037afa3d5868f67936f
MD5 567caed796f96e7cceaf458307bf71d1
SHA1 ffb032c701b2c8207e186ca49f6e70c058dfb7a0
SHA512 2ee9ef790d9392d6cf06a9012b0d6e7960c6810c02396befa57e251aec5beb23fc2f4ab7a63f2bf7f542808f90f9cbb50d75a608a499ae43020bf48ccb252aec
SSDEEP 24576:f+iO1LQD5Np7+LA3gakgxTItxQSFuXftZ:nDLpxxEtiVXf3
TLSH
T1F875A75829E7E817964D241BAE0CFD4236D8D0B4F196E301DF25FE830654B58AAACCFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qcsm.exe

Path C:\Windows\qcsm.exe
Size 1.6MB
SHA256 37e8a12333fef7a0bd0c3c764533df2f1028a6162ad3d97005fc308588d95295
MD5 e5250f085fb21361f3cc0f66a8dc8974
SHA1 9df17403436c8e5ffd1d1aee8ff73640cffdd99f
SHA512 b627efe31f68b715713642119c99e1743b2cfc38c73d083d3708d18bb5ae549f5ce0bb65270eaf2fe6389d7f455e6cc364814eccad42298ea62c0038164c4920
SSDEEP 24576:K5vVwOxz32Ck9C8o5PPKvSpSAXi4ee0PPdQ7TWQNk:K5vVwSD2CkMzfHKXdSWQNk
TLSH
T174750018C79319938DE1B83F9FA868414674967C979773DB222AD0FFEBA9D870334448
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkss.exe

Path C:\Windows\qkss.exe
Size 1.6MB
SHA256 7f12d29171b02d38e57cbe90aecb842095ddb8c055b1c5fd3a5b3ecc820dfc3b
MD5 4c95dccc428ba920b16a22f620639695
SHA1 fe06a26a210ef4ac6e45c025dcd17fdb85e7609e
SHA512 aa5cbefa4553db041642a6ee75e259fdcf87580725ca5d39dab0e4ad11da182ade14fd8004ad86f0c66d362f719c32ce73d6fcb95a1c4d715afdb3f7ae94fb6a
SSDEEP 12288:Zxpd37iZiXJZABRQuPJKdMkA5I+Cf1+E6Ry8+Pavi7QVpSIOqGWVen:Z/97kiIHPJg85I+q6cyvi7QmjcE
TLSH
T120759B07F52C6BABE2464A00BE1C98112C7BEEC792E457BDBE1759116C8D412E89FF4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sAAs.exe

Path C:\Windows\sAAs.exe
Size 2.0MB
SHA256 d0948fe47482e688edc2e3cabd91d324ebca050101bd3e395b0453a96e4f90f1
MD5 c9fc7ad1076dbc14580c179561104b6b
SHA1 9b74994fd1de9dd3bc5f40138f9c84c1dd22aa55
SHA512 e6c6444b78ca9f76c5c04382b65ef6b8e324bde6f2acdf332e6cbf74280b10bbc33d7e64edda11e01f587698b1dda4e16e204058013666ddd458b08287a066da
SSDEEP 24576:fZaTJfiWNODrjUf4ED8dPTuNZyAxnbVaPjI83Bqypi+qTX6:fINvuXK42O7udbV9KBqypi7TX6
TLSH
T106A542501CEAF2FDAE426C8FA2DF3D09B109E77D5C382F64A4698D6F7404DEE4296112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sAQg.exe

Path C:\Windows\sAQg.exe
Size 2.0MB
SHA256 8f5b9fcfb274d6ddf6733d677215074c83a4af90aa497771108d676dc8737873
MD5 820e0360d2040604016e6df01f5197f3
SHA1 d2bc345abce3b292e6c5fefd9aab1b5b416d5b21
SHA512 0b48de33e0e7b93f82e754479d048dc4ece137c54c54dd3e7fef440eb70d4504e4f0e3f2c57eca881187b0dc90c46c23e8dc5176bb11117b4d6bf7372289349d
SSDEEP 24576:+bVuIiortu2M0lFpPTCYZ8idZ9i/faB1QdKTuXN:+Uorv3TCYZ96fa+KTMN
TLSH
T134952E0D523589DF149EB273006159AB1E0EAEB09BC76106BF490EE58978DFD097BC3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sEom.exe

Path C:\Windows\sEom.exe
Size 2.1MB
SHA256 8d234c1fb8bd1d25e4cdb4f4221b40253963dd7c64107d502162238f50581264
MD5 d36d3e477b86b329eac7a76ebedc5837
SHA1 6195c5cbb99f79da59ea5c1da5c4fe72d6d125cb
SHA512 c5d901661bcde3d03d1bd584c5fdb828d6189275dc798bd55fd5420b0f38176f9549b5dcbc9372b730c71fc22ec2114d6ead269bc6ef0033b2ca3be3d0b57cb4
SSDEEP 24576:6wu1Ay0d45TLj86uZ3ihv7UaiFJAwr3qmjEi/0+MwLkJZOGbKEjx:S19E4J8xEhvI9FawLkHrxZOdE
TLSH
T13DA5EDC9CA3732A6CED6446C3A062197F5FA7A15A10157BD2F0C8007E552FAD22E74FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sIIk.exe

Path C:\Windows\sIIk.exe
Size 2.1MB
SHA256 cc852f93fc928f1133f583e197f38567468d6c5e9f3b77efe246bb85ebc81bc2
MD5 3f7ac0ee07dbe8baaebb0d9d5d42b02d
SHA1 e20fbebe1e12fb414841f86282104c9dfa6f07f2
SHA512 b08f76456c1a3e1026328283a08468ad40f2f03c66c5a830ad68932de1d02afc066dfe436b2e91a48753e0899b4389ceff55e939e2d15bec39e97e214fc2b3a3
SSDEEP 24576:qeACszK6SkBR46ekBbS562geWTe6iKdX5n82Wh0hL9jVyaCQ:gCsezkBR4HkBbv2v61pPRjVyO
TLSH
T193A530E13B3E9AAA4CE5E0FC79F41DA7F2212D684AC952E036157F674812346AF4077C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sIgU.exe

Path C:\Windows\sIgU.exe
Size 2.3MB
SHA256 96d04f709645464afbb83fb367810418b3ea0de97b3263ecd6ff21aac03c8271
MD5 fe73f8bc5a5d9c47a11679d19385ad59
SHA1 d0a583238996dcf9398e9d0960da45e02affeab8
SHA512 8ae5fba650239ff8141c06f96846f8ff38e49ad4f472e4229b26e54162cc5bfd58c75173f3ffa96757d40a776760f8d0ef50711fda2dc54f388091792637b582
SSDEEP 49152:7wQz3vxreNxYTpTZ8SR0QeR9DxShVMEx:0SvlevSt8SRubmVv
TLSH
T107B53E5DDA3444888CC7EF778B64F2D126CB69DEA0B84B44C8F474AB11DC9422CED6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sMQq.exe

Path C:\Windows\sMQq.exe
Size 2.4MB
SHA256 e219d3bd121e08507a8f7c3e3d0057b322c6998041f0c8d6376bf53f55f86dfe
MD5 ea5f13039b24ff8ecb5cc1b64ab5b75f
SHA1 10cc9152a14f24c9052d95fa4b14fc5c3567899d
SHA512 496ae800c4d6981f3189578637058320015888390370d724bd55af608253f5dc62aba94b407cff82d332870ddfbf14cf1d2c248d068a4c201942dd46fa5b2854
SSDEEP 24576:Uc3MgBmKL/ECXXBX6TWaRtAEPzJm7SnJyNabCEberMMve6lvj7Bi6iUTHSv0faj:h0y/5BXVwAE8SnMIbCPlJxisHSE4
TLSH
T181B53DA227DDF7252BA8783A00C00935D662F95C682B1D372C5DD9D89FB6F136309FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

swEe.exe

Path C:\Windows\swEe.exe
Size 2.2MB
SHA256 7ba47cbd6687b32a2ca2484fce2eac41d431b9ffb80fe3a7189167f611750286
MD5 ad79d53662010aa8d3147e31adba0243
SHA1 60eda20b913a70c35f359a2ee7ef31944bab2b1c
SHA512 55195279d1cd1b5cd0e5ad8a7e667ba21e4a2adaedf88e7098fa722da54eae3cdb457a8f558f07b57df52a62eccf3361c2fb4a720a8f8553d845d604afc6d3b8
SSDEEP 24576:XdGdg0JfBN8E9t580AI0gWKEkIa7U5B3QTYbqNRgb2nPdcesLwRnOUYx+:XUdHJh9gI8zBQTYbUyqnFicMm
TLSH
T1ABB5B638DC6A80E4D292900D5C06E2960A7AC9F3AB925FFDF2D647DF591D94CBE43D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uMEO.exe

Path C:\Windows\uMEO.exe
Size 1.6MB
SHA256 9a363f1d8d58a0eb9b7d27fab52fc199ef52cc1020530a810661ca5c9508d6d1
MD5 2f10c65649cb0337531c8307e0b2c02f
SHA1 8c00e23973ca65a342ec2df1d178ccec586f0d70
SHA512 6b0f4742fff6c417137541efb4e720164df46fe86c2521eac004d9ddd010fcc935f40b20609d2403ebc9607d6239df519f1461c24cf9188121e57f1845483d28
SSDEEP 12288:PErvm7u40mx3Aan5S8AVwTBekVcFp+tOfzQiDd9hvR3C8:PEa7uLfaY8s4BekV
TLSH
T18475470E1673C6C2D4361EBD9E809F845E09737B4102BB990F485E9E94D686A1FBF07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uMkG.exe

Path C:\Windows\uMkG.exe
Size 1.8MB
SHA256 9b5a3f5f28c9c490960063af9ed45e1be4a875e3b8923876b6bcd33dd6154ad8
MD5 8bd09ac1adb6c2e9b18646d6f0866481
SHA1 3ccd6ba3b460ccad8de7c2ad569322663338295a
SHA512 f53ef6bb947f28109551db9bd5960da2fc984909fef1273744f923549d4a28c268d1ce5023b46b0180889a7ef44e0cb356dce40ca567c4f480110b411045cbb5
SSDEEP 24576:0f9IEKEPfzDvmxlGaWi5iRHGtOttEv3F0UAcFdu:0f9IERnfaWi5iRHDwF0UxFdu
TLSH
T1AF85ACFA66109E7F803143117EDD16E63BA08710BFD02EC52D71FD16294AE7A631A89F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uMkc.exe

Path C:\Windows\uMkc.exe
Size 1.6MB
SHA256 dd5f1ca56544d5742743c11e7c6eadc02493c74c79fff8de22f16b953f084e3f
MD5 f3b93208217003d59d6c368334b9c48f
SHA1 f99d822b09aef8845126ddeab5f5aedc33349ebd
SHA512 32ebb53eb56c5e7acc34916c81e13ef140a13f11234d79aa0afcd7632ef48aca76323124ed3b5d0675266352a7ed6d0cf8776cbce7d0a3d54090dc408f435f31
SSDEEP 24576:jDlqPr4HuoTmoYuActUT8RdEwLMgDDnVCI4FgYVh:nlluCdEwLMUAI6gYL
TLSH
T1177597ABF0ED68A584670CCA5B753CFAA4CDDD577A2641305E4B30E74271F2BB9022C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ugkW.exe

Path C:\Windows\ugkW.exe
Size 1.6MB
SHA256 c4912627d69c536bbd35913e506a9860935d91c6fc9882bc99aeeb5fb5b6600b
MD5 6447358c61e07764d612909a143bfc18
SHA1 aeb812e6e192572bcbd15c63a2f5b859c0ca4e47
SHA512 1bf3541460aea121436df4edbd0c32a6812453927b528a12b0660bab69faa3b8fc856e8a81b1eaccbab5e7b2602a6b68f3c7b21fde6ed50ef14e57686350c80f
SSDEEP 12288:g3/nfAcMWWoos06r2F1zCCgfD5AItXgliDrP2sqEeEekiYsh5cDJcb8ztLS4AIMY:gPnYcyo1pBFwGMmxYbSCX4wXc19G
TLSH
T139750FB033101E62F05A26A59485EF9357FEDF3915E378047E2A954133ABEFAEB74900
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uoko.exe

Path C:\Windows\uoko.exe
Size 2.4MB
SHA256 71d98845513b19612ed54724fb9ee2f4a4958c7b2959d1fdbcba1b6e70d795c7
MD5 f961a2da27e8a44580afc13a0e2d9205
SHA1 8339039a2eedf70b10e059783d8393f0b801414c
SHA512 cb93eafd4f669a9c123c8e5e86fb32d722adeb69c91348efec0adae4cbef83ff48b97cb159c560bdd13e84df49e76918a3937fd5807c08565dd5766358d9a4a0
SSDEEP 24576:tTlPSJahSBtPy3kfMbJpazQNagt3390W/V4jnU9CmAjIS6M2OCW4WK:tlPWasOtbJpa8Nau3N9+Q9CXtPw
TLSH
T1AEB595A267E22E4B205A3A818730919FC67796BFEC3FEB0ED5D7404FC4243E694A554C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uqso.ico

Path C:\Windows\uqso.ico
Size 4KB
SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
MD5 ac4b56cc5c5e71c3bb226181418fd891
SHA1 e62149df7a7d31a7777cae68822e4d0eaba2199d
SHA512 a8136ef9245c8a03a155d831ed9b9d5b126f160cdf3da3214850305d726d5d511145e0c83b817ca1ac7b10abccb47729624867d48fede0c46da06f4ac50cf998
SSDEEP 24:su1Flj/XygwYAaMiM1E2/pkQ14btLH3RJigg1Kjq:vFlj/XygFA28BRkI4btLHhJigg1Kjq
TLSH
T1579127351B08C4E4EC5AA53182A706F708AD2CC3D1B4D47B52F07D7EAF33B72691166A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wQIE.exe

Path C:\Windows\wQIE.exe
Size 2.0MB
SHA256 ee5c85e88578e43bff9f098ca37e85a0a1461448743d0cbd4c358c6e72773f0f
MD5 a41e9b87136ff5c5395276950e468e1d
SHA1 d7f588419973d787ed2e0a27e6ad5b2204132b84
SHA512 dbfd046a00e8400e8b6c5c26774814cae34c58fe982cf1c1e2b41efc7de1bd7e092a95ace95ca1204530817825a2c3ae2c2f9b05692fabcd07f739e8c9a2dc73
SSDEEP 24576:6w/CmpgNjSginnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnc:2mpgxU2Bo/ppHtO0+WecmLcPW3
TLSH
T103A5EC035D60A7D777C29132064F8B6E680E5511A2D63933ECD5B931BC3938F91A8FAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wQUI.exe

Path C:\Windows\wQUI.exe
Size 2.2MB
SHA256 89d7f285ab6d1da680288e277ac473cbe4b29d23cea18389066b020ebc10fe55
MD5 b1aafd240b3221324e3bd564bf7421f6
SHA1 13240c5aae3b3086b3b96a3910ebe589a17adbf3
SHA512 9ae2511831297f1d6f222d77ab4cd753a2099f225120eb9dc0605a416f8db87511dad86db57b83f247f26dbeb59bd74c37177538128527ffd913711a1c372a2b
SSDEEP 24576:Rwm7YaDdVyFtqPC11omr5HFRtgjN9gGop4AFsFxjWB:RtYWIFtqPMomNTtWVo+5Fxc
TLSH
T190B54D6212F40BA9E82B3E09267F082797769530D7DCA47D5C2C2458FA27E7D2B3E543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wQsS.exe

Path C:\Windows\wQsS.exe
Size 1.6MB
SHA256 d9b9d006bb0b559b95d1d84fcb540ed411df8b1cecb149107c2a4fcedb6502ed
MD5 4919ece2283f9a680fdeb881c1697843
SHA1 3d6013016b91d85e795f335ebeec7129d27a5167
SHA512 03692dc0dff28955fa9fd246ad213018ec5c1ac7b4e31c10f0e3ebd3b033c4fdc40b327efa36d07023d81a1100ea1ff451aabadd78ffb5518ffb5c79349dbb55
SSDEEP 12288:zDaFWV5lFww9gGDSC857OMG3PqlO6SlkwgFGC41OBUwr0V69VEmW56k:9N3//qw1kwgFT4EBUwwV69Vk7
TLSH
T1D875F1756889B58362C9D27DC33FB032047DE1889A576E7BA5E34FB1783E4628D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wQsU.exe

Path C:\Windows\wQsU.exe
Size 2.0MB
SHA256 2120ffbd808d6b60f83ea27836c8922f9488fb549f234744520c107787671ce7
MD5 ceac5e798cc5ec38b5b0535c3dfc1b8a
SHA1 822afdd581cb69b24a1ed71a2815f94551533fe3
SHA512 477e0f9baf10dd1002215a21e2bcd183cb327c688e44b549ef26e883c141c44459ded05853c5b4b93938784d80ee0492432aaf779bbd9b56146bcb9ab5f65557
SSDEEP 24576:AttwSTaJb+ifCfV+HIR4tXTphuoLddVD7j3345kZjOi:AttwoaFjqfV+HIStXlnJdVD7j4Od
TLSH
T172A5D8973C5E69BD1F4422A240DF1E04CE0753BE95FD8D6E034AFA62439C450A3BE9AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yAAc.exe

Path C:\Windows\yAAc.exe
Size 1.6MB
SHA256 28d92483b136481fc96326640aff457f5bcb14f60e5c323b74da3bef1763cc26
MD5 193a89e0310108738202ba6a7534935f
SHA1 2a8fe88f07a8bba43f03e2f4b63dde2b858665b7
SHA512 5b367b008951cd586b1483d1e138e1ec1bbd802ec45c8a8580906c8cfb5a5f402179442a9469038897667cc04b8540789792ac5d33f625ce583825faddbe44a0
SSDEEP 24576:wUd1T0WG+GXUGo5gOlGH+aGT++GW9x5dbV0LIx0Ur90782bj:weiWx5ULIx90tb
TLSH
T13775A5166BD6FC02148FB0E15A391EAE3C3F59DCF2AECCC04159629DA625D6C4DAF4B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yAQw.exe

Path C:\Windows\yAQw.exe
Size 1.6MB
SHA256 2bb02f29f3a05dbe9c45f22d34742a8dd81c86b65c04c26ed549dc9de36ef647
MD5 37a7e74b708e53f586ac2781d9193446
SHA1 e31623b619b57bae9f42c3f485c9966d5f724d78
SHA512 a4052611a171d2179c2b616c8715185388acb37c80198fb5ec87d374200b8d091cf1453a2ff2eb6e1a9651db7744bf28b567d2cc701d67203021022a990e99d6
SSDEEP 12288:q3TSSDSU+SS1SSKSSTSvSjcSRSiSNSSwSSLgKgpcU3wEUXwkU3w+2SLmbNcdYyFK:q7gKyFNkwkQXcEdZ6V/t9z/a98
TLSH
T1587513B43A873B486BBB5E110148764B6306D951A7603B40CD82DC6E9E7EEC244F7DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ygAq.exe

Path C:\Windows\ygAq.exe
Size 1.6MB
SHA256 e87f7546d21881f227d1790fec37f287f349f16d7c0847a84848c2a210e7335b
MD5 3968230e71837f52a048641c6e7b60b0
SHA1 57c3069f6491eb710528eebebda76b3511721d85
SHA512 3f4a4ba51fc1452a08742f6668cdb5799489142c5da212601e9bcbe9ee0765d5674442f768ebd851e37316107d1e3a2a9085674a7d021051fd8b469f2400fac8
SSDEEP 24576:ZMM9jq9zlsPrRreqBPx7esjNkkoGC2pg3Xs6p5V9qu3Nn/UoGY1s:OAk3G5gHs6pj9x3Nn/UoGY1
TLSH
T1E375A966FE859C7DD722907CC17C0A54273BE1966B881BFA10F69C673FC2AD70600D9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywUm.exe

Path C:\Windows\ywUm.exe
Size 2.2MB
SHA256 aca383fd7a3ee73e40b6bd0b7a837330cd8dac86062476f7795b09dcb278cade
MD5 e7750eac2507d557f1ff6ec93552c9e5
SHA1 7f42399a46c8937ed3c2b9570a98bc8dc9689402
SHA512 9d08e8125d9d5c1cbef87e8e330cf3c1c3cad1e8ebb742aec8a2c3ef70e43e25dcbfde0ca08110e710e179edb5d38ead95d5df4ca27083e64f87dd160122b661
SSDEEP 24576:ZF7Mt6squ9F8/HU0TyZEvwLWvIcqRqdjLTV8eGa89faDMGz0NLThisGAF4jn9L:q6Lag04d9q4dB1S53nhisl4j9
TLSH
T104A52FF092D38BE6A640117C76DDF96098EA75B83EF8491142E931C616B2EB3C0FD356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-97-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/1080-172-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/1080-156-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/1116-184-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/1296-112-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/1508-1695-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/1508-39-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/2140-127-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/2260-36-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/2260-37-0x0000000000B90000-0x0000000000BB0000-memory.dmp

Download

memory/2260-1-0x0000000000B90000-0x0000000000BB0000-memory.dmp

Download

memory/2260-0-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/2308-238-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/2732-227-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/2856-1677-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/2856-20-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/3332-1667-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/3332-7-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/3476-66-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/4180-83-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/4188-16-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/4188-1672-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/4320-198-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/4596-280-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/4704-259-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/4712-216-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/4824-52-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/5132-234-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/5132-250-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/5348-1682-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/5540-358-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/5564-154-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/6036-140-0x0000000000400000-0x0000000000592000-memory.dmp

Download