Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/07/2026, 02:51

General

  • Target
    2026-07-29_303972993a9f156b6df7b6488f0f2fe7_elex_virlock.exe
  • Size 637KB
  • Sample260729-dclymsfm61
  • SHA256 1ba67a3f551fcbb13a03b921bf9f3209060259ff96481b8b89207861aa4ce95a
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Renames multiple (80) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-29_303972993a9f156b6df7b6488f0f2fe7_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-29_303972993a9f156b6df7b6488f0f2fe7_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3760
    • C:\Users\Admin\qIsEUMoE\VeUccQoE.exe
      "C:\Users\Admin\qIsEUMoE\VeUccQoE.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:5584
    • C:\ProgramData\KUwYogsg\FkwIUQwE.exe
      "C:\ProgramData\KUwYogsg\FkwIUQwE.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:1040
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5640
      • C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe
        C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1632
        • C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe
          "C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe" -burn.unelevated BurnPipe.{D88D50C4-69B8-43D2-A9F3-253848FCAB25} {AF911A97-BA07-45BE-86DC-33B8895BA6A8} 1632
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4592
    • C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      2⤵
      • Modifies visibility of file extensions in Explorer
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:1352
    • C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:2928
    • C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      2⤵
      • UAC bypass
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:1488
  • C:\Users\Admin\qIsEUMoE\VeUccQoE.exe
    C:\Users\Admin\qIsEUMoE\VeUccQoE.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    PID:3652
  • C:\ProgramData\KUwYogsg\FkwIUQwE.exe
    C:\ProgramData\KUwYogsg\FkwIUQwE.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    PID:800

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        FkwIUQwE.exe

        • Path C:\ProgramData\KUwYogsg\FkwIUQwE.exe
        • Size 188KB
        • SHA256 15f064af39eba36a1f6cf5665b2cff1b9f801c3842cee83403efb7ffdbc7097d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FkwIUQwE.inf

        • Path C:\ProgramData\KUwYogsg\FkwIUQwE.inf
        • Size 4B
        • SHA256 6aae309b53022519aaaaaac6537944abd4c3e9e0f3eb4a9dc903269be3dc80a6
        • MD5 SHA1 SHA512

        FkwIUQwE.inf

        • Path C:\ProgramData\KUwYogsg\FkwIUQwE.inf
        • Size 4B
        • SHA256 ecb1efa3d72ee4de1101910daae334dbbbe3b4f11387c902e7c38cc0457c9a46
        • MD5 SHA1 SHA512

        FkwIUQwE.inf

        • Path C:\ProgramData\KUwYogsg\FkwIUQwE.inf
        • Size 4B
        • SHA256 3e4cf87e7ad7b8bd8ead10344b96b29a34333186de2aa97cc97b683dd1d0068a
        • MD5 SHA1 SHA512

        FkwIUQwE.inf

        • Path C:\ProgramData\KUwYogsg\FkwIUQwE.inf
        • Size 4B
        • SHA256 ff2953ce9bebebe211efbb299b6e617cb6a2d73748539a8d57445bc84a83c9e1
        • MD5 SHA1 SHA512

        FkwIUQwE.inf

        • Path C:\ProgramData\KUwYogsg\FkwIUQwE.inf
        • Size 4B
        • SHA256 b08c0ce1ebb3781ae6b8ed0f86d6c47f2cf18a0f0f6106d4ff473d343c4cc302
        • MD5 SHA1 SHA512

        FkwIUQwE.inf

        • Path C:\ProgramData\KUwYogsg\FkwIUQwE.inf
        • Size 4B
        • SHA256 ff49219e94aa03bd004d3d722925d34926865c72d68c58cf65064d3d661cb149
        • MD5 SHA1 SHA512

        FkwIUQwE.inf

        • Path C:\ProgramData\KUwYogsg\FkwIUQwE.inf
        • Size 4B
        • SHA256 78c3a69d85fa265dc6696fc51b8b69846167e8580c604da4682a3068271f3746
        • MD5 SHA1 SHA512

        FkwIUQwE.inf

        • Path C:\ProgramData\KUwYogsg\FkwIUQwE.inf
        • Size 4B
        • SHA256 aa92b1fcf864fd5328c1d7d3aa7be274e11700e4b3593be90a0cf82d2f86c7b5
        • MD5 SHA1 SHA512

        AAsY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AAsY.exe
        • Size 437KB
        • SHA256 215629aead7972123cf2674e01bd50b0758400c13998bcef7f665fa84f3d8d1a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AMAS.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AMAS.exe
        • Size 683KB
        • SHA256 4f84452ccf36d6be1922ef6f8b27e12276ae5484c1a7c794dbccf23905bdb99e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CEQQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\CEQQ.exe
        • Size 184KB
        • SHA256 d3c777d6a87631572ceb1fb17140a1969c46d3c7ae946b9bfb5d0729d7231779
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CkYQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\CkYQ.exe
        • Size 574KB
        • SHA256 b9961fd80f7db5d2f2b432375dc2f5f2ee165ea72454acc21ca6e47542e43b36
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CsYA.ico

        • Path C:\Users\Admin\AppData\Local\Temp\CsYA.ico
        • Size 4KB
        • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CwQg.exe

        • Path C:\Users\Admin\AppData\Local\Temp\CwQg.exe
        • Size 209KB
        • SHA256 19126878ad34e452969e35f711eca3345e64e8ef9f4f68c9c3fb60e4249373d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Cwsc.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Cwsc.exe
        • Size 412KB
        • SHA256 de55443de9bb03a968b3719da5b928dcf5609f40ecf33cd6d979332e2ebd2875
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EAcU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\EAcU.exe
        • Size 491KB
        • SHA256 51d8bdcb97a8e0d09d8a1f68cf25c16db8a7e7283fe042c09f668affe26ba005
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EEQA.exe

        • Path C:\Users\Admin\AppData\Local\Temp\EEQA.exe
        • Size 188KB
        • SHA256 3afd52139b85f5629d30205dce08f5f4562678f955402fcdc11481b70efb8a28
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GAwi.exe

        • Path C:\Users\Admin\AppData\Local\Temp\GAwi.exe
        • Size 210KB
        • SHA256 74f626455e7739361bc641324fe02e8629090ec445802449f2a690af930dae79
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GIgy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\GIgy.exe
        • Size 1.8MB
        • SHA256 45da3fdc6e69651c1b697460f34bc69b2942c2f6cf91f5e36d1698aee6eefb65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GQks.exe

        • Path C:\Users\Admin\AppData\Local\Temp\GQks.exe
        • Size 814KB
        • SHA256 e11799955d187e429e00078523ef80473fa521d80050f4da659a3917427d343a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GQog.exe

        • Path C:\Users\Admin\AppData\Local\Temp\GQog.exe
        • Size 487KB
        • SHA256 d425d16b9970752788c2619672921208b7ae201adfcebdcb0ca56a80407ec15e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GcsW.exe

        • Path C:\Users\Admin\AppData\Local\Temp\GcsW.exe
        • Size 199KB
        • SHA256 826b538174e785c1b62af21ec1d782bb4f263c5b916a6c884be1256e2cd07286
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Gcwm.ico

        • Path C:\Users\Admin\AppData\Local\Temp\Gcwm.ico
        • Size 4KB
        • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Goco.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Goco.exe
        • Size 198KB
        • SHA256 771a913c90bfee76882840c695ecb78a0ea6314b08cc3d6d289afadc029c0dfc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IIMu.exe

        • Path C:\Users\Admin\AppData\Local\Temp\IIMu.exe
        • Size 685KB
        • SHA256 5b922ec58b8224dff46b6c35b9d148c096679c941182d70d091f0f687634edfb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IMQy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\IMQy.exe
        • Size 205KB
        • SHA256 93bbedd9fa9c4f625ca6c037c7abcba887850b7bb780f3f410a1773508c7245a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IcsQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\IcsQ.exe
        • Size 554KB
        • SHA256 fce0b3ebc9e8140f8e9266b5daafb1c2c8161c73136c251b9611a72b5eeaca84
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Iosi.ico

        • Path C:\Users\Admin\AppData\Local\Temp\Iosi.ico
        • Size 4KB
        • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IwYm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\IwYm.exe
        • Size 225KB
        • SHA256 9a4f8b182482533964bb7e65d89c9bfd487399033522a98dcbc74ef3ae5efe9c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MUYa.exe

        • Path C:\Users\Admin\AppData\Local\Temp\MUYa.exe
        • Size 199KB
        • SHA256 dbf1c441c6f338dfc4ba5df6cabf75ae7c39e74ce82dd4f3b211b2a8672efba5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MggG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\MggG.exe
        • Size 501KB
        • SHA256 5876f22d80d39466c66a98f8272e28c8ba3fcf20476e73a5cea9c6f883d4e847
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OAEa.exe

        • Path C:\Users\Admin\AppData\Local\Temp\OAEa.exe
        • Size 1.0MB
        • SHA256 43d3cbb80e65ca312dc1885cb7e904e07cb84dbb1ec55f1486d8595158a220f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OIYY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\OIYY.exe
        • Size 402KB
        • SHA256 ebf067d247cdcd4d0f1d47ce58961b9a598214b1a4d4fdc4f0d9695da312a57e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OYoC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\OYoC.exe
        • Size 481KB
        • SHA256 6fe8f757a59debd91826362a8c1b07d1e84c2960ea92e6e9335fd364ef05500b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Okcs.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Okcs.exe
        • Size 799KB
        • SHA256 4c086f87cea8c66de711593f20969a0ce0cdd3f35140d2bfac84d222f1eec003
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OkgY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\OkgY.exe
        • Size 192KB
        • SHA256 21b85bd525c18f5a792bab2056f8398720d9835059b5dadbfd9d93ac5d0e34d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OoYU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\OoYU.exe
        • Size 546KB
        • SHA256 b09981d4b733dbcad9e0d250638167fdf16e7e95026e001cf3a1c30ebecd5ddb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Owgw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Owgw.exe
        • Size 187KB
        • SHA256 cbbd6274c05463f36eea8b505452fb38f9de71ccbfcad19fa9f1934c8da943d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QMok.ico

        • Path C:\Users\Admin\AppData\Local\Temp\QMok.ico
        • Size 4KB
        • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QgEU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\QgEU.exe
        • Size 492KB
        • SHA256 43b794bab7031a0098d1dbc4c2c1e4619d38a0c5c584bb4f8ecb1bc4289195af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QocK.exe

        • Path C:\Users\Admin\AppData\Local\Temp\QocK.exe
        • Size 326KB
        • SHA256 dd04260412a90d51c1df0939a53c91cd35651f590c9231fab9021a8eb9ba481f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QsAo.exe

        • Path C:\Users\Admin\AppData\Local\Temp\QsAo.exe
        • Size 862KB
        • SHA256 4c877c3f811fd0ae3b3f3783b2edd5db944c616cfe601c224d643142814bf3b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QscO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\QscO.exe
        • Size 394KB
        • SHA256 9174da2c7aecd776def2f250d7e1ccc5c36e65baae63ce6d8c9d0e981753d5d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SUQK.exe

        • Path C:\Users\Admin\AppData\Local\Temp\SUQK.exe
        • Size 197KB
        • SHA256 9bf8cb04efc6d0d15a0b9279c42285062fe090f684e69aadea6a75aeaf615ac5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UcYo.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UcYo.exe
        • Size 192KB
        • SHA256 6d5b30aa31547bcc4b0196dc06f3b758c000347579c90b53a786ccda33dd5aad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Ucce.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Ucce.exe
        • Size 638KB
        • SHA256 ec9bf5e05fdba5b91d150f5bf351cca6df0b4750bef0b6997f82cbd9f1a126c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UksC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UksC.exe
        • Size 195KB
        • SHA256 cd7b7f4746b13baaacdaae66dee6a1629c70d19ae6e57ef7a2ffa6dd26acac57
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WAQu.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WAQu.exe
        • Size 306KB
        • SHA256 aa10eef126d24e87ccfb93f29799c7425655174b8ebb8ffd94ce9d6e2fd80134
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WAUm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WAUm.exe
        • Size 310KB
        • SHA256 ab51529c9436a52cce69d062627aad7ac60fc6ab57918c3e3f344cec9af3c257
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WIoK.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WIoK.exe
        • Size 622KB
        • SHA256 0de9455445e96577bdb5b9607de24d8012026fee153b02925c8d00046b60a042
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WwQQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WwQQ.exe
        • Size 212KB
        • SHA256 156460e4d635f89f39c1f279ec93d1b7fea4c77ea1a854b21401d8199a8868ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YIoU.ico

        • Path C:\Users\Admin\AppData\Local\Temp\YIoU.ico
        • Size 4KB
        • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YMkU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YMkU.exe
        • Size 649KB
        • SHA256 901ff0ce7e55450e8bd66c63b26eee3533de779fd124900ec0961f67f2e0d47b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YQAi.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YQAi.exe
        • Size 210KB
        • SHA256 a77e27ae2f162671ae3ab814ea3405fc6715fc55544cc16b24199ec2bd7c8030
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ecoU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ecoU.exe
        • Size 633KB
        • SHA256 b902f42bdaa8d7b1259ea78bef725c8c4229f236cf1bb029940adbefc750aabc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gUMY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gUMY.exe
        • Size 313KB
        • SHA256 08e73ea49e3c2b0d2cee4abdd9d52d1ac44845836a8496696f474a207525baae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ggQG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ggQG.exe
        • Size 196KB
        • SHA256 93a17fdf3a6c6d69c373ea91a344da1408dde1597ad73fbabb6e2a82f2765bf0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gosM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gosM.exe
        • Size 334KB
        • SHA256 6e3aa4eefee3ae28b9f076bf1ba6e8df6d6763869a8762fc54ba398b09702d49
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iAwo.exe

        • Path C:\Users\Admin\AppData\Local\Temp\iAwo.exe
        • Size 631KB
        • SHA256 2d13dc02ec9b7a7d3ceaf712cfd06a11b9461622d600369a69a3980a078a9417
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iEYQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\iEYQ.exe
        • Size 672KB
        • SHA256 f181ce6d842e54befc9d48211abcafc4d8325e603e73bcda42cdaa07af9d1788
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iEoO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\iEoO.exe
        • Size 276KB
        • SHA256 cb541910ed07673e81bb48ae6195e5571fabc408e40730f79c42e35e48484fd8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iQEC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\iQEC.exe
        • Size 181KB
        • SHA256 82cd8556e8f31d8838fa384dbe7bba5d94966075729825edeb8b9e41b2c3d0c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iYsy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\iYsy.exe
        • Size 871KB
        • SHA256 87475484938990384c7a5d4dec2786a6d6370da08a161d5bdd7d3962a38cadea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icMC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\icMC.exe
        • Size 231KB
        • SHA256 55765b7959c7440db6ded6240b175f01c2641119a0b3a1fd8cfc3934e2e1c236
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icMu.exe

        • Path C:\Users\Admin\AppData\Local\Temp\icMu.exe
        • Size 581KB
        • SHA256 81f55a476f2e51751974c32182a080c2eed18a8a63f1b08ac78e4597c8fd9801
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iwMK.exe

        • Path C:\Users\Admin\AppData\Local\Temp\iwMK.exe
        • Size 831KB
        • SHA256 61a1511db9c2548f64a72a6328b96ee0cf7f59b1548f05a4454ba4acbb2d2dee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kEgO.ico

        • Path C:\Users\Admin\AppData\Local\Temp\kEgO.ico
        • Size 4KB
        • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kIYy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kIYy.exe
        • Size 729KB
        • SHA256 1748c54f3be40245b979674091d454be87169daf1f2a7665e8de40ecdaad1ca5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kQEM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kQEM.exe
        • Size 396KB
        • SHA256 a8eaadcd5a96201b1ee7f24d663c5436c03c2f97f6943338f31382a408a0ec2c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kYAg.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kYAg.exe
        • Size 848KB
        • SHA256 59536ec1f09720a23b1c56e38d1f2298c20444cfb3878cc8c2e5d6022f118cfd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kYkk.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kYkk.exe
        • Size 772KB
        • SHA256 773e78b3e04cdd40de08cee4dc846f510a356ca0dd816b91ae002bb031675d1d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kgIm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kgIm.exe
        • Size 193KB
        • SHA256 9d22823401640503c4a479be59d3b60fe69d6090de1c4b2de6179f4cacc73c76
        • MD5 SHA1 SHA512 SSDEEP TLSH

        koMe.exe

        • Path C:\Users\Admin\AppData\Local\Temp\koMe.exe
        • Size 190KB
        • SHA256 f07346c0f113792b83c45e2bb8cdafa3918631251fe6ccc5a48498c9d730a3a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mEAQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\mEAQ.exe
        • Size 720KB
        • SHA256 c0bd24434d4b25af282d7745df23af78aef12f9858ab753c15ff88be80cc6e17
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mIUG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\mIUG.exe
        • Size 802KB
        • SHA256 8c195eb1d262e9df015022964d69c62ef048f16c072bd2679793f6bf03e14caf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mMkC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\mMkC.exe
        • Size 353KB
        • SHA256 47f5f05610e873b83d098805a5db373c82a925113256d91e120ac2388e91fc1c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        oIoM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\oIoM.exe
        • Size 242KB
        • SHA256 46d1629a7392cb96da33ef2c225f349cb972c6db56bfe1e155b984496f5483d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        oMow.exe

        • Path C:\Users\Admin\AppData\Local\Temp\oMow.exe
        • Size 647KB
        • SHA256 b8bfdb4b96c32ec237c28b710187df28016de679be976d204dec657d15aad689
        • MD5 SHA1 SHA512 SSDEEP TLSH

        oUEs.exe

        • Path C:\Users\Admin\AppData\Local\Temp\oUEs.exe
        • Size 367KB
        • SHA256 d34abb9213cdeede56b574d2700ce0f448bb26fc7175965d48126ce35eef9442
        • MD5 SHA1 SHA512 SSDEEP TLSH

        oUMQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\oUMQ.exe
        • Size 832KB
        • SHA256 8828575827763f36f033b96f105ec7fdc5603443e645b47942332e5cce091d24
        • MD5 SHA1 SHA512 SSDEEP TLSH

        oUQM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\oUQM.exe
        • Size 185KB
        • SHA256 16c68099dd4385d39157e8418300a3d6326d857dc3af8571c6a0db0e541f0c9d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ockG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ockG.exe
        • Size 393KB
        • SHA256 830b396f98ecc4d8ec75e6c9fca80a0949e4bb9d087d9d8bde87e4a51606e683
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ogoI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ogoI.exe
        • Size 197KB
        • SHA256 d591c5408dbfecb8b3d9dbb30a899c4d35714d899793c5d1f7772f83f7658c06
        • MD5 SHA1 SHA512 SSDEEP TLSH

        okAU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\okAU.exe
        • Size 519KB
        • SHA256 e843ff42dc15348b23cf7004bc09af75e599a3f363950a0542d7231bcd7d6d7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        oowM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\oowM.exe
        • Size 984KB
        • SHA256 75436c7f0e05d2f6d08fa0413bc25f06579dfbe7b81d12ff0df6aa0e5894b21a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qgIA.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qgIA.exe
        • Size 200KB
        • SHA256 d87c6b67b2138126a7e94708a7df28455b1e8133d250964bc8cbc5768f96b260
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qwEc.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qwEc.exe
        • Size 640KB
        • SHA256 7ef0060aefcd8d0b7fcba9c0c661f61a52c52855a0ce851d74b5637a4f5417b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qwEi.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qwEi.exe
        • Size 529KB
        • SHA256 8da2a7edb21a5f9d5105a414b7c5b89e4b20542089703192e933afa5d8055d28
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sIww.ico

        • Path C:\Users\Admin\AppData\Local\Temp\sIww.ico
        • Size 4KB
        • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sMUc.exe

        • Path C:\Users\Admin\AppData\Local\Temp\sMUc.exe
        • Size 191KB
        • SHA256 d2de3e6631d9732307561b8fd5a2d4a82cd3e35b687e272ae1865a3d42b336ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sUoM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\sUoM.exe
        • Size 422KB
        • SHA256 c05b4ab219a0544857eb8440530e1127324c5c73d0753682cacf428865e52fc6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ssIm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ssIm.exe
        • Size 215KB
        • SHA256 a0a6d089e548ed56c13d765bccf0775cd928b44c037b6169e2cdc86ead6f0fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uIgY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\uIgY.exe
        • Size 197KB
        • SHA256 2c11e24575f7f7859c4b0d5ae4d2767c5bf20a8226a57e5cd2510182a487b67e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uogI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\uogI.exe
        • Size 417KB
        • SHA256 dc40bc5017a2389b143220fcca7bee995ab4447a01789f1bf1849f8945658192
        • MD5 SHA1 SHA512 SSDEEP TLSH

        usUi.exe

        • Path C:\Users\Admin\AppData\Local\Temp\usUi.exe
        • Size 454KB
        • SHA256 025552d4e207f8b51c616773d54bfea74d12e775d6c78a8b676d7af78cf0f195
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uwAm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\uwAm.exe
        • Size 1.3MB
        • SHA256 7afe28d3ff32ad606953e77c579b9e4c6248ba791f8eda3d270bf8fd76b4fb78
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcredist_x86.exe

        • Path C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe
        • Size 445KB
        • SHA256 4670e1ecb4b136d81148401cd71737ccf1376c772fa513a3e176b8ce8b8f982d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wQYs.exe

        • Path C:\Users\Admin\AppData\Local\Temp\wQYs.exe
        • Size 529KB
        • SHA256 b545267e69eb374fa90d51ed2a24dc1914144c27a7401543f7abb3e41dca2e92
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wUsK.exe

        • Path C:\Users\Admin\AppData\Local\Temp\wUsK.exe
        • Size 227KB
        • SHA256 7cbbd2da2b10d6454573a232cd8905e0cd26447702647faf457368db60fbb78e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        woge.exe

        • Path C:\Users\Admin\AppData\Local\Temp\woge.exe
        • Size 310KB
        • SHA256 1c2a84b3435ee9994a0eb0760221dda642500ef1c718cfb2de00f489855b0c3a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wsUe.exe

        • Path C:\Users\Admin\AppData\Local\Temp\wsUe.exe
        • Size 1004KB
        • SHA256 0509375aabeea282e384bf76e055368359bff7a0a9eaa65c3ab03c22d3742cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wwkq.exe

        • Path C:\Users\Admin\AppData\Local\Temp\wwkq.exe
        • Size 190KB
        • SHA256 93bda7ef8cb24fc3e6f34db3dd2da560a2444472bb338bb31e6d466c3e925f92
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yIgE.exe

        • Path C:\Users\Admin\AppData\Local\Temp\yIgE.exe
        • Size 1.3MB
        • SHA256 e2cc9cf72554ba4bf802060093847738e70de72134235cb1b9e899217334aed2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yUsg.exe

        • Path C:\Users\Admin\AppData\Local\Temp\yUsg.exe
        • Size 678KB
        • SHA256 ff5e901994b6c9df3f0c75ebb2e5f8774dae0b835b00b69cd441b2f057785547
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yYgG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\yYgG.exe
        • Size 904KB
        • SHA256 874e788dfc7b01e7c30e514b5b24c2dc6e8bf8650c1750f1cd0e473225b325bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ycAG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ycAG.exe
        • Size 339KB
        • SHA256 cc3184a02052184e3a63934d3e6aeb358cf963e9a65e55bf88668affb8c5d40f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ykMe.ico

        • Path C:\Users\Admin\AppData\Local\Temp\ykMe.ico
        • Size 4KB
        • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logo.png

        • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
        • Size 1KB
        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
        • MD5 SHA1 SHA512 TLSH

        wixstdba.dll

        • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll
        • Size 126KB
        • SHA256 7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VeUccQoE.exe

        • Path C:\Users\Admin\qIsEUMoE\VeUccQoE.exe
        • Size 183KB
        • SHA256 aaccb2da24a88a0f284bdc252410dc14fa490b317580c950449293b7c2b9709e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VeUccQoE.inf

        • Path C:\Users\Admin\qIsEUMoE\VeUccQoE.inf
        • Size 4B
        • SHA256 16df1976f614a09d3cb3412a9cb634c692fd20e3d925636dd74bcaeaf18f99ef
        • MD5 SHA1 SHA512

        VeUccQoE.inf

        • Path C:\Users\Admin\qIsEUMoE\VeUccQoE.inf
        • Size 4B
        • SHA256 3cf335a74c0a9089adc1dd847215affec52be98ebe1e00b7c454052c262a6cd2
        • MD5 SHA1 SHA512

        VeUccQoE.inf

        • Path C:\Users\Admin\qIsEUMoE\VeUccQoE.inf
        • Size 4B
        • SHA256 bafeff18d3a0349056357f031bee50b88ab4e3b34ee060b8253881a29caa3e36
        • MD5 SHA1 SHA512

        VeUccQoE.inf

        • Path C:\Users\Admin\qIsEUMoE\VeUccQoE.inf
        • Size 4B
        • SHA256 b88dcddb4d5f66c5a9f044cc7499e6b40155f88506248dc47c19a30f1c6e02db
        • MD5 SHA1 SHA512

        VeUccQoE.inf

        • Path C:\Users\Admin\qIsEUMoE\VeUccQoE.inf
        • Size 4B
        • SHA256 45c6603ec0edc50ad0285e69282318129d166925eb7772aac8a771575c776619
        • MD5 SHA1 SHA512

        VeUccQoE.inf

        • Path C:\Users\Admin\qIsEUMoE\VeUccQoE.inf
        • Size 4B
        • SHA256 2453d210b2c30366783fff19d90f0c1fa84d5d1846430da3bc0d1b3041cef9b6
        • MD5 SHA1 SHA512

        VeUccQoE.inf

        • Path C:\Users\Admin\qIsEUMoE\VeUccQoE.inf
        • Size 4B
        • SHA256 3a22e25f9a96b514d964656bbf1cad6c7441900ed6ca4a7ad20f9ec488c52283
        • MD5 SHA1 SHA512

        VeUccQoE.inf

        • Path C:\Users\Admin\qIsEUMoE\VeUccQoE.inf
        • Size 4B
        • SHA256 43b9646e1468de3aa1079134ac2e781c7774a5783b3657e7f3b228b4fd77cc14
        • MD5 SHA1 SHA512

        VeUccQoE.inf

        • Path C:\Users\Admin\qIsEUMoE\VeUccQoE.inf
        • Size 4B
        • SHA256 fadb1e75b1bc09224745ccd0c003ced04398e811853a24a8f492df3a8c267ef9
        • MD5 SHA1 SHA512

        memory/800-1457-0x0000000000400000-0x0000000000430000-memory.dmp

        memory/1040-17-0x0000000000400000-0x0000000000430000-memory.dmp

        memory/1040-1447-0x0000000000400000-0x0000000000430000-memory.dmp

        memory/3652-1452-0x0000000000400000-0x000000000042F000-memory.dmp

        memory/3760-0-0x0000000000400000-0x00000000004A1000-memory.dmp

        memory/3760-21-0x0000000000400000-0x00000000004A1000-memory.dmp

        memory/5584-1442-0x0000000000400000-0x000000000042F000-memory.dmp

        memory/5584-9-0x0000000000400000-0x000000000042F000-memory.dmp