nabucur | ac1e51d920c236d54c1f13c89f0ae686d2b483fcbce6dc962be52893351c5eb1

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_9dce690fe290bc8d4bfa970789f0dde2_elex_virlock.exe
Size 596KB
Sample260802-af667sag53
SHA256 ac1e51d920c236d54c1f13c89f0ae686d2b483fcbce6dc962be52893351c5eb1
MD5 9dce690fe290bc8d4bfa970789f0dde2
SHA1 0f5f63922740091e41eeea6669d9d2b12e91ebd5
SHA512 fd0b3ad265767408b9228e69b22d251a27c3fdff27401245a203e9f04f2624fc9add2cf256842cb031e40c808fab63c50dafc0278c43bb439087628bd273db56
SSDEEP 12288:omPPus7MWjG1kSehYBQ+cmYxxpAX2lKf:7PdwOoeyTWLUWK
TLSH
T14AD48D9FE41CE15DCBF119754CB7B1C06688E27C7AD5096CFE48A01790B502E7ABC8BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan

Malware Config

Signatures

Family: Nabucur
Nabucur is a ransomware first seen in 2015.
ransomware nabucur

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Executes dropped EXE 5 IoCs

pid	Process
760	cCwoksEU.exe
4960	WSwswQAM.exe
2508	setup.exe
4596	WSwswQAM.exe
4136	cCwoksEU.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\cCwoksEU.exe = "C:\\Users\\Admin\\dWEkQIAg\\cCwoksEU.exe"	2026-08-01_9dce690fe290bc8d4bfa970789f0dde2_elex_virlock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WSwswQAM.exe = "C:\\ProgramData\\twUMoEgU\\WSwswQAM.exe"	2026-08-01_9dce690fe290bc8d4bfa970789f0dde2_elex_virlock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\cCwoksEU.exe = "C:\\Users\\Admin\\dWEkQIAg\\cCwoksEU.exe"	cCwoksEU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WSwswQAM.exe = "C:\\ProgramData\\twUMoEgU\\WSwswQAM.exe"	WSwswQAM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WSwswQAM.exe = "C:\\ProgramData\\twUMoEgU\\WSwswQAM.exe"	WSwswQAM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\cCwoksEU.exe = "C:\\Users\\Admin\\dWEkQIAg\\cCwoksEU.exe"	cCwoksEU.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4148	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1100	760	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSwswQAM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_9dce690fe290bc8d4bfa970789f0dde2_elex_virlock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cCwoksEU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cCwoksEU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSwswQAM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
824	reg.exe
2360	reg.exe
4684	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2960	2026-08-01_9dce690fe290bc8d4bfa970789f0dde2_elex_virlock.exe
2960	2026-08-01_9dce690fe290bc8d4bfa970789f0dde2_elex_virlock.exe
2960	2026-08-01_9dce690fe290bc8d4bfa970789f0dde2_elex_virlock.exe
2960	2026-08-01_9dce690fe290bc8d4bfa970789f0dde2_elex_virlock.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2508	setup.exe
2508	setup.exe
2508	setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 760	2960	2026-08-01_9dce690fe290bc8d4bfa970789f0dde2_elex_virlock.exe	88
PID 2960 wrote to memory of 4960	2960	2026-08-01_9dce690fe290bc8d4bfa970789f0dde2_elex_virlock.exe	89
PID 2960 wrote to memory of 4148	2960	2026-08-01_9dce690fe290bc8d4bfa970789f0dde2_elex_virlock.exe	90
PID 2960 wrote to memory of 4684	2960	2026-08-01_9dce690fe290bc8d4bfa970789f0dde2_elex_virlock.exe	92
PID 2960 wrote to memory of 2360	2960	2026-08-01_9dce690fe290bc8d4bfa970789f0dde2_elex_virlock.exe	93
PID 2960 wrote to memory of 824	2960	2026-08-01_9dce690fe290bc8d4bfa970789f0dde2_elex_virlock.exe	94
PID 4148 wrote to memory of 2508	4148	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-08-01_9dce690fe290bc8d4bfa970789f0dde2_elex_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_9dce690fe290bc8d4bfa970789f0dde2_elex_virlock.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\dWEkQIAg\cCwoksEU.exe
  "C:\Users\Admin\dWEkQIAg\cCwoksEU.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 1244
    3⤵
    - Program crash
    PID:1100
- C:\ProgramData\twUMoEgU\WSwswQAM.exe
  "C:\ProgramData\twUMoEgU\WSwswQAM.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\setup.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Users\Admin\AppData\Local\Temp\setup.exe
    C:\Users\Admin\AppData\Local\Temp\setup.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2508
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies visibility of file extensions in Explorer
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:4684
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:2360
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - UAC bypass
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:824

C:\ProgramData\twUMoEgU\WSwswQAM.exe
C:\ProgramData\twUMoEgU\WSwswQAM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4596

C:\Users\Admin\dWEkQIAg\cCwoksEU.exe
C:\Users\Admin\dWEkQIAg\cCwoksEU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 760 -ip 760
1⤵
PID:4804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WSwswQAM.exe

Path C:\ProgramData\twUMoEgU\WSwswQAM.exe
Size 139KB
SHA256 ba92c7704edab5e36e66036cc9bb53f9e5fc29bb9be08bfc993b83b63ba764a4
MD5 e37646407c1308e670bff5565bb076b8
SHA1 1ceb266730586dfdc9c3ad12962655ea5aadd646
SHA512 07d848de5b0c6b1fea506fcd62bfbbd0d80259e271f998be243e50d434a222b3a0d6a289e952a13eb6e5dc94f90f2f54b588f4d7c452a4476d309c773830297c
SSDEEP 3072:iKWhT6MB76SasKya/A6ysIx7IgsfhgWhkcuBJ1x/V:pWWMBuSfC//t8sfqLlJ1R
TLSH
T1F0D3E187019D7FFFD8D64AF2D9D0C39922B58D746B62FE64D4B1488CC90BE8A21893C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUgc.exe

Path C:\Users\Admin\AppData\Local\Temp\AUgc.exe
Size 767KB
SHA256 adf85b395c56a34ce6f5bbeaf54d76324800cfee98b2945c17171e2d77841728
MD5 524b2b17a542dfb4e6f8d76643f7fb63
SHA1 44f52aee0782e014e9b73924b67f8e3e4fc555e0
SHA512 0ffaa170f969722ff4f86377a681e5d67e60f768176df85c9c5ca4bbd4fb237d47d8202a14abf4c4f8506080ae5eca755b804f1a5fccbd1ba66428f7d6a57ffd
SSDEEP 12288:/M7V7peBqpM4B99spSUczNufqD8DyoodhF4wibp9CtgNJ5zd2PY9p16VLB+8JlfZ:/M7dpqy903wibp94gNJ5QA9yVLPlfgWR
TLSH
T16BF4DF514F508FA8F1C2D6914C0D2A4F3E0939C47293A11FAC9F99DD85B5AEE48BB2F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CMoG.exe

Path C:\Users\Admin\AppData\Local\Temp\CMoG.exe
Size 153KB
SHA256 bf9b2789a6cb73150898693ba3c7ebe8cabd2151bf11f995805fe8615bcd91fe
MD5 47318d3f25a2834ee0039ac50235f4c7
SHA1 0a46dc59ac478b7d748d6e6d5b94ffa3d8209bde
SHA512 a12f62f30a1d872d2325bee38a8eff856f23a9c7873443dcdae17ea969134a794761d1045ab3c93d840889d479778d9f62891b1e128b17ad558a8211c560d27b
SSDEEP 3072:K/ErdoDcZ+ZNdE0OOXjB9Q3JwF7cy1u2hB4BTZdX:K/ErdoQKeOXF9J7XBOBFd
TLSH
T1A6E3E1395FB44A24EB06F5F4D85DB822D24A82D9E771AD8BE5C8E35CC06C6C8942F31D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUkQ.ico

Path C:\Users\Admin\AppData\Local\Temp\CUkQ.ico
Size 4KB
SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
MD5 ac4b56cc5c5e71c3bb226181418fd891
SHA1 e62149df7a7d31a7777cae68822e4d0eaba2199d
SHA512 a8136ef9245c8a03a155d831ed9b9d5b126f160cdf3da3214850305d726d5d511145e0c83b817ca1ac7b10abccb47729624867d48fede0c46da06f4ac50cf998
SSDEEP 24:su1Flj/XygwYAaMiM1E2/pkQ14btLH3RJigg1Kjq:vFlj/XygFA28BRkI4btLHhJigg1Kjq
TLSH
T1579127351B08C4E4EC5AA53182A706F708AD2CC3D1B4D47B52F07D7EAF33B72691166A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CYYe.exe

Path C:\Users\Admin\AppData\Local\Temp\CYYe.exe
Size 142KB
SHA256 f10fcf66bff0d5f15a15f75ffc812cd8c4cbfb1d21f01d59c7f749577ab2fcfa
MD5 371145a9f9a5fc7accaf25338f8a8609
SHA1 eb9c6021ab2f1478b20f69fdffe055a4613520e2
SHA512 a443c7faa9ac953fc9031377f30adfa328a399adf6061faf01eb46617228cdef136ecaa5eb431aa3237a3463ba7b18219d99708a2120b3a663638c0c54648204
SSDEEP 3072:nJHfEx1qSGSjmhli7hhMIGNoPbP7OFpsKZcP7fOR3kkkkkkkkF0dNUuep:nJElG77g0INL7OFzoep
TLSH
T1B2E3CF43D5EF6C8EC15A21BDB85CA51BD84C8042A0A46F5E83BD4C6DA4E8B05EF7B71C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EwUs.exe

Path C:\Users\Admin\AppData\Local\Temp\EwUs.exe
Size 591KB
SHA256 ffbaf61512801998a2b89306d9e99196e86a0d8bd8e6008fda568269f6e48c5a
MD5 3bef40ea4f38d1744b2e3f346095c76c
SHA1 d2391e2fd595d8f10749fc6e5d353cd959e7b3d4
SHA512 75cd74820782a878622690db7ba4277172efa8f98bd0cbada2b9aa61211f4f14189e375704540f5a3d8e8fd586c7a958fcd8c70d8dd6117ffde64d664782bac8
SSDEEP 12288:Bf1KBbxleUD8luHNO6O7zPMdMJ62eb3UH:90XleUDyKO1/JEC
TLSH
T141D4E0D9490E2C6EF481E6F6A97940E32D0ED3764999DB6D843093702A36E70B7BCD34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GgYe.exe

Path C:\Users\Admin\AppData\Local\Temp\GgYe.exe
Size 747KB
SHA256 25eccbf27897a3462766756a554fda96e06ac0a3e932a6f925e65e15b8e3d0d6
MD5 b387cf85ed04d61bba44e6dcb2ee3d84
SHA1 55de21809ed7ccb3774a9ef0e3e0f9c2432cb698
SHA512 70c04e54d14ca28caacb9574b745579c1d981ad27cd47735f93570c42dad38ed8a7078c22940027dde43fbb89a8e31680de404a7834858aa43d336b79af3033b
SSDEEP 12288:i/Hm4s2b9NtsJG1UgwI8qcg+NulCk0HeTv86xg0bgyeMWYX82ABNBCp4bNxRZi3i:i+Zq9NCJkL8fulkkk6VRsTNcp425Dc
TLSH
T131F4DF5F083D48569C7873A6D4B440F2DA40DBC49990FE04B65A6A53C7AB3FF2EB1329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GsII.exe

Path C:\Users\Admin\AppData\Local\Temp\GsII.exe
Size 134KB
SHA256 861d1c644793696c99a762affddd35da07e6921325c6692da2c719773c24e031
MD5 7a2190e586fa44eaf405e8b86bc6903c
SHA1 de4f9b137a619c46f447c048bc54e86166de82be
SHA512 aec21fc0ffa9cbddc9f785e8c04bc8f3f399761c5a2a0d0c0e85814fb114edaacb4d5effe0672e8ad0d888999344e4ba9cee8fafc77a45eee4c361a2263e1433
SSDEEP 3072:Y8ueWqHo7zoJcut/AgXbSacPY7oBb9lcBQD8tQ8MR3O5847FWIXAA:cezovqt/tuU74HQQD6I3y8474cAA
TLSH
T11BD3CF1F18132F9ED42DF9B8144FCC5A5272B2061EACBD172DD56726BA3C613F932682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GwQS.exe

Path C:\Users\Admin\AppData\Local\Temp\GwQS.exe
Size 134KB
SHA256 bd256721d56988080526884cc46d648cc5098544b1bef48cb8436e4cbe445372
MD5 0eab7adc4e7d4d0e86870a29a32b2d9c
SHA1 15f96fd31b8abe3a08a61cc9e40c17945e7dae99
SHA512 74e583d6481edb0eebdade376b797aae930d51d3f962d86a39a9ca7dc20d10bf787afb5acd1f3e6c47b324495850dbd31ef208b42b3bca4687a804ec6506cd1a
SSDEEP 3072:jg1DgwrWlsZdeSOWcJujmdFGlIZBW1Qej9W1g0/yMC+d4iMRaS7i:kDgOMsTexWcJymDuQk8LdHMAS
TLSH
T1A6D3D176447A1EFDC51EE3BE9CDBE45BA438B5124112871DEF437189FA3B72049A3205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KIAe.exe

Path C:\Users\Admin\AppData\Local\Temp\KIAe.exe
Size 250KB
SHA256 8b818e0b10d9875040d8bcaa1c532cf500b93dae733fc506f1f293b71dc5bea2
MD5 3aa47d03e8625aabef1019d32b8ab740
SHA1 73d31a944c23bc1408e16d055e4c5acf7f19ad1b
SHA512 77d8cf7665ef82146f9c7a0f938f0f4d3dcd6298d69a1c858f6a22e05ff75c11b907861e674249f7c3f2aeb2bc928cad07fd2305441d3a384ba5f4ebaa0a38c0
SSDEEP 6144:ud+ARnb8rcPB4jupHaL1hMYjU8ekSLlTl:rAicPBPpHaL1hHN+l
TLSH
T10244013BC181F689C52EDC3AACFE55C7658798840E46CBC4A2C7DBF3D4914B4172B26A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OIYI.exe

Path C:\Users\Admin\AppData\Local\Temp\OIYI.exe
Size 161KB
SHA256 7751d6be0e4055e57fb913bad794b68f1e0ce237de8f44e5c270e7ed3b0559e8
MD5 794e76743cdaa639e8481e77eaa87962
SHA1 468750358e924ebad70956b9afd382e2fc91e36d
SHA512 bbf7bd1e3a16301c5ed20ae7964af27e364a36948a8580c6b4d07dbcf7e1e48492a9b3bda84889d5822b919bc519a0257e63bbd95f70c953fb9236d42cf7b298
SSDEEP 3072:UnrLR6MSqJnGe1zD3JHdXiHnahbJQqvsf+y6aBKAmpMCISPyT3hwf:wh6MSqIyzd9y8FPEGkBKxCCkT3a
TLSH
T120F3F13E6208C60FC6BD717B8976C8156131D59E4BB87D2E00D0FDE997DAABB48F0168
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OYse.exe

Path C:\Users\Admin\AppData\Local\Temp\OYse.exe
Size 513KB
SHA256 2ed9949c0b6e2ee8b940d6c17b737520eaada4b5a54c1d571f7da0b5ce57c8a9
MD5 3c5e3a619b7222f1f0f7d994f79727ef
SHA1 813e94f1933b660d07dd88eb77f179e3bb8c2979
SHA512 b298db93e5f7dcc597a0ceadcdc14d54be3c34865c916e7b63d33c71d4caece4ca661b60d42d555f9e9c1a3884190b56846d7a987592317b7fb3f75611ad6932
SSDEEP 12288:/8cYhhgASxPZNlMlUDML8dRsHPWnVua8Y5HMDIll9WfQ:zggASxxOOML8dRyPWnVyYtMolGQ
TLSH
T19EB4122786DF1A0EC6BEEB7C4C4505E817D90903DBA82E5451E2F32CE1CBC4299B99D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UUsw.exe

Path C:\Users\Admin\AppData\Local\Temp\UUsw.exe
Size 149KB
SHA256 1aeeee96553b70cc3285550ad37521fbda49dd9ee125c7d169fbd47e58e890b6
MD5 ffdc67db1185827b6eea9742dc9a6fe9
SHA1 14d404d415894026da2b948cdbcda20ed3af3075
SHA512 c740a88cbf0547fbcdd0f35ea99f9b85fd647588a4d12f8356cd376033cde932a2cea168c6536f05191edc784fe94e24a9005d0cd6e9ebbaa41c78b0aa0aa014
SSDEEP 3072:Jql3fTJtt3NcA3yGWkUwouPiniL9IZnw4dSJ:JqlPTJttCA3dawowUw4du
TLSH
T10FE3E0FE38142C1ED90696FC41E577318627D83AFD91DD4DB1D2A5DCA878A3C0A82E4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UwIO.exe

Path C:\Users\Admin\AppData\Local\Temp\UwIO.exe
Size 138KB
SHA256 9d28ae5de4d8f8f73fe6665d105e2ca6fd335e72a3382c2091e57c7310c05336
MD5 213341cdb2d287ca7e6d59801607d7d1
SHA1 628feb3ade648b74e97aad0d02ce0504d6c12413
SHA512 cfec3e508f15ce99b0e0dcf3f72b38c919c45920c26e5c32795da9d0238fd11e2667cec60367bdf8952402222078ff8a0c7e43a07e11e5cb584124f85d3ded8c
SSDEEP 3072:kaUkxA3dqqjyC6H/Bp/DDtSi3Ycjj11GINl:63dCbH/r/DzL311G
TLSH
T1BED3D01F814106DED685A7F2C241AA56CB6350B1F88CCCA955D84DFCAB7DC2EF70E21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WYIi.exe

Path C:\Users\Admin\AppData\Local\Temp\WYIi.exe
Size 598KB
SHA256 d7f34e574d81882e2f0c9740bb01debd631c471910c25811bd5dc3e095a36a4a
MD5 f3a531381d381a3d139d16b65169cff1
SHA1 bb743a20d592540f3f4541fa964da20854cdb262
SHA512 39f5970eabf78ab08c05e610e154616844b0f2fd8693b5ffeba9a990cc86b5cd0f9734f944763ef168f797fe2135c3a4eb12189eef4775ac503abd4623bc4f38
SSDEEP 6144:Hw8qFOINpOm/sArPneQ70Haow4rAkN0LY4IjS2gh8x7FHDQsPlDdtVVEutMgraD5:HMN/rmA06owOjN0BIoh02s/tVsiuGV
TLSH
T102D4BEF76D86F2988E8081255FCA46CF9A1A37C745610CFE4AC4F4CBB039F06E16D999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

akEq.exe

Path C:\Users\Admin\AppData\Local\Temp\akEq.exe
Size 165KB
SHA256 8dc7f0458db11095a18fb8c64c61df41607cf5cbbd67dd8fa06bbbf6d21fabcc
MD5 37242e889629d7b09899e29cf3b08e2d
SHA1 c21429a002a32fcc70b32350ffab57d11e65aa08
SHA512 5591ca0e90b972da93c8ff70f56baf556c5e09522dc04bd00e4b401ea8d3fb0241b4e023fb1dbe94988cb753c8ed3afdcf9aa63281aa6586d926ad02a87ef888
SSDEEP 3072:hXj+4wpvom7lCnx7sgB0rmwUfVxOLDIvRueR8DtzvOeRG:Bi4wp5cxgNDUfzjpoBzWWG
TLSH
T197F3D01B4698126FC9FD4CF9E3016E4685BDD802E4909DB4F3F98D8BC4E386B719960E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

awgS.exe

Path C:\Users\Admin\AppData\Local\Temp\awgS.exe
Size 736KB
SHA256 edf14b84414c4dc42a9c949db6845e7b456407810e7a59e62ba29c9b9879a036
MD5 96c311b184034f6e0ca662ad10d2a5bb
SHA1 b9d2e4f9eaa0e0deafc03d6ce578f9e333a1a35d
SHA512 d15e799e722db98b64298ca20c44ddd22f078440abd944d4934c6ba5c6b454201d436b11ea5e9e4038a3a0fd3262cc031b8f8df6ff6b4c415b13af87e16a9617
SSDEEP 12288:KxPBU+YwsYZ5VIsNDd+BCXhCkJNQ2/uJkHXwNIuRVJyEFKB3JBDrc+:WPoQZrTWCXhPQ2/uNpRit5JJr
TLSH
T16AF4D0B7B0487C89E4329CB7D93352669369C9037130F4BC6EE67A6283BAD38947DD05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

awwC.ico

Path C:\Users\Admin\AppData\Local\Temp\awwC.ico
Size 4KB
SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
MD5 6e9325e46193ec554308cdb9ec8a9cd5
SHA1 3e3c4a52ed1fd3a85f8ab172108c8fb61e45f70c
SHA512 071ece6913f89a4b1634daa9d650bfa8f9f406719c124a3819cbdd3cb617af419abc6010283dbb510891e9744ce03cadcceea7b137395c538f42df838b1f6322
SSDEEP 96:5wwwwww6W/rQPIEXv6KvzVqzd4sJvbZwwl/j+jNj2jly9:NQrXvfzwzRu
TLSH
T1C4911623531D1CB9FD2405F1ACF89A75A59CBA0153C63C642DEEF80F69AE8C69AF2444
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cMsW.exe

Path C:\Users\Admin\AppData\Local\Temp\cMsW.exe
Size 148KB
SHA256 788f98e42752c5ee41b1a10bc6c48027ee99fa0f6297f5f60cf986abc6980632
MD5 37d4c084c232f13d09126e7c1ce36c3b
SHA1 7c39a57f2ffd07fefc8cd266cd135a9e8624159a
SHA512 95173aa6140448afbff61d817c7f91431a1c4b17fadc00a2f1ae039069164b93ca0ed5020ed0c5023aa51d864edcc08a13b8c68be7004b84aa43d87614b644d9
SSDEEP 3072:n6+czKtgvtwdxyjRizq+OG2LQmek3+iGtQH4PvPP4B59ehQsPrzhR:n6jz7vtwdxyjtHek32tQHGH4N6QsP/n
TLSH
T1F8E3C0AF12E3490FC6A210F8A36F0595C2A4D0DE292EED4794EE7C5CF64BB4750D9B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coMG.exe

Path C:\Users\Admin\AppData\Local\Temp\coMG.exe
Size 180KB
SHA256 aada65f77b8d06f88d41f547f70482e5391da77e55e0a6d5627f982580433570
MD5 16314f3bcf1377634dd0f8334085eac4
SHA1 23d572cbe061eba99312c5473304efdfe0ee1285
SHA512 51de00af57940934da10b5abda06a4e52eaa499ba5052419603b1f0462958e7ef27087889cbb1f8f3df65b25a51ad87beb3f6a42e3dc1e0c63bf0c9143532e24
SSDEEP 3072:G+tuCdIbWzE1lSTDZR+eK3+LhufTf/esImubTfFYBW5kVW7oIC6vtZXW3EUlz7SZ:3tiiA1leNEGleTfjiTdYBZkRZpH
TLSH
T1F504D00FA35DB29FD084B0B601102B2C3267C5851B62EDDEAA6F6E08BDFF91513E5785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kAwg.exe

Path C:\Users\Admin\AppData\Local\Temp\kAwg.exe
Size 140KB
SHA256 0d5e1042ffb4e1ac7468bdd7f7df35741db48a19af92f3d435233acdb940e2cc
MD5 7a34fb6c1e7b69eee4ace159099b7d25
SHA1 258e72f99308111933c87330a365de8ad3b38c79
SHA512 a1ff4a947e66cc7da7cd8cc53129be4ee3eee23c4b84ff26faa4503209059a5d918c39f4ad873528ae3ba30b3535f25afb54909965a37fab41af2d959133b62b
SSDEEP 3072:iHrS9lpC8QrldutPOwfm8X9hY4DyFOW+m7dCW0A5wzD0ThOlLowq7MMfw:iH8C8QrzEPOnS5Dsl+6CZApglLow6w
TLSH
T1D9E3E1E9C28857DBF18E5DF4A682A424C14375127BAA2C4FA4E5FCDB08FBA215C0F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oAYS.exe

Path C:\Users\Admin\AppData\Local\Temp\oAYS.exe
Size 763KB
SHA256 5e3c1f2abddc541a3f54dcb88e40cf4961717b62a8abc33d591364cf2c8438b3
MD5 5d89ab0300153ee4ad4767aa558db55a
SHA1 3610b7154d064005799c73ae4aa842930693d993
SHA512 72788e4d151d2c4188a2f56404231730ac95c0bd20567349a89d52ca31190506cc5bfda8e1902584de8ec46094efc9414fe3f7a60b64d5f5148ba8195d4c83bc
SSDEEP 12288:gGL3S+2SeiIujL5iAHpdjMGHRcaoQMX0rEPj8UJRmv0gyKHo/vg5tAt6pblN:gUS+2SeiI+DdFjfMXlPj8Uny5jAt6ll
TLSH
T15AF4E0082FE967378B813D36FC25501ADAE8560427A911F78B2CF1875B71D73ACD728A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oMwE.exe

Path C:\Users\Admin\AppData\Local\Temp\oMwE.exe
Size 538KB
SHA256 959b7b656cf2e8c69b051da5179add50d2c74f61717e7d00de33ae9da4b95033
MD5 3aec47671b138b0eafd7c52f961b44e2
SHA1 1d27b2580c59c1d7f148359d6971a3e95c4b44b5
SHA512 9468d94cc9c415284df99ab084f63a66a4400c80090979e90fba8f48e25fd9c8fc00b572070cc17a9fcfd4fd5b5dab3920b19daad3edf5f3e6bbd62d2a6838b6
SSDEEP 6144:GeNBX3MBwPLyI+vRA1eWKTOBhRxV1QG3u/:GeZjHoR+26BhRxV93u/
TLSH
T1A4C469DB0D07BC6EC0BBA5F6FE94308D1AD49485362F8F8A1BC8DDE4045DD7A9A47182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\setup.exe
Size 453KB
SHA256 d2893c55259772b554cb887d3e2e1f9c67f5cd5abac2ab9f4720dec507cdd290
MD5 96f7cb9f7481a279bd4bc0681a3b993e
SHA1 deaedb5becc6c0bd263d7cf81e0909b912a1afd4
SHA512 694d2da36df04db25cc5972f7cc180b77e1cb0c3b5be8b69fe7e2d4e59555efb8aa7e50b1475ad5196ca638dabde2c796ae6faeb4a31f38166838cd1cc028149
SSDEEP 6144:s78n5Qw0tneDA/sqhleIc0HftDrkYY1hj63hgDonsogCh6NEpAFM:G85bM3npxYfj63hgD1ZiL
TLSH
T156A4190277E99135F6F31B31AEB592615A7ABC729D35D20F23C41A0D0DB0A90EA75B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cCwoksEU.exe

Path C:\Users\Admin\dWEkQIAg\cCwoksEU.exe
Size 146KB
SHA256 8b0d04e81aa4b9e1690459756e4cdd10398b17da187fcdd8af47ef67d703f8c0
MD5 82a81f31b7fae559caf068d5ebbfeddd
SHA1 cea337b7c639683b95e988323e93c1f7a7b50833
SHA512 80a5f00fc7691cd7e8c5908eced78db809625c6774f80fc15c25a1fd3e7a1d18e904178624dd6588f4116badc961ae6b9a40e41cd3f5cf8064926d5b11ff4095
SSDEEP 3072:0OnlR8/2mDbWIMIsY4hnfRRZpd+12eoDTxTjiTt4fWVIxfWTH:jnlKPbWICBZTpi54fWVce
TLSH
T18BE3D0BBCB0558DFC22176B15F6D3D1E3904E036E9704ECDA1D2FAA6C18EA351A8875C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f.inf

Path C:\Users\Admin\f.inf
Size 6KB
SHA256 b324b01585722cabe06579111afec91be80871bd0d18a5360a6deaafe007f67e
MD5 7e82fe93d74f6b19083981b6834d7741
SHA1 58707decce0a57779596c56b5f772f777b2d3e36
SHA512 6e4526f4da65716e732bcced1f7fcd86fb913f98f5987ba3b29f36cccd90ef1006b5030afd84fbaa3647993946a72d35db8d86012b7a67f7f5e773bfe513bec3
SSDEEP 24:gM/0Imx8X91dqQgqyowQgwyozwVqVdqQgqyowQgwyofwVqVdqQgqyowQgwyo+wVv:z9h5hFhAhVLc4ZB+2PH+bpiQPxAxPmn
TLSH
T16AE1983B981A583B54B6D278E0D30567F6C01567744CAA2A50FF43A64BE72037A832EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/760-9-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/760-305-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/2960-20-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2960-0-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4136-308-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4596-307-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4960-17-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4960-306-0x0000000000400000-0x0000000000424000-memory.dmp

Download